plugnz 0.0.7 → 0.0.8

package/dist/plugnz.mjs

@@ -12622,12 +12622,12 @@ function assertOutcome(outcome, snapshots, dryRun, command) {
   if (outcome["action"] === "not-attempted" && (outcome["route"] !== "none" || outcome["changed"] !== false || outcome["result"] === "succeeded" || outcome["result"] === "pending")) {
     throw contradiction(`preflight refusal '${outcome["operationId"]}' must be a non-successful, non-mutating no-route action`);
   }
-  if (outcome["action"] === "not-attempted" && (outcome["resourceState"] !== "unknown" || outcome["activationState"] !== "unknown")) {
+  if (!dryRun && outcome["action"] === "not-attempted" && (outcome["resourceState"] !== "unknown" || outcome["activationState"] !== "unknown")) {
     throw contradiction(`preflight refusal '${outcome["operationId"]}' cannot claim a terminal resource or activation state`);
   }
   const containment = outcome["action"] === "retain-prior" || outcome["action"] === "disable-nonconforming";
   const appliedDisablement = outcome["action"] === "disable-nonconforming" && outcome["changed"] === true;
-  if (containment) {
+  if (containment && !dryRun) {
     const expectedResourceState = "retained";
     const expectedActivationState = outcome["action"] === "retain-prior" ? "retained-prior" : appliedDisablement ? "inactive" : "active-nonconforming";
     if (outcome["result"] !== "failed" || outcome["resourceState"] !== expectedResourceState || outcome["activationState"] !== expectedActivationState) {
@@ -12654,9 +12654,12 @@ function assertOutcome(outcome, snapshots, dryRun, command) {
       throw contradiction(`successful Desired outcome '${outcome["operationId"]}' needs an exact native identity`);
     }
     const terminalStateMatches = outcome["coverage"] === "retirement" ? outcome["resourceState"] === "absent" && outcome["activationState"] === "inactive" : outcome["resourceState"] === "present" && outcome["activationState"] === "active-conforming";
-    if (!terminalStateMatches)
+    if (!dryRun && !terminalStateMatches)
       throw contradiction(`successful outcome '${outcome["operationId"]}' contradicts its terminal resource or activation state`);
   }
+  if (dryRun && (outcome["resourceState"] === "potentially-changed" || outcome["resourceState"] === "absent" && outcome["activationState"] !== "inactive" || outcome["resourceState"] === "unknown" && outcome["activationState"] !== "unknown")) {
+    throw contradiction(`dry-run outcome '${outcome["operationId"]}' contradicts its observed resource or activation state`);
+  }
   if (outcome["result"] === "not-attempted" && outcome["resourceState"] === "potentially-changed") {
     throw contradiction(`not-attempted outcome '${outcome["operationId"]}' cannot be potentially changed`);
   }
@@ -25043,7 +25046,7 @@ async function planLifecycle(input) {
     scopes.push(planned.scope);
     operations.push(...planned.operations);
   }
-  return frozenPlan(input, command, attemptId, scopes, operations, prepared);
+  return frozenPlan(input, command, attemptId, scopes, operations, prepared, loaded.state);
 }
 async function prepareEntry(entry, hosts, state, command, transportSource, transportCache) {
   switch (entry.operation) {
@@ -25202,7 +25205,7 @@ async function planSync(item, attemptId, validatedAt, state, command) {
         requiredCapabilities: [],
         adoptionRequested: selected.adoptionRequested
       });
-      classified.push(uninventoriedUpdate(item, selected.plugin.name, nativeId));
+      classified.push(uninventoriedUpdate(item, selected.plugin.name, nativeId, attemptId));
       continue;
     }
     const nativeId = item.host === null ? selected.plugin.name : item.host.plannedNativeId(selected.plugin);
@@ -25213,7 +25216,7 @@ async function planSync(item, attemptId, validatedAt, state, command) {
       requiredCapabilities: [...requiredSemanticsForOperation(inventory, "install")].sort(),
       adoptionRequested: selected.adoptionRequested
     });
-    const row = await classifyDesired(item, selected, inventory, nativeId, attemptId, state, command === "add" || command === "update", command === "update");
+    const row = await classifyDesired(item, selected, inventory, nativeId, attemptId, state, command === "update");
     if (row.kind === "defect")
       return row;
     classified.push(row);
@@ -25233,8 +25236,8 @@ async function planSync(item, attemptId, validatedAt, state, command) {
