dotmd-cli 0.77.1 → 0.77.3

package/README.md

@@ -40,6 +40,8 @@ dotmd doctor --session    # what identity dotmd sees here, and from where
 ```
 
 Both are one-time and global; `dotmd update` keeps them in step with the CLI.
+Codex needs no install for identity: it exports `CODEX_THREAD_ID` to every tool
+shell, and dotmd reads it as a per-session identity automatically.
 
 ### Claude Code Plugin
 
@@ -163,7 +165,7 @@ readable for compatibility and can be migrated with `dotmd lint --fix`.
 |---|---|---|
 | `plan` | Executable work | `in-session`, `active`, `planned`, `blocked`, `partial`, `paused`, `awaiting`, `queued-after`, `archived` |
 | `doc` | Specs, ADRs, audits, and reference material | `draft`, `active`, `review`, `reference`, `deprecated`, `archived` |
-| `prompt` | Saved future-session instructions | `pending`, `held`, `shelved`, `claimed`, `archived` |
+| `prompt` | Saved future-session instructions | `pending`, `archived` |
 
 Status definitions can be customized per type. Rich status objects co-locate
 display, staleness, validation, terminal, and archive behavior in one place.

package/bin/dotmd.mjs

@@ -103,7 +103,7 @@ const HELP = {
 
 Common commands:
   plans                 Live plans (excludes archived)
-  prompts               Prompt queue/admin (list, next, archive, new, hold)
+  prompts               Prompt queue/admin (list, next, archive, new)
   briefing              Full briefing with plan counts + next steps
   agent-context         Compact bounded JSON context for agents
   set <status> [file]   Transition status (start work, finish, archive — all via target status)
@@ -160,6 +160,12 @@ host gets that a different way:
             with "plugin not installed"), and the README's slash commands only
             work from inside a session. Without the \`claude\` CLI on PATH the
             two in-session commands are printed instead.
+            It also repairs a plugin Claude lists as "failed to load: Marketplace
+            dotmd not found" — an install record whose marketplace registration
+            is gone — by re-adding the marketplace and updating the plugin. If
+            Claude refuses the marketplace, ~/.claude/settings.json declares it
+            under extraKnownMarketplaces with a source that no longer matches;
+            dotmd names the field but never edits that file.
 
   opencode  Writes one auto-discovered plugin file. OpenCode has no plugin
             registry but globs \`{plugin,plugins}/*.{ts,js}\` under its global
@@ -190,7 +196,11 @@ reports a missing integration but never installs one.`,
 The plugin and CLI ship in lockstep; a release bumps both. Updating the plugin
 requires a session restart (or /reload-plugins) to apply. The plugin step needs
 the \`claude\` CLI on PATH — otherwise it prints the \`/plugin update\` command to
-run from a session instead.`,
+run from a session instead. The OpenCode file is refreshed in the same run when
+it is present and behind. The hosts are independent, so a failing step does not
+stop the others: every step runs, the failures are listed together, and the
+exit code is 1. A plugin whose marketplace registration is gone gets the
+marketplace re-added before the update (see \`dotmd install claude\`).`,
 
   misuse: `dotmd misuse — read the cross-repo guard log (~/.claude/logs/dotmd-misuse.log)
 
@@ -219,7 +229,7 @@ View & Query:
   plans                             Live plans (excludes archived; --include-archived for all)
   use [<file-or-slug>]              Open a doc by type: prompt → consume, plan → start, doc → read
   baton [<plan>|<slug>] <@<file>|->  Save a resume prompt; releases the plan + prints the commit when one is in-session
-  prompts [list|show|archive|new|hold] Prompt admin (list / peek / archive / save / hold). Use \`dotmd use\` to consume.
+  prompts [list|show|archive|new] Prompt admin (list / peek / archive / save). Use \`dotmd use\` to consume.
   stale                             Stale docs (preset)
   actionable                        Docs with next steps (preset)
 
@@ -359,21 +369,21 @@ doc statuses
 ────────────────────────────────────────────────────────────────────
 prompt statuses
 
+  A prompt has two states and no third.
+
   pending        Ready for the next session to consume.
                  \`dotmd prompts use <file>\` prints body + archives atomically.
