@kontextmind/kxm 0.7.174 → 0.7.176

package/plugins/kxm/dist/extension.js

@@ -33758,6 +33758,9 @@ var Protocol = class {
       this.setRequestHandler(GetTaskPayloadRequestSchema, async (request, extra) => {
         const handleTaskResult = async () => {
           const taskId = request.params.taskId;
+          if (!await this._taskStore.getTask(taskId, extra.sessionId)) {
+            throw new McpError(ErrorCode.InvalidParams, `Task not found: ${taskId}`);
+          }
           if (this._taskMessageQueue) {
             let queuedMessage;
             while (queuedMessage = await this._taskMessageQueue.dequeue(taskId, extra.sessionId)) {
@@ -33788,12 +33791,12 @@ var Protocol = class {
             throw new McpError(ErrorCode.InvalidParams, `Task not found: ${taskId}`);
           }
           if (!isTerminal(task.status)) {
-            await this._waitForTaskUpdate(taskId, extra.signal);
+            await this._waitForTaskUpdate(taskId, extra.signal, extra.sessionId);
             return await handleTaskResult();
           }
           if (isTerminal(task.status)) {
             const result2 = await this._taskStore.getTaskResult(taskId, extra.sessionId);
-            this._clearTaskQueue(taskId);
+            this._clearTaskQueue(taskId, extra.sessionId);
             return {
               ...result2,
               _meta: {
@@ -33830,7 +33833,7 @@ var Protocol = class {
             throw new McpError(ErrorCode.InvalidParams, `Cannot cancel task in terminal status: ${task.status}`);
           }
           await this._taskStore.updateTaskStatus(request.params.taskId, "cancelled", "Client cancelled task execution.", extra.sessionId);
-          this._clearTaskQueue(request.params.taskId);
+          this._clearTaskQueue(request.params.taskId, extra.sessionId);
           const cancelledTask = await this._taskStore.getTask(request.params.taskId, extra.sessionId);
           if (!cancelledTask) {
             throw new McpError(ErrorCode.InvalidParams, `Task not found after cancellation: ${request.params.taskId}`);
@@ -33958,6 +33961,19 @@ var Protocol = class {
     const handler = this._requestHandlers.get(request.method) ?? this.fallbackRequestHandler;
     const capturedTransport = this._transport;
     const relatedTaskId = request.params?._meta?.[RELATED_TASK_META_KEY]?.taskId;
+    const sessionId = capturedTransport?.sessionId;
+    const store = this._taskStore;
+    let relatedTaskFound = true;
+    let relatedTaskLookup;
+    if (relatedTaskId && store && this._taskMessageQueue && sessionId !== void 0) {
+      relatedTaskFound = false;
+      relatedTaskLookup = (async () => {
+        if (!await store.getTask(relatedTaskId, sessionId)) {
+          throw new McpError(ErrorCode.InvalidParams, `Task not found: ${relatedTaskId}`);
+        }
+        relatedTaskFound = true;
+      })();
+    }
     if (handler === void 0) {
       const errorResponse = {
         jsonrpc: "2.0",
@@ -33967,7 +33983,10 @@ var Protocol = class {
           message: "Method not found"
         }
       };
-      if (relatedTaskId && this._taskMessageQueue) {
+      if (relatedTaskId && relatedTaskLookup) {
+        const queuedError = { type: "error", message: errorResponse, timestamp: Date.now() };
+        relatedTaskLookup.then(() => this._enqueueTaskMessage(relatedTaskId, queuedError, sessionId), () => capturedTransport?.send(errorResponse)).catch((error2) => this._onerror(new Error(`Failed to send an error response: ${error2}`)));
+      } else if (relatedTaskId && this._taskMessageQueue) {
         this._enqueueTaskMessage(relatedTaskId, {
           type: "error",
           message: errorResponse,
@@ -34018,7 +34037,10 @@ var Protocol = class {
       closeSSEStream: extra?.closeSSEStream,
       closeStandaloneSSEStream: extra?.closeStandaloneSSEStream
     };
-    Promise.resolve().then(() => {
+    (relatedTaskLookup ?? Promise.resolve()).then(() => {
+      if (relatedTaskLookup && abortController.signal.aborted) {
+        throw new McpError(ErrorCode.ConnectionClosed, "Request was cancelled");
+      }
       if (taskCreationParams) {
         this.assertTaskHandlerCapability(request.method);
       }
@@ -34053,7 +34075,7 @@ var Protocol = class {
           ...error2["data"] !== void 0 && { data: error2["data"] }
         }
       };
-      if (relatedTaskId && this._taskMessageQueue) {
+      if (relatedTaskId && this._taskMessageQueue && relatedTaskFound) {
         await this._enqueueTaskMessage(relatedTaskId, {
           type: "error",
           message: errorResponse,
@@ -34533,7 +34555,7 @@ var Protocol = class {
       throw new Error("Cannot enqueue task message: taskStore and taskMessageQueue are not configured");
     }
     const maxQueueSize = this._options?.maxTaskQueueSize;
-    await this._taskMessageQueue.enqueue(taskId, message, sessionId, maxQueueSize);
+    await this._taskMessageQueue.enqueue(taskId, message, sessionId ?? this._transport?.sessionId, maxQueueSize);
   }
   /**
    * Clears the message queue for a task and rejects any pending request resolvers.
@@ -34562,12 +34584,13 @@ var Protocol = class {
    * Uses polling to check for updates at the task's configured poll interval.
    * @param taskId The task ID to wait for
    * @param signal Abort signal to cancel the wait
+   * @param sessionId Session of the request that waits, passed to the task store
    * @returns Promise that resolves when an update occurs or rejects if aborted
    */
-  async _waitForTaskUpdate(taskId, signal) {
+  async _waitForTaskUpdate(taskId, signal, sessionId) {
     let interval = this._options?.defaultTaskPollInterval ?? 1e3;
     try {
-      const task = await this._taskStore?.getTask(taskId);
+      const task = await this._taskStore?.getTask(taskId, sessionId);
       if (task?.pollInterval) {
         interval = task.pollInterval;
       }
@@ -35446,6 +35469,42 @@ var ExperimentalMcpServerTasks = class {
 };
 
