@imfusion/web-ui 0.5.1-dev.20.g9170acaf → 0.5.1-dev.21.g2accd17d

package/README.md

@@ -53,15 +53,16 @@ the directories it already installed into, without asking again — `--reconfigu
 
 **Available consumer skills - `/imf-web-ui-*`**
 
-| Skill                              | What it does                                                                  |
-| ---------------------------------- | ----------------------------------------------------------------------------- |
-| `/imf-web-ui`                      | The router: decides whether guidance is needed, then which companion to open. |
-| `/imf-web-ui-library-setup`        | One-time wiring in a consumer project — the styles import and the provider.   |
-| `/imf-web-ui-components`           | Component reference — what exists and how it's meant to be used.              |
-| `/imf-web-ui-ux`                   | UX guidance for building interfaces with the library.                         |
-| `/imf-web-ui-frontend-conventions` | The frontend conventions baseline, including the sanctioned styling seams.    |
-| `/imf-web-ui-frontend-setup`       | Set up or audit an ImFusion frontend's tooling against the house baseline.    |
-| `/imf-web-ui-agent-setup`          | Install or update the vendored skills, agent hooks, and TanStack Intent.      |
+| Skill                              | What it does                                                                   |
+| ---------------------------------- | ------------------------------------------------------------------------------ |
+| `/imf-web-ui`                      | The router: decides whether guidance is needed, then which companion to open.  |
+| `/imf-web-ui-library-setup`        | One-time wiring in a consumer project — the styles import and the provider.    |
+| `/imf-web-ui-components`           | Component reference — what exists and how it's meant to be used.               |
+| `/imf-web-ui-ux`                   | UX guidance for building interfaces with the library.                          |
+| `/imf-web-ui-frontend-conventions` | The frontend conventions baseline, including the sanctioned styling seams.     |
+| `/imf-web-ui-frontend-setup`       | Set up or audit an ImFusion frontend's tooling against the house baseline.     |
+| `/imf-web-ui-agent-setup`          | Install or update the vendored skills, agent hooks, and TanStack Intent.       |
+| `/imf-web-ui-update`               | Update the library, skills, and optional hooks, then verify before committing. |
 
 Start at `/imf-web-ui` — it routes to the rest. Storybook's **User Guide → AI Agents** page covers the whole family.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@imfusion/web-ui",
-  "version": "0.5.1-dev.20.g9170acaf",
+  "version": "0.5.1-dev.21.g2accd17d",
   "description": "The official Web UI component library for ImFusion web apps",
   "author": "ImFusion GmbH",
   "license": "UNLICENSED",