                  \`dotmd prompts next\` does the same for the oldest pending.
 
-  held           Saved under prompts/held/ and hidden from \`hud\` /
-                 \`briefing\` / \`prompts next\`.
-                 Still listed by \`dotmd prompts list\`.
-                 \`dotmd prompts unhold <file>\` → pending.
-
-  shelved        Legacy spelling for held prompts. \`dotmd prompts shelve\`
-                 now writes \`status: held\`.
-
-  claimed        Legacy intermediate state (atomic use → archived now).
+  archived       Consumed prompt; body preserved in the archive directory,
+                 which is the only directory a prompt ever moves into.
 
-  archived       Consumed prompt; body preserved in archive directory.
+  \`held\`, \`shelved\` and \`claimed\` were removed 2026-08-30, along with
+  \`prompts hold\` / \`unhold\` / \`shelve\` / \`unshelve\` and the
+  prompts/held/ bucket. A prompt directs work, so parking one instead of
+  archiving it left work state outside the plan that owns it, fighting with
+  that plan's own status. If a prompt should not be consumed, lift its content
+  into the plan and archive the prompt.
 
 ────────────────────────────────────────────────────────────────────
 Related commands:
@@ -504,9 +514,10 @@ another session's work.
 a unique bare slug / basename across the doc roots (\`set paused auth-revamp\`).
 Ambiguous slugs error with the candidate list instead of guessing.
 When the path is omitted, exactly one plan must be owned by this session.
-Claude Code session IDs are recognized automatically, as is OpenCode (via
-OPENCODE_PID — per OpenCode process, not per session). Other hosts must set
-RUNLIST_SESSION_ID; anonymous ownership mutations fail closed.
+Claude Code and Codex session IDs are recognized automatically (Codex exports
+CODEX_THREAD_ID to every tool shell), as is OpenCode (via OPENCODE_PID — per
+OpenCode process, not per session). Other hosts must set RUNLIST_SESSION_ID;
+anonymous ownership mutations fail closed.
 Pickup hooks use at-least-once delivery with a stable operationId; hook side
 effects must deduplicate that ID.
 
@@ -995,7 +1006,7 @@ Other options:
 
 For plans, the default status vocabulary is: in-session, active, planned,
 blocked, partial, paused, awaiting, queued-after, archived.
-For prompts: pending (default), held, shelved, claimed, archived.
+For prompts: pending (default), archived.
 
 Use --dry-run (-n) to preview without creating the file.`,
 
@@ -1132,11 +1143,6 @@ Subcommands:
   show <file-or-slug>        Read-only peek: print the body WITHOUT consuming
                              (triage). \`peek\` is an alias.
   archive <file-or-slug>     Archive a prompt without printing its body
-  hold <file-or-slug>        Park a prompt (status → held) under prompts/held/:
-                             kept in list, hidden from hud/briefing pending
-                             surfaces, skipped by \`prompts next\`.
-  unhold <file-or-slug>      Move a held prompt back to pending.
-  shelve / unshelve          Legacy aliases for hold / unhold.
   new <slug> [body]          Create a new prompt (alias for
                              \`dotmd new prompt <slug> [body]\`)
 
@@ -1144,7 +1150,7 @@ Subcommands:
 slug matching a prompt basename, or a unique substring of a prompt
 path. Ambiguous substrings error with the candidate list.
 
-Default prompt statuses: pending, held, shelved, claimed, archived.
+Default prompt statuses: pending, archived.
 
 Examples:
   dotmd prompts                        # pending prompts (default)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dotmd-cli",
-  "version": "0.77.1",
+  "version": "0.77.3",
   "description": "CLI for managing markdown documents with YAML frontmatter — index, query, validate, graph, export, lifecycle, and AI summaries.",
   "type": "module",
   "license": "MIT",

package/src/config.mjs

@@ -37,9 +37,17 @@ const DEFAULTS = {
       context: { expanded: ['active'], listed: ['draft', 'review'], counted: ['reference', 'deprecated', 'archived'] },
       staleDays: { draft: 30, active: 14, review: 14 },
     },
+    // A prompt has two states and no third. It is pending — the next session
+    // should consume it — or it is archived, consumed, body kept under the
+    // archive directory. `held`, `shelved` and `claimed` were removed 2026-08-30:
+    // a prompt directs work, so parking one instead of archiving it leaves work
+    // state sitting outside the plan that owns it, where it fights with the
+    // plan's own status and neither one is the truth. If a prompt should not be
+    // consumed, its content belongs in the plan and the prompt should be
+    // archived. See lifecycle.filedStatuses — prompts file nowhere.
