@zalom/plastic 1.0.3 → 1.1.0

package/scripts/end-intent

@@ -0,0 +1,330 @@
+#!/usr/bin/env ruby
+# encoding: UTF-8
+# frozen_string_literal: true
+
+# end-intent (intent 161) - the mechanical core of the single owned Done
+# procedure (D2 steps 1-4). Pure with respect to worktrees, locks, and QMD:
+# those stay in the plastic-intent-ending skill body (steps 0 and 5-7), never
+# duplicated here. Pairs new-intent's shape: one callable script instead of
+# raw one-liners repeated in skill prose (the failure mode this intent fixes).
+#
+# Usage:
+#   end-intent --store <store_path> --id <intent_id> --disposition delivered|abandoned \
+#              [--index <path>] [--outcome-summary <text>] [--index-note <text>] \
+#              [--no-commit] [--dry-run]
+#
+# Steps performed (in order), all idempotent:
+#   1. Guard outcome.md (exit 2, authors nothing, on any failure), then stamp
+#      the intent file's `## Outcome` section with --outcome-summary if given.
+#   2. Move the intent's INDEX.md line from `## Active` into `## Completed`
+#      (delivered) or `## Abandoned` (abandoned), dated today, appending
+#      --index-note (if given) after the date so the terminal entry stays
+#      the store's existing rich Completed/Abandoned shape rather than
+#      thinning to bare id+date.
+#   3. Append the savepoint `Done` bookend (Bridge.append_terminal_savepoint).
+#   4. Commit the store repo, unless --no-commit.
+#
+# Exit codes: 0 (ok), 1 (usage/resolution failure), 2 (outcome.md guard refused).
+
+require "fileutils"
+require "date"
+require "open3"
+require_relative "lib/bridge"
+require_relative "lib/intent_validator"
+
+DISPOSITIONS = %w[delivered abandoned].freeze
+
+# The store-line separator this script must reproduce is a real em dash
+# (U+2014), the existing INDEX.md convention (store files are exempt from the
+# no-em-dash shipped-file rule). Built from the codepoint, not a literal byte
+# in this source file, so the script's own source stays em-dash free.
+EM_DASH = "\u2014"
+
+# --- Explicit flag parsing (no eval, no global injection) -------------------
+
+def parse_args(argv)
+  opts = {
+    store: nil, id: nil, disposition: nil, index: nil,
+    outcome_summary: nil, index_note: nil, no_commit: false, dry_run: false,
+  }
+  i = 0
+  while i < argv.length
+    arg = argv[i]
+    case arg
+    when "--store"          then opts[:store] = argv[i += 1]
+    when "--id"              then opts[:id] = argv[i += 1]
+    when "--disposition"     then opts[:disposition] = argv[i += 1]
+    when "--index"           then opts[:index] = argv[i += 1]
+    when "--outcome-summary" then opts[:outcome_summary] = argv[i += 1]
+    when "--index-note"      then opts[:index_note] = argv[i += 1]
+    when "--no-commit"       then opts[:no_commit] = true
+    when "--dry-run"         then opts[:dry_run] = true
+    else
+      usage_abort("unknown argument #{arg.inspect}")
+    end
+    i += 1
+  end
+  opts
+end
+
+def usage
+  "usage: end-intent --store <store_path> --id <intent_id> " \
+    "--disposition delivered|abandoned [--index <path>] " \
+    "[--outcome-summary <text>] [--index-note <text>] [--no-commit] [--dry-run]"
+end
+
+def usage_abort(message)
+  warn "end-intent: #{message}"
+  warn usage
+  exit 1
+end
+
+def expand(path)
+  File.expand_path(path.to_s.sub(/\A~/, Dir.home))
+end
+
+# Resolve the single "<store>/<id>--*" directory, or abort (usage error: exit 1).
