loadout-ai 0.2.3 → 0.4.0

package/dist/src/core/profile-state.js

@@ -0,0 +1,101 @@
+import { resolveCatalogProfile } from "./profiles.js";
+import { readInstallState, writeInstallState } from "./state.js";
+export async function recordInstalledProfile(prepared) {
+    const profile = {
+        mode: prepared.selection.mode,
+        ...(prepared.selection.packageIds
+            ? { packageIds: [...prepared.selection.packageIds] }
+            : {}),
+        agents: prepared.agents.map((agent) => agent.id),
+        catalogPackages: prepared.resolution.packages
+            .filter((pkg) => pkg.components?.includes("skill"))
+            .map((pkg) => ({
+            packageId: pkg.id,
+            ...(pkg.source?.commit ? { reviewedCommit: pkg.source.commit } : {}),
+        })),
+        appliedAt: new Date().toISOString(),
+    };
+    const state = await readInstallState();
+    await writeInstallState({ ...state, profile });
+    return profile;
+}
+export function evaluateInstalledProfileState(state, catalog) {
+    const evaluatedAt = new Date().toISOString();
+    const boundary = "Checks the current signed/reviewed catalog. Newly discovered candidates stay recommendations until review evidence promotes them.";
+    if (!state.profile)
+        return {
+            installed: false,
+            expectedPackages: [],
+            missingPackages: [],
+            reviewedRevisionChanges: [],
+            needsRefresh: false,
+            evaluatedAt,
+            boundary,
+        };
+    const resolution = resolveCatalogProfile(catalog, {
+        mode: state.profile.mode,
+        ...(state.profile.packageIds
+            ? { packageIds: state.profile.packageIds }
+            : {}),
+    });
+    const expected = resolution.packages.filter((pkg) => pkg.components?.includes("skill"));
+    const installed = new Map(state.installs.map((record) => [record.packageId, record]));
+    const previousCatalog = new Map(state.profile.catalogPackages.map((record) => [record.packageId, record]));
+    const missingPackages = expected
+        .filter((pkg) => !installed.has(pkg.id))
+        .map((pkg) => pkg.id);
+    const reviewedRevisionChanges = expected.flatMap((pkg) => {
+        const previous = previousCatalog.get(pkg.id);
+        if (!previous ||
+            !pkg.source?.commit ||
+            previous.reviewedCommit?.toLowerCase() === pkg.source.commit.toLowerCase())
+            return [];
+        return [
+            {
+                packageId: pkg.id,
+                previousReviewedCommit: previous.reviewedCommit,
+                reviewedCommit: pkg.source.commit,
+            },
+        ];
+    });
+    const oldIds = state.profile.catalogPackages
+        .map((item) => item.packageId)
+        .sort();
+    const expectedPackages = expected.map((pkg) => pkg.id).sort();
+    const selectionChanged = oldIds.join("\0") !== expectedPackages.join("\0");
+    return {
+        installed: true,
+        mode: state.profile.mode,
+        appliedAt: state.profile.appliedAt,
+        expectedPackages,
+        missingPackages,
+        reviewedRevisionChanges,
+        needsRefresh: selectionChanged ||
+            missingPackages.length > 0 ||
+            reviewedRevisionChanges.length > 0,
+        evaluatedAt,
+        boundary,
+    };
+}
+export async function evaluateInstalledProfile(catalog) {
+    return evaluateInstalledProfileState(await readInstallState(), catalog);
+}
+export function formatInstalledProfileStatus(status) {
+    if (!status.installed)
+        return "PROFILE No saved Stable, Power, Maximum, or Custom profile yet.";
+    return [
+        `PROFILE ${status.mode?.toUpperCase()}: ${status.needsRefresh ? "reviewed changes available" : "current against reviewed catalog"}`,
+        `Expected repositories: ${status.expectedPackages.length}`,
+        ...(status.missingPackages.length
+            ? [`Missing: ${status.missingPackages.join(", ")}`]
+            : []),
+        ...(status.reviewedRevisionChanges.length
+            ? [
+                `Reviewed revisions changed: ${status.reviewedRevisionChanges
+                    .map((item) => item.packageId)
+                    .join(", ")}`,
+            ]
+            : []),
+        `Trust boundary: ${status.boundary}`,
+    ].join("\n");
+}

