auriga-cli 1.18.5 → 1.20.0

package/README.md

@@ -11,10 +11,10 @@ This repo itself is a fully configured harness project. You can clone it to see
 | Module | Description |
 |---|---|
 | **Workflow** | `CLAUDE.md` auriga workflow: requirement clarification -> TDD -> Review, Harness principles, Subagent usage guide |
-| **Skills** | Development process + orchestration skills — brainstorming, systematic-debugging, TDD, verification, planning, playwright, test-designer, incremental-impl |
+| **Skills** | External development process skills — brainstorming, systematic-debugging, TDD, verification, planning, playwright |
 | **Recommended Skills** | Optional utility skills (e.g. `codex-agent`, `claude-code-agent`) you can add on top of the workflow skills |
-| **Plugins** | Recommended Claude Code and Codex plugins — skill-creator, claude-md-management, codex, auriga-go, auriga-git-guards, session-instructions-loader, deep-review |
-| **Hooks** | Claude Code hooks: `notify` (macOS notification, focus-aware sound-only when terminal is frontmost — **opt-in**: not installed by `install --all`, requires `install hooks --hook notify`) |
+| **Plugins** | Recommended Claude Code and Codex plugins — skill-creator, claude-md-management, codex, auriga-go, auriga-git-guards, auriga-workflow-skills, auriga-notify, session-instructions-loader, deep-review |
+| **Hooks** | Legacy Claude Code hook installer. No repo-owned hooks are currently exposed here; `notify` ships as the `auriga-notify` plugin. |
 
 ## Quick Start
 
@@ -41,14 +41,14 @@ The leading `-y` belongs to `npx` (it auto-confirms package installation), **not
 Non-interactive install commands:
 
 ```bash
-npx -y auriga-cli install --all              # workflow + skills + plugins + hooks (atomic)
+npx -y auriga-cli install --all              # workflow + skills + default plugins (atomic)
 npx -y auriga-cli install recommended        # opt-in utility skills (not in --all)
 npx -y auriga-cli install plugins --agent codex --plugin session-instructions-loader
 npx -y auriga-cli install <type> [--flags]   # one of: workflow | skills | recommended | plugins | hooks
 npx -y auriga-cli --help                     # full catalog + flags
 ```
 
-Exit codes: `0` success, `1` fatal (precheck / parse / fetch), `2` partial success — `stderr` lists per-category `[OK]/[FAIL]` and a `Retry:` hint. After install, reload the Claude Code or Codex session so the new `CLAUDE.md` / skills / plugins / hook registrations are picked up.
+Exit codes: `0` success, `1` fatal (precheck / parse / fetch), `2` partial success — `stderr` lists per-category `[OK]/[FAIL]` and a `Retry:` hint. After install, reload the Claude Code or Codex session so the new `CLAUDE.md` / skills / plugins / hook-plugin registrations are picked up.
 
 ### Web UI (opt-in)
 
@@ -58,7 +58,7 @@ For a browser-based view of what's installed and one-click apply, run:
 npx auriga-cli web-ui
 ```
 
-This boots a local server on `127.0.0.1`, opens your default browser, and serves a dashboard that scans the current project, shows each module's status (installed / update-available / not-installed), and applies install / update / uninstall in a queue with live SSE progress. The server shuts down on its own ~15 s after the browser closes.
+This boots a local server on `127.0.0.1`, opens your default browser, and serves a dashboard that scans the current project, shows each module's status (installed / not-installed / partial-install), and applies install / uninstall in a queue with live SSE progress. Re-running install is the update path — every installer is idempotent and overwrites in place. The server shuts down on its own ~15 s after the browser closes.
 
 The UI is opt-in — `npx auriga-cli` still launches the TTY menu below.
 
@@ -102,9 +102,6 @@ Installs selected skills via `npx skills add`, targeting both Claude Code and Co
 | verification-before-completion | [obra/superpowers](https://github.com/obra/superpowers) | Pre-completion verification — evidence before assertions |
 | planning-with-files | [OthmanAdi/planning-with-files](https://github.com/OthmanAdi/planning-with-files) | File-based task planning and progress tracking |
 | playwright-cli | [microsoft/playwright-cli](https://github.com/microsoft/playwright-cli) | Browser automation and testing |
-| test-designer | [Ben2pc/auriga-cli](https://github.com/Ben2pc/auriga-cli) | Independent-Evaluation test designer for TDD red phase |
-| incremental-impl | [Ben2pc/auriga-cli](https://github.com/Ben2pc/auriga-cli) | Decides how to implement a non-trivial change: size, slicing strategy, optional parallel dispatch, per-slice execution discipline |
-| session-compound | [Ben2pc/auriga-cli](https://github.com/Ben2pc/auriga-cli) | Post-merge session compounder — distills the session into an interactive HTML report (timeline + token / cache / tool health + playground for skill installs / AGENTS.md edits / new-skill gaps) |
 
 **Recommended Skills (opt-in, not installed by `--all`):**
 
@@ -129,6 +126,8 @@ Examples:
 
