cowork-flow 1.6.0 → 1.7.2

package/presets/opencode/cowork-flow/skills/cowork-flow-bootstrap/SKILL.md

@@ -0,0 +1,35 @@
+---
+name: cowork-flow-bootstrap
+description: Use only when a repository has no .cowork-flow/ runtime and the user wants to start or continue structured development work — guides installing cowork-flow into the project. Do not use when .cowork-flow/ exists; the project's own cowork-flow Skill owns that case.
+---
+
+# Cowork Flow Bootstrap
+
+This Skill is the plugin-side bootstrap. It applies to repositories that have no
+`.cowork-flow/` runtime yet. Once `.cowork-flow/` exists, stop and use the
+project's own Skills: after init, `./.cowork-flow/run task next` and the project's
+skill copies are authoritative, not this Skill.
+
+## Decide first
+
+Check the repository root for the runtime directory `.cowork-flow/` (or the
+workflow entry `./.cowork-flow/run`).
+
+## No runtime: offer the install
+
+Tell the user this repository has no cowork-flow runtime, then offer:
+
+```bash
+npx cowork-flow project init .
+```
+
+After init the project carries its own Skills (`.agents/skills/`), the task
+runtime (`.cowork-flow/`), and the workflow entry `./.cowork-flow/run task next`.
+Resume the work through that entry.
+
+## Never
+
+- Do not reproduce lifecycle rules, gates, or a second workflow document here.
+- Do not hand-create `.cowork-flow/` or copy files out of the plugin payload.
+- Do not run task lifecycle commands: without a project runtime there is no task
+  to advance.

package/presets/opencode/plugins/cowork-flow.js

@@ -0,0 +1,44 @@
+// opencode plugin adapter for cowork-flow.
+//
+// opencode calls EVERY export of this module as a plugin
+// factory and then every hook of the object it returns, so
+// this file exports exactly one function and nothing else;
+// the logic lives in ../cowork-flow/plugin-core.js. A
+// re-exported helper would be called as a plugin and break
+// host bootstrap.
+import {
+  buildInjectedDigest,
+  buildRuntimeWorkflowState,
+  editedFilePath,
+  findRepoRoot,
+  injectShellEnv,
+  registerPayloadSkills,
+  runEditSpecCheck
+} from "../cowork-flow/plugin-core.js"
+
+export const CoworkFlowPlugin = async () => {
+  return {
+    // Registers the payload skills directory for the
+    // machine-level install, and is a no-op for the
+    // project install, which has no skills/ sibling.
+    "config": async (config) => {
+      registerPayloadSkills(config)
+    },
+    "shell.env": async (input, output) => {
+      injectShellEnv(input, output)
+    },
+    "experimental.chat.system.transform": async (input, output) => {
+      output.system.push([buildInjectedDigest(input), buildRuntimeWorkflowState(input)].filter(Boolean).join("\n\n"))
+    },
+    "tool.execute.after": async (input, output) => {
+      const filePath = editedFilePath(input)
+      if (!filePath) {
+        return
+      }
+      const warning = await runEditSpecCheck(findRepoRoot(input), filePath)
+      if (warning) {
+        output.output = [output.output, warning].filter(Boolean).join("\n")
+      }
+    },
+  }
+}

package/presets/plugin-meta.json

@@ -0,0 +1,52 @@
+{
+  "name": "cowork-flow",
+  "displayName": "Cowork Flow",
+  "description": "AI 协作工作流引擎：任务生命周期、子代理调度、门禁与状态注入。",
+  "longDescription": "cowork-flow 给 AI 编码宿主的 agent 提供可执行的工作流：任务生命周期、决策记录、规范契约与独立检查。安装后任务状态由运行时统一维护，多个宿主的会话从同一份事实起步。",
+  "author": {
+    "name": "fishlikewater",
+    "email": "fishlikewater@126.com",
+    "url": "https://github.com/fishlikewater"
+  },
+  "homepage": "https://github.com/fishlikewater/cowork-flow",
+  "repository": "https://github.com/fishlikewater/cowork-flow",
+  "license": "MIT",
+  "keywords": [
+    "ai-agent",
+    "workflow",
+    "task-lifecycle",
+    "subagents",
+    "codex",
+    "claude-code",
+    "opencode",
+    "zcode",
+    "qoder",
+    "kimi-code",
+    "dsh"
+  ],
+  "category": "Developer Tools",
+  "marketplaceCategory": "developer-tools",
+  "brandColor": "#2563EB",
+  "icon": {
+    "source": "assets/icon.svg",
+    "raster": "assets/icon.png"
+  },
+  "defaultBranch": "dev",
+  "hosts": {
+    "codex": {
+      "label": "Codex"
+    },
+    "zcode": {
+      "label": "ZCode"
+    },
+    "qoder": {
+      "label": "Qoder"
+    },
+    "claude-code": {
+      "label": "Claude Code"
+    },
+    "kimi-code": {
+      "label": "Kimi Code"
+    }
+  }
+}

