@unbrained/pm-cli 2026.6.30 → 2026.7.1

package/dist/cli-bundle/chunks/{chunk-JZG5ADVE.js → chunk-NU2UEROZ.js}

@@ -1,25 +1,25 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="cf3d5e72-2400-54df-b34f-c84fd2383853")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="bfb4fc80-65a7-5c83-b180-b171fcfa4f33")}catch(e){}}();
 import {
   splitCommaList
 } from "./chunk-P4SESZGT.js";
 import {
   ensureTypeFolderScaffold
-} from "./chunk-WTRUDJ3R.js";
+} from "./chunk-2D4HATP2.js";
 import {
   buildExtensionDescribeResult,
   scaffoldExtensionProject
-} from "./chunk-T7ZMQI4J.js";
+} from "./chunk-6AQZPVHQ.js";
 import {
   normalizeExtensionNameForMatch,
   normalizeManagedDirectoryName,
   normalizeStringList,
   parseExtensionManifest,
   validateExtensionDirectory
-} from "./chunk-C2KCIZKZ.js";
+} from "./chunk-4A3BJ675.js";
 import {
   nowIso
-} from "./chunk-KRASIL6M.js";
+} from "./chunk-AXIDKKAT.js";
 import {
   EXIT_CODE,
   EXTENSION_CAPABILITY_CONTRACT,
@@ -40,7 +40,7 @@ import {
   resolvePmPackageRootFromModule,
   resolvePmRoot,
   writeSettings
-} from "./chunk-CY5IJMUM.js";
+} from "./chunk-7R4QEMZZ.js";
 
 // dist/cli/commands/extension.js
 import { execFile as execFile2 } from "node:child_process";
@@ -92,6 +92,63 @@ function managedExtensionSourcesEquivalent(left, right) {
   }
   return true;
 }
+function optionalString(value) {
+  return typeof value === "string" ? value : void 0;
+}
+function hasRequiredManagedRecordFields(entry) {
+  return typeof entry.name === "string" && entry.name.trim().length > 0 && typeof entry.directory === "string" && entry.directory.trim().length > 0 && (entry.scope === "project" || entry.scope === "global") && typeof entry.manifest_version === "string" && typeof entry.manifest_entry === "string" && Array.isArray(entry.capabilities) && entry.capabilities.every((value) => typeof value === "string") && typeof entry.installed_at === "string" && typeof entry.updated_at === "string";
+}
+function normalizeManagedSource(raw) {
+  if (typeof raw !== "object" || raw === null) {
+    return null;
+  }
+  const source = raw;
+  if (source.kind !== "local" && source.kind !== "github" && source.kind !== "npm" && source.kind !== "builtin" || typeof source.input !== "string" || typeof source.location !== "string") {
+    return null;
+  }
+  return {
+    kind: source.kind,
+    input: source.input,
+    location: source.location,
+    name: optionalString(source.name),
+    package: optionalString(source.package),
+    version: optionalString(source.version),
+    repository: optionalString(source.repository),
+    owner: optionalString(source.owner),
+    repo: optionalString(source.repo),
+    ref: optionalString(source.ref),
+    subpath: optionalString(source.subpath),
+    commit: optionalString(source.commit)
+  };
+}
+function normalizeManagedRecord(raw) {
+  if (typeof raw !== "object" || raw === null) {
+    return null;
+  }
+  const entry = raw;
+  if (!hasRequiredManagedRecordFields(entry)) {
+    return null;
+  }
+  const source = normalizeManagedSource(entry.source);
+  if (!source) {
+    return null;
+  }
+  return {
+    name: entry.name.trim(),
+    directory: entry.directory.trim(),
+    scope: entry.scope,
+    manifest_version: entry.manifest_version,
+    manifest_entry: entry.manifest_entry,
+    capabilities: normalizeStringList(entry.capabilities),
+    installed_at: entry.installed_at,
+    updated_at: entry.updated_at,
+    source,
+    last_update_check_at: optionalString(entry.last_update_check_at),
+    last_update_remote_commit: optionalString(entry.last_update_remote_commit),
+    update_available: typeof entry.update_available === "boolean" || entry.update_available === null ? entry.update_available : void 0,
+    update_error: optionalString(entry.update_error)
+  };
+}
 function normalizeManagedState(raw) {
   if (typeof raw !== "object" || raw === null) {
     return null;
@@ -102,49 +159,14 @@ function normalizeManagedState(raw) {
   }
   const entries = [];
   for (const rawEntry of candidate.entries) {
-    if (typeof rawEntry !== "object" || rawEntry === null) {
-      continue;
-    }
-    const entry = rawEntry;
-    if (typeof entry.name !== "string" || entry.name.trim().length === 0 || typeof entry.directory !== "string" || entry.directory.trim().length === 0 || entry.scope !== "project" && entry.scope !== "global" || typeof entry.manifest_version !== "string" || typeof entry.manifest_entry !== "string" || !Array.isArray(entry.capabilities) || entry.capabilities.some((value) => typeof value !== "string") || typeof entry.installed_at !== "string" || typeof entry.updated_at !== "string" || typeof entry.source !== "object" || entry.source === null) {
-      continue;
-    }
-    const source = entry.source;
-    if (source.kind !== "local" && source.kind !== "github" && source.kind !== "npm" && source.kind !== "builtin" || typeof source.input !== "string" || typeof source.location !== "string") {
-      continue;
+    const record = normalizeManagedRecord(rawEntry);
+    if (record) {
+      entries.push(record);
     }
-    entries.push({
-      name: entry.name.trim(),
-      directory: entry.directory.trim(),
-      scope: entry.scope,
-      manifest_version: entry.manifest_version,
-      manifest_entry: entry.manifest_entry,
-      capabilities: normalizeStringList(entry.capabilities),
-      installed_at: entry.installed_at,
-      updated_at: entry.updated_at,
-      source: {
-        kind: source.kind,
-        input: source.input,
-        location: source.location,
-        name: typeof source.name === "string" ? source.name : void 0,
-        package: typeof source.package === "string" ? source.package : void 0,
-        version: typeof source.version === "string" ? source.version : void 0,
-        repository: typeof source.repository === "string" ? source.repository : void 0,
-        owner: typeof source.owner === "string" ? source.owner : void 0,
-        repo: typeof source.repo === "string" ? source.repo : void 0,
-        ref: typeof source.ref === "string" ? source.ref : void 0,
-        subpath: typeof source.subpath === "string" ? source.subpath : void 0,
-        commit: typeof source.commit === "string" ? source.commit : void 0
-      },
-      last_update_check_at: typeof entry.last_update_check_at === "string" ? entry.last_update_check_at : void 0,
-      last_update_remote_commit: typeof entry.last_update_remote_commit === "string" ? entry.last_update_remote_commit : void 0,
-      update_available: typeof entry.update_available === "boolean" || entry.update_available === null ? entry.update_available : void 0,
-      update_error: typeof entry.update_error === "string" ? entry.update_error : void 0
-    });
   }
   return {
     version: MANAGED_EXTENSION_STATE_VERSION,
-    updated_at: typeof candidate.updated_at === "string" ? candidate.updated_at : nowIso(),
+    updated_at: optionalString(candidate.updated_at) ?? nowIso(),
     entries: sortManagedEntries(entries)
   };
 }
@@ -1065,6 +1087,42 @@ async function resolveBundledAliasManifestName(input) {
     return null;
   }
 }
+function buildBundledCatalogLinks(manifest) {
+  return {
+    docs: manifest.catalog?.links?.docs ?? manifest.package_homepage,
+    npm: manifest.catalog?.links?.npm ?? (manifest.package_name && manifest.package_private !== true ? `https://www.npmjs.com/package/${encodeURIComponent(manifest.package_name)}` : void 0),
+    repository: manifest.catalog?.links?.repository ?? manifest.package_repository_url,
+    report: manifest.catalog?.links?.report ?? manifest.package_bugs_url
+  };
+}
+function buildBundledCatalogPackageEntry(manifest, bundledEntry, scope, installedBuiltinAliases, installedLocations) {
+  const installScopeFlag = scope === "global" ? "--global" : "--project";
+  const metadataOnlyResources = Object.fromEntries(PM_PACKAGE_RESOURCE_KINDS.filter((resourceKind) => resourceKind !== "extensions").map((resourceKind) => [resourceKind, manifest.resources[resourceKind] ?? []]).filter(([, entries]) => Array.isArray(entries) && entries.length > 0));
+  return {
+    alias: bundledEntry.alias,
+    bundled: true,
+    available: true,
+    installed: installedBuiltinAliases.has(bundledEntry.alias) || installedLocations.has(path4.resolve(bundledEntry.package_root)),
+    install_target: bundledEntry.alias,
+    install_command: `pm install ${bundledEntry.alias} ${installScopeFlag}`,
+    package_name: manifest.package_name,
+    package_version: manifest.package_version,
+    description: manifest.catalog?.summary ?? manifest.package_description,
+    keywords: manifest.package_keywords ?? [],
+    resources: manifest.resources,
+    installable_resources: {
+      extensions: manifest.resources.extensions ?? []
+    },
+    metadata_only_resources: metadataOnlyResources,
+    catalog: {
+      display_name: manifest.catalog?.display_name,
+      category: manifest.catalog?.category,
+      tags: manifest.catalog?.tags ?? manifest.package_keywords ?? [],
+      links: buildBundledCatalogLinks(manifest),
+      media: manifest.catalog?.media
+    }
+  };
+}
 async function buildBundledPackageCatalog(scope, global, options = {}) {
   const roots = resolveExtensionRoots(resolvePmRoot(process.cwd(), global.path), process.cwd());
   const selectedRoot = scope === "global" ? roots.global : roots.project;
@@ -1073,44 +1131,8 @@ async function buildBundledPackageCatalog(scope, global, options = {}) {
   const installedBuiltinAliases = new Set(managedStateRead.state.entries.filter((entry) => entry.scope === scope && entry.source.kind === "builtin").flatMap((entry) => [entry.source.name, entry.source.input, entry.source.location]).filter((value) => typeof value === "string" && value.trim().length > 0).map((value) => value.trim().toLowerCase()));
   const packages = [];
   for (const bundledEntry of await collectBundledPackageEntries()) {
-    const alias = bundledEntry.alias;
-    const packageRoot = bundledEntry.package_root;
-    const installScopeFlag = scope === "global" ? "--global" : "--project";
-    const manifest = await readPmPackageManifest(packageRoot);
-    const repository = manifest.catalog?.links?.repository ?? manifest.package_repository_url;
-    const report = manifest.catalog?.links?.report ?? manifest.package_bugs_url;
-    const docs = manifest.catalog?.links?.docs ?? manifest.package_homepage;
-    const npm = manifest.catalog?.links?.npm ?? (manifest.package_name && manifest.package_private !== true ? `https://www.npmjs.com/package/${encodeURIComponent(manifest.package_name)}` : void 0);
-    const metadataOnlyResources = Object.fromEntries(PM_PACKAGE_RESOURCE_KINDS.filter((resourceKind) => resourceKind !== "extensions").map((resourceKind) => [resourceKind, manifest.resources[resourceKind] ?? []]).filter(([, entries]) => Array.isArray(entries) && entries.length > 0));
-    packages.push({
-      alias,
-      bundled: true,
-      available: true,
-      installed: installedBuiltinAliases.has(alias) || installedLocations.has(path4.resolve(packageRoot)),
-      install_target: alias,
-      install_command: `pm install ${alias} ${installScopeFlag}`,
-      package_name: manifest.package_name,
-      package_version: manifest.package_version,
-      description: manifest.catalog?.summary ?? manifest.package_description,
-      keywords: manifest.package_keywords ?? [],
-      resources: manifest.resources,
-      installable_resources: {
-        extensions: manifest.resources.extensions ?? []
-      },
-      metadata_only_resources: metadataOnlyResources,
-      catalog: {
-        display_name: manifest.catalog?.display_name,
-        category: manifest.catalog?.category,
-        tags: manifest.catalog?.tags ?? manifest.package_keywords ?? [],
-        links: {
-          docs,
-          npm,
-          repository,
-          report
-        },
-        media: manifest.catalog?.media
-      }
-    });
+    const manifest = await readPmPackageManifest(bundledEntry.package_root);
+    packages.push(buildBundledCatalogPackageEntry(manifest, bundledEntry, scope, installedBuiltinAliases, installedLocations));
   }
   const fields = parsePackageCatalogFields(options.fields);
   const outputPackages = fields ? packages.map((entry) => projectPackageCatalogEntry(entry, fields)) : packages;
@@ -1426,6 +1448,98 @@ function classifyUnusedCapabilityWarnings(loadResult, activationResult) {
   }
   return [...new Set(warnings)].sort((left, right) => left.localeCompare(right));
 }
+var TRIAGE_REMEDIATION_RULES = [
+  {
+    matches: (warnings) => warnings.some((warning) => warning.startsWith("extension_manifest_")),
+    build: (ctx) => `Run ${lifecycleFlagCommand(ctx.options, "explore")} ${ctx.scopeFlag} to inspect discovered manifests and directories.`
+  },
+  {
+    matches: (warnings) => warnings.some((warning) => warning.startsWith("extension_capability_unknown:")),
+    build: () => `Unknown extension capabilities detected. Allowed capabilities: ${KNOWN_EXTENSION_CAPABILITIES.join(", ")}. Review extension_capability_unknown warning details for suggested replacements.`
+  },
+  {
+    matches: (warnings) => warnings.some((warning) => warning.startsWith("extension_capability_legacy_alias:")),
+    build: () => "Legacy extension capability aliases were auto-remapped to canonical capabilities. Update manifests to canonical names (migration/validation -> schema)."
+  },
+  {
+    matches: (warnings) => warnings.some((warning) => warning.startsWith("extension_capability_missing:")),
+    build: (ctx) => `Extension activation failed because code registered a surface missing from manifest capabilities. Run ${lifecycleFlagCommand(ctx.options, "doctor")} ${ctx.scopeFlag} --detail deep --trace and add the reported missing_capability to manifest.json before publishing.`
+  },
+  {
+    matches: (warnings) => warnings.some((warning) => warning.startsWith("extension_capability_unused:")),
+    build: (ctx) => `Extension manifests declare capabilities that are never registered against. Remove each reported unused capability from manifest.json to keep least privilege, or add the matching registration. Run ${lifecycleFlagCommand(ctx.options, "doctor")} ${ctx.scopeFlag} --detail deep --trace for per-extension registration counts.`
+  },
+  {
+    matches: (warnings) => warnings.some((warning) => warning.startsWith("extension_command_definition_legacy_handler_alias:")),
+    build: () => "Extension command definitions using legacy handler were auto-remapped. Update command definitions to use run: (context) => ... for forward compatibility."
