create-principles-disciple 1.146.4 → 1.146.7

package/release-manager/dist/uninstaller.js

@@ -1,746 +0,0 @@
-/**
- * Uninstaller module
- *
- * ⚠️ Safety principles:
- * 1. Only delete plugin system files (~/.openclaw/extensions/principles-disciple)
- * 2. Only delete plugin config files (~/.openclaw/principles-disciple.json)
- * 3. Never delete any files from user workspace:
- *    - MD files (AGENTS.md, SOUL.md, etc.)
- *    - Memory files (.principles/ directory)
- *    - State files (.state/ directory)
- *    - Any user data
- *
- * ADR-0020 §2.3: Multi-host uninstall. Host-side config cleanup (openclaw.json
- * entries, ~/.codex/hooks.json entries, wrapper scripts) is delegated to
- * HostInstaller.uninstall() implementations. Workspace user data is always
- * preserved regardless of host target.
- */
-import { existsSync, lstatSync, readFileSync } from 'fs';
-import fse from 'fs-extra';
-import * as path from 'path';
-import * as os from 'os';
-import { execFileSync } from 'child_process';
-import { confirm } from '@inquirer/prompts';
-import { logger } from './utils/logger.js';
-import { getOpenClawConfigDir, getPluginExtDir, checkOpenClawGateway } from './utils/env.js';
-import { getGlobalShimPaths, getInstalledBinDir, getPdRuntimeDir, getPdDir, getPdRuntimeBackupsDir, getInstallManifestPath, isWindows } from './mvp-config.js';
-import { parseInstallManifest } from '@principles/install-layout';
-import { mergeIntoInstallJson, resolvePdHomePaths } from './update/install-layout.js';
-import { readActiveRecord } from './update/transaction-journal.js';
-import { setLanguage, t, getLanguage } from './i18n.js';
-import { getHostInstallers, WorkBuddyHostInstaller } from './installers/index.js';
-/**
- * PRI-945: does a filesystem ENTRY exist at p — including a dangling
- * symlink/junction whose target is missing? existsSync follows the link and
- * returns false for a dangling one, so a removal gate silently strands it.
- * lstat checks the link itself. True for any dirent; false on ENOENT/other
- * stat error (fail-safe: absent → nothing to remove). Removal itself is
- * already dangling-safe (fse.remove → fs.rm {recursive,force} unlinks without
- * following the target), so this only fixes the "should I delete" decision.
- */
-function pathEntryExists(p) {
-    try {
-        lstatSync(p);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-export function planSharedRuntimeUninstall(host) {
-    if (host === 'all') {
-        return { removeSharedRuntime: true, remainingHosts: [], manifestHasTarget: true };
-    }
-    try {
-        const raw = JSON.parse(readFileSync(getInstallManifestPath(), 'utf8'));
-        const parsed = parseInstallManifest(raw);
-        if (!parsed.manifest) {
-            return {
-                removeSharedRuntime: false,
-                remainingHosts: [],
-                manifestHasTarget: false,
-                warning: `${parsed.error ?? 'install_manifest_malformed'}; shared runtime preserved. Re-run uninstall --host all after repairing ~/.pd/install.json.`,
-            };
-        }
-        const manifestHasTarget = parsed.manifest.hosts.includes(host);
-        // Unknown host registrations survive an uninstall of a KNOWN host — the
-        // shared runtime may be serving a newer host this reader cannot name, so
-        // it is only removable when NO registration (known or unknown) remains.
-        const remainingHosts = [
-            ...parsed.manifest.hosts.filter(candidate => candidate !== host),
-            ...(parsed.manifest.unknownHosts ?? []),
-        ];
-        return { removeSharedRuntime: remainingHosts.length === 0, remainingHosts, manifestHasTarget };
-    }
-    catch (error) {
-        return {
-            removeSharedRuntime: false,
-            remainingHosts: [],
-            manifestHasTarget: false,
-            warning: `install_manifest_unreadable: ${error instanceof Error ? error.message : String(error)}; shared runtime preserved. Re-run uninstall --host all after repairing ~/.pd/install.json.`,
-        };
-    }
-}
-async function detectAndSetLanguage(lang) {
-    setLanguage(lang === 'en' ? 'en' : 'zh');
-}
-/**
- * Check install status across all hosts (OpenClaw + Codex).
- *
- * ADR-0020 §2.3: Detects PD install markers for each registered host.
