agent-toggle 0.1.0__py3-none-any.whl

agent_toggle/store.py

@@ -0,0 +1,252 @@
+"""State file, action log, and the legacy ~/.claude-toggle import."""
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import re
+import shutil
+import time
+from pathlib import Path
+
+from . import fs
+from .output import die
+
+VERSION = 3
+
+
+def mechanism_of(entry: dict) -> str | None:
+    """How an entry was parked, derived from the fields mechanisms.py writes."""
+    if entry.get("parked_at"):
+        return "move"
+    if entry.get("backup"):
+        return "remove_backup"
+    if entry.get("native"):
+        return "native_cli"
+    if entry.get("connector"):           # claude.ai connector: fanned over ~/.claude.json projects
+        return "connector"
+    if entry.get("flag"):                # one {file, pointer, was} config flag
+        return "flag"
+    return None
+
+
+# ------------------------------------------------------------ state keys
+
+def project_digest(project: Path | str) -> str:
+    return hashlib.sha1(str(Path(project).resolve()).encode("utf-8")).hexdigest()[:8]
+
+
+def make_key(harness: str, type_: str, name: str, project: Path | str | None = None) -> str:
+    """The one state-key scheme: `harness:type:name` for user scope,
+    `harness@<sha1(resolved project dir)[:8]>:type:name` for project scope."""
+    if project is not None:
+        harness = f"{harness}@{project_digest(project)}"
+    return f"{harness}:{type_}:{name}"
+
+
+def parse_key(key: str) -> tuple[str, str | None, str, str]:
+    """(harness, project_hash or None, type, name); a name may hold `:`."""
+    parts = key.split(":", 2)
+    if len(parts) != 3 or not all(parts):
+        raise ValueError(f"malformed state key {key!r}")
+    head, type_, name = parts
+    harness, at, digest = head.partition("@")
+    if not harness or (at and not re.fullmatch(r"[0-9a-f]{8}", digest)):
+        raise ValueError(f"malformed state key {key!r}")
+    return harness, digest or None, type_, name
+
+
+# ------------------------------------------------- entry integrity (s6.1 row 2)
+
+PATH_FIELDS = ("origin", "parked_at", "backup", "project")
+
+
+def check_entry(entry: dict, table: dict, key: str | None = None) -> str | None:
+    """Why a (possibly tampered) state entry must not be replayed, or None.
+
+    `project` comes from the same untrusted entry, so it is refused when it is
+    a filesystem root, $HOME or an ancestor of it, and (given the state key)
+    must hash to the key's project digest. Project dirs are `.<home name>`
+    (`.claude`, `.opencode`); a project entry's origin must sit in one of them and
+    its parked_at under fs.parked_dir()/<sha8> (symlinked parents refused)."""
+    if not isinstance(entry, dict):
+        return "entry is not an object"
+    hname = entry.get("harness")
+    h = table.get(hname) if isinstance(hname, str) else None
+    if h is None:
+        return f"unknown harness {entry.get('harness')!r}"
+    flag = entry.get("flag")
+    fields = {f: entry.get(f) for f in PATH_FIELDS}
+    if flag is not None:
+        fields["flag"] = flag.get("file") if isinstance(flag, dict) else flag
+    for field, value in fields.items():
+        if value is None:
+            continue
+        if not isinstance(value, str) or not value:
+            return f"{field} is not a path"
+        if ".." in Path(value).parts:
+            return f"{field} holds '..': {value}"
+        if not Path(value).is_absolute():    # would resolve against the cwd
+            return f"{field} is not absolute: {value}"
+
+    project = Path(fields["project"]) if fields["project"] else None
+    if project is not None:
+        rp, home = project.resolve(), fs.home().resolve()
+        if rp == Path(rp.anchor) or home.is_relative_to(rp):
+            return f"project is a root or holds $HOME: {project}"
+    if key is not None:
+        try:
+            digest = parse_key(key)[1]
+        except ValueError as e:
+            return str(e)
+        if digest != (project_digest(project) if project else None):
+            return f"project does not match the state key {key!r}"
+    origin, parked = fields["origin"], fields["parked_at"]
+    if project is not None:
+        # Project scope: items come from <project>/.<home name>/<declared dir> and park
+        # ONLY under parked_dir()/<sha8>, never inside the project (a repo is shared).