+  },
+  {
+    matches: (warnings) => warnings.some((warning) => warning.startsWith("extension_output_service_override_global:") || warning.startsWith("extension_output_renderer_override_global:")),
+    build: () => "Global output service/renderer overrides are active. For output_format, return context.payload/null/undefined unless the extension owns the command. For renderers, return null for unrelated payloads so pm falls back to native rendering."
+  },
+  {
+    matches: (warnings) => warnings.some((warning) => warning.startsWith("extension_schema_narrow_activation:")),
+    build: () => "A package registers custom item types/fields (a GLOBAL schema contribution) but also declares narrow activation.commands, so it never activates for built-in commands like pm create <type> and the custom type silently fails to register. Remove activation.commands from manifest.json so pm activates the package for every command, or \u2014 if the schema is intentionally command-scoped \u2014 knowingly ignore this advisory."
+  },
+  {
+    matches: (warnings) => warnings.some((warning) => warning.startsWith("extension_load_failed_sdk_dependency_missing:")),
+    build: (ctx) => `Detected extension load failures caused by missing SDK dependency resolution. Ensure extension package dependencies include "@unbrained/pm-cli" and reinstall dependencies before running ${lifecycleFlagCommand(ctx.options, "doctor")} ${ctx.scopeFlag}.`
+  },
+  {
+    matches: (warnings) => warnings.some((warning) => warning.startsWith("extension_load_failed_module_mode_mismatch:")),
+    build: (ctx) => `Detected extension module-mode mismatches. For ESM-based extension entries/imports, set package.json "type": "module" or use an explicit .mjs entry and rerun ${lifecycleFlagCommand(ctx.options, "doctor")} ${ctx.scopeFlag}.`
+  },
+  {
+    matches: (warnings) => warnings.some((warning) => warning.startsWith("extension_pm_min_version_") || warning.startsWith("extension_pm_max_version_")),
+    build: (ctx) => `Extension pm version-bound warnings detected. Align each package manifest's pm_min_version/pm_max_version with the installed pm CLI version (see the warning's required/allowed=...:current=... details), or upgrade/downgrade the pm CLI to satisfy the declared bounds, then rerun ${lifecycleFlagCommand(ctx.options, "doctor")} ${ctx.scopeFlag}.`
+  },
+  {
+    matches: (_warnings, ctx) => ctx.updateCheckFailedTotal > 0,
+    build: (ctx) => `Run ${lifecycleFlagCommand(ctx.options, "manage")} ${ctx.scopeFlag} after validating network and repository access.`
+  },
+  {
+    matches: (warnings) => warnings.some((warning) => warning.startsWith("extension_manager_state_")),
+    build: (ctx) => `Review and repair ${ctx.scope} managed extension state file if schema/read warnings persist.`
+  },
+  {
+    matches: (_warnings, ctx) => ctx.policyWarningCount > 0,
+    build: () => "Extension governance policy warnings detected. Review settings.extensions.policy mode and allow/block lists to confirm intended capabilities and registration surfaces."
+  }
+];
+function buildExtensionTriageRemediation(params) {
+  const { normalizedWarnings, options, scope, scopeFlag, updateCheckFailedTotal, policyWarningCount, updateHealthPartial, skippedUnmanagedTotal, skippedNonGithubTotal, updateAvailableTotal } = params;
+  const remediation = [];
+  const ctx = { options, scope, scopeFlag, updateCheckFailedTotal, policyWarningCount };
+  if (normalizedWarnings.length > 0) {
+    const registrationCollisionRemediation = buildRegistrationCollisionRemediation(normalizedWarnings, {
+      deactivate: `${lifecycleFlagCommand(options, "deactivate")} <name> ${scopeFlag}`,
+      doctor: `${lifecycleFlagCommand(options, "doctor")} ${scopeFlag} --detail deep --trace`
+    });
+    if (registrationCollisionRemediation) {
+      remediation.push(registrationCollisionRemediation);
+    }
+    for (const rule of TRIAGE_REMEDIATION_RULES) {
+      if (rule.matches(normalizedWarnings, ctx)) {
+        remediation.push(rule.build(ctx));
+      }
+    }
+  }
+  if (updateHealthPartial) {
+    remediation.push(`Update-check coverage is partial because unmanaged extensions need adoption. Adopt existing installs via ${lifecycleFlagCommand(options, "manage")} ${scopeFlag} --fix-managed-state (or ${lifecycleFlagCommand(options, "adopt-all")} ${scopeFlag}, ${lifecycleFlagCommand(options, "adopt")} <name> ${scopeFlag}, or reinstall via ${lifecycleFlagCommand(options, "install")} ${scopeFlag} <source>).`);
+  } else if (skippedUnmanagedTotal > 0) {
+    remediation.push(`Loaded unmanaged extensions are currently treated as informational. Use ${lifecycleFlagCommand(options, "manage")} ${scopeFlag} --fix-managed-state to adopt them for update checks.`);
+  }
+  if (skippedNonGithubTotal > 0) {
+    remediation.push(`Non-GitHub managed extensions are skipped by update checks. Use doctor output for non-update diagnostics.`);
+  }
+  if (updateAvailableTotal > 0) {
+    remediation.push(`Update available managed extensions via ${lifecycleFlagCommand(options, "install")} ${scopeFlag} <source>.`);
+  }
+  if (remediation.length === 0) {
+    remediation.push(`No immediate action required. Re-run ${lifecycleFlagCommand(options, "manage")} ${scopeFlag} after extension changes.`);
+  }
+  return remediation;
+}
 function buildExtensionTriageSummary(scope, warnings, extensions, options = {}) {
   const normalizedWarnings = [...new Set(warnings)].sort((left, right) => left.localeCompare(right));
   const managedTotal = extensions.filter((entry) => entry.managed).length;
@@ -1455,73 +1569,19 @@ function buildExtensionTriageSummary(scope, warnings, extensions, options = {})
   const warningCodes = [...new Set(effectiveWarnings.map((value) => warningCode(value)))].sort((left, right) => left.localeCompare(right));
   const policyWarnings = summarizePolicyWarnings(effectiveWarnings);
   const scopeFlag = scope === "global" ? "--global" : "--project";
-  const remediation = [];
-  if (normalizedWarnings.length > 0) {
-    const registrationCollisionRemediation = buildRegistrationCollisionRemediation(normalizedWarnings, {
-      deactivate: `${lifecycleFlagCommand(options, "deactivate")} <name> ${scopeFlag}`,
-      doctor: `${lifecycleFlagCommand(options, "doctor")} ${scopeFlag} --detail deep --trace`
-    });
-    if (registrationCollisionRemediation) {
-      remediation.push(registrationCollisionRemediation);
-    }
-    if (normalizedWarnings.some((warning) => warning.startsWith("extension_manifest_"))) {
-      remediation.push(`Run ${lifecycleFlagCommand(options, "explore")} ${scopeFlag} to inspect discovered manifests and directories.`);
-    }
-    if (normalizedWarnings.some((warning) => warning.startsWith("extension_capability_unknown:"))) {
-      remediation.push(`Unknown extension capabilities detected. Allowed capabilities: ${KNOWN_EXTENSION_CAPABILITIES.join(", ")}. Review extension_capability_unknown warning details for suggested replacements.`);
-    }
-    if (normalizedWarnings.some((warning) => warning.startsWith("extension_capability_legacy_alias:"))) {
-      remediation.push("Legacy extension capability aliases were auto-remapped to canonical capabilities. Update manifests to canonical names (migration/validation -> schema).");
-    }
-    if (normalizedWarnings.some((warning) => warning.startsWith("extension_capability_missing:"))) {
-      remediation.push(`Extension activation failed because code registered a surface missing from manifest capabilities. Run ${lifecycleFlagCommand(options, "doctor")} ${scopeFlag} --detail deep --trace and add the reported missing_capability to manifest.json before publishing.`);
-    }
-    if (normalizedWarnings.some((warning) => warning.startsWith("extension_capability_unused:"))) {
-      remediation.push(`Extension manifests declare capabilities that are never registered against. Remove each reported unused capability from manifest.json to keep least privilege, or add the matching registration. Run ${lifecycleFlagCommand(options, "doctor")} ${scopeFlag} --detail deep --trace for per-extension registration counts.`);
-    }
-    if (normalizedWarnings.some((warning) => warning.startsWith("extension_command_definition_legacy_handler_alias:"))) {
-      remediation.push("Extension command definitions using legacy handler were auto-remapped. Update command definitions to use run: (context) => ... for forward compatibility.");
-    }
-    if (normalizedWarnings.some((warning) => warning.startsWith("extension_output_service_override_global:") || warning.startsWith("extension_output_renderer_override_global:"))) {
-      remediation.push("Global output service/renderer overrides are active. For output_format, return context.payload/null/undefined unless the extension owns the command. For renderers, return null for unrelated payloads so pm falls back to native rendering.");
-    }
-    if (normalizedWarnings.some((warning) => warning.startsWith("extension_schema_narrow_activation:"))) {
-      remediation.push("A package registers custom item types/fields (a GLOBAL schema contribution) but also declares narrow activation.commands, so it never activates for built-in commands like pm create <type> and the custom type silently fails to register. Remove activation.commands from manifest.json so pm activates the package for every command, or \u2014 if the schema is intentionally command-scoped \u2014 knowingly ignore this advisory.");
-    }
-    if (normalizedWarnings.some((warning) => warning.startsWith("extension_load_failed_sdk_dependency_missing:"))) {
-      remediation.push(`Detected extension load failures caused by missing SDK dependency resolution. Ensure extension package dependencies include "@unbrained/pm-cli" and reinstall dependencies before running ${lifecycleFlagCommand(options, "doctor")} ${scopeFlag}.`);
-    }
-    if (normalizedWarnings.some((warning) => warning.startsWith("extension_load_failed_module_mode_mismatch:"))) {
-      remediation.push(`Detected extension module-mode mismatches. For ESM-based extension entries/imports, set package.json "type": "module" or use an explicit .mjs entry and rerun ${lifecycleFlagCommand(options, "doctor")} ${scopeFlag}.`);
-    }
-    if (normalizedWarnings.some((warning) => warning.startsWith("extension_pm_min_version_") || warning.startsWith("extension_pm_max_version_"))) {
-      remediation.push(`Extension pm version-bound warnings detected. Align each package manifest's pm_min_version/pm_max_version with the installed pm CLI version (see the warning's required/allowed=...:current=... details), or upgrade/downgrade the pm CLI to satisfy the declared bounds, then rerun ${lifecycleFlagCommand(options, "doctor")} ${scopeFlag}.`);
-    }
-    if (updateCheckFailedTotal > 0) {
-      remediation.push(`Run ${lifecycleFlagCommand(options, "manage")} ${scopeFlag} after validating network and repository access.`);
-    }
-    if (normalizedWarnings.some((warning) => warning.startsWith("extension_manager_state_"))) {
-      remediation.push(`Review and repair ${scope} managed extension state file if schema/read warnings persist.`);
-    }
-    if (policyWarnings.warning_count > 0) {
-      remediation.push("Extension governance policy warnings detected. Review settings.extensions.policy mode and allow/block lists to confirm intended capabilities and registration surfaces.");
-    }
-  }
   const collisionPlan = buildRegistrationCollisionPlan(scope, normalizedWarnings, extensions, options);
-  if (updateHealthPartial) {
-    remediation.push(`Update-check coverage is partial because unmanaged extensions need adoption. Adopt existing installs via ${lifecycleFlagCommand(options, "manage")} ${scopeFlag} --fix-managed-state (or ${lifecycleFlagCommand(options, "adopt-all")} ${scopeFlag}, ${lifecycleFlagCommand(options, "adopt")} <name> ${scopeFlag}, or reinstall via ${lifecycleFlagCommand(options, "install")} ${scopeFlag} <source>).`);
-  } else if (skippedUnmanagedTotal > 0) {
-    remediation.push(`Loaded unmanaged extensions are currently treated as informational. Use ${lifecycleFlagCommand(options, "manage")} ${scopeFlag} --fix-managed-state to adopt them for update checks.`);
-  }
-  if (skippedNonGithubTotal > 0) {
-    remediation.push(`Non-GitHub managed extensions are skipped by update checks. Use doctor output for non-update diagnostics.`);
-  }
-  if (updateAvailableTotal > 0) {
-    remediation.push(`Update available managed extensions via ${lifecycleFlagCommand(options, "install")} ${scopeFlag} <source>.`);
-  }
-  if (remediation.length === 0) {
-    remediation.push(`No immediate action required. Re-run ${lifecycleFlagCommand(options, "manage")} ${scopeFlag} after extension changes.`);
-  }
+  const remediation = buildExtensionTriageRemediation({
+    normalizedWarnings,
+    options,
+    scope,
+    scopeFlag,
+    updateCheckFailedTotal,
+    policyWarningCount: policyWarnings.warning_count,
+    updateHealthPartial,
+    skippedUnmanagedTotal,
+    skippedNonGithubTotal,
+    updateAvailableTotal
+  });
   return {
     status: effectiveWarnings.length === 0 ? "ok" : "warn",
     warning_count: effectiveWarnings.length,
@@ -1941,48 +2001,58 @@ function buildUnknownLifecycleActionError(target, options) {
     }
   });
 }
+var EXTENSION_ACTION_FLAG_SELECTORS = [
+  ["install", "install"],
+  ["uninstall", "uninstall"],
+  ["explore", "explore"],
+  ["manage", "manage"],
+  ["describe", "describe"],
+  ["reload", "reload"],
+  ["doctor", "doctor"],
+  ["catalog", "catalog"],
+  ["init", "init"],
+  ["scaffold", "init"],
+  ["adopt", "adopt"],
+  ["adoptAll", "adopt-all"],
+  ["activate", "activate"],
+  ["deactivate", "deactivate"]
+];
+function resolveImplicitActionFromTarget(normalizedTarget) {
+  if (normalizedTarget === "doctor") {
+    return "doctor";
+  }
+  if (normalizedTarget === "reload") {
+    return "reload";
+  }
+  if (normalizedTarget === "catalog") {
+    return "catalog";
+  }
+  if (normalizedTarget === "init" || normalizedTarget === "scaffold") {
+    return "init";
+  }
+  if (normalizedTarget === "explore") {
+    return "explore";
+  }
+  if (normalizedTarget === "manage") {
+    return "manage";
+  }
+  if (normalizedTarget === "list" || normalizedTarget === "") {
+    return "explore";
+  }
+  return null;
+}
 function resolveAction(target, options) {
-  const selected = [...new Set([
-    options.install ? "install" : null,
-    options.uninstall ? "uninstall" : null,
-    options.explore ? "explore" : null,
-    options.manage ? "manage" : null,
