fix(cli): preserve global install ownership and recovery

Keep successful native plugin selections recoverable, protect unowned files, and complete global cleanup without removing other marketplace sources. Restore managed OpenCode reload compatibility.

Refs: #1142

Author: blafourcade

cli/README.md

@@ -126,11 +126,15 @@ Counts the tokens of Claude Code and Codex sessions, locally. Details: [FAQ](../
 | `opencode`, `kilo` | Copies the plugins' skills and agents into `~/.config/opencode/` or `~/.config/kilo/` |
 | `cursor` | Copies the plugins into `~/.cursor/plugins/local/`; Cursor must allow local plugin imports |
 
+Files without recorded AIDD ownership are refused even when their content matches. This includes
+copies from an older `make reload`, or files left by an interrupted install before ownership was
+saved. Move the named files aside, then rerun the original setup or reload command.
+
 Copilot needs a CLI whose `plugin marketplace list` accepts `--json` (verified with 1.0.98; 1.0.83 refuses it).
 
 Native activation needs the tool's executable on `PATH`.
 Without it, registration succeeds with a warning and activation stays unrun.
-Install it, then run `aidd sync --global`.
+Install it, then rerun the original `aidd setup --global` command with its `--ide` and `--plugins` selections.
 
 ```sh
 aidd setup --global --ide claude,codex,copilot,cursor,kilo,opencode --plugins all --yes

cli/src/contexts/framework/application/clean-use-case.ts

@@ -272,7 +272,8 @@ export class CleanUseCase {
           this.hostPluginRegistries.get(toolId),
           registration.hostName,
           new Set([...registrations.pluginRefs, ...machineRefs]),
-          projectRoot
+          projectRoot,
+          toolId
         );
       }
     }
@@ -604,7 +605,8 @@ export class CleanUseCase {
         reader,
         sourceRegistration.hostName,
         new Set([...registrations.pluginRefs, ...machineRefs]),
-        projectRoot
+        projectRoot,
+        toolId
       );
     } catch (error) {
       this.logger.warn(`${binary}: '${ref}' left enabled; ${String(error)}`);

cli/src/contexts/framework/application/clean/clean-user-scope-use-case.ts

@@ -327,7 +327,8 @@ export class CleanUserScopeUseCase {
           this.hostPluginRegistries.get(toolId),
           registration.hostName,
           owned,
-          projectRoot
+          projectRoot,
+          toolId
         );
         for (const ref of refsByHost.get(registration.hostName) ?? []) {
           if (hostRefs.get(ref)?.enabled !== true)
@@ -419,6 +420,15 @@ export class CleanUserScopeUseCase {
     await this.purgeWhitelistedPath("cache/built", "cache/built", (candidate) =>
       this.fs.deleteDirectory(candidate)
     );
+    // Other user marketplaces keep their registered sources. Plugin fetches belong to the
+    // machine manifest being removed, whose active dependents were checked before any purge.
+    const frameworkSource = `cache/marketplaces/${FRAMEWORK_MARKETPLACE_NAME}`;
+    for (const path of [frameworkSource, "cache/plugin-cache"]) {
+      await this.purgeWhitelistedPath(path, path, (candidate) =>
+        this.fs.deleteDirectory(candidate)
+      );
+    }
+    await this.purgeEmptyCacheShell("cache/marketplaces");
     // The self-update check cache, written into the same `cache/` directory by any online
     // command: left behind it keeps the shell below non-empty, the one occupant that made
     // "leaves nothing of aidd's on the machine" false in the ordinary case.
@@ -444,17 +454,15 @@ export class CleanUserScopeUseCase {
     await this.userManifestRepo.delete();
   }
 
-  /** `cache/built/` and `cache/update-check.json` are this whitelist's only occupants of
-   * `userConfigDir()/cache/`. The shell around them is removed only once proven empty, under the
-   * same containment as every other candidate — never assumed from having just purged its only
-   * children, since a future writer under `cache/` would make that assumption stale silently. */
-  private async purgeEmptyCacheShell(): Promise<void> {
+  /** Remove a cache directory only once proven empty, with the same containment as every
+   * whitelist candidate: another marketplace or a future cache writer may still use it. */
+  private async purgeEmptyCacheShell(path = "cache"): Promise<void> {
     const candidate = await resolveCacheCandidate(
       this.fs,
       this.logger,
       this.userConfigDir(),
-      "cache",
-      "user scope: cache"
+      path,
+      `user scope: ${path}`
     );
     if (candidate === null) return;
     let entries: string[];
@@ -466,7 +474,7 @@ export class CleanUserScopeUseCase {
     }
     if (entries.length > 0) return;
     await this.fs.deleteDirectory(candidate);
-    this.logger.info(`user scope: cache purged: ${candidate}`);
+    this.logger.info(`user scope: ${path} purged: ${candidate}`);
   }
 
   /** Never `userConfigDir()` itself, and never on a manifest's word: every fixed whitelist entry

cli/src/contexts/framework/application/flows/marketplace-sync-settings-use-case.ts

@@ -630,7 +630,7 @@ export class MarketplaceSyncSettingsUseCase implements MarketplaceSyncSettings {
       toolId,
       [
         ...new Set([
-          ...this.pluginRefsToEnable(toolId, manifest, marketplaces, hostNameByAlias),
+          ...this.pluginRefsToEnable(toolId, manifest, marketplaces, hostNameByAlias, scope),
