loadout-ai 0.5.1 → 0.5.2

package/CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ## Unreleased
 
+## 0.5.2 - 2026-07-21
+
+### Fixed
+
+- Revalidate and apply the exact skill-and-agent activation delta shown in a project
+  preview instead of broadening package selections across every requested agent.
+- Reject browser-testing skills and Playwright MCP recommendations for CLI-only
+  TypeScript projects without a browser or frontend signal.
+- Replace unexplained ranking numbers and a duplicated full activation delta with a
+  concise exact-transaction summary in the default project optimization output.
+
 ## 0.5.1 - 2026-07-21
 
 ### Fixed

package/MASTER_PLAN.md

@@ -277,6 +277,14 @@ merged `codex/relatable-readme-hero` remote branch remains safe to delete after
       previews an unblocked removal of 29 packages/2,316 disabled records, and health
       reports `library ready (nothing active)` with explicit counts. Release as
       `0.5.1` before continuing the complete-uninstall acceptance step.
+- [x] `P18-38 [TERRA]` Fix the founder-discovered asymmetric project-activation
+      scope bug. The `0.5.1` preview correctly budgeted 22 Codex and 18 Claude
+      additions, but apply-time revalidation broadened four Codex-only selectors
+      onto Claude. Revalidation now preserves the exact package, skill, and agent
+      tuple from the preview; a two-agent regression proves exact 30/18 applied
+      counts. CLI-only TypeScript projects also reject browser-testing and
+      Playwright false positives, and the default preview removes unexplained scores
+      and duplicated delta output. Release as `0.5.2` before resuming activation.
 
 ### Release 0.3 lifecycle hardening
 

package/README.md

@@ -26,7 +26,7 @@
 </p>
 
 > [!IMPORTANT]
-> Installation is version-pinned so the code you test matches these docs. The commands below target `loadout-ai@0.5.1`; review the preview before every apply.
+> Installation is version-pinned so the code you test matches these docs. The commands below target `loadout-ai@0.5.2`; review the preview before every apply.
 
 ## How it works
 
@@ -76,7 +76,7 @@ Skills, plugins, MCP servers, and agent settings tend to accumulate one experime
 You need Node.js 20 or newer and Git.
 
 ```bash
-npm install --global loadout-ai@0.5.1
+npm install --global loadout-ai@0.5.2
 loadout --version
 loadout guide
 ```

package/dist/src/cli.js

@@ -263,7 +263,7 @@ async function runSetup(options) {
         reader?.close();
     }
 }
-const LOADOUT_VERSION = "0.5.1";
+const LOADOUT_VERSION = "0.5.2";
 function durableSchedulerLauncher() {
     return [
         join(dirname(process.execPath), process.platform === "win32" ? "npx.cmd" : "npx"),

package/dist/src/core/active-policy.js

@@ -57,6 +57,10 @@ function hasProjectCompatibility(name, project) {
     if (/(?:publish-to-pages|github-pages|cloudflare-pages)/.test(name) &&
         !project.frameworks.some((framework) => ["react", "next.js", "vue", "svelte"].includes(framework)))
         return false;
+    if (/playwright|e2e|webapp-testing|browser-testing/.test(name) &&
+        !project.frameworks.includes("playwright") &&
+        !project.frameworks.some((framework) => ["react", "next.js", "vue", "svelte"].includes(framework)))
+        return false;
     return true;
 }
 const SOURCE_PRIORITY = {
@@ -396,11 +400,20 @@ export function formatProjectActivation(plan) {
         ...plan.agentPlans.flatMap((agentPlan) => [
             `${agentPlan.displayName}: ${agentPlan.activeBefore} active (${agentPlan.managedBefore} managed, ${agentPlan.unmanagedBefore} unmanaged); ${agentPlan.capacity}/${plan.limit} slots available`,
             `Proposed additions for ${agentPlan.displayName}: ${agentPlan.selected.length}`,
-            ...agentPlan.selected.map((item) => `  + ${item.selector} [${item.score}] — ${item.reasons.join(", ")}`),
+            ...agentPlan.selected.map((item) => `  + ${item.selector} — ${item.reasons.join(", ")}`),
             ...agentPlan.alternatives.map((item) => `  = ${item.unitId}: selected ${item.selected}; deferred equivalent source(s): ${item.deferred.join(", ")}`),
         ]),
         ...(plan.activation
-            ? ["", "Exact activation delta:", formatActivationPlan(plan.activation)]
+            ? plan.activation.blocked
+                ? [
+                    "",
+                    "Blocked activation details:",
+                    formatActivationPlan(plan.activation),
+                ]
+                : [
+                    "",
+                    `Activation transaction: ${plan.activation.changes.length} exact skill change(s), applied together with one rollback snapshot.`,
+                ]
             : []),
         ...plan.warnings.map((warning) => `Warning: ${warning}`),
     ].join("\n");