-    options.describe ? "describe" : null,
-    options.reload ? "reload" : null,
-    options.doctor ? "doctor" : null,
-    options.catalog ? "catalog" : null,
-    options.init ? "init" : null,
-    options.scaffold ? "init" : null,
-    options.adopt ? "adopt" : null,
-    options.adoptAll ? "adopt-all" : null,
-    options.activate ? "activate" : null,
-    options.deactivate ? "deactivate" : null
-  ].filter((value) => value !== null))];
+  const selected = [
+    ...new Set(EXTENSION_ACTION_FLAG_SELECTORS.filter(([flag]) => options[flag] === true).map(([, mappedAction]) => mappedAction))
+  ];
   if (selected.length === 0) {
-    if (typeof target === "string" && target.trim().toLowerCase() === "doctor") {
-      return "doctor";
-    }
-    if (typeof target === "string" && target.trim().toLowerCase() === "reload") {
-      return "reload";
-    }
-    if (typeof target === "string" && target.trim().toLowerCase() === "catalog") {
-      return "catalog";
-    }
-    if (typeof target === "string" && (target.trim().toLowerCase() === "init" || target.trim().toLowerCase() === "scaffold")) {
-      return "init";
-    }
-    if (typeof target === "string" && target.trim().toLowerCase() === "explore") {
-      return "explore";
-    }
-    if (typeof target === "string" && target.trim().toLowerCase() === "manage") {
-      return "manage";
-    }
-    if (typeof target === "string" && (target.trim().toLowerCase() === "list" || target.trim() === "")) {
-      return "explore";
-    }
     if (target === void 0) {
       return "explore";
     }
+    const implicitAction = resolveImplicitActionFromTarget(target.trim().toLowerCase());
+    if (implicitAction) {
+      return implicitAction;
+    }
     throw buildUnknownLifecycleActionError(target, options);
   }
   if (selected.length > 1) {
@@ -2041,6 +2111,27 @@ function resolveUpdateCheckResolution(managedEntry) {
     reason: "no_update_check_recorded"
   };
 }
+function buildInstalledExtensionSummary(identity, scope, managedEntry, updateCheck) {
+  return {
+    name: identity.name,
+    directory: identity.directory,
+    version: identity.version,
+    entry: identity.entry,
+    scope,
+    active: identity.enabled,
+    enabled: identity.enabled,
+    runtime_active: null,
+    activation_status: "unknown",
+    managed: Boolean(managedEntry),
+    source: managedEntry?.source,
+    update_available: managedEntry?.update_available,
+    last_update_check_at: managedEntry?.last_update_check_at,
+    last_update_remote_commit: managedEntry?.last_update_remote_commit,
+    update_error: managedEntry?.update_error,
+    update_check_status: updateCheck.status,
+    update_check_reason: updateCheck.reason
+  };
+}
 async function listInstalledExtensions(extensionsRoot, scope, settings, state) {
   if (!await pathExists(extensionsRoot)) {
     return {
@@ -2064,27 +2155,13 @@ async function listInstalledExtensions(extensionsRoot, scope, settings, state) {
     if (!await pathExists(manifestPath)) {
       warnings.push(`extension_manifest_missing:${scope}:${directoryName}`);
       const managedEntry2 = managedByDirectory.get(normalizeExtensionNameForMatch(directoryName));
-      const updateCheck2 = resolveUpdateCheckResolution(managedEntry2);
-      const enabled2 = managedEntry2 ? isExtensionEnabled(settings, managedEntry2.name) : false;
-      summaries.push({
+      summaries.push(buildInstalledExtensionSummary({
         name: managedEntry2?.name ?? directoryName,
         directory: directoryName,
         version: managedEntry2?.manifest_version ?? "unknown",
         entry: managedEntry2?.manifest_entry ?? "unknown",
-        scope,
-        active: enabled2,
-        enabled: enabled2,
-        runtime_active: null,
-        activation_status: "unknown",
-        managed: Boolean(managedEntry2),
-        source: managedEntry2?.source,
-        update_available: managedEntry2?.update_available,
-        last_update_check_at: managedEntry2?.last_update_check_at,
-        last_update_remote_commit: managedEntry2?.last_update_remote_commit,
-        update_error: managedEntry2?.update_error,
-        update_check_status: updateCheck2.status,
-        update_check_reason: updateCheck2.reason
-      });
+        enabled: managedEntry2 ? isExtensionEnabled(settings, managedEntry2.name) : false
+      }, scope, managedEntry2, resolveUpdateCheckResolution(managedEntry2)));
       continue;
     }
     let rawManifest;
@@ -2100,27 +2177,13 @@ async function listInstalledExtensions(extensionsRoot, scope, settings, state) {
       continue;
     }
     const managedEntry = managedByName.get(normalizeExtensionNameForMatch(manifest.name)) ?? managedByDirectory.get(normalizeExtensionNameForMatch(directoryName));
-    const updateCheck = resolveUpdateCheckResolution(managedEntry);
-    const enabled = isExtensionEnabled(settings, manifest.name);
-    summaries.push({
+    summaries.push(buildInstalledExtensionSummary({
       name: manifest.name,
       directory: directoryName,
       version: manifest.version,
       entry: manifest.entry,
-      scope,
-      active: enabled,
-      enabled,
-      runtime_active: null,
-      activation_status: "unknown",
-      managed: Boolean(managedEntry),
-      source: managedEntry?.source,
-      update_available: managedEntry?.update_available,
-      last_update_check_at: managedEntry?.last_update_check_at,
-      last_update_remote_commit: managedEntry?.last_update_remote_commit,
-      update_error: managedEntry?.update_error,
-      update_check_status: updateCheck.status,
-      update_check_reason: updateCheck.reason
-    });
+      enabled: isExtensionEnabled(settings, manifest.name)
+    }, scope, managedEntry, resolveUpdateCheckResolution(managedEntry)));
   }
   return {
     extensions: summaries.sort((left, right) => left.name.localeCompare(right.name)),
@@ -2399,46 +2462,63 @@ function collectSchemaNarrowActivationDoctorWarnings(loadResult, activationResul
   }
   return [...new Set(warnings)].sort((left, right) => left.localeCompare(right));
 }
-async function runExtension(target, options, global) {
-  const action = resolveAction(target, options);
-  if ((options.strictExit === true || options.failOnWarn === true) && action !== "doctor") {
-    throw new PmCliError("--strict-exit and --fail-on-warn are only valid with --doctor.", EXIT_CODE.USAGE);
-  }
-  if (options.trace === true && action !== "doctor") {
-    throw new PmCliError("--trace is only valid with --doctor.", EXIT_CODE.USAGE);
-  }
-  if (options.watch === true && action !== "reload") {
-    throw new PmCliError("--watch is only valid with --reload.", EXIT_CODE.USAGE);
-  }
-  if (options.runtimeProbe === true && action !== "manage") {
-    throw new PmCliError("--runtime-probe is only valid with --manage.", EXIT_CODE.USAGE);
+function assertExtensionActionOptionScope(action, options) {
+  const guards = [
+    {
+      triggered: options.strictExit === true || options.failOnWarn === true,
+      allowed: action === "doctor",
+      message: "--strict-exit and --fail-on-warn are only valid with --doctor."
+    },
+    { triggered: options.trace === true, allowed: action === "doctor", message: "--trace is only valid with --doctor." },
+    { triggered: options.watch === true, allowed: action === "reload", message: "--watch is only valid with --reload." },
+    {
+      triggered: options.runtimeProbe === true,
+      allowed: action === "manage",
+      message: "--runtime-probe is only valid with --manage."
+    },
+    {
+      triggered: options.fixManagedState === true,
+      allowed: action === "manage" || action === "doctor",
+      message: "--fix-managed-state is only valid with --manage or --doctor."
+    },
+    {
+      triggered: options.capability !== void 0,
+      allowed: action === "init",
+      message: "--capability is only valid with --init/--scaffold."
+    },
+    {
+      triggered: options.declarative === true,
+      allowed: action === "init",
+      message: "--declarative is only valid with --init/--scaffold."
+    }
+  ];
+  for (const guard of guards) {
+    if (guard.triggered && !guard.allowed) {
+      throw new PmCliError(guard.message, EXIT_CODE.USAGE);
+    }
+  }
+}
+function resolveNormalizedExtensionTarget(target, action, options) {
+  const normalizedInput = target?.trim().toLowerCase();
+  if (action === "doctor" && normalizedInput === "doctor") {
+    return void 0;
   }
-  if (options.fixManagedState === true && action !== "manage" && action !== "doctor") {
-    throw new PmCliError("--fix-managed-state is only valid with --manage or --doctor.", EXIT_CODE.USAGE);
+  if (action === "reload" && normalizedInput === "reload") {
+    return void 0;
   }
-  if (options.capability !== void 0 && action !== "init") {
-    throw new PmCliError("--capability is only valid with --init/--scaffold.", EXIT_CODE.USAGE);
+  if (action === "catalog" && normalizedInput === "catalog") {
+    return void 0;
   }
-  if (options.declarative === true && action !== "init") {
-    throw new PmCliError("--declarative is only valid with --init/--scaffold.", EXIT_CODE.USAGE);
+  const inferredInitAlias = action === "init" && options.init !== true && options.scaffold !== true && (normalizedInput === "init" || normalizedInput === "scaffold");
+  if (inferredInitAlias) {
+    return void 0;
   }
-  const normalizedTarget = (() => {
-    const normalizedInput = target?.trim().toLowerCase();
-    if (action === "doctor" && normalizedInput === "doctor") {
-      return void 0;
-    }
-    if (action === "reload" && normalizedInput === "reload") {
-      return void 0;
-    }
-    if (action === "catalog" && normalizedInput === "catalog") {
-      return void 0;
-    }
-    const inferredInitAlias = action === "init" && options.init !== true && options.scaffold !== true && (normalizedInput === "init" || normalizedInput === "scaffold");
-    if (inferredInitAlias) {
-      return void 0;
-    }
-    return target;
-  })();
+  return target;
+}
+async function runExtension(target, options, global) {
+  const action = resolveAction(target, options);
+  assertExtensionActionOptionScope(action, options);
+  const normalizedTarget = resolveNormalizedExtensionTarget(target, action, options);
   const scope = resolveScope(options);
   const resolvedRoots = resolveExtensionRootsForScope(scope, global);
   const warnings = [];
@@ -2470,438 +2550,736 @@ async function runExtension(target, options, global) {
     }
     return result;
   };
-  if (action === "init") {
-    const githubOption = resolveGithubOption(options);
-    if (githubOption !== void 0 || typeof options.ref === "string" && options.ref.trim().length > 0) {
-      throw new PmCliError('Action "init" does not accept --gh/--github/--ref options.', EXIT_CODE.USAGE);
-    }
-    const scaffoldTarget = requireTarget(normalizedTarget, action, options);
-    const scaffold = await scaffoldExtensionProject(scaffoldTarget, options.vocabulary ?? "extension", options.capability, options.declarative === true);
-    const quotedTargetPath = JSON.stringify(scaffold.target_path);
-    const quotedShellTargetPath = JSON.stringify(scaffold.target_path.replace(/\\/g, "/"));
-    return withResult({
-      scaffolded: scaffold.created_directory || scaffold.files.some((entry) => entry.status === "created"),
-      extension: {
-        name: scaffold.extension_name,
-        command: scaffold.command_name
-      },
-      capability: scaffold.capability,
-      style: scaffold.style,
-      target_path: scaffold.target_path,
-      created_directory: scaffold.created_directory,
-      files: scaffold.files,
-      next_steps: [
-        // Extensions are authored AND loaded as TypeScript (ADR pm-2c28 / pm-m1uz):
-        // the manifest entry is ./index.ts and pm strips types on load (Node
-        // >=22.18), so there is no compile/build step — install dependencies, then
-        // install the scaffold directly.
-        ...options.vocabulary === "package" ? [`Install dependencies: cd ${quotedShellTargetPath}, then run "npm install"`] : [
-          `Install type-check dependencies: cd ${quotedShellTargetPath}, then run "npm install -D typescript @types/node @unbrained/pm-cli"`
-        ],
-        `Install the scaffold: ${options.vocabulary === "package" ? "pm install --project" : "pm extension --install --project"} ${quotedTargetPath}`,
-        `Smoke-test command path: pm ${scaffold.command_name}`,
-        ...options.vocabulary === "package" ? [`Validate the package: cd ${quotedShellTargetPath}, then run "npm run typecheck" and "npm test"`] : [`Type-check the source (optional): cd ${quotedShellTargetPath}, then run "npx tsc --noEmit"`],
-        `Run diagnostics: ${options.vocabulary === "package" ? "pm package doctor" : "pm extension --doctor"} --project --detail summary`
-      ]
-    });
+  const ctx = {
+    action,
+    normalizedTarget,
+    scope,
+    resolvedRoots,
+    warnings,
+    options,
+    global,
+    withResult
+  };
+  return EXTENSION_ACTION_HANDLERS[action](ctx);
+}
+async function runExtensionInitAction(ctx) {
+  const { action, normalizedTarget, options, withResult } = ctx;
+  const githubOption = resolveGithubOption(options);
+  if (githubOption !== void 0 || typeof options.ref === "string" && options.ref.trim().length > 0) {
+    throw new PmCliError('Action "init" does not accept --gh/--github/--ref options.', EXIT_CODE.USAGE);
+  }
+  const scaffoldTarget = requireTarget(normalizedTarget, action, options);
+  const scaffold = await scaffoldExtensionProject(scaffoldTarget, options.vocabulary ?? "extension", options.capability, options.declarative === true);
+  const quotedTargetPath = JSON.stringify(scaffold.target_path);
+  const quotedShellTargetPath = JSON.stringify(scaffold.target_path.replace(/\\/g, "/"));
+  return withResult({
+    scaffolded: scaffold.created_directory || scaffold.files.some((entry) => entry.status === "created"),
+    extension: {
+      name: scaffold.extension_name,
+      command: scaffold.command_name
+    },
+    capability: scaffold.capability,
+    style: scaffold.style,
+    target_path: scaffold.target_path,
+    created_directory: scaffold.created_directory,
+    files: scaffold.files,
+    next_steps: [
+      // Extensions are authored AND loaded as TypeScript (ADR pm-2c28 / pm-m1uz):
+      // the manifest entry is ./index.ts and pm strips types on load (Node
+      // >=22.18), so there is no compile/build step — install dependencies, then
+      // install the scaffold directly.
