codebyplan 1.13.23 → 1.13.25

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codebyplan",
-  "version": "1.13.23",
+  "version": "1.13.25",
   "description": "CLI for CodeByPlan — AI-powered development planning and tracking",
   "type": "module",
   "bin": {
@@ -14,7 +14,7 @@
   "scripts": {
     "build": "tsc --project tsconfig.build.json",
     "build:npm": "node esbuild.npm.mjs",
-    "prepublishOnly": "npm run build:npm",
+    "prepare": "node -e \"const v=process.env.CI;process.exit(v&&v!=='false'&&v!=='0'?0:1)\" || node esbuild.npm.mjs",
     "lint": "eslint",
     "lint:fix": "eslint --fix",
     "format": "prettier --write \"src/**/*.ts\"",

package/templates/agents/cbp-cc-executor.md

@@ -1,7 +1,7 @@
 ---
 scope: org-shared
 name: cbp-cc-executor
-description: Authoring executor for `.claude/` infrastructure. Applies approved changes across rules, skills, agents, context, CLAUDE.md, settings, hooks, and auto-memory — with update-first discipline, scope-marker enforcement, and length-limit awareness. Callable by the main conversation and `/cbp-checkpoint-end`. NEVER called by `round-executor`.
+description: Authoring executor for `.claude/` infrastructure. Applies approved changes across rules, skills, agents, context, CLAUDE.md, settings, hooks, and auto-memory — with update-first discipline, scope-marker enforcement, and length-limit awareness. Callable by the main conversation, `/cbp-checkpoint-end`, and `round-executor` (for in-scope `.claude/` infra deliverables).
 tools: Read, Write, Edit, Glob, Grep, Skill, Task, AskUserQuestion, mcp__codebyplan__create_task
 model: sonnet
 effort: xhigh
@@ -28,15 +28,16 @@ One reusable primitive for applying batches of approved `.claude/` changes. Cent
 | ---------------------------- | ----------------------------------------------------- | -------------------------------------------------- |
 | Main conversation            | User directly asks Claude to update a rule/skill/etc. | Claude spawns the agent instead of editing by hand |
 | `/cbp-checkpoint-end` | Post-ship documentation / CLAUDE.md updates           | Future                                             |
+| `round-executor`             | A round's planned deliverables include `.claude/` infra | Executor delegates the batch here (`source: 'round-executor'`) instead of looping `/cbp-build-cc-*` per file |
 
-**`round-executor` NEVER calls this agent.** Round execution stays code-only. Infrastructure needs discovered mid-round are captured as tasks per `rules/immediate-issue-capture.md`, addressed through fix or a subsequent task.
+**`round-executor` MAY call this agent** to apply IN-SCOPE `.claude/` infrastructure deliverables — paths already in the round's approved `files_to_modify[]`. This is distinct from the immediate-issue-capture path: infrastructure needs *discovered* mid-round that fall OUTSIDE the round's scope are still captured as tasks per `cbp-task-create` Step 3.5 "Immediate Issue Capture Contract" — never routed through this agent.
 