- * Returns aggregated status so `pd status` / `npx create-principles-disciple
- * status` shows the full picture regardless of which host was selected
- * during install.
- */
-export function checkInstallStatus(host = 'all') {
-    const configDir = getOpenClawConfigDir();
-    const lang = getLanguage();
-    // OpenClaw paths
-    const openclawPaths = [
-        { path: getPluginExtDir(), name: lang === 'zh' ? '插件扩展目录' : 'Plugin extension directory', type: 'dir' },
-        { path: path.join(configDir, 'principles-disciple.json'), name: lang === 'zh' ? 'OpenClaw 配置文件' : 'OpenClaw config file', type: 'file' },
-    ];
-    // Codex paths (ADR-0020).
-    // NOTE: ~/.codex/hooks.json is intentionally NOT in this deletion set.
-    // It is a shared host config file — CodexHostInstaller.uninstall() removes
-    // only PD-owned entries (matched by __pd_marker) from it. If it were listed
-    // here, the generic delete loop below would delete the entire file,
-    // destroying the user's non-PD Codex hooks. Also, including it would make
-    // isInstalled=true for any user who merely has a hooks.json, even if PD
-    // was never installed.
-    const pdCodexDir = path.join(os.homedir(), '.pd', 'codex');
-    const codexPaths = [
-        { path: path.join(pdCodexDir, 'pd-hooks.marker'), name: lang === 'zh' ? 'Codex 安装标记' : 'Codex install marker', type: 'file' },
-        { path: path.join(pdCodexDir, 'pd-hook-entry.cjs'), name: lang === 'zh' ? 'Codex 钩子入口' : 'Codex hook entry script', type: 'file' },
-    ];
-    // WorkBuddy paths (ADR-0020 third host, SPEC workbuddy-host-adapter §6).
-    // ONLY provably PD-owned artifacts belong here: the PD-owned local
-    // marketplace directory. Everything else in the WorkBuddy domain is
-    // deliberately EXCLUDED from the generic delete loop:
-    //   - the governance workspace (~/.workbuddy/pd-workspace) is NEVER a
-    //     deletion candidate — it owns the governance database (OD-07/§18);
-    //   - settings.json / installed_plugins.json / the plugin cache are shared
-    //     or host-owned — WorkBuddyHostInstaller.uninstall() removes only OUR
-    //     entries from them;
-    //   - the shared runtime payload under ~/.pd/runtime is retained per the
-    //     install.json manifest policy (planSharedRuntimeUninstall).
-    // Review 2026-10-13 S1: without this branch, host==='workbuddy' fell into
-    // the openclaw+codex union and a WorkBuddy-only uninstall DELETED other
-    // hosts' files before the host installer ever ran.
-    const workbuddyPaths = [
-        { path: path.join(os.homedir(), '.pd', 'workbuddy-marketplace'), name: lang === 'zh' ? 'PD WorkBuddy marketplace（PD 拥有）' : 'PD WorkBuddy marketplace (PD-owned)', type: 'dir' },
-    ];
-    const allPaths = host === 'openclaw'
-        ? openclawPaths
-        : host === 'codex'
-            ? codexPaths
-            : host === 'workbuddy'
-                ? workbuddyPaths
-                : [...openclawPaths, ...codexPaths, ...workbuddyPaths];
-    const checkedPaths = allPaths.map(p => ({
-        exists: existsSync(p.path),
-        path: p.path,
-        name: p.name,
-        type: p.type,
-    }));
-    const isInstalled = checkedPaths.some(p => p.exists);
-    return { isInstalled, paths: checkedPaths };
-}
-/**
- * 检查 shim 文件是否由 Principles Disciple 创建
- * 通过读取文件内容，确认其目标指向 PD 安装目录
- */
-export function isPdOwnedShim(shimPath) {
-    try {
-        const content = readFileSync(shimPath, 'utf-8');
-        const pdBinDir = getInstalledBinDir();
-        const pdBinPath = isWindows()
-            ? path.join(pdBinDir, 'pd.cmd')
-            : path.join(pdBinDir, 'pd');
-        if (isWindows()) {
-            // Windows cmd/ps1 shim 应包含 PD 安装路径
-            return content.includes(pdBinDir) || content.includes(pdBinPath);
-        }
-        else {
-            // Unix shim 通常是符号链接或脚本，检查是否指向 PD 安装目录
-            return content.includes(pdBinDir) || content.includes(pdBinPath);
-        }
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Clean up global pd shim files
- * Only deletes shims that were created by Principles Disciple
- */
-async function removeGlobalPdShim() {
-    const removed = [];
-    const skipped = [];
-    const shimPaths = getGlobalShimPaths();
-    if (shimPaths.length === 0) {
-        logger.info(t('cannot_detect_npm_global'));
-        return { removed, skipped };
-    }
