[nt-nerdtechnic]

Summary

Live activation L1: approving the install of a plugin that is not installed yet makes it take effect immediately. There is no Restart button to find and no relaunch (ANALYSIS-plugin-live-activation, approved by the user 2026-10-20 23:46).

Stacked on #505 (fix/sideload-relaunch-promote, head ed5808b). L1 reuses the restartStagedCandidate extraction from #505. Once #505 merges, this branch merges main normally (no rebase), and the diff shrinks to the L1 commit c5030ae.

What changed (commit c5030ae)

• plugins:commitInstall and plugins:commitLocalInstall: after the commit, outside its transaction lock, a first install is promoted through the same restartStagedCandidate cutover Restart runs. A first install here means a candidate with no active package, no activation in progress and nothing loaded under the id. A factory package or an update is left untouched.
• The cutover is unchanged:
  • trust and digest re-verification at the cutover seam
  • the version-bound grant from this approval
  • the backend activation, handed to the Host's admission gate
• Nothing runs under the id yet, so nothing is drained. A native backend still asks for its own consent before it starts.
• The answer is either restartRequired: false, activatedVersion, or, when activation fails, restartRequired: true, activationError. On failure the candidate stays staged with Restart and Discard, and the install flow shows the reason (settings.extensions.activationFailed, en-US/zh-TW/ja-JP).
• plugins:restart on a plugin that is already active with nothing staged returns success with nothing to do, so a flow that still calls Restart after the commit keeps working.
• fix(plugins): activate a first install staged without Restart on the next launch #505's launch-time rule shares the new isStagedFirstInstall check.

Disclosure

• On a first install there is no earlier view, so no transient state can be lost.
• What changed is shown in place: the installed list shows the active version straight away instead of "Update vX is ready".
• An activation failure is disclosed with its reason, and the package stays staged.
• One-click undo of a first install is Remove, as before.
• The switch record with "退回 vA" belongs to updates and comes in L3.
• Consent rules do not loosen:
  • nothing is written before approval (the rejected-commit assertions stay as they were)
  • the approval itself writes the grant and activates the package
  • the native backend keeps its own separate consent

Test plan (red → green)

Red against #505's pluginIpc.ts, pnpm vitest run src/main/plugins/pluginIpc.localInstall.test.ts -t "L1" --maxWorkers 1: 2 failed, 1 passed.

• is active right after the commit, with no Restart and no relaunch
• stays staged with Restart and Discard, and says why, when the activation fails
• (guard, already green) leaves an update from a file for Restart

Green: all three pass.

Assertions that encoded the old "commit only stages" contract were updated (10 tests):

• the grant and installedAt are now written on approval instead of on Restart
• the commit result shape
• the TOCTOU test now reads the active copy instead of the staged one

The installLocal helper calls Restart only while something is staged. The relaunch tests from #505 leave a first install staged by failing its activation once ("the App went away").

Local run before the coordinator paused local tests:

• pnpm vitest run pluginIpc.localInstall pluginIpc pluginIpc.localInstall.review pluginIpc.agentFileInstall pluginIpc.developerMode pluginIpc.testplace pluginIpc.digestBlock navideBrowserRegistryInstall pluginRegistry.e2e pluginAgentAction --maxWorkers 2: 10 files, 331 passed, 12 skipped
• pnpm typecheck: exit 0
• After that the host load reached 268, so per the coordinator nothing else ran locally. CI is the check from here.

Review fixes (planb/0228/review-live-activation.md)

• H2 (CI red, classified, not rerun): pluginRegistry.e2e (3) still asserted the pre-L1 contract. It now checks that the approved commit activates 0.1.0 with its grant, and that a following Restart has nothing to do. Local run with the Registry venv: 13/13 pass. Commit 2b0d415.

Protection check

• Credential / account switching / quota paths: git diff origin/main -- 'backend/agent_team_backend/credential_*.py' 'backend/agent_team_backend/quota_*.py' 'backend/agent_team_backend/usage_*.py' src/renderer/src/composables/useQuotaFailover.ts | wc -l gives 0.
• No function deleted: a definition list diff of pluginIpc.ts, preload/index.ts and usePluginInstallFlow.ts shows nothing removed.
• Signature changes: the commitInstall / commitLocalInstall result type widens from restartRequired: true to restartRequired: boolean plus optional activatedVersion and activationError (preload and env.d.ts). No caller reads restartRequired. plugins:restart gains the already-active, nothing-to-do answer.
• No limits added.

🤖 Generated with Claude Code

[nt-nerdtechnic]

Squash-merged into main as 2e22e4a.