 ## Input Contract
 
 ```yaml
 input:
   repo_id: string
-  source: 'main' | 'checkpoint-end'  # additional internal sources may exist in your CBP setup; extend as needed
+  source: 'main' | 'checkpoint-end' | 'round-executor'  # additional internal sources may exist in your CBP setup; extend as needed
   changes:
     - id: string | number
       type: 'rule' | 'skill' | 'agent' | 'context' | 'architecture' | 'CLAUDE.md' | 'settings' | 'hook' | 'memory'
@@ -102,7 +103,7 @@ For each change in `input.changes`, pre-flight in order:
 
    | `source`                  | Expected                        | On missing/generic                                                                                                                     |
    | ------------------------- | ------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
-   | `main` / `checkpoint-end` | Often absent — caller is ad-hoc | Derive them here: use Phase 1 inventory to list candidates, and fill `why_not_existing` with the agent's own reasoning. Do not reject. |
+   | `main` / `checkpoint-end` / `round-executor` | Often absent — caller is ad-hoc or plan-driven | Derive them here: use Phase 1 inventory to list candidates, and fill `why_not_existing` with the agent's own reasoning. Do not reject. |
 
 4. **Length pre-flight** — for `update`, read current length; reject if the requested change would exceed the block limit in `validate-structure-lengths.sh`. Offer a split proposal via `AskUserQuestion` instead.
 
@@ -134,7 +135,7 @@ Record every applied change with `authored_via` and `status`.
 
 - **Downgrade `create` → `update`** — apply silently, note in output.
 - **Unclear fit between two existing files** — `AskUserQuestion` with the two candidates and their descriptions.
-- **Change exceeds this invocation's scope** (e.g. proposal implies a broader refactor) — create a task via MCP `create_task` per `rules/immediate-issue-capture.md`, record in `deferred_changes` with `task_id_created`.
+- **Change exceeds this invocation's scope** (e.g. proposal implies a broader refactor) — create a task via MCP `create_task` per `cbp-task-create` Step 3.5 "Immediate Issue Capture Contract", record in `deferred_changes` with `task_id_created`.
 - **Hook or settings change with cross-environment implications** — require explicit `scope` field from caller; if missing or ambiguous, ask.
 
 ### Phase 5: Post-Apply Sanity
@@ -204,8 +205,7 @@ Block-limit violations are non-negotiable — split before applying.
 
 ## Integration
 
-- **Spawned by**: main conversation (ad-hoc), `/cbp-checkpoint-end` (future)
-- **Never spawned by**: `round-executor` (round execution stays code-only)
+- **Spawned by**: main conversation (ad-hoc), `/cbp-checkpoint-end` (future), `round-executor` (in-scope `.claude/` infra deliverables, `source: 'round-executor'`)
 - **Reads**: `.claude/` inventory, `validate-structure-lengths.sh`, target files
 - **Writes**: `.claude/` files (via `/cbp-build-cc-*` skills for creates, direct Edit for updates)
 - **Calls skills**: `/cbp-build-cc-rule`, `/cbp-build-cc-skill`, `/cbp-build-cc-claude-file`, `/cbp-build-cc-settings`, `/cbp-build-cc-memory`

package/templates/agents/cbp-improve-round.md

@@ -237,9 +237,9 @@ For each issue found:
 **Corrective-depth advisory**: Before emitting findings, check `round.number` and round provenance:
 - IF `round.number >= 3` AND the round is corrective (round requirements contain improvement/correction verbs: "fix", "address", "correct", "resolve" against a prior finding)
 - THEN prepend to the Phase 6 output: `> [advisory] This is round N. Each successive corrective round increases ship-delay risk; consider deferring low/medium findings to a follow-up TASK in the current checkpoint (not a standalone task). Findings still listed in full — your call.`
-- Findings remain unchanged; this is informational only. Pairs with `rules/planner-spawn-threshold.md` Path B (which keeps trivial corrective rounds cheap) — together they bound corrective-chain depth.
+- Findings remain unchanged; this is informational only. Pairs with the planner's Path B trivial-corrective bypass (which keeps trivial corrective rounds cheap) — together they bound corrective-chain depth.
 
-**Scope-routing recommendation**: For each finding that exceeds the current round's scope, populate `finding.routing_recommendation` per `rules/immediate-issue-capture.md` "How to Capture":
+**Scope-routing recommendation**: For each finding that exceeds the current round's scope, populate `finding.routing_recommendation` per `cbp-task-create` Step 3.5 "Immediate Issue Capture Contract — How to Capture":
 
 | Finding shape | `routing_recommendation` |
 |---------------|--------------------------|

package/templates/agents/cbp-round-executor.md

@@ -2,7 +2,7 @@
 scope: org-shared
 name: cbp-round-executor
 description: Execute approved plan. Receives pre-analyzed deliverables and files list. Focuses on quality implementation. Communicates with user when blocked or needs decisions.
-tools: Read, Write, Edit, Glob, Grep, Bash, TaskUpdate, AskUserQuestion, Skill
+tools: Read, Write, Edit, Glob, Grep, Bash, TaskUpdate, AskUserQuestion, Skill, Task
 model: sonnet
 effort: xhigh
 ---
@@ -94,6 +94,7 @@ output:
 | TaskUpdate | Mark todos as complete |
 | AskUserQuestion | **Critical** - Ask user when blocked or need decisions |
 | Skill | **Required** - Invoke routing commands for managed files |
+| Task | Spawn sub-executor agents (Step 3.5): `cbp-database-agent`, `general-purpose`, `cbp-cc-executor` — NEVER `cbp-e2e-*` (orchestrator-owned) |
 
 **Key Principle:** If something is unclear or you're blocked, ASK the user. Don't make assumptions.
 
@@ -140,6 +141,8 @@ Action: {Use Skill tool for routing / Proceed with direct edits}
 
 **Critical:** If ANY file requires routing, you MUST use the Skill tool. NEVER use Edit/Write on managed files.
 
+**Batch alternative:** when `files_to_modify[]` contains MULTIPLE `.claude/` infra files, you MAY delegate the whole batch to `cbp-cc-executor` (Step 3.5) instead of looping the build-cc skills here — cc-executor applies the same routing with centralized update-first / scope-marker / length discipline. Single-file managed edits stay on the Skill-tool routing above.
