@graphit/cli 0.2.365 → 0.2.371

package/dist/update-check.d.ts

@@ -9,6 +9,18 @@ type InstallContext = "npx" | "global" | "local";
  */
 export declare function classifyInstallContext(selfPath: string, cwd: string): InstallContext;
 export declare function getCurrentVersion(): string;
+/**
+ * Issue #994: the remedy for a stale CLI depends on who launched it. The Claude
+ * Code plugin's wrapper exports GRAPHIT_PLUGIN_ROOT and resolves npm latest once
+ * per session, so a newer release arrives in the next session on its own - and
+ * `npm install -g` there would create a global that shadows the wrapper on PATH.
+ * A pinned `npx -y @graphit/cli@<version>` (Codex, Cursor, CI) is also npx, but a
+ * new session reruns the same pin, so it keeps the pre-existing guidance.
+ */
+export type UpdateChannel = "plugin" | "global" | "other";
+export declare function updateChannel(context: InstallContext, env?: NodeJS.ProcessEnv): UpdateChannel;
+export declare function updateRemedy(channel: UpdateChannel): string;
+export declare function formatUpdateBanner(channel: UpdateChannel, current: string, latest: string): string;
 /**
  * Issue #904: the one line that turns an uninterpretable failure into an
  * actionable one, for the caller who is behind the server's contract.

package/dist/update-check.js

@@ -66,19 +66,22 @@ export function classifyInstallContext(selfPath, cwd) {
     return "local";
 }
 /**
- * Whether THIS binary is a stale global install (the `npm i -g` shadowing the
- * plugin's npx wrapper). One definition for the three call sites, and safe on
- * the error path: `process.cwd()` throws ENOENT from an unlinked directory, and
- * a probe that cannot answer must read as "not global", never as a crash.
+ * How THIS binary was launched. One definition for every call site, and safe on
+ * the error path: `process.cwd()` throws ENOENT from an unlinked directory, and a
+ * probe that cannot answer reads as "local" (quiet, never global), never as a crash.
  */
-function isGlobalInstall() {
+function installContext() {
     try {
-        return classifyInstallContext(fileURLToPath(import.meta.url), process.cwd()) === "global";
+        return classifyInstallContext(fileURLToPath(import.meta.url), process.cwd());
     }
     catch {
-        return false;
+        return "local";
     }
 }
+/** Whether THIS binary is a stale global install (the `npm i -g` shadowing the plugin's npx wrapper). */
+function isGlobalInstall() {
+    return installContext() === "global";
+}
 function migrationNoticeAllowed() {
     try {
         if (!existsSync(MIGRATION_NOTICE_FILE))
@@ -136,6 +139,28 @@ function isNewer(latest, current) {
 export function getCurrentVersion() {
     return pkg.version;
 }
+export function updateChannel(context, env = process.env) {
+    if (context === "global")
+        return "global";
+    return env.GRAPHIT_PLUGIN_ROOT ? "plugin" : "other";
+}
+export function updateRemedy(channel) {
+    if (channel === "global")
+        return INSTALL_LATEST_COMMAND;
+    if (channel === "plugin")
+        return "start a new session - the plugin runs the newest CLI automatically";
+    return "your assistant's plugin manager";
+}
+export function formatUpdateBanner(channel, current, latest) {
+    if (channel === "plugin") {
+        return (`\n  Graphit CLI update published: ${current} → ${latest}\n` +
+            "  The plugin picks it up automatically in your next session - no install needed.\n\n");
+    }
+    return (`\n  Graphit CLI update available: ${current} → ${latest}\n` +
+        `  Update the CLI binary:  ${INSTALL_LATEST_COMMAND}\n` +
+        "  (If `graphit` is on a custom npm prefix, add --prefix <dir> for that prefix.)\n" +
+        "  Your assistant's skill bundle updates separately via the plugin manager.\n\n");
+}
 /**
  * Issue #904: the one line that turns an uninterpretable failure into an
  * actionable one, for the caller who is behind the server's contract.
@@ -160,9 +185,7 @@ export function staleVersionHint() {
         return undefined;
     if (Date.now() - cache.checkedAt > HINT_MAX_AGE_MS)
         return undefined;
-    const remedy = isGlobalInstall()
-        ? INSTALL_LATEST_COMMAND
-        : "your assistant's plugin manager";
+    const remedy = updateRemedy(updateChannel(installContext()));
     return (`This CLI is ${current}; ${cache.latestVersion} is available. ` +
         `The server's contract can move ahead of an older CLI - update (${remedy}) and retry.`);
 }
@@ -172,12 +195,9 @@ export function printUpdateBanner() {
     // Project #246: when running as the stale global, the self-announcing shim
     // prints the migration notice instead - suppress the "npm install -g" banner so
     // we don't tell the user to reinstall the very global we're asking them to remove.
-    const onGlobal = isGlobalInstall();
-    if (!onGlobal && cache && isNewer(cache.latestVersion, current)) {
-        writeStderr(`\n  Graphit CLI update available: ${current} → ${cache.latestVersion}\n` +
-            `  Update the CLI binary:  ${INSTALL_LATEST_COMMAND}\n` +
-            "  (If `graphit` is on a custom npm prefix, add --prefix <dir> for that prefix.)\n" +
-            "  Your assistant's skill bundle updates separately via the plugin manager.\n\n");
+    const channel = updateChannel(installContext());
+    if (channel !== "global" && cache && isNewer(cache.latestVersion, current)) {
+        writeStderr(formatUpdateBanner(channel, current, cache.latestVersion));
     }
     const skillBanner = formatSkillStalenessBanner(findOutdatedSkillInstalls(current), current);
     if (skillBanner) {