+      ...options.vocabulary === "package" ? [`Install dependencies: cd ${quotedShellTargetPath}, then run "npm install"`] : [
+        `Install type-check dependencies: cd ${quotedShellTargetPath}, then run "npm install -D typescript @types/node @unbrained/pm-cli"`
+      ],
+      `Install the scaffold: ${options.vocabulary === "package" ? "pm install --project" : "pm extension --install --project"} ${quotedTargetPath}`,
+      `Smoke-test command path: pm ${scaffold.command_name}`,
+      ...options.vocabulary === "package" ? [`Validate the package: cd ${quotedShellTargetPath}, then run "npm run typecheck" and "npm test"`] : [`Type-check the source (optional): cd ${quotedShellTargetPath}, then run "npx tsc --noEmit"`],
+      `Run diagnostics: ${options.vocabulary === "package" ? "pm package doctor" : "pm extension --doctor"} --project --detail summary`
+    ]
+  });
+}
+async function runExtensionReloadAction(ctx) {
+  const { normalizedTarget, resolvedRoots, warnings, options, global, withResult } = ctx;
+  if (normalizedTarget !== void 0) {
+    throw new PmCliError('Action "reload" does not accept a target argument.', EXIT_CODE.USAGE);
   }
-  if (action === "reload") {
-    if (normalizedTarget !== void 0) {
-      throw new PmCliError('Action "reload" does not accept a target argument.', EXIT_CODE.USAGE);
-    }
-    const settings = await readSettings(resolvedRoots.settings_root);
-    const reloadToken = nextExtensionReloadToken();
-    const reloaded = await loadExtensions({
-      pmRoot: resolvedRoots.settings_root,
-      settings,
-      cwd: process.cwd(),
-      noExtensions: global.noExtensions,
-      reload_token: reloadToken,
-      cache_bust: true
-    });
-    warnings.push(...reloaded.warnings);
-    const activation = await activateExtensions(reloaded);
-    warnings.push(...activation.warnings);
-    const details = {
-      reload: {
-        token: reloadToken,
-        cache_bust: true,
-        watch: options.watch === true
-      },
-      loaded_count: reloaded.loaded.length,
-      failed_count: reloaded.failed.length,
-      activated_count: Math.max(0, reloaded.loaded.length - activation.failed.length),
-      activation_failed_count: activation.failed.length,
-      loaded_extensions: reloaded.loaded.map((entry) => ({
-        name: entry.name,
-        layer: entry.layer,
-        version: entry.version
-      })),
-      failed_extensions: reloaded.failed.map((entry) => ({
-        name: entry.name,
-        layer: entry.layer,
-        error: entry.error
-      })),
-      activation_failures: activation.failed.map((entry) => ({
-        name: entry.name,
-        layer: entry.layer,
-        error: entry.error
-      }))
+  const settings = await readSettings(resolvedRoots.settings_root);
+  const reloadToken = nextExtensionReloadToken();
+  const reloaded = await loadExtensions({
+    pmRoot: resolvedRoots.settings_root,
+    settings,
+    cwd: process.cwd(),
+    noExtensions: global.noExtensions,
+    reload_token: reloadToken,
+    cache_bust: true
+  });
+  warnings.push(...reloaded.warnings);
+  const activation = await activateExtensions(reloaded);
+  warnings.push(...activation.warnings);
+  const details = {
+    reload: {
+      token: reloadToken,
+      cache_bust: true,
+      watch: options.watch === true
+    },
+    loaded_count: reloaded.loaded.length,
+    failed_count: reloaded.failed.length,
+    activated_count: Math.max(0, reloaded.loaded.length - activation.failed.length),
+    activation_failed_count: activation.failed.length,
+    loaded_extensions: reloaded.loaded.map((entry) => ({
+      name: entry.name,
+      layer: entry.layer,
+      version: entry.version
+    })),
+    failed_extensions: reloaded.failed.map((entry) => ({
+      name: entry.name,
+      layer: entry.layer,
+      error: entry.error
+    })),
+    activation_failures: activation.failed.map((entry) => ({
+      name: entry.name,
+      layer: entry.layer,
+      error: entry.error
+    }))
+  };
+  if (options.watch === true) {
+    warnings.push("extension_reload_watch_hint:watch_mode_requested_non_interactive_single_pass_only");
+  }
+  return withResult(details);
+}
+async function runExtensionCatalogAction(ctx) {
+  const { normalizedTarget, scope, options, global, withResult } = ctx;
+  if (typeof normalizedTarget === "string" && normalizedTarget.length > 0 && normalizedTarget !== "catalog") {
+    throw new PmCliError('Action "catalog" does not accept a package target.', EXIT_CODE.USAGE);
+  }
+  return withResult(await buildBundledPackageCatalog(scope, global, options));
+}
+function buildInstallManagedSource(bundledAliasName, installSource, resolvedSource) {
+  if (bundledAliasName) {
+    return {
+      kind: "builtin",
+      input: bundledAliasName,
+      location: bundledAliasName,
+      name: bundledAliasName
     };
-    if (options.watch === true) {
-      warnings.push("extension_reload_watch_hint:watch_mode_requested_non_interactive_single_pass_only");
-    }
-    return withResult(details);
   }
-  if (action === "catalog") {
-    if (typeof normalizedTarget === "string" && normalizedTarget.length > 0 && normalizedTarget !== "catalog") {
-      throw new PmCliError('Action "catalog" does not accept a package target.', EXIT_CODE.USAGE);
-    }
-    return withResult(await buildBundledPackageCatalog(scope, global, options));
+  if (installSource.kind === "local") {
+    return {
+      kind: "local",
+      input: installSource.input,
+      location: installSource.absolute_path
+    };
   }
-  if (action === "install") {
-    const githubOption = resolveGithubOption(options);
-    const explicitSourceInput = githubOption ?? requireTarget(normalizedTarget, action, options);
-    if (typeof githubOption !== "string" && isBundledPackageInstallAllTarget(explicitSourceInput)) {
-      if (typeof options.ref === "string" && options.ref.trim().length > 0) {
-        throw new PmCliError('Action "install all" does not accept --ref.', EXIT_CODE.USAGE);
-      }
-      const aliases = await listBundledPackageAliases();
-      const packages = [];
-      for (const alias of aliases) {
-        packages.push({
-          alias,
-          result: await runExtension(alias, { ...options, install: true }, global)
-        });
-      }
-      for (const entry of packages) {
-        warnings.push(...entry.result.warnings);
-      }
-      return withResult({
-        installed_all: true,
-        installed_count: packages.length,
-        packages: packages.map((entry) => ({
-          alias: entry.alias,
-          ok: entry.result.ok,
-          extension: entry.result.details.extension,
-          source: entry.result.details.source,
-          destination_path: entry.result.details.destination_path,
-          activated: entry.result.details.activated,
-          settings_changed: entry.result.details.settings_changed,
-          command_paths: entry.result.details.command_paths,
-          action_paths: entry.result.details.action_paths,
-          command_discovery: entry.result.details.command_discovery,
-          warnings: entry.result.warnings
-        }))
-      });
+  if (installSource.kind === "npm") {
+    return {
+      kind: "npm",
+      input: installSource.input,
+      location: resolvedSource.resolved_subpath ?? ".",
+      package: resolvedSource.npm_package,
+      version: resolvedSource.npm_version
+    };
+  }
+  return {
+    kind: "github",
+    input: installSource.input,
+    location: resolvedSource.resolved_subpath ?? installSource.subpath ?? ".",
+    repository: installSource.repository,
+    owner: installSource.owner,
+    repo: installSource.repo,
+    ref: installSource.ref,
+    subpath: resolvedSource.resolved_subpath ?? installSource.subpath,
+    commit: resolvedSource.commit
+  };
+}
+async function performExtensionInstallUnderLock(ctx, input) {
+  const { scope, resolvedRoots, warnings, global, withResult } = ctx;
+  const { validated, destinationDirectoryName, bundledAliasName, installSource, resolvedSource } = input;
+  const settings = await readSettings(resolvedRoots.settings_root);
+  const managedStateRead = await readManagedExtensionState(resolvedRoots.selected_root);
+  warnings.push(...managedStateRead.warnings);
+  const destinationDirectory = path5.join(resolvedRoots.selected_root, destinationDirectoryName);
+  const destinationExists = await pathExists(destinationDirectory);
+  const installInPlace = await areDirectoriesEquivalent(validated.directory, destinationDirectory);
+  await fs5.mkdir(resolvedRoots.selected_root, { recursive: true });
+  if (!installInPlace) {
+    await copyExtensionDirectoryForInstall(validated.directory, destinationDirectory);
+  }
+  const sourceRecord = buildInstallManagedSource(bundledAliasName, installSource, resolvedSource);
+  const now = nowIso();
+  const existingManagedEntry = managedStateRead.state.entries.find((entry) => normalizeExtensionNameForMatch(entry.name) === normalizeExtensionNameForMatch(validated.manifest.name));
+  const sourceUnchanged = existingManagedEntry !== void 0 && existingManagedEntry.manifest_version === validated.manifest.version && managedExtensionSourcesEquivalent(existingManagedEntry.source, sourceRecord);
+  const managedState = upsertManagedEntry(managedStateRead.state, {
+    name: validated.manifest.name,
+    directory: destinationDirectoryName,
+    scope,
+    manifest_version: validated.manifest.version,
+    manifest_entry: validated.manifest.entry,
+    capabilities: [...validated.manifest.capabilities],
+    installed_at: existingManagedEntry?.installed_at ?? now,
+    updated_at: sourceUnchanged ? existingManagedEntry.updated_at : now,
+    source: sourceRecord
+  });
+  await writeManagedExtensionState(resolvedRoots.selected_root, managedState);
+  const activationChanged = ensureActivated(settings, validated.manifest.name);
+  if (activationChanged) {
+    await writeSettings(resolvedRoots.settings_root, settings, "settings:write");
+  }
+  const refreshedInstalled = await listInstalledExtensions(resolvedRoots.selected_root, scope, settings, managedState);
+  warnings.push(...refreshedInstalled.warnings);
+  const runtimeProbe = await probeRuntimeCommandPathsForInstall(resolvedRoots.pm_root, settings, refreshedInstalled.extensions, global);
+  warnings.push(...runtimeProbe.warnings);
+  const installedItemTypeDefinitions = runtimeProbe.item_type_registrations.filter((entry) => normalizeExtensionNameForMatch(entry.name) === normalizeExtensionNameForMatch(validated.manifest.name)).flatMap((entry) => entry.types.map((type) => ({ name: type.name, folder: type.folder })));
+  if (scope === "project" && installedItemTypeDefinitions.length > 0) {
+    await ensureTypeFolderScaffold(resolvedRoots.pm_root, installedItemTypeDefinitions, warnings, "install:type-folder");
+  }
+  const commandSummary = summarizeRuntimeCommandPathsForExtension(validated.manifest.name, runtimeProbe.installed);
+  const installActivationFailure = findActivationFailureByName(validated.manifest.name, runtimeProbe.activation_failures, scope);
+  const runtimeActivationStatus = resolveInstallRuntimeActivationStatus(validated.manifest.name, scope, runtimeProbe.installed, installActivationFailure);
+  return withResult({
+    extension: {
+      name: validated.manifest.name,
+      version: validated.manifest.version,
+      entry: validated.manifest.entry,
+      capabilities: validated.manifest.capabilities,
+      directory: destinationDirectoryName
+    },
+    source: sourceRecord,
+    destination_path: destinationDirectory,
+    overwritten: destinationExists && !installInPlace,
+    installed_in_place: installInPlace,
+    activated: true,
+    settings_changed: activationChanged,
+    runtime_activation_status: runtimeActivationStatus,
+    command_paths: commandSummary.command_paths,
+    action_paths: commandSummary.action_paths,
+    command_discovery: buildInstallCommandDiscovery(validated.manifest.name, sourceRecord, commandSummary),
+    activation_diagnostics: {
+      failed_count: runtimeProbe.activation_failures.length,
+      failed: runtimeProbe.activation_failures,
+      installed_extension_failed: installActivationFailure ?? null
     }
-    const bundledAliasSource = typeof githubOption === "string" ? null : await resolveBundledExtensionAliasSource(explicitSourceInput);
-    const bundledAliasName = bundledAliasSource === null ? null : explicitSourceInput.trim().toLowerCase();
-    const sourceInput = bundledAliasSource ?? explicitSourceInput;
-    const installSource = parseExtensionInstallSource(sourceInput, {
-      forceGithub: typeof githubOption === "string",
-      ref: options.ref
-    });
-    const resolvedSource = await resolveInstallSource(installSource);
-    try {
-      const validated = await validateExtensionDirectory(resolvedSource.directory);
-      const destinationDirectoryName = normalizeManagedDirectoryName(validated.manifest.name);
-      return await withExtensionInstallLock(resolvedRoots.settings_root, destinationDirectoryName, async () => {
-        const settings = await readSettings(resolvedRoots.settings_root);
-        const managedStateRead = await readManagedExtensionState(resolvedRoots.selected_root);
-        warnings.push(...managedStateRead.warnings);
-        const destinationDirectory = path5.join(resolvedRoots.selected_root, destinationDirectoryName);
-        const destinationExists = await pathExists(destinationDirectory);
-        const installInPlace = await areDirectoriesEquivalent(validated.directory, destinationDirectory);
-        await fs5.mkdir(resolvedRoots.selected_root, { recursive: true });
-        if (!installInPlace) {
-          await copyExtensionDirectoryForInstall(validated.directory, destinationDirectory);
-        }
-        const sourceRecord = bundledAliasName ? {
-          kind: "builtin",
-          input: bundledAliasName,
-          location: bundledAliasName,
-          name: bundledAliasName
-        } : installSource.kind === "local" ? {
-          kind: "local",
-          input: installSource.input,
-          location: installSource.absolute_path
-        } : installSource.kind === "npm" ? {
-          kind: "npm",
-          input: installSource.input,
-          location: resolvedSource.resolved_subpath ?? ".",
-          package: resolvedSource.npm_package,
-          version: resolvedSource.npm_version
-        } : {
-          kind: "github",
-          input: installSource.input,
-          location: resolvedSource.resolved_subpath ?? installSource.subpath ?? ".",
-          repository: installSource.repository,
-          owner: installSource.owner,