-    for (const shimPath of shimPaths) {
-        if (!pathEntryExists(shimPath)) {
-            skipped.push(shimPath);
-            continue;
-        }
-        if (!isPdOwnedShim(shimPath)) {
-            logger.warn(`${t('global_command_skip_not_owned')}: ${shimPath}`);
-            skipped.push(shimPath);
-            continue;
-        }
-        try {
-            await fse.remove(shimPath);
-            removed.push(shimPath);
-            logger.success(`${t('global_command_deleted')}: ${shimPath}`);
-        }
-        catch (error) {
-            logger.warn(`${t('global_command_delete_failed')}: ${shimPath} - ${error instanceof Error ? error.message : String(error)}`);
-            skipped.push(shimPath);
-        }
-    }
-    return { removed, skipped };
-}
-/**
- * Get user workspace path (for showing preservation notice)
- */
-function getWorkspacePath() {
-    const configDir = getOpenClawConfigDir();
-    const configPath = path.join(configDir, 'principles-disciple.json');
-    if (!existsSync(configPath))
-        return null;
-    // Read and parse JSON directly — require() would execute the file if its
-    // extension ever changed, and the path must stay inside the config dir.
-    const resolved = path.resolve(configPath);
-    if (resolved !== configPath && !resolved.startsWith(configDir + path.sep)) {
-        return null;
-    }
-    try {
-        const config = JSON.parse(readFileSync(configPath, 'utf-8'));
-        if (config && typeof config === 'object' && !Array.isArray(config)) {
-            const workspace = Reflect.get(config, 'workspace');
-            return typeof workspace === 'string' && workspace.length > 0 ? workspace : null;
-        }
-        return null;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Execute uninstall
- *
- * @param options.force Skip confirmation prompt (dangerous, for scripts only)
- * @param options.host   ADR-0020 host id: 'openclaw' | 'codex' | 'workbuddy' | 'all' (default 'all')
- */
-const REMOVE_RETRY_ATTEMPTS = 3;
-const REMOVE_RETRY_DELAY_MS = 1000;
-/**
- * PRI-696: find node processes running the installed PD console server and
- * stop them. Without this, a detached auto-launched console keeps native
- * modules under ~/.pd/runtime/console locked and the uninstall ends in a
- * partial state that only manual PID hunting resolves.
- *
- * Identification is by command line: the argv must reference the installed
- * console server entry (<pdRuntime>/console/dist/server.js) — the same
- * command the installer spawns. Never kills anything it cannot attribute.
- * ERR-045: argv-array execution only; every value is either a literal or a
- * validated JS-side output match, never a shell string.
- */
-/**
- * PRI-710: one RFC4180 CSV line → fields. Handles PowerShell ConvertTo-Csv
- * quoting: values are wrapped in double quotes and embedded quotes are
- * doubled (""). ConvertTo-Csv does NOT escape backslashes (wmic did), so
- * paths arrive verbatim. A comma inside a quoted value must not split.
- */
-function splitCsvLine(line) {
-    const fields = [];
-    let current = '';
-    let inQuotes = false;
-    for (let i = 0; i < line.length; i++) {
-        const char = line.charAt(i);
-        if (inQuotes) {
-            if (char === '"') {
-                if (line.charAt(i + 1) === '"') {
-                    current += '"';
-                    i++;
-                }
-                else {
-                    inQuotes = false;
-                }
-            }
-            else {
-                current += char;
-            }
-        }
-        else if (char === '"' && current === '') {
-            inQuotes = true;
-        }
-        else if (char === ',') {
-            fields.push(current);
-            current = '';
-        }
-        else {
-            current += char;
-        }
-    }
-    fields.push(current);
-    return fields;
-}
-/**
- * PRI-710 (supersedes parseWmicProcessCsv): parse
- * `Get-CimInstance Win32_Process | Select-Object ProcessId,CommandLine |
- * ConvertTo-Csv -NoTypeInformation` output. Header row is `ProcessId,
- * CommandLine` (order as selected); rows without a positive integer PID or
- * with an empty CommandLine are skipped. Attribution unchanged: only rows
- * whose CommandLine references consoleEntry count. Duplicates are collapsed
- * (CIM can surface the same PID twice across brief query windows).