+
 #### Step 0.1: Scope-Leak Guard (MANDATORY)
 
 Before ANY Write/Edit invocation during execution, the target path MUST appear in the active scope. When running in wave mode (`wave` input is present), the scope is `wave.files[]`; otherwise it is `approved_plan.files_to_modify[].path`. Silent absorption of an out-of-scope file is forbidden — every absorbed file dilutes the round's diff and erodes plan-as-contract guarantees.
@@ -183,7 +186,7 @@ Two categories of work are NOT performed by this agent and must be returned to t
 | Action | Why excluded | Where it goes |
 |--------|--------------|---------------|
 | MCP `create_task`, `update_task`, `complete_task`, `add_round`, etc. (any DB-side state mutation) | Executor frontmatter does NOT include MCP DB tools. Tool-not-available errors force orchestrator improvisation. | Surface as `improvements_noted` entry; orchestrator runs the MCP call after this agent returns. Executor never tries to invoke MCP DB tools. |
-| Spawning `cbp-e2e-*` specialist agents | Executor's tools list (Read/Write/Edit/Glob/Grep/Bash/TaskUpdate/AskUserQuestion/Skill) does NOT include the `Task` / Agent tool. E2E execution is owned by the `cbp-e2e-*` specialist agents (dispatched per `context/testing/e2e.md`), spawned by `/cbp-round-execute` Step 5 (parallel with `cbp-testing-qa-agent`) and is invoked by the orchestrator. | Set `specialist_needs.review_needed.ux_review` / `ui_review` if applicable. Do NOT attempt to spawn any e2e agent from inside the executor. |
+| Spawning `cbp-e2e-*` specialist agents | E2E execution is **orchestrator-owned by design** — the `cbp-e2e-*` specialist agents (dispatched per `context/testing/e2e.md`) are spawned by `/cbp-round-execute` Step 5 (parallel with `cbp-testing-qa-agent`), NOT by this executor. The executor's `Task` tool exists ONLY for the Step 3.5 sub-executor delegations (`cbp-database-agent`, `general-purpose`, `cbp-cc-executor`) — it is never used to spawn an e2e specialist even though it now physically could. | Set `specialist_needs.review_needed.ux_review` / `ui_review` if applicable. Do NOT attempt to spawn any e2e agent from inside the executor. |
 
 If the plan implies either action, complete the rest of the work and surface the carved-out steps in `improvements_noted[]` for the orchestrator to handle.
 
@@ -305,6 +308,7 @@ When the approved plan includes specialized work, delegate to sub-executor agent
 |-----------|-------|-----------------|
 | Supabase migrations, RLS, types | `cbp-database-agent` | Plan includes DB schema changes, RLS policies, or type generation |
 | Batch identical-structure file writes (≥4 files) | `general-purpose` (background) | Plan has 4+ independent files, no shared state, no ordered dependency |
+| `.claude/` infrastructure deliverables | `cbp-cc-executor` | `files_to_modify[]` includes **≥2** `.claude/` files (rules, skills, agents, context, hooks, settings, CLAUDE.md). A single `.claude/` file edit stays on Step 0 Skill-tool routing |
 
 **How to delegate to `cbp-database-agent`:**
 1. Collect all DB-related steps from the plan
@@ -316,6 +320,18 @@ When the approved plan includes specialized work, delegate to sub-executor agent
 - Simple Supabase queries in application code (executor handles these)
 - Only delegate schema/migration/RLS/type generation work
 
+**How to delegate to `cbp-cc-executor`:**
+1. Collect every `files_to_modify[]` entry whose path is under `.claude/` (or is `CLAUDE.md`).
+2. Build cc-executor's `input.changes[]` — one entry per file (`type`, `target`, `action`, `description`, `reasoning`, `source_of_proposal`).
+3. Spawn `cbp-cc-executor` via Agent tool with `source: 'round-executor'` and those changes.
+4. Merge its `applied_changes` / `files_changed` into executor output; surface any `deferred_changes` / `conflicts` in `improvements_noted[]`.
+
+> **Agent-create guard**: cc-executor REJECTS `type: 'agent'` with `action: 'create'` (its No-Go table — agent creation is a planning-level decision). If `files_to_modify[]` contains an agent **create**, surface it via `AskUserQuestion` BEFORE spawning rather than letting it come back as `status: 'rejected'`. Agent **updates** delegate normally.
+
+**When NOT to delegate to `cbp-cc-executor`:**
+- A single `.claude/` file edit — the Step 0 build-cc routing (Skill tool) handles it; reserve cc-executor for multi-file batches or when its centralized update-first / scope / length discipline adds value.
+- Infra needs *discovered* mid-round that are OUTSIDE `files_to_modify[]` — those become tasks per `cbp-task-create` Step 3.5, NEVER a cc-executor call.
+
 #### Background General-Purpose Delegation
 
 **Trigger** — all of the following must hold:
@@ -585,7 +601,7 @@ Which would you prefer?
 - **Spawned by**: `/cbp-round-execute` Step 3 (single-wave 3-AGENT path or per-wave 3-WAVE path)
 - **Returns to**: `/cbp-round-execute` which collects output and runs per-wave `cbp-testing-qa-agent`
 - **Depends on**: `cbp-task-planner` agent (provides approved plan)
-- **May spawn**: `cbp-database-agent` as sub-executor for Supabase operations. (NOT any `cbp-e2e-*` specialist — those are owned by the `cbp-e2e-*` specialist agents (dispatched per `context/testing/e2e.md`), spawned by `/cbp-round-execute` Step 5 per Step 0.2 carve-out.)
+- **May spawn**: `cbp-database-agent` (Supabase operations), `general-purpose` (background batch writes), and `cbp-cc-executor` (in-scope `.claude/` infra deliverables, `source: 'round-executor'`) as sub-executors. (NOT any `cbp-e2e-*` specialist — e2e is orchestrator-owned, spawned by `/cbp-round-execute` Step 5 per the Step 0.2 carve-out.)
 
 ## Structure Knowledge
 
@@ -603,4 +619,4 @@ improvements_noted:
     suggestion: 'Add [pattern] to [skill-name] or create new skill'
 ```
 