+def resolve_intent_dir(store, id)
+  matches = Dir.glob(File.join(store, "#{id}--*")).select { |d| File.directory?(d) }
+  usage_abort("no intent directory matches #{id}--* under #{store}") if matches.empty?
+  if matches.length > 1
+    usage_abort("ambiguous id #{id.inspect}: #{matches.length} matching directories under #{store}")
+  end
+  matches.first
+end
+
+# --- outcome.md guard (D2 step 1a) ------------------------------------------
+#
+# Returns nil when the guard PASSES, or a reason String to refuse with exit 2.
+# Read-only: authors nothing regardless of outcome. Refuses a missing file, a
+# still-placeholder file (first line is the sentinel), or a disposition that
+# does not exactly equal the requested one (this is what naturally refuses a
+# freshly scaffolded outcome.md, whose disposition is the literal
+# "delivered|abandoned" string, not one of the two real values).
+def outcome_guard_reason(intent_dir, disposition)
+  path = File.join(intent_dir, "outcome.md")
+  return "outcome.md is missing at #{path}" unless File.exist?(path)
+
+  content = File.read(path)
+  first_line = content.each_line.first.to_s.chomp
+  if first_line == Bridge::PLACEHOLDER_SENTINEL
+    return "outcome.md is still the scaffold placeholder (first line is the sentinel)"
+  end
+
+  fm = IntentValidator.parse_frontmatter_text(content)
+  actual = fm.is_a?(Hash) ? fm["disposition"] : nil
+  unless DISPOSITIONS.include?(actual) && actual == disposition
+    return "outcome.md frontmatter disposition is #{actual.inspect}, expected #{disposition.inspect}"
+  end
+
+  nil
+end
+
+# --- intent-file `## Outcome` summary stamp (D2 step 1b) --------------------
+#
+# Replace the body of the intent file's `## Outcome` section with `summary`,
+# leaving every other section and the frontmatter untouched. No-op (returns
+# content unchanged) when summary is blank or the section is not found.
+def stamp_outcome_summary(content, summary)
+  return content if summary.nil? || summary.to_s.strip.empty?
+
+  lines = content.lines
+  start = lines.index { |l| l.rstrip == "## Outcome" }
+  return content if start.nil?
+
+  stop = start + 1
+  stop += 1 while stop < lines.length && !lines[stop].start_with?("## ")
+
+  body = "#{summary.to_s.strip}\n"
+  replacement = (stop < lines.length) ? [body, "\n"] : [body]
+  (lines[0..start] + replacement + lines[stop..]).join
+end
+
+# --- INDEX.md terminal move (D2 step 2) -------------------------------------
+
+ACTIVE_LINE_RE = /\A- \[(\S+)\s+#{Regexp.escape(EM_DASH)}\s+(.*?)\]\(([^)]+)\)/.freeze
+
+def index_target_heading(disposition)
+  disposition == "delivered" ? "## Completed" : "## Abandoned"
+end
+
+# Index of the first `## ` heading at or after heading_idx + 1, or lines.length
+# at EOF (the section's exclusive end bound).
+def section_stop(lines, heading_idx)
+  stop = heading_idx + 1
+  stop += 1 while stop < lines.length && !lines[stop].start_with?("## ")
+  stop
+end
+
+def active_line_id(line)
+  m = line.match(ACTIVE_LINE_RE)
+  m && m[1]
+end
+
+def section_contains_id?(lines, heading_idx, id)
+  stop = section_stop(lines, heading_idx)
+  (heading_idx + 1...stop).any? { |i| active_line_id(lines[i]) == id }
+end
+
+# Remove the entry at entry_idx from the `## Active` section. When no real
+# entries remain, install the canonical "_(none)_" placeholder (the same
