@imfusion/web-ui 0.10.1-dev.60.g7891a716 → 0.10.1-dev.61.g9d1000b8

package/CHANGELOG.md

@@ -57,6 +57,11 @@ never changes the character width, so columns stay aligned. CoFo Sans Mono still
   - Remove a header color set to match the branded navbar. A custom surface still goes in `--imf-ui-appshell-header-bg`, which is unset by default and falls back to the navbar variant's surface.
 - **Breaking:** `AppShell.Header` is a flex row, and it wraps its children in a container that aligns them to the inline end. [AppShell](src/components/app-shell/app-shell.mdx) — Nikolaus Brunner <brunner@imfusion.com>
   - Give your own row `width: 100%` to span the header.
+- **Breaking:** `npx web-ui install hooks` removes `baseline-staleness.sh`, and the `SessionStart` hook reports installed
+  skills that differ from the package copy in `node_modules` instead. — Nikolaus Brunner <brunner@imfusion.com>
+  - Remove the `.agents/hooks/imf-web-ui/baseline-staleness.sh` line from the project's pre-commit hook before running
+    `install hooks`; a pre-commit that calls the missing script fails every commit.
+  - Keep `.agents/skills/imf-web-ui*` out of the project's formatter, or the reformatted skills read as stale.
 
 ### Added
 
@@ -121,6 +126,9 @@ never changes the character width, so columns stay aligned. CoFo Sans Mono still
   - The navbar rail, `AppShell.Main`, and the aside share `--imf-ui-appshell-padding` as their inline gutter, so their text lines up with no consumer CSS. [Docs](src/components/app-shell/app-shell.mdx)
   - `--imf-ui-appshell-navbar-padding` defaults to `--imf-ui-appshell-padding`, and `--imf-ui-appshell-aside-padding` defaults to `--imf-ui-appshell-padding`. Both stay overridable.
 - Agent skills — Nikolaus Brunner <brunner@imfusion.com>
+  - `npx web-ui install skills` writes no `.imf-web-ui-skill-version.json` marker into each skill and removes existing ones.
+    Both install commands read the harness back from the Claude skill links and the installer's hook registrations, and
+    take it from an old marker when one is still there.
   - `imf-web-ui-audit` checks that `@imfusion/web-ui` is installed before it dispatches, and asks whether to install first,
     since token, version, and type checks need the installed package. Its investigators search with whatever read-only
     file search the host offers.