package/dist/src/core/profiles.js

@@ -1,6 +1,6 @@
 import { compareCatalogPackages } from "./ranking.js";
 /**
- * Stable is Loadout's recommended daily driver: broad enough to improve normal
+ * Stable is Loadout's bounded policy-selected daily driver: broad enough to improve normal
  * engineering work immediately, but bounded at skill granularity and restricted
  * to catalog sources with an identified SPDX license. Maximum remains the
  * explicit broad-library mode.
@@ -45,7 +45,8 @@ export const STABLE_BOOST_PACKAGE_IDS = Object.freeze(Object.keys(STABLE_SKILL_A
 /**
  * Trust is deliberately separate from popularity and publisher tier. No
  * bundled record is labelled human-reviewed or benchmarked until that evidence
- * is actually stored; Stable is the policy-recommended subset.
+ * is actually stored; Stable is the policy-selected subset. The stored
+ * `recommended` value remains for schema compatibility.
  */
 export function catalogTrustStage(pkg) {
     if (STABLE_BOOST_PACKAGE_IDS.includes(pkg.id) &&
@@ -58,6 +59,10 @@ export function catalogTrustStage(pkg) {
         return "inspected";
     return "discovered";
 }
+/** Keep stored `recommended` values compatible while naming their evidence honestly. */
+export function formatCatalogTrustStage(stage) {
+    return stage === "recommended" ? "policy-selected" : stage;
+}
 export function isStableSkillSelected(packageId, skillName, targetName) {
     const selected = STABLE_SKILL_ALLOWLIST[packageId];
     if (!selected)
@@ -233,7 +238,7 @@ export function resolveCatalogProfile(packages, selection, families = CATALOG_CO
                 selected.delete(secondary.id);
                 deferred.push(secondary);
             }
-            warnings.push(`Stable Boost selected ${primary.displayName}; deferred ${members
+            warnings.push(`Loadout policy selection for Stable chose ${primary.displayName}; deferred ${members
                 .slice(1)
                 .map((pkg) => pkg.displayName)
                 .join(", ")} because they overlap in ${family.label}.`);
@@ -242,7 +247,7 @@ export function resolveCatalogProfile(packages, selection, families = CATALOG_CO
             warnings.push(`Custom selection retains the soft overlap in ${family.label}. Review ${names} before installation.`);
         }
         else {
-            warnings.push(`${selection.mode === "power" ? "Power Boost" : "Maximum Library"} retains the soft overlap in ${family.label}. ${primary.displayName} is the recommended default; review each package before installation.`);
+            warnings.push(`${selection.mode === "power" ? "Power Boost" : "Maximum Library"} retains the soft overlap in ${family.label}. Loadout policy orders ${primary.displayName} first; review each package before installation.`);
         }
     }
     return {

package/dist/src/core/ranking.js

@@ -96,7 +96,7 @@ export function explainCatalogScore(pkg, now = new Date()) {
         ],
     };
 }
-/** A deterministic ordering: review tier first, then explainable evidence, then id. */
+/** A deterministic policy ordering: declared tier, bounded evidence score, then id. */
 export function compareCatalogPackages(a, b) {
     return (TIER_ORDER[b.tier] - TIER_ORDER[a.tier] ||
         explainCatalogScore(b).score - explainCatalogScore(a).score ||

package/dist/src/core/readme-claims.js

@@ -0,0 +1,10 @@
+import { formatSchemaError, readmeClaimManifestSchema, } from "../shared/schemas.js";
+export { readmeClaimManifestSchema };
+/** Parse the versioned index of evidence for material README statements. */
+export function parseReadmeClaimManifest(value) {
+    const result = readmeClaimManifestSchema.safeParse(value);
+    if (!result.success) {
+        throw new Error(`README claim manifest is invalid: ${formatSchemaError(result.error)}`);
+    }
+    return result.data;
+}