-**Do NOT edit rules/skills during execution** - `cbp-improve-claude` handles `.claude/` updates after task completion.
+**Do NOT make self-directed rules/skills edits based on gaps you discover mid-execution** — those go through `cbp-improve-claude` after task completion. This is distinct from approved `.claude/` deliverables already in `files_to_modify[]`, which ARE applied this round via the Step 3.5 `cbp-cc-executor` delegation path (or Step 0 Skill-tool routing for a single file).

package/templates/agents/cbp-testing-qa-agent.md

@@ -300,11 +300,11 @@ Mandatory dependency vulnerability scan:
 
 ### Phase 3.8: Capture Unrelated Issues — Default to Current Scope
 
-For each entry in `unrelated_issues[]` with severity `warning` or `critical`, route per `immediate-issue-capture.md` "How to Capture" — DO NOT default to standalone task creation.
+For each entry in `unrelated_issues[]` with severity `warning` or `critical`, route per `cbp-task-create` Step 3.5 "Immediate Issue Capture Contract — How to Capture" — DO NOT default to standalone task creation.
 
 **Routing logic** (walk top-down; use the first row that fits):
 
-1. **Trivial inline fix** (≤5 min, mechanical, scope-clean per `infra-issue-absorption.md` Trivial-Resolution Exception) — leave the issue in `unrelated_issues[]` with `routing: "inline"` and let the orchestrator absorb it into the current round before `/cbp-round-end`.
+1. **Trivial inline fix** (≤5 min, mechanical, scope-clean per `cbp-round-end` reference `findings-presentation.md` "Infra Issue Absorption Contract — Trivial-Resolution Exception") — leave the issue in `unrelated_issues[]` with `routing: "inline"` and let the orchestrator absorb it into the current round before `/cbp-round-end`.
 
 2. **Related to current task's domain** (most cases) — emit the finding in `unrelated_issues[]` with `routing: "new_round_in_current_task"`. The agent does NOT call `create_task`. `/cbp-round-end` consumes these and includes them as requirements for the next round of the current task.
 
@@ -318,7 +318,7 @@ For routings 1-4, include each finding in `unrelated_issues[]` with the routing
 
 The agent's job is **classification + recommendation**, not unilateral task creation. Standalone creation outside the timed-re-check case requires explicit user confirmation at `/cbp-round-end`.
 
-This aligns with `immediate-issue-capture.md` (resolve-in-current-scope by default; standalone is rare) and `infra-issue-absorption.md` (absorb-by-default since the flip from defer-by-default).
+This aligns with `cbp-task-create` Step 3.5 "Immediate Issue Capture Contract" (resolve-in-current-scope by default; standalone is rare) and `cbp-round-end` reference `findings-presentation.md` "Infra Issue Absorption Contract" (absorb-by-default since the flip from defer-by-default).
 