package/dist/web-ui-cli.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { n as e, r as t, t as n } from "./paths-B5Ht3ETc.js";
 import { chmodSync as r, cpSync as i, existsSync as a, lstatSync as o, mkdirSync as s, readFileSync as c, readdirSync as l, readlinkSync as u, realpathSync as d, rmSync as f, symlinkSync as p, writeFileSync as m } from "node:fs";
-import { dirname as h, relative as g, resolve as _ } from "node:path";
-import { Command as ee, Option as te } from "commander";
-import * as v from "@clack/prompts";
-var y = {
+import { dirname as ee, relative as h, resolve as g } from "node:path";
+import { Command as te, Option as ne } from "commander";
+import * as _ from "@clack/prompts";
+var v = {
 	harnesses: {
 		claude: {
 			label: "Claude Code",
@@ -22,162 +22,160 @@ var y = {
 	templatesDir: "src/llms/install-templates",
 	skillsSource: "src/llms/skills",
 	skillsDir: ".agents/skills",
-	linkDir: ".claude/skills",
-	versionMarker: ".imf-web-ui-skill-version.json"
-}, ne = `<!-- ${y.namespace}:begin`, b = `<!-- ${y.namespace}:end -->`, re = _(e, y.templatesDir, "AGENTS.md"), x = _(t, "AGENTS.md");
-function S(e) {
-	let t = e.indexOf(ne), n = e.indexOf(b);
-	return t === -1 || n === -1 ? null : e.slice(t, n + b.length);
+	linkDir: ".claude/skills"
+}, re = `<!-- ${v.namespace}:begin`, y = `<!-- ${v.namespace}:end -->`, ie = g(e, v.templatesDir, "AGENTS.md"), b = g(t, "AGENTS.md");
+function x(e) {
+	let t = e.indexOf(re), n = e.indexOf(y);
+	return t === -1 || n === -1 ? null : e.slice(t, n + y.length);
 }
-function ie() {
-	if (!a(x)) return "absent";
-	let e = S(c(re, "utf-8"));
+function S() {
+	if (!a(b)) return "absent";
+	let e = x(c(ie, "utf-8"));
 	if (!e) return "absent";
-	let t = c(x, "utf-8"), n = S(t), r = n ? t.replace(n, e) : `${t.trimEnd()}\n\n${e}\n`;
-	return r === t ? "unchanged" : (m(x, r), n ? "updated" : "added");
+	let t = c(b, "utf-8"), n = x(t), r = n ? t.replace(n, e) : `${t.trimEnd()}\n\n${e}\n`;
+	return r === t ? "unchanged" : (m(b, r), n ? "updated" : "added");
 }
 //#endregion
 //#region src/cli/skills.ts
-var C = Object.keys(y.harnesses).filter((e) => e in y.harnesses), w = [...C, "all"];
-function T(e) {
+var C = Object.keys(v.harnesses).filter((e) => e in v.harnesses), ae = [...C, "all"];
+function w(e) {
 	return e === "all" ? C : [e];
 }
-function E(e) {
-	return `./${g(t, e)}`;
+function T(e) {
+	return `./${h(t, e)}`;
 }
-var D = y.namespace, O = y.versionMarker, k = _(e, y.skillsSource), A = _(t, y.skillsDir), j = _(t, y.linkDir), M = class extends Error {}, N = JSON.parse(c(_(e, "package.json"), "utf-8"));
-if (typeof N != "object" || !N || !("version" in N) || typeof N.version != "string") throw Error(`${_(e, "package.json")} has no string "version" field`);
-var P = N.version;
-function F(e) {
-	return e === D || e.startsWith(`${D}-`);
+var E = v.namespace, D = ".imf-web-ui-skill-version.json", O = g(e, v.skillsSource), k = g(t, v.skillsDir), A = g(t, v.linkDir), j = class extends Error {}, M = JSON.parse(c(g(e, "package.json"), "utf-8"));
+if (typeof M != "object" || !M || !("version" in M) || typeof M.version != "string") throw Error(`${g(e, "package.json")} has no string "version" field`);
+var oe = M.version;
+function N(e) {
+	return e === E || e.startsWith(`${E}-`);
 }
-function I() {
-	return a(k) ? l(k, { withFileTypes: !0 }).filter((e) => e.isDirectory() && F(e.name)).map((e) => e.name).sort() : [];
+function P() {
+	return a(O) ? l(O, { withFileTypes: !0 }).filter((e) => e.isDirectory() && N(e.name)).map((e) => e.name).sort() : [];
