fix(install): retain the marketplace on unproven dependents and inventory receipts without a host probe

Codex review on #452:
- uninstall: a same-id Claude row at another scope is a marketplace dependent
  (marketplace remove applies to every scope); a failed dependency re-read of
  plugin list --json is 'unknown' and retains the marketplace instead of
  reading as an empty inventory.
- doctor: the receipt store is inventoried from disk even when the host
  executable cannot be probed; the host cross-check alone decides
  consistent/orphaned, otherwise unknown.

Author: ScriptedAlchemy

docs/diagnostics.md

@@ -821,8 +821,11 @@ open issue). Every mutation is opt-in and bounded by the receipt:
   fails closed, `AB7004`), compares the cached copy with the receipt, runs
   `claude plugin uninstall <id> --scope <scope> --keep-data` /
   `codex plugin remove <id>`, then `plugin marketplace remove <marketplace>`
-  unless another installed plugin still names that marketplace (`retained`),
-  and removes the store receipt. A registration the host no longer holds is
+  and removes the store receipt. Because `plugin marketplace remove` applies
+  to every scope, the marketplace is `retained` when another installed plugin
+  still names it, when the same plugin is installed at another Claude scope,
+  or when the dependency re-read of `plugin list --json` fails (a failed read
+  is not proof that nothing depends on it). A registration the host no longer holds is
   `already-absent`, so a receipt orphaned behind Agent Bundle's back is
   consumed without running any host verb.
 

packages/agent-bundle/src/install/doctor.ts

@@ -2215,19 +2215,19 @@ const doctorHost = async (
       ? { diagnostics: Object.freeze([]), inventory: freezeInventory('skipped') }
       : publicHostInventory(host, listing, environment, home);
   const diagnostics = [...probed.diagnostics, ...inventoried.diagnostics];
-  // Store receipts are lifecycle evidence Agent Bundle itself wrote; each is cross-checked against the
-  // host so an orphaned receipt (registration gone) is diagnosed instead of silently trusted.
-  const receipts = probed.probe.status !== 'available'
-    ? { diagnostics: Object.freeze([]), receipts: Object.freeze([]) }
-    : host === 'cursor'
-      ? await inspectStoreReceipts(host, join(home, '.cursor'), async (receipt) => receipt.mode === 'marketplace'
-        ? (await exists(join(cursorMarketplaceRoot(join(home, '.cursor')), receipt.plugin)) ? 'consistent' : 'orphaned')
-        : 'unknown')
-      : await inspectStoreReceipts(
-        host,
-        publicHostRoot(host, environment, home),
-        async (receipt) => receiptRegistrationState(host, receipt, listing),
-      );
+  // Store receipts are lifecycle evidence Agent Bundle itself wrote, so the store is inventoried from
+  // the filesystem whether or not the host can be probed: malformed and migrated receipts are always
+  // reported. The host cross-check that separates `consistent` from `orphaned` needs the host's
+  // inventory; without it the registration state is `unknown`, never guessed.
+  const receipts = host === 'cursor'
+    ? await inspectStoreReceipts(host, join(home, '.cursor'), async (receipt) => receipt.mode === 'marketplace'
+      ? (await exists(join(cursorMarketplaceRoot(join(home, '.cursor')), receipt.plugin)) ? 'consistent' : 'orphaned')
+      : 'unknown')
+    : await inspectStoreReceipts(
+      host,
+      publicHostRoot(host, environment, home),
+      async (receipt) => receiptRegistrationState(host, receipt, listing),
+    );
   diagnostics.push(...receipts.diagnostics);
   let bundle: DoctorHostReport['bundle'];
   if (options.from !== undefined) {

packages/agent-bundle/src/install/uninstall.ts

@@ -716,32 +716,45 @@ const marketplaceRegistered = async (
     : 'absent';
 };
 