 ### Phase 4: QA Generation
 

package/templates/hooks/README.md

@@ -18,7 +18,7 @@ Renders up to 6 structured lines below Claude Code's prompt area. Reads JSON fro
 
 **Render lines:**
 
-- **Line 1 — Identity**: **folder name** (basename of `cwd`) + **git branch** (always shown — taken from `worktree.branch`, else derived via `git -C <cwd> rev-parse --abbrev-ref HEAD`, so it appears even without a registered worktree); single prefix (`wt:NAME` / `session:NAME` / `agent:NAME`, priority order); model **display name only**; `effort:LEVEL` (when set); `thinking:on` (only when thinking is enabled); `style:NAME` (when output style is not "default"); `[VIM_MODE]`
+- **Line 1 — Identity**: **folder name** (basename of `cwd`) + **git branch** (always shown — taken from `worktree.branch`, else derived via `git -C <cwd> rev-parse --abbrev-ref HEAD`, so it appears even without a registered worktree); single prefix (`wt:NAME` / `session:NAME` / `agent:NAME`, priority order); model **display name only**; `effort:LEVEL` (when set); `style:NAME` (when output style is not "default"); `[VIM_MODE]`
 - **Line 2 — Context**: 20-character progress bar (green / yellow / red at 50% / 75%); `used% / ctx_size`; per-call token breakdown — `in:N out:N cache_cr:N cache_rd:N` (from `context_window.current_usage`); `⚠ 200k+` banner when `exceeds_200k_tokens` is true
 - **Line 3 — Cost**: session cost in USD; total wall duration (`dur:`) and API-only duration (`api:`) via human-readable format; lines added/removed
 - **Line 4 — Rate limits**: `5h: PCT% (resets in Xh)` and `7d: PCT% (resets in Xd)` with relative-time helper; colour-coded green / yellow / red at 60% / 80%; emitted only when at least one window has a non-zero `resets_at` epoch

package/templates/hooks/cbp-statusline.mjs

@@ -77,7 +77,6 @@ function main() {
   );
   const EXCEEDS_200K = get(data, ["exceeds_200k_tokens"], false);
   const EFFORT = get(data, ["effort", "level"], "");
-  const THINKING = get(data, ["thinking", "enabled"], false);
   const RATE_5H_PCT = get(
     data,
     ["rate_limits", "five_hour", "used_percentage"],
@@ -119,6 +118,7 @@ function main() {
     repo_pr: true,
     worktree: true,
     infra_drift: true,
+    package_freshness: true,
     no_color: false,
   };
   try {
@@ -138,6 +138,7 @@ function main() {
           "repo_pr",
           "worktree",
           "infra_drift",
+          "package_freshness",
         ]) {
           if (typeof parsed.lines[k] === "boolean") cfg[k] = parsed.lines[k];
         }
@@ -190,6 +191,9 @@ function main() {
     return String(n);
   };
 
+  // Percentage formatter (integer round-half-up; cross-runtime identical).
+  const fmtPct = (n) => String(Math.floor(Number(n) + 0.5));
+
   const fmtK = (val) => {
     const v = Number(val);
     if (v >= 1000000) {
@@ -203,9 +207,9 @@ function main() {
   };
 
   const fmtCost = (c) => {
-    const n = Math.floor(Number(c) * 10000 + 0.5);
-    const frac = String(n % 10000).padStart(4, "0");
-    return `$${Math.floor(n / 10000)}.${frac}`;
+    const n = Math.floor(Number(c) * 100 + 0.5);
+    const frac = String(n % 100).padStart(2, "0");
+    return `$${Math.floor(n / 100)}.${frac}`;
   };
 