 }
-function ae(e) {
-	let t = _(A, e, O);
-	if (!a(t)) return null;
+function se(e) {
+	if (!a(e)) return null;
 	try {
-		let e = JSON.parse(c(t, "utf-8"));
-		if (typeof e != "object" || !e) return null;
-		let n = "harnesses" in e && Array.isArray(e.harnesses) ? e.harnesses : null;
+		let t = JSON.parse(c(e, "utf-8"));
+		if (typeof t != "object" || !t) return null;
+		let n = "harnesses" in t && Array.isArray(t.harnesses) ? t.harnesses : null;
 		return n ? C.filter((e) => n.includes(e)) : null;
 	} catch {
 		return null;
 	}
 }
-function L(e) {
+function ce(e) {
 	for (let t of e) {
-		let e = ae(t);
+		let e = se(g(k, t, D));
 		if (e && e.length > 0) return e;
 	}
 	return null;
 }
-function R(e, t, n) {
-	if (a(e)) for (let r of l(e).filter(F)) t.has(r) || (f(_(e, r), {
+function F(e) {
+	return e.some((e) => a(g(k, e)));
+}
+function I(e) {
+	return R() ? F(e) : e.some((e) => o(g(A, e), { throwIfNoEntry: !1 })?.isSymbolicLink() === !0);
+}
+function L(e, t, n) {
+	if (a(e)) for (let r of l(e).filter(N)) t.has(r) || (f(g(e, r), {
 		recursive: !0,
 		force: !0
-	}), v.log.info(`Removed skill: ${r} (${n})`));
+	}), _.log.info(`Removed skill: ${r} (${n})`));
 }
-function oe() {
-	return a(j) && a(A) && d(j) === d(A);
+function R() {
+	return a(A) && a(k) && d(A) === d(k);
 }
-function z(e) {
-	let t = _(j, e), n = g(j, _(A, e)), r = o(t, { throwIfNoEntry: !1 });
+function le(e) {
+	let t = g(A, e), n = h(A, g(k, e)), r = o(t, { throwIfNoEntry: !1 });
 	r?.isSymbolicLink() && u(t) === n || (r && f(t, {
 		recursive: !0,
 		force: !0
-	}), s(j, { recursive: !0 }), p(n, t));
+	}), s(A, { recursive: !0 }), p(n, t));
 }
-function se(e, t) {
+function ue(e, t) {
 	try {
-		s(A, { recursive: !0 });
-		let r = [];
-		for (let n of e) {
-			let e = _(A, n);
+		s(k, { recursive: !0 });
+		for (let t of e) {
+			let e = g(k, t);
 			f(e, {
 				recursive: !0,
 				force: !0
-			}), i(_(k, n), e, { recursive: !0 });
-			let a = _(e, O);
-			m(a, JSON.stringify({
-				version: P,
-				harnesses: t
-			}, null, 2) + "\n"), r.push(a);
+			}), i(g(O, t), e, { recursive: !0 });
 		}
-		if (n(r), R(A, new Set(e), "no longer in this bundle"), v.log.success(`Skills -> ${E(A)}/${D}*`), oe()) return;
+		if (L(k, new Set(e), "no longer in this bundle"), _.log.success(`Skills -> ${T(k)}/${E}*`), R()) return;
 		if (t.includes("claude")) {
-			for (let t of e) z(t);
-			R(j, new Set(e), "no longer in this bundle"), v.log.success(`Claude Code -> ${E(j)}/${D}* (symlinks -> ${E(A)})`);
-		} else R(j, /* @__PURE__ */ new Set(), "claude not selected");
+			for (let t of e) le(t);
+			L(A, new Set(e), "no longer in this bundle"), _.log.success(`Claude Code -> ${T(A)}/${E}* (symlinks -> ${T(k)})`);
+		} else L(A, /* @__PURE__ */ new Set(), "claude not selected");
 	} catch (e) {
-		throw e instanceof Error ? new M(e.message) : e;
+		throw e instanceof Error ? new j(e.message) : e;
 	}
 }
 //#endregion
 //#region src/cli/hooks.ts
-var B = _(e, y.templatesDir), V = _(B, "hooks"), H = _(t, y.hooksDir), U = class extends Error {};
-function ce(e, t) {
-	if (typeof e != "object" || !e || Array.isArray(e)) throw new U(`${t} is not a JSON object.`);
+var z = g(e, v.templatesDir), B = g(z, "hooks"), V = g(t, v.hooksDir), H = class extends Error {};
+function de(e, t) {
+	if (typeof e != "object" || !e || Array.isArray(e)) throw new H(`${t} is not a JSON object.`);
 	let n = { ...e };
 	if ("hooks" in n) {
-		if (typeof n.hooks != "object" || n.hooks === null || Array.isArray(n.hooks)) throw new U(`${t}: "hooks" is not a JSON object.`);