package/src/llms/skills/imf-web-ui-update/SKILL.md

@@ -0,0 +1,119 @@
+---
+name: imf-web-ui-update
+description:
+  "Update @imfusion/web-ui in a consumer repository: refresh the package and vendored skills, audit and optionally install
+  lifecycle hooks, handle conflicts, verify the result, and obtain explicit approval before committing."
+argument-hint: "[--dry-run] [optional version or reason]"
+---
+
+# imf-web-ui-update
+
+Update a repository that consumes `@imfusion/web-ui`. Preserve existing project choices and user work. Never commit without a
+fresh explicit approval.
+
+## Rules
+
+- Work from the frontend package root. In a monorepo, inspect package manifests and `git worktree list` first, then choose
+  the frontend package in the active worktree that uses web-ui. Read repository and component instructions before changing
+  files.
+- Detect the package manager from lockfiles. Use npm for `package-lock.json`, pnpm for `pnpm-lock.yaml`, Yarn for
+  `yarn.lock`, and Bun for `bun.lock*`. If multiple lockfiles exist, stop and ask which is authoritative.
+- A dry run is read-only. Do not install, run the installer, format, stage, commit, reset, or clean. Report what would run.
+- Record the initial `git status --short`. Existing changes are held back, never staged or overwritten.
+- A dirty file that the workflow needs to modify is a conflict. Stop and report it. This includes package files, installed
+  skill directories, the `AGENTS.md` installer fence, hook files, and hook settings.
+- Do not hand-edit installer-owned skills, the `AGENTS.md` fenced block, or installer-owned hook files.
+
+## Preflight
+
+1. Select the frontend package in the active worktree and read its instructions, `package.json`, and lockfile.
+2. Check whether `@imfusion/web-ui` is already declared and record its installed/version-marker version.
+3. Record the worktree status and identify files the update would touch.
+4. Inspect `.agents/skills/`, `.claude/skills/`, the `AGENTS.md` fence, `.claude/settings.json`, and `.agents/hooks/`.
+5. Check for another package-manager process. Stop on any conflict or ambiguous target.
+
+## Update
+
+In a non-dry run, update the dependency with the detected manager:
+
+```sh
+npm install @imfusion/web-ui
+```
+
+Use the equivalent command for another detected manager. Pass an explicit version only when the user supplied one. Do not use
+`--force` or `--legacy-peer-deps` to make installation pass. Stop on install failure.
+
+Then refresh the existing web-ui skill target:
+
+```sh
+npx web-ui-install --skills
+```
+
+Use the detected manager's runner for non-npm projects. Preserve the existing target (`.agents`, `.claude`, or both); do not
+silently choose a new one. Stop on malformed settings or installer conflicts.
+
+## Hook audit
+
+Audit these responsibilities separately: session start, prompt submit, and post-edit verification.
+
+- If current web-ui hooks cover a responsibility, do not reinstall it.
+- If no equivalent hook exists and the installer-owned destination is clean, ask whether to run:
+
+  ```sh
+  npx web-ui-install --hooks
+  ```
+
+  Run it only after the user accepts. Use the detected runner otherwise.
+
+- If another hook covers a responsibility, do not stack a duplicate. Report the overlap and ask whether to leave hooks alone
+  or adapt the existing hook in a separate approved change.
+- Invalid settings or dirty installer-owned hook files are conflicts. Stop and ask for resolution.
+
+A declined hook offer is valid. Report `hooks: skipped by user` and continue.
+
+## Conflict and verification
+
+After each mutating command, compare `git status --short` with the preflight snapshot.
+
+Classify paths as:
+
+- **Update-owned:** package files and installer-owned files changed by this workflow.
+- **Held back:** pre-existing user changes, excluded from the commit.
+- **Conflict:** an overlapping pre-existing change, ambiguous target, or unexpected changed path.
+
+On conflict, stop. Never use `git restore`, `git reset`, `git clean`, or broad staging to hide it.
+
+Run only scripts documented by the frontend's `package.json`. Verify the dependency/lockfile, current skill markers, the
+`AGENTS.md` fence, hook coverage, and the final path list. In dry-run mode, say that mutation-dependent checks were skipped.
+
+## Report and approval
+
+Before any commit, show this concise report:
+
+```text
+@imfusion/web-ui update report
+Package      : <old> -> <new> / would update
+Skills       : <status>
+Hooks        : <status>
+Verification : <status>
+Update files : <paths>
+Held back    : <paths or none>
+Conflicts    : <paths or none>
+Commit       : <imperative message or not proposed>
+```
+
+Normal mode: ask exactly, **“Approve these update-owned changes and commit them?”** Do not commit without an affirmative
+answer. If denied, leave the changes uncommitted.
+
+Dry-run mode: state **“Dry run complete; no changes or commit were made.”** Do not mutate or ask for commit approval.
+
+## Commit
+
+After approval:
+
+1. Recheck status and exclude held-back paths.
+2. Stage update-owned paths selectively. Never use `git add .` or `git add -A`.
+3. Run the repository's commit workflow if it has one, including its required verification and documentation audit. Otherwise
+   run documented verification and follow the repository's commit convention.
+4. Commit with a concise imperative message and confirm the commit and final status. Never bypass hooks or amend an unrelated
+   commit after a hook failure.