     prompt: {
-      statuses: ['pending', 'held', 'shelved', 'claimed', 'archived'],
-      context: { expanded: ['pending'], listed: ['held', 'shelved'], counted: ['claimed', 'archived'] },
+      statuses: ['pending', 'archived'],
+      context: { expanded: ['pending'], counted: ['archived'] },
       staleDays: { pending: 30 },
     },
   },
@@ -64,7 +72,11 @@ const DEFAULTS = {
     // F15: per-status filing buckets (status → dirName). Built-in held/paused
     // statuses file under the owning type folder; archive remains a separate
     // primitive untouched.
-    filedStatuses: { held: 'held', shelved: 'held', paused: 'held' },
+    // Plans only. A paused plan files under <plansDir>/held/ so the live plan
+    // list stays readable. Prompts were removed from this map 2026-08-30 along
+    // with their held/shelved statuses — `archived` is the only directory a
+    // prompt ever moves into.
+    filedStatuses: { paused: 'held' },
     // Types whose archive nests under their own type dir (<typeDir>/<archiveDir>,
     // e.g. docs/prompts/archived/) instead of the shared <root>/<archiveDir>.
     // Prompts are session-local churn — keeping their archive out of the shared

package/src/host-integration.mjs

@@ -23,6 +23,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { hostSessionSource } from './util.mjs';
 import { readEnv, stateDir } from './naming.mjs';
+import { planMarketplaceRepair } from './update.mjs';
 
 export const GENERATED_MARKER = 'dotmd-generated:';
 const PLUGIN_FILENAME = 'dotmd.js';
@@ -233,6 +234,19 @@ export function degradedIdentityNotice(repoRoot, opts = {}) {
 export const CLAUDE_MARKETPLACE = 'reowens/dotmd';
 export const CLAUDE_PLUGIN_ID = 'dotmd@dotmd';
 
+// Why `claude plugin marketplace add` can refuse a marketplace that is not
+// even registered: settings.json may still DECLARE it (extraKnownMarketplaces),
+// and Claude rejects an add whose source differs from that declaration in any
+// fetch-shaping field. dotmd never writes that declaration and will not edit
+// it, so the most it can do is name the field.
+export function claudeMarketplaceRefusalHint(marketplace = 'dotmd') {
+  return [
+    `Claude refused to register marketplace "${marketplace}". If ~/.claude/settings.json declares it under`,
+    `extraKnownMarketplaces, its source must be exactly {"source":"github","repo":"${CLAUDE_MARKETPLACE}"} —`,
+    'a stray "path", "ref" or header there makes the add fail and the installed plugin fail to load.',
+  ];
+}
+
 // Pure planner, mirroring planUpdate: the orchestration is unit-testable and
 // the side effects stay in the caller.
 export function planClaudeInstall({ installed, hasClaude, remove = false } = {}) {
@@ -242,6 +256,13 @@ export function planClaudeInstall({ installed, hasClaude, remove = false } = {})
       ? [{ kind: 'run', cmd: ['claude', 'plugin', 'uninstall', installed.id] }]
       : [{ kind: 'manual', lines: [`/plugin uninstall ${installed.id}`] }];
   }
+  // An install record whose marketplace registration is gone is not an
+  // installed plugin — Claude lists it as "failed to load". Skipping here with
+  // "already installed" left the user with no dotmd verb that could repair it.
+  if (installed?.marketplaceRegistered === false) {
+    return planMarketplaceRepair(installed, { hasClaude, verb: 'update' })
+      .map(step => (step.kind === 'marketplace' || step.kind === 'plugin' ? { ...step, kind: 'run', step: step.kind } : step));
+  }
   if (installed) return [{ kind: 'skip', reason: `dotmd plugin already installed (${installed.version ?? 'unknown version'})` }];
   // The marketplace has to be registered before the plugin resolves; adding one
   // already present is a no-op, so this stays safe to re-run.