 // node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js
+function toolInputElementCount(value, max) {
+  let count = 0;
+  const stack = [value];
+  while (stack.length > 0) {
+    const node = stack.pop();
+    if (node === null || typeof node !== "object")
+      continue;
+    if (Array.isArray(node)) {
+      for (const child of node) {
+        if (++count > max)
+          return count;
+        if (child !== null && typeof child === "object")
+          stack.push(child);
+      }
+    } else {
+      for (const key in node) {
+        if (!Object.prototype.hasOwnProperty.call(node, key))
+          continue;
+        if (++count > max)
+          return count;
+        const child = node[key];
+        if (child !== null && typeof child === "object")
+          stack.push(child);
+      }
+    }
+  }
+  return count;
+}
+function resolveMaxToolInputElements(value) {
+  if (value === void 0 || value === Infinity)
+    return void 0;
+  if (typeof value !== "number" || Number.isNaN(value) || value < 1) {
+    throw new RangeError(`maxToolInputElements must be a number of at least 1, or Infinity, got ${String(value)}`);
+  }
+  return value;
+}
 var McpServer = class {
   constructor(serverInfo, options) {
     this._registeredResources = {};
@@ -35457,6 +35516,7 @@ var McpServer = class {
     this._resourceHandlersInitialized = false;
     this._promptHandlersInitialized = false;
     this.server = new Server(serverInfo, options);
+    this._maxToolInputElements = resolveMaxToolInputElements(options?.maxToolInputElements);
   }
   /**
    * Access experimental features.
@@ -35587,12 +35647,15 @@ var McpServer = class {
    * Validates tool input arguments against the tool's input schema.
    */
   async validateToolInput(tool, args, toolName) {
+    if (this._maxToolInputElements !== void 0 && toolInputElementCount(args, this._maxToolInputElements) > this._maxToolInputElements) {
+      throw new McpError(ErrorCode.InvalidParams, `Invalid arguments for tool ${toolName}: arguments contain more than the maximum of ${this._maxToolInputElements} elements`);
+    }
     if (!tool.inputSchema) {
       return void 0;
     }
     const inputObj = normalizeObjectSchema(tool.inputSchema);
     const schemaToParse = inputObj ?? tool.inputSchema;
-    const parseResult = await safeParseAsync2(schemaToParse, args);
+    const parseResult = await safeParseAsync2(schemaToParse, args ?? {});
     if (!parseResult.success) {
       const error2 = "error" in parseResult ? parseResult.error : "Unknown error";
       const errorMessage = getParseErrorMessage(error2);
@@ -35830,7 +35893,7 @@ var McpServer = class {
       }
       if (prompt.argsSchema) {
         const argsObj = normalizeObjectSchema(prompt.argsSchema);
-        const parseResult = await safeParseAsync2(argsObj, request.params.arguments);
+        const parseResult = await safeParseAsync2(argsObj, request.params.arguments ?? {});
         if (!parseResult.success) {
           const error2 = "error" in parseResult ? parseResult.error : "Unknown error";
           const errorMessage = getParseErrorMessage(error2);

