loadout-ai 0.5.0 → 0.5.1

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 ## Unreleased
 
+## 0.5.1 - 2026-07-21
+
+### Fixed
+
+- Remove disabled Maximum-library copies during package removal and complete
+  uninstall without inspecting or deleting unrelated skills that later occupy the
+  original agent path.
+- Describe a disabled-only Maximum library as ready with nothing active, including
+  explicit active and disabled skill counts, instead of calling it a healthy active
+  installation.
+- Name modified managed paths in blocked complete-uninstall previews so users can
+  review real drift before deciding whether to force removal.
+
+## 0.5.0 - 2026-07-21
+
 ### Added
 
 - Add the pinned MIT-licensed Obsidian Skills collection and recommend it only when an

package/MASTER_PLAN.md

@@ -270,6 +270,13 @@ merged `codex/relatable-readme-hero` remote branch remains safe to delete after
       publish attempt. Every build now removes `dist` first on every platform, and the
       package smoke test rejects removed dashboard/demo JavaScript if it ever leaks
       back into the tarball. The failed OTP-gated attempt published nothing.
+- [x] `P18-37 [TERRA]` Fix the founder-discovered disabled-library uninstall bug.
+      Removal now resolves each managed file to its disabled Maximum-library copy,
+      never an unmanaged skill that later occupies the original active path. A
+      regression test preserves the replacement bytes, the real founder state now
+      previews an unblocked removal of 29 packages/2,316 disabled records, and health
+      reports `library ready (nothing active)` with explicit counts. Release as
+      `0.5.1` before continuing the complete-uninstall acceptance step.
 
 ### Release 0.3 lifecycle hardening
 

package/README.md

@@ -26,7 +26,7 @@
 </p>
 
 > [!IMPORTANT]
-> Installation is version-pinned so the code you test matches these docs. The commands below target `loadout-ai@0.5.0`; review the preview before every apply.
+> Installation is version-pinned so the code you test matches these docs. The commands below target `loadout-ai@0.5.1`; review the preview before every apply.
 
 ## How it works
 
@@ -76,7 +76,7 @@ Skills, plugins, MCP servers, and agent settings tend to accumulate one experime
 You need Node.js 20 or newer and Git.
 
 ```bash
-npm install --global loadout-ai@0.5.0
+npm install --global loadout-ai@0.5.1
 loadout --version
 loadout guide
 ```

package/dist/src/cli.js

@@ -263,7 +263,7 @@ async function runSetup(options) {
         reader?.close();
     }
 }
-const LOADOUT_VERSION = "0.5.0";
+const LOADOUT_VERSION = "0.5.1";
 function durableSchedulerLauncher() {
     return [
         join(dirname(process.execPath), process.platform === "win32" ? "npx.cmd" : "npx"),

package/dist/src/core/health.js

@@ -100,18 +100,26 @@ export async function buildHealthReport(options = {}) {
             fix: "Check connectivity and retry.",
         });
     const configured = state.installs.length > 0 || (state.mcpInstalls ?? []).length > 0;
+    const activeSkills = (state.activations ?? []).filter((entry) => entry.installationState === "installed" &&
+        entry.activationState === "active").length;
+    const disabledSkills = (state.activations ?? []).filter((entry) => entry.installationState === "installed" &&
+        entry.activationState === "disabled").length;
     const status = findings.some((finding) => finding.level === "error")
         ? "unhealthy"
         : !configured
             ? "not-configured"
             : findings.some((finding) => finding.level === "warning")
                 ? "attention"
-                : "healthy";
+                : activeSkills === 0 && disabledSkills > 0
+                    ? "library-only"
+                    : "healthy";
     return {
         status,
         generatedAt: new Date().toISOString(),
         agents,
         installedPackages: state.installs.length,
+        activeSkills,
+        disabledSkills,
         updatesChecked: Boolean(options.updates || options.checkUpdates),
         updatesAvailable: available.length,
         driftedFiles: drifted.length,
@@ -120,7 +128,7 @@ export async function buildHealthReport(options = {}) {
     };
 }
 export function formatHealthReport(report) {
-    const icon = report.status === "not-configured"
+    const icon = report.status === "not-configured" || report.status === "library-only"
         ? "•"
         : report.status === "healthy"
             ? "✓"
@@ -128,8 +136,8 @@ export function formatHealthReport(report) {
                 ? "!"
                 : "✗";
     const lines = [
-        `${icon} Loadout health: ${report.status === "not-configured" ? "not configured" : report.status}`,
-        `Packages: ${report.installedPackages} installed, ${report.updatesChecked ? `${report.updatesAvailable} update(s)` : "updates not checked (use --updates)"}, ${report.driftedFiles} drifted file(s), ${report.driftedMcpServers} drifted MCP server(s)`,
+        `${icon} Loadout health: ${report.status === "not-configured" ? "not configured" : report.status === "library-only" ? "library ready (nothing active)" : report.status}`,
+        `Packages: ${report.installedPackages} managed; skills: ${report.activeSkills ?? 0} active, ${report.disabledSkills ?? 0} disabled; ${report.updatesChecked ? `${report.updatesAvailable} update(s)` : "updates not checked (use --updates)"}; ${report.driftedFiles} drifted file(s), ${report.driftedMcpServers} drifted MCP server(s)`,
     ];
     for (const finding of report.findings)
         lines.push(`${finding.level === "ok" ? "✓" : finding.level === "error" ? "✗" : finding.level === "warning" ? "!" : "•"} ${finding.message}${finding.fix ? ` ${finding.fix}` : ""}`);

