auriga-cli 1.18.2 → 1.18.3

package/dist/catalog.d.ts

@@ -1,6 +1,14 @@
 export interface CatalogEntry {
     name: string;
     description: string;
+    /** Build-time-baked plugin version. Set ONLY for plugin entries whose
+     *  source lives in this repo's `plugins/<name>/` directory — the scanner
+     *  uses it to surface "update-available" when the user's installed copy
+     *  is older. Absent for skill / hook entries and for external-marketplace
+     *  plugins (whose manifest lives upstream). Must be baked at build time
+     *  because `plugins/<name>/.claude-plugin/plugin.json` is NOT shipped in
+     *  the npm tarball (see `package.json` `files` field). */
+    expectedVersion?: string;
 }
 export interface Catalog {
     generatedAt: string;

package/dist/catalog.json

@@ -1,5 +1,5 @@
 {
-  "generatedAt": "2026-05-12T13:41:34.719Z",
+  "generatedAt": "2026-05-12T13:58:42.583Z",
   "workflowSkills": [
     {
       "name": "brainstorming",
@@ -87,19 +87,23 @@
     },
     {
       "name": "auriga-go",
-      "description": "(Claude/Codex) Workflow autopilot for the auriga workflow. Reminder-based navigation across CLAUDE.md's phases. Bundles a /goalify skill that plans an autonomous goal from a spec or work-in-progress and dispatches it via Claude Code's built-in /goal command."
+      "description": "(Claude/Codex) Workflow autopilot for the auriga workflow. Reminder-based navigation across CLAUDE.md's phases. Bundles a /goalify skill that plans an autonomous goal from a spec or work-in-progress and dispatches it via Claude Code's built-in /goal command.",
+      "expectedVersion": "1.1.0"
     },
     {
       "name": "auriga-git-guards",
-      "description": "(Claude/Codex) Git lifecycle guardrails: commit-reminder + PR-create snapshot inject + PR-ready structural block. Bundles the git-workflow skill (Claude Code + Codex)."
+      "description": "(Claude/Codex) Git lifecycle guardrails: commit-reminder + PR-create snapshot inject + PR-ready structural block. Bundles the git-workflow skill (Claude Code + Codex).",
+      "expectedVersion": "1.1.0"
     },
     {
       "name": "deep-review",
-      "description": "(Claude/Codex) Multi-dimensional PR review orchestrator. Dispatches parallel reviewers (spec-conformance, correctness, test-quality, docs-sync, robustness, security, ux, performance, structure, code-quality, skill-plugin-quality) and synthesizes findings into an actionable punch list. Supports project-level custom reviewers via docs/rules/review/ and ships a reviewer-creator skill for scaffolding them."
+      "description": "(Claude/Codex) Multi-dimensional PR review orchestrator. Dispatches parallel reviewers (spec-conformance, correctness, test-quality, docs-sync, robustness, security, ux, performance, structure, code-quality, skill-plugin-quality) and synthesizes findings into an actionable punch list. Supports project-level custom reviewers via docs/rules/review/ and ships a reviewer-creator skill for scaffolding them.",
+      "expectedVersion": "0.3.1"
     },
     {
       "name": "session-instructions-loader",
-      "description": "(Codex) Injects extra instruction files on session start"
+      "description": "(Codex) Injects extra instruction files on session start",
+      "expectedVersion": "1.0.0"
     }
   ],
   "hooks": [

package/dist/scan-catalog.js

@@ -31,30 +31,6 @@ async function sha256SkillMd(skillsRoot, name) {
         return "";
     }
 }
-/** Read `plugins/<name>/.claude-plugin/plugin.json` (or `.codex-plugin/plugin.json`
- *  as fallback) and return the `version` field. Returns "" when no manifest
- *  exists or the JSON is malformed — the scanner then leaves expectedVersion
- *  unset, which means external-marketplace plugins (whose source lives
- *  upstream, not in this repo) get the "trust installed" classification. */
-async function readPluginManifestVersion(packageRoot, name) {
-    const candidates = [
-        path.join(packageRoot, "plugins", name, ".claude-plugin", "plugin.json"),
-        path.join(packageRoot, "plugins", name, ".codex-plugin", "plugin.json"),
-    ];
-    for (const p of candidates) {
-        try {
-            const raw = await readFile(p, "utf8");
-            const parsed = JSON.parse(raw);
-            if (typeof parsed.version === "string" && parsed.version.length > 0) {
-                return parsed.version;
-            }
-        }
-        catch {
-            /* try next candidate */
-        }
-    }
-    return "";
-}
 const WORKFLOW_VERSION_RE = /^#\s*auriga Workflow\s*\(v([\d.]+)\)/m;
 async function tryReadFile(p) {
     try {
@@ -138,19 +114,18 @@ export async function buildScanCatalog(packageRoot) {
             agents.push("codex");
         if (agents.length === 0)
             agents.push("claude"); // unknown defaults to claude
-        // Bake expectedVersion from the owned plugin's manifest. For Claude-side
-        // plugins prefer plugins/<name>/.claude-plugin/plugin.json; fall back to
-        // .codex-plugin/plugin.json for codex-only plugins (e.g.
-        // session-instructions-loader). External-marketplace plugins (skill-creator,
-        // claude-md-management, codex) have no local manifest — they install from
-        // their upstream marketplace, so we deliberately leave expectedVersion
-        // undefined. The scanner then falls through to "trust whatever is installed",
-        // which matches what the user agreed to when they registered the upstream.
-        const expectedVersion = await readPluginManifestVersion(packageRoot, entry.name);
+        // expectedVersion comes from the build-time-baked field in dist/catalog.json
+        // (populated by `src/build/generate-catalog.ts` from
+        // `plugins/<name>/.claude-plugin/plugin.json`). It MUST be baked at build
+        // time because `plugins/<name>/` is NOT shipped in the npm tarball
+        // (`package.json` `files` field allowlists only `dist/`), so reading it
+        // at runtime from packageRoot would silently fail for npm-installed users.
         plugins[entry.name] = {
             description: entry.description,
             agents,
-            ...(expectedVersion ? { expectedVersion } : {}),
+            ...(typeof entry.expectedVersion === "string" && entry.expectedVersion.length > 0
+                ? { expectedVersion: entry.expectedVersion }
+                : {}),
         };
     }
     // Hooks: the scanner reads <scope>/.claude/settings.json and matches by

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auriga-cli",
-  "version": "1.18.2",
+  "version": "1.18.3",
   "description": "Interactive CLI to install Claude Code harness modules (Workflow, Skills, Recommended Skills, Plugins, Hooks)",
   "license": "MIT",
   "repository": {