package/plugins/kxm/dist/mcp-server.js

@@ -21387,6 +21387,9 @@ var Protocol = class {
       this.setRequestHandler(GetTaskPayloadRequestSchema, async (request, extra) => {
         const handleTaskResult = async () => {
           const taskId = request.params.taskId;
+          if (!await this._taskStore.getTask(taskId, extra.sessionId)) {
+            throw new McpError(ErrorCode.InvalidParams, `Task not found: ${taskId}`);
+          }
           if (this._taskMessageQueue) {
             let queuedMessage;
             while (queuedMessage = await this._taskMessageQueue.dequeue(taskId, extra.sessionId)) {
@@ -21417,12 +21420,12 @@ var Protocol = class {
             throw new McpError(ErrorCode.InvalidParams, `Task not found: ${taskId}`);
           }
           if (!isTerminal(task.status)) {
-            await this._waitForTaskUpdate(taskId, extra.signal);
+            await this._waitForTaskUpdate(taskId, extra.signal, extra.sessionId);
             return await handleTaskResult();
           }
           if (isTerminal(task.status)) {
             const result = await this._taskStore.getTaskResult(taskId, extra.sessionId);
-            this._clearTaskQueue(taskId);
+            this._clearTaskQueue(taskId, extra.sessionId);
             return {
               ...result,
               _meta: {
@@ -21459,7 +21462,7 @@ var Protocol = class {
             throw new McpError(ErrorCode.InvalidParams, `Cannot cancel task in terminal status: ${task.status}`);
           }
           await this._taskStore.updateTaskStatus(request.params.taskId, "cancelled", "Client cancelled task execution.", extra.sessionId);
-          this._clearTaskQueue(request.params.taskId);
+          this._clearTaskQueue(request.params.taskId, extra.sessionId);
           const cancelledTask = await this._taskStore.getTask(request.params.taskId, extra.sessionId);
           if (!cancelledTask) {
             throw new McpError(ErrorCode.InvalidParams, `Task not found after cancellation: ${request.params.taskId}`);
@@ -21587,6 +21590,19 @@ var Protocol = class {
     const handler = this._requestHandlers.get(request.method) ?? this.fallbackRequestHandler;
     const capturedTransport = this._transport;
     const relatedTaskId = request.params?._meta?.[RELATED_TASK_META_KEY]?.taskId;
+    const sessionId = capturedTransport?.sessionId;
+    const store = this._taskStore;
+    let relatedTaskFound = true;
+    let relatedTaskLookup;
+    if (relatedTaskId && store && this._taskMessageQueue && sessionId !== void 0) {
+      relatedTaskFound = false;
+      relatedTaskLookup = (async () => {
+        if (!await store.getTask(relatedTaskId, sessionId)) {
+          throw new McpError(ErrorCode.InvalidParams, `Task not found: ${relatedTaskId}`);
+        }
+        relatedTaskFound = true;
+      })();
+    }
     if (handler === void 0) {
       const errorResponse = {
         jsonrpc: "2.0",
@@ -21596,7 +21612,10 @@ var Protocol = class {
           message: "Method not found"
         }
       };
-      if (relatedTaskId && this._taskMessageQueue) {
+      if (relatedTaskId && relatedTaskLookup) {
+        const queuedError = { type: "error", message: errorResponse, timestamp: Date.now() };
+        relatedTaskLookup.then(() => this._enqueueTaskMessage(relatedTaskId, queuedError, sessionId), () => capturedTransport?.send(errorResponse)).catch((error2) => this._onerror(new Error(`Failed to send an error response: ${error2}`)));
+      } else if (relatedTaskId && this._taskMessageQueue) {
         this._enqueueTaskMessage(relatedTaskId, {
           type: "error",
           message: errorResponse,
@@ -21647,7 +21666,10 @@ var Protocol = class {
       closeSSEStream: extra?.closeSSEStream,
       closeStandaloneSSEStream: extra?.closeStandaloneSSEStream
     };
-    Promise.resolve().then(() => {
+    (relatedTaskLookup ?? Promise.resolve()).then(() => {
+      if (relatedTaskLookup && abortController.signal.aborted) {
+        throw new McpError(ErrorCode.ConnectionClosed, "Request was cancelled");
+      }
       if (taskCreationParams) {
         this.assertTaskHandlerCapability(request.method);
       }
@@ -21682,7 +21704,7 @@ var Protocol = class {
           ...error2["data"] !== void 0 && { data: error2["data"] }
         }
       };
-      if (relatedTaskId && this._taskMessageQueue) {
+      if (relatedTaskId && this._taskMessageQueue && relatedTaskFound) {
         await this._enqueueTaskMessage(relatedTaskId, {
           type: "error",
           message: errorResponse,
@@ -22162,7 +22184,7 @@ var Protocol = class {
       throw new Error("Cannot enqueue task message: taskStore and taskMessageQueue are not configured");
     }
     const maxQueueSize = this._options?.maxTaskQueueSize;
-    await this._taskMessageQueue.enqueue(taskId, message, sessionId, maxQueueSize);
+    await this._taskMessageQueue.enqueue(taskId, message, sessionId ?? this._transport?.sessionId, maxQueueSize);
   }
   /**
    * Clears the message queue for a task and rejects any pending request resolvers.
@@ -22191,12 +22213,13 @@ var Protocol = class {
    * Uses polling to check for updates at the task's configured poll interval.
    * @param taskId The task ID to wait for
    * @param signal Abort signal to cancel the wait
+   * @param sessionId Session of the request that waits, passed to the task store
    * @returns Promise that resolves when an update occurs or rejects if aborted
    */
-  async _waitForTaskUpdate(taskId, signal) {
+  async _waitForTaskUpdate(taskId, signal, sessionId) {
     let interval = this._options?.defaultTaskPollInterval ?? 1e3;
     try {
-      const task = await this._taskStore?.getTask(taskId);
+      const task = await this._taskStore?.getTask(taskId, sessionId);
       if (task?.pollInterval) {
         interval = task.pollInterval;
       }
@@ -25438,7 +25461,7 @@ function sessionTokenFixHint(policy) {
 }
 