package/src/install.mjs

@@ -4,7 +4,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { bold, dim, green, yellow } from './color.mjs';
 import {
-  CLAUDE_MARKETPLACE, CLAUDE_PLUGIN_ID, installOpencodePlugin, opencodeDetected,
+  CLAUDE_MARKETPLACE, CLAUDE_PLUGIN_ID, claudeMarketplaceRefusalHint, installOpencodePlugin, opencodeDetected,
   opencodeStatus, planClaudeInstall, removeOpencodePlugin,
 } from './host-integration.mjs';
 import { readInstalledPlugin } from './update.mjs';
@@ -24,7 +24,14 @@ function flagValue(argv, name) {
 function hostStates() {
   const plugin = readInstalledPlugin();
   return {
-    claude: { installed: Boolean(plugin), version: plugin?.version ?? null, id: plugin?.id ?? CLAUDE_PLUGIN_ID },
+    claude: {
+      installed: Boolean(plugin),
+      version: plugin?.version ?? null,
+      id: plugin?.id ?? CLAUDE_PLUGIN_ID,
+      marketplace: plugin?.marketplace ?? null,
+      // false = record present, marketplace gone: Claude shows "failed to load".
+      marketplaceRegistered: plugin ? plugin.marketplaceRegistered : null,
+    },
     opencode: { ...opencodeStatus({ version: pkg.version }), detected: opencodeDetected() },
   };
 }
@@ -38,7 +45,11 @@ function reportStatus(json) {
   const { claude, opencode } = states;
   process.stdout.write(`${bold('dotmd host integrations')}  ${dim(`CLI ${pkg.version}`)}\n\n`);
 
-  process.stdout.write(`  claude    ${claude.installed ? green(claude.version ?? 'installed') : yellow('not installed')}\n`);
+  const claudeBroken = claude.installed && claude.marketplaceRegistered === false;
+  const claudeState = !claude.installed ? yellow('not installed')
+    : claudeBroken ? yellow(`${claude.version ?? 'installed'} — marketplace "${claude.marketplace}" not registered, plugin fails to load`)
+    : green(claude.version ?? 'installed');
+  process.stdout.write(`  claude    ${claudeState}\n`);
   process.stdout.write(`            ${dim(claude.installed ? claude.id : 'plugin: SessionStart primer, PreToolUse guard, workflow skill')}\n`);
 
   const ocState = opencode.foreign ? yellow('unmanaged file present')
@@ -49,7 +60,7 @@ function reportStatus(json) {
   process.stdout.write(`            ${dim(opencode.path)}\n`);
 
   const todo = [];
-  if (!claude.installed) todo.push('dotmd install claude');
+  if (!claude.installed || claudeBroken) todo.push('dotmd install claude');
   if (!opencode.exists || opencode.stale) todo.push('dotmd install opencode');
   if (todo.length) {
     process.stdout.write('\n');
@@ -73,10 +84,11 @@ function installClaude(argv, dryRun, json) {
   for (const step of steps) {
     if (step.kind === 'skip') { process.stdout.write(`${dim('skip:')} ${step.reason}\n`); continue; }
     if (step.kind === 'manual') {
-      process.stdout.write(`${yellow('claude CLI not on PATH')} — run these from a Claude Code session:\n`);
+      process.stdout.write(`${yellow(step.reason ?? 'claude CLI not on PATH')} — run these from a Claude Code session:\n`);
       for (const line of step.lines) process.stdout.write(`  ${bold(line)}\n`);
       continue;
     }
+    if (step.reason) process.stdout.write(`${step.reason}\n`);
     if (dryRun) { process.stdout.write(dim(`[dry-run] Would run: ${step.cmd.join(' ')}\n`)); continue; }
     process.stdout.write(dim(`$ ${step.cmd.join(' ')}\n`));
     const result = spawnSync(executableName(step.cmd[0]), step.cmd.slice(1), {
@@ -85,6 +97,11 @@ function installClaude(argv, dryRun, json) {
     ran = true;
     if (result.status !== 0) {
       process.stdout.write(yellow(`(claude exited ${result.status ?? '?'})\n`));
+      // Each later step here depends on this one (the plugin resolves through
+      // the marketplace), so unlike `update` there is nothing independent left.