-          repo: installSource.repo,
-          ref: installSource.ref,
-          subpath: resolvedSource.resolved_subpath ?? installSource.subpath,
-          commit: resolvedSource.commit
-        };
-        const now = nowIso();
-        const existingManagedEntry = managedStateRead.state.entries.find((entry) => normalizeExtensionNameForMatch(entry.name) === normalizeExtensionNameForMatch(validated.manifest.name));
-        const sourceUnchanged = existingManagedEntry !== void 0 && existingManagedEntry.manifest_version === validated.manifest.version && managedExtensionSourcesEquivalent(existingManagedEntry.source, sourceRecord);
-        const managedState = upsertManagedEntry(managedStateRead.state, {
-          name: validated.manifest.name,
-          directory: destinationDirectoryName,
-          scope,
-          manifest_version: validated.manifest.version,
-          manifest_entry: validated.manifest.entry,
-          capabilities: [...validated.manifest.capabilities],
-          installed_at: existingManagedEntry?.installed_at ?? now,
-          updated_at: sourceUnchanged ? existingManagedEntry.updated_at : now,
-          source: sourceRecord
-        });
-        await writeManagedExtensionState(resolvedRoots.selected_root, managedState);
-        const activationChanged = ensureActivated(settings, validated.manifest.name);
-        if (activationChanged) {
-          await writeSettings(resolvedRoots.settings_root, settings, "settings:write");
-        }
-        const refreshedInstalled = await listInstalledExtensions(resolvedRoots.selected_root, scope, settings, managedState);
-        warnings.push(...refreshedInstalled.warnings);
-        const runtimeProbe = await probeRuntimeCommandPathsForInstall(resolvedRoots.pm_root, settings, refreshedInstalled.extensions, global);
-        warnings.push(...runtimeProbe.warnings);
-        const installedItemTypeDefinitions = runtimeProbe.item_type_registrations.filter((entry) => normalizeExtensionNameForMatch(entry.name) === normalizeExtensionNameForMatch(validated.manifest.name)).flatMap((entry) => entry.types.map((type) => ({ name: type.name, folder: type.folder })));
-        if (scope === "project" && installedItemTypeDefinitions.length > 0) {
-          await ensureTypeFolderScaffold(resolvedRoots.pm_root, installedItemTypeDefinitions, warnings, "install:type-folder");
-        }
-        const commandSummary = summarizeRuntimeCommandPathsForExtension(validated.manifest.name, runtimeProbe.installed);
-        const installActivationFailure = findActivationFailureByName(validated.manifest.name, runtimeProbe.activation_failures, scope);
-        const runtimeActivationStatus = resolveInstallRuntimeActivationStatus(validated.manifest.name, scope, runtimeProbe.installed, installActivationFailure);
-        return withResult({
-          extension: {
-            name: validated.manifest.name,
-            version: validated.manifest.version,
-            entry: validated.manifest.entry,
-            capabilities: validated.manifest.capabilities,
-            directory: destinationDirectoryName
-          },
-          source: sourceRecord,
-          destination_path: destinationDirectory,
-          overwritten: destinationExists && !installInPlace,
-          installed_in_place: installInPlace,
-          activated: true,
-          settings_changed: activationChanged,
-          runtime_activation_status: runtimeActivationStatus,
-          command_paths: commandSummary.command_paths,
-          action_paths: commandSummary.action_paths,
-          command_discovery: buildInstallCommandDiscovery(validated.manifest.name, sourceRecord, commandSummary),
-          activation_diagnostics: {
-            failed_count: runtimeProbe.activation_failures.length,
-            failed: runtimeProbe.activation_failures,
-            installed_extension_failed: installActivationFailure ?? null
-          }
-        });
+  });
+}
+async function runExtensionInstallAction(ctx) {
+  const { action, normalizedTarget, resolvedRoots, warnings, options, global, withResult } = ctx;
+  const githubOption = resolveGithubOption(options);
+  const explicitSourceInput = githubOption ?? requireTarget(normalizedTarget, action, options);
+  if (typeof githubOption !== "string" && isBundledPackageInstallAllTarget(explicitSourceInput)) {
+    if (typeof options.ref === "string" && options.ref.trim().length > 0) {
+      throw new PmCliError('Action "install all" does not accept --ref.', EXIT_CODE.USAGE);
+    }
+    const aliases = await listBundledPackageAliases();
+    const packages = [];
+    for (const alias of aliases) {
+      packages.push({
+        alias,
+        result: await runExtension(alias, { ...options, install: true }, global)
       });
-    } finally {
-      if (resolvedSource.cleanup) {
-        await resolvedSource.cleanup();
-      }
     }
-  }
-  if (action === "adopt-all") {
-    if (normalizedTarget !== void 0) {
-      throw new PmCliError('Action "adopt-all" does not accept a target argument.', EXIT_CODE.USAGE);
-    }
-    const githubOption = resolveGithubOption(options);
-    if (githubOption !== void 0 || typeof options.ref === "string" && options.ref.trim().length > 0) {
-      throw new PmCliError('Action "adopt-all" does not accept --gh/--github/--ref options.', EXIT_CODE.USAGE);
-    }
-    const settings = await readSettings(resolvedRoots.settings_root);
-    const managedStateRead = await readManagedExtensionState(resolvedRoots.selected_root);
-    warnings.push(...managedStateRead.warnings);
-    const installed = await listInstalledExtensions(resolvedRoots.selected_root, scope, settings, managedStateRead.state);
-    warnings.push(...installed.warnings);
-    const adoption = await adoptUnmanagedExtensions(resolvedRoots.selected_root, scope, installed.extensions, managedStateRead.state);
-    const refreshedInstalled = await listInstalledExtensions(resolvedRoots.selected_root, scope, settings, adoption.state);
-    warnings.push(...refreshedInstalled.warnings);
-    const triage = buildExtensionTriageSummary(scope, warnings, refreshedInstalled.extensions, options);
-    warnings.push(...triage.warnings);
-    const adoptedDetails = adoption.adopted_entries.map((entry) => {
-      const refreshedEntry = refreshedInstalled.extensions.find((candidate) => normalizeExtensionNameForMatch(candidate.name) === normalizeExtensionNameForMatch(entry.name) && normalizeExtensionNameForMatch(candidate.directory) === normalizeExtensionNameForMatch(entry.directory)) ?? /* c8 ignore next 3 -- fallback only matters if a manifest renames between adopt and refresh */
-      refreshedInstalled.extensions.find((candidate) => normalizeExtensionNameForMatch(candidate.directory) === normalizeExtensionNameForMatch(entry.directory));
-      return {
-        ...entry,
-        update_check_status: refreshedEntry?.update_check_status ?? null,
-        update_check_reason: refreshedEntry?.update_check_reason ?? null
-      };
-    });
+    for (const entry of packages) {
+      warnings.push(...entry.result.warnings);
+    }
     return withResult({
-      adopted_all: adoptedDetails.length > 0,
-      adopted_count: adoptedDetails.length,
-      already_managed_count: adoption.already_managed_count,
-      extensions: adoptedDetails,
-      triage,
-      warning_codes: triage.warning_codes,
-      update_health_partial: triage.update_health_partial,
-      update_health_coverage: triage.update_health_coverage
+      installed_all: true,
+      installed_count: packages.length,
+      packages: packages.map((entry) => ({
+        alias: entry.alias,
+        ok: entry.result.ok,
+        extension: entry.result.details.extension,
+        source: entry.result.details.source,
+        destination_path: entry.result.details.destination_path,
+        activated: entry.result.details.activated,
+        settings_changed: entry.result.details.settings_changed,
+        command_paths: entry.result.details.command_paths,
+        action_paths: entry.result.details.action_paths,
+        command_discovery: entry.result.details.command_discovery,
+        warnings: entry.result.warnings
+      }))
     });
   }
-  if (action === "adopt") {
-    const extensionTarget = requireTarget(normalizedTarget, action, options);
-    const githubOption = resolveGithubOption(options);
-    const settings = await readSettings(resolvedRoots.settings_root);
-    const managedStateRead = await readManagedExtensionState(resolvedRoots.selected_root);
-    warnings.push(...managedStateRead.warnings);
-    const installed = await listInstalledExtensions(resolvedRoots.selected_root, scope, settings, managedStateRead.state);
-    warnings.push(...installed.warnings);
-    const candidate = await resolveInstalledExtensionCandidate(installed.extensions, extensionTarget);
-    if (!candidate) {
-      throw new PmCliError(`Installed extension "${extensionTarget}" was not found in ${scope} scope.`, EXIT_CODE.NOT_FOUND);
-    }
-    if (candidate.managed) {
-      return withResult({
-        adopted: false,
-        already_managed: true,
-        extension: {
-          name: candidate.name,
-          directory: candidate.directory
-        }
-      });
-    }
-    const extensionDirectory = path5.join(resolvedRoots.selected_root, candidate.directory);
-    const validated = await validateExtensionDirectory(extensionDirectory);
-    const now = nowIso();
-    const sourceRecord = githubOption === void 0 ? {
-      kind: "local",
-      input: extensionTarget,
-      location: extensionDirectory
-    } : (() => {
-      const parsed = parseExtensionInstallSource(githubOption, {
-        forceGithub: true,
-        ref: options.ref
-      });
-      if (parsed.kind !== "github") {
-        throw new PmCliError(`Invalid GitHub shorthand "${githubOption}".`, EXIT_CODE.USAGE);
-      }
-      return {
-        kind: "github",
-        input: parsed.input,
-        location: parsed.subpath ?? ".",
-        repository: parsed.repository,
-        owner: parsed.owner,
-        repo: parsed.repo,
-        ref: parsed.ref,
-        subpath: parsed.subpath
-      };
-    })();
-    const managedState = upsertManagedEntry(managedStateRead.state, {
-      name: validated.manifest.name,
-      directory: candidate.directory,
-      scope,
-      manifest_version: validated.manifest.version,
-      manifest_entry: validated.manifest.entry,
-      capabilities: [...validated.manifest.capabilities],
-      installed_at: now,
-      updated_at: now,
-      source: sourceRecord
-    });
-    await writeManagedExtensionState(resolvedRoots.selected_root, managedState);
-    const refreshedInstalled = await listInstalledExtensions(resolvedRoots.selected_root, scope, settings, managedState);
-    warnings.push(...refreshedInstalled.warnings);
-    const refreshedEntry = refreshedInstalled.extensions.find((entry) => normalizeExtensionNameForMatch(entry.name) === normalizeExtensionNameForMatch(validated.manifest.name)) ?? refreshedInstalled.extensions.find((entry) => normalizeExtensionNameForMatch(entry.directory) === normalizeExtensionNameForMatch(candidate.directory));
-    return withResult({
-      adopted: true,
-      extension: {
-        name: validated.manifest.name,
-        directory: candidate.directory,
-        version: validated.manifest.version,
-        entry: validated.manifest.entry
-      },
-      source: sourceRecord,
+  const bundledAliasSource = typeof githubOption === "string" ? null : await resolveBundledExtensionAliasSource(explicitSourceInput);
+  const bundledAliasName = bundledAliasSource === null ? null : explicitSourceInput.trim().toLowerCase();
+  const sourceInput = bundledAliasSource ?? explicitSourceInput;
+  const installSource = parseExtensionInstallSource(sourceInput, {
+    forceGithub: typeof githubOption === "string",
+    ref: options.ref
+  });
+  const resolvedSource = await resolveInstallSource(installSource);
+  try {
+    const validated = await validateExtensionDirectory(resolvedSource.directory);
+    const destinationDirectoryName = normalizeManagedDirectoryName(validated.manifest.name);
+    return await withExtensionInstallLock(resolvedRoots.settings_root, destinationDirectoryName, () => performExtensionInstallUnderLock(ctx, {
+      validated,
+      destinationDirectoryName,
+      bundledAliasName,
+      installSource,
+      resolvedSource
+    }));
+  } finally {
+    if (resolvedSource.cleanup) {
+      await resolvedSource.cleanup();
+    }
+  }
+}
+async function runExtensionAdoptAllAction(ctx) {
+  const { normalizedTarget, scope, resolvedRoots, warnings, options, withResult } = ctx;
+  if (normalizedTarget !== void 0) {
+    throw new PmCliError('Action "adopt-all" does not accept a target argument.', EXIT_CODE.USAGE);
+  }
+  const githubOption = resolveGithubOption(options);
+  if (githubOption !== void 0 || typeof options.ref === "string" && options.ref.trim().length > 0) {
+    throw new PmCliError('Action "adopt-all" does not accept --gh/--github/--ref options.', EXIT_CODE.USAGE);
+  }
+  const settings = await readSettings(resolvedRoots.settings_root);
+  const managedStateRead = await readManagedExtensionState(resolvedRoots.selected_root);
+  warnings.push(...managedStateRead.warnings);
+  const installed = await listInstalledExtensions(resolvedRoots.selected_root, scope, settings, managedStateRead.state);
+  warnings.push(...installed.warnings);
+  const adoption = await adoptUnmanagedExtensions(resolvedRoots.selected_root, scope, installed.extensions, managedStateRead.state);
+  const refreshedInstalled = await listInstalledExtensions(resolvedRoots.selected_root, scope, settings, adoption.state);
+  warnings.push(...refreshedInstalled.warnings);
+  const triage = buildExtensionTriageSummary(scope, warnings, refreshedInstalled.extensions, options);
+  warnings.push(...triage.warnings);
+  const adoptedDetails = adoption.adopted_entries.map((entry) => {
+    const refreshedEntry = refreshedInstalled.extensions.find((candidate) => normalizeExtensionNameForMatch(candidate.name) === normalizeExtensionNameForMatch(entry.name) && normalizeExtensionNameForMatch(candidate.directory) === normalizeExtensionNameForMatch(entry.directory)) ?? /* c8 ignore next 3 -- fallback only matters if a manifest renames between adopt and refresh */
+    refreshedInstalled.extensions.find((candidate) => normalizeExtensionNameForMatch(candidate.directory) === normalizeExtensionNameForMatch(entry.directory));
+    return {
+      ...entry,
       update_check_status: refreshedEntry?.update_check_status ?? null,
       update_check_reason: refreshedEntry?.update_check_reason ?? null