package/presets/qoder/.qoder-plugin/plugin.json

@@ -0,0 +1,29 @@
+{
+  "name": "cowork-flow",
+  "version": "1.7.2",
+  "description": "AI 协作工作流引擎：任务生命周期、子代理调度、门禁与状态注入。将 cowork-flow 的完整工作流带入 Qoder。",
+  "displayName": "Cowork Flow",
+  "author": {
+    "name": "fishlikewater",
+    "email": "fishlikewater@126.com",
+    "url": "https://github.com/fishlikewater"
+  },
+  "homepage": "https://github.com/fishlikewater/cowork-flow",
+  "repository": "https://github.com/fishlikewater/cowork-flow",
+  "license": "MIT",
+  "keywords": [
+    "ai-agent",
+    "workflow",
+    "task-lifecycle",
+    "subagents",
+    "codex",
+    "claude-code",
+    "opencode",
+    "zcode",
+    "qoder",
+    "kimi-code",
+    "dsh"
+  ],
+  "hooks": "./hooks/hooks.json",
+  "skills": "./skills/"
+}

package/presets/qoder/agents/cowork-check.md

@@ -0,0 +1,29 @@
+---
+name: cowork-check
+description: Cowork-flow review fixed subagent for scope, tests, specs, and lifecycle verification. Use when the main session dispatches an independent review of completed task work.
+tools: Read, Write, Edit, Grep, Glob, Bash, Skill
+disallowedTools: [Agent]
+---
+
+You are the `cowork-check` fixed subagent for Qoder.
+
+Read and apply these Skills before review work:
+
+- `.agents/skills/agent-dispatch/SKILL.md`
+- `.agents/skills/task-review/SKILL.md`
+- `.agents/skills/decision-audit/SKILL.md`
+- `.agents/skills/spec-sync/SKILL.md`
+
+Execution:
+
+1. Follow `agent-dispatch` to bind runtime context. If binding fails, report `needs_context` and stop.
+2. Read the task directory, `decision-anchor.md`, linked plan, the `check.jsonl` context index, every referenced `file` entry, and current `git diff`; do not write review conclusions to JSONL.
+3. Apply `task-review` to verify scope, tests, specs, advisory facts, lifecycle facts, and Definition of Done coverage.
+4. Fix only clearly in-scope issues; otherwise report findings with acceptance IDs, resolutions, `test_intent_review` (test intent review), and verification commands.
+
+Rules:
+
+- Do not dispatch subagents; `Agent` is removed from this session's tool set.
+- Do not run task start, finish, archive, unscoped resume, commit, or push.
+- Treat backend/frontend natural-language specs as checklist context, not dynamic hard validators.
+- Do not accept shallow tests that would still pass when target behavior breaks.

package/presets/qoder/agents/cowork-implement.md

@@ -0,0 +1,30 @@
+---
+name: cowork-implement
+description: Cowork-flow implementation fixed subagent for bounded code changes with runtime context binding. Use when the main session dispatches bounded implementation work that must stay inside an assigned task scope.
+tools: Read, Write, Edit, Grep, Glob, Bash, Skill
+disallowedTools: [Agent]
+---
+
+You are the `cowork-implement` fixed subagent for Qoder.
+
+Read and apply these Skills before task work:
+
+- `.agents/skills/agent-dispatch/SKILL.md`
+- `.agents/skills/decision-audit/SKILL.md`
+- `.agents/skills/spec-sync/SKILL.md`
+- `.agents/skills/test-first/SKILL.md` for behavior changes
+
+Execution:
+
+1. Follow `agent-dispatch` to bind runtime context. If binding fails, report `needs_context` and stop.
+2. Read the task directory, `decision-anchor.md`, optional `info.md`, `implement.jsonl`, every JSONL `file` entry, and the linked plan.
+3. Follow the plan in order, keeping edits inside assigned scope.
+4. Use project specs and quality sources as checklist context; runtime gates remain kernel-owned commands.
+5. Run planned verification and report changed files, acceptance IDs, verification commands, and spec updates or why none were needed.
+
+Rules:
+
+- Do not dispatch subagents; `Agent` is removed from this session's tool set.
+- Do not run task start, finish, archive, unscoped resume, commit, or push.
+- Do not create task-local review artifacts, `tdd.jsonl`, or TDD evidence records in `check.jsonl`.
+- Do not claim completion without current verification.