- */
-export function parseConsoleProcessCsv(output, consoleEntry) {
-    const results = new Map();
-    const lines = output.split('\n').map((l) => l.replace(/\r$/, '').trim()).filter((l) => l.length > 0);
-    let processIdColumn = -1;
-    let commandLineColumn = -1;
-    for (const line of lines) {
-        const fields = splitCsvLine(line);
-        if (processIdColumn === -1) {
-            // Header row (first non-empty line): locate columns by name so a
-            // future property reorder cannot silently misparse PIDs.
-            processIdColumn = fields.findIndex((f) => f.trim().toLowerCase() === 'processid');
-            commandLineColumn = fields.findIndex((f) => f.trim().toLowerCase() === 'commandline');
-            if (processIdColumn === -1 || commandLineColumn === -1) {
-                // Unrecognized header — refuse to guess column positions (rc-3).
-                return [];
-            }
-            continue;
-        }
-        const pidStr = (fields[processIdColumn] ?? '').trim();
-        const pid = Number.parseInt(pidStr, 10);
-        if (!Number.isInteger(pid) || pid <= 0 || pid === process.pid)
-            continue;
-        const commandLine = (fields[commandLineColumn] ?? '').trim();
-        if (commandLine === '')
-            continue;
-        if (!commandLine.includes(consoleEntry))
-            continue;
-        results.set(pid, { pid });
-    }
-    return [...results.values()];
-}
-function findRunningConsoleProcesses() {
-    const consoleEntry = path.join(getPdRuntimeDir(), 'console', 'dist', 'server.js');
-    if (!existsSync(consoleEntry))
-        return [];
-    try {
-        // Windows-only: other platforms have no detached-console lock problem
-        // observed (the EPERM reports so far are all Windows prebuilds).
-        if (!isWindows())
-            return [];
-        // PRI-710: wmic.exe was removed from Windows 11 24H2+ and is not in the
-        // project command allowlist. Get-CimInstance is the supported successor
-        // (powershell.exe is allowlisted). The script is passed ENCODED (UTF-16LE
-        // base64) because Node→PowerShell argv quoting corrupts embedded quotes
-        // in -Command strings; -EncodedCommand is quote-safe. Output encoding is
-        // pinned to UTF-8: PowerShell 5.1 pipes use the OEM code page by default
-        // (cp936 on zh-CN hosts), which would mangle non-ASCII command lines
-        // before the consoleEntry match. Pipeline is ONE statement (a `|` before
-        // a `;` separator is an EmptyPipeElement syntax error — caught by the
-        // PRI-710 real-machine smoke).
-        const script = [
-            '[Console]::OutputEncoding=[System.Text.Encoding]::UTF8',
-            'Get-CimInstance Win32_Process -Filter "Name=\'node.exe\'" | Select-Object ProcessId,CommandLine | ConvertTo-Csv -NoTypeInformation',
-        ].join('; ');
-        const encoded = Buffer.from(script, 'utf16le').toString('base64');
-        const output = execFileSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-EncodedCommand', encoded], { encoding: 'utf8', timeout: 10_000 });
-        return parseConsoleProcessCsv(output, consoleEntry);
-    }
-    catch {
-        // PowerShell unavailable/failed — degrade to no-stop; removeWithRetry
-        // still handles transient locks, and the EPERM path reports the manual
-        // action.
-        return [];
-    }
-}
-function stopRunningConsoleProcesses() {
-    const notes = [];
-    for (const proc of findRunningConsoleProcesses()) {
-        try {
-            process.kill(proc.pid, 'SIGTERM');
-            notes.push(`stopped auto-launched console process (PID ${proc.pid})`);
-        }
-        catch {
-            // Already exited or not ours to kill — removing files will surface any
-            // remaining lock through the normal EPERM path.