     operations: [...classified.map((row) => row.operation), ...retirements.operations]
   };
 }
-async function classifyDesired(item, selected, inventory, nativeId, attemptId, state, applyUpdates, reapplyMatchingUpdate) {
-  const operationId = operationIdentity("desired-pair", item.scope.id, selected.plugin.name, nativeId, item.frozen.snapshot.fingerprint);
+async function classifyDesired(item, selected, inventory, nativeId, attemptId, state, reapplyMatchingUpdate) {
+  const operationId = operationIdentity("desired-pair", item.scope.id, selected.plugin.name, nativeId, `${item.frozen.snapshot.fingerprint}\x00${attemptId}`);
   const snapshotId = sourceSnapshotId(item.frozen);
   const activation = findActivation(state, item.scope.id, selected.plugin.name, nativeId);
   if (item.host === null || item.observation === null) {
@@ -25274,13 +25277,12 @@ async function classifyDesired(item, selected, inventory, nativeId, attemptId, s
     return classified(operationId, "desired-pair", item.scope, snapshotId, selected.plugin.name, nativeId, "not-attempted", "none", decision.reason);
   }
   const recordedRoute = activation?.route.kind === "managed" || activation?.route.kind === "native" ? activation.route.kind : null;
-  const matchingBytes = sameBytes(activation, installation, selected.plugin);
+  const matchingBytes = sameBytes(activation, installation, selected.plugin) && installation?.activation === "active" && installation.enablement === "enabled";
   const action = chosenAction(replacing, recordedRoute, decision.route, matchingBytes, reapplyMatchingUpdate);
-  const plannedOperationId = action === "update" && matchingBytes && reapplyMatchingUpdate ? operationIdentity("desired-pair", item.scope.id, selected.plugin.name, nativeId, `${item.frozen.snapshot.fingerprint}\x00${state.stateGeneration}`) : operationId;
-  if (action === "route-migrate" || action === "update" && !applyUpdates) {
+  if (action === "route-migrate") {
     return classified(operationId, "desired-pair", item.scope, snapshotId, selected.plugin.name, nativeId, "retain-prior", recordedRoute ?? decision.route, createLifecycleReason("capability", "capability.unsupported", `${action} of '${selected.plugin.name}' is not applied by this execution slice`, action));
   }
-  return classified(plannedOperationId, "desired-pair", item.scope, snapshotId, selected.plugin.name, nativeId, action, decision.route, null);
+  return classified(operationId, "desired-pair", item.scope, snapshotId, selected.plugin.name, nativeId, action, decision.route, null);
 }
 async function planOmissions(item, attemptId, state, desired) {
   const packageIds = new Set(desired.map((row) => row.packageId));
@@ -25417,7 +25419,7 @@ async function selectDisable(item, nativeId, operationId, attemptId, version, ac
   return decision;
 }
 async function selectRetirement(host, observation, scope, activation, attemptId, source) {
-  const operationId = operationIdentity("retirement", scope.id, activation.packageId, activation.nativeId, activation.sourceRevision ?? "unrecorded");
+  const operationId = operationIdentity("retirement", scope.id, activation.packageId, activation.nativeId, `${activation.sourceRevision ?? "unrecorded"}\x00${attemptId}`);
   const installation = observation.installations.find((row) => row.nativeId === activation.nativeId);
   if (installation === undefined) {
     return { kind: "planned", operation: notAttemptedRetirement(operationId, scope, activation, "ownership was not revalidated") };
@@ -25500,8 +25502,9 @@ async function decideRecordedRoute(host, observation, recorded, operationId, att
 function recordedActivation(scope, source, activation, installation, target) {
   return ownedActivation(scope, source, activation, installation, target);
 }
-function frozenPlan(input, command, attemptId, scopes, operations, prepared) {
+function frozenPlan(input, command, attemptId, scopes, operations, prepared, state) {
   const snapshots = [];
+  const frozenSources = new Map;
   const seen = new Set;
   for (const item of prepared) {
     if (item.kind !== "sync")
@@ -25511,8 +25514,12 @@ function frozenPlan(input, command, attemptId, scopes, operations, prepared) {
       continue;
     seen.add(id);
     snapshots.push({ id, reference: item.frozen.snapshot });
+    frozenSources.set(id, item.frozen);
   }
-  const outcomes = operations.map((row) => outcomeFor(row));
+  const outcomes = operations.map((row) => {
+    const outcome = outcomeFor(row);