package/dist/src/core/readme-facts.js

@@ -0,0 +1,40 @@
+import { supportedAdapterNames } from "./adapters.js";
+import { buildCatalogCoverage } from "./catalog-coverage.js";
+function profileFacts(allowlist) {
+    return {
+        sources: Object.keys(allowlist).length,
+        skillDirectories: Object.values(allowlist).reduce((count, skills) => count + skills.length, 0),
+    };
+}
+/**
+ * Derive all changeable README facts from passed authoritative source data.
+ * This module intentionally neither reads nor parses README text.
+ */
+export function deriveReadmeFacts({ catalog, packageJson, agents, profiles, }) {
+    const coverage = buildCatalogCoverage(catalog);
+    return {
+        catalog: {
+            records: coverage.records,
+            categories: coverage.categoryCount,
+            components: coverage.components,
+            installShapes: coverage.installShapes,
+            assertedLicenses: coverage.assertedLicenses,
+            noAssertionLicenses: coverage.noAssertionLicenses,
+        },
+        profiles: {
+            stable: profileFacts(profiles.stable),
+            power: profileFacts(profiles.power),
+        },
+        agents: {
+            supportedNames: supportedAdapterNames(agents),
+        },
+        package: {
+            name: packageJson.name,
+            version: packageJson.version,
+            bin: { ...packageJson.bin },
+        },
+        runtime: {
+            node: packageJson.engines.node,
+        },
+    };
+}

package/dist/src/core/recommend.js

@@ -17,6 +17,11 @@ const SIGNAL_FILES = new Set([
     "playwright.config.ts",
     ".git",
 ]);
+/** Additive machine-readable boundary for every rule-selected recommendation list. */
+export const RECOMMENDATION_BOUNDARY = Object.freeze({
+    selectionMethod: "deterministic-project-signal-rules",
+    qualityEvidence: "not-established",
+});
 export async function scanProject(root = process.cwd()) {
     const absolute = resolve(root);
     const entries = await readdir(absolute, { withFileTypes: true });
@@ -132,7 +137,7 @@ export function personalizeRecommendations(recommendations, signals, outcomes, a
 }
 export const TESTED_PROFILES = {
     stable: {
-        description: "Recommended 30-skill daily driver from four pinned, SPDX-identified sources with no extra static-risk approvals.",
+        description: "Loadout policy selection: 30 skills from four pinned, SPDX-identified sources with no extra static-risk approvals.",
         packages: [...STABLE_BOOST_PACKAGE_IDS],
     },
     web: {
@@ -144,7 +149,7 @@ export const TESTED_PROFILES = {
         packages: ["superpowers", "context7", "github-mcp-server"],
     },
     maximum: {
-        description: "Broad reviewed toolkit; always review MCP permissions before applying.",
+        description: "Broad inspected toolkit; always review MCP permissions before applying.",
         packages: [
             "superpowers",
             "context7",
@@ -171,7 +176,8 @@ export function formatRecommendations(signals, recommendations) {
         `Project: ${basename(signals.root)}`,
         `Detected: ${[...signals.languages, ...signals.frameworks].join(", ") || "no known project signals"}`,
         "",
-        "Recommendations:",
+        "Rule-based project suggestions:",
+        "Rules use detected project signals and catalog membership; they do not prove package quality.",
     ];
     if (!recommendations.length)
         lines.push("  No matching catalog packages found.");