package/dist/update-check.js.map

@@ -1 +1 @@
-{"version":3,"file":"update-check.js","sourceRoot":"","sources":["../src/update-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACtF,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EACL,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAwB,CAAC;AAE9D,MAAM,YAAY,GAAG,gDAAgD,CAAC;AACtE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;AAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;AACxD,MAAM,qBAAqB,GAAG,IAAI,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;AACvE,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACnC,4EAA4E;AAC5E,8EAA8E;AAC9E,uEAAuE;AACvE,MAAM,eAAe,GAAG,EAAE,GAAG,MAAM,CAAC;AACpC,2EAA2E;AAC3E,6DAA6D;AAC7D,MAAM,sBAAsB,GAAG,oCAAoC,CAAC;AAOpE,6EAA6E;AAC7E,iFAAiF;AACjF,iFAAiF;AACjF,+EAA+E;AAC/E,MAAM,SAAS,GAAG,iBAAiB,CAAC;AAEpC,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,CACL,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ;QACnC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC;QAC/B,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAChC,CAAC;AACJ,CAAC;AAID,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,2EAA2E;AAC3E,SAAS,QAAQ,CAAC,KAAa,EAAE,MAAc;IAC7C,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB,EAAE,GAAW;IAClE,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,OAAO,GAAG,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,eAAe,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACpF,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,OAAO,sBAAsB,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB;IAC7B,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAyB,CAAC;QACrG,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,IAAI,MAAM,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB;IAC5B,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,aAAa,CAAC,qBAAqB,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,wBAAwB;IAC1B,CAAC;AACH,CAAC;AAED,SAAS,SAAS;IAChB,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QACzC,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,MAAc,EAAE,OAAe;IAC9C,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAC9C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACvE,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,eAAe;QAAE,OAAO,SAAS,CAAC;IAErE,MAAM,MAAM,GAAG,eAAe,EAAE;QAC9B,CAAC,CAAC,sBAAsB;QACxB,CAAC,CAAC,iCAAiC,CAAC;IACtC,OAAO,CACL,eAAe,OAAO,KAAK,KAAK,CAAC,aAAa,iBAAiB;QAC/D,kEAAkE,MAAM,cAAc,CACvF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IAEpC,2EAA2E;IAC3E,gFAAgF;IAChF,mFAAmF;IACnF,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IAEnC,IAAI,CAAC,QAAQ,IAAI,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,CAAC;QAChE,WAAW,CACT,qCAAqC,OAAO,MAAM,KAAK,CAAC,aAAa,IAAI;YACvE,6BAA6B,sBAAsB,IAAI;YACvD,mFAAmF;YACnF,gFAAgF,CACnF,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,0BAA0B,CAC5C,yBAAyB,CAAC,OAAO,CAAC,EAClC,OAAO,CACR,CAAC;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,WAAW,CAAC,WAAW,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,IAAI,OAAO,CAAC,GAAG,CAAC,6BAA6B,KAAK,GAAG;QAAE,OAAO;IAE9D,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACjE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO;IAEhC,MAAM,MAAM,GAAG,SAAS,CACtB,OAAO,CAAC,QAAQ,EAChB,CAAC,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,gBAAgB,CAAC,EAChE;QACE,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,IAAI;QACb,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CACF,CAAC;IAEF,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B;IAC1C,IAAI,CAAC,eAAe,EAAE;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,CAAC,sBAAsB,EAAE;QAAE,OAAO,KAAK,CAAC;IAE5C,WAAW,CACT,iGAAiG;QAC/F,0FAA0F;QAC1F,4DAA4D,CAC/D,CAAC;IACF,qBAAqB,EAAE,CAAC;IACxB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,MAAM;QAAE,OAAO;IAE3D,KAAK,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;SACvD,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO;QACpB,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QACb,MAAM,OAAO,GACX,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAC9B,CAAC,CAAE,IAA8B,CAAC,OAAO;YACzC,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3D,UAAU,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC,CAAC;SACD,KAAK,CAAC,GAAG,EAAE;QACV,2CAA2C;IAC7C,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"update-check.js","sourceRoot":"","sources":["../src/update-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACtF,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EACL,yBAAyB,EACzB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAwB,CAAC;AAE9D,MAAM,YAAY,GAAG,gDAAgD,CAAC;AACtE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;AAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;AACxD,MAAM,qBAAqB,GAAG,IAAI,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;AACvE,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACnC,4EAA4E;AAC5E,8EAA8E;AAC9E,uEAAuE;AACvE,MAAM,eAAe,GAAG,EAAE,GAAG,MAAM,CAAC;AACpC,2EAA2E;AAC3E,6DAA6D;AAC7D,MAAM,sBAAsB,GAAG,oCAAoC,CAAC;AAOpE,6EAA6E;AAC7E,iFAAiF;AACjF,iFAAiF;AACjF,+EAA+E;AAC/E,MAAM,SAAS,GAAG,iBAAiB,CAAC;AAEpC,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,CACL,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ;QACnC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC;QAC/B,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAChC,CAAC;AACJ,CAAC;AAID,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,2EAA2E;AAC3E,SAAS,QAAQ,CAAC,KAAa,EAAE,MAAc;IAC7C,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAgB,EAAE,GAAW;IAClE,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,OAAO,GAAG,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,eAAe,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACpF,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc;IACrB,IAAI,CAAC;QACH,OAAO,sBAAsB,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED,yGAAyG;AACzG,SAAS,eAAe;IACtB,OAAO,cAAc,EAAE,KAAK,QAAQ,CAAC;AACvC,CAAC;AAED,SAAS,sBAAsB;IAC7B,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC;YAAE,OAAO,IAAI,CAAC;QACpD,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAyB,CAAC;QACrG,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,IAAI,MAAM,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB;IAC5B,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,aAAa,CAAC,qBAAqB,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,wBAAwB;IAC1B,CAAC;AACH,CAAC;AAED,SAAS,SAAS;IAChB,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QACzC,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,MAAc,EAAE,OAAe;IAC9C,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAC9C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAYD,MAAM,UAAU,aAAa,CAAC,OAAuB,EAAE,MAAyB,OAAO,CAAC,GAAG;IACzF,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC1C,OAAO,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAsB;IACjD,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,sBAAsB,CAAC;IACxD,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,oEAAoE,CAAC;IACtG,OAAO,iCAAiC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAsB,EAAE,OAAe,EAAE,MAAc;IACxF,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO,CACL,qCAAqC,OAAO,MAAM,MAAM,IAAI;YAC5D,sFAAsF,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,CACL,qCAAqC,OAAO,MAAM,MAAM,IAAI;QAC5D,6BAA6B,sBAAsB,IAAI;QACvD,mFAAmF;QACnF,gFAAgF,CACjF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACvE,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,eAAe;QAAE,OAAO,SAAS,CAAC;IAErE,MAAM,MAAM,GAAG,YAAY,CAAC,aAAa,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;IAC7D,OAAO,CACL,eAAe,OAAO,KAAK,KAAK,CAAC,aAAa,iBAAiB;QAC/D,kEAAkE,MAAM,cAAc,CACvF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IAEpC,2EAA2E;IAC3E,gFAAgF;IAChF,mFAAmF;IACnF,MAAM,OAAO,GAAG,aAAa,CAAC,cAAc,EAAE,CAAC,CAAC;IAEhD,IAAI,OAAO,KAAK,QAAQ,IAAI,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,CAAC;QAC3E,WAAW,CAAC,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,WAAW,GAAG,0BAA0B,CAC5C,yBAAyB,CAAC,OAAO,CAAC,EAClC,OAAO,CACR,CAAC;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,WAAW,CAAC,WAAW,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,IAAI,OAAO,CAAC,GAAG,CAAC,6BAA6B,KAAK,GAAG;QAAE,OAAO;IAE9D,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACjE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO;IAEhC,MAAM,MAAM,GAAG,SAAS,CACtB,OAAO,CAAC,QAAQ,EAChB,CAAC,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,gBAAgB,CAAC,EAChE;QACE,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,IAAI;QACb,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CACF,CAAC;IAEF,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B;IAC1C,IAAI,CAAC,eAAe,EAAE;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,CAAC,sBAAsB,EAAE;QAAE,OAAO,KAAK,CAAC;IAE5C,WAAW,CACT,iGAAiG;QAC/F,0FAA0F;QAC1F,4DAA4D,CAC/D,CAAC;IACF,qBAAqB,EAAE,CAAC;IACxB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,MAAM;QAAE,OAAO;IAE3D,KAAK,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;SACvD,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;QACZ,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO;QACpB,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QACb,MAAM,OAAO,GACX,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAC9B,CAAC,CAAE,IAA8B,CAAC,OAAO;YACzC,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3D,UAAU,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC,CAAC;SACD,KAAK,CAAC,GAAG,EAAE;QACV,2CAA2C;IAC7C,CAAC,CAAC,CAAC;AACP,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@graphit/cli",
-  "version": "0.2.365",
+  "version": "0.2.371",
   "description": "Graphit CLI - Build custom dashboards from any AI coding assistant",
   "repository": {
     "type": "git",
@@ -12,14 +12,16 @@
     "graphit": "./dist/index.js"
   },
   "scripts": {
-    "build": "npm run sync:version && tsc",
+    "build": "npm run sync:version && npm run sync:workflows && tsc",
     "dev": "tsx src/index.ts",
     "lint": "npm run check:version && tsc --noEmit",
-    "test": "npm run build && npm run check:commands && node --test test/*.test.mjs",
+    "test": "npm run build && npm run check:commands && GRAPHIT_SKIP_PLUGIN_PREFLIGHT=1 node --test test/*.test.mjs",
     "sync:version": "node scripts/sync-plugin-version.mjs",
+    "sync:workflows": "node scripts/sync-workflow-references.mjs",
+    "check:workflows": "node scripts/sync-workflow-references.mjs --check",
     "check:version": "node scripts/sync-plugin-version.mjs --check",
     "gen:commands": "node scripts/generate-commands-doc.mjs && node scripts/generate-tool-manifest.mjs",
-    "check:commands": "node scripts/generate-commands-doc.mjs --check && node scripts/generate-tool-manifest.mjs --check"
+    "check:commands": "node scripts/generate-commands-doc.mjs --check && node scripts/generate-tool-manifest.mjs --check && npm run check:workflows"
   },
   "engines": {
     "node": ">=18"