-/** Installed rows for other plugins from the same marketplace: the marketplace registration then stays. */
-const otherPluginsFromMarketplace = async (
+/**
+ * Installed rows that still depend on the marketplace once the `id`@`scope` copy
+ * is gone: other plugins from the same marketplace, plus (Claude) the same plugin
+ * installed at another scope, because `plugin marketplace remove` unregisters the
+ * marketplace for every scope. A second `plugin list --json` that cannot be read
+ * is `'unknown'`, never an empty list: a failed read is not proof that nothing
+ * depends on the marketplace, so the caller retains it (fail-closed).
+ */
+const marketplaceDependents = async (
   runner: InstallCommandRunner,
   identity: PluginIdentity,
   host: Exclude<InstallHost, 'cursor'>,
   marketplace: string,
   id: string,
-): Promise<readonly string[]> => {
+  scope: InstallScope,
+): Promise<readonly string[] | 'unknown'> => {
   try {
     const result = await runner.run(host, ['plugin', 'list', '--json'], { cwd: identity.bundleRoot });
-    if (result.code !== 0) return [];
+    if (result.code !== 0) return 'unknown';
     const document = JSON.parse(result.stdout) as unknown;
     const rows = host === 'claude'
       ? document
       : typeof document === 'object' && document !== null ? (document as { readonly installed?: unknown }).installed : undefined;
-    if (!Array.isArray(rows)) return [];
-    const ids: string[] = [];
+    if (!Array.isArray(rows)) return 'unknown';
+    const dependents: string[] = [];
     for (const row of rows) {
       if (typeof row !== 'object' || row === null) continue;
-      const candidate = (row as { readonly id?: unknown; readonly pluginId?: unknown });
+      const candidate = (row as { readonly id?: unknown; readonly pluginId?: unknown; readonly scope?: unknown });
       const rowId = host === 'claude' ? candidate.id : candidate.pluginId;
-      if (typeof rowId === 'string' && rowId !== id && rowId.endsWith(`@${marketplace}`)) ids.push(rowId);
+      if (typeof rowId !== 'string' || !rowId.endsWith(`@${marketplace}`)) continue;
+      if (rowId !== id) {
+        dependents.push(rowId);
+      } else if (host === 'claude' && typeof candidate.scope === 'string' && candidate.scope !== scope) {
+        dependents.push(`${rowId} (scope ${candidate.scope})`);
+      }
     }
-    return ids;
+    return dependents;
   } catch {
-    return [];
+    return 'unknown';
   }
 };
 
@@ -896,7 +909,10 @@ const uninstallPublicCli = async (
   const marketplaceState = marketplaceRegistration === undefined
     ? 'absent'
     : await marketplaceRegistered(runner, identity, host, marketplace);
-  const sharedBy = marketplaceState === 'absent' ? [] : await otherPluginsFromMarketplace(runner, identity, host, marketplace, id);
+  const dependents = marketplaceState === 'absent'
+    ? []
+    : await marketplaceDependents(runner, identity, host, marketplace, id, scope);
+  const retainMarketplace = dependents === 'unknown' || dependents.length > 0;
   const planned = options.plan === true;
   const data = await publicHostData(host, policy, entry, hostRoot, id);
   const registrations: UninstallRegistrationReport[] = [];
@@ -914,12 +930,16 @@ const uninstallPublicCli = async (
       ...marketplaceRegistration,
       action: marketplaceState === 'absent'
         ? 'already-absent'
-        : sharedBy.length > 0 ? 'retained' : planned ? 'planned' : 'removed',
+        : retainMarketplace ? 'retained' : planned ? 'planned' : 'removed',
       detail: marketplaceState === 'absent'
         ? `${host} no longer lists marketplace ${marketplace}.`
-        : sharedBy.length > 0
-          ? `Marketplace ${marketplace} stays registered: ${sharedBy.join(', ')} still install from it.`
-          : `\`${host} ${publicHostMarketplaceRemoveArguments(marketplace).join(' ')}\``,
+        : dependents === 'unknown'
+          ? `Marketplace ${marketplace} stays registered: \`${host} plugin list --json\` could not be re-read to prove ` +
+            'nothing else installs from it, and `plugin marketplace remove` applies to every scope. Remove it by hand once ' +
+            'the inventory is readable.'
+          : dependents.length > 0
+            ? `Marketplace ${marketplace} stays registered: ${dependents.join(', ')} still install from it.`
+            : `\`${host} ${publicHostMarketplaceRemoveArguments(marketplace).join(' ')}\``,
     }));
   }
   const files = receipt === undefined && !await exists(receiptPath) ? [] : [receiptPath];
@@ -944,7 +964,7 @@ const uninstallPublicCli = async (
   if (entry !== undefined) {
     await runHostCommand(runner, identity, host, publicHostUninstallArguments(host, id, scope), 'removal');
   }
-  if (marketplaceRegistration !== undefined && marketplaceState !== 'absent' && sharedBy.length === 0) {
+  if (marketplaceRegistration !== undefined && marketplaceState !== 'absent' && !retainMarketplace) {
     await runHostCommand(runner, identity, host, publicHostMarketplaceRemoveArguments(marketplace), 'removal');
   }
   const purged: string[] = [];