 // plugins/kxm/src/mcp-server.ts
-var VERSION = "0.7.174";
+var VERSION = "0.7.176";
 var CONFIGURE_PLUGIN = "/plugin configure kxm@kxm";
 var inbox = /* @__PURE__ */ new Map();
 var notifiedInbox = /* @__PURE__ */ new Set();

package/plugins/kxm/dist/runtime.js

@@ -17298,8 +17298,17 @@ function argsFor(entry, scope) {
   if (scope === "extensions") return entry.update.extensions;
   return entry.update.models;
 }
+function detectedHarnesses(inventory, requestedHarness) {
+  if (requestedHarness) return inventory.harnesses.filter((entry) => entry.id === requestedHarness);
+  const detected = inventory.harnesses.filter((entry) => entry.detected);
+  const preferred = inventory.defaultHarness;
+  return [
+    ...detected.filter((entry) => entry.id === preferred),
+    ...detected.filter((entry) => entry.id !== preferred)
+  ];
+}
 function planHarnessUpdate(inventory, requested) {
-  const selected = requested.harness ? inventory.harnesses.filter((entry) => entry.id === requested.harness) : inventory.harnesses.filter((entry) => entry.detected);
+  const selected = detectedHarnesses(inventory, requested.harness);
   if (requested.harness && selected.length === 0) {
     return [{
       harness: requested.harness,
@@ -17310,36 +17319,44 @@ function planHarnessUpdate(inventory, requested) {
       detail: isKnownHarnessId(requested.harness) ? "not_detected" : "unknown_harness"
     }];
   }
+  const waves = requested.scope === "all" ? ["self", "extensions", "models"] : [requested.scope];
   const steps = [];
-  for (const status of selected) {
-    const entry = BUILTIN_HARNESSES.find((candidate) => candidate.id === status.id);
-    if (!entry) continue;
-    const scopes = scopesFor(requested.scope, entry);
-    if (scopes.length === 0) {
-      steps.push({
-        harness: status.id,
-        scope: requested.scope === "all" ? "self" : requested.scope,
-        command: status.command ?? entry.commands[0],
-        args: [],
-        outcome: "skipped",
-        detail: "no_updater"
-      });
-      continue;
-    }
-    if (!status.detected || !status.command) {
+  for (const scope of waves) {
+    for (const status of selected) {
+      const entry = BUILTIN_HARNESSES.find((candidate) => candidate.id === status.id);
+      if (!entry) continue;
+      const supported = scopesFor(requested.scope === "all" ? "all" : scope, entry);
+      if (!supported.includes(scope)) {
+        if (requested.scope !== "all") {
+          steps.push({
+            harness: status.id,
+            scope,
+            command: status.command ?? entry.commands[0],
+            args: [],
+            outcome: "skipped",
+            detail: "no_updater"
+          });
+        }
+        continue;
+      }
+      if (!status.detected || !status.command) {
+        steps.push({
+          harness: status.id,
+          scope,
+          command: entry.commands[0],
+          args: argsFor(entry, scope) ?? [],
+          outcome: "skipped",
+          detail: "not_detected"
+        });
+        continue;
+      }
       steps.push({
         harness: status.id,
-        scope: scopes[0],
-        command: entry.commands[0],
-        args: argsFor(entry, scopes[0]) ?? [],
-        outcome: "skipped",
-        detail: "not_detected"
+        scope,
+        command: status.command,
+        args: argsFor(entry, scope) ?? [],
+        outcome: "would"
       });
-      continue;
-    }
-    for (const scope of scopes) {
-      const args = argsFor(entry, scope) ?? [];
-      steps.push({ harness: status.id, scope, command: status.command, args, outcome: "would" });
     }
   }
   return steps;

package/plugins/kxm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-plugin",
-  "version": "0.7.174",
+  "version": "0.7.176",
   "private": true,
   "type": "module",
   "engines": {

package/plugins/kxm/skills/kxm-harness-auth/SKILL.md

@@ -34,15 +34,20 @@ still blocks the tools.
 | Command | Purpose |
 |---|---|
 | `kxm update --check` | Check for a kxm package update without applying it |
-| `kxm update --kxm` | Apply the kxm package update |
+| `kxm update` / `--all` | Harness `--self` first, then kxm, extensions, and models |
+| `kxm update --kxm` | Apply only the kxm package update |
 | `kxm update [harness] --self` | Update only the harness CLI |
 | `kxm update [harness] --extensions` | Update only extensions and plugins (Pi packages, the Claude kxm plugin) |
 | `kxm update [harness] --models` | Refresh model catalogs where the harness supports it |
 