 ```bash
 npx -y auriga-cli install plugins --plugin auriga-go
+npx -y auriga-cli install plugins --agent both --plugin auriga-workflow-skills
+npx -y auriga-cli install plugins --plugin auriga-notify
 npx -y auriga-cli install plugins --agent codex --plugin session-instructions-loader
 npx -y auriga-cli install plugins --agent both --plugin auriga-git-guards
 ```
@@ -140,31 +139,24 @@ npx -y auriga-cli install plugins --agent both --plugin auriga-git-guards
 | codex | Claude Code | Codex cross-model collaboration |
 | auriga-go | Claude Code / Codex | Workflow autopilot for the auriga workflow. Reminder-based navigation across the `CLAUDE.md` phases. Bundles two skills: `auriga-go` (description-based NL trigger + `/auriga-go`) and `/goalify` (plans an autonomous goal from a spec or work-in-progress and dispatches it via Claude Code's built-in `/goal` command). |
 | auriga-git-guards | Claude Code / Codex | Three git-lifecycle guardrails plus the bundled `git-workflow` skill. Hooks: `commit-reminder` (PostToolUse on `Edit` / `Write` / `MultiEdit` in Claude Code and on `apply_patch` — Codex's canonical file-edit `tool_name` — so it fires in both runtimes → when uncommitted diff vs `HEAD` exceeds 200 lines or 8 files and the last reminder was ≥ 60 s ago, inject a nudge to commit at the next semantic boundary), `pr-create-guard` (PostToolUse on `gh pr create` → fetch the new PR's body via `gh pr view` and inject headings + TODO counts as `additionalContext` so the Agent can self-verify the five-element PR description: scope / acceptance criteria / design decisions / risks / remaining TODOs), and `pr-ready-guard` (PreToolUse on `gh pr ready` → block on stray planning docs at `findings.md` / `progress.md` / `task_plan.md` / `docs/superpowers/specs/*.md`, unfinalized active specs in `docs/specs/*.md`, or unpushed commits; otherwise inject the body snapshot). The two PostToolUse hooks reach full Claude Code / Codex parity; Codex currently fails open on `pr-ready-guard`'s PreToolUse `additionalContext` informational path (block path identical). |
+| auriga-workflow-skills | Claude Code / Codex | Bundles the auriga-owned workflow execution skills: `incremental-impl`, `test-designer`, and `session-compound`. Installed by default through the plugin path instead of `install skills`. |
+| auriga-notify *(opt-in)* | Claude Code | macOS native notification plugin for Claude Code `Notification` events. Focus-aware sound-only mode, click-to-activate, per-project notification grouping, and migrated `config.json` / `icon.png` support. Not installed by `install --all`; install explicitly with `install plugins --plugin auriga-notify`. |
 | session-instructions-loader | Codex | Codex-only SessionStart plugin that injects ancestor `AGENTS.md` files plus repo-configured extra instruction files. |
 | deep-review | Claude Code / Codex | Multi-dimensional PR review orchestrator — dispatches parallel reviewers (spec-conformance, correctness, test-quality, docs-sync, plus conditional robustness/UX/performance/structure/code-quality/skill-plugin-quality) and synthesizes findings into an actionable punch list. Bundles a companion `reviewer-creator` skill for scaffolding project-level custom reviewers under `docs/rules/review/`. Drives the formal-review phase in `CLAUDE.md`. |
 
 ### Hooks
 
-Installs Claude Code hooks into a chosen scope. Each hook is self-contained under `.claude/hooks/<name>/` and can be customized without editing code.
-
-| Hook | Description |
-|---|---|
-| notify *(opt-in)* | Native macOS notification when Claude needs your attention. Shows the brand mark in the small app-icon position; click brings the originating terminal back to focus. **Focus-aware**: when the launching terminal is already frontmost, drops the banner and plays the sound only (toggle via `soundOnlyWhenFocused` in `config.json`). **Per-project group ID**: new notifications cleanly replace older ones in Notification Center, no process accumulation, no cross-project interference. Auto-installs `alerter` via Homebrew (`vjeantet/tap/alerter`). Customize sound and icon by editing `.claude/hooks/notify/config.json` and `.claude/hooks/notify/icon.png`. macOS-only at runtime; silent no-op on other platforms. |
-
-Scope choices:
-
-- **Project local** (recommended for cross-platform teams): files under `./.claude/hooks/`, registered in `./.claude/settings.local.json` — per-developer, not committed.
-- **Project**: same files, registered in `./.claude/settings.json` — shared with the team via git.
-- **User**: files under `~/.claude/hooks/`, registered in `~/.claude/settings.json` — global across all your projects.
-
-Re-running the installer preserves your customized `config.json` and `icon.png`, overwrites the runtime, and never produces duplicate hook entries (idempotent merge by sentinel marker).
+The traditional hook installer remains for compatibility, but this repo no
+longer exposes a repo-owned hook through `install hooks`. New repo-owned hooks
+should be shipped inside plugins. The former `notify` hook is now the
+`auriga-notify` plugin.
 
 ## Requirements
 
 - Node.js >= 18
 - [Claude Code](https://docs.anthropic.com/en/docs/claude-code) (required for Claude Code Plugins and Hooks modules)
 - Codex CLI (required only for `install plugins --agent codex|both`)
-- [Homebrew](https://brew.sh) (recommended for the `notify` hook to install `alerter`)
+- [Homebrew](https://brew.sh) (recommended for the `auriga-notify` plugin to use `alerter`)
 
 ## Development
 

package/README.zh-CN.md

@@ -11,10 +11,10 @@
 | 模块 | 说明 |
 |---|---|
 | **Workflow** | `CLAUDE.md` 里的 auriga 工作流：需求澄清 → TDD → Review，Harness 原则，Subagent 使用指南 |
-| **Skills** | 开发流程 + 编排类 skills —— brainstorming、systematic-debugging、TDD、verification、planning、playwright、test-designer、incremental-impl |
+| **Skills** | 外部开发流程 skills —— brainstorming、systematic-debugging、TDD、verification、planning、playwright |
 | **Recommended Skills** | 可选的工具类 skills（如 `codex-agent`、`claude-code-agent`），在 workflow skills 之外按需追加 |
-| **Plugins** | 推荐的 Claude Code 和 Codex 插件 —— skill-creator、claude-md-management、codex、auriga-go、auriga-git-guards、session-instructions-loader、deep-review |
-| **Hooks** | Claude Code hooks：`notify`（macOS 通知，终端在焦点时仅放声不弹横幅 —— **opt-in**：`install --all` 不装，需要 `install hooks --hook notify`） |
+| **Plugins** | 推荐的 Claude Code 和 Codex 插件 —— skill-creator、claude-md-management、codex、auriga-go、auriga-git-guards、auriga-workflow-skills、auriga-notify、session-instructions-loader、deep-review |
+| **Hooks** | 传统 Claude Code hook 安装器。目前没有仓库自维护 hook 暴露在这里；`notify` 已迁移为 `auriga-notify` 插件。 |
 
 ## 快速开始
 
@@ -41,7 +41,7 @@ npx -y auriga-cli guide
 非交互安装命令：
 
