loadout-ai 0.2.0 → 0.2.1

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.2.1 - 2026-07-17
+
+### Fixed
+
+- Make Stable and Power setup safe to rerun when Loadout already owns some target skills.
+- Preserve unmanaged skills and refuse to replace managed skills that changed outside Loadout.
+- Verify every replacement byte and keep mixed existing/new-agent installs rollback-safe.
+
 ## 0.2.0 - 2026-07-17
 
 ### Added

package/MASTER_PLAN.md

@@ -1023,13 +1023,12 @@ universal or permanent truth.
       `NOASSERTION` records, before distribution.
 - [ ] `P12-31 [TERRA]` Publish `loadout-ai` to npm and run clean-machine package tests
       from outside the repository on macOS, Windows, Linux, and Node 20/22.
-  - Partial: `loadout-ai@0.1.2` was published publicly on 2026-07-16 while the GitHub
-    repository remained private. Registry metadata, `npx` version/help, and a real
-    read-only Stable preview passed outside the source directory. Patch `0.1.2`
-    adds Codex Desktop detection through its existing `~/.codex` home when the
-    standalone `codex` executable is absent from the user's shell PATH. CI contains an
-    opt-in OS/Node matrix and OIDC/provenance release workflow; clean independent-user
-    installs on Windows/macOS/Linux remain required.
+  - Partial: `loadout-ai@0.2.0` was published publicly on 2026-07-17 while the GitHub
+    repository remained private. Registry version/integrity, a clean external npm
+    install, version/help, 50-record catalog coverage, and the real disposable
+    Superpowers install/rollback demo pass on macOS. Hosted matrix evidence already
+    covers Windows/macOS/Linux and Node 20/22; clean independent-user installs on
+    Windows and Linux remain required.
 - [ ] `P12-32 [HUMAN]` Run moderated founder testing on the real Claude and Codex
       profiles with snapshots and explicit rollback checkpoints.
   - Partial 2026-07-16: the founder ran the published npm CLI against the real macOS
@@ -1170,7 +1169,7 @@ universal or permanent truth.
     1,000 on-disk skills at a 1.29-second p95 on macOS/Node 23.
 - [ ] `P15-06 [HUMAN]` Approve public repository visibility, complete the six
       `NOASSERTION` license decisions, authenticate npm, and publish `loadout-ai`.
-  - Partial 2026-07-16: npm authentication and the public `loadout-ai@0.1.2`
+  - Partial 2026-07-17: npm authentication and the public `loadout-ai@0.2.0`
     publication succeeded. Repository visibility remains private at the owner's
     request, and the six root-level `NOASSERTION` decisions remain a human release
     gate; therefore this combined item is not ticked.
@@ -1601,6 +1600,10 @@ accident.
   - Repeat the safe no-key journey with Claude, then collect one Windows and one Linux
     external session. Convert every reproducible failure into a regression test before
     public-release claims.
+  - Partial 2026-07-17: the registry and clean external macOS install are verified for
+    `0.2.0`; the published CLI loads the complete command surface, reports all 50
+    catalog records, and completes its disposable install/rollback demo. Real founder
+    Stable/Power/Maximum and Claude-profile exercises remain deliberately pending.
 - [x] `P17-09 [TERRA implementation, LUNA copy review]` Make Power resilient and
       explain the product in beginner language before the `0.2.0` release.
   - Power now quarantines a rejected selected skill while retaining safe selected

package/dist/src/cli.js

@@ -262,7 +262,7 @@ async function runSetup(options) {
         reader?.close();
     }
 }
-const LOADOUT_VERSION = "0.2.0";
+const LOADOUT_VERSION = "0.2.1";
 function durableSchedulerLauncher() {
     return [
         join(dirname(process.execPath), process.platform === "win32" ? "npx.cmd" : "npx"),

package/dist/src/core/catalog-install.js

@@ -230,5 +230,7 @@ export async function applyPreparedCatalogInstall(prepared, options = {}) {
         throw new Error(`Additional risk approval is required for: ${risky.map((entry) => entry.package.id).join(", ")}. Review the plan, then use --approve-risk.`);
     return prepared.selection.mode === "maximum"
         ? applySkillLibraryBatch(prepared.entries)
-        : applySkillInstallBatch(prepared.entries);
+        : applySkillInstallBatch(prepared.entries, [], {
+            replaceManagedTargets: true,
+        });
 }