package/presets/qoder/agents/cowork-research.md

@@ -0,0 +1,23 @@
+---
+name: cowork-research
+description: Cowork-flow research fixed subagent for sourced codebase and spec investigation. Use when the main session dispatches read-only investigation that must return evidence rather than edits.
+tools: Read, Grep, Glob, Bash, Skill
+disallowedTools: [Agent]
+---
+
+You are the `cowork-research` fixed subagent for Qoder.
+
+Read and apply `.agents/skills/agent-dispatch/SKILL.md` before research work.
+
+Execution:
+
+1. Follow `agent-dispatch` to bind runtime context. If binding fails, report `needs_context` and stop.
+2. Read the task directory, assignment, and prompt-named context.
+3. Write research notes only under the assigned task `research/` directory when asked.
+4. Report sourced findings, uncertainty, and recommended next action.
+
+Rules:
+
+- Do not dispatch subagents; `Agent` is removed from this session's tool set.
+- Do not edit code, specs, task state, or git state.
+- Do not run task start, finish, archive, unscoped resume, commit, or push.

package/presets/qoder/hooks/hooks.json

@@ -0,0 +1,50 @@
+{
+  "hooks": {
+    "SessionStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node",
+            "args": [
+              "${QODER_PLUGIN_ROOT}/hooks/inject-context.mjs"
+            ],
+            "timeout": 30,
+            "statusMessage": "cowork-flow: 注入工作流状态"
+          }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node",
+            "args": [
+              "${QODER_PLUGIN_ROOT}/hooks/inject-context.mjs"
+            ],
+            "timeout": 30,
+            "statusMessage": "cowork-flow: 注入工作流状态"
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Edit|Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node",
+            "args": [
+              "${QODER_PLUGIN_ROOT}/hooks/inject-context.mjs"
+            ],
+            "timeout": 30,
+            "statusMessage": "cowork-flow: 规范自查"
+          }
+        ]
+      }
+    ]
+  }
+}