 ```bash
-npx -y auriga-cli install --all              # workflow + skills + plugins + hooks（原子）
+npx -y auriga-cli install --all              # workflow + skills + 默认 plugins（原子）
 npx -y auriga-cli install recommended        # 可选工具 skills（不在 --all 内）
 npx -y auriga-cli install plugins --agent codex --plugin session-instructions-loader
 npx -y auriga-cli install <type> [--flags]   # 单类：workflow | skills | recommended | plugins | hooks
@@ -52,13 +52,13 @@ npx -y auriga-cli --help                     # 完整 catalog + flag 说明
 
 ### Web UI（可选）
 
-如果想在浏览器里看到“已装 / 可更新 / 未装”全景并一键 apply，跑：
+如果想在浏览器里看到“已装 / 未装 / 半装”全景并一键 apply，跑：
 
 ```bash
 npx auriga-cli web-ui
 ```
 
-它会在 `127.0.0.1` 起一个本地 server、自动开浏览器，扫描当前项目并展示 5 个分类的状态。勾选要安装/更新/卸载的项目后点 Apply，SSE 实时回传执行进度。关浏览器后约 15 秒 server 自动退出。
+它会在 `127.0.0.1` 起一个本地 server、自动开浏览器，扫描当前项目并展示 5 个分类的状态。勾选要安装/卸载的项目后点 Apply，SSE 实时回传执行进度。需要"升级"时就重新 install——每个安装器都是幂等覆盖。关浏览器后约 15 秒 server 自动退出。
 
 Web UI 是显式入口；`npx auriga-cli` 仍然走下面的 TTY 菜单。
 
@@ -102,9 +102,6 @@ npx auriga-cli
 | verification-before-completion | [obra/superpowers](https://github.com/obra/superpowers) | 完成前验证，用证据说话 |
 | planning-with-files | [OthmanAdi/planning-with-files](https://github.com/OthmanAdi/planning-with-files) | 文件化任务计划与进度跟踪 |
 | playwright-cli | [microsoft/playwright-cli](https://github.com/microsoft/playwright-cli) | 浏览器自动化与测试 |
-| test-designer | [Ben2pc/auriga-cli](https://github.com/Ben2pc/auriga-cli) | TDD 红灯阶段的 Independent Evaluation 测试设计器 |
-| incremental-impl | [Ben2pc/auriga-cli](https://github.com/Ben2pc/auriga-cli) | 决定如何实现非平凡改动：估算大小、选择切片策略、按需并行派遣、执行片间纪律 |
-| session-compound | [Ben2pc/auriga-cli](https://github.com/Ben2pc/auriga-cli) | PR 合并后的会话复利 skill — 将本次会话沉淀为交互式 HTML 报告（时间线 + token / cache / 工具健康度 + playground：skill 安装 / AGENTS.md 修改 / 新建 skill 缺口） |
 