   const fmtDur = (ms) => {
@@ -281,7 +285,6 @@ function main() {
       L1 += `${C.BOLD}${C.CYAN}${MODEL_ID}${C.RST}`;
     }
     if (EFFORT) L1 += ` ${C.DIM}effort:${C.RST}${EFFORT}`;
-    if (THINKING === true) L1 += ` ${C.YELLOW}thinking:on${C.RST}`;
     if (OUTPUT_STYLE && OUTPUT_STYLE !== "default")
       L1 += ` ${C.DIM}style:${C.RST}${OUTPUT_STYLE}`;
     if (VIM_MODE) L1 += ` ${C.DIM}[${VIM_MODE}]${C.RST}`;
@@ -325,18 +328,20 @@ function main() {
     if (has5h || has7d) {
       let L4 = "";
       if (has5h) {
+        const r5 = fmtPct(RATE_5H_PCT);
         let c5;
-        if (gte(RATE_5H_PCT, 80)) c5 = C.RED;
-        else if (gte(RATE_5H_PCT, 60)) c5 = C.YELLOW;
+        if (gte(r5, 80)) c5 = C.RED;
+        else if (gte(r5, 60)) c5 = C.YELLOW;
         else c5 = C.GREEN;
-        L4 = `${C.DIM}5h:${C.RST}${c5}${numStr(RATE_5H_PCT)}%${C.RST} ${C.DIM}(resets in ${fmtRelTime(RATE_5H_RESETS)})${C.RST}`;
+        L4 = `${C.DIM}5h:${C.RST}${c5}${r5}%${C.RST} ${C.DIM}(resets in ${fmtRelTime(RATE_5H_RESETS)})${C.RST}`;
       }
       if (has7d) {
+        const r7 = fmtPct(RATE_7D_PCT);
         let c7;
-        if (gte(RATE_7D_PCT, 80)) c7 = C.RED;
-        else if (gte(RATE_7D_PCT, 60)) c7 = C.YELLOW;
+        if (gte(r7, 80)) c7 = C.RED;
+        else if (gte(r7, 60)) c7 = C.YELLOW;
         else c7 = C.GREEN;
-        const seg7 = `${C.DIM}7d:${C.RST}${c7}${numStr(RATE_7D_PCT)}%${C.RST} ${C.DIM}(resets in ${fmtRelTime(RATE_7D_RESETS)})${C.RST}`;
+        const seg7 = `${C.DIM}7d:${C.RST}${c7}${r7}%${C.RST} ${C.DIM}(resets in ${fmtRelTime(RATE_7D_RESETS)})${C.RST}`;
         L4 = L4 ? `${L4} ${C.DIM}|${C.RST} ${seg7}` : seg7;
       }
       out.push(L4);
@@ -418,6 +423,96 @@ function main() {
     }
   }
 
+  // ============================================================
+  // LINE 8 — Package freshness (codebyplan version / sync state)
+  // ============================================================
+  // Source: .codebyplan/claude-status.local.json (written by background refresh).
+  // Inline fallback (cache absent): read .claude/.cbp.manifest.json vs
+  // node_modules/codebyplan/package.json. HIDE when guarded (canonical_source /
+  // no_manifest / unknown) or when manifest absent (not a managed consumer).
+  if (shouldShow("PACKAGE_FRESHNESS", cfg.package_freshness)) {
+    let guarded = false;
+    let installed = "";
+    let newer = false;
+    let latest = "";
+    let inSync = true;
+
+    const cachePath = path.join(
+      root,
+      ".codebyplan",
+      "claude-status.local.json"
+    );
+    if (fs.existsSync(cachePath)) {
+      try {
+        const cacheRaw = fs.readFileSync(cachePath, "utf8");
+        const cache = JSON.parse(cacheRaw);
+        if (cache && typeof cache === "object") {
+          const gr = cache.guard_reason;
+          if (
+            gr === "canonical_source" ||
+            gr === "no_manifest" ||
+            gr === "unknown"
+          ) {
+            guarded = true;
+          } else {
+            installed =
+              typeof cache.installed === "string" ? cache.installed : "";
+            newer = cache.newer === true;
+            latest = typeof cache.latest === "string" ? cache.latest : "";
+            inSync = cache.in_sync !== false;
+          }
+        }
+      } catch {
+        // Unreadable / invalid → keep guarded=false, installed=""
+      }
+    } else {
+      // Inline fallback: no cache — read-only file reads only, no network.
+      const manifestPath = path.join(root, ".claude", ".cbp.manifest.json");
+      const pkgPath = path.join(
+        root,
+        "node_modules",
+        "codebyplan",
+        "package.json"
+      );
+      if (!fs.existsSync(manifestPath)) {
+        // No manifest → not a managed consumer → hide.
+        guarded = true;
+      } else {
+        try {
+          const mRaw = fs.readFileSync(manifestPath, "utf8");
+          const mParsed = JSON.parse(mRaw);
+          const mVer =
+            typeof mParsed?.version === "string" ? mParsed.version : "";
+          const pRaw = fs.readFileSync(pkgPath, "utf8");
+          const pParsed = JSON.parse(pRaw);
+          const iVer =
+            typeof pParsed?.version === "string" ? pParsed.version : "";
+          installed = iVer;
+          if (mVer && iVer && mVer !== iVer) {
+            // manifest ≠ installed → .claude is out of sync → ⟳ run claude update
+            // (mirrors the doctor's version_skip → in_sync:false). No npm info in
+            // the offline fallback, so never the ↑ newer-available marker.
+            inSync = false;
+          }
+        } catch {
+          // Can't read files → hide segment.
+          guarded = true;
+        }
+      }
+    }
+
+    if (!guarded && installed) {
+      let L8 = `${C.DIM}cbp${C.RST} ${installed}`;
+      if (newer && latest) {
+        L8 += ` ${C.YELLOW}↑${latest}${C.RST}`;
+      }
+      if (!inSync) {
+        L8 += ` ${C.YELLOW}⟳ run claude update${C.RST}`;
+      }
+      out.push(L8);
+    }
+  }
+
   process.stdout.write(out.length ? out.join("\n") + "\n" : "");
 }
 