-    });
-  }
-  if (action === "uninstall") {
-    const extensionTarget = requireTarget(normalizedTarget, action, options);
-    const settings = await readSettings(resolvedRoots.settings_root);
-    const managedStateRead = await readManagedExtensionState(resolvedRoots.selected_root);
-    warnings.push(...managedStateRead.warnings);
-    const installed = await listInstalledExtensions(resolvedRoots.selected_root, scope, settings, managedStateRead.state);
-    warnings.push(...installed.warnings);
-    const candidate = await resolveInstalledExtensionCandidate(installed.extensions, extensionTarget);
-    if (!candidate) {
-      throw new PmCliError(`Installed extension "${extensionTarget}" was not found in ${scope} scope.`, EXIT_CODE.NOT_FOUND);
-    }
-    const destinationDirectory = path5.join(resolvedRoots.selected_root, candidate.directory);
-    await fs5.rm(destinationDirectory, { recursive: true, force: true });
-    const updatedState = {
-      ...managedStateRead.state,
-      updated_at: nowIso(),
-      /* c8 ignore start -- uninstall filter keeps both name+directory guards for legacy managed-state migrations */
-      entries: managedStateRead.state.entries.filter((entry) => normalizeExtensionNameForMatch(entry.name) !== normalizeExtensionNameForMatch(candidate.name) && normalizeExtensionNameForMatch(entry.directory) !== normalizeExtensionNameForMatch(candidate.directory))
-      /* c8 ignore stop */
     };
-    await writeManagedExtensionState(resolvedRoots.selected_root, updatedState);
-    const stateChanged = clearExtensionState(settings, candidate.name);
-    if (stateChanged) {
-      await writeSettings(resolvedRoots.settings_root, settings, "settings:write");
-    }
+  });
+  return withResult({
+    adopted_all: adoptedDetails.length > 0,
+    adopted_count: adoptedDetails.length,
+    already_managed_count: adoption.already_managed_count,
+    extensions: adoptedDetails,
+    triage,
+    warning_codes: triage.warning_codes,
+    update_health_partial: triage.update_health_partial,
+    update_health_coverage: triage.update_health_coverage
+  });
+}
+async function runExtensionAdoptAction(ctx) {
+  const { action, normalizedTarget, scope, resolvedRoots, warnings, options, withResult } = ctx;
+  const extensionTarget = requireTarget(normalizedTarget, action, options);
+  const githubOption = resolveGithubOption(options);
+  const settings = await readSettings(resolvedRoots.settings_root);
+  const managedStateRead = await readManagedExtensionState(resolvedRoots.selected_root);
+  warnings.push(...managedStateRead.warnings);
+  const installed = await listInstalledExtensions(resolvedRoots.selected_root, scope, settings, managedStateRead.state);
+  warnings.push(...installed.warnings);
+  const candidate = await resolveInstalledExtensionCandidate(installed.extensions, extensionTarget);
+  if (!candidate) {
+    throw new PmCliError(`Installed extension "${extensionTarget}" was not found in ${scope} scope.`, EXIT_CODE.NOT_FOUND);
+  }
+  if (candidate.managed) {
     return withResult({
-      removed: true,
+      adopted: false,
+      already_managed: true,
       extension: {
         name: candidate.name,
         directory: candidate.directory
-      },
-      destination_path: destinationDirectory,
-      settings_changed: stateChanged
+      }
     });
   }
-  if (action === "activate" || action === "deactivate") {
-    const extensionTarget = requireTarget(normalizedTarget, action, options);
-    const settings = await readSettings(resolvedRoots.settings_root);
-    const managedStateRead = await readManagedExtensionState(resolvedRoots.selected_root);
-    warnings.push(...managedStateRead.warnings);
-    const installed = await listInstalledExtensions(resolvedRoots.selected_root, scope, settings, managedStateRead.state);
-    warnings.push(...installed.warnings);
-    const candidate = await resolveInstalledExtensionCandidate(installed.extensions, extensionTarget);
-    if (!candidate) {
-      throw new PmCliError(`Installed extension "${extensionTarget}" was not found in ${scope} scope.`, EXIT_CODE.NOT_FOUND);
-    }
-    const settingsChanged = action === "activate" ? ensureActivated(settings, candidate.name) : ensureDeactivated(settings, candidate.name);
-    if (settingsChanged) {
-      await writeSettings(resolvedRoots.settings_root, settings, "settings:write");
+  const extensionDirectory = path5.join(resolvedRoots.selected_root, candidate.directory);
+  const validated = await validateExtensionDirectory(extensionDirectory);
+  const now = nowIso();
+  const sourceRecord = githubOption === void 0 ? {
+    kind: "local",
+    input: extensionTarget,
+    location: extensionDirectory
+  } : (() => {
+    const parsed = parseExtensionInstallSource(githubOption, {
+      forceGithub: true,
+      ref: options.ref
+    });
+    if (parsed.kind !== "github") {
+      throw new PmCliError(`Invalid GitHub shorthand "${githubOption}".`, EXIT_CODE.USAGE);
     }
-    return withResult({
-      extension: {
-        name: candidate.name,
-        directory: candidate.directory
+    return {
+      kind: "github",
+      input: parsed.input,
+      location: parsed.subpath ?? ".",
+      repository: parsed.repository,
+      owner: parsed.owner,
+      repo: parsed.repo,
+      ref: parsed.ref,
+      subpath: parsed.subpath
+    };
+  })();
+  const managedState = upsertManagedEntry(managedStateRead.state, {
+    name: validated.manifest.name,
+    directory: candidate.directory,
+    scope,
+    manifest_version: validated.manifest.version,
+    manifest_entry: validated.manifest.entry,
+    capabilities: [...validated.manifest.capabilities],
+    installed_at: now,
+    updated_at: now,
+    source: sourceRecord
+  });
+  await writeManagedExtensionState(resolvedRoots.selected_root, managedState);
+  const refreshedInstalled = await listInstalledExtensions(resolvedRoots.selected_root, scope, settings, managedState);
+  warnings.push(...refreshedInstalled.warnings);
+  const refreshedEntry = refreshedInstalled.extensions.find((entry) => normalizeExtensionNameForMatch(entry.name) === normalizeExtensionNameForMatch(validated.manifest.name)) ?? refreshedInstalled.extensions.find((entry) => normalizeExtensionNameForMatch(entry.directory) === normalizeExtensionNameForMatch(candidate.directory));
+  return withResult({
+    adopted: true,
+    extension: {
+      name: validated.manifest.name,
+      directory: candidate.directory,
+      version: validated.manifest.version,
+      entry: validated.manifest.entry
+    },
+    source: sourceRecord,
+    update_check_status: refreshedEntry?.update_check_status ?? null,
+    update_check_reason: refreshedEntry?.update_check_reason ?? null
+  });
+}
+async function runExtensionUninstallAction(ctx) {
+  const { action, normalizedTarget, scope, resolvedRoots, warnings, options, withResult } = ctx;
+  const extensionTarget = requireTarget(normalizedTarget, action, options);
+  const settings = await readSettings(resolvedRoots.settings_root);
+  const managedStateRead = await readManagedExtensionState(resolvedRoots.selected_root);
+  warnings.push(...managedStateRead.warnings);
+  const installed = await listInstalledExtensions(resolvedRoots.selected_root, scope, settings, managedStateRead.state);
+  warnings.push(...installed.warnings);
+  const candidate = await resolveInstalledExtensionCandidate(installed.extensions, extensionTarget);
+  if (!candidate) {
+    throw new PmCliError(`Installed extension "${extensionTarget}" was not found in ${scope} scope.`, EXIT_CODE.NOT_FOUND);
+  }
+  const destinationDirectory = path5.join(resolvedRoots.selected_root, candidate.directory);
+  await fs5.rm(destinationDirectory, { recursive: true, force: true });
+  const updatedState = {
+    ...managedStateRead.state,
+    updated_at: nowIso(),
+    /* c8 ignore start -- uninstall filter keeps both name+directory guards for legacy managed-state migrations */
+    entries: managedStateRead.state.entries.filter((entry) => normalizeExtensionNameForMatch(entry.name) !== normalizeExtensionNameForMatch(candidate.name) && normalizeExtensionNameForMatch(entry.directory) !== normalizeExtensionNameForMatch(candidate.directory))
+    /* c8 ignore stop */
+  };
+  await writeManagedExtensionState(resolvedRoots.selected_root, updatedState);
+  const stateChanged = clearExtensionState(settings, candidate.name);
+  if (stateChanged) {
+    await writeSettings(resolvedRoots.settings_root, settings, "settings:write");
+  }
+  return withResult({
+    removed: true,
+    extension: {
+      name: candidate.name,
+      directory: candidate.directory
+    },
+    destination_path: destinationDirectory,
+    settings_changed: stateChanged
+  });
+}
+async function runExtensionActivateDeactivateAction(ctx) {
+  const { action, normalizedTarget, scope, resolvedRoots, warnings, options, withResult } = ctx;
+  const extensionTarget = requireTarget(normalizedTarget, action, options);
+  const settings = await readSettings(resolvedRoots.settings_root);
+  const managedStateRead = await readManagedExtensionState(resolvedRoots.selected_root);
+  warnings.push(...managedStateRead.warnings);
+  const installed = await listInstalledExtensions(resolvedRoots.selected_root, scope, settings, managedStateRead.state);
+  warnings.push(...installed.warnings);
+  const candidate = await resolveInstalledExtensionCandidate(installed.extensions, extensionTarget);
+  if (!candidate) {
+    throw new PmCliError(`Installed extension "${extensionTarget}" was not found in ${scope} scope.`, EXIT_CODE.NOT_FOUND);
+  }
+  const settingsChanged = action === "activate" ? ensureActivated(settings, candidate.name) : ensureDeactivated(settings, candidate.name);
+  if (settingsChanged) {
+    await writeSettings(resolvedRoots.settings_root, settings, "settings:write");
+  }
+  return withResult({
+    extension: {
+      name: candidate.name,
+      directory: candidate.directory
+    },
+    active: action === "activate",
+    settings_changed: settingsChanged,
+    settings: {
+      enabled: [...settings.extensions.enabled],
+      disabled: [...settings.extensions.disabled]
+    }
+  });
+}
+function buildDoctorRemediation(baseRemediation, loadFailureCount, activationFailureCount, vocabulary, managedStateFix) {
+  return [
+    ...new Set([
+      ...baseRemediation,
+      /* c8 ignore start -- vocabulary-specific remediation branches are copy-only variants */
+      ...loadFailureCount > 0 ? [
+        vocabulary === "package" ? "Run pm package explore --project and pm package explore --global to inspect load failures." : "Run pm extension --explore --project and pm extension --explore --global to inspect load failures."
+      ] : [],
+      ...activationFailureCount > 0 ? [
+        vocabulary === "package" ? "Review activation failures in pm package doctor --detail deep output." : "Review activation failures in pm extension --doctor --detail deep output."
+      ] : [],
+      /* c8 ignore stop */
+      ...managedStateFix && managedStateFix.adopted_entries.length > 0 ? [`Managed-state fix adopted ${managedStateFix.adopted_entries.length} extension(s).`] : []
+    ].map((entry) => entry.trim()).filter((entry) => entry.length > 0))
+  ];
+}
+async function runExtensionDoctorAction(ctx) {
+  const { normalizedTarget, scope, resolvedRoots, warnings, options, global, withResult } = ctx;
+  if (normalizedTarget && normalizedTarget.trim().length > 0) {
+    throw new PmCliError('Action "doctor" does not accept a target argument.', EXIT_CODE.USAGE);
+  }
+  const detailMode = parseDoctorDetailMode(options.detail);
+  const includeTrace = options.trace === true;
+  if (includeTrace && detailMode !== "deep") {
+    throw new PmCliError("--trace requires --detail deep with --doctor.", EXIT_CODE.USAGE);
+  }
+  const settings = await readSettings(resolvedRoots.settings_root);
+  const managedStateRead = await readManagedExtensionState(resolvedRoots.selected_root);
+  warnings.push(...managedStateRead.warnings);
+  const installed = await listInstalledExtensions(resolvedRoots.selected_root, scope, settings, managedStateRead.state);
+  warnings.push(...installed.warnings);
+  let managedState = managedStateRead.state;
+  const managedStateFix = options.fixManagedState === true ? await adoptUnmanagedExtensions(resolvedRoots.selected_root, scope, installed.extensions, managedStateRead.state) : null;
+  if (managedStateFix) {
+    managedState = managedStateFix.state;
+  }
+  const refreshedInstalled = await listInstalledExtensions(resolvedRoots.selected_root, scope, settings, managedState);
+  warnings.push(...refreshedInstalled.warnings);
+  const loadResult = await loadExtensions({
+    pmRoot: resolvedRoots.pm_root,
+    settings,
+    cwd: process.cwd(),
+    noExtensions: global.noExtensions === true
+  });
+  const activationResult = await activateExtensions({
+    ...loadResult,
+    loaded: loadResult.loaded
+  });
+  warnings.push(...loadResult.warnings);
+  warnings.push(...classifyDoctorLoadFailureWarnings(loadResult.failed));
+  warnings.push(...activationResult.warnings);
+  warnings.push(...classifyDoctorActivationFailureWarnings(activationResult.failed));
+  warnings.push(...classifyUnusedCapabilityWarnings(loadResult, activationResult));
+  warnings.push(...collectGlobalOutputOverrideDoctorWarnings(activationResult));
+  warnings.push(...collectSchemaNarrowActivationDoctorWarnings(loadResult, activationResult));
+  const runtimeInstalledExtensions = applyDoctorRuntimeActivationState(refreshedInstalled.extensions, loadResult, activationResult);
+  const doctorConsistency = buildDoctorConsistencySummary(scope, runtimeInstalledExtensions, loadResult.loaded.map((entry) => ({ layer: entry.layer, name: entry.name })), loadResult.failed.map((entry) => ({ name: entry.name })), loadResult.disabled_by_flag);
+  warnings.push(...doctorConsistency.warnings);
+  const updateCheckWarnings = runtimeInstalledExtensions.filter((entry) => entry.update_check_status === "failed").map((entry) => `extension_update_check_failed:${entry.name}`);
+  warnings.push(...updateCheckWarnings);
+  const triage = buildExtensionTriageSummary(scope, warnings, runtimeInstalledExtensions, options);
+  warnings.push(...triage.warnings);
+  const normalizedWarnings = [...triage.warnings];
+  const policySummary = {
+    mode: loadResult.policy.mode,
+    trust_mode: loadResult.policy.trust_mode,
+    require_provenance: loadResult.policy.require_provenance,
+    default_sandbox_profile: loadResult.policy.default_sandbox_profile,
+    // Honest trust model (ADR pm-6ef3): keep this caveat to one concise line.