+    return input.dryRun ? { ...outcome, ...observedStates(row.operation, prepared, state) } : outcome;
+  });
   const failed = outcomes.filter((outcome) => outcome.result !== "succeeded");
   const converged = failed.length === 0;
   const failureCategory = converged ? null : failed[0]?.reason?.category ?? "internal";
@@ -25536,12 +25543,31 @@ function frozenPlan(input, command, attemptId, scopes, operations, prepared) {
     kind: "frozen",
     requestedDryRun: input.dryRun,
     attemptId,
+    frozenSources,
     report,
     scopes,
     operations,
     ...input.transportSource === undefined ? {} : { transportSource: input.transportSource }
   };
 }
+function observedStates(operation, prepared, state) {
+  const item = prepared.find((candidate) => candidate.scope.id === operation.scope.id);
+  if (item?.observation === null || item === undefined)
+    return { resourceState: "unknown", activationState: "unknown" };
+  const installation = item.observation.installations.find((row) => row.nativeId === operation.nativeId);
+  if (installation === undefined || installation.presence === "absent")
+    return { resourceState: "absent", activationState: "inactive" };
+  if (installation.enablement === "disabled" || installation.activation === "inactive")
+    return { resourceState: "present", activationState: "inactive" };
+  if (installation.enablement === "unknown" || installation.activation === "unknown")
+    return { resourceState: "present", activationState: "unknown" };
+  if (installation.activation === "nonconforming")
+    return { resourceState: "present", activationState: "active-nonconforming" };
+  const activation = findActivation(state, operation.scope.id, operation.package, operation.nativeId ?? "");
+  const plugin = item.kind === "sync" ? item.selected.find((selected) => selected.plugin.name === operation.package)?.plugin : undefined;
+  const conforming = operation.coverage === "retirement" ? activation?.fingerprints.installed === installation.installedFingerprint : plugin !== undefined && sameBytes(activation, installation, plugin);
+  return { resourceState: "present", activationState: conforming ? "active-conforming" : "active-nonconforming" };
+}
 function outcomeFor(row) {
   const operation = row.operation;
   switch (operation.action) {
@@ -25580,8 +25606,8 @@ function plannedNativeIdFor(item, plugin) {
     return error instanceof Error ? error : new Error(unknownErrorDiagnostic(error));
   }
 }
-function uninventoriedUpdate(item, packageName, nativeId) {
-  return classified(operationIdentity("desired-pair", item.scope.id, packageName, nativeId, item.frozen.snapshot.fingerprint), "desired-pair", item.scope, sourceSnapshotId(item.frozen), packageName, nativeId, "update", "managed", null);
+function uninventoriedUpdate(item, packageName, nativeId, attemptId) {
+  return classified(operationIdentity("desired-pair", item.scope.id, packageName, nativeId, `${item.frozen.snapshot.fingerprint}\x00${attemptId}`), "desired-pair", item.scope, sourceSnapshotId(item.frozen), packageName, nativeId, "update", "managed", null);
 }
 function classified(operationId, coverage, scope, sourceSnapshotId, packageName, nativeId, action, route, reason) {
   return {
@@ -25748,9 +25774,7 @@ function commandName(manifest) {
   return manifest.entries.every((entry) => entry.operation === "retire-source") ? "retire-source" : "sync";
 }
 function resolvePlannedSource(binding, transportSource, cache) {
-  const argument = transportArgument(binding, transportSource);
-  if (argument === undefined)
-    return resolveSource(sourceArgument(binding));
+  const argument = transportArgument(binding, transportSource) ?? sourceArgument(binding);
   const cached = cache.get(argument);
   if (cached !== undefined)
     return cached;
@@ -26022,6 +26046,15 @@ async function executeFrozen(plan, hosts, now) {
   const refusal = ledger.generationRefusal(plan);
   if (refusal !== null)
     return refusalReport(plan, refusal);
+  try {
+    for (const frozen of plan.frozenSources.values()) {
+      if (fingerprintTree(frozen.snapshotDir) !== frozen.snapshot.fingerprint) {
+        return refusalReport(plan, createLifecycleReason("internal", "internal.invariant", "retained frozen source bytes drifted before apply"));
+      }
+    }
+  } catch (error) {
+    return refusalReport(plan, thrownReason(error));
+  }
   const outcomes = [];
   let stopped = null;
   for (const row of plan.operations) {