-            notes.push(`console process PID ${proc.pid} could not be stopped (already exited or access denied)`);
-        }
-    }
-    return notes;
-}
-async function removeWithRetry(targetPath, _type) {
-    for (let attempt = 1; attempt <= REMOVE_RETRY_ATTEMPTS; attempt++) {
-        try {
-            await fse.remove(targetPath);
-            return;
-        }
-        catch (error) {
-            const errMsg = error instanceof Error ? error.message : String(error);
-            const isLockError = errMsg.includes('EPERM') || errMsg.includes('EBUSY') || errMsg.includes('permission');
-            if (!isLockError || attempt === REMOVE_RETRY_ATTEMPTS)
-                throw error;
-            await new Promise(r => setTimeout(r, REMOVE_RETRY_DELAY_MS * attempt));
-        }
-    }
-}
-/**
- * PRI-894 / PRI-895: on a full shared-runtime teardown (the last host being
- * uninstalled), reclaim the update residue under ~/.pd that the old flow left
- * behind: staging/, releases/ and backups/ (a GB-scale disk leak) plus a
- * dangling active.json pointing at a release that no longer exists.
- *
- * This is a §18 destructive path, so deletion is bounded to what can be PROVEN
- * safe: it runs only for a full teardown after the runtime dir itself is gone
- * (a partial uninstall or a locked runtime preserves everything); it removes
- * exactly those three hardcoded directories and never a glob of ~/.pd/* (so
- * transactions/ logs/ trust/ channels/ bootstrap/ stay untouched); it deletes
- * active.json last and only when readable with a target that is already gone;
- * and every removal is failure-open — a locked path lands in deleteErrors
- * (result.success=false) and install.json is kept so a re-run can retry.
- */
-async function reclaimSharedRuntimeResidue(params) {
-    if (!params.removeSharedRuntime || params.sharedRuntimeRemovalFailed) {
-        return { reclaimFailed: false };
-    }
-    const paths = resolvePdHomePaths(getPdDir());
-    const backupsDir = getPdRuntimeBackupsDir();
-    let reclaimFailed = false;
-    const reclaimed = [];
-    const preserved = [];
-    // Read the pointer before touching its targets, so we can decide whether
-    // releasing it is safe. Absent → null; unreadable/malformed → throw.
-    // existsSync (follow) is correct HERE: a dangling pointer has no readable
-    // content, so it stays null and is reclaimed later as a bare link entry.
-    let active = null;
-    let activeCorruptReason = null;
-    if (existsSync(paths.activeRecordPath)) {
-        try {
-            active = readActiveRecord(paths.activeRecordPath);
-        }
-        catch (err) {
-            // rc-9: keep WHY the pointer is unreadable so the operator sees it.
-            activeCorruptReason = err instanceof Error ? err.message : String(err);
-        }
-    }
-    const removeDir = async (dir, name) => {
-        // PRI-945: lstat, not existsSync — a dangling staging/releases/backups
-        // junction (interrupted release swap) must still be reclaimed, not skipped.
-        if (!pathEntryExists(dir))
-            return;
-        try {
-            await removeWithRetry(dir, 'dir');
-            params.removedDirs.push(dir);
-            reclaimed.push(`${path.basename(dir)}/`);
-        }
-        catch (err) {
-            reclaimFailed = true;
-            params.deleteErrors.push({ name, error: err instanceof Error ? err.message : String(err) });
-        }
-    };
-    await removeDir(paths.stagingDir, 'PD update staging');
-    await removeDir(paths.releasesDir, 'PD update releases');
-    await removeDir(backupsDir, 'PD update backups');
-    // PRI-945: lstat, not existsSync — a dangling active.json pointer is still a
-    // leftover ENTRY to reclaim; the else branch below unlinks it (never following
-    // the missing target).
-    if (pathEntryExists(paths.activeRecordPath)) {
-        if (activeCorruptReason !== null) {
-            // §18 default-preservation: never delete an unreadable pointer. This is
-            // intentional (reclaimFailed stays false so install.json is still
-            // cleaned), so do NOT promise a retry — the file is evidence to remove by
-            // hand only if the operator is sure.
-            preserved.push(`active.json is unreadable (${activeCorruptReason}) — kept for diagnosis; remove it manually only if you are sure`);
-        }
-        else if (active !== null && existsSync(path.join(paths.releasesDir, active.releaseId))) {
-            // existsSync (follow) is correct HERE: this asks whether the release
-            // TARGET still resolves (releases/ removal failed), so the pointer and
-            // its target must be kept together — not whether the entry exists.