package/presets/qoder/hooks/inject-context.mjs

@@ -0,0 +1,150 @@
+#!/usr/bin/env node
+/**
+ * cowork-flow Qoder plugin hook — transport shim.
+ *
+ * Workflow facts (workflow-state, contract digest, decision
+ * anchor, stage contract, scope/spec edits) come from the
+ * Python source
+ * <scripts>/adapters/host/inject.py; this shim does
+ * transport only:
+ *   1. project resolution from the hook payload (`cwd`),
+ *      then QODER_PROJECT_DIR / QODER_WORKING_DIR;
+ *   2. interpreter location, COWORK_FLOW_PYTHON -> python3
+ *      -> python -> py -3 — the hook runs under the host's
+ *      process PATH, which is not the user's login shell;
+ *   3. stdin passthrough to inject.py --host qoder, with
+ *      stdout forwarded and a failing project runtime
+ *      absorbed (exit 0, reason on stderr) — Qoder refuses
+ *      the prompt on a non-zero hook exit, and the hook is
+ *      machine-level, so it may meet a project runtime
+ *      older than itself.
+ *
+ * Deliberately named .mjs: the installed plugin cache has
+ * no package.json, so a plain .js entry point is parsed as
+ * CommonJS there and an `import` file would only load on
+ * Node versions that auto-detect module syntax.
+ */
+
+import { existsSync, readFileSync } from "fs";
+import { dirname, join, resolve } from "path";
+import { spawnSync } from "child_process";
+
+const HOST = "qoder";
+const DIR_WORKFLOW = ".cowork-flow";
+// hooks.json grants 30s per event.
+const SPAWN_TIMEOUT_MS = 25000;
+
+function readHookInput() {
+  if (process.stdin.isTTY) return { raw: "", parsed: {} };
+  let raw = "";
+  try {
+    raw = readFileSync(0, "utf8");
+  } catch {
+    return { raw: "", parsed: {} };
+  }
+  try {
+    // Tolerate a UTF-8 BOM and surrounding whitespace: the payload is
+    // forwarded verbatim either way, only the parse needs it clean.
+    const parsed = JSON.parse(raw.replace(/^\uFEFF/, "").trim());
+    return { raw, parsed: parsed && typeof parsed === "object" ? parsed : {} };
+  } catch {
+    return { raw, parsed: {} };
+  }
+}
+
+function findWorkflowRoot(startDir) {
+  if (typeof startDir !== "string" || !startDir.trim()) return null;
+  let current;
+  try {
+    current = resolve(startDir);
+  } catch {
+    return null;
+  }
+  for (;;) {
+    if (existsSync(join(current, DIR_WORKFLOW))) return current;
+    const parent = dirname(current);
+    if (parent === current) return null;
+    current = parent;
+  }
+}
+
+function findProjectRoot(parsedInput) {
+  const candidates = [
+    parsedInput?.cwd,
+    process.env.QODER_PROJECT_DIR,
+    process.env.QODER_WORKING_DIR,
+    process.cwd(),
+  ];
+  for (const candidate of candidates) {
+    const root = findWorkflowRoot(candidate);
+    if (root) return root;
+  }
+  return null;
+}
+
+function pythonCandidates() {
+  const list = [];
+  const env = (process.env.COWORK_FLOW_PYTHON || "").trim();
+  if (env) list.push([env]);
+  list.push(["python3"], ["python"]);
+  if (process.platform === "win32") list.push(["py", "-3"]);
+  return list;
+}
+
+function main() {
+  if (
+    process.env.COWORK_FLOW_HOOKS === "0" ||
+    process.env.COWORK_FLOW_DISABLE_HOOKS === "1"
+  ) {
+    process.exit(0);
+  }
+
+  const { raw, parsed } = readHookInput();
+  const root = findProjectRoot(parsed);
+  if (!root) process.exit(0);
+  const injectScript = join(
+    root,
+    DIR_WORKFLOW,
+    "scripts",
+    "adapters",
+    "host",
+    "inject.py"
+  );
+  if (!existsSync(injectScript)) process.exit(0);
+
+  for (const candidate of pythonCandidates()) {
+    let result;
+    try {
+      result = spawnSync(
+        candidate[0],
+        [...candidate.slice(1), injectScript, "--host", HOST],
+        {
+          input: raw,
+          cwd: root,
+          timeout: SPAWN_TIMEOUT_MS,
+          encoding: "utf8",
+          windowsHide: true,
+        }
+      );
+    } catch {
+      continue;
+    }
+    if (result.error || result.status === null) continue;
+    if (result.stdout) process.stdout.write(result.stdout);
+    if (result.stderr) process.stderr.write(result.stderr);
+    // The interpreter ran; its exit status is the project runtime's verdict,
+    // not ours. Forwarding it would let a stale project copy fail the event
+    // this hook only decorates.
+    if (result.status !== 0) {
+      process.stderr.write(
+        `cowork-flow qoder hook: inject.py exited ${result.status}; skipping injection\n`
+      );
+    }
+    process.exit(0);
+  }
+  // No interpreter could run the entry: stay silent rather
+  // than break the host's event stream (fail-open).
+  process.exit(0);
+}
+
+main();

package/presets/qoder/skills/cowork-flow-bootstrap/SKILL.md

@@ -0,0 +1,35 @@
+---
+name: cowork-flow-bootstrap
+description: Use only when a repository has no .cowork-flow/ runtime and the user wants to start or continue structured development work — guides installing cowork-flow into the project. Do not use when .cowork-flow/ exists; the project's own cowork-flow Skill owns that case.
+---
+
+# Cowork Flow Bootstrap
+
+This Skill is the plugin-side bootstrap. It applies to repositories that have no
+`.cowork-flow/` runtime yet. Once `.cowork-flow/` exists, stop and use the
+project's own Skills: after init, `./.cowork-flow/run task next` and the project's
+skill copies are authoritative, not this Skill.
+
+## Decide first
+
+Check the repository root for the runtime directory `.cowork-flow/` (or the
+workflow entry `./.cowork-flow/run`).
+
+## No runtime: offer the install
+
+Tell the user this repository has no cowork-flow runtime, then offer:
+
+```bash
+npx cowork-flow project init .
+```
+
+After init the project carries its own Skills (`.agents/skills/`), the task
+runtime (`.cowork-flow/`), and the workflow entry `./.cowork-flow/run task next`.
+Resume the work through that entry.
+
+## Never
+
+- Do not reproduce lifecycle rules, gates, or a second workflow document here.
+- Do not hand-create `.cowork-flow/` or copy files out of the plugin payload.
+- Do not run task lifecycle commands: without a project runtime there is no task
+  to advance.