-		for (let [e, r] of Object.entries(n.hooks)) if (!Array.isArray(r)) throw new U(`${t}: "hooks.${e}" is not a JSON array.`);
+		if (typeof n.hooks != "object" || n.hooks === null || Array.isArray(n.hooks)) throw new H(`${t}: "hooks" is not a JSON object.`);
+		for (let [e, r] of Object.entries(n.hooks)) if (!Array.isArray(r)) throw new H(`${t}: "hooks.${e}" is not a JSON array.`);
 	}
 	return n;
 }
-function W(e) {
+function U(e) {
 	let t;
 	try {
 		t = JSON.parse(c(e, "utf-8"));
 	} catch {
-		throw new U(`${e} is not valid JSON.`);
+		throw new H(`${e} is not valid JSON.`);
 	}
-	return ce(t, e);
+	return de(t, e);
 }
-function le() {
-	let e = l(V).filter((e) => e.endsWith(".sh"));
-	s(H, { recursive: !0 });
+function fe() {
+	let e = l(B).filter((e) => e.endsWith(".sh"));
+	s(V, { recursive: !0 });
 	for (let t of e) {
-		let e = _(H, t);
-		i(_(V, t), e, { force: !0 }), r(e, 493);
+		let e = g(V, t);
+		i(g(B, t), e, { force: !0 }), r(e, 493);
 	}
-	let t = l(H).filter((t) => t.endsWith(".sh") && !e.includes(t));
-	for (let e of t) f(_(H, e), { force: !0 });
+	let t = l(V).filter((t) => t.endsWith(".sh") && !e.includes(t));
+	for (let e of t) f(g(V, e), { force: !0 });
 	return {
 		installed: e,
 		removed: t
 	};
 }
-var G = `${y.hooksDir}/`;
-function K(e) {
+var W = `${v.hooksDir}/`;
+function G(e) {
 	if (typeof e != "string") return null;
-	let t = e.lastIndexOf(G);
+	let t = e.lastIndexOf(W);
 	if (t === -1) return null;
-	let n = /^([\w.-]+)["']?$/.exec(e.slice(t + G.length));
+	let n = /^([\w.-]+)["']?$/.exec(e.slice(t + W.length));
 	return n ? n[1] : null;
 }
-function q(e) {
+function K(e) {
 	return typeof e == "object" && !!e && "hooks" in e && Array.isArray(e.hooks);
 }
-function J(e) {
-	return q(e) ? e.hooks : null;
+function q(e) {
+	return K(e) ? e.hooks : null;
 }
-function Y(e) {
+function J(e) {
 	return typeof e == "object" && e && "command" in e ? e.command : void 0;
 }
-function X(e) {
-	let t = J(e);
-	return t ? t.map((e) => K(Y(e))).filter((e) => e !== null) : [];
+function Y(e) {
+	let t = q(e);
+	return t ? t.map((e) => G(J(e))).filter((e) => e !== null) : [];
 }
-function ue(e, t, n) {
+function pe(e, t, n) {
 	e.hooks ??= {};
 	let r = 0, i = 0, a = [];
 	for (let [r, o] of Object.entries(e.hooks)) {
 		let s = 0, c = o.map((e) => {
-			if (!q(e)) return e;
+			if (!K(e)) return e;
 			let t = e.hooks, r = t.filter((e) => {
-				let t = K(Y(e));
+				let t = G(J(e));
 				return t === null || n.includes(t);
 			});
 			return s += t.length - r.length, r.length === t.length ? e : {
@@ -185,7 +183,7 @@ function ue(e, t, n) {
 				hooks: r
 			};
 		}).filter((e) => {
-			let t = J(e);
+			let t = q(e);
 			return t === null || t.length > 0;
 		});
 		s !== 0 && (i += s, c.length === 0 && !(r in t) ? a.push(r) : e.hooks[r] = c);
@@ -194,8 +192,8 @@ function ue(e, t, n) {
 	for (let [n, i] of Object.entries(t)) {
 		e.hooks[n] ??= [];
 		for (let t of i) {
-			let i = X(t);
-			e.hooks[n].some((e) => X(e).some((e) => i.includes(e))) || (e.hooks[n].push(t), r++);
+			let i = Y(t);
+			e.hooks[n].some((e) => Y(e).some((e) => i.includes(e))) || (e.hooks[n].push(t), r++);
 		}
 	}
 	return {
@@ -203,99 +201,115 @@ function ue(e, t, n) {
 		removed: i
 	};
 }
-function de(e) {
+function me(e) {
+	let n = g(t, v.harnesses[e].hookSettings);
+	if (!a(n)) return !1;
+	try {
+		return Object.values(U(n).hooks ?? {}).flat().some((e) => Y(e).length > 0);
+	} catch {
+		return !1;
+	}
+}
+function he(e) {
 	let r = /* @__PURE__ */ new Map(), i = /* @__PURE__ */ new Map();