package/dist/src/core/install.js

@@ -1,6 +1,6 @@
 import { existsSync } from "node:fs";
 import { cp, lstat, rm } from "node:fs/promises";
-import { basename, dirname, join, posix, relative, win32 } from "node:path";
+import { basename, dirname, isAbsolute, join, posix, relative, win32, } from "node:path";
 import { ensureDirectory, loadoutHome } from "./paths.js";
 import { planAdapterSkillInstall } from "./adapters.js";
 import { applySkillPlan, detectInstallConflicts } from "./skills.js";
@@ -17,6 +17,26 @@ export function installedAgents(agents, requested) {
     }
     return selected;
 }
+function relativeHashes(root, files) {
+    return files
+        .filter((file) => {
+        const child = relative(root, file.path);
+        return child !== "" && !child.startsWith("..") && !isAbsolute(child);
+    })
+        .map((file) => ({
+        path: relative(root, file.path),
+        sha256: file.sha256,
+    }))
+        .sort((left, right) => left.path.localeCompare(right.path));
+}
+async function assertExactDirectoryCopy(source, target, label) {
+    const [expected, actual] = await Promise.all([
+        hashDirectory(source).then((files) => relativeHashes(source, files)),
+        hashDirectory(target).then((files) => relativeHashes(target, files)),
+    ]);
+    if (JSON.stringify(actual) !== JSON.stringify(expected))
+        throw new Error(`${label} for ${target}`);
+}
 async function assertActiveTargetsUnoccupied(plans, options = {}) {
     const occupied = [];
     for (const target of [
@@ -35,26 +55,40 @@ async function assertActiveTargetsUnoccupied(plans, options = {}) {
         }
     if (occupied.length && options.allowManagedReplacement) {
         const state = await readInstallState();
-        const allowed = new Set(plans.flatMap((plan) => {
+        const allowed = new Map();
+        for (const plan of plans) {
             const install = state.installs.find((record) => record.packageId === plan.packageId);
             const packageActivations = (state.activations ?? []).filter((record) => record.packageId === plan.packageId);
-            const active = packageActivations.length === 0 ||
-                packageActivations.some((record) => record.installationState === "installed" &&
-                    record.activationState === "active");
-            if (!install || !active)
-                return [];
+            if (!install)
+                continue;
+            const activeTargets = new Set(packageActivations
+                .filter((record) => record.installationState === "installed" &&
+                record.activationState === "active")
+                .flatMap((record) => record.targets.map((target) => target.activePath)));
             const recorded = install.files
                 .filter((file) => basename(file.path) === "SKILL.md")
-                .map((file) => dirname(file.path));
+                .map((file) => dirname(file.path))
+                .filter((target) => packageActivations.length === 0 || activeTargets.has(target));
             const legacy = packageActivations.length
                 ? []
                 : plan.files
                     .map((file) => file.target)
                     .filter((target) => basename(target) === plan.packageId);
-            return [...recorded, ...legacy];
-        }));
-        if (occupied.every((target) => allowed.has(target)))
+            for (const target of [...recorded, ...legacy])
+                if (plan.files.some((file) => file.target === target))
+                    allowed.set(target, install);
+        }
+        if (occupied.every((target) => allowed.has(target))) {
+            for (const target of occupied) {
+                const owner = allowed.get(target);
+                const expected = relativeHashes(target, owner?.files ?? []);
+                const actual = relativeHashes(target, await hashDirectory(target));
+                if (!expected.length ||
+                    JSON.stringify(actual) !== JSON.stringify(expected))
+                    throw new Error(`Installation refuses to replace drifted managed skill target: ${target}`);
+            }
             return;
+        }
     }
     if (occupied.length)
         throw new Error(`Installation refuses ${occupied.length} occupied skill target(s); scan, compare, or adopt them first. First target: ${occupied[0]}`);
@@ -106,20 +140,7 @@ export async function applySkillInstall(plan, metadata, options = {}) {
         await applySkillPlan(freshPlan);
         if (options.replaceManagedTargets)
             for (const file of freshPlan.files) {
-                const expected = (await hashDirectory(file.source))
-                    .map((entry) => ({
-                    path: relative(file.source, entry.path),
-                    sha256: entry.sha256,
-                }))
-                    .sort((left, right) => left.path.localeCompare(right.path));
-                const actual = (await hashDirectory(file.target))
-                    .map((entry) => ({
-                    path: relative(file.target, entry.path),
-                    sha256: entry.sha256,
-                }))
-                    .sort((left, right) => left.path.localeCompare(right.path));
-                if (JSON.stringify(actual) !== JSON.stringify(expected))
-                    throw new Error(`Exact update copy verification failed for ${file.target}`);
+                await assertExactDirectoryCopy(file.source, file.target, "Exact update copy verification failed");
             }
         await recordInstall(freshPlan, snapshot.id, metadata);
         await options.verifyBeforeCommit?.(snapshot.id);
@@ -127,7 +148,7 @@ export async function applySkillInstall(plan, metadata, options = {}) {
     return applied.snapshotId;
 }
 /** Apply all selected packages as one filesystem transaction and one state update. */
-export async function applySkillInstallBatch(entries, extraSnapshotPaths = []) {
+export async function applySkillInstallBatch(entries, extraSnapshotPaths = [], options = {}) {
     if (!entries.length)
         throw new Error("Installation batch is empty");
     const conflicts = detectInstallConflicts(entries.map((entry) => entry.plan));
@@ -135,7 +156,7 @@ export async function applySkillInstallBatch(entries, extraSnapshotPaths = []) {
     if (blocking.length)
         throw new Error(`Installation blocked by conflicts: ${blocking.map((item) => item.message).join("; ")}`);
     const applied = await runMutationTransaction(async () => {
-        await assertActiveTargetsUnoccupied(entries.map((entry) => entry.plan));
+        await assertActiveTargetsUnoccupied(entries.map((entry) => entry.plan), { allowManagedReplacement: options.replaceManagedTargets });
         for (const entry of entries) {
             entry.plan.conflicts = [
                 ...(entry.plan.conflicts ?? []),
@@ -160,8 +181,17 @@ export async function applySkillInstallBatch(entries, extraSnapshotPaths = []) {
             value: entries,
         };
     }, async (freshEntries, snapshot) => {
+        if (options.replaceManagedTargets)
+            for (const target of [
+                ...new Set(freshEntries.flatMap((entry) => entry.plan.files.map((file) => file.target))),
+            ])
+                await rm(target, { recursive: true, force: true });
         for (const entry of freshEntries)
             await applySkillPlan(entry.plan);
+        if (options.replaceManagedTargets)
+            for (const entry of freshEntries)
+                for (const file of entry.plan.files)
+                    await assertExactDirectoryCopy(file.source, file.target, "Exact setup copy verification failed");
         await recordInstallBatch(freshEntries, snapshot.id);
     });
     return applied.snapshotId;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loadout-ai",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "private": false,
   "license": "MIT",
   "description": "Universal upgrade manager for AI coding agents",