package/{template/.zcode → presets/zcode}/.zcode-plugin/plugin.json

@@ -1,10 +1,12 @@
 {
   "name": "cowork-flow",
-  "version": "1.6.0",
+  "version": "1.7.2",
   "description": "AI 协作工作流引擎：任务生命周期、子代理调度、门禁与状态注入。将 cowork-flow 的完整工作流带入 ZCode。",
   "author": {
-    "name": "fisklikewater"
+    "name": "fishlikewater",
+    "url": "https://github.com/fishlikewater"
   },
+  "homepage": "https://github.com/fishlikewater/cowork-flow",
   "license": "MIT",
   "hooks": "hooks/hooks.json",
   "agents": "agents",

package/{template/.zcode → presets/zcode}/agents/cowork-check.md

@@ -7,10 +7,10 @@ You are the `cowork-check` fixed subagent for ZCode.
 
 Read and apply these plugin Skills before review work:
 
-- `skills/agent-dispatch/SKILL.md`
-- `skills/task-review/SKILL.md`
-- `skills/decision-audit/SKILL.md`
-- `skills/spec-sync/SKILL.md`
+- `.agents/skills/agent-dispatch/SKILL.md`
+- `.agents/skills/task-review/SKILL.md`
+- `.agents/skills/decision-audit/SKILL.md`
+- `.agents/skills/spec-sync/SKILL.md`
 
 Execution:
 

package/{template/.zcode → presets/zcode}/agents/cowork-implement.md

@@ -7,10 +7,10 @@ You are the `cowork-implement` fixed subagent for ZCode.
 
 Read and apply these plugin Skills before task work:
 
-- `skills/agent-dispatch/SKILL.md`
-- `skills/decision-audit/SKILL.md`
-- `skills/spec-sync/SKILL.md`
-- `skills/test-first/SKILL.md` for behavior changes
+- `.agents/skills/agent-dispatch/SKILL.md`
+- `.agents/skills/decision-audit/SKILL.md`
+- `.agents/skills/spec-sync/SKILL.md`
+- `.agents/skills/test-first/SKILL.md` for behavior changes
 
 Execution:
 

package/{template/.zcode → presets/zcode}/agents/cowork-research.md

@@ -5,7 +5,7 @@ description: Cowork-flow research-only fixed subagent for sourced investigation
 
 You are the `cowork-research` fixed subagent for ZCode.
 
-Read and apply `skills/agent-dispatch/SKILL.md` before research work.
+Read and apply `.agents/skills/agent-dispatch/SKILL.md` before research work.
 
 Execution:
 

package/{template/.zcode → presets/zcode}/hooks/inject-context.js

@@ -2,19 +2,26 @@
 /**
  * cowork-flow ZCode plugin hook — transport shim.
  *
- * All workflow facts (workflow-state, contract digest, decision anchor,
- * stage contract, scope/spec edit warnings) are rendered by the single
- * Python source: <scripts>/adapters/host/inject.py. This shim keeps only
- * transport duties:
- *   1. cheap PostToolUse(Bash) filter — non-lifecycle commands exit 0
- *      without spawning anything (the highest-frequency event);
- *   2. interpreter location (COWORK_FLOW_PYTHON → python3 → python → py -3);
- *   3. stdin passthrough to inject.py --host zcode, stdout/exit forwarding.
+ * Workflow facts (workflow-state, contract digest,
+ * decision anchor, stage contract, scope/spec edits)
+ * come from the Python source
+ * <scripts>/adapters/host/inject.py; this shim does
+ * transport only:
+ *   1. cheap PostToolUse(Bash) filter: anything that
+ *      is not a lifecycle command exits 0 unspawned;
+ *   2. interpreter location, COWORK_FLOW_PYTHON -> python3
+ *      -> python -> py -3;
+ *   3. stdin passthrough to inject.py --host zcode, with
+ *      stdout forwarded and a failing project runtime
+ *      absorbed (exit 0, reason on stderr) — the hook
+ *      is machine-level and may meet an older project
+ *      copy, which must not fail the event.
  *
- * The project's own runtime copy is preferred (same root the CLI resolves);
- * the plugin cache copy (hooks/runtime/scripts) renders only for directories
- * outside any cowork-flow project. Windows never spawns .cmd shims directly
- * (Node 24+ EINVAL) — interpreters resolve to .exe entries.
+ * The project's own runtime copy wins (same root the CLI
+ * resolves); the plugin cache copy (runtime/scripts)
+ * renders only outside any cowork-flow project. Windows
+ * never spawns .cmd shims directly (Node 24+ EINVAL), so
+ * interpreters resolve to .exe entries.
  */
 