@@ -26186,8 +26219,10 @@ async function prepareActivation(plan, operation, host, nativeId, action, record
   if (context === undefined) {
     return refused(createLifecycleReason("internal", "internal.invariant", `${action} '${operation.package}' has no frozen source snapshot`));
   }
-  const frozen = resolvePlannedSource(operation.scope.source, plan.transportSource, new Map);
-  if (frozen.snapshot.fingerprint !== context.reference.fingerprint || frozen.snapshot.revision !== context.reference.revision) {
+  const frozen = operation.sourceSnapshotId === null ? undefined : plan.frozenSources.get(operation.sourceSnapshotId);
+  if (frozen === undefined)
+    return refused(createLifecycleReason("internal", "internal.invariant", `${action} '${operation.package}' lost its retained frozen source`));
+  if (frozen.snapshot.fingerprint !== context.reference.fingerprint || frozen.snapshot.revision !== context.reference.revision || fingerprintTree(frozen.snapshotDir) !== context.reference.fingerprint) {
     return refused(createLifecycleReason("internal", "internal.invariant", `${action} '${operation.package}' source bytes drifted from the frozen snapshot`));
   }
   const plugin = frozen.plugins.find((candidate) => candidate.name === operation.package);
@@ -26201,6 +26236,9 @@ async function prepareActivation(plan, operation, host, nativeId, action, record
   if (version.kind !== "detected") {
     return refused(createLifecycleReason("runtime", "runtime.operation-failed", `${action} '${operation.package}' lost its detected target version`));
   }
+  if (fingerprintTree(frozen.snapshotDir) !== context.reference.fingerprint) {
+    return refused(createLifecycleReason("internal", "internal.invariant", `${action} '${operation.package}' retained snapshot changed during target observation`));
+  }
   const inventory = inventoryPackageSemantics(plugin);
   const resolvedPins = resolveRecordedPinExecutables(plugin.dir, recordedPins);
   if (resolvedPins.kind === "refused")
@@ -27634,7 +27672,7 @@ function legacyCommandAction(command) {
 // package.json
 var package_default = {
   name: "plugnz",
-  version: "0.0.7",
+  version: "0.0.8",
   description: "Install, diagnose and update agent plugins (Agent Plugins spec) and MCP configs across Claude Code, Codex, Cursor, Kimi and more",
   license: "MIT",
   type: "module",
@@ -27877,10 +27915,17 @@ function withoutRetiredActivation(state, scopeId, packageId, nativeId, retiredAt
   if (activation === undefined)
     throw new Error(`activation '${packageId}' is not recorded for manual removal`);
   const dropped = state.activations.filter((row) => row !== activation);
+  const attempts = state.attempts.map((attempt) => attempt.id !== activation.pending?.attemptId ? attempt : {
+    ...attempt,
+    phase: "completed",
+    completedAt: retiredAt,
+    updatedAt: retiredAt,
+    journal: attempt.journal.map((entry) => ({ ...entry, state: "completed", updatedAt: retiredAt }))
+  });
   const tombstone = retirementTombstone(activation, retiredAt);
   if (tombstone === null) {
     if (activation.ownership.kind === "legacy-claim" && activation.route.kind === "legacy-unverified" && (activation.ownership.prior === "plgnz" || activation.ownership.prior === "unrecorded")) {
-      return { ...state, stateGeneration: state.stateGeneration + 1, activations: dropped };
+      return { ...state, stateGeneration: state.stateGeneration + 1, activations: dropped, attempts };
     }
     throw new Error(`activation '${packageId}' cannot retain a tombstone`);
   }
@@ -27888,9 +27933,47 @@ function withoutRetiredActivation(state, scopeId, packageId, nativeId, retiredAt
     ...state,
     stateGeneration: state.stateGeneration + 1,
     activations: dropped,
+    attempts,
     tombstones: state.tombstones.some((row) => row.id === tombstone.id) ? state.tombstones : [...state.tombstones, tombstone]
   };
 }
+function withPendingRemoval(state, operation, now) {
+  const activation = state.activations.find((row) => row.scopeId === operation.scope.id && row.nativeId === operation.nativeId && (row.packageId === operation.package || row.packageId === operation.nativeId));
+  if (activation === undefined)
+    throw new Error(`activation '${operation.package}' is not recorded for manual removal`);
+  if (activation.pending?.operation === "remove")
+    return { ...state, stateGeneration: state.stateGeneration + 1 };