package/dist/src/core/active-set.js

@@ -287,12 +287,39 @@ export async function planActivationChange(action, packageIds, options = {}) {
 function activationKey(record) {
     return `${record.packageId}\0${record.agent}\0${record.unitId ?? ""}`;
 }
+async function revalidateExactActivationPlan(plan) {
+    const selectorsByAgent = new Map();
+    for (const change of plan.changes) {
+        const selectors = selectorsByAgent.get(change.agent) ?? [];
+        selectors.push(change.unitId ? `${change.packageId}/${change.unitId}` : change.packageId);
+        selectorsByAgent.set(change.agent, selectors);
+    }
+    const fragments = await Promise.all([...selectorsByAgent].map(([agent, selectors]) => planActivationChange(plan.action, selectors, { agents: [agent] })));
+    const changes = fragments.flatMap((fragment) => fragment.changes);
+    const plannedKeys = plan.changes.map(activationKey);
+    const freshKeys = changes.map(activationKey);
+    if (new Set(plannedKeys).size !== plannedKeys.length ||
+        new Set(freshKeys).size !== freshKeys.length ||
+        plannedKeys.length !== freshKeys.length ||
+        plannedKeys.some((key) => !freshKeys.includes(key)))
+        throw new Error("Activation selection changed after preview; generate a new plan before applying.");
+    const order = new Map(plannedKeys.map((key, index) => [key, index]));
+    changes.sort((left, right) => order.get(activationKey(left)) - order.get(activationKey(right)));
+    const warnings = fragments.flatMap((fragment) => fragment.warnings);
+    return {
+        action: plan.action,
+        packages: plan.packages,
+        ...(plan.requestedAgents ? { requestedAgents: plan.requestedAgents } : {}),
+        changes,
+        skipped: fragments.flatMap((fragment) => fragment.skipped),
+        blocked: warnings.length > 0,
+        warnings,
+    };
+}
 export async function applyActivationChange(plan, options = {}) {
     const applied = await runMutationTransaction(async () => {
         await options.preflight?.();
-        const fresh = await planActivationChange(plan.action, plan.packages, {
-            ...(plan.requestedAgents ? { agents: plan.requestedAgents } : {}),
-        });
+        const fresh = await revalidateExactActivationPlan(plan);
         if (fresh.blocked)
             throw new Error(fresh.warnings.join("; "));
         if (!fresh.changes.length)

package/dist/src/core/recommend.js

@@ -179,8 +179,10 @@ export function recommendPackages(signals, catalog) {
     if (signals.frameworks.some((item) => ["react", "next.js", "vue", "svelte"].includes(item)))
         add("ui-ux-pro-max", `Frontend framework detected: ${signals.frameworks.join(", ")}.`, "high");
     if (signals.frameworks.includes("playwright") ||
-        signals.languages.includes("javascript/typescript"))
-        add("playwright-mcp", "Browser verification is useful for this web-capable project.", signals.frameworks.includes("playwright") ? "high" : "medium");
+        signals.frameworks.some((item) => ["react", "next.js", "vue", "svelte"].includes(item)))
+        add("playwright-mcp", signals.frameworks.includes("playwright")
+            ? "Playwright is already configured in this project."
+            : "Browser verification may help test the detected frontend framework.", signals.frameworks.includes("playwright") ? "high" : "medium");
     if (signals.files.includes(".git"))
         add("github-mcp-server", "A Git repository was detected; GitHub tools may help with issues and pull requests.", "medium");
     if (signals.roles.includes("obsidian-vault"))

package/docs/USER_TEST_GUIDE.md

@@ -183,7 +183,7 @@ cleanup deliberately deletes Loadout's snapshots, so it is the last lifecycle te
 ## Troubleshooting and recovery
 
 - **`loadout` is not found after installation:** confirm `npm install --global
-loadout-ai@0.5.1` completed, run `hash -r`, and confirm npm's global binary
+loadout-ai@0.5.2` completed, run `hash -r`, and confirm npm's global binary
   directory is on `PATH`. For a source checkout, run `npm run build` and `npm link`.
 - **A preview asks for `--approve-risk`:** read the reported scripts, domains,
   credentials, binaries, or instruction findings. If you accept that specific plan,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loadout-ai",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "private": false,
   "license": "MIT",
   "description": "Universal upgrade manager for AI coding agents",