package/dist/src/core/remove.js

@@ -4,10 +4,12 @@ import { forgetInstall, installStatePath, readInstallState } from "./state.js";
 import { writeMcpConfigPlan } from "./mcp.js";
 import { runMutationTransaction } from "./transaction.js";
 export async function planRemove(packageId) {
-    const record = (await readInstallState()).installs.find((entry) => entry.packageId === packageId);
-    if (!record)
+    const state = await readInstallState();
+    const record = state.installs.find((entry) => entry.packageId === packageId);
+    const trackedMcp = (state.mcpInstalls ?? []).filter((entry) => entry.packageId === packageId);
+    if (!record && !trackedMcp.length)
         throw new Error(`Package is not managed by Loadout: ${packageId}`);
-    const files = await Promise.all(record.files.map(async (file) => {
+    const files = await Promise.all((record?.files ?? []).map(async (file) => {
         try {
             const digest = createHash("sha256")
                 .update(await readFile(file.path))
@@ -24,10 +26,7 @@ export async function planRemove(packageId) {
         }
     }));
     const modified = files.filter((file) => file.status === "modified");
-    const state = await readInstallState();
-    const mcpServers = await Promise.all((state.mcpInstalls ?? [])
-        .filter((entry) => entry.packageId === packageId)
-        .map(async (entry) => {
+    const mcpServers = await Promise.all(trackedMcp.map(async (entry) => {
         try {
             const config = JSON.parse(await readFile(entry.configPath, "utf8"));
             if (!config.mcpServers || !(entry.serverName in config.mcpServers))

package/dist/src/core/runtime-tools.js

@@ -5,7 +5,7 @@ import { promisify } from "node:util";
 import { writeFileAtomically } from "./atomic-file.js";
 import { detectAgents, loadoutHome, userHome } from "./paths.js";
 import { parseRuntimeToolRecipe, renderRuntimeRecipeValue, resolveRuntimeRecipePath, } from "./runtime-tool-recipe.js";
-import { createSnapshot, readSnapshot, restoreSnapshot } from "./snapshot.js";
+import { createSnapshot, readSnapshot, recordSnapshotPostMutationState, restoreSnapshot, } from "./snapshot.js";
 const execFileAsync = promisify(execFile);
 function deepFreeze(value) {
     if (value && typeof value === "object" && !Object.isFrozen(value)) {
@@ -217,6 +217,11 @@ async function readState(stateHome) {
         throw error;
     }
 }
+/** Return runtime tools currently installed and owned by Loadout. */
+export async function listInstalledRuntimeTools(stateHome = loadoutHome()) {
+    const state = await readState(stateHome);
+    return Object.keys(state.tools).sort();
+}
 async function writeState(state, stateHome) {
     await writeFileAtomically(statePath(stateHome), `${JSON.stringify(state, null, 2)}\n`);
 }
@@ -394,7 +399,9 @@ export async function applyRuntimeToolPlan(plan, options) {
         if (!installed)
             throw new Error(`${plan.recipe.displayName} is not managed by Loadout`);
         const snapshot = await readSnapshot(installed.snapshotId);
-        await restoreSnapshot(snapshot);
+        await restoreSnapshot(snapshot, {
+            requireUnchangedPostMutationState: true,
+        });
         delete state.tools[plan.recipe.id];
         await writeState(state, plan.stateHome);
         return { action: "remove", snapshotId: snapshot.id };
@@ -439,6 +446,7 @@ export async function applyRuntimeToolPlan(plan, options) {
             agents: plan.agents.map((agent) => agent.id),
             runtimeRoot: plan.runtimeRoot,
         };
+        await recordSnapshotPostMutationState(snapshot);
         await writeState(state, plan.stateHome);
         return { action: "install", snapshotId: snapshot.id };
     }