+# empty-state convention INDEX.md already uses).
+def remove_active_entry(lines, active_start, entry_idx)
+  new_lines = lines.dup
+  new_lines.delete_at(entry_idx)
+  stop = section_stop(new_lines, active_start)
+  remaining = (active_start + 1...stop).reject { |i| new_lines[i].strip.empty? }
+  if remaining.empty?
+    # Keep the blank-line separator before the next heading (if any); only
+    # collapse the section body to the placeholder, never the spacing.
+    placeholder = (stop < new_lines.length) ? ["_(none)_\n", "\n"] : ["_(none)_\n"]
+    new_lines[(active_start + 1)...stop] = placeholder
+  end
+  new_lines
+end
+
+# Insert new_entry into the target terminal section: replace the "_(none)_"
+# placeholder if that is the ONLY non-blank content the section holds (a
+# trailing blank line before the next heading is common and must not
+# defeat this check), otherwise prepend (newest-first, matching the
+# existing Completed/Abandoned convention).
+def insert_terminal_entry(lines, target_start, new_entry)
+  new_lines = lines.dup
+  stop = section_stop(new_lines, target_start)
+  body_range = (target_start + 1...stop)
+  placeholder_idx = body_range.find { |i| new_lines[i].strip == "_(none)_" }
+  non_blank = body_range.reject { |i| new_lines[i].strip.empty? }
+  if placeholder_idx && non_blank == [placeholder_idx]
+    new_lines[placeholder_idx] = new_entry
+  else
+    new_lines.insert(target_start + 1, new_entry)
+  end
+  new_lines
+end
+
+# Move the intent's `## Active` line into the terminal section. Returns the
+# new INDEX.md content, or the original content unchanged when there is
+# nothing to do (idempotent: a second run finds no Active entry and the
+# terminal section already carries it, so it is a clean no-op). `index_note`
+# (D2 "rich entry", review F3), when given, is appended verbatim after the
+# date with a single leading space: content authoring (mode/tier, what
+# shipped, suite result, and so on) stays with the caller, this only places
+# the text where the store's existing Completed/Abandoned lines carry it.
+def move_index_to_terminal(content, id, disposition, today:, index_note: nil)
+  target_heading = index_target_heading(disposition)
+  lines = content.lines
+
+  active_start = lines.index { |l| l.rstrip == "## Active" }
+  target_start = lines.index { |l| l.rstrip == target_heading }
+  return content if active_start.nil? || target_start.nil?
+
+  already_in_target = section_contains_id?(lines, target_start, id)
+  active_stop = section_stop(lines, active_start)
+  entry_idx = (active_start + 1...active_stop).find { |i| active_line_id(lines[i]) == id }
+
+  return content if entry_idx.nil? # already moved (or never present): no-op either way
+
+  m = lines[entry_idx].match(ACTIVE_LINE_RE)
+  title, link = m[2], m[3]
+  note_suffix = (index_note && !index_note.to_s.strip.empty?) ? " #{index_note.to_s.strip}" : ""
+  new_entry = "- [#{id} #{EM_DASH} #{title}](#{link}) #{EM_DASH} #{today}#{note_suffix}\n"
+
+  lines = remove_active_entry(lines, active_start, entry_idx)
+  target_start = lines.index { |l| l.rstrip == target_heading }
+  lines = insert_terminal_entry(lines, target_start, new_entry) unless already_in_target
+
+  lines.join
+end
+
+# --- store auto-commit (D2 step 4) ------------------------------------------
+
+def git_toplevel(dir)
+  out, _err, status = Open3.capture3("git", "-C", dir, "rev-parse", "--show-toplevel")