package/templates/hooks/cbp-statusline.py

@@ -60,7 +60,6 @@ def main():
     CACHE_READ = _get(data, ["context_window", "current_usage", "cache_read_input_tokens"], 0)
     EXCEEDS_200K = _get(data, ["exceeds_200k_tokens"], False)
     EFFORT = _get(data, ["effort", "level"], "")
-    THINKING = _get(data, ["thinking", "enabled"], False)
     RATE_5H_PCT = _get(data, ["rate_limits", "five_hour", "used_percentage"], "")
     RATE_5H_RESETS = _get(data, ["rate_limits", "five_hour", "resets_at"], 0)
     RATE_7D_PCT = _get(data, ["rate_limits", "seven_day", "used_percentage"], "")
@@ -81,7 +80,7 @@ def main():
     cfg = {
         "identity": True, "context": True, "cost": True,
         "rate_limits": True, "repo_pr": True, "worktree": True,
-        "infra_drift": True, "no_color": False,
+        "infra_drift": True, "package_freshness": True, "no_color": False,
     }
     try:
         with open(os.path.join(root, ".codebyplan", "statusline.json"), "r", encoding="utf-8") as fh:
@@ -91,7 +90,7 @@ def main():
                 cfg["no_color"] = parsed["no_color"]
             lines = parsed.get("lines")
             if isinstance(lines, dict):
-                for k in ["identity", "context", "cost", "rate_limits", "repo_pr", "worktree", "infra_drift"]:
+                for k in ["identity", "context", "cost", "rate_limits", "repo_pr", "worktree", "infra_drift", "package_freshness"]:
                     if isinstance(lines.get(k), bool):
                         cfg[k] = lines[k]
     except Exception:
@@ -134,6 +133,10 @@ def main():
             return str(int(x))
         return str(n)
 
+    # Percentage formatter (integer round-half-up; cross-runtime identical).
+    def fmt_pct(n):
+        return "%d" % int(float(n) + 0.5)
+
     def fmt_k(val):
         v = float(val)
         if v >= 1000000:
@@ -145,8 +148,8 @@ def main():
         return str(int(v))
 
     def fmt_cost(c):
-        n = math.floor(float(c) * 10000 + 0.5)
-        return "$%d.%04d" % (n // 10000, n % 10000)
+        n = math.floor(float(c) * 100 + 0.5)
+        return "$%d.%02d" % (n // 100, n % 100)
 