+        base = project / ("." + h.home.name.lstrip("."))
+        declared = [base / sub for subs in h.dirs.values() for sub in subs
+                    if not Path(sub).is_absolute()]
+        origin_ok = bool(origin) and fs.contained(Path(origin), *declared) \
+            and fs.contained(Path(origin), project)
+        parks = [fs.parked_dir() / project_digest(project)]
+    else:
+        declared = [h.home / sub for subs in h.dirs.values() for sub in subs]
+        origin_ok = bool(origin) and fs.contained(Path(origin), h.home, *declared)
+        # user scope parks only in the `*-disabled` siblings; parked_dir() is project-only
+        parks = [d.with_name(d.name + "-disabled") for d in declared]
+    if origin and not origin_ok:
+        return f"origin outside the {h.name} {'project' if project else 'home'}: {origin}"
+    if parked and not fs.contained(Path(parked), *parks):
+        return f"parked_at outside {' / '.join(map(str, parks))}: {parked}"
+    ffile = fields.get("flag")
+    if ffile and not ((fs.contained(Path(ffile), base) and fs.contained(Path(ffile), project))
+                      if project is not None else
+                      (fs.contained(Path(ffile), h.home, *declared)
+                       or Path(ffile) in {fs.claude_json(), *([h.mcp.file] if h.mcp else [])})):
+        return f"flag file outside the {h.name} home/project: {ffile}"
+    backup = fields["backup"]
+    if backup and not fs.contained(Path(backup), fs.backup_dir()):
+        return f"backup outside {fs.backup_dir()}: {backup}"
+    return None
+
+
+def scope_state(state: dict, project: Path | str | None = None) -> dict:
+    """`state` holding only one scope: user entries (project=None) or one project's."""
+    want = project_digest(project) if project is not None else None
+    keep = {}
+    for k, e in state["disabled"].items():
+        try:
+            if parse_key(k)[1] == want:
+                keep[k] = e
+        except ValueError:
+            pass
+    return {**state, "disabled": keep}
+
+
+def upgrade(state: dict) -> bool:
+    """Forward-only in-place upgrade to schema v3. True if anything changed."""
+    if state.get("version", 0) > VERSION:
+        die(f"state is schema v{state['version']}, newer than this agent-toggle "
+            f"(v{VERSION}) -- upgrade agent-toggle")
+    changed = state.get("version") != VERSION
+    state["version"] = VERSION
+    for entry in state.setdefault("disabled", {}).values():
+        if isinstance(entry, dict) and "mechanism" not in entry:
+            mech = mechanism_of(entry) or "flag"
+            entry["mechanism"] = "flag" if mech == "connector" else mech   # stored enum
+            changed = True
+    return changed
+
+
+def load_state(write_back: bool = True, check_entries: bool = True) -> dict:
+    """Read state, upgrading it to v3. Read-only commands pass write_back=False
+    so they never write outside the lock; the upgrade then stays in memory.
+    `check_entries=False` (doctor) lets a non-object entry through to be reported."""
+    state_file = fs.state_file()
+    if not state_file.exists():
+        return {"version": VERSION, "disabled": {}}
+    if write_back:                       # read-only runs never chmod; status only warns
+        fs.tighten(state_file)
+        for bp in fs.backup_dir().glob("*.json"):
+            fs.tighten(bp)
+    try:
+        state = json.loads(state_file.read_text(encoding="utf-8"))
+    except (OSError, ValueError, UnicodeDecodeError) as e:
+        die(f"state file unreadable ({state_file}): {e}")
+    if not isinstance(state, dict):
+        die(f"state file malformed ({state_file}): top level must be an object")
+    version = state.get("version", 0)
+    if not isinstance(version, int) or isinstance(version, bool):
+        die(f"state file malformed ({state_file}): version must be an integer")
+    if not isinstance(state.get("disabled", {}), dict):
+        die(f"state file malformed ({state_file}): disabled must be an object")
+    for key, entry in state.get("disabled", {}).items():
+        if check_entries and not isinstance(entry, dict):
+            die(f"state file malformed ({state_file}): entry {key!r} must be an object")
+    if upgrade(state) and write_back:
+        save_state(state)
+    return state
+
+
+def save_state(state: dict) -> None:
+    fs.private_dir(fs.state_dir())
+    fs.atomic_write(fs.state_file(), json.dumps(state, indent=2, ensure_ascii=False))
+
+
+# The log row schema, defined once; log() writes every field, in this order.