+    sandbox_enforcement: "advisory: sandbox_profile/permissions are declaration-based load gates, not runtime isolation (ADR pm-6ef3)",
+    trusted_extensions_count: loadResult.policy.trusted_extensions.length,
+    allowed_extensions_count: loadResult.policy.allowed_extensions.length,
+    blocked_extensions_count: loadResult.policy.blocked_extensions.length,
+    allowed_capabilities_count: loadResult.policy.allowed_capabilities.length,
+    blocked_capabilities_count: loadResult.policy.blocked_capabilities.length,
+    allowed_surfaces_count: loadResult.policy.allowed_surfaces.length,
+    blocked_surfaces_count: loadResult.policy.blocked_surfaces.length,
+    allowed_commands_count: loadResult.policy.allowed_commands.length,
+    blocked_commands_count: loadResult.policy.blocked_commands.length,
+    allowed_actions_count: loadResult.policy.allowed_actions.length,
+    blocked_actions_count: loadResult.policy.blocked_actions.length,
+    allowed_services_count: loadResult.policy.allowed_services.length,
+    blocked_services_count: loadResult.policy.blocked_services.length,
+    extension_override_count: loadResult.policy.extension_overrides.length
+  };
+  const capabilityGuidance = collectUnknownCapabilityGuidance(normalizedWarnings);
+  const capabilityContract = buildCapabilityContractMetadata();
+  const warningCodes = triage.warning_codes;
+  const remediation = buildDoctorRemediation(triage.remediation, loadResult.failed.length, activationResult.failed.length, options.vocabulary, managedStateFix);
+  const summary = {
+    status: triage.status,
+    scope,
+    warning_count: triage.warning_count,
+    warning_codes: warningCodes,
+    total_extensions: runtimeInstalledExtensions.length,
+    managed_total: runtimeInstalledExtensions.filter((entry) => entry.managed).length,
+    enabled_total: runtimeInstalledExtensions.filter((entry) => entry.enabled).length,
+    active_total: runtimeInstalledExtensions.filter((entry) => entry.active).length,
+    unmanaged_loaded_extension_count: triage.unmanaged_loaded_extension_count,
+    unmanaged_action_required_extension_count: triage.unmanaged_action_required_extension_count,
+    unmanaged_expected_extension_count: triage.unmanaged_expected_extension_count,
+    runtime_active_total: runtimeInstalledExtensions.filter((entry) => entry.runtime_active === true).length,
+    activation_status_totals: {
+      ok: runtimeInstalledExtensions.filter((entry) => entry.activation_status === "ok").length,
+      failed: runtimeInstalledExtensions.filter((entry) => entry.activation_status === "failed").length,
+      not_loaded: runtimeInstalledExtensions.filter((entry) => entry.activation_status === "not_loaded").length,
+      unknown: runtimeInstalledExtensions.filter((entry) => entry.activation_status === "unknown").length
+    },
+    unknown_capability_count: capabilityGuidance.length,
+    capability_contract_version: capabilityContract.version,
+    update_available_total: runtimeInstalledExtensions.filter((entry) => entry.update_available === true).length,
+    update_health_coverage: triage.update_health_coverage,
+    update_health_partial: triage.update_health_partial,
+    update_check_failed_total: runtimeInstalledExtensions.filter((entry) => entry.update_check_status === "failed").length,
+    load_failure_count: loadResult.failed.length,
+    activation_failure_count: activationResult.failed.length,
+    blocking_failure_count: loadResult.failed.length + activationResult.failed.length,
+    has_blocking_failures: loadResult.failed.length + activationResult.failed.length > 0,
+    consistency_warning_count: doctorConsistency.warnings.length,
+    trace_enabled: includeTrace,
+    policy: policySummary,
+    remediation
+  };
+  const managedStateFixSummary = managedStateFix ? {
+    requested: true,
+    applied: managedStateFix.adopted_entries.length > 0,
+    adopted_count: managedStateFix.adopted_entries.length,
+    already_managed_count: managedStateFix.already_managed_count,
+    adopted_extensions: managedStateFix.adopted_entries.map((entry) => entry.name)
+  } : {
+    requested: false,
+    applied: false,
+    adopted_count: 0,
+    already_managed_count: refreshedInstalled.extensions.filter((entry) => entry.managed).length,
+    adopted_extensions: []
+  };
+  const details = {
+    mode: detailMode,
+    summary,
+    triage,
+    trace_enabled: includeTrace,
+    capability_contract: capabilityContract,
+    capability_guidance: capabilityGuidance,
+    managed_state_fix: managedStateFixSummary,
+    policy: loadResult.policy
+  };
+  if (detailMode === "deep") {
+    const activationFailedDetails = includeTrace ? activationResult.failed : activationResult.failed.map((entry) => {
+      const { trace: _trace, ...rest } = entry;
+      return rest;
+    });
+    details.deep = {
+      warnings: normalizedWarnings,
+      warning_codes: warningCodes,
+      capability_contract: capabilityContract,
+      capability_guidance: capabilityGuidance,
+      trace_enabled: includeTrace,
+      managed_state: {
+        path: managedStateRead.path,
+        count: managedState.entries.length,
+        entries: managedState.entries
       },
-      active: action === "activate",
-      settings_changed: settingsChanged,
-      settings: {
-        enabled: [...settings.extensions.enabled],
-        disabled: [...settings.extensions.disabled]
+      installed_extensions: runtimeInstalledExtensions,
+      load: {
+        roots: loadResult.roots,
+        policy: loadResult.policy,
+        warnings: loadResult.warnings,
+        failed: loadResult.failed,
+        loaded: loadResult.loaded.map((entry) => ({
+          layer: entry.layer,
+          directory: entry.directory,
+          name: entry.name,
+          version: entry.version,
+          entry: entry.entry,
+          priority: entry.priority
+        }))
+      },
+      activation: {
+        failed: activationFailedDetails,
+        warnings: activationResult.warnings,
+        hook_counts: activationResult.hook_counts,
+        registration_counts: activationResult.registration_counts,
+        parser_override_count: activationResult.parser_override_count,
+        preflight_override_count: activationResult.preflight_override_count,
+        service_override_count: activationResult.service_override_count,
+        renderer_override_count: activationResult.renderer_override_count
+      },
+      consistency: doctorConsistency.summary
+    };
+    if (includeTrace) {
+      details.deep.trace = {
+        activation_failures: activationResult.failed.filter((entry) => entry.trace !== void 0).map((entry) => ({
+          layer: entry.layer,
+          name: entry.name,
+          entry_path: entry.entry_path,
+          error: entry.error,
+          method: entry.trace?.method,
+          command: entry.trace?.command,
+          capability: entry.trace?.capability,
+          missing_capability: entry.trace?.missing_capability,
+          registration_index: entry.trace?.registration_index,
+          expected_schema: entry.trace?.expected_schema,
+          hint: entry.trace?.hint,
+          received: entry.trace?.received
+        }))
+      };
+    }
+  }
+  return withResult(details);
+}
+async function runExtensionDescribeAction(ctx) {
+  const { normalizedTarget, scope, resolvedRoots, warnings, options, global, withResult } = ctx;
+  const settings = await readSettings(resolvedRoots.settings_root);
+  const loadResult = await loadExtensions({
+    pmRoot: resolvedRoots.pm_root,
+    settings,
+    cwd: process.cwd(),
+    noExtensions: global.noExtensions === true
+  });
+  const activationResult = await activateExtensions(loadResult);
+  warnings.push(...loadResult.warnings);
+  warnings.push(...activationResult.warnings);
+  const describeResult = buildExtensionDescribeResult(normalizedTarget, loadResult, activationResult);
+  if (normalizedTarget !== void 0 && describeResult.extensions.length === 0) {
+    const noun = options.vocabulary === "package" ? "package" : "extension";
+    throw new PmCliError(`No loaded ${noun} named "${normalizedTarget}" was found in ${scope} scope. Run pm ${noun} explore to list discovered ${noun}s.`, EXIT_CODE.NOT_FOUND);
+  }
+  return withResult({
+    target: describeResult.target,
+    total: describeResult.total,
+    extensions: describeResult.extensions,
+    union: describeResult.union
+  });
+}
+async function runExtensionExploreManageAction(ctx) {
+  const { action, scope, resolvedRoots, warnings, options, global, withResult } = ctx;
+  const settings = await readSettings(resolvedRoots.settings_root);
+  const configuredPolicy = buildExtensionPolicyDetails(settings.extensions.policy);
+  const managedStateRead = await readManagedExtensionState(resolvedRoots.selected_root);
+  warnings.push(...managedStateRead.warnings);
+  const installed = await listInstalledExtensions(resolvedRoots.selected_root, scope, settings, managedStateRead.state);
+  warnings.push(...installed.warnings);
+  let managedState = managedStateRead.state;
+  const managedStateFix = action === "manage" && options.fixManagedState === true ? await adoptUnmanagedExtensions(resolvedRoots.selected_root, scope, installed.extensions, managedStateRead.state) : null;
+  if (managedStateFix) {
+    managedState = managedStateFix.state;
+  }
+  if (action === "manage") {
+    const updates = await Promise.all(managedState.entries.map(async (entry) => {
+      if (entry.source.kind !== "github") {
+        return entry;
       }
-    });
+      const updateStatus = await checkGithubUpdate(entry.source);
+      return {
+        ...entry,
+        last_update_check_at: updateStatus.checked_at,
+        last_update_remote_commit: updateStatus.remote_commit,
+        update_available: updateStatus.available,
+        update_error: updateStatus.error
+      };
+    }));
+    managedState = {
+      ...managedState,
+      updated_at: nowIso(),
+      entries: sortManagedEntries(updates)
+    };
+    await writeManagedExtensionState(resolvedRoots.selected_root, managedState);
+  }
+  const refreshedInstalled = await listInstalledExtensions(resolvedRoots.selected_root, scope, settings, managedState);
+  warnings.push(...refreshedInstalled.warnings);
+  if (action === "manage") {
+    const updateWarnings = refreshedInstalled.extensions.filter((entry) => entry.update_check_status === "failed").map((entry) => `extension_update_check_failed:${entry.name}`);
+    warnings.push(...updateWarnings);
   }
-  if (action === "doctor") {
-    if (normalizedTarget && normalizedTarget.trim().length > 0) {
-      throw new PmCliError('Action "doctor" does not accept a target argument.', EXIT_CODE.USAGE);
-    }
-    const detailMode = parseDoctorDetailMode(options.detail);
-    const includeTrace = options.trace === true;
-    if (includeTrace && detailMode !== "deep") {
-      throw new PmCliError("--trace requires --detail deep with --doctor.", EXIT_CODE.USAGE);
-    }
-    const settings = await readSettings(resolvedRoots.settings_root);
-    const managedStateRead = await readManagedExtensionState(resolvedRoots.selected_root);
-    warnings.push(...managedStateRead.warnings);
-    const installed = await listInstalledExtensions(resolvedRoots.selected_root, scope, settings, managedStateRead.state);
-    warnings.push(...installed.warnings);
-    let managedState = managedStateRead.state;
-    const managedStateFix = options.fixManagedState === true ? await adoptUnmanagedExtensions(resolvedRoots.selected_root, scope, installed.extensions, managedStateRead.state) : null;
-    if (managedStateFix) {
-      managedState = managedStateFix.state;
-    }
-    const refreshedInstalled = await listInstalledExtensions(resolvedRoots.selected_root, scope, settings, managedState);
-    warnings.push(...refreshedInstalled.warnings);
+  let runtimeProbeSummary;
+  let runtimeInstalledExtensions = refreshedInstalled.extensions;
+  let runtimeActivationFailures;
+  if (action === "explore" || options.runtimeProbe === true) {
     const loadResult = await loadExtensions({
       pmRoot: resolvedRoots.pm_root,
       settings,
@@ -2913,315 +3291,77 @@ async function runExtension(target, options, global) {
       loaded: loadResult.loaded
     });
     warnings.push(...loadResult.warnings);
-    warnings.push(...classifyDoctorLoadFailureWarnings(loadResult.failed));
     warnings.push(...activationResult.warnings);
-    warnings.push(...classifyDoctorActivationFailureWarnings(activationResult.failed));
-    warnings.push(...classifyUnusedCapabilityWarnings(loadResult, activationResult));
-    warnings.push(...collectGlobalOutputOverrideDoctorWarnings(activationResult));
-    warnings.push(...collectSchemaNarrowActivationDoctorWarnings(loadResult, activationResult));
-    const runtimeInstalledExtensions = applyDoctorRuntimeActivationState(refreshedInstalled.extensions, loadResult, activationResult);
-    const doctorConsistency = buildDoctorConsistencySummary(scope, runtimeInstalledExtensions, loadResult.loaded.map((entry) => ({ layer: entry.layer, name: entry.name })), loadResult.failed.map((entry) => ({ name: entry.name })), loadResult.disabled_by_flag);
-    warnings.push(...doctorConsistency.warnings);
-    const updateCheckWarnings = runtimeInstalledExtensions.filter((entry) => entry.update_check_status === "failed").map((entry) => `extension_update_check_failed:${entry.name}`);
-    warnings.push(...updateCheckWarnings);
-    const triage = buildExtensionTriageSummary(scope, warnings, runtimeInstalledExtensions, options);
-    warnings.push(...triage.warnings);
-    const normalizedWarnings = [...triage.warnings];
-    const policySummary = {
-      mode: loadResult.policy.mode,
-      trust_mode: loadResult.policy.trust_mode,
-      require_provenance: loadResult.policy.require_provenance,
-      default_sandbox_profile: loadResult.policy.default_sandbox_profile,
-      // Honest trust model (ADR pm-6ef3): keep this caveat to one concise line.
-      sandbox_enforcement: "advisory: sandbox_profile/permissions are declaration-based load gates, not runtime isolation (ADR pm-6ef3)",
-      trusted_extensions_count: loadResult.policy.trusted_extensions.length,
-      allowed_extensions_count: loadResult.policy.allowed_extensions.length,
-      blocked_extensions_count: loadResult.policy.blocked_extensions.length,
-      allowed_capabilities_count: loadResult.policy.allowed_capabilities.length,
-      blocked_capabilities_count: loadResult.policy.blocked_capabilities.length,
-      allowed_surfaces_count: loadResult.policy.allowed_surfaces.length,
-      blocked_surfaces_count: loadResult.policy.blocked_surfaces.length,
-      allowed_commands_count: loadResult.policy.allowed_commands.length,
-      blocked_commands_count: loadResult.policy.blocked_commands.length,
-      allowed_actions_count: loadResult.policy.allowed_actions.length,
-      blocked_actions_count: loadResult.policy.blocked_actions.length,
-      allowed_services_count: loadResult.policy.allowed_services.length,
-      blocked_services_count: loadResult.policy.blocked_services.length,
-      extension_override_count: loadResult.policy.extension_overrides.length
-    };
-    const capabilityGuidance = collectUnknownCapabilityGuidance(normalizedWarnings);
-    const capabilityContract = buildCapabilityContractMetadata();
-    const warningCodes = triage.warning_codes;
-    const remediation = [
-      ...new Set([
-        ...triage.remediation,
-        /* c8 ignore start -- vocabulary-specific remediation branches are copy-only variants */
-        ...loadResult.failed.length > 0 ? [
-          options.vocabulary === "package" ? "Run pm package explore --project and pm package explore --global to inspect load failures." : "Run pm extension --explore --project and pm extension --explore --global to inspect load failures."
-        ] : [],
-        ...activationResult.failed.length > 0 ? [
-          options.vocabulary === "package" ? "Review activation failures in pm package doctor --detail deep output." : "Review activation failures in pm extension --doctor --detail deep output."