     def fmt_dur(ms):
         secs = math.trunc(float(ms) / 1000)
@@ -217,8 +220,6 @@ def main():
             l1 += "%s%s%s%s" % (BOLD, CYAN, MODEL_ID, RST)
         if EFFORT:
             l1 += " %seffort:%s%s" % (DIM, RST, EFFORT)
-        if THINKING is True:
-            l1 += " %sthinking:on%s" % (YELLOW, RST)
         if OUTPUT_STYLE and OUTPUT_STYLE != "default":
             l1 += " %sstyle:%s%s" % (DIM, RST, OUTPUT_STYLE)
         if VIM_MODE:
@@ -273,24 +274,26 @@ def main():
         if has_5h or has_7d:
             l4 = ""
             if has_5h:
-                if gte(RATE_5H_PCT, 80):
+                r5 = fmt_pct(RATE_5H_PCT)
+                if gte(r5, 80):
                     c5 = RED
-                elif gte(RATE_5H_PCT, 60):
+                elif gte(r5, 60):
                     c5 = YELLOW
                 else:
                     c5 = GREEN
                 l4 = "%s5h:%s%s%s%%%s %s(resets in %s)%s" % (
-                    DIM, RST, c5, num_str(RATE_5H_PCT), RST, DIM, fmt_rel_time(RATE_5H_RESETS), RST,
+                    DIM, RST, c5, r5, RST, DIM, fmt_rel_time(RATE_5H_RESETS), RST,
                 )
             if has_7d:
-                if gte(RATE_7D_PCT, 80):
+                r7 = fmt_pct(RATE_7D_PCT)
+                if gte(r7, 80):
                     c7 = RED
-                elif gte(RATE_7D_PCT, 60):
+                elif gte(r7, 60):
                     c7 = YELLOW
                 else:
                     c7 = GREEN
                 seg7 = "%s7d:%s%s%s%%%s %s(resets in %s)%s" % (
-                    DIM, RST, c7, num_str(RATE_7D_PCT), RST, DIM, fmt_rel_time(RATE_7D_RESETS), RST,
+                    DIM, RST, c7, r7, RST, DIM, fmt_rel_time(RATE_7D_RESETS), RST,
                 )
                 l4 = ("%s %s|%s %s" % (l4, DIM, RST, seg7)) if l4 else seg7
             out.append(l4)
@@ -343,6 +346,69 @@ def main():
             if behind > 0:
                 out.append("%s⚠ infra %d behind%s %s→ /cbp-refresh-infra%s" % (YELLOW, behind, RST, DIM, RST))
 
+    # ===== LINE 8 — Package freshness (codebyplan version / sync state) =====
+    # Source: .codebyplan/claude-status.local.json (written by background refresh).
+    # Inline fallback (cache absent): read .claude/.cbp.manifest.json vs
+    # node_modules/codebyplan/package.json. HIDE when guarded (canonical_source /
+    # no_manifest / unknown) or when manifest absent (not a managed consumer).
+    if should_show("PACKAGE_FRESHNESS", cfg["package_freshness"]):
+        _guarded = False
+        _installed = ""
+        _newer = False
+        _latest = ""
+        _in_sync = True
+
+        cache_path = os.path.join(root, ".codebyplan", "claude-status.local.json")
+        if os.path.isfile(cache_path):
+            try:
+                with open(cache_path, "r", encoding="utf-8") as fh:
+                    cache = json.load(fh)
+                if isinstance(cache, dict):
+                    gr = cache.get("guard_reason")
+                    if gr in ("canonical_source", "no_manifest", "unknown"):
+                        _guarded = True
+                    else:
+                        _installed = cache.get("installed") if isinstance(cache.get("installed"), str) else ""
+                        _newer = cache.get("newer") is True
+                        _latest = cache.get("latest") if isinstance(cache.get("latest"), str) else ""
+                        _in_sync = cache.get("in_sync") is not False
+            except Exception:
+                pass  # Unreadable / invalid → keep _installed=""
+        else:
+            # Inline fallback: no cache — read-only file reads only, no network.
+            manifest_path = os.path.join(root, ".claude", ".cbp.manifest.json")
+            pkg_path = os.path.join(root, "node_modules", "codebyplan", "package.json")
+            if not os.path.isfile(manifest_path):
+                # No manifest → not a managed consumer → hide.
+                _guarded = True
+            else:
+                try:
+                    with open(manifest_path, "r", encoding="utf-8") as fh:
+                        m_data = json.load(fh)
+                    m_ver = m_data.get("version") if isinstance(m_data, dict) else ""
+                    m_ver = m_ver if isinstance(m_ver, str) else ""
+                    with open(pkg_path, "r", encoding="utf-8") as fh:
+                        p_data = json.load(fh)
+                    i_ver = p_data.get("version") if isinstance(p_data, dict) else ""
+                    i_ver = i_ver if isinstance(i_ver, str) else ""
+                    _installed = i_ver
+                    if m_ver and i_ver and m_ver != i_ver:
+                        # manifest != installed -> .claude is out of sync -> run claude update
+                        # (mirrors the doctor's version_skip -> in_sync:false). No npm info
+                        # in the offline fallback, so never the up-arrow newer marker.
+                        _in_sync = False
+                except Exception:
+                    # Can't read files → hide segment.
+                    _guarded = True
+
+        if not _guarded and _installed:
+            l8 = "%scbp%s %s" % (DIM, RST, _installed)
+            if _newer and _latest:
+                l8 += " %s↑%s%s" % (YELLOW, _latest, RST)
+            if not _in_sync:
+                l8 += " %s⟳ run claude update%s" % (YELLOW, RST)
+            out.append(l8)
+
     sys.stdout.write(("\n".join(out) + "\n") if out else "")