+  return nil unless status.success?
+  top = out.strip
+  top.empty? ? nil : top
+end
+
+# Best-effort store commit: never raises, never blocks the mechanical close.
+# Returns true when a commit was created, false otherwise (not a git repo,
+# nothing to commit, or the commit failed). Pins a local committer identity so
+# the commit succeeds even with no ambient git config (hermetic).
+def store_commit(store, id, disposition)
+  root = git_toplevel(store)
+  return false if root.nil?
+
+  Open3.capture3("git", "-C", root, "add", "-A")
+  _out, _err, status = Open3.capture3(
+    "git", "-C", root,
+    "-c", "user.name=Plastic", "-c", "user.email=plastic@localhost",
+    "commit", "--quiet", "-m", "chore: complete intent #{id} (#{disposition})"
+  )
+  status.success?
+end
+
+# --- main --------------------------------------------------------------------
+
+def main(argv)
+  opts = parse_args(argv)
+  usage_abort("--store is required") if opts[:store].nil? || opts[:store].empty?
+  usage_abort("--id is required") if opts[:id].nil? || opts[:id].empty?
+  unless DISPOSITIONS.include?(opts[:disposition])
+    usage_abort("--disposition must be one of #{DISPOSITIONS.join('|')}")
+  end
+
+  store = expand(opts[:store])
+  usage_abort("store dir does not exist: #{store}") unless Dir.exist?(store)
+
+  id = opts[:id]
+  disposition = opts[:disposition]
+  intent_dir = resolve_intent_dir(store, id)
+  index_path = opts[:index] ? expand(opts[:index]) : File.join(File.dirname(store), "INDEX.md")
+  today = Date.today.iso8601
+
+  reason = outcome_guard_reason(intent_dir, disposition)
+  if reason
+    warn "end-intent: #{reason}"
+    exit 2
+  end
+
+  if opts[:dry_run]
+    puts "end-intent: dry run for #{File.basename(intent_dir)} (#{disposition})"
+    puts "  would stamp ## Outcome: #{opts[:outcome_summary].inspect}" if opts[:outcome_summary]
+    puts "  would move INDEX.md entry from ## Active to #{index_target_heading(disposition)} (#{index_path})"
+    puts "  would append index note: #{opts[:index_note].inspect}" if opts[:index_note]
+    puts "  would append savepoint bookend: Done  #{disposition}"
+    puts(opts[:no_commit] ? "  would skip store commit (--no-commit)" : "  would commit the store repo")
+    exit 0
+  end
+
+  # 1b. Intent-file `## Outcome` summary stamp (no-op unless given).
+  if opts[:outcome_summary]
+    intent_file = Bridge.intent_file(intent_dir)
+    if File.exist?(intent_file)
+      original = File.read(intent_file)
+      updated = stamp_outcome_summary(original, opts[:outcome_summary])
+      File.write(intent_file, updated) if updated != original
+    end
+  end
+
+  # 2. INDEX.md terminal move.
+  if File.exist?(index_path)
+    original_index = File.read(index_path)
+    updated_index = move_index_to_terminal(original_index, id, disposition, today: today,
+                                            index_note: opts[:index_note])
+    File.write(index_path, updated_index) if updated_index != original_index
+  else
+    warn "end-intent: INDEX.md not found at #{index_path}, skipping the terminal move"
+  end
+
+  # 3. Savepoint Done bookend (idempotent).
+  Bridge.append_terminal_savepoint(intent_dir, disposition)
+
+  # 4. Store auto-commit, unless --no-commit.
+  store_commit(store, id, disposition) unless opts[:no_commit]
+
+  puts intent_dir
+  exit 0
+end
+
+main(ARGV) if $PROGRAM_NAME == __FILE__