package/scripts/plugin-status.mjs

@@ -50,11 +50,21 @@ const shouldRepair = args.has("--repair") || args.has("--auto-repair");
 const isPreflight = args.has("--preflight");
 const hookIndex = process.argv.indexOf("--hook");
 const hookEvent = hookIndex >= 0 ? process.argv[hookIndex + 1] : null;
-const pluginRoot =
+const pluginRootFromEnv =
   process.env.CLAUDE_PLUGIN_ROOT ??
   process.env.CODEX_PLUGIN_ROOT ??
-  process.env.GRAPHIT_PLUGIN_ROOT ??
-  dirname(dirname(fileURLToPath(import.meta.url)));
+  process.env.GRAPHIT_PLUGIN_ROOT;
+const pluginRoot = pluginRootFromEnv ?? dirname(dirname(fileURLToPath(import.meta.url)));
+// Issue #994: a plugin root variable means this run inspects the bundle an
+// assistant loaded (hooks get CLAUDE_PLUGIN_ROOT, the bin/graphit wrapper exports
+// GRAPHIT_PLUGIN_ROOT). That bundle's CLI already tracks npm latest through npx, so
+// a newer release means the BUNDLE is behind. Without one, this run inspects the
+// npm package it ships in - a CLI launched without the plugin, i.e. a global install.
+const inspectsPluginBundle = pluginRootFromEnv !== undefined;
+const PLUGIN_UPDATE_STEPS =
+  "In Claude Code run `/plugin marketplace update graphit-plugin`, then `/plugin update graphit@graphit-plugin`, " +
+  "then restart Claude Code (asking to update Graphit runs the same steps via `/graphit:update`). " +
+  "In Codex, update the Graphit plugin through its plugin manager.";
 // Project #246: the version cache must be shared between this SessionStart hook
 // and the bin/graphit wrapper (agent Bash tool). CLAUDE_PLUGIN_DATA is set
 // per-plugin/per-context by Claude Code and is NOT guaranteed identical across
@@ -629,10 +639,23 @@ async function collectStatus() {
   const marketplace = bundleInfo.marketplace;
   const marketplacePlugin = bundleInfo.marketplacePlugin;
 