+  const attemptId = `remove-attempt-${state.stateGeneration}-${operation.operationId}`;
+  return {
+    ...state,
+    stateGeneration: state.stateGeneration + 1,
+    scopes: state.scopes.map((scope) => scope.id === operation.scope.id ? { ...scope, lastAttemptId: attemptId } : scope),
+    activations: state.activations.map((row) => row !== activation ? row : {
+      ...row,
+      pending: { operation: "remove", phase: "applying", attemptId, startedAt: now }
+    }),
+    attempts: [...state.attempts, {
+      id: attemptId,
+      command: "remove",
+      phase: "pruning",
+      mutationStarted: true,
+      scopeIds: [operation.scope.id],
+      startedAt: now,
+      updatedAt: now,
+      journal: [{
+        operationId: operation.operationId,
+        scopeId: operation.scope.id,
+        packageId: activation.packageId,
+        nativeId: activation.nativeId,
+        action: "remove",
+        state: "applying",
+        route: activation.route,
+        startedAt: now,
+        updatedAt: now
+      }]
+    }]
+  };
+}
 function reportFor(command, dryRun, plan, outcomes, options = {}) {
   const failure = options.reason ?? outcomes.find((candidate) => candidate.result !== "succeeded")?.reason ?? null;
   const result = options.result ?? (failure === null && outcomes.every((candidate) => candidate.result === "succeeded") ? "converged" : "incomplete");
@@ -29175,20 +29258,22 @@ async function main(argv) {
         preflightFailure = createLifecycleReason("internal", "internal.invariant", "install is pending; refusing removal");
         break;
       }
+      const pendingOperationId = claimed?.pending?.operation === "remove" ? lifecycleState.attempts.find((attempt) => attempt.id === claimed.pending.attemptId)?.journal.find((entry) => entry.scopeId === claimed.scopeId && entry.packageId === claimed.packageId && entry.nativeId === claimed.nativeId)?.operationId : undefined;
       pairs.push({
         writer,
         record,
         nativeId: identity.nativeId,
         legacyNativeIds: identity.legacyNativeIds,
         failure: null,
-        operation: planOperation2({
+        operation: { ...planOperation2({
           command: "remove",
           scope: selected.scope,
           package: identity.package,
           nativeId: identity.nativeId,
           action: "retire-orphan",
-          route: "managed"
-        })
+          route: "managed",
+          discriminator: lifecycleVersion === 2 ? String(lifecycleState.stateGeneration) : undefined
+        }), ...pendingOperationId === undefined ? {} : { operationId: pendingOperationId } }
       });
     }
     if (preflightFailure !== null) {
@@ -29244,7 +29329,7 @@ async function main(argv) {
             throw new LifecycleCommandError(createLifecycleReason("internal", "internal.invariant", `state generation moved before removal of '${nativeId}'`));
           }
           try {
-            lifecycleState = withoutRetiredActivation(fresh.state, operation.scope.id, operation.package, nativeId, new Date().toISOString());
+            lifecycleState = withPendingRemoval(fresh.state, operation, new Date().toISOString());
           } catch (error) {
             throw new LifecycleCommandError(createLifecycleReason("internal", "internal.invariant", unknownErrorDiagnostic(error)));
           }
@@ -29276,6 +29361,12 @@ async function main(argv) {
         }
         pairTerminalPhase = "finalize";
         if (lifecycleVersion === 2) {
+          const fresh = readLifecycleState();
+          if (fresh.sourceVersion !== 2 || fresh.state.stateGeneration !== lifecycleState.stateGeneration) {
+            throw new LifecycleCommandError(createLifecycleReason("internal", "internal.invariant", `state generation moved before retirement finalization of '${nativeId}'`));
+          }
+          lifecycleState = withoutRetiredActivation(fresh.state, operation.scope.id, operation.package, nativeId, new Date().toISOString());
+          writeLifecycleState(lifecycleState, { globalPreflight: "succeeded" });
           state = readState();
         } else {
           const finalized = state.filter((candidate) => candidate !== pending);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "plugnz",
-  "version": "0.0.7",
+  "version": "0.0.8",
   "description": "Install, diagnose and update agent plugins (Agent Plugins spec) and MCP configs across Claude Code, Codex, Cursor, Kimi and more",
   "license": "MIT",
   "type": "module",