packages/agent-bundle/tests/doctor.test.ts

@@ -1520,6 +1520,20 @@ it('inventories store receipts, diagnoses orphaned ones (AB7326), and reports pr
     await writeFile(join(claudeConfig, 'agent-bundle', 'receipts', 'broken.user.json'), '{"format":"nope"}\n');
     const broken = hostReport(await doctor(), 'claude');
     expect(broken.diagnostics.filter((entry) => entry.code === 'AB7326').some((entry) => entry.message.includes('not a valid install receipt'))).toBe(true);
+
+    // The host executable cannot be probed at all: the store is still inventoried from disk, so the
+    // stored receipt (state unknown) and the malformed file are reported instead of hidden.
+    const absentHost: DoctorCommandRunner = async () => commandResult({ exitCode: 127, stderr: 'claude: command not found' });
+    const unprobed = hostReport(await runDoctor({
+      commandRunner: absentHost,
+      endpointDirectory: fixture.endpointDirectory,
+      environment: { CLAUDE_CONFIG_DIR: claudeConfig },
+      home: fixture.home,
+      hosts: ['claude'],
+    }), 'claude');
+    expect(unprobed.probe.status).not.toBe('available');
+    expect(unprobed.receipts).toEqual([expect.objectContaining({ path: result.receipt, state: 'unknown' })]);
+    expect(unprobed.diagnostics.filter((entry) => entry.code === 'AB7326').some((entry) => entry.message.includes('not a valid install receipt'))).toBe(true);
     await rm(join(claudeConfig, 'agent-bundle', 'receipts', 'broken.user.json'));
 
     // A Cursor local copy whose receipt predates format/2 is diagnosed as migrated, never rewritten by Doctor.

packages/agent-bundle/tests/uninstall.test.ts

@@ -565,6 +565,61 @@ it.each([
     expect(shared.calls.map((call) => call.args.join(' '))).toContain(uninstall);
     installed = false;
 
+    // The dependency re-read fails after the first inventory succeeded: a failed read is not proof that
+    // nothing depends on the marketplace, so the marketplace is retained (fail-closed), never removed.
+    await installBundle(options);
+    let listCalls = 0;
+    const flaky: { readonly calls: CommandCall[]; readonly runner: InstallCommandRunner } = { calls: [], runner: {
+      run: async (command, args) => {
+        const call = { args: [...args], command };
+        flaky.calls.push(call);
+        const verb = args.join(' ');
+        if (verb === 'plugin list --json') {
+          listCalls += 1;
+          return listCalls === 1
+            ? { code: 0, stderr: '', stdout: listing(true, installPath) }
+            : { code: 1, stderr: 'transient failure', stdout: '' };
+        }
+        if (verb === 'plugin marketplace list --json') return { code: 0, stderr: '', stdout: marketplaces(true) };
+        return { code: 0, stderr: '', stdout: '' };
+      },
+    } };
+    const unproven = await uninstallBundle({ ...options, commandRunner: flaky.runner });
+    expect(unproven).toMatchObject({
+      registrations: [
+        { action: 'removed', kind: `${host}-plugin` },
+        { action: 'retained', detail: expect.stringContaining('could not be re-read'), kind: `${host}-marketplace` },
+      ],
+      state: 'uninstalled',
+    });
+    expect(flaky.calls.map((call) => call.args.join(' '))).not.toContain(removeMarketplace);
+    installed = false;
+
+    if (host === 'claude') {
+      // The same plugin installed at another Claude scope still depends on the marketplace, and
+      // `plugin marketplace remove` applies to every scope: the marketplace is retained.
+      await installBundle(options);
+      const scoped = recordingRunner((call) => {
+        const verb = call.args.join(' ');
+        if (verb === 'plugin list --json') {
+          return claudeListing([
+            { enabled: true, id: 'uninstall-fixture@uninstall-fixture-marketplace', installPath, scope: 'user', version: '1.2.3' },
+            { enabled: true, id: 'uninstall-fixture@uninstall-fixture-marketplace', installPath, scope: 'project', version: '1.2.3' },
+          ]);
+        }
+        if (verb === 'plugin marketplace list --json') return marketplaces(true);
+        return '';
+      });
+      const otherScope = await uninstallBundle({ ...options, commandRunner: scoped.runner });
+      expect(otherScope.registrations.find((registration) => registration.kind === 'claude-marketplace')).toMatchObject({
+        action: 'retained',
+        detail: expect.stringContaining('uninstall-fixture@uninstall-fixture-marketplace (scope project)'),
+      });
+      expect(scoped.calls.map((call) => call.args.join(' '))).toContain(uninstall);
+      expect(scoped.calls.map((call) => call.args.join(' '))).not.toContain(removeMarketplace);
+      installed = false;
+    }
+
     // An orphaned receipt (host already forgot the plugin) is consumed without any host verb.
     await installBundle(options);
     installed = false;