package/scripts/hook-code-gate

@@ -39,7 +39,7 @@ if new_content && Bridge::PLASTIC_OK_RE.match?(new_content.chomp)
 end
 
 # --- Load bridge (shared resolution; stdin session_id -> CLAUDE_CODE_SESSION_ID -> /tmp scan) ---
-bridge_data = Bridge.discover_bridge(session: session, cwd: file_path)
+bridge_data = Bridge.discover_bridge(session: session, cwd: file_path, edited_path: file_path)
 exit 0 unless bridge_data
 
 reason = Bridge.code_gate_decision(bridge_data, file_path) ||

package/scripts/hook-continue

@@ -19,7 +19,7 @@ cockpit, _err, status = Open3.capture3("ruby", dashboard, "continue")
 exit 0 unless status.success? && !cockpit.strip.empty?
 
 context = cockpit.rstrip +
-  "\n\nFollow the plastic-continuing skill workflow to resume: " \
+  "\n\nFollow the plastic-intent-continuing skill workflow to resume: " \
   "if active intents exist, read their state and resume; otherwise offer the " \
   "Value×Effort matrix items above, surfacing any stale (Nd) / ⚑ triage intents."
 

package/scripts/hook-create-gate

@@ -67,7 +67,7 @@ result =
     # the validator.
     unless File.exist?(abs)
       block!("PLASTIC CREATE GATE — #{File.basename(abs)} does not exist; " \
-             "create intents via new-intent / plastic-creating-intent.")
+             "create intents via new-intent / plastic-intent-creating.")
     end
     current = File.read(abs)
     unless current.include?(old_string)
@@ -91,5 +91,5 @@ exit 0 if result[:ok]
 
 $stderr.puts "PLASTIC CREATE GATE — #{File.basename(abs)} is not a valid intent:"
 result[:errors].each { |e| $stderr.puts "  #{e}" }
-$stderr.puts "Create intents via new-intent / plastic-creating-intent; do not hand-author them."
+$stderr.puts "Create intents via new-intent / plastic-intent-creating; do not hand-author them."
 exit 2

package/scripts/hook-session-start

@@ -201,7 +201,7 @@ parts = []
 
 # Boot banner first: every session start surfaces that Plastic loaded, with the
 # version (clean) or the first failing core check (degraded). Owned by the hook
-# so it runs by construction — the plastic-continuing skill no longer does this.
+# so it runs by construction — the plastic-intent-continuing skill no longer does this.
 parts << core_banner
 parts << ""
 

package/scripts/lib/bridge.rb

@@ -165,6 +165,18 @@ module Bridge
     -1
   end
 
+  # The provisioned code worktree dir (<repo>/.claude/worktrees/{id}--{slug})
+  # that contains file_path, or nil (intent 168). Structural and bridge-free:
+  # Worktree.provision builds exactly this layout, so a file under it is
+  # "worktree-scoped" and only that intent may gate it. The {id}--{slug} shape
+  # (a `--` in the dir name) is required, so a stray .claude/worktrees/README
+  # is not worktree-scoped and returns nil.
+  def self.enclosing_worktree_dir(file_path)
+    return nil if blank?(file_path)
+    m = File.expand_path(file_path).match(%r{\A(.*/\.claude/worktrees/[^/]+--[^/]+)(?:/|\z)})
+    m && m[1]
+  end
+
   # Resolve the active bridge: scan tmp for plastic-*.json (both per-intent and
   # legacy-keyed files), keep only valid bridges, filter to the caller's own
   # session when it has one, prefer auto-armed, then disambiguate by cwd tier
@@ -172,7 +184,7 @@ module Bridge
   # path: a session now legitimately owns several bridges (one per concurrent
   # intent), so filename lookup alone cannot pick the right one; cwd must
   # decide (intent 131).
-  def self.discover_bridge(session:, cwd: Dir.pwd, tmp: tmp_dir)
+  def self.discover_bridge(session:, cwd: Dir.pwd, tmp: tmp_dir, edited_path: nil)
     candidates = Dir.glob(File.join(tmp, "plastic-*.json")).reject { |f| f.end_with?(".tmp") }
     parsed = candidates.filter_map do |f|
       data = (JSON.parse(File.read(f)) rescue nil)
@@ -181,6 +193,26 @@ module Bridge
     end
     return nil if parsed.empty?
 
