[nt-nerdtechnic]

Summary

A plugin installed (from a file or the Marketplace) is staged as a candidate and only plugins:restart promoted it. If the user reopened Navide without pressing Restart, the plugin never loaded, the log said installed plugin quarantined: … manifest.json is not valid UTF-8: ENOENT, and nothing appeared on screen (packaged checklist 0.2.27, finding 2). This PR activates such a first install at launch exactly as Restart would, makes the log accurate, and shows a main-window notice for any candidate that still needs the user.

Why

Developer experience: the sideload → edit → reinstall loop must work without a hidden extra step. A relaunch has nothing running, so promoting the staged first install is the same cutover Restart performs, with the same checks (trust re-verification, digest identity, version-bound grant from install-time consent).

What changed

• pluginIpc.ts: the plugins:restart body is now restartStagedCandidate(id) (header and footer only; the body is unchanged). The handler keeps assertAuthorized + assertPluginRemovalTarget and calls it. New controller method activateStagedFirstInstalls() promotes each candidate with no active package, no activation in progress and nothing loaded under its id, and returns those it could not promote (they stay staged).
• Not auto-promoted on purpose: an update next to an active package, and a package a rollback displaced (activatePrevious / completeRollback / demoteActiveToCandidate keep it as the candidate). The selector does not tell these apart, so the user still decides with Restart, as on main.
• installedPlugins.ts scanInstalledPlugins: a staged first install (candidate, no active, no manifest.json at the root) is skipped instead of being reported as a broken package. A legacy package at the root still loads as before.
• index.ts: runs activateStagedFirstInstalls() at startup, next to loadDeveloperFolders(). Each failure is logged with its real reason and sent through the new pluginStagedCandidateRelay (same hold-until-loaded pattern as pluginAgentActionRelay).
• Preload onPluginStagedCandidateNotActivated, App.vue error toast, and the label.plugin-staged-not-activated string in en-US, zh-TW and ja-JP. The toast names the plugin, the version, the reason, and Settings → Navide Plugins, where Restart and Discard are.

Second commit: disclose a staged package beside the active one (coordinator request)

• On purpose, a package staged next to an active one is still not applied automatically: an update installed without Restart, and the package a rollback displaced, look the same in the selector. Now it is disclosed instead.
• pluginIpc.ts stagedUpdates() lists {pluginId, activeVersion, stagedVersion} for every record that has an active package, a candidate and no activation in progress. index.ts sends the list to the main window after the first-install activation, through the same relay (plugins:stagedUpdates).
• The main window adds one row per package to the announcements centre: "The Navide plugin X has version Y waiting to be applied; version Z is running." It has an Apply now button and also shows a toast.
• The row stays until the package is applied. Marking it read does not dismiss it.
• Apply now runs plugins:restart for that package, only while the same version is still staged next to the same active one (pluginStagedApplyApplies). Otherwise the row is dropped with a "changed since" notice.
• Strings are in en-US, zh-TW and ja-JP.
• Three relaunch cases are tested:
  • first install: promoted
  • update from a file: stays staged and is listed
  • Registry rollback: the rollback stands, the selector is unchanged, and the package is listed

Regression check vs 0.2.26

Not a regression. git diff v0.2.26..origin/main touches nothing on the scanner or promote path (installedPlugins.ts unchanged; the selector only gained web in grant validation). The root fallback in scanInstalledPlugins dates from 088b4ca (#133, 2026-09-26). No App was launched.

Test plan (red → green)

Red on origin/main, 4/4 (pnpm vitest run src/main/plugins/pluginIpc.localInstall.test.ts -t "on the next launch" --maxWorkers 1):

• is not reported as a broken package by the startup scan: the scan returned the ENOENT error entry
• is activated exactly as Restart would have done it: no such method (active, grant, local-unsigned source and the next launch's scan are all checked)
• leaves an update staged next to the active package for the user to restart
• reports a candidate that can no longer be activated and keeps it staged: a tampered candidate is reported as quarantined and stays staged

Green: all 4.

Also: src/main/pluginStagedCandidateRelay.test.ts (2) and src/renderer/src/composables/__tests__/pluginStagedCandidateNotice.test.ts (2: text in all three locales, and wiring main → relay → preload → App.vue).

Regression: existing plugins

• pnpm vitest run pluginIpc.localInstall pluginIpc.localInstall.review pluginIpc.agentFileInstall installedPlugins pluginStagedCandidateRelay pluginStagedCandidateNotice plansBackendStoppedNotice pluginAgentActionRelay --maxWorkers 2: 8 files, 249 passed
• pnpm vitest run pluginIpc pluginIpc.developerMode pluginIpc.testplace pluginIpc.digestBlock navideBrowserRegistryInstall --maxWorkers 2 (every suite that drives plugins:restart): 5 files, 230 passed
• pnpm typecheck: exit 0 (node, integration, public packages, built-in plugins, web, public), on both commits
• Second commit: pnpm vitest run pluginIpc.localInstall pluginIpc pluginStagedCandidateRelay pluginStagedCandidateNotice useAnnouncements AnnouncementsPanel --maxWorkers 2 gives 6 files, 243 passed
• No local full suites (0.2.28 dispatch rule); CI runs the full suites.

Protection check

• Credential / account switching / quota paths: git diff origin/main -- 'backend/agent_team_backend/credential_*.py' 'backend/agent_team_backend/quota_*.py' 'backend/agent_team_backend/usage_*.py' | wc -l gives 0. No backend file is touched.
• No function deleted: a definition list diff (function|const|let names, origin/main vs branch) of pluginIpc.ts, index.ts, installedPlugins.ts, preload/index.ts and App.vue shows nothing removed. App.vue's NUL byte is preserved.
• Signature changes: none to existing exports. Added: PluginTrustRefreshController.activateStagedFirstInstalls() and stagedUpdates(), the preload onPluginStagedCandidateNotActivated and onPluginStagedUpdates, the announcement kind plugin-staged and the action plugin-staged-apply.
• Consent and security: nothing gets looser. Promotion runs the same Restart code: trust re-verification, artifact digest identity, and the grant bound to the candidate at install time. A candidate that fails a check stays staged and is disclosed.
• No limits added or removed.

🤖 Generated with Claude Code

[nt-nerdtechnic]

Squash-merged into main as 8f51ac0.