+LOG_FIELDS = ("ts", "harness", "type", "name", "action", "result", "batch",
+              "project", "scope", "detail")
+# One id per process: every row a single CLI run writes shares it.
+BATCH = f"{time.strftime('%Y%m%dT%H%M%S')}-{os.getpid()}"
+
+
+def log(action: str, type_: str, name: str, result: str, detail: str = "", *,
+        harness: str | None = None, batch: str = BATCH, project: str | None = None,
+        scope: str = "user") -> None:
+    """Append one row; every row carries the full schema (LOG_FIELDS order)."""
+    fs.private_dir(fs.state_dir())
+    rec = {"ts": time.strftime("%Y-%m-%dT%H:%M:%S%z"), "harness": harness,
+           "type": type_, "name": name, "action": action, "result": result,
+           "batch": batch, "project": project, "scope": scope, "detail": detail}
+    fd = os.open(fs.log_file(), os.O_APPEND | os.O_CREAT | os.O_WRONLY, 0o600)
+    with os.fdopen(fd, "a", encoding="utf-8") as fh:
+        fh.write(json.dumps(rec, ensure_ascii=False) + "\n")
+
+
+def migrate(state: dict) -> int:
+    """Import ~/.claude-toggle state so existing rollbacks keep working."""
+    legacy_state_dir, backup_dir = fs.legacy_state_dir(), fs.backup_dir()
+    old_file = legacy_state_dir / "state.json"
+    if not old_file.is_file():
+        print(f"nothing to migrate ({old_file} not found)")
+        return 0
+    try:
+        old = json.loads(old_file.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError) as e:
+        die(f"legacy state unreadable: {e}")
+
+    fs.private_dir(backup_dir)
+    added = 0
+    for okey, entry in old.get("disabled", {}).items():
+        new = dict(entry, harness="claude")
+        if entry["type"] == "mcp" and entry.get("backup"):
+            src = Path(entry["backup"])
+            dst = backup_dir / f"claude__{entry['name'].replace('/', '_')}.json"
+            if src.is_file() and not dst.exists():
+                shutil.copy2(src, dst)     # copy, not move: legacy stays usable
+                fs.tighten(dst)
+            new["backup"] = str(dst)
+            new["backend"] = "claude-json"
+        elif entry.get("parked_at"):
+            new.setdefault("origin", entry["parked_at"]
+                           .replace("-disabled/", "/", 1))
+        new["mechanism"] = mechanism_of(new) or "flag"
+        key = f"claude:{okey}"
+        if key not in state["disabled"]:
+            state["disabled"][key] = new
+            added += 1
+    print(f"migrated {added} entries from {legacy_state_dir}")
+    print("legacy directory left untouched -- delete it yourself once happy")
+    return 0

agent_toggle/ui/picker.py

@@ -0,0 +1,279 @@
+"""Interactive terminal picker for agent-toggle.
+
+Built on curses (stdlib) so there is nothing to install. The checkbox shows
+the ENABLED state: `[x]` is live, `[ ]` is parked. Unticking something disables
+it, ticking it back enables it.
+
+Nothing is applied while the picker is open. Changes are staged, the screen is
+torn down, and only then are the real operations run -- so their output (which
+companion files moved, which were kept because they are shared) is readable
+instead of fighting the curses display for the terminal.