-- `kxm update --kxm` downloads the GitHub release tarball by default. It uses
-  `gh` when that CLI answers `gh --version`, and otherwise curl with the same
+- Bare `kxm update` (and `--all`) updates detected harness CLIs first, then kxm,
+  then extensions and models. `--kxm` is kxm-only. kxm installs from npm by default;
+  it needs an authenticated `gh` only when `update.yaml` sets `source: github`.
+  It uses `gh` when that CLI answers `gh --version`, and otherwise curl with the same
   sha256 check. A host with neither can follow the curl commands in
   docs/operations/upgrade.md.
+  Inside the kxm repository it installs the local files. Detected harness updater
+  failures on `--all` are degraded, not fatal.
 - `kxm update claude --extensions` updates only a user-scope plugin install;
   its dry run prints `claude extensions: would claude plugin update kxm -y`.
   A project-scope install is the operator's `claude plugin update kxm@kxm --scope project`.

package/plugins/kxm/src/cli/system.ts

@@ -68,6 +68,7 @@ import {
 } from "../init-guide-setup.ts";
 import {
   classifyInstallRoot,
+  kxmSourceCheckoutRoot,
   resolveInstallKind,
   type InstallKindReport,
   type InstallProbe,
@@ -161,7 +162,7 @@ export function applyKxmPackageUpdate(runtime: Runtime, notice: KxmUpdateNotice)
   const releaseDir = mkdtempSync(join(tmpdir(), "kxm-pkg-update-"));
   try {
     const downloader = notice.source === "github" && !ghReleaseDownloadAvailable(runtime.env) ? "curl" : "gh";
-    const planned = planKxmPackageUpdate(notice.source, notice.latest, releaseDir, notice.asset, downloader);
+    const planned = planKxmPackageUpdate(notice.source, notice.latest, releaseDir, notice.asset, downloader, notice.localRoot);
     if (runtime.dryRun) {
       return { ok: true, detail: planned.map(formatPackageUpdateStep).join(" && ") };
     }
@@ -309,14 +310,15 @@ export async function cmdUpdate(runtime: Runtime, harness: string | undefined, o
   models?: boolean | undefined;
   check?: boolean | undefined;
   kxm?: boolean | undefined;
+  all?: boolean | undefined;
 }): Promise<number> {
-  if (options.check && (options.kxm || options.self || options.extensions || options.models || harness)) {
+  if (options.check && (options.kxm || options.self || options.extensions || options.models || options.all || harness)) {
     print(runtime.io, runtime.json, { ok: false, command: "update", error: "scope_conflict" }, "--check cannot be combined with other update flags");
     return 2;
   }
-  const selected = [options.self, options.extensions, options.models].filter(Boolean).length;
+  const selected = [options.self, options.extensions, options.models, options.all].filter(Boolean).length;
   if (selected > 1) {
-    print(runtime.io, runtime.json, { ok: false, command: "update", error: "scope_conflict" }, "specify at most one of --self, --extensions, or --models");
+    print(runtime.io, runtime.json, { ok: false, command: "update", error: "scope_conflict" }, "specify at most one of --all, --self, --extensions, or --models");
     return 2;
   }
   warnIgnoredProjectUpdateYaml(runtime);
@@ -328,10 +330,24 @@ export async function cmdUpdate(runtime: Runtime, harness: string | undefined, o