+  // Issue #994: only the npm package (and the repo's cli/ dir) carries package.json
+  // and the npm-shaped marketplace.json that sync:version stamps. A bundle installed
+  // from the git marketplace ships that repo's own catalog (source "./", no
+  // metadata) by design, so the catalog checks are publisher checks - CI gates them
+  // (`check:version`, `sync-plugin-marketplace.sh verify`) - and a customer who hits
+  // real drift needs a plugin update, not a publish step.
+  const isPackageLayout = existsSync(join(pluginRoot, "package.json"));
+  const driftRemediation = isPackageLayout
+    ? "Run `npm run sync:version` before publishing @graphit/cli."
+    : `This installed Graphit plugin bundle is inconsistent. Update or reinstall it: ${PLUGIN_UPDATE_STEPS}`;
+
   const versionChecks = [
     [".claude-plugin/plugin.json", claudePlugin?.version],
     [".codex-plugin/plugin.json", codexPlugin?.version],
-    [".claude-plugin/marketplace.json metadata", marketplace?.metadata?.version],
+    ...(isPackageLayout
+      ? [[".claude-plugin/marketplace.json metadata", marketplace?.metadata?.version]]
+      : []),
     [".claude-plugin/marketplace.json plugin", marketplacePlugin?.version],
     ["skills/graphit/VERSION.json", tryReadJson(join(pluginRoot, "skills", "graphit", "VERSION.json"))?.version],
     ["skills/graphit/SKILL.md", readFrontmatterVersion(join(pluginRoot, "skills", "graphit", "SKILL.md"))],
@@ -646,39 +669,47 @@ async function collectStatus() {
       findings.push({
         type: "metadata-drift",
         message: `${label} is ${version ?? "missing"}, expected ${currentVersion}`,
-        remediation: "Run `npm run sync:version` before publishing @graphit/cli.",
+        remediation: driftRemediation,
       });
     }
     metadata.push({ label, version: version ?? null });
   }
 
   const marketplaceSource = marketplacePlugin?.source;
-  const sourceMatches =
-    marketplaceSource?.source === "npm" &&
-    marketplaceSource.package === packageName &&
-    marketplaceSource.version === currentVersion;
   metadata.push({
     label: ".claude-plugin/marketplace.json source",
     version: marketplaceSource?.version ?? null,
     source: marketplaceSource ?? null,
   });
-  if (!isPreflight && !sourceMatches) {
+  const sourceMatches =
+    marketplaceSource?.source === "npm" &&
+    marketplaceSource.package === packageName &&
+    marketplaceSource.version === currentVersion;
+  if (!isPreflight && isPackageLayout && !sourceMatches) {
     findings.push({
       type: "metadata-drift",
       message: `.claude-plugin/marketplace.json source is ${
         marketplaceSource ? JSON.stringify(marketplaceSource) : "missing"
       }, expected npm source ${packageName}@${currentVersion}`,
-      remediation: "Run `npm run sync:version` before publishing @graphit/cli.",
+      remediation: driftRemediation,
     });
   }
 