 **Recommended Skills（可选，不在 `--all` 内）：**
 
@@ -129,6 +126,8 @@ npx auriga-cli
 
 ```bash
 npx -y auriga-cli install plugins --plugin auriga-go
+npx -y auriga-cli install plugins --agent both --plugin auriga-workflow-skills
+npx -y auriga-cli install plugins --plugin auriga-notify
 npx -y auriga-cli install plugins --agent codex --plugin session-instructions-loader
 npx -y auriga-cli install plugins --agent both --plugin auriga-git-guards
 ```
@@ -140,31 +139,23 @@ npx -y auriga-cli install plugins --agent both --plugin auriga-git-guards
 | codex | Claude Code | Codex 跨模型协作 |
 | auriga-go | Claude Code / Codex | auriga 工作流的自动驾驶：按 `CLAUDE.md` 的 phase 做 reminder-based 导航。内置两个 skill：`auriga-go`（按 description 的自然语言触发 + `/auriga-go` slash command）和 `/goalify`（根据 spec 或当前进展 plan 出 goal，并通过 Claude Code 内置的 `/goal` 命令分发执行）。 |
 | auriga-git-guards | Claude Code / Codex | 三个 git-lifecycle guardrail + 内置 `git-workflow` skill。Hooks：`commit-reminder`（Claude Code 下 PostToolUse 匹配 `Edit` / `Write` / `MultiEdit`，Codex 下匹配 `apply_patch`（Codex 文件编辑 canonical `tool_name`），两个 runtime 都触发 —— 未提交 diff 对比 `HEAD` 超过 200 行或 8 个文件，且距上次提醒 ≥ 60 s 时，注入提醒让 Agent 在下一个语义边界 commit）、`pr-create-guard`（`gh pr create` 的 PostToolUse —— 通过 `gh pr view` 拉真实 PR body，扫 `^##` / `^###` headings 并统计 `- [ ]` / `- [x]` 注入 `additionalContext`，让 Agent 对照五要素：scope / acceptance criteria / design decisions / risks / remaining TODOs）、`pr-ready-guard`（`gh pr ready` 的 PreToolUse —— 仅按结构信号拦截：游离 `findings.md` / `progress.md` / `task_plan.md` / `docs/superpowers/specs/*.md`、`docs/specs/*.md` 内未结案的活跃 spec、未 push commits；放行时注入 body 快照）。两个 PostToolUse hook 在 Claude Code / Codex 上完全对齐；Codex 仅对 `pr-ready-guard` 的 PreToolUse `additionalContext` 信息路径 fail-open（block 路径两边一致）。 |
+| auriga-workflow-skills | Claude Code / Codex | 打包 auriga 自维护的工作流执行 skills：`incremental-impl`、`test-designer`、`session-compound`。默认通过插件路径安装，不再通过 `install skills` 作为独立条目安装。 |
+| auriga-notify *(opt-in)* | Claude Code | Claude Code `Notification` 事件的 macOS 原生通知插件。支持焦点感知仅提示音、点击唤起终端、按项目分组通知，并迁移旧 `config.json` / `icon.png`。不随 `install --all` 默认安装，需要显式执行 `install plugins --plugin auriga-notify`。 |
 | session-instructions-loader | Codex | Codex-only SessionStart 插件，注入上层目录的 `AGENTS.md` 和仓库配置的额外 instruction 文件。 |
 | deep-review | Claude Code / Codex | 多维度 PR review 编排器 —— 并行派发各维度 reviewer（spec-conformance、correctness、test-quality、docs-sync，以及条件触发的 robustness/UX/performance/structure/code-quality/skill-plugin-quality），汇总成 punch list。同包内打包了 `reviewer-creator` skill，用于在 `docs/rules/review/` 下生成项目级自定义 reviewer。承担 `CLAUDE.md` 中的正式评审职责。 |
 
 ### Hooks
 
-把 Claude Code hooks 安装到选定的作用域。每个 hook 都是 `.claude/hooks/<name>/` 下一个自包含目录，可以**不改代码**自定义。
-
-| Hook | 说明 |
-|---|---|
-| notify *(opt-in)* | 当 Claude 需要你关注时弹一条原生 macOS 通知。在通知小图标位显示品牌图，点击通知可把发起 Claude 的终端拉回前台。**焦点感知**：发起 Claude 的终端正处于前台时，仅放提示音不弹横幅（通过 `config.json` 的 `soundOnlyWhenFocused` 切换）。**按项目分组**：新通知会干净地替换通知中心里的旧条目，不会进程堆积，也不会跨项目互相覆盖。会自动通过 Homebrew 安装 `alerter`（`vjeantet/tap/alerter`）。改 `.claude/hooks/notify/config.json` 即可换提示音、替换 `.claude/hooks/notify/icon.png` 即可换图标。仅 macOS 运行时生效，其它平台静默 no-op。 |
-
-作用域选择：
-
-- **Project local**（推荐给跨平台团队）：文件落在 `./.claude/hooks/`，注册到 `./.claude/settings.local.json` —— 每个开发者各自安装，不进 git。
-- **Project**：同样的文件，注册到 `./.claude/settings.json` —— 整个团队共享。
-- **User**：文件落在 `~/.claude/hooks/`，注册到 `~/.claude/settings.json` —— 全局生效。
-
-重新跑安装器时会保留你修改过的 `config.json` 和 `icon.png`，覆盖运行时本身，并通过 marker 字段幂等去重，绝不会产生重复的 hook 条目。
+传统 hook 安装器仍保留作兼容入口，但本仓库当前不再通过
+`install hooks` 暴露自维护 hook。新的自维护 hook 应随插件分发。原来的
+`notify` hook 已迁移为 `auriga-notify` 插件。
 