package/dist/src/core/scheduler.js

@@ -4,7 +4,7 @@ import { dirname, win32, join } from "node:path";
 import { promisify } from "node:util";
 import { writeFileAtomically } from "./atomic-file.js";
 import { ensureDirectory, loadoutHome, userHome } from "./paths.js";
-import { createSnapshot } from "./snapshot.js";
+import { createSnapshot, recordSnapshotPostMutationState } from "./snapshot.js";
 import { beginTransaction, completeTransaction, markTransactionCommitting, recoverPendingTransactions, rollbackTransaction, } from "./transaction.js";
 const execFileAsync = promisify(execFile);
 function parseTime(value) {
@@ -41,7 +41,7 @@ export function planNativeScheduler(action, options = {}) {
     const job = options.job ?? "updates";
     const nativeId = `loadout-daily-${job}`;
     const command = job === "updates"
-        ? [...launcher, "watch", "--once", "--json"]
+        ? [...launcher, "update", "--json"]
         : [...launcher, "discover", "--source", "all", "--queue", "--json"];
     if (selectedPlatform === "darwin") {
         const label = `com.loadout.daily.${job}`;
@@ -238,6 +238,7 @@ export async function applyNativeSchedulerBundle(plans, runner = defaultRunner)
         if (plans[0].action === "unschedule")
             for (const file of plans.flatMap((plan) => plan.files))
                 await rm(file.path, { force: true });
+        await recordSnapshotPostMutationState(snapshot);
         await completeTransaction(transaction);
     }
     catch (error) {
@@ -259,6 +260,6 @@ export function formatNativeScheduler(plan) {
         `Command: ${plan.command.join(" ")}`,
         ...plan.files.map((file) => `File: ${file.path}`),
         ...plan.applyCommands.map((item) => `Native action: ${item.command} ${item.args.join(" ")}`),
-        `Guarantee: the scheduled command is ${plan.command.slice(2).join(" ")}; it can only report updates or queue candidates and cannot apply changes.`,
+        `Guarantee: no --yes flag is scheduled; this job can only report updates or queue candidates and cannot apply changes.`,
     ].join("\n");
 }