           ...requested,
         ]),
       ],
@@ -782,7 +782,8 @@ export class MarketplaceSyncSettingsUseCase implements MarketplaceSyncSettings {
     toolId: ToolId,
     manifest: Manifest,
     marketplaces: readonly Marketplace[],
-    hostNameByAlias: ReadonlyMap<string, string>
+    hostNameByAlias: ReadonlyMap<string, string>,
+    scope: MarketplaceScope
   ): string[] {
     const byName = new Map(marketplaces.map((m) => [m.name, m]));
     const refs: string[] = [];
@@ -793,6 +794,18 @@ export class MarketplaceSyncSettingsUseCase implements MarketplaceSyncSettings {
       if (hostName === undefined) continue;
       refs.push(`${plugin.name}@${hostName}`);
     }
+    // Native-only global installs record successful activations, not copied plugin files.
+    // Claims also recover a selection an older sync dropped from its projection.
+    if (scope === "user") {
+      const native = manifest.getNativeRegistrations(toolId);
+      const provenHosts = [...hostNameByAlias.values()];
+      for (const ref of [
+        ...(native?.pluginRefs ?? []),
+        ...(native?.pluginClaims ?? []).map((claim) => claim.ref),
+      ]) {
+        if (provenHosts.some((hostName) => ref.endsWith(`@${hostName}`))) refs.push(ref);
+      }
+    }
     return refs;
   }
 

cli/src/contexts/framework/application/ownership/global-plugin-files.ts

@@ -45,8 +45,8 @@ export async function readGlobalPluginFiles(
 /**
  * Refuses a machine-scope write before any byte lands: every path must stay a normalized relative
  * path, its nearest existing parent must resolve strictly inside the tool's user directory, and a
- * file already there that this plugin does not own is never overwritten unless it already holds
- * the same bytes. Creates the user directory itself when the host has not yet.
+ * file already there that this plugin does not own is never overwritten. Creates the user
+ * directory itself when the host has not yet.
  */
 export async function assertGlobalFilesWritable(
   fs: FileReader & FileWriter,
@@ -80,7 +80,6 @@ export async function assertGlobalFilesWritable(
     if (plugin?.files.has(rel) === true) continue;
     const target = join(boundary, rel);
     if (!(await fs.fileExists(target))) continue;
-    if ((await fs.readFileHash(target)).value === file.hash.value) continue;
     throw new Error(
       `${toolId}: '${target}' already exists and was not installed by aidd; move or delete it, then rerun.`
     );

cli/src/contexts/framework/application/ownership/native-host-registration-gate.ts

@@ -95,7 +95,8 @@ export class NativeHostRegistrationGate {
       reader,
       registration.hostName,
       owned,
-      projectRoot
+      projectRoot,
+      toolId
     );
     const refs = (registrations.pluginClaims ?? []).filter((claim) =>
       claim.ref.endsWith(`@${registration.hostName}`)

cli/src/contexts/framework/application/ownership/native-marketplace-source-proof.ts

@@ -1,3 +1,4 @@
+import type { ToolId } from "../../../../kernel/tool.js";
 import type {
   HostPluginRegistryEntry,
   HostPluginRegistryReader,
@@ -8,6 +9,7 @@ import type {
   NativeMarketplaceSourceReader,
   NativeMarketplaceSourceReading,
 } from "../../../tools/domain/ports/native-marketplace-source-reader.js";
+import { hostRefInUse } from "../../../tools/domain/registry.js";
 import type { NativeMarketplaceRegistration } from "../../domain/manifest/native-registrations.js";
 
 export interface NativeMarketplaceSourceInspection {
@@ -80,7 +82,8 @@ export async function assertNoForeignNativeRefs(
   reader: HostPluginRegistryReader | undefined,
   hostName: string,
   ownedRefs: ReadonlySet<string>,
-  projectRoot: string
+  projectRoot: string,
+  toolId: ToolId
 ): Promise<ReadonlyMap<string, HostPluginRegistryEntry>> {
   if (reader === undefined)
     throw new Error(
@@ -99,9 +102,10 @@ export async function assertNoForeignNativeRefs(
       `Catalogue '${hostName}': host plugin registry unreadable (${reading.unreadable ?? reading.location}); no host mutation made.`
     );
   const refs = reading.refs ?? new Map<string, HostPluginRegistryEntry>();
-  const foreign = [...refs.keys()].find(
-    (ref) => ref.endsWith(`@${hostName}`) && !ownedRefs.has(ref)
-  );
+  const foreign = [...refs].find(
+    ([ref, entry]) =>
+      hostRefInUse(toolId, entry.enabled) && ref.endsWith(`@${hostName}`) && !ownedRefs.has(ref)
+  )?.[0];
   if (foreign !== undefined)
     throw new Error(
       `Catalogue '${hostName}' includes foreign host ref '${foreign}'; no host mutation made.`

cli/src/contexts/framework/application/ownership/user-plugin-file-updater.ts

@@ -160,11 +160,9 @@ export class UserPluginFileUpdater {
       if (plugin.files.has(file.relativePath)) continue;
       const target = join(baseDir, file.relativePath);
       if (!(await this.fs.fileExists(target))) continue;
-      if ((await this.fs.readFileHash(target)).value !== file.hash.value) {
-        throw new Error(
-          `${toolId}: '${plugin.name}' has untracked existing file '${file.relativePath}'; update refused without overwriting user content or changing its machine claim.`
-        );
-      }
+      throw new Error(
+        `${toolId}: '${plugin.name}' has untracked existing file '${file.relativePath}'; update refused without overwriting user content or changing its machine claim.`
+      );
     }
   }