-            // releases/ removal failed, so the pointer still resolves — keep pointer
-            // and target together so a re-run can reclaim both.
-            preserved.push(`active.json still points at releases/${active.releaseId} — kept with its target; re-run to reclaim both`);
-        }
-        else {
-            try {
-                await removeWithRetry(paths.activeRecordPath, 'file');
-                params.removedFiles.push(paths.activeRecordPath);
-                reclaimed.push('active.json');
-            }
-            catch (err) {
-                reclaimFailed = true;
-                params.deleteErrors.push({ name: 'PD active record', error: err instanceof Error ? err.message : String(err) });
-            }
-        }
-    }
-    return {
-        reclaimFailed,
-        reclaimedNote: reclaimed.length > 0 ? reclaimed.join(', ') : undefined,
-        preservedNote: preserved.length > 0 ? preserved.join('; ') : undefined,
-    };
-}
-export async function uninstall(options = {}) {
-    await detectAndSetLanguage(options.lang);
-    const hostTarget = options.host ?? 'all';
-    const result = {
-        success: false,
-        removedDirs: [],
-        removedFiles: [],
-        removedGlobalShims: [],
-        skippedGlobalShims: [],
-        preservedPaths: [],
-    };
-    // PRI-694: refuse BEFORE any probing when we cannot confirm interactively —
-    // the @inquirer confirm rejects on stdin EOF with an ExitPromptError that
-    // the global uncaughtException handler swallows ("Goodbye!", exit 0),
-    // turning the whole uninstall into a silent no-op that looks like success
-    // in scripts. rc-9: fail loudly with a structured reason instead.
-    if (!options.force && !process.stdin.isTTY) {
-        logger.error(t('uninstall_confirmation_required'));
-        console.log(`   ${t('uninstall_confirmation_next')}`);
-        result.error = t('uninstall_confirmation_required');
-        return result;
-    }
-    try {
-        const gatewayStatus = hostTarget === 'codex'
-            ? { isRunning: false, port: undefined, pid: undefined }
-            : await checkOpenClawGateway();
-        if (gatewayStatus.isRunning) {
-            const portInfo = gatewayStatus.port ? ` (port ${gatewayStatus.port})` : '';
-            const pidInfo = gatewayStatus.pid ? `, PID ${gatewayStatus.pid}` : '';
-            logger.warn(`OpenClaw gateway is running${portInfo}${pidInfo}.`);
-            logger.warn(isWindows()
-                ? '文件可能被占用导致删除失败。建议先关闭 OpenClaw（openclaw gateway stop），然后重新运行卸载。'
-                : 'Files may be locked. Stop OpenClaw first (openclaw gateway stop), then re-run uninstall.');
-            console.log('');
-        }
-        // 1. Check install status
-        const status = checkInstallStatus(hostTarget);
-        const runtimePlan = planSharedRuntimeUninstall(hostTarget);
-        if (runtimePlan.warning)
-            logger.warn(runtimePlan.warning);
-        if (!status.isInstalled && !runtimePlan.manifestHasTarget) {
-            logger.warn(t('no_install_detected'));
-            result.success = true;
-            return result;
-        }
-        // 2. Get workspace path and show preservation notice
-        const workspaceDir = getWorkspacePath();
-        console.log('\n');
-        logger.warn(t('uninstall_warning_title'));
-        console.log(`   ${t('uninstall_warning_msg')}`);
-        console.log('\n');
-        if (workspaceDir && existsSync(workspaceDir)) {
-            logger.info(t('workspace_files_preserved'));
-            console.log(`   📁 ${t('workspace_dir_label')}: ${workspaceDir}`);
-            console.log(`   📄 ${t('md_files_preserved')}`);
-            console.log(`   📁 ${t('principles_dir_preserved')}`);
-            console.log(`   📁 ${t('state_dir_preserved')}`);
-            console.log('\n');
-        }
-        // 3. Show what will be deleted
-        logger.info(t('plugin_files_will_delete'));
-        for (const p of status.paths) {
-            // PRI-945: p.exists is follow-based (via checkInstallStatus, which the
-            // CLI --check consumer relies on). List a dangling entry too so this
-            // preview matches what the deletion loop below actually reclaims.