 import { existsSync, readFileSync } from "fs";
@@ -26,7 +33,8 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 
 const DIR_WORKFLOW = ".cowork-flow";
 const LIFECYCLE_BASH_RE = /\brun(?:\.cmd)?\s+(?:task|subagent|resume)\b/;
-const SPAWN_TIMEOUT_MS = 4800; // hooks.json grants 5s per event
+// hooks.json grants 5s per event.
+const SPAWN_TIMEOUT_MS = 4800;
 
 function readHookInput() {
   if (process.stdin.isTTY) return { raw: "", parsed: {} };
@@ -91,7 +99,7 @@ function resolveInjectScript(parsedInput) {
     );
     if (existsSync(projectInject)) return projectInject;
   }
-  // Plugin-cache runtime copy: renders the not-initialized context for
+  // Plugin-cache copy: the not-initialized context for
   // directories outside any cowork-flow project.
   const cacheInject = join(
     __dirname,
@@ -115,8 +123,8 @@ function main() {
 
   const { raw, parsed } = readHookInput();
 
-  // Cheap first: a PostToolUse Bash call only matters when it is a workflow
-  // lifecycle command (mid-turn state refresh); every other Bash call exits
+  // A PostToolUse Bash call matters only when it is a
+  // workflow lifecycle command; every other call exits
   // without spawning Python.
   if (
     typeof parsed?.hook_event_name === "string" &&
@@ -157,10 +165,19 @@ function main() {
     if (result.error || result.status === null) continue;
     if (result.stdout) process.stdout.write(result.stdout);
     if (result.stderr) process.stderr.write(result.stderr);
-    process.exit(result.status);
+    // The interpreter ran; its exit status is the project runtime's verdict,
+    // not ours. Forwarding it would let a stale project copy fail the event
+    // this hook only decorates.
+    if (result.status !== 0) {
+      process.stderr.write(
+        `cowork-flow zcode hook: inject.py exited ${result.status}; skipping injection\n`
+      );
+    }
+    process.exit(0);
   }
-  // No interpreter could run the entry: stay silent rather than break the
-  // host's event stream (fail-open, same contract as the spec-edit path).
+  // No interpreter could run the entry: stay silent rather
+  // than break the host's event stream (fail-open, like
+  // the spec-edit path).
   process.exit(0);
 }
 

package/presets/zcode/skills/cowork-flow-bootstrap/SKILL.md

@@ -0,0 +1,35 @@
+---
+name: cowork-flow-bootstrap
+description: Use only when a repository has no .cowork-flow/ runtime and the user wants to start or continue structured development work — guides installing cowork-flow into the project. Do not use when .cowork-flow/ exists; the project's own cowork-flow Skill owns that case.
+---
+
+# Cowork Flow Bootstrap
+
+This Skill is the plugin-side bootstrap. It applies to repositories that have no
+`.cowork-flow/` runtime yet. Once `.cowork-flow/` exists, stop and use the
+project's own Skills: after init, `./.cowork-flow/run task next` and the project's
+skill copies are authoritative, not this Skill.
+
+## Decide first
+
+Check the repository root for the runtime directory `.cowork-flow/` (or the
+workflow entry `./.cowork-flow/run`).
+
+## No runtime: offer the install
+
+Tell the user this repository has no cowork-flow runtime, then offer:
+
+```bash
+npx cowork-flow project init .
+```
+
+After init the project carries its own Skills (`.agents/skills/`), the task
+runtime (`.cowork-flow/`), and the workflow entry `./.cowork-flow/run task next`.
+Resume the work through that entry.
+
+## Never
+
+- Do not reproduce lifecycle rules, gates, or a second workflow document here.
+- Do not hand-create `.cowork-flow/` or copy files out of the plugin payload.
+- Do not run task lifecycle commands: without a project runtime there is no task
+  to advance.