+"""
+from __future__ import annotations
+
+import curses
+
+from .. import cost
+
+HELP = "Tab tick  Enter apply  Esc cancel  s sort  h/t filter  ? keys  / type to filter"
+LONG_HELP = (
+    "Keys",
+    "",
+    "  Up/Down, PgUp/PgDn   move",
+    "  Tab                  tick / untick the row (unticked = parked)",
+    "  Enter                apply the staged changes (with --dry-run: show the plan)",
+    "  Esc, Ctrl-C          cancel; nothing is changed",
+    "  s                    cycle sort: name -> cost (biggest first)",
+    "  h                    cycle the harness filter",
+    "  t                    cycle the type filter",
+    "  ?                    this screen",
+    "  /                    start typing a filter (needed to type a filter that",
+    "                       begins with s, h, t or ?; any other letter just types)",
+    "  Backspace, Ctrl-U    edit / clear the filter",
+    "",
+    "Cost is ~tokens loaded at session start (chars/4); a parked row shows",
+    "(N) = what restoring it would load. A shared dir is one row, filed under",
+    "the harness that owns it.",
+    "",
+    "any key to close",
+)
+SORTS = ("name", "cost")
+
+
+class Row:
+    __slots__ = ("harness", "type", "name", "enabled", "staged", "tokens", "would_save",
+                 "shared")
+
+    def __init__(self, harness: str, type_: str, name: str, enabled: bool,
+                 tokens: int = 0, would_save: int = 0, shared: tuple[str, ...] = ()):
+        self.harness, self.type, self.name = harness, type_, name
+        self.enabled = enabled
+        self.staged = enabled          # what the user has ticked so far
+        self.tokens, self.would_save, self.shared = tokens, would_save, shared
+
+    @property
+    def changed(self) -> bool:
+        return self.staged != self.enabled
+
+    @property
+    def label(self) -> str:
+        return f"{self.harness}/{self.type}/{self.name}"
+
+    @property
+    def cost_cell(self) -> str:
+        return f"{self.tokens}" if self.enabled else f"({self.would_save})"
+
+
+# ------------------------------------------------------------- data gathering
+
+def collect(state: dict, harnesses: dict, warn=lambda m: None,
+            plugins: bool = True) -> list[Row]:
+    """Every togglable resource on this machine, live and parked, plugins included.
+
+    A dir shared by several harnesses is one row, filed under its owner, so staging
+    it cannot also be staged (and then fail) under the other harness.
+    """
+    rows = [Row(i.harness, i.type, i.name, i.enabled, i.tokens, i.would_save, i.shared_with)
+            for i in cost.inventory(state, harnesses, warn, plugins)]
+    rows.sort(key=lambda r: (r.harness, r.type, r.name))
+    return rows
+
+
+def match(rows: list[Row], query: str) -> list[Row]:
+    """Case-insensitive AND over whitespace-separated terms."""
+    terms = query.lower().split()
+    if not terms:
+        return rows
+    return [r for r in rows if all(t in r.label.lower() for t in terms)]
+
+
+def visible(rows: list[Row], query: str = "", harness: str = "all", type_: str = "all",
+            sort: str = "name") -> list[Row]:
+    """The rows on screen: filter chips, then the text query, then the sort."""
+    shown = [r for r in rows
+             if (harness == "all" or harness in (r.harness, *r.shared))
+             and (type_ == "all" or r.type == type_)]
+    shown = match(shown, query)
+    if sort == "cost":
+        shown = sorted(shown, key=lambda r: (-r.tokens, -r.would_save, r.harness, r.type, r.name))
+    return shown
+
+
+def cycle(options: tuple[str, ...] | list[str], current: str) -> str:
+    """The option after `current` (wraps; an unknown current restarts at the first)."""
+    return options[(options.index(current) + 1) % len(options)] if current in options \
+        else options[0]
+
+
+# -------------------------------------------------------------------- drawing
+
+# curses colour-pair ids; 0 is the terminal default.
+P_HARNESS, P_TYPE, P_LIVE, P_PARKED, P_PENDING = 1, 2, 3, 4, 5
+
+
+def state_pair(r: Row) -> int:
+    """Pair id for a row's state cell: staged change > ticked (live) > unticked (parked)."""
+    return P_PENDING if r.changed else P_LIVE if r.staged else P_PARKED
+
+
+def init_colors(color: bool) -> bool:
+    """Set up the pairs; True only when colours are wanted AND the terminal has them."""