 	for (let n of C) {
-		let o = _(t, y.harnesses[n].hookSettings);
-		if (a(o) && r.set(n, W(o)), e.includes(n)) {
-			let e = _(B, y.harnesses[n].hookTemplate);
-			i.set(n, W(e).hooks ?? {});
+		let o = g(t, v.harnesses[n].hookSettings);
+		if (a(o) && r.set(n, U(o)), e.includes(n)) {
+			let e = g(z, v.harnesses[n].hookTemplate);
+			i.set(n, U(e).hooks ?? {});
 		}
 	}
-	let { installed: o, removed: c } = le();
-	v.log.success(`Agent hooks -> ${E(H)} (${String(o.length)} scripts)`), c.length > 0 && v.log.info(`Removed stale hook script(s): ${c.join(", ")} (no longer shipped)`);
+	let { installed: o, removed: c } = fe();
+	_.log.success(`Agent hooks -> ${T(V)} (${String(o.length)} scripts)`), c.length > 0 && _.log.info(`Removed stale hook script(s): ${c.join(", ")} (no longer shipped)`);
 	for (let a of C) {
 		let c = e.includes(a);
 		if (!c && !r.has(a)) continue;
-		let l = _(t, y.harnesses[a].hookSettings), u = i.get(a) ?? {}, d = r.get(a) ?? {}, f = ue(d, u, c ? o : []);
+		let l = g(t, v.harnesses[a].hookSettings), u = i.get(a) ?? {}, d = r.get(a) ?? {}, f = pe(d, u, c ? o : []);
 		if (f.added === 0 && f.removed === 0) {
-			c && v.log.info(`Hook registrations already present in ${E(l)}`);
+			c && _.log.info(`Hook registrations already present in ${T(l)}`);
 			continue;
 		}
-		s(h(l), { recursive: !0 }), m(l, JSON.stringify(d, null, 2) + "\n"), n([l]);
+		s(ee(l), { recursive: !0 }), m(l, JSON.stringify(d, null, 2) + "\n"), n([l]);
 		let p = [f.added > 0 && `registered ${String(f.added)}`, f.removed > 0 && `removed ${String(f.removed)} stale`].filter(Boolean);
-		v.log.success(`${p.join(", ")} hook registration(s) in ${E(l)}`);
+		_.log.success(`${p.join(", ")} hook registration(s) in ${T(l)}`);
 	}
 }
 //#endregion
 //#region src/cli/index.ts
+function X(e) {
+	let t = ce(e);
+	if (t) return t;
+	if (!F(e)) return null;
+	let n = C.filter((t) => me(t) || t === "claude" && I(e));
+	return n.length > 0 ? n : ["codex"];
+}
 function Z() {
-	return new te("--harness <harness>", "claude, codex, or all").choices(w);
+	return new ne("--harness <harness>", "claude, codex, or all").choices(ae);
 }
-async function fe(e, t, n) {
-	if (t) return v.log.info(`Harness from --harness flag: ${t.join(", ")}`), t;
-	let r = L(e);
-	if (r && !n) return v.log.info(`Refreshing the existing install: ${r.join(", ")} — pass --reconfigure to choose differently.`), r;
+async function ge(e, t, n) {
+	if (t) return _.log.info(`Harness from --harness flag: ${t.join(", ")}`), t;
+	let r = X(e);
+	if (r && !n) return _.log.info(`Refreshing the existing install: ${r.join(", ")} — pass --reconfigure to choose differently.`), r;
 	if (!process.stdin.isTTY) return console.error("Pass --harness=claude|codex|all — no terminal to prompt in."), process.exitCode = 1, null;
-	let i = await v.multiselect({
+	let i = await _.multiselect({
 		message: "Install into which harness (or harnesses)?",
 		options: C.map((e) => ({
 			value: e,
-			label: y.harnesses[e].label
+			label: v.harnesses[e].label
 		})),
 		required: !0
 	});
-	return v.isCancel(i) ? (v.cancel("Cancelled — nothing installed."), null) : i;
+	return _.isCancel(i) ? (_.cancel("Cancelled — nothing installed."), null) : i;
 }
-async function pe(e) {
-	let t = e.harness ? T(e.harness) : null, n = I();
-	if (v.intro(`@imfusion/web-ui install skills — ${String(n.length)} skills`), n.length === 0) {
-		v.log.error("No skills found. Reinstall @imfusion/web-ui and try again."), v.outro("Nothing installed."), process.exitCode = 1;