+    # Worktree-membership-first (intent 168). hook-code-gate passes the edited
+    # file as edited_path; when that file lies inside a provisioned code worktree
+    # (<repo>/.claude/worktrees/{id}--{slug}), only that worktree's owning intent
+    # may gate the write, BEFORE the intent-90 per-session filter below. Resolve
+    # the candidate whose worktree.code owns that dir (newest mtime on a tie), or
+    # nil when none owns it, so a session-keyed guided bridge can never claim a
+    # write located inside a sibling intent's worktree. No edited_path (every
+    # other caller) or a non-worktree path skips this and runs the pipeline
+    # unchanged (intents 90/52/131 preserved).
+    unless blank?(edited_path)
+      wt_dir = enclosing_worktree_dir(edited_path)
+      if wt_dir
+        owners = parsed.select do |c|
+          code = c[:data].dig("worktree", "code")
+          !blank?(code) && File.expand_path(code) == wt_dir
+        end
+        return owners.max_by { |c| c[:mtime] }&.fetch(:data)
+      end
+    end
+
     has_session = !blank?(session)
 
     # Strict per-session ownership (intent 90): when the caller HAS a session, a foreign
@@ -412,7 +444,7 @@ module Bridge
   NEXT_HINTS = {
     "why" => "write spec.md",
     "how" => "Why complete. Invoke plastic-auto to deliver autonomously, or write plan.md manually.",
-    "exec" => "How complete. Invoke plastic-auto or plastic-executing-plan to execute, or work through the checklist manually.",
+    "exec" => "How complete. Invoke plastic-auto or plastic-intent-executing to execute, or work through the checklist manually.",
     "done" => "Exec complete. Intent must be completed now — write outcome.md, update INDEX.md, auto-commit. Use plastic-auto or do it manually."
   }.freeze
 
@@ -918,7 +950,7 @@ module Bridge
 
     id = intent_info["id"]
     "intent #{id} has not reached How — write plan.md + checklist.md before " \
-      "editing project code. Run plastic-auto or plastic-writing-plans first. " \
+      "editing project code. Run plastic-auto or plastic-intent-planning first. " \
       "(blocked edit: #{file_abs})"
   end
 

package/scripts/lib/installer_core.rb

@@ -10,7 +10,7 @@ require_relative "hook_registry"
 require_relative "agent_models"
 
 # Shared installer machinery, instantiable with injected package root / store / agent
-# map so the verb scripts (install/update/uninstall/versions) and their tests can run
+# map so the verb scripts (install/update/uninstall/rollback) and their tests can run
 # hermetically (no eval, no global-constant rewriting). Mirrors the DI recipe proven in
 # doctor.rb / install.rb (intents 30a, 30a1). Library only — no CLI, no $PROGRAM_NAME guard.
 class InstallerCore
@@ -54,7 +54,7 @@ class InstallerCore
     STABILITY[ch] || 2
   end
 
-  # --- Semver (§11) — parse/compare, shared by update + versions ---
+  # --- Semver (§11) — parse/compare, shared by update + rollback ---
 
   def semver_parse(version)
     m = /\A(\d+)\.(\d+)\.(\d+)(?:-(.+))?\z/.match(version.to_s.strip)
@@ -286,7 +286,7 @@ class InstallerCore
       "scripts/install.rb" => "scripts/install.rb",
       "scripts/update.rb" => "scripts/update.rb",
       "scripts/uninstall.rb" => "scripts/uninstall.rb",
-      "scripts/versions.rb" => "scripts/versions.rb",
+      "scripts/rollback.rb" => "scripts/rollback.rb",
       "scripts/doctor.rb" => "scripts/doctor.rb",
       "scripts/dashboard.rb" => "scripts/dashboard.rb",
     }
@@ -471,8 +471,10 @@ class InstallerCore
   end
 
   # Copy each skills/<name>/ to <skills_root>/plastic-<name>/ (flat, namespaced by
-  # directory name — the only personal-skill namespacing Claude Code supports).
-  # The non-skill `_active-intent-gate.md` is relocated to ~/.plastic/ instead.
+  # directory name -- the only personal-skill namespacing Claude Code supports).
+  # Any top-level underscore-prefixed markdown fragment (e.g. `_active-intent-gate.md`,
+  # `_decision-tables.md`) is a shared non-skill fragment and relocates to ~/.plastic/
+  # instead, so every skill can read it from one shared location.
   def install_skills_flat(skills_source, skills_root)
     installed = []
     FileUtils.mkdir_p(skills_root)
@@ -481,7 +483,7 @@ class InstallerCore
       src = File.join(skills_source, entry)
       if File.directory?(src)
         installed += copy_dir_recursive(src, File.join(skills_root, "plastic-#{entry}"))
-      elsif entry == "_active-intent-gate.md"
+      elsif entry.start_with?("_") && entry.end_with?(".md")
         FileUtils.mkdir_p(plastic_home)
         dest = File.join(plastic_home, entry)
         FileUtils.cp(src, dest)