   const latestVersion = await getLatestVersion(currentVersion);
   if (!isPreflight && latestVersion && compareVersions(latestVersion, currentVersion) > 0) {
-    findings.push({
-      type: "package-update",
-      message: `@graphit/cli update available: ${currentVersion} -> ${latestVersion}`,
-      remediation: "This update is for the npm CLI binary (@graphit/cli), a separate artifact from the skill bundle. Update the binary with `npm install -g @graphit/cli@latest` (not `npm update -g`, which respects the original semver range and can miss the latest). If `graphit` resolves to a custom npm prefix (compare `command -v graphit` with `npm prefix -g`), reinstall to that prefix with `npm install -g @graphit/cli@latest --prefix <dir>` (<dir> = the parent of the bin dir holding graphit). The Claude Code/Codex skill bundle updates separately via `claude plugin update graphit@graphit-plugin` and does NOT update the binary.",
-    });
+    findings.push(
+      inspectsPluginBundle
+        ? {
+            type: "plugin-update",
+            message: `Graphit plugin update available: ${currentVersion} -> ${latestVersion}`,
+            remediation: `The plugin runs the latest Graphit CLI automatically; what is behind is the plugin bundle itself (skills, hooks and commands at ${currentVersion}). ${PLUGIN_UPDATE_STEPS} Do not install @graphit/cli globally: a global install shadows the plugin's CLI on PATH.`,
+          }
+        : {
+            type: "package-update",
+            message: `@graphit/cli update available: ${currentVersion} -> ${latestVersion}`,
+            remediation: "This update is for the npm CLI binary (@graphit/cli), a separate artifact from the skill bundle. Update the binary with `npm install -g @graphit/cli@latest` (not `npm update -g`, which respects the original semver range and can miss the latest). If `graphit` resolves to a custom npm prefix (compare `command -v graphit` with `npm prefix -g`), reinstall to that prefix with `npm install -g @graphit/cli@latest --prefix <dir>` (<dir> = the parent of the bin dir holding graphit). The Claude Code/Codex skill bundle updates separately via `claude plugin update graphit@graphit-plugin` and does NOT update the binary.",
+          },
+    );
   }
 
   const claudeInstall = inspectClaudeInstalledPlugin(currentVersion, shouldRepair);
@@ -759,8 +790,8 @@ function buildHookNudges(status) {
   ) {
     lines.push(
       `- A newer Graphit plugin is available (${status.currentVersion} -> ${status.latestVersion}). ` +
-        "Tell the user once to update the bundle with `/plugin update graphit@graphit-plugin`; " +
-        "the CLI binary itself updates automatically.",
+        "Tell the user once to update it with `/plugin marketplace update graphit-plugin`, then " +
+        "`/plugin update graphit@graphit-plugin`, then restart Claude Code; the CLI itself already runs the latest release.",
     );
     shown.push("plugin-update");
   }

package/scripts/sync-plugin-marketplace.sh

@@ -8,21 +8,18 @@ VERSION=$(node -p "require('./cli/package.json').version")
 sync_marketplace() {
   local target="$MARKETPLACE_DIR"
 
-  mkdir -p "$target/skills/graphit"
-  cp cli/skills/graphit/SKILL.md "$target/skills/graphit/SKILL.md"
-  cp cli/skills/graphit/graphit.mdc "$target/skills/graphit/graphit.mdc"
-  cp cli/skills/graphit/VERSION.json "$target/skills/graphit/VERSION.json"
-
-  # Mirror generated directories so removed files cannot linger downstream.
-  mkdir -p "$target/skills/graphit/references"
-  rsync -a --delete cli/skills/graphit/references/ "$target/skills/graphit/references/"
-  mkdir -p "$target/skills/graphit/cursor"
-  rsync -a --delete cli/skills/graphit/cursor/ "$target/skills/graphit/cursor/"
+  # Project #298: native workflows are siblings of the router. Mirror the
+  # entire authored skill tree so every host receives them and retired skills
+  # cannot linger. Hidden editor state is not plugin content.
+  mkdir -p "$target/skills"
+  rsync -a --delete --exclude='.*' cli/skills/ "$target/skills/"
   mkdir -p "$target/hooks"
   rsync -a --delete cli/hooks/ "$target/hooks/"
 
   mkdir -p "$target/scripts"
-  cp cli/scripts/plugin-status.mjs "$target/scripts/"
+  # Project #298: the copied hook manifest must not reference absent scripts.
+  cp cli/scripts/plugin-status.mjs cli/scripts/block-legacy-setup.mjs \
+    cli/scripts/show-query-result.mjs "$target/scripts/"
 
   # Project #246: the public plugin ships wrappers that invoke the current CLI.
   mkdir -p "$target/bin"
@@ -84,13 +81,42 @@ verify_marketplace() {
     fail=1
   fi
 