+async function _e(e) {
+	let t = e.harness ? w(e.harness) : null, n = P();
+	if (_.intro(`@imfusion/web-ui install skills — ${String(n.length)} skills`), n.length === 0) {
+		_.log.error("No skills found. Reinstall @imfusion/web-ui and try again."), _.outro("Nothing installed."), process.exitCode = 1;
 		return;
 	}
-	let r = await fe(n, t, e.reconfigure === !0);
+	let r = await ge(n, t, e.reconfigure === !0);
 	if (!r) return;
-	v.log.message(`Skills in this bundle:\n${n.map((e) => `  - ${e}`).join("\n")}`);
+	_.log.message(`Skills in this bundle:\n${n.map((e) => `  - ${e}`).join("\n")}`);
 	try {
-		se(n, r);
+		ue(n, r);
 	} catch (e) {
-		if (e instanceof M) {
-			v.log.error(e.message), v.outro("Install failed."), process.exitCode = 1;
+		if (e instanceof j) {
+			_.log.error(e.message), _.outro("Install failed."), process.exitCode = 1;
 			return;
 		}
 		throw e;
 	}
-	let i = ie();
-	(i === "updated" || i === "added") && v.log.success(`Refreshed the ${y.namespace} block in ./AGENTS.md`), v.outro(`Done — ${String(n.length)} skills installed.`);
+	let i = S();
+	(i === "updated" || i === "added") && _.log.success(`Refreshed the ${v.namespace} block in ./AGENTS.md`), _.outro(`Done — ${String(n.length)} skills installed.`);
 }
-function me(e) {
-	let t = e.harness ? T(e.harness) : null, n = L(I());
-	if (!t && !n) {
-		console.error("No harness recorded. Pass --harness=claude|codex|all."), process.exitCode = 1;
+function ve(e) {
+	let t = e.harness ? w(e.harness) : null, n = P(), r = X(n);
+	if (!t && !r) {
+		console.error("No harness detected. Pass --harness=claude|codex|all."), process.exitCode = 1;
 		return;
 	}
-	let r = t ?? n ?? [], i = r.filter((e) => !(n ?? []).includes(e));
-	if (i.length > 0) {
-		for (let e of i) console.error(`No skills installed for ${e}. Run \`npx web-ui install skills --harness=${e}\` first.`);
+	let i = t ?? r ?? [], a = i.filter((e) => e === "claude" ? !I(n) : !F(n));
+	if (a.length > 0) {
+		for (let e of a) console.error(`No skills installed for ${e}. Run \`npx web-ui install skills --harness=${e}\` first.`);
 		process.exitCode = 1;
 	} else {
-		v.intro("@imfusion/web-ui install hooks");
+		_.intro("@imfusion/web-ui install hooks");
 		try {
-			de(r);
+			he(i);
 		} catch (e) {
-			if (e instanceof U) {
+			if (e instanceof H) {
 				console.error(e.message), process.exitCode = 1;
 				return;
 			}
 			throw e;
 		}
-		v.outro("Done — agent hooks installed.");
+		_.outro("Done — agent hooks installed.");
 	}
 }
-var Q = new ee();
-Q.name("web-ui").description("Command-line tools for @imfusion/web-ui").version(P);
+var Q = new te();
+Q.name("web-ui").description("Command-line tools for @imfusion/web-ui").version(oe);
 var $ = Q.command("install").description("Install @imfusion/web-ui agent skills or hooks into a project");
-$.command("skills").description("Install skills for the chosen harness").addOption(Z()).option("--reconfigure", "Re-open the harness selection prompt on an existing install").action(pe), $.command("hooks").description("Install agent lifecycle hooks (requires skills already installed for the harness)").addOption(Z()).action(me), $.action(() => {
+$.command("skills").description("Install skills for the chosen harness").addOption(Z()).option("--reconfigure", "Re-open the harness selection prompt on an existing install").action(_e), $.command("hooks").description("Install agent lifecycle hooks (requires skills already installed for the harness)").addOption(Z()).action(ve), $.action(() => {
 	$.help();
 }), Q.action(() => {
 	Q.help();