package/dist/src/core/snapshot.js

@@ -1,5 +1,5 @@
 import { createHash, randomUUID } from "node:crypto";
-import { readFile, writeFile, mkdir, readdir, rm, lstat, } from "node:fs/promises";
+import { readFile, writeFile, mkdir, readdir, rename, rm, lstat, } from "node:fs/promises";
 import { dirname, join, resolve, sep } from "node:path";
 import { loadoutHome, ensureDirectory, userHome } from "./paths.js";
 export async function createSnapshot(paths, options = {}) {
@@ -41,7 +41,7 @@ export async function createSnapshot(paths, options = {}) {
         if (!info.isDirectory())
             throw new Error(`Refusing unsupported snapshot target: ${path}`);
         snapshot.files.push({ path, existed: true, directory: true });
-        const entries = await readdir(path, { withFileTypes: true });
+        const entries = (await readdir(path, { withFileTypes: true })).sort((left, right) => left.name.localeCompare(right.name));
         for (const entry of entries) {
             const child = join(path, entry.name);
             if (entry.isSymbolicLink())
@@ -55,6 +55,8 @@ export async function createSnapshot(paths, options = {}) {
                     content: (await readFile(child)).toString("base64"),
                     encoding: "base64",
                 });
+            else
+                throw new Error(`Refusing unsupported snapshot target: ${child}`);
         }
     }
     for (const path of snapshot.roots)
@@ -67,8 +69,10 @@ export async function createSnapshot(paths, options = {}) {
     }
     return snapshot;
 }
-export async function restoreSnapshot(snapshot) {
+export async function restoreSnapshot(snapshot, options = {}) {
     validateSnapshot(snapshot);
+    if (options.requireUnchangedPostMutationState)
+        await assertUnchangedPostMutationState(snapshot);
     for (const root of snapshot.roots)
         await rm(root, { recursive: true, force: true });
     for (const directory of snapshot.files
@@ -84,6 +88,39 @@ export async function restoreSnapshot(snapshot) {
             : (file.content ?? ""));
     }
 }
+/** Attach the committed state used to make later user-requested rollback safe. */
+export async function recordSnapshotPostMutationState(snapshot) {
+    const postMutation = await createSnapshot(snapshot.roots, { persist: false });
+    snapshot.postMutationFiles = postMutation.files;
+    validateSnapshot(snapshot);
+    const directory = join(loadoutHome(), "snapshots");
+    await ensureDirectory(directory);
+    const target = join(directory, `${snapshot.id}.json`);
+    const temporary = `${target}.${process.pid}.${Date.now()}.tmp`;
+    await writeFile(temporary, JSON.stringify(snapshot, null, 2), {
+        mode: 0o600,
+        flag: "wx",
+    });
+    await rename(temporary, target);
+}
+async function assertUnchangedPostMutationState(snapshot) {
+    if (!snapshot.postMutationFiles)
+        throw new Error("Explicit rollback refused: this legacy snapshot has no post-mutation evidence. Preserve current files and use a newer snapshot.");
+    let current;
+    try {
+        current = (await createSnapshot(snapshot.roots, { persist: false })).files;
+    }
+    catch (error) {
+        throw new Error(`Explicit rollback refused because the current filesystem cannot be verified: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const expected = new Map(snapshot.postMutationFiles.map((file) => [file.path, file]));
+    const actual = new Map(current.map((file) => [file.path, file]));
+    const changed = [...new Set([...expected.keys(), ...actual.keys()])]
+        .filter((path) => JSON.stringify(expected.get(path)) !== JSON.stringify(actual.get(path)))
+        .sort();
+    if (changed.length)
+        throw new Error(`Explicit rollback refused because files changed after the snapshot: ${changed.slice(0, 10).join(", ")}. Preserve or review these changes before rollback.`);
+}
 export async function readSnapshot(id) {
     if (!isSnapshotId(id))
         throw new Error(`Invalid snapshot id: ${id}`);
@@ -167,42 +204,50 @@ export function validateSnapshot(value) {
         if (roots.some((candidate, candidateIndex) => candidateIndex !== index && isInside(candidate, root)))
             throw new Error("Snapshot roots must be unique and non-overlapping");
     }
+    validateSnapshotFiles(value.files, roots, "Snapshot");
+    if (value.postMutationFiles !== undefined) {
+        if (!Array.isArray(value.postMutationFiles))
+            throw new Error("Snapshot post-mutation files are invalid");
+        validateSnapshotFiles(value.postMutationFiles, roots, "Snapshot post-mutation");
+    }
+    return value;
+}
+function validateSnapshotFiles(files, roots, label) {
     const paths = new Set();
-    for (const [index, file] of value.files.entries()) {
+    for (const [index, file] of files.entries()) {
         if (!isRecord(file) ||
             typeof file.path !== "string" ||
             typeof file.existed !== "boolean" ||
             (file.directory !== undefined && typeof file.directory !== "boolean") ||
             (file.content !== undefined && typeof file.content !== "string") ||
             (file.encoding !== undefined && file.encoding !== "base64"))
-            throw new Error(`Snapshot file ${index} is invalid`);
+            throw new Error(`${label} file ${index} is invalid`);
         const filePath = file.path;
         if (resolve(filePath) !== filePath)
-            throw new Error(`Snapshot file ${index} path must be absolute and normalized`);
+            throw new Error(`${label} file ${index} path must be absolute and normalized`);
         if (paths.has(filePath))
-            throw new Error(`Snapshot file ${index} duplicates another path`);
+            throw new Error(`${label} file ${index} duplicates another path`);
         paths.add(filePath);
         if (!roots.some((root) => isInside(root, filePath)))
-            throw new Error(`Snapshot file ${index} escapes its declared roots`);
+            throw new Error(`${label} file ${index} escapes its declared roots`);
         if (!file.existed) {
             if (file.directory !== undefined ||
                 file.content !== undefined ||
                 file.encoding !== undefined)
-                throw new Error(`Missing snapshot file ${index} must not contain data`);
+                throw new Error(`Missing ${label.toLowerCase()} file ${index} must not contain data`);
         }
         else if (file.directory) {
             if (file.content !== undefined || file.encoding !== undefined)
-                throw new Error(`Snapshot directory ${index} must not contain bytes`);
+                throw new Error(`${label} directory ${index} must not contain bytes`);
         }
         else if (typeof file.content !== "string" ||
             file.encoding !== "base64" ||
             !isCanonicalBase64(file.content))
-            throw new Error(`Snapshot file ${index} bytes are invalid`);
+            throw new Error(`${label} file ${index} bytes are invalid`);
     }
     for (const [index, root] of roots.entries())
         if (!paths.has(root))
-            throw new Error(`Snapshot root ${index} has no matching file record`);
-    return value;
+            throw new Error(`${label} root ${index} has no matching file record`);
 }
 function isCanonicalBase64(value) {
     if (value.length % 4 !== 0)