 ## 环境要求
 
 - Node.js >= 18
 - [Claude Code](https://docs.anthropic.com/en/docs/claude-code)（Claude Code Plugins 和 Hooks 模块需要）
 - Codex CLI（仅 `install plugins --agent codex|both` 需要）
-- [Homebrew](https://brew.sh)（`notify` hook 用来安装 `alerter`，可选）
+- [Homebrew](https://brew.sh)（`auriga-notify` 插件使用 `alerter` 时推荐安装）
 
 ## 开发
 

package/dist/api-types.d.ts

@@ -1,9 +1,8 @@
-export type ItemStatus = "installed" | "update-available" | "not-installed"
+export type ItemStatus = "installed" | "not-installed"
 /** Dual-Agent plugin where some target Agents have the plugin installed
- *  and some don't (e.g. Claude side installed, Codex side missing). Distinct
- *  from `update-available` because the action is "install on the missing
- *  side", not "upgrade to a newer version". The missing agents are
- *  enumerated in `PluginState.missingAgents`. */
+ *  and some don't (e.g. Claude side installed, Codex side missing). The
+ *  user-facing action is "install on the missing side"; the missing
+ *  agents are enumerated in `PluginState.missingAgents`. */
  | "partial-install";
 /**
  * Per-category scan scope. Each category (workflow / skills / plugins / hooks)
@@ -29,8 +28,6 @@ export interface StateReport {
 }
 export interface WorkflowState {
     status: ItemStatus;
-    currentVersion?: string;
-    expectedVersion: string;
     /** Which scope the scanner read to produce this row. Reflects the scope
      *  scanned, not where the file was found — e.g. when scope=user and
      *  ~/.claude/CLAUDE.md is absent, observedScope is still "user". The
@@ -44,8 +41,6 @@ export interface SkillState {
     description: string;
     status: ItemStatus;
     isWorkflow: boolean;
-    currentHash?: string;
-    expectedHash: string;
     /** Scope the scanner read to produce this row. See WorkflowState comment. */
     observedScope?: ScanScope;
 }
@@ -59,35 +54,26 @@ export interface PluginState {
      *  `agents.length === 2` the UI shows a BOTH badge and Apply installs to
      *  each agent in turn. Status is aggregated across all targeted agents:
      *  `installed` ⇔ all agents installed; `not-installed` ⇔ all not-installed;
-     *  partial state (some installed, some not) → `partial-install`; agent-
-     *  uniform version drift → `update-available`. */
+     *  mixed → `partial-install` (some installed, some not). */
     agents: ApplyAgent[];
     /** Agents that target this plugin but don't have it installed. Populated
-     *  iff `status === "partial-install"`. Lets the UI render per-agent
-     *  ✓/✗ marks and tell the user exactly which side needs `auriga-cli`
-     *  to backfill. Always omitted for `installed` / `not-installed` /
-     *  `update-available`. */
+     *  iff `status === "partial-install"`. Drives the "Missing on Codex"
+     *  UI caption + tells the user exactly which side needs backfill. */
     missingAgents?: ApplyAgent[];
-    currentVersion?: string;
-    expectedVersion?: string;
-    versionSource: "upstream-live" | "catalog";
     /** Scope the scanner read to produce this row. Codex plugins are always
      *  "user" (Codex has no project-scope plugin concept). See WorkflowState
      *  comment on why this is typed optional. */
     observedScope?: ScanScope;
     /** True for plugins whose source lives in an upstream marketplace, not in
-     *  this repo (skill-creator / claude-md-management / codex). The scanner
-     *  short-circuits update-available reporting for these — upgrades go
-     *  through `claude plugins update`, not us. The UI renders an EXTERNAL
-     *  badge to make the "not our jurisdiction" signal explicit. */
+     *  this repo (skill-creator / claude-md-management / codex). Pure UI hint
+     *  since v1.19.0 — the EXTERNAL badge tells users upgrades go through
+     *  `claude plugins update`, not via auriga-cli. */
     external?: boolean;
 }
 export interface HookState {
     name: string;
     description: string;
     status: ItemStatus;
-    currentHash?: string;
-    expectedHash: string;
     /** Scope the scanner read to produce this row. See WorkflowState comment. */
     observedScope?: ScanScope;
 }
@@ -101,7 +87,7 @@ export interface StateWarning {
     message: string;
 }
 export type ApplyCategory = "workflow" | "skill" | "recommended-skill" | "plugin" | "hook";
-export type ApplyAction = "install" | "update" | "uninstall";
+export type ApplyAction = "install" | "uninstall";
 /**
  * Installer scope. Carried per-item so the Web UI can mix scopes within a
  * single apply batch.