package/docs/user-guide/AgentTooling.mdx

@@ -40,8 +40,8 @@ npx web-ui install hooks --harness=all
 | `codex` | Codex, and any agent that reads `.agents/skills/` |
 | `all` | Both |
 
-Without `--harness`, `install skills` prompts once and records the choice, and later runs reuse it. `install hooks` needs the
-skills installed for the same harness first. Leave out the second command to install only the skills.
+Without `--harness`, `install skills` prompts on a first install. Later runs read the harness from the installed skill links
+and hook registrations. `install hooks` needs the skills installed first. Leave out the second command to install only the skills.
 
 `npx web-ui --help` lists the commands, and `--help` on any subcommand lists its options.
 
@@ -79,7 +79,7 @@ The hooks put the agent on the right skill at the right moment and ask it to ver
 
 | Event | What the hook does |
 | --- | --- |
-| `SessionStart` | Points the agent at the router once per session. |
+| `SessionStart` | Points the agent at the router once per session, and tells it when the installed skills differ from the package. |
 | `SubagentStart` | Gives the same pointer to spawned agents. |
 | `UserPromptSubmit` | Names the companion skills relevant to the prompt. |
 | `Stop` | Asks for project verification after a turn edits source files. |
@@ -97,7 +97,7 @@ npx web-ui install skills
 npx web-ui install hooks
 ```
 
-Both reuse the recorded harness. Leave out the second command if the project skips hooks. Together they bring the installed
+Both read the harness from the installed files. Leave out the second command if the project skips hooks. Together they bring the installed
 tooling in line with the package version and remove anything the package no longer ships.
 
 ## Reference

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@imfusion/web-ui",
-  "version": "0.10.1-dev.60.g7891a716",
+  "version": "0.10.1-dev.61.g9d1000b8",
   "description": "The official Web UI component library for ImFusion web apps",
   "author": "ImFusion GmbH",
   "homepage": "https://imfusion.com",

package/src/llms/install-templates/hooks/session-start.sh

@@ -2,4 +2,18 @@
 # SessionStart: inject the web-ui router pointer once per session. Fixed string — the
 # hook-injection eval asserts on it verbatim.
 echo "This project depends on @imfusion/web-ui. Start at the imf-web-ui skill: it decides whether guidance is needed and routes to the right companion. Repo docs carry only what is unique to this repo."
+
+# Installed skills that differ from the package's copy are stale. A symlinked checkout
+# carries work-in-progress skills, so it never counts.
+ROOT=$(cd "$(dirname "$0")/../../.." && pwd) || exit 0
+PACKAGE="$ROOT/node_modules/@imfusion/web-ui"
+[ -d "$PACKAGE/src/llms/skills" ] && [ ! -L "$PACKAGE" ] || exit 0
+for dir in "$PACKAGE"/src/llms/skills/imf-web-ui* "$ROOT"/.agents/skills/imf-web-ui*; do
+  [ -d "$dir" ] || continue
+  name=$(basename "$dir")
+  if ! diff -rq "$PACKAGE/src/llms/skills/$name" "$ROOT/.agents/skills/$name" >/dev/null 2>&1; then
+    echo "The installed imf-web-ui skills differ from the @imfusion/web-ui package in node_modules. Tell the user and offer the imf-web-ui-update skill, or \`npx web-ui install skills\`."
+    break
+  fi
+done
 exit 0

package/src/llms/skills/imf-web-ui-audit/SKILL.md

@@ -96,10 +96,10 @@ UI component or a hard-coded color waiting for a token, is evidence for that top
 ## Agent tooling checks
 
 For `agent-tooling`, compare the declared version in `package.json`, the installed
-`node_modules/@imfusion/web-ui/package.json`, every `.imf-web-ui-skill-version.json` marker, the `AGENTS.md` fence, hook
-scripts, and both host registrations with the shipped topic. Version drift, extra hooks, stale markers, and missing
-registrations are findings; point version drift to `imf-web-ui-update`. Registry availability is unverified. Read files as
-text; do not run installers or hooks.
+`node_modules/@imfusion/web-ui/package.json`, the installed skills against `node_modules/@imfusion/web-ui/src/llms/skills`,
+the `AGENTS.md` fence, hook scripts, and both host registrations with the shipped topic. Version drift, extra hooks, skills
+that differ from the package copy, and missing registrations are findings; point version drift to `imf-web-ui-update`.
+Registry availability is unverified. Read files as text; do not run installers or hooks.
 
 ## Safety
 

package/src/llms/skills/imf-web-ui-conventions/topics/agent-tooling.md

@@ -12,12 +12,13 @@ npx web-ui install skills --harness=claude
 
 It installs or refreshes the `imf-web-ui-*` skills, updates the managed `AGENTS.md` fence, and removes skills that the
 package no longer ships. The skills always live in `.agents/skills/`. `--harness` selects `claude`, which also links each
-skill into `.claude/skills/`, `codex`, or `all`; without it, the command prompts and remembers the choice. Pass
-`--reconfigure` to choose again. On a project that already has an install, re-running `install skills` without `--harness`
-reuses the remembered harness instead of narrowing it.
+skill into `.claude/skills/`, `codex`, or `all`; without it, the command prompts on a first install. Pass `--reconfigure` to
+choose again. On a project that already has an install, re-running `install skills` or `install hooks` without `--harness`
+reads the harness back from the installed files: Claude skill links and installer-owned hook registrations, with Codex
+assumed when skills leave no trace.
 
-Skill version markers (`.imf-web-ui-skill-version.json`) show which package version installed each skill. Refresh them with
-the installer; do not hand-edit the vendored files.
+Refresh the skills with the installer; do not hand-edit them. Keep `.agents/skills/imf-web-ui*` out of the project's
+formatter: a reformatted skill no longer matches the package copy, and the session-start check reports it as stale.
 
 ## The hooks
 
@@ -36,7 +37,8 @@ harness that is not selected.
 
 The shipped events are:
 
-- `SessionStart`: point the agent at the Web UI router once per session.
+- `SessionStart`: point the agent at the Web UI router once per session, and tell it when the installed skills differ from
+  the copy in `node_modules/@imfusion/web-ui`.
 - `SubagentStart`: provide the same pointer to spawned agents.
 - `UserPromptSubmit`: name the companion skills relevant to the prompt.
 - `Stop`: ask for project verification after a turn edits source files.
@@ -44,9 +46,6 @@ The shipped events are:
 Read existing registrations first. If the project already covers an event, do not stack a second hook; adapt the existing
 registration and keep the missing behavior.
 
-`baseline-staleness.sh` is a pre-commit check, not an agent hook. It compares installed skill markers with the installed
-package version.
-
 ## Codex trust
 
 Codex runs project hooks only after the project is trusted and each script is approved through `/hooks`. Revisit that review

package/src/llms/skills/imf-web-ui-conventions/topics/git.md

@@ -28,6 +28,6 @@ The `staged` block and the scripts under `scripts/verify/` own the step lists. H
 
 ## Staleness at commit time
 
-Pre-commit also runs advisory checks for vendored skill markers and documentation drift. If a staged change makes a doc
-stale, update the doc in the same commit. For an outdated installed skill, run `npx web-ui install skills` (also
-`npx web-ui install hooks` if the project uses hooks) with the project's existing `--harness` in the consumer project.
+Pre-commit also runs an advisory check for documentation drift. If a staged change makes a doc stale, update the doc in the
+same commit. Outdated installed skills surface at session start instead, as the `agent-tooling` topic describes; refresh them
+with `npx web-ui install skills` (also `npx web-ui install hooks` if the project uses hooks).

package/src/llms/skills/imf-web-ui-update/SKILL.md

@@ -79,8 +79,9 @@ npx web-ui install skills
 npx web-ui install hooks
 ```
 