-            if (p.exists || pathEntryExists(p.path)) {
-                const icon = p.type === 'dir' ? '📁' : '📄';
-                console.log(`  ${icon} ${p.name}: ${p.path}`);
-            }
-        }
-        console.log('\n');
-        // 4. Confirm uninstall (unless --force)
-        if (!options.force) {
-            const confirmed = await confirm({
-                message: t('confirm_uninstall'),
-                default: false,
-            });
-            if (!confirmed) {
-                logger.info(t('uninstall_cancelled'));
-                result.success = true;
-                return result;
-            }
-        }
-        // 4b. PRI-696: a running Console (auto-launched by a prior install, kept
-        // alive detached) locks files under ~/.pd/runtime/console and turns the
-        // deletion into a partial uninstall. Find PD-identified console processes
-        // and stop them before deleting — the gateway warning above covers only
-        // half of the lock sources.
-        if (hostTarget !== 'codex') {
-            const stoppedConsoles = stopRunningConsoleProcesses();
-            for (const note of stoppedConsoles)
-                logger.info(`[console] ${note}`);
-        }
-        // 5. Execute deletion (only plugin system files)
-        const deleteErrors = [];
-        for (const p of status.paths) {
-            // PRI-945 (稳妥 B): do NOT change checkInstallStatus.exists (the CLI
-            // --check consumer must still see a dangling link as "missing"). Instead
-            // reclaim a dangling entry at the deletion site: proceed when either the
-            // resolved target exists OR the link entry itself exists (lstat); the
-            // remover unlinks it without following a missing target.
-            if (!p.exists && !pathEntryExists(p.path))
-                continue;
-            try {
-                await removeWithRetry(p.path, p.type);
-                if (p.type === 'dir') {
-                    result.removedDirs.push(p.path);
-                }
-                else {
-                    result.removedFiles.push(p.path);
-                }
-                logger.success(`${t('deleted')}: ${p.name}`);
-            }
-            catch (error) {
-                const errMsg = error instanceof Error ? error.message : String(error);
-                const isPermError = errMsg.includes('EPERM') || errMsg.includes('permission') || errMsg.includes('access denied') || errMsg.includes('EBUSY');
-                if (isPermError) {
-                    logger.error(`${t('delete_failed')}: ${p.name} - ${errMsg}`);
-                    logger.warn(isWindows()
-                        ? '文件被占用，请先关闭 OpenClaw（openclaw gateway stop），然后手动删除目录或重新运行卸载。'
-                        : 'File is locked. Stop OpenClaw first (openclaw gateway stop), then re-run uninstall or delete manually.');
-                }
-                else {
-                    logger.error(`${t('delete_failed')}: ${p.name} - ${errMsg}`);
-                }
-                deleteErrors.push({ name: p.name, error: errMsg });
-            }
-        }
-        // 6. The pd shim belongs to the shared runtime. Keep it while another host
-        // remains attached; otherwise a host-scoped uninstall breaks that host.
-        if (runtimePlan.removeSharedRuntime) {
-            console.log('\n');
-            logger.info(t('cleaning_global_commands'));
-            const { removed, skipped } = await removeGlobalPdShim();
-            result.removedGlobalShims = removed;
-            result.skippedGlobalShims = skipped;
-        }
-        else {
-            logger.info('Keeping the shared pd command because another host still uses the runtime.');
-        }
-        // 6.5. ADR-0020 §2.3: Clean up host-side configs via HostInstallers.
-        // Replaces the old cleanupOpenClawConfig() with multi-host delegation.
-        // 'all' means "every host PD ever registered with" — WorkBuddy included
-        // even though its INSTALL is a separate explicit opt-in target (removing
-        // a registration is cleanup, not opt-in; getHostInstallers('all')
-        // deliberately stays openclaw+codex for the install direction).
-        const hostInstallers = hostTarget === 'all'
-            ? [...getHostInstallers('all'), new WorkBuddyHostInstaller()]
-            : getHostInstallers(hostTarget);
-        for (const installer of hostInstallers) {
-            try {
-                const ctx = {
-                    language: getLanguage(),
-                    force: options.force === true,
-                };
-                const hostResult = await installer.uninstall(ctx);
-                if (hostResult.success) {
-                    if (hostResult.removedPaths.length > 0) {
-                        logger.success(`Host "${installer.hostId}": cleaned ${hostResult.removedPaths.length} path(s)`);
-                    }
-                }
-                else {
-                    logger.warn(`Host "${installer.hostId}" cleanup: ${hostResult.reason ?? 'partial failure'}. Next: ${hostResult.nextAction}`);
-                }
-            }
-            catch (err) {
-                // rc-9: never silently swallow — surface the failure.