package/dist/src/core/remove.js

@@ -3,6 +3,7 @@ import { readFile, rm } from "node:fs/promises";
 import { forgetInstall, installStatePath, readInstallState } from "./state.js";
 import { writeMcpConfigPlan } from "./mcp.js";
 import { runMutationTransaction } from "./transaction.js";
+import { managedFileReadPath } from "./active-set.js";
 import { codexMcpServerFingerprint, removeCodexMcpServerBlock, writeCodexMcpConfigContent, } from "./codex-mcp.js";
 export async function planRemove(packageId) {
     const state = await readInstallState();
@@ -11,19 +12,20 @@ export async function planRemove(packageId) {
     if (!record && !trackedMcp.length)
         throw new Error(`Package is not managed by Loadout: ${packageId}`);
     const files = await Promise.all((record?.files ?? []).map(async (file) => {
+        const managedPath = managedFileReadPath(packageId, file.path, state.activations ?? []);
         try {
             const digest = createHash("sha256")
-                .update(await readFile(file.path))
+                .update(await readFile(managedPath))
                 .digest("hex");
             return {
-                path: file.path,
+                path: managedPath,
                 status: digest === file.sha256
                     ? "unchanged"
                     : "modified",
             };
         }
         catch {
-            return { path: file.path, status: "missing" };
+            return { path: managedPath, status: "missing" };
         }
     }));
     const modified = files.filter((file) => file.status === "modified");

package/dist/src/core/uninstall.js

@@ -113,6 +113,9 @@ export async function uninstallGlobalCli() {
     });
 }
 export function formatUninstallPlan(plan) {
+    const modifiedPaths = plan.packages.flatMap((entry) => entry.files
+        .filter((file) => file.status === "modified")
+        .map((file) => file.path));
     return [
         "Complete Loadout uninstall preview",
         "",
@@ -122,7 +125,14 @@ export function formatUninstallPlan(plan) {
         `Daily jobs to remove: ${plan.schedulers.map((item) => item.job).join(", ") || "none"}`,
         `State and cache: ${plan.stateHome}`,
         ...(plan.blocked
-            ? ["", "BLOCKED: managed files were changed outside Loadout."]
+            ? [
+                "",
+                "BLOCKED: managed files were changed outside Loadout.",
+                ...modifiedPaths.slice(0, 10).map((path) => `  Modified: ${path}`),
+                ...(modifiedPaths.length > 10
+                    ? [`  …and ${modifiedPaths.length - 10} more`]
+                    : []),
+            ]
             : []),
         "",
         ...plan.warnings.map((warning) => `Warning: ${warning}`),

package/docs/USER_TEST_GUIDE.md

@@ -183,7 +183,7 @@ cleanup deliberately deletes Loadout's snapshots, so it is the last lifecycle te
 ## Troubleshooting and recovery
 
 - **`loadout` is not found after installation:** confirm `npm install --global
-loadout-ai@0.5.0` completed, run `hash -r`, and confirm npm's global binary
+loadout-ai@0.5.1` completed, run `hash -r`, and confirm npm's global binary
   directory is on `PATH`. For a source checkout, run `npm run build` and `npm link`.
 - **A preview asks for `--approve-risk`:** read the reported scripts, domains,
   credentials, binaries, or instruction findings. If you accept that specific plan,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loadout-ai",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "private": false,
   "license": "MIT",
   "description": "Universal upgrade manager for AI coding agents",