+    if not color:
+        return False
+    try:
+        if not curses.has_colors():
+            return False
+        curses.start_color()
+        try:
+            curses.use_default_colors()
+            bg = -1
+        except curses.error:
+            bg = curses.COLOR_BLACK
+        for pid, fg in ((P_HARNESS, curses.COLOR_CYAN), (P_TYPE, curses.COLOR_BLUE),
+                        (P_LIVE, curses.COLOR_GREEN), (P_PARKED, curses.COLOR_YELLOW),
+                        (P_PENDING, curses.COLOR_MAGENTA)):
+            curses.init_pair(pid, fg, bg)
+    except curses.error:
+        return False
+    return True
+
+
+def draw(win, rows: list[Row], query: str, cur: int, top: int, pending: int,
+         chips: str = "", color: bool = False) -> None:
+    win.erase()
+    height, width = win.getmaxyx()
+    body = max(1, height - 3)
+
+    header = f" filter: {query}█" if query else " filter: (type to narrow, ? for keys)"
+    win.addnstr(0, 0, header.ljust(width - 1), width - 1, curses.A_BOLD)
+
+    for i in range(body):
+        idx = top + i
+        if idx >= len(rows):
+            break
+        r = rows[idx]
+        box = "[x]" if r.staged else "[ ]"
+        mark = "*" if r.changed else " "
+        also = f"  (+{','.join(r.shared)})" if r.shared else ""
+        parts = (f" {mark}{box} {r.cost_cell:>7}  ", f"{r.harness:<9}", f"{r.type:<8}",
+                 f"{r.name}{also}")
+        line = "".join(parts)
+        attr = curses.A_REVERSE if idx == cur else curses.A_NORMAL
+        if r.changed:
+            attr |= curses.A_BOLD
+        if not color:
+            win.addnstr(1 + i, 0, line.ljust(width - 1), width - 1, attr)
+        elif idx == cur:                # one reversed bar, tinted by state
+            win.addnstr(1 + i, 0, line.ljust(width - 1), width - 1,
+                        attr | curses.color_pair(state_pair(r)))
+        else:
+            x = 0
+            for n, (text, pid) in enumerate(zip(parts, (state_pair(r), P_HARNESS, P_TYPE, 0))):
+                if x >= width - 1:
+                    break
+                if n == len(parts) - 1:
+                    text = text.ljust(width - 1 - x)
+                win.addnstr(1 + i, x, text, width - 1 - x, attr | curses.color_pair(pid))
+                x += len(text)
+
+    count = f" {len(rows)} shown  |  ~{sum(r.tokens for r in rows)} tok  |  {chips}"
+    if pending:
+        count += f"  |  {pending} staged -- Enter to apply"
+    win.addnstr(height - 2, 0, count.ljust(width - 1), width - 1, curses.A_BOLD)
+    win.addnstr(height - 1, 0, " " + HELP.ljust(width - 2), width - 1, curses.A_DIM)
+    win.noutrefresh()
+    curses.doupdate()
+
+
+def show_help(win) -> None:
+    win.erase()
+    height, width = win.getmaxyx()
+    for y, text in enumerate(LONG_HELP[:height]):
+        win.addnstr(y, 0, text, width - 1)
+    win.refresh()
+    try:
+        win.get_wch()
+    except (curses.error, KeyboardInterrupt):
+        pass
+
+
+def loop(win, rows: list[Row], color: bool = False) -> list[Row] | None:
+    color = init_colors(color)
+    curses.curs_set(0)
+    win.keypad(True)
+    query, cur, top = "", 0, 0
+    typing = False                     # True after `/`: s/h/t/? are then letters, not commands
+    harness, type_, sort = "all", "all", "name"
+    harness_opts = ["all", *sorted({n for r in rows for n in (r.harness, *r.shared)})]
+    type_opts = ["all", *sorted({r.type for r in rows})]
+
+    while True:
+        shown = visible(rows, query, harness, type_, sort)
+        cur = max(0, min(cur, len(shown) - 1))
+        height = max(1, win.getmaxyx()[0] - 3)
+        top = max(0, min(top, max(0, len(shown) - height)))
+        if cur < top:
+            top = cur