package/dist/apply-handlers.js

@@ -17,6 +17,10 @@
 //   hook:               installHook(hookDef, "project",…)│  needs HookDef
 //   hook:               uninstallHook(name, …)           │
 //
+// v1.19.0 dropped the "update" action — every installer is idempotent and
+// overwriting, so re-running install IS the update path. Apply receives
+// "install" or "uninstall" only.
+//
 // Spec: docs/architecture/web-ui.md §6.4 (apply execution model).
 import { installHook, loadHooksConfig, uninstallHook } from "./hooks.js";
 import { installPlugins, uninstallPlugin, } from "./plugins.js";
@@ -24,7 +28,6 @@ import { installRecommendedSkills, installSkills, uninstallSkill, } from "./skil
 import { installWorkflow, uninstallWorkflow } from "./workflow.js";
 const ALL_ACTIONS = new Set([
     "install",
-    "update",
     "uninstall",
 ]);
 function assertAction(action) {
@@ -43,7 +46,7 @@ export function buildDefaultApplyHandlers(ctx) {
         // the Workflow column's EN/ZH-CN picker). Falls back to ctx lang for
         // CLI-mode callers that don't pass it.
         const installLang = requestedLang ?? lang;
-        if (action === "install" || action === "update") {
+        if (action === "install") {
             await installWorkflow(packageRoot, {
                 interactive: false,
                 cwd,
@@ -68,7 +71,7 @@ export function buildDefaultApplyHandlers(ctx) {
     const skill = async (action, name, { onLog, scope }) => {
         assertAction(action);
         const installScope = scope ?? "project";
-        if (action === "install" || action === "update") {
+        if (action === "install") {
             await installSkills(packageRoot, {
                 interactive: false,
                 cwd,
@@ -88,7 +91,7 @@ export function buildDefaultApplyHandlers(ctx) {
     const recommendedSkill = async (action, name, { onLog, scope }) => {
         assertAction(action);
         const installScope = scope ?? "project";
-        if (action === "install" || action === "update") {
+        if (action === "install") {
             await installRecommendedSkills(packageRoot, {
                 interactive: false,
                 cwd,
@@ -119,7 +122,7 @@ export function buildDefaultApplyHandlers(ctx) {
         const failures = [];
         for (const agent of agents) {
             try {
-                if (action === "install" || action === "update") {
+                if (action === "install") {
                     await installPlugins(packageRoot, {
                         interactive: false,
                         cwd,
@@ -162,10 +165,9 @@ export function buildDefaultApplyHandlers(ctx) {
             });
             return;
         }
-        // install + update both run installHook with the requested scope. The
-        // hook installer is idempotent — re-running == "update". Look up the
-        // HookDef in the bundled registry; unknown name → loud throw so the
-        // SSE caller surfaces it as item:done success=false.
+        // Look up the HookDef in the bundled registry; unknown name → loud throw
+        // so the SSE caller surfaces it as item:done success=false. The hook
+        // installer is idempotent; re-running install is the update path.
         const config = loadHooksConfig(packageRoot);
         const hookDef = config.hooks.find((h) => h.name === name);
         if (!hookDef) {

package/dist/catalog.d.ts

@@ -1,14 +1,6 @@
 export interface CatalogEntry {
     name: string;
     description: string;
-    /** Build-time-baked plugin version. Set ONLY for plugin entries whose
-     *  source lives in this repo's `plugins/<name>/` directory — the scanner
-     *  uses it to surface "update-available" when the user's installed copy
-     *  is older. Absent for skill / hook entries and for external-marketplace
-     *  plugins (whose manifest lives upstream). Must be baked at build time
-     *  because `plugins/<name>/.claude-plugin/plugin.json` is NOT shipped in
-     *  the npm tarball (see `package.json` `files` field). */
-    expectedVersion?: string;
     /** Build-time-baked agent map for plugin entries. Derived from
      *  `.claude/plugins.json` ∪ `.agents/plugins/install.json` — those config
      *  files are NOT shipped in the npm tarball, so the scanner can't read
@@ -17,21 +9,13 @@ export interface CatalogEntry {
      *  Absent on skill / hook entries. */
     agents?: ("claude" | "codex")[];
     /** True for plugins whose source lives in an UPSTREAM marketplace
-     *  (skill-creator / claude-md-management / codex), not in this repo. The
-     *  scanner uses this to disable update-available reporting — those
-     *  plugins update through `claude plugins update`, not through us. UI
-     *  surfaces an EXTERNAL badge so users know where to look. */
+     *  (skill-creator / claude-md-management / codex), not in this repo.
+     *  Pure UI hint since v1.19.0 — the EXTERNAL badge tells users that
+     *  upgrades go through `claude plugins update`, not us. */
     external?: boolean;
 }
 export interface Catalog {
     generatedAt: string;
-    /** Workflow content version baked from `CLAUDE.md`'s `# auriga Workflow (vX.Y.Z)`
-     *  header at build time. MUST live here rather than be read at runtime
-     *  because `CLAUDE.md` is NOT in the npm tarball — `package.json` `files`
-     *  allowlists only `dist/`. Empty string when the header is unparseable;
-     *  the scanner then degrades to "trust whatever the user has" rather than
-     *  forcing phantom update-available against an empty expected value. */
-    workflowVersion: string;
     workflowSkills: CatalogEntry[];
     recommendedSkills: CatalogEntry[];
     plugins: CatalogEntry[];