   // `cd ~ && kxm update --kxm` into an uncaught ENOENT on `$HOME/package.json`,
   // and would happily compare a stranger project's version wherever one did
   // exist. Unreadable is now a stated refusal.
+  // Exception: a cwd that *is* this repository (`@kontextmind/kxm` plus `.git`)
+  // is a local-files apply, not a stranger version compare.
   const current = installedKxmVersion(classified.root) ?? installedKxmVersion(findKxmRepoRoot(import.meta.url));
+  const localRoot = kxmSourceCheckoutRoot(runtime.dirs.workdir) ?? kxmSourceCheckoutRoot(runtime.cwd);
   let notice: KxmUpdateNotice;
   let kindReport = classified;
-  if (classified.kind === "source") {
+  if (localRoot) {
+    const localVersion = installedKxmVersion(localRoot) ?? current ?? "unknown";
+    notice = {
+      current: current ?? localVersion,
+      latest: localVersion,
+      available: true,
+      auto: false,
+      source: "local",
+      message: `kxm ${current ?? localVersion} (local ${localRoot})`,
+      localRoot,
+    };
+  } else if (classified.kind === "source") {
     if (options.check) {
       const message = `kxm ${current ?? "unknown"} (running from source at ${classified.root})`;
       print(runtime.io, runtime.json, {
@@ -340,7 +356,7 @@ export async function cmdUpdate(runtime: Runtime, harness: string | undefined, o
         current: current ?? "unknown",
         available: false,
         auto: false,
-        source: "github",
+        source: "npm",
         installKind: "source",
         root: classified.root,
         message,
@@ -362,7 +378,7 @@ export async function cmdUpdate(runtime: Runtime, harness: string | undefined, o
       current: current ?? "unknown",
       available: false,
       auto: false,
-      source: "github",
+      source: "npm",
       message: `kxm ${current ?? "unknown"} (running from source)`,
     };
   } else {
@@ -385,13 +401,30 @@ export async function cmdUpdate(runtime: Runtime, harness: string | undefined, o
     }, notice.message);
     return 0;
   }
-  const applyKxm = Boolean(options.kxm || notice.auto);
+  const fullUpdate = Boolean(options.all) || (selected === 0 && !options.kxm && !harness);
+  const applyKxm = Boolean(options.kxm || fullUpdate || notice.auto);
   let kxmApply: { ok: boolean; detail: string; error?: string } | undefined;
-  if (applyKxm) {
+  const applyKxmPackage = (requireSuccess: boolean): number | undefined => {
+    if (!applyKxm) return undefined;
+    if (notice.source === "local" && notice.localRoot) {
+      kxmApply = applyKxmPackageUpdate(runtime, notice);
+      if (!kxmApply.ok && requireSuccess) {
+        print(runtime.io, runtime.json, {
+          ok: false,
+          command: "update",
+          error: kxmApply.error,
+          kxm: kxmApply,
+          notice,
+          ...installKindPayload(classified),
+        }, kxmApply.detail);
+        return 1;
+      }
+      return undefined;
+    }
     const resolved = resolveInstallKind(probe, npmGlobalRootFn(runtime));
     kindReport = resolved;
     if (resolved.kind !== "npm-global") {
-      if (options.kxm) {
+      if (requireSuccess) {
         print(runtime.io, runtime.json, {
           ok: false,
           command: "update",