+        elif cur >= top + height:
+            top = cur - height + 1
+
+        pending = sum(1 for r in rows if r.changed)
+        draw(win, shown, query, cur, top, pending,
+             f"harness:{harness} type:{type_} sort:{sort}", color)
+
+        try:
+            key = win.get_wch()
+        except (curses.error, KeyboardInterrupt):
+            return None
+
+        if key in ("\x1b", "\x03"):                       # Esc / Ctrl-C
+            return None
+        if key in ("\n", "\r", curses.KEY_ENTER):
+            return [r for r in rows if r.changed]
+        if key == "\t" and shown:
+            shown[cur].staged = not shown[cur].staged
+            cur += 1
+        elif key in (curses.KEY_UP, "\x10"):
+            cur -= 1
+        elif key in (curses.KEY_DOWN, "\x0e"):
+            cur += 1
+        elif key == curses.KEY_NPAGE:
+            cur += height
+        elif key == curses.KEY_PPAGE:
+            cur -= height
+        elif key in (curses.KEY_BACKSPACE, "\x7f", "\b"):
+            query = query[:-1]
+            typing = typing and bool(query)
+            cur = 0
+        elif key == "\x15":                               # Ctrl-U
+            query, typing, cur = "", False, 0
+        elif not (typing or query) and key in ("s", "h", "t", "?", "/"):
+            if key == "s":
+                sort = cycle(SORTS, sort)
+            elif key == "h":
+                harness = cycle(harness_opts, harness)
+            elif key == "t":
+                type_ = cycle(type_opts, type_)
+            elif key == "?":
+                show_help(win)
+            else:
+                typing = True
+            cur = 0
+        elif isinstance(key, str) and key.isprintable():
+            query += key
+            cur = 0
+        # KEY_RESIZE and anything else just redraw
+
+
+def pick(state: dict, harnesses: dict, plugins: bool = True, color: bool = False) -> list[Row] | None:
+    """`plugins=False` skips the `claude plugin list` call (a dry run never shells out)."""
+    notes: list[str] = []
+    rows = collect(state, harnesses, notes.append, plugins)
+    if not rows:
+        print("nothing to show")
+        return None
+    try:
+        return curses.wrapper(loop, rows, color)
+    finally:
+        for n in notes:                 # after curses is torn down, where they are readable
+            print(f"WARNING  {n}")

agent_toggle/undo.py

@@ -0,0 +1,133 @@
+"""`undo` (reverse the last logged batch) and `enable --all` (restore everything).
+
+Both build a plan of ops.Op and hand it to ops.apply_plan, the one apply path,
+so locking, state saving, refusal checks and logging are shared with disable/enable.
+"""
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+from . import fs, ops, store
+from .harnesses import TYPES, harnesses, project_view
+from .mechanisms import fail_row, validate_name
+from .output import CliError, Result, die
+
+REVERSE = {"disable": "enable", "enable": "disable"}
+
+
+def _log_rows() -> list[dict]:
+    p = fs.log_file()
+    if not p.is_file():
+        return []
+    rows = []
+    for line in p.read_text(encoding="utf-8", errors="replace").splitlines():
+        try:
+            row = json.loads(line)
+        except ValueError:
+            continue
+        if isinstance(row, dict):
+            rows.append(row)
+    return rows
+
+
+def _toggled(row: dict) -> bool:
+    return row.get("result") == "ok" and row.get("action") in REVERSE
+
+
+def _runnable(plan: list[ops.Op], table: dict, out: Result, dry_run: bool, batch: str) -> list[ops.Op]:
+    """Drop (as error rows) ops whose harness is unknown or whose home is gone.
+    Project ops pass through: ops.apply_plan validates the project dir itself."""