-Both commands reuse the recorded harness. An install from the old `web-ui-install` has no record: pass the project's existing
-harness once, e.g. `--harness=all`. Stop on install failure. Do not use `--force` or `--legacy-peer-deps`.
+Both commands read the harness back from the installed files and print it. Codex leaves no trace without hooks, so a Claude
+and Codex install without hooks reads as Claude only; when the printed harness is wrong, pass the project's harness, e.g.
+`--harness=all`. Stop on install failure. Do not use `--force` or `--legacy-peer-deps`.
 
 The installer owns the vendored skills, its `AGENTS.md` fence, and hook scripts. Run the installer commands after the package
 update even when the existing registrations look complete: they refresh scripts, prune retired registrations, and merge
@@ -88,8 +89,7 @@ installer-owned entries idempotently into the registration file for the chosen h
 `.codex/hooks.json`, or both). Stop on malformed settings or installer conflicts. Read existing host registrations first and
 do not stack an event the project already covers.
 
-After the installer command, inspect the installed skill diffs and briefly report any guidance changes; version-marker
-changes alone do not count.
+After the installer command, inspect the installed skill diffs and briefly report any guidance changes.
 
 Then re-read, in full, every changed skill and reference the remaining work uses, starting with this update skill when it
 changed. A diff shows what moved, not the step order you continue under, so it does not replace the re-read. Continue from
@@ -117,7 +117,7 @@ Run the consumer's documented full verification. Read its scripts first; prefer
 non-watch format, lint, typecheck, test, and build commands that exist.
 
 Verify that the installed package, manifest, and lockfile match the recorded target version. A mismatch is a base-update
-conflict. Check skill markers, the `AGENTS.md` fence, hook registrations, and the final update-owned path list.
+conflict. Check the `AGENTS.md` fence, hook registrations, and the final update-owned path list.
 
 Report before the first commit:
 

package/src/llms/install-templates/hooks/baseline-staleness.sh

@@ -1,26 +0,0 @@
-#!/usr/bin/env sh
-# Advisory baseline-staleness check, meant to be called from the repo's pre-commit hook.
-# Compares the installed imf-web-ui skill markers against the installed package version
-# and warns on drift. Always exits 0 — staleness never blocks a commit.
-PKG=node_modules/@imfusion/web-ui/package.json
-[ -f "$PKG" ] || exit 0
-# A symlinked checkout reports its own dev version.
-[ -L node_modules/@imfusion/web-ui ] && exit 0
-CURRENT=$(node -p "require('./$PKG').version" 2>/dev/null) || exit 0
-
-# .claude/skills may be a symlink to .agents/skills; skip markers already read.
-seen=""
-for marker in .agents/skills/imf-web-ui*/.imf-web-ui-skill-version.json .claude/skills/imf-web-ui*/.imf-web-ui-skill-version.json; do
-  [ -f "$marker" ] || continue
-  real=$(cd "$(dirname "$marker")" && pwd -P)/$(basename "$marker")
-  case " $seen " in
-    *" $real "*) continue ;;
-  esac
-  seen="$seen $real"
-  INSTALLED=$(node -p "require('./$marker').version" 2>/dev/null) || continue
-  if [ "$INSTALLED" != "$CURRENT" ]; then
-    echo "imf-web-ui skills are stale ($INSTALLED installed, package is $CURRENT) — run /imf-web-ui-update, or: npx web-ui install skills && npx web-ui install hooks"
-    break
-  fi
-done
-exit 0