@@ -404,9 +437,11 @@ export async function cmdUpdate(runtime: Runtime, harness: string | undefined, o
         return 2;
       }
       if (notice.available) runtime.io.stderr(`kxm: ${resolved.instruction}\n`);
-    } else if (notice.available) {
+      return undefined;
+    }
+    if (notice.available) {
       kxmApply = applyKxmPackageUpdate(runtime, notice);
-      if (!kxmApply.ok && options.kxm) {
+      if (!kxmApply.ok && requireSuccess) {
         print(runtime.io, runtime.json, {
           ok: false,
           command: "update",
@@ -418,9 +453,12 @@ export async function cmdUpdate(runtime: Runtime, harness: string | undefined, o
         return 1;
       }
     }
-  }
-  const skipHarness = Boolean(options.kxm && selected === 0 && !harness && !notice.auto);
+    return undefined;
+  };
+  const skipHarness = Boolean(options.kxm && !fullUpdate && selected === 0 && !harness && !notice.auto);
   if (skipHarness) {
+    const aborted = applyKxmPackage(true);
+    if (aborted !== undefined) return aborted;
     print(
       runtime.io,
       runtime.json,
@@ -431,23 +469,39 @@ export async function cmdUpdate(runtime: Runtime, harness: string | undefined, o
   }
   const scope: HarnessUpdateScope = options.self ? "self" : options.extensions ? "extensions" : options.models ? "models" : "all";
   const inventory = await probeHarnessesAsync({ env: runtime.env });
-  const planned = planHarnessUpdate(inventory, { ...(harness ? { harness } : {}), scope });
-  const steps = runHarnessUpdate(planned, { env: runtime.env, dryRun: runtime.dryRun });
-  const failed = steps.some((step) => step.outcome === "failed") || kxmApply?.ok === false;
+  const planned = planHarnessUpdate(inventory, { ...(harness ? { harness } : {}), scope: fullUpdate ? "all" : scope });
+  const runOpts = { env: runtime.env, dryRun: runtime.dryRun };
+  let steps;
+  if (fullUpdate) {
+    const selfSteps = runHarnessUpdate(planned.filter((step) => step.scope === "self"), runOpts);
+    applyKxmPackage(false);
+    const restSteps = runHarnessUpdate(planned.filter((step) => step.scope !== "self"), runOpts);
+    steps = [...selfSteps, ...restSteps];
+  } else {
+    const aborted = applyKxmPackage(Boolean(options.kxm));
+    if (aborted !== undefined) return aborted;
+    steps = runHarnessUpdate(planned, runOpts);
+  }
+  const kxmFailed = kxmApply?.ok === false;
   const skippedUnknown = steps.some((step) => step.detail === "unknown_harness");
+  const harnessFailed = steps.some((step) => step.outcome === "failed");
   const text = [notice.available ? notice.message : undefined, kxmApply?.detail, formatHarnessUpdate(steps)].filter(Boolean).join("\n");
   print(runtime.io, runtime.json, {
-    ok: !failed && !skippedUnknown,
+    ok: !kxmFailed && !skippedUnknown,
     command: "update",
     dryRun: runtime.dryRun,
-    scope,
+    scope: fullUpdate ? "all" : scope,
+    defaultHarness: inventory.defaultHarness,
     notice,
     ...(kxmApply ? { kxm: kxmApply } : {}),
     steps,
+    ...(harnessFailed ? { degraded: true } : {}),
     ...installKindPayload(kindReport),
   }, text);
   if (skippedUnknown) return 2;
-  return failed ? 1 : 0;
+  if (kxmFailed) return 1;
+  if (harnessFailed && !fullUpdate) return 1;
+  return 0;
 }
 