-                logger.warn(`Host "${installer.hostId}" cleanup threw: ${err instanceof Error ? err.message : String(err)}`);
-            }
-        }
-        // Shared runtime is removed only after the final host is uninstalled.
-        let sharedRuntimeRemovalFailed = false;
-        if (runtimePlan.removeSharedRuntime && pathEntryExists(getPdRuntimeDir())) {
-            try {
-                await removeWithRetry(getPdRuntimeDir(), 'dir');
-                result.removedDirs.push(getPdRuntimeDir());
-            }
-            catch (err) {
-                sharedRuntimeRemovalFailed = true;
-                deleteErrors.push({ name: 'PD shared runtime', error: err instanceof Error ? err.message : String(err) });
-            }
-        }
-        // PRI-894 / PRI-895: reclaim update residue (staging/, releases/, backups/
-        // and a dangling active.json) while the manifest is still present. It runs
-        // BEFORE install.json is deleted on purpose: if reclaim fails we keep
-        // install.json so a re-run still plans a full teardown and retries the
-        // residue instead of stranding it under a now-missing manifest.
-        const residueReclaim = await reclaimSharedRuntimeResidue({
-            removeSharedRuntime: runtimePlan.removeSharedRuntime,
-            sharedRuntimeRemovalFailed,
-            deleteErrors,
-            removedDirs: result.removedDirs,
-            removedFiles: result.removedFiles,
-        });
-        if (residueReclaim.reclaimedNote) {
-            logger.success(`Reclaimed update residue: ${residueReclaim.reclaimedNote}`);
-        }
-        if (residueReclaim.preservedNote) {
-            logger.warn(`Kept update residue for safety: ${residueReclaim.preservedNote}`);
-        }
-        if (runtimePlan.removeSharedRuntime && !sharedRuntimeRemovalFailed && !residueReclaim.reclaimFailed && pathEntryExists(getInstallManifestPath())) {
-            try {
-                await removeWithRetry(getInstallManifestPath(), 'file');
-                result.removedFiles.push(getInstallManifestPath());
-            }
-            catch (err) {
-                deleteErrors.push({ name: 'PD install manifest', error: err instanceof Error ? err.message : String(err) });
-            }
-        }
-        else if (!runtimePlan.removeSharedRuntime && runtimePlan.remainingHosts.length > 0) {
-            // PRI-709 P0-1: merge instead of replace — a wholesale rewrite dropped
-            // `workspaces` and every update-side field (channel / autoCheck /
-            // releaseMetadataUrl).
-            mergeIntoInstallJson(getInstallManifestPath(), {
-                layoutVersion: 1,
-                mode: 'canonical',
-                hosts: runtimePlan.remainingHosts,
-            });
-        }
-        // 7. Record preserved paths
-        if (workspaceDir) {
-            result.preservedPaths.push(workspaceDir);
-            if (existsSync(path.join(workspaceDir, '.principles'))) {
-                result.preservedPaths.push(path.join(workspaceDir, '.principles'));
-            }
-            if (existsSync(path.join(workspaceDir, '.state'))) {
-                result.preservedPaths.push(path.join(workspaceDir, '.state'));
-            }
-        }
-        result.success = deleteErrors.length === 0;
-        if (deleteErrors.length > 0) {
-            result.error = deleteErrors.map(e => `${e.name}: ${e.error}`).join('; ');
-        }
-        console.log('\n');
-        if (deleteErrors.length > 0) {
-            logger.warn(t('uninstall_partial') || '卸载部分完成 — 部分文件未能删除，请按上方提示处理。');
-        }
-        else {
-            logger.success(t('uninstall_complete'));
-        }
-        console.log('\n');
-        if (result.preservedPaths.length > 0) {
-            logger.info(t('personal_data_preserved'));
-            result.preservedPaths.forEach(p => console.log(`   ${p}`));
-            console.log('\n');
-            logger.info(t('manual_cleanup_hint'));
-        }
-        return result;
-    }
-    catch (error) {
-        result.error = error instanceof Error ? error.message : String(error);
-        logger.error(`${t('uninstall_failed')}: ${result.error}`);
-        return result;
-    }
-}
-//# sourceMappingURL=uninstaller.js.map