package/dist/catalog.json

@@ -1,15 +1,10 @@
 {
-  "generatedAt": "2026-05-12T16:35:23.439Z",
-  "workflowVersion": "1.7.0",
+  "generatedAt": "2026-05-13T06:35:46.774Z",
   "workflowSkills": [
     {
       "name": "brainstorming",
       "description": "You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation."
     },
-    {
-      "name": "incremental-impl",
-      "description": "Plan a non-trivial code change end-to-end — size triage (XS–XL), slicing strategy, optional parallel subagent dispatch, per-slice Implement → Test → Verify → Commit discipline. Use for any multi-file change, refactor across files, executing a planned task from any planning source, cross-cutting modification (analytics sweep / i18n / library migration), or when about to write more than ~100 lines. 也用于增量实现 / 切片落地 / 推进已规划任务 / 跨切面改动。Skip only for trivial XS edits and pure documentation / configuration changes."
-    },
     {
       "name": "planning-with-files",
       "description": "Implements Manus-style file-based planning to organize and track progress on complex tasks. Creates task_plan.md, findings.md, and progress.md. Use when asked to plan out, break down, or organize a multi-step project, research task, or any work requiring 5+ tool calls. Supports automatic session recovery after /clear."
@@ -18,18 +13,10 @@
       "name": "playwright-cli",
       "description": "Automate browser interactions, test web pages and work with Playwright tests."
     },
-    {
-      "name": "session-compound",
-      "description": "This skill should be used when the user asks to \"复盘 / 总结 / 沉淀 / wrap up this session\", \"整理一下这次会话\", or \"extract takeaways from this session\". It compounds a single Claude Code or Codex CLI session into a self-contained interactive HTML report (narrative timeline + token / cache / tool health + a playground panel with checkable candidate items for ecosystem-skill installs / AGENTS.md edits / new-skill gaps) so the user can review, tick, and copy back a prompt that lands each item in the right place."
-    },
     {
       "name": "systematic-debugging",
       "description": "Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes"
     },
-    {
-      "name": "test-designer",
-      "description": "Design failing tests for complex features using Independent Evaluation — dispatches a context-free agent that sees only the requirement spec and code paths (not the implementation approach), then returns executable failing tests. Use when starting TDD for a non-trivial feature, when the requirement is ambiguous enough that biased tests are a risk, or when the user asks for independent test design."
-    },
     {
       "name": "test-driven-development",
       "description": "Use when implementing any feature or bugfix, before writing implementation code"
@@ -104,8 +91,7 @@
       "agents": [
         "claude",
         "codex"
-      ],
-      "expectedVersion": "1.1.0"
+      ]
     },
     {
       "name": "auriga-git-guards",
@@ -113,8 +99,22 @@
       "agents": [
         "claude",
         "codex"
-      ],
-      "expectedVersion": "1.1.0"
+      ]
+    },
+    {
+      "name": "auriga-workflow-skills",
+      "description": "(Claude/Codex) Bundles the auriga-owned workflow execution skills: incremental-impl, test-designer, and session-compound.",
+      "agents": [
+        "claude",
+        "codex"
+      ]
+    },
+    {
+      "name": "auriga-notify",
+      "description": "(opt-in) Opt-in macOS native notification hook for Claude Code Notification events; migrates legacy notify config and icon on install.",
+      "agents": [
+        "claude"
+      ]
     },
     {
       "name": "deep-review",
@@ -122,22 +122,15 @@
       "agents": [
         "claude",
         "codex"
-      ],
-      "expectedVersion": "0.3.1"
+      ]
     },
     {
       "name": "session-instructions-loader",
       "description": "(Codex) Injects extra instruction files on session start",
       "agents": [
         "codex"
-      ],
-      "expectedVersion": "1.0.0"
+      ]
     }
   ],
-  "hooks": [
-    {
-      "name": "notify",
-      "description": "(opt-in) Native macOS notification when Claude needs your attention (auto-installs alerter via Homebrew)"
-    }
-  ]
+  "hooks": []
 }