package/scripts/lib/store_provisioning.rb

@@ -14,7 +14,7 @@ require "yaml"
 # `project.yml` (from templates/project.yml). Re-running never clobbers existing
 # files. The logic was migrated here from the orphaned
 # `InstallerCore#bootstrap_project_store` so there is one definition that the
-# `provision-project-store` CLI, the `plastic-add-project-store` skill, the
+# `provision-project-store` CLI, the `plastic-store-provisioning` skill, the
 # doctor fix hint, and the project skills all consult.
 #
 # Pure filesystem and dependency-injected: `provision` accepts an injectable

package/scripts/new-intent

@@ -13,7 +13,7 @@
 # IntentValidator (exit non-zero if not born complete).
 #
 # It does NOT touch INDEX.md, git, or project creation: those remain skill/agent
-# responsibilities (see plastic-creating-intent).
+# responsibilities (see plastic-intent-creating).
 #
 # Usage:
 #   new-intent --store <store_path> --intent "<one-line>" --slug <slug> \

package/scripts/{versions.rb → rollback.rb}

@@ -2,20 +2,24 @@
 # encoding: UTF-8
 # frozen_string_literal: true
 
-# Plastic — `versions` verb. Runs via `npx @zalom/plastic versions` (bin/plastic.js) or directly.
-# Usage: ruby scripts/versions.rb [--downgrade [--version <v>] | --upgrade] [--help]
+# Plastic — `rollback` verb. Runs via `npx @zalom/plastic rollback` (bin/plastic.js) or directly.
+# Usage: ruby scripts/rollback.rb [--version <v> [--downgrade | --upgrade]] [--help]
 #
 # Local time-machine over the append-only versions.json ledger. Navigates ONLY versions you
 # have actually run (the ledger), never npm's full list — fetching brand-new versions is
 # `update`'s job. Lets you roll back to a known-good build after a bad release.
-#   - no flag                  print the ledger table (and offer to continue a rollback)
-#   - --downgrade              step back one version in your history
-#   - --downgrade --version V  jump to a specific previously-run version
-#   - --upgrade                step forward one version (after a rollback)
+#   - no flag                        read-only: print the version-history table, never switch
+#   - --version V                    switch to a specific previously-run version (direction derived)
+#   - --downgrade --version V        synonym of --version V (direction flag is descriptive only)
+#   - --upgrade --version V          synonym of --version V (direction flag is descriptive only)
+#   - --downgrade / --upgrade alone  no target given: error, no switch
+#
+# Switching always requires an explicit --version V. A rollback tool whose job is safety
+# during a bad release must never switch versions without a named target.
 
 require_relative "lib/installer_core"
 
-class Versions < InstallerCore
+class Rollback < InstallerCore
   PKG = "@zalom/plastic"
 
   def cli(argv = ARGV)
@@ -32,31 +36,24 @@ class Versions < InstallerCore
 
     timeline = version_timeline(ledger)
     current = installed_version || timeline.last
+    explicit = flag_value(argv, "--version")
 
-    if argv.include?("--downgrade")
-      explicit = flag_value(argv, "--version")
-      target = explicit || step_target(timeline, current, :back)
-      return no_target("No earlier version in your history.") unless target
-      unless timeline.include?(target)
-        warn "#{target} is not in your version history. Choose one of: #{timeline.join(", ")}"
+    if explicit
+      unless timeline.include?(explicit)
+        warn "#{explicit} is not in your version history. Choose one of: #{timeline.join(", ")}"
         return 1
       end
-      return switch_to(target, current)
-    elsif argv.include?("--upgrade")
-      target = step_target(timeline, current, :forward)
-      return no_target("No later version in your history. Use `update` for new releases.") unless target
-      return switch_to(target, current)
+      return switch_to(explicit, current)
     end
 