package/dist/src/core/state.js

@@ -123,7 +123,7 @@ export async function hashDirectory(root) {
     await visit(root);
     return files;
 }
-export async function recordInstall(plan, snapshotId, metadata = {}) {
+export async function recordInstall(plan, snapshotId, metadata = {}, options = {}) {
     const record = await createInstallRecord(plan, snapshotId, metadata);
     const state = await readInstallState();
     state.installs = [
@@ -131,6 +131,13 @@ export async function recordInstall(plan, snapshotId, metadata = {}) {
         record,
     ];
     state.activations = mergeActivationRecords(state.activations, activationRecordsForPlan(plan, metadata));
+    await options.verifyBeforeWrite?.();
+    if (options.expectedFiles) {
+        const actual = [...record.files].sort((left, right) => left.path.localeCompare(right.path));
+        const expected = [...options.expectedFiles].sort((left, right) => left.path.localeCompare(right.path));
+        if (JSON.stringify(actual) !== JSON.stringify(expected))
+            throw new Error("Installed files changed before ownership could be recorded.");
+    }
     await writeInstallState(state);
     return record;
 }
@@ -298,12 +305,15 @@ export async function recordInstallTransaction(entries, mcpEntries, snapshotId)
 export async function forgetInstall(packageId) {
     const state = await readInstallState();
     const installs = state.installs.filter((entry) => entry.packageId !== packageId);
-    if (installs.length === state.installs.length)
+    const mcpInstalls = (state.mcpInstalls ?? []).filter((entry) => entry.packageId !== packageId);
+    if (installs.length === state.installs.length &&
+        mcpInstalls.length === (state.mcpInstalls ?? []).length)
         throw new Error(`Package is not managed by Loadout: ${packageId}`);
     await writeInstallState({
         version: 1,
         installs,
-        mcpInstalls: (state.mcpInstalls ?? []).filter((entry) => entry.packageId !== packageId),
+        ...(state.profile ? { profile: state.profile } : {}),
+        mcpInstalls,
         activations: (state.activations ?? []).map((entry) => entry.packageId === packageId
             ? {
                 ...entry,

package/dist/src/core/transaction.js

@@ -2,7 +2,7 @@ import { lstat, mkdir, readdir, readFile, rename, rm, writeFile, } from "node:fs
 import { randomUUID } from "node:crypto";
 import { join } from "node:path";
 import { ensureDirectory, loadoutHome } from "./paths.js";
-import { createSnapshot, readSnapshot, restoreSnapshot } from "./snapshot.js";
+import { createSnapshot, readSnapshot, recordSnapshotPostMutationState, restoreSnapshot, } from "./snapshot.js";
 import { acquireFileLock, withFileLock, } from "./file-lock.js";
 export const transactionRoot = () => join(loadoutHome(), "staging");
 const transactionPreparingRoot = () => join(loadoutHome(), "staging-preparing");
@@ -136,6 +136,7 @@ export async function runMutationTransaction(prepare, mutate) {
         });
         await markTransactionCommitting(transaction);
         const result = await mutate(prepared.value, snapshot);
+        await recordSnapshotPostMutationState(snapshot);
         await completeTransaction(transaction);
         return { snapshotId: snapshot.id, result };
     }