package/dist/cli.js

@@ -316,10 +316,22 @@ function validateFilterAgainstCatalog(type, filter) {
     const singular = categorySingular(type);
     for (const name of filter) {
         if (!available.includes(name)) {
-            parseErr(`unknown ${singular} '${name}'; available: ${available.join(", ")}`);
+            const hint = migratedPluginHint(type, name);
+            const hintText = hint ? ` ${hint}` : "";
+            parseErr(`unknown ${singular} '${name}';${hintText} available: ${available.join(", ")}`);
         }
     }
 }
+function migratedPluginHint(type, name) {
+    if (type === "skills" &&
+        ["incremental-impl", "test-designer", "session-compound"].includes(name)) {
+        return "This skill moved to the auriga-workflow-skills plugin; install it with `install plugins --plugin auriga-workflow-skills`.";
+    }
+    if (type === "hooks" && name === "notify") {
+        return "The notify hook moved to the auriga-notify plugin; install it with `install plugins --plugin auriga-notify`.";
+    }
+    return undefined;
+}
 function categorySingular(type) {
     return type === "recommended" ? "recommended skill"
         : type === "skills" ? "skill"
@@ -576,7 +588,29 @@ async function runUi(p, version) {
     const { buildScanCatalog } = await import("./scan-catalog.js");
     const { ensureUiBundle } = await import("./ui-fetch.js");
     const cwd = process.cwd();
-    const packageRoot = getPackageRoot();
+    // Two roots, two responsibilities (mirrors the TTY install path's pattern):
+    //   - tarballRoot: where `dist/catalog.json` + the bundled DEV ui/dist live.
+    //     Always read from the installed npm package; can't be fetched because
+    //     dist/ is built artifact, not git content.
+    //   - contentRoot: where the runtime install recipes live (CLAUDE.md,
+    //     .claude/plugins.json, .claude/hooks/hooks.json, .agents/plugins/
+    //     install.json + marketplace.json, skills-lock.json). These files are
+    //     NOT in the npm tarball — the `files` allowlist only ships `dist/*`
+    //     + npm defaults. They are fetched from GitHub, pinned to the CLI
+    //     version tag, by fetchContentRoot(). Under DEV=1 fetchContentRoot
+    //     short-circuits to the repo root so this is a no-op there.
+    // Without the contentRoot fix, tarball-installed Web UI users hit ENOENT
+    // on any Codex plugin install (apply handlers read .agents/plugins/
+    // install.json from packageRoot).
+    const tarballRoot = getPackageRoot();
+    let contentRoot;
+    try {
+        contentRoot = await fetchContentRoot();
+    }
+    catch (e) {
+        log.error(`Failed to fetch content: ${e.message}`);
+        return 1;
+    }
     // 1. Resolve UI bundle directory.
     let uiDir;
     if (p.uiDir) {
@@ -588,7 +622,7 @@ async function runUi(p, version) {
     }
     else if (process.env.DEV === "1") {
         // Dev convenience: prefer the locally-built ui/dist over a network fetch.
-        const localDist = path.join(packageRoot, "ui", "dist");
+        const localDist = path.join(tarballRoot, "ui", "dist");
         if (fs.existsSync(path.join(localDist, "index.html"))) {
             uiDir = localDist;
         }
@@ -613,7 +647,9 @@ async function runUi(p, version) {
     // 2. Build scan catalog → ApplyCatalog + pluginAgentsByName.
     let scanCatalog;
     try {
-        scanCatalog = await buildScanCatalog(packageRoot);
+        // dist/catalog.json ships in the tarball — read from tarballRoot, not
+        // the fetched content root (which doesn't carry build artifacts).
+        scanCatalog = await buildScanCatalog(tarballRoot);
     }
     catch (e) {
         log.error(`Failed to build catalog: ${e.message}`);
@@ -635,7 +671,10 @@ async function runUi(p, version) {
         pluginAgentsByName.set(name, def.agents);
     }
     const applyHandlers = buildDefaultApplyHandlers({
-        packageRoot,
+        // contentRoot: install handlers read CLAUDE.md, plugins.json,
+        // hooks.json, install.json, marketplace.json — all CONTENT_FILES.
+        // Routing them at tarballRoot fails ENOENT for npm-installed users.
+        packageRoot: contentRoot,
         cwd,
         pluginAgentsByName,
     });
@@ -656,7 +695,11 @@ async function runUi(p, version) {
                 port,
                 token,
                 cwd,
-                packageRoot,
+                // server reads dist/catalog.json (tarball-shipped) via
+                // buildScanCatalog on each /api/state call; install-time content
+                // (install.json, plugins.json, CLAUDE.md, …) was already injected
+                // into applyHandlers above with contentRoot.
+                packageRoot: tarballRoot,
                 heartbeatTimeoutMs: UI_HEARTBEAT_TIMEOUT_MS,
                 applyHandlers,
                 applyCatalog,