-    # No flag: show the table, and detect an in-progress rollback.
-    print_table(ledger, current)
-    if ledger.last && ledger.last["action"] == "downgrade"
-      prev = step_target(timeline, current, :back)
-      if prev && $stdin.tty?
-        print "\nYou recently rolled back. Go back further to #{prev}? [y/N]: "
-        return switch_to(prev, current) if ($stdin.gets&.strip || "").downcase.start_with?("y")
-      end
+    if argv.include?("--downgrade") || argv.include?("--upgrade")
+      warn "An explicit target is required: pass --version <v>. Run `rollback` with no " \
+           "flags to see your version history and pick a target."
+      return 1
     end
+
+    # No flags at all: read-only. Print the table and stop; never switch, never prompt.
+    print_table(ledger, current)
     0
   end
 
@@ -93,11 +90,6 @@ class Versions < InstallerCore
     argv[i + 1]
   end
 
-  def no_target(msg)
-    puts msg
-    0
-  end
-
   def switch_to(target, current)
     action = action_for(target, current)
     puts "#{action == "downgrade" ? "\u{23ea}" : "\u{23e9}"}  #{current} \u{2192} #{target} (#{action})"
@@ -119,23 +111,23 @@ class Versions < InstallerCore
   def show_help
     puts <<~HELP
 
-      plastic versions — manage and roll back your local Plastic versions
+      plastic rollback — read installed and available versions, and switch on request
 
       Usage:
-        npx @zalom/plastic versions [options]
+        npx @zalom/plastic rollback [options]
 
       Options:
-        (none)                  Show the version-history table
-        --downgrade             Roll back one version in your history
-        --downgrade --version V Roll back to a specific previously-run version
-        --upgrade               Step forward one version in your history
-        -h, --help              Show this help
+        (none)                    Show the version-history table (read-only, no switch)
+        --version V                Switch to version V (direction derived automatically)
+        --downgrade --version V    Synonym of --version V
+        --upgrade --version V      Synonym of --version V
+        -h, --help                 Show this help
 
-      Navigates only versions you have already run (the append-only ledger). To move to a
-      brand-new release, use `update`.
+      Switching always requires an explicit --version V. Navigates only versions you have
+      already run (the append-only ledger). To move to a brand-new release, use `update`.
 
     HELP
   end
 end
 
-exit(Versions.new(package_root: ENV["PLASTIC_PACKAGE_ROOT"] || File.expand_path("..", __dir__)).cli(ARGV)) if $PROGRAM_NAME == __FILE__
+exit(Rollback.new(package_root: ENV["PLASTIC_PACKAGE_ROOT"] || File.expand_path("..", __dir__)).cli(ARGV)) if $PROGRAM_NAME == __FILE__

package/scripts/update.rb

@@ -164,7 +164,7 @@ class Update < InstallerCore
       Behaviour:
         No flag advances to the next version on your current channel. Switching toward a
         more stable channel is frictionless; switching toward bleeding edge is confirmed.
-        Use `versions` to roll back to a previously-installed version.
+        Use `rollback` to roll back to a previously-installed version.
 
     HELP
   end

package/skills/_active-intent-gate.md

@@ -13,7 +13,7 @@ Before proceeding, resolve the active intent:
    - Look under `## Active` for intent entries
    - If exactly one active intent → use it
    - If multiple active intents → ask user which one
-   - If no active intent → refuse: "No active intent. Create one first with /plastic-creating-intent"
+   - If no active intent → refuse: "No active intent. Create one first with /plastic-intent-creating"
 
 3. **Resolve paths:**
    - Intent directory: `{store}/store/{id}--{slug}/`