+    keep = []
+    for op in plan:
+        if op.project is not None:
+            keep.append(op)
+            continue
+        h = table.get(op.harness)
+        why = (f"unknown harness {op.harness!r}" if h is None
+               else f"{op.harness} is not installed ({h.home} does not exist)"
+               if not h.home.is_dir() else None)
+        if why:
+            fail_row(out, dry_run, op.harness, op.type, op.action, op.name, why, batch=batch)
+        else:
+            keep.append(op)
+    return keep
+
+
+def cmd_undo(dry_run: bool, harness: str | None, out: Result) -> None:
+    if harness:
+        die("undo reverses a whole batch; --harness does not apply", 2)
+    rows = _log_rows()
+    last = next((r for r in reversed(rows) if _toggled(r)), None)
+    if last is None:
+        out.say("nothing to undo")
+        return
+    target = last.get("batch")
+    if not target:
+        die("nothing to undo: log predates undo (its rows carry no batch id)")
+    if not isinstance(target, str):
+        die("nothing to undo: corrupt log row (batch is not a string)")
+    batch_rows = [r for r in rows if _toggled(r) and r.get("batch") == target]
+    if any(not isinstance(r.get("harness"), str) or not r["harness"] for r in batch_rows):
+        die("nothing to undo: log predates undo (a row of the last batch has no harness)")
+    for r in batch_rows:                   # the log is a file anyone can edit: validate like argv
+        try:
+            if r.get("type") not in TYPES or not isinstance(r.get("name"), str):
+                raise CliError("bad type or name")
+            validate_name(r["name"])
+            # Only scope=project is a --project change; it replays in THAT project
+            # (ops.apply_plan refuses $HOME, roots and dirs without .claude), never in
+            # user scope. Every other scope (user, claude mcp `local`) is user scope.
+            if r.get("scope") == "project" and not (
+                    isinstance(r.get("project"), str) and Path(r["project"]).is_absolute()):
+                raise CliError("bad project")
+        except CliError:
+            die(f"nothing to undo: corrupt log row for {r.get('type')!r} {r.get('name')!r}")
+    seen = {r.get("batch") for r in rows}
+    batch = store.BATCH
+    if batch in seen:                 # only when several runs share one process (tests)
+        batch = f"{batch}-{len(seen)}"
+    table, plan = harnesses(), []
+    out.say(f"undoing batch {target} ({len(batch_rows)} change(s))")
+    for r in reversed(batch_rows):
+        plan.append(ops.Op(r["harness"], r["type"], REVERSE[r["action"]], r["name"],
+                           r["project"] if r.get("scope") == "project" else None))
+    plan = _runnable(plan, table, out, dry_run, batch)
+    if plan:
+        ops.apply_plan(plan, out, dry_run, batch=batch, headers=True)
+
+
+def cmd_enable_all(harness: str | None, dry_run: bool, out: Result,
+                   project: str | None = None) -> None:
+    """Restore every state entry, user and project scope, each in its own scope
+    (optionally only one harness's, or with `project` only that project's)."""
+    table, plan, bad = harnesses(), [], []
+    if project is not None:
+        project = str(project_view(project).project)       # exit 4 like disable --project
+    want = store.project_digest(project) if project is not None else None
+    for key, entry in store.load_state(write_back=False)["disabled"].items():
+        try:
+            h, digest, type_, name = store.parse_key(key)
+            if project is not None and digest != want:
+                continue
+            pdir = entry.get("project") if digest and isinstance(entry, dict) else None
+            if digest and not (isinstance(pdir, str) and Path(pdir).is_absolute()):
+                raise ValueError("project-scope entry without an absolute project dir")
+            if type_ not in TYPES:
+                raise ValueError(f"unknown type {type_!r}")
+            validate_name(name)
+        except (ValueError, CliError) as e:
+            bad.append((key, str(getattr(e, "msg", e))))
+            continue
+        shared = entry.get("shared_with") if isinstance(entry, dict) else None
+        if harness and harness != h and harness not in (shared if isinstance(shared, list) else ()):
+            continue
+        plan.append(ops.Op(h, type_, "enable", name, pdir))
+    for key, why in bad:
+        out.row(None, None, key, "enable", "error", f"unusable state key: {why}")
+    plan = _runnable(plan, table, out, dry_run, store.BATCH)
+    if not plan and not bad:
+        out.say("nothing disabled")
+        return
+    if plan:
+        ops.apply_plan(plan, out, dry_run, batch=store.BATCH, headers=True)