+  # Check against the canonical manifest, so a damaged target cannot hide a dependency.
+  if ! node - "$target" <<'JS'
+const fs = require("node:fs");
+const path = require("node:path");
+const target = process.argv[2];
+const config = JSON.parse(fs.readFileSync("cli/hooks/hooks.json", "utf8"));
+const prefix = "${CLAUDE_PLUGIN_ROOT}/";
+const files = new Set(["hooks/hooks.json"]);
+for (const groups of Object.values(config.hooks)) {
+  for (const group of groups) {
+    for (const hook of group.hooks) {
+      for (const arg of hook.args ?? []) {
+        if (typeof arg === "string" && arg.startsWith(prefix)) files.add(arg.slice(prefix.length));
+      }
+    }
+  }
+}
+let valid = true;
+for (const file of files) {
+  const destination = path.join(target, file);
+  if (!fs.existsSync(destination) || !fs.readFileSync(destination).equals(fs.readFileSync(path.join("cli", file)))) {
+    console.error(`::error::marketplace hook file missing or differs from source: ${file}`);
+    valid = false;
+  }
+}
+process.exitCode = valid ? 0 : 1;
+JS
+  then
+    fail=1
+  fi
+
   local marketplace_version claude_plugin_version codex_plugin_version skill_version
-  local skill_frontmatter_version
   marketplace_version=$(node -p "require('$target/.claude-plugin/marketplace.json').plugins.find(p => p.name === 'graphit')?.version")
   claude_plugin_version=$(node -p "require('$target/.claude-plugin/plugin.json').version")
   codex_plugin_version=$(node -p "require('$target/.codex-plugin/plugin.json').version")
   skill_version=$(node -p "require('$target/skills/graphit/VERSION.json').version")
-  skill_frontmatter_version=$(node -e "const fs=require('fs'); const m=fs.readFileSync('$target/skills/graphit/SKILL.md','utf8').match(/^skill_version:\\s*[\\\"']?([^\\\"'\\n]+)[\\\"']?\\s*$/m); console.log(m?.[1] ?? '')")
 
   if [[ "$marketplace_version" != "$VERSION" ]]; then
     echo "::error::marketplace.json graphit version ($marketplace_version) != package.json ($VERSION)"
@@ -108,8 +134,29 @@ verify_marketplace() {
     echo "::error::skills/graphit/VERSION.json version ($skill_version) != package.json ($VERSION)"
     fail=1
   fi
-  if [[ "$skill_frontmatter_version" != "$VERSION" ]]; then
-    echo "::error::skills/graphit/SKILL.md frontmatter version ($skill_frontmatter_version) != package.json ($VERSION)"
+  local skill_path relative_path skill_frontmatter_version
+  for skill_path in cli/skills/*/SKILL.md; do
+    relative_path="${skill_path#cli/}"
+    if [[ ! -f "$target/$relative_path" ]]; then
+      echo "::error::marketplace missing $relative_path after sync"
+      fail=1
+      continue
+    fi
+    skill_frontmatter_version=$(node - "$target/$relative_path" <<'JS'
+const fs = require("fs");
+const text = fs.readFileSync(process.argv[2], "utf8");
+const frontmatter = text.startsWith("---\n") ? text.split("\n---")[0] : "";
+console.log(frontmatter.match(/^skill_version:\s*["']?([^"'\n]+)["']?\s*$/m)?.[1] ?? "");
+JS
+)
+    if [[ "$skill_frontmatter_version" != "$VERSION" ]]; then
+      echo "::error::$relative_path frontmatter version ($skill_frontmatter_version) != package.json ($VERSION)"
+      fail=1
+    fi
+  done
+
+  if ! diff -qr -x '.*' cli/skills "$target/skills"; then
+    echo "::error::marketplace skill content differs from the canonical skills tree"
     fail=1
   fi
 

package/scripts/sync-plugin-version.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -122,7 +122,12 @@ updatePluginManifest(join(cliRoot, ".claude-plugin", "plugin.json"), version, ch
 updatePluginManifest(join(cliRoot, ".codex-plugin", "plugin.json"), version, changes);
 updateMarketplace(join(cliRoot, ".claude-plugin", "marketplace.json"), version, packageName, changes);
 updateVersionJson(join(cliRoot, "skills", "graphit", "VERSION.json"), packageName, version, changes);
-updateSkillFile(join(cliRoot, "skills", "graphit", "SKILL.md"), version, packageName, changes);
+for (const entry of readdirSync(join(cliRoot, "skills"), { withFileTypes: true })) {
+  const skill = join(cliRoot, "skills", entry.name, "SKILL.md");
+  if (entry.isDirectory() && existsSync(skill)) {
+    updateSkillFile(skill, version, packageName, changes);
+  }
+}
 // graphit.mdc is the frozen Cursor mirror and is no longer stamped (Cursor unmaintained for Claude Code + Codex).
 updateWrapperFloor(join(cliRoot, "bin", "graphit"), version, changes);
 updateWrapperFloor(join(cliRoot, "bin", "graphit.ps1"), version, changes);