 export async function cmdValidate(runtime: Runtime, fileFlag?: string | undefined): Promise<number> {

package/plugins/kxm/src/cli.ts

@@ -788,8 +788,9 @@ function createProgram(ctx: CliContext, result: { code: number }, argv: readonly
   addGlobalOptions(program.command("update").description("Update kxm, harness CLIs, extensions, plugins, and model catalogs")
     .argument("[harness]", "Harness id (default: every detected harness)")
     .option("--check", "Check for a kxm package update without applying")
-    .option("--kxm", "Apply the kxm operator package update (GitHub release tarball or npm)")
-    .option("--self", "Update only the harness CLI")
+    .option("--all", "Update harness CLIs first (--self), then kxm, extensions, and models (default)")
+    .option("--kxm", "Apply only the kxm operator package update")
+    .option("--self", "Update only harness CLIs")
     .option("--extensions", "Update only extensions/plugins (Pi packages, Claude kxm)")
     .option("--models", "Refresh model catalogs where the harness supports it"))
     .action(async function updateAction(this: Command, harness: string | undefined, options: {
@@ -798,6 +799,7 @@ function createProgram(ctx: CliContext, result: { code: number }, argv: readonly
       models?: boolean;
       check?: boolean;
       kxm?: boolean;
+      all?: boolean;
     }) {
       result.code = await cmdUpdate(runtimeFrom(ctx, this), harness, options);
     });