@petercjl/codex-own 0.6.3 → 0.6.5

package/skills/codex-own/SKILL.md

@@ -20,6 +20,12 @@ For installation-only acceptance, verify doctor, version, target and shortcut wi
 
 Desktop builds with the bundled npm updater check stable latest 15 seconds after startup and every six hours. The user-facing menu is 更新 → 检查 codex-own 更新…. Download runs while the app remains usable; 重启并安装 asks the user to end active tasks, then an independent helper waits for exit, backs up and replaces the app. The helper uses bundled Node and npm payloads, so daily in-app updates do not require updating global npm tooling. Inspect the installed app's own updater version separately from the global CLI version. Retain CLI step 3 for older builds and recovery. Prepared, verified downloads survive restarts; offline checks preserve the current installation. Install logs and unique result records live under the independent manager directory; never delete locks to bypass a failed update.
 
+## Update cleanup (contract 1)
+
+Desktop 0.6.4+ confirms a matching managed installation only after its main interface loads and remains alive for 30 seconds. It then automatically reclaims applied archives and completed inactive helpers, retires superseded successful app/data backup pairs while preserving the latest complete rollback, and evicts least recently used unpinned content blocks above the default 2 GiB cache limit. Pending or failed updates retain their files and needed blocks; unknown receipts protect the cache conservatively and can temporarily exceed the limit. Live configuration, credentials, conversations and private tool versions remain outside cleanup.
+
+For a cleanup request, inspect `codex-own cleanup plan` first. With authorization covering removal of obsolete managed update files and older backups, use `codex-own cleanup run --yes`; the app may remain open. `--cache-limit-mib <0..16384>` optionally changes that invocation's limit. Return to main-line verification with reclaimed bytes, retained rollback, warnings and report path. A deferred result such as HEALTH_NOT_CONFIRMED, INCOMPLETE_TRANSACTION or ROLLBACK_INCOMPLETE is not a cleanup success: inspect the corresponding startup or transaction state and preserve recovery material. BUSY retains the operation lock. Do not substitute broad filesystem deletion or fabricate startup evidence. The update window displays the latest startup's cleanup result; diagnostic records are bounded to 20 per category.
+
 ## Private tool runtime (contract 1)
 
 Desktop installations from 0.5.0 include a separately versioned Node/npm/Python toolchain. The manager's release manifest pins verified npm payloads for macOS ARM64 and Windows x64. Install/update ensures these tools before switching the app. Runtime bytes retain upstream licenses and contain no user configuration. The initial npm manager bootstrap still requires existing Node.js 22+; ordinary app updates use the bundled updater.
@@ -36,6 +42,14 @@ Tools own their npm prefix/cache and pip cache; no user/system PATH, shell profi
 
 ## Recovery and boundaries
 
+For installation failures, read `doctor --json` and `repair plan`. Doctor reports the actual bootstrap Node executable/version/architecture, lock owner, and inactive staging inventory. Node 22+ is checked before loading the manager; on Windows, a `.cmd` shim may select a different Node than PATH. Prefer invoking the selected supported Node with the npm CLI and installed `bin/codex-own.mjs` explicitly when multiple runtimes exist.
+
+With authorization to reclaim failed installation staging and recover a dead lock, use `repair run --yes`. It preserves current applications, live data, content caches and rollback snapshots. Live/unknown lock owners, active applications, recovery locks and incomplete transactions require inspection; never delete their files to force continuation. Run doctor again, then return to main-line install/update. A copied application candidate is reclaimable only with a matching ownership receipt; unknown next directories stay intact.
+
+Extraction reads Unicode entry names directly from TAR/PAX/gzip/ZIP bytes, checks entry types, file sizes and SHA256, and retries missing or changed entries at most three times. UNPACK_INCOMPLETE/UNPACK_FAILED report missing samples and staging location; persistent security-software interception needs investigation rather than repeated retries or disabling protection. Each installation cleans its own staging on success/failure; occupied files remain reported for explicit recovery. Verified content blocks remain reusable.
+
+Default stdout remains JSON and progress remains stderr for integrations. For an interactive Windows terminal use `--progress stdout` with UTF-8 console settings; `--quiet` suppresses progress. `--json` cannot be combined with stdout progress. Use the process exit status and final result, rather than text color, for success. Runtime selection receipts retain at most 20 verified backups; immutable tool versions stay preserved.
+
 For Windows Agent shell diagnosis, inspect `doctor.agentShell`: verified system Git Bash is preferred for general task commands, PowerShell remains available for Windows-specific operations, and missing/unusable Bash reports a fallback reason. `desktopAdapterBundled` distinguishes a capable desktop from an upgraded manager with an older desktop. The desktop adds this execution policy to new, resumed and forked Agent sessions while preserving existing developer instructions and the private Node/npm/Python environment. Integrated-terminal settings are independent; verify the actual tool call's explicit `shell` and command result. The Windows host context may still say PowerShell. An explicit user shell choice takes precedence. Never replay a failed command in a different shell without checking its side effects.
 
 Component binding contract 2 requires a bridge desktop with embedded updater contract 2 and tool environment contract 1. Manager releases pin exact immutable artifacts, so their version numbers may differ. A manager-only release is not a desktop update; a tool-only update retains the desktop and uses new paths after restart. Legacy pre-bridge clients may need one CLI upgrade. INCOMPATIBLE_BINDING preserves the installed components; inspect the published binding and compatibility instead of forcing a version match.

package/skills/codex-own/capabilities.json

@@ -28,7 +28,7 @@
       "side_effects": {
         "external_mutation": true,
         "may_cost_money": false,
-        "authorization": "Only requested install, update, configuration or recovery; read-only checks otherwise."
+        "authorization": "Only requested install, update, configuration, recovery or managed update cleanup; read-only checks otherwise. Cleanup may retire older backups while preserving the latest complete rollback."
       },
       "errors": [
         "CAPABILITY_UNAVAILABLE",
@@ -36,4 +36,4 @@
       ]
     }
   ]
-}
+}