package/scripts/sync-workflow-references.mjs

@@ -0,0 +1,61 @@
+#!/usr/bin/env node
+// Project #298: one authored workflow serves native host skills and the app loader.
+import { readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = process.env.GRAPHIT_CLI_ROOT ?? fileURLToPath(new URL("..", import.meta.url));
+const check = process.argv.includes("--check");
+const intents = ["explore", "build", "share"];
+const pending = [];
+
+function block(text, marker, source) {
+  const start = `<!-- ${marker}:START -->`;
+  const end = `<!-- ${marker}:END -->`;
+  const parts = text.split(start);
+  const tail = parts[1]?.split(end);
+  if (parts.length !== 2 || text.split(end).length !== 2 || tail?.length !== 2 || !tail[0].trim()) {
+    throw new Error(`${source}: expected one nonempty ${marker} block in order`);
+  }
+  return { body: tail[0].trim(), before: parts[0], after: tail[1], start, end };
+}
+
+function plan(destination, output) {
+  let current;
+  try {
+    current = readFileSync(join(root, destination), "utf8");
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+  if (current !== output) pending.push({ destination, output });
+}
+
+const core = "skills/graphit/SKILL.md";
+const essentials = block(readFileSync(join(root, core), "utf8"), "GRAPHIT-ESSENTIALS", core).body;
+
+for (const intent of intents) {
+  const source = `skills/graphit-${intent}/SKILL.md`;
+  const text = readFileSync(join(root, source), "utf8");
+  const name = text.match(/^name: (.+)$/m)?.[1];
+  const title = text.match(/^# .+$/m)?.[0];
+  const workflow = block(text, "WORKFLOW", source);
+  const shared = block(text, "GRAPHIT-ESSENTIALS", source);
+  if (name !== `graphit-${intent}` || !title || !shared.after.includes(workflow.start)) {
+    throw new Error(`${source}: expected matching name/title and essentials before workflow`);
+  }
+  plan(source, `${shared.before}${shared.start}\n${essentials}\n${shared.end}${shared.after}`);
+  const body = workflow.body
+    .replaceAll("../graphit/references/", "")
+    .replace(/\[graphit-(explore|build|share)\]\(\.\.\/graphit-\1\/SKILL\.md\)/g, "$1.md");
+  const output = `<!-- Generated from ${source}; edit the workflow skill, then run npm run sync:workflows. -->\n\n${title}\n\n${body}\n`;
+  plan(`skills/graphit/references/${intent}.md`, output);
+}
+
+// Validate every source before any write, including when a later workflow is malformed.
+if (check && pending.length) {
+  console.error(`Workflow artifacts out of sync: ${pending.map(item => item.destination).join(", ")}. Run npm run sync:workflows.`);
+  process.exitCode = 1;
+} else {
+  for (const { destination, output } of pending) writeFileSync(join(root, destination), output);
+  console.log(pending.length ? `Synced ${pending.length} workflow artifacts.` : "Workflow artifacts are in sync.");
+}

package/scripts/verb-policy-source.json

@@ -474,12 +474,12 @@
       "silent_retry_exempt": true
     },
     "ds delete": {
-      "surface": "cli_only",
+      "surface": "both",
       "is_read_only": false,
       "mutation_class": "data_source",
       "requires_approval": true,
       "silent_retry_exempt": true,
-      "reason": "Not a working verb on either surface. The CLI registers it only to name the boundary - deletion cascades into dashboards, KB tables and cached snapshots, so it runs from the Sources Hub where the blast radius is shown first. Generating it in-app would advertise a capability that always errors."
+      "reason": "Delete only the caller's own private sources through the same policy-complete route on both surfaces. Shared sources remain in the Sources Hub; applied cleanup-pending deletes must not be retried."
     },
     "ds move": {
       "surface": "cli_only",
@@ -487,7 +487,7 @@
       "mutation_class": "data_source",
       "requires_approval": true,
       "silent_retry_exempt": true,
-      "reason": "Not a working verb on either surface, and unlike `ds delete` there is no UI action behind it (Issue #962). A source has no home of its own: it lives in the group of the semantic model bound to it, so `kb update semantic-model` with a new group is the move. The CLI registers `ds move` only to say so."
+      "reason": "Not a working verb on either surface, and there is no UI action behind it (Issue #962). A source has no home of its own: it lives in the group of the semantic model bound to it, so `kb update semantic-model` with a new group is the move. The CLI registers `ds move` only to say so."
     },
     "dashboard folder spaces": {
       "surface": "both", "noun": "dashboard", "is_read_only": true,