-        ] : [],
-        /* c8 ignore stop */
-        ...managedStateFix && managedStateFix.adopted_entries.length > 0 ? [`Managed-state fix adopted ${managedStateFix.adopted_entries.length} extension(s).`] : []
-      ].map((entry) => entry.trim()).filter((entry) => entry.length > 0))
-    ];
-    const summary = {
-      status: triage.status,
-      scope,
-      warning_count: triage.warning_count,
-      warning_codes: warningCodes,
-      total_extensions: runtimeInstalledExtensions.length,
-      managed_total: runtimeInstalledExtensions.filter((entry) => entry.managed).length,
-      enabled_total: runtimeInstalledExtensions.filter((entry) => entry.enabled).length,
-      active_total: runtimeInstalledExtensions.filter((entry) => entry.active).length,
-      unmanaged_loaded_extension_count: triage.unmanaged_loaded_extension_count,
-      unmanaged_action_required_extension_count: triage.unmanaged_action_required_extension_count,
-      unmanaged_expected_extension_count: triage.unmanaged_expected_extension_count,
-      runtime_active_total: runtimeInstalledExtensions.filter((entry) => entry.runtime_active === true).length,
-      activation_status_totals: {
-        ok: runtimeInstalledExtensions.filter((entry) => entry.activation_status === "ok").length,
-        failed: runtimeInstalledExtensions.filter((entry) => entry.activation_status === "failed").length,
-        not_loaded: runtimeInstalledExtensions.filter((entry) => entry.activation_status === "not_loaded").length,
-        unknown: runtimeInstalledExtensions.filter((entry) => entry.activation_status === "unknown").length
-      },
-      unknown_capability_count: capabilityGuidance.length,
-      capability_contract_version: capabilityContract.version,
-      update_available_total: runtimeInstalledExtensions.filter((entry) => entry.update_available === true).length,
-      update_health_coverage: triage.update_health_coverage,
-      update_health_partial: triage.update_health_partial,
-      update_check_failed_total: runtimeInstalledExtensions.filter((entry) => entry.update_check_status === "failed").length,
+    runtimeInstalledExtensions = applyDoctorRuntimeActivationState(refreshedInstalled.extensions, loadResult, activationResult);
+    runtimeActivationFailures = collectActivationFailureDiagnostics(activationResult.failed);
+    runtimeProbeSummary = {
+      requested: true,
+      executed: true,
+      reason: action === "explore" ? "explore_defaults_to_runtime_probe" : "runtime_probe_requested",
       load_failure_count: loadResult.failed.length,
       activation_failure_count: activationResult.failed.length,
-      blocking_failure_count: loadResult.failed.length + activationResult.failed.length,
-      has_blocking_failures: loadResult.failed.length + activationResult.failed.length > 0,
-      consistency_warning_count: doctorConsistency.warnings.length,
-      trace_enabled: includeTrace,
-      policy: policySummary,
-      remediation
+      warning_count: [.../* @__PURE__ */ new Set([...loadResult.warnings, ...activationResult.warnings])].length,
+      policy: loadResult.policy
     };
-    const managedStateFixSummary = managedStateFix ? {
+  } else if (action === "manage") {
+    runtimeProbeSummary = {
+      requested: false,
+      executed: false
+    };
+  }
+  const triage = buildExtensionTriageSummary(scope, warnings, runtimeInstalledExtensions, options);
+  warnings.push(...triage.warnings);
+  const details = {
+    total: runtimeInstalledExtensions.length,
+    managed_total: runtimeInstalledExtensions.filter((entry) => entry.managed).length,
+    enabled_total: runtimeInstalledExtensions.filter((entry) => entry.enabled).length,
+    active_total: runtimeInstalledExtensions.filter((entry) => entry.active).length,
+    extensions: runtimeInstalledExtensions,
+    triage,
+    policy: configuredPolicy
+  };
+  if (runtimeActivationFailures !== void 0) {
+    details.activation_diagnostics = {
+      failed_count: runtimeActivationFailures.length,
+      failed: runtimeActivationFailures
+    };
+  }
+  if (action === "explore") {
+    details.runtime_probe = runtimeProbeSummary;
+  }
+  if (action === "manage") {
+    details.runtime_probe = runtimeProbeSummary;
+    details.managed_state_fix = managedStateFix !== null ? {
       requested: true,
       applied: managedStateFix.adopted_entries.length > 0,
       adopted_count: managedStateFix.adopted_entries.length,
-      already_managed_count: managedStateFix.already_managed_count,
-      adopted_extensions: managedStateFix.adopted_entries.map((entry) => entry.name)
+      adopted_extensions: managedStateFix.adopted_entries.map((entry) => entry.name),
+      already_managed_count: managedStateFix.already_managed_count
     } : {
       requested: false,
       applied: false,
       adopted_count: 0,
-      already_managed_count: refreshedInstalled.extensions.filter((entry) => entry.managed).length,
-      adopted_extensions: []
-    };
-    const details = {
-      mode: detailMode,
-      summary,
-      triage,
-      trace_enabled: includeTrace,
-      capability_contract: capabilityContract,
-      capability_guidance: capabilityGuidance,
-      managed_state_fix: managedStateFixSummary,
-      policy: loadResult.policy
-    };
-    if (detailMode === "deep") {
-      const activationFailedDetails = includeTrace ? activationResult.failed : activationResult.failed.map((entry) => {
-        const { trace: _trace, ...rest } = entry;
-        return rest;
-      });
-      details.deep = {
-        warnings: normalizedWarnings,
-        warning_codes: warningCodes,
-        capability_contract: capabilityContract,
-        capability_guidance: capabilityGuidance,
-        trace_enabled: includeTrace,
-        managed_state: {
-          path: managedStateRead.path,
-          count: managedState.entries.length,
-          entries: managedState.entries
-        },
-        installed_extensions: runtimeInstalledExtensions,
-        load: {
-          roots: loadResult.roots,
-          policy: loadResult.policy,
-          warnings: loadResult.warnings,
-          failed: loadResult.failed,
-          loaded: loadResult.loaded.map((entry) => ({
-            layer: entry.layer,
-            directory: entry.directory,
-            name: entry.name,
-            version: entry.version,
-            entry: entry.entry,
-            priority: entry.priority
-          }))
-        },
-        activation: {
-          failed: activationFailedDetails,
-          warnings: activationResult.warnings,
-          hook_counts: activationResult.hook_counts,
-          registration_counts: activationResult.registration_counts,
-          parser_override_count: activationResult.parser_override_count,
-          preflight_override_count: activationResult.preflight_override_count,
-          service_override_count: activationResult.service_override_count,
-          renderer_override_count: activationResult.renderer_override_count
-        },
-        consistency: doctorConsistency.summary
-      };
-      if (includeTrace) {
-        details.deep.trace = {
-          activation_failures: activationResult.failed.filter((entry) => entry.trace !== void 0).map((entry) => ({
-            layer: entry.layer,
-            name: entry.name,
-            entry_path: entry.entry_path,
-            error: entry.error,
-            method: entry.trace?.method,
-            command: entry.trace?.command,
-            capability: entry.trace?.capability,
-            missing_capability: entry.trace?.missing_capability,
-            registration_index: entry.trace?.registration_index,
-            expected_schema: entry.trace?.expected_schema,
-            hint: entry.trace?.hint,
-            received: entry.trace?.received
-          }))
-        };
-      }
-    }
-    return withResult(details);
-  }
-  if (action === "describe") {
-    const settings = await readSettings(resolvedRoots.settings_root);
-    const loadResult = await loadExtensions({
-      pmRoot: resolvedRoots.pm_root,
-      settings,
-      cwd: process.cwd(),
-      noExtensions: global.noExtensions === true
-    });
-    const activationResult = await activateExtensions(loadResult);
-    warnings.push(...loadResult.warnings);
-    warnings.push(...activationResult.warnings);
-    const describeResult = buildExtensionDescribeResult(normalizedTarget, loadResult, activationResult);
-    if (normalizedTarget !== void 0 && describeResult.extensions.length === 0) {
-      const noun = options.vocabulary === "package" ? "package" : "extension";
-      throw new PmCliError(`No loaded ${noun} named "${normalizedTarget}" was found in ${scope} scope. Run pm ${noun} explore to list discovered ${noun}s.`, EXIT_CODE.NOT_FOUND);
-    }
-    return withResult({
-      target: describeResult.target,
-      total: describeResult.total,
-      extensions: describeResult.extensions,
-      union: describeResult.union
-    });
-  }
-  if (action === "explore" || action === "manage") {
-    const settings = await readSettings(resolvedRoots.settings_root);
-    const configuredPolicy = buildExtensionPolicyDetails(settings.extensions.policy);
-    const managedStateRead = await readManagedExtensionState(resolvedRoots.selected_root);
-    warnings.push(...managedStateRead.warnings);
-    const installed = await listInstalledExtensions(resolvedRoots.selected_root, scope, settings, managedStateRead.state);
-    warnings.push(...installed.warnings);
-    let managedState = managedStateRead.state;
-    const managedStateFix = action === "manage" && options.fixManagedState === true ? await adoptUnmanagedExtensions(resolvedRoots.selected_root, scope, installed.extensions, managedStateRead.state) : null;
-    if (managedStateFix) {
-      managedState = managedStateFix.state;
-    }
-    if (action === "manage") {
-      const updates = await Promise.all(managedState.entries.map(async (entry) => {
-        if (entry.source.kind !== "github") {
-          return entry;
-        }
-        const updateStatus = await checkGithubUpdate(entry.source);
-        return {
-          ...entry,
-          last_update_check_at: updateStatus.checked_at,
-          last_update_remote_commit: updateStatus.remote_commit,
-          update_available: updateStatus.available,
-          update_error: updateStatus.error
-        };
-      }));
-      managedState = {
-        ...managedState,
-        updated_at: nowIso(),
-        entries: sortManagedEntries(updates)
-      };
-      await writeManagedExtensionState(resolvedRoots.selected_root, managedState);
-    }
-    const refreshedInstalled = await listInstalledExtensions(resolvedRoots.selected_root, scope, settings, managedState);
-    warnings.push(...refreshedInstalled.warnings);
-    if (action === "manage") {
-      const updateWarnings = refreshedInstalled.extensions.filter((entry) => entry.update_check_status === "failed").map((entry) => `extension_update_check_failed:${entry.name}`);
-      warnings.push(...updateWarnings);
-    }
-    let runtimeProbeSummary;
-    let runtimeInstalledExtensions = refreshedInstalled.extensions;
-    let runtimeActivationFailures;
-    if (action === "explore" || options.runtimeProbe === true) {
-      const loadResult = await loadExtensions({
-        pmRoot: resolvedRoots.pm_root,
-        settings,
-        cwd: process.cwd(),
-        noExtensions: global.noExtensions === true
-      });
-      const activationResult = await activateExtensions({
-        ...loadResult,
-        loaded: loadResult.loaded
-      });
-      warnings.push(...loadResult.warnings);
-      warnings.push(...activationResult.warnings);
-      runtimeInstalledExtensions = applyDoctorRuntimeActivationState(refreshedInstalled.extensions, loadResult, activationResult);
-      runtimeActivationFailures = collectActivationFailureDiagnostics(activationResult.failed);
-      runtimeProbeSummary = {
-        requested: true,
-        executed: true,
-        reason: action === "explore" ? "explore_defaults_to_runtime_probe" : "runtime_probe_requested",
-        load_failure_count: loadResult.failed.length,
-        activation_failure_count: activationResult.failed.length,
-        warning_count: [.../* @__PURE__ */ new Set([...loadResult.warnings, ...activationResult.warnings])].length,
-        policy: loadResult.policy
-      };
-    } else if (action === "manage") {
-      runtimeProbeSummary = {
-        requested: false,
-        executed: false
-      };
-    }
-    const triage = buildExtensionTriageSummary(scope, warnings, runtimeInstalledExtensions, options);
-    warnings.push(...triage.warnings);
-    const details = {
-      total: runtimeInstalledExtensions.length,
-      managed_total: runtimeInstalledExtensions.filter((entry) => entry.managed).length,
-      enabled_total: runtimeInstalledExtensions.filter((entry) => entry.enabled).length,
-      active_total: runtimeInstalledExtensions.filter((entry) => entry.active).length,
-      extensions: runtimeInstalledExtensions,
-      triage,
-      policy: configuredPolicy
+      adopted_extensions: [],
+      already_managed_count: runtimeInstalledExtensions.filter((entry) => entry.managed).length
     };
-    if (runtimeActivationFailures !== void 0) {
-      details.activation_diagnostics = {
-        failed_count: runtimeActivationFailures.length,
-        failed: runtimeActivationFailures
-      };
-    }
-    if (action === "explore") {
-      details.runtime_probe = runtimeProbeSummary;
-    }
-    if (action === "manage") {
-      details.runtime_probe = runtimeProbeSummary;
-      details.managed_state_fix = managedStateFix !== null ? {
-        requested: true,
-        applied: managedStateFix.adopted_entries.length > 0,
-        adopted_count: managedStateFix.adopted_entries.length,
-        adopted_extensions: managedStateFix.adopted_entries.map((entry) => entry.name),
-        already_managed_count: managedStateFix.already_managed_count
-      } : {
-        requested: false,
-        applied: false,
-        adopted_count: 0,
-        adopted_extensions: [],
-        already_managed_count: runtimeInstalledExtensions.filter((entry) => entry.managed).length
-      };
-    }
-    return withResult(details);
   }
-  throw new PmCliError(`Unsupported extension action "${action}".`, EXIT_CODE.USAGE);
-}
+  return withResult(details);
+}
+var EXTENSION_ACTION_HANDLERS = {
+  init: runExtensionInitAction,
+  install: runExtensionInstallAction,
+  uninstall: runExtensionUninstallAction,
+  explore: runExtensionExploreManageAction,
+  manage: runExtensionExploreManageAction,
+  describe: runExtensionDescribeAction,
+  reload: runExtensionReloadAction,
+  doctor: runExtensionDoctorAction,
+  catalog: runExtensionCatalogAction,
+  adopt: runExtensionAdoptAction,
+  "adopt-all": runExtensionAdoptAllAction,
+  activate: runExtensionActivateDeactivateAction,
+  deactivate: runExtensionActivateDeactivateAction
+};
 var _testOnly = {
   adoptUnmanagedExtensions,
   buildExtensionPolicyDetails,
@@ -3259,6 +3399,6 @@ export {
   runExtension,
   _testOnly
 };
-//# sourceMappingURL=chunk-JZG5ADVE.js.map
+//# sourceMappingURL=chunk-NU2UEROZ.js.map
 
-//# debugId=cf3d5e72-2400-54df-b34f-c84fd2383853
+//# debugId=bfb4fc80-65a7-5c83-b180-b171fcfa4f33