+      if (step.step === 'marketplace' || step.cmd.includes('marketplace')) {
+        for (const line of claudeMarketplaceRefusalHint(readInstalledPlugin()?.marketplace)) process.stdout.write(yellow(`${line}\n`));
+      }
       process.exitCode = 1;
       return;
     }

package/src/prompts.mjs

@@ -4,7 +4,7 @@ import { extractFrontmatter, parseSimpleFrontmatter } from './frontmatter.mjs';
 import { asString, toRepoPath, die, resolveDocPath, resolveRefPath, isArchivedPath } from './util.mjs';
 import { buildIndex, resolveDocArg } from './index.mjs';
 import { runQuery } from './query.mjs';
-import { completePlanClaim, regenIndex, renderLifecycleMutation, runArchive, runStatus } from './lifecycle.mjs';
+import { completePlanClaim, regenIndex, renderLifecycleMutation, runArchive } from './lifecycle.mjs';
 import { runNew } from './new.mjs';
 import { green, dim, yellow } from './color.mjs';
 import { authorizeManagedSource } from './managed-path.mjs';
@@ -21,11 +21,23 @@ import { LEGACY_STATE_DIR, STATE_DIR } from './naming.mjs';
 // `resume` is an alias for `use` — agents reach for "resume" when continuing a
 // session; `use` reads as internal mechanics. Both names stay valid; the
 // canonical output ("Consumed: …") is unchanged.
-const SUBCOMMANDS = new Set(['list', 'next', 'use', 'resume', 'show', 'peek', 'archive', 'new', 'hold', 'unhold', 'shelve', 'unshelve']);
+const SUBCOMMANDS = new Set(['list', 'next', 'use', 'resume', 'show', 'peek', 'archive', 'new']);
+
+// Removed 2026-08-30 with the `held`/`shelved` statuses. Named rather than left
+// to fall through to the list filter below, which would silently answer a
+// removed command with an empty list — the caller needs to be told the state is
+// gone and what replaced it.
+const REMOVED_SUBCOMMANDS = new Set(['hold', 'unhold', 'shelve', 'unshelve']);
 
 export async function runPrompts(argv, config, opts = {}) {
   const sub = argv[0];
 
+  if (sub && REMOVED_SUBCOMMANDS.has(sub)) {
+    die(`\`dotmd prompts ${sub}\` was removed — a prompt is pending or archived, and nothing else.\n`
+      + 'A prompt directs work, so parking one instead of archiving it leaves work state outside the\n'
+      + 'plan that owns it. Lift its content into that plan, then `dotmd prompts archive <file>`.');
+  }
+
   if (!sub || !SUBCOMMANDS.has(sub)) {
     return runPromptsList(argv, config, opts);
   }
@@ -40,10 +52,6 @@ export async function runPrompts(argv, config, opts = {}) {
     case 'peek':     return runPromptsShow(rest, config);
     case 'archive':  return runPromptsArchive(rest, config, opts);
     case 'new':      return runPromptsNew(rest, config, opts);
-    case 'hold':     return runPromptsHold(rest, config, opts);
-    case 'unhold':   return runPromptsUnhold(rest, config, opts);
-    case 'shelve':   return runPromptsHold(rest, config, opts);
-    case 'unshelve': return runPromptsUnhold(rest, config, opts);
   }
 }
 
@@ -562,16 +570,3 @@ async function runPromptsNew(argv, config, opts = {}) {
   return runNew(['prompt', ...argv], config, opts);
 }
 
-async function runPromptsHold(argv, config, opts = {}) {
-  const input = argv.find(a => !a.startsWith('-'));
-  if (!input) die('Usage: dotmd prompts hold <file-or-slug>');
-  const filePath = resolvePromptInput(input, config);
-  return runStatus([filePath, 'held'], config, opts);
-}
-
-async function runPromptsUnhold(argv, config, opts = {}) {
-  const input = argv.find(a => !a.startsWith('-'));
-  if (!input) die('Usage: dotmd prompts unhold <file-or-slug>');
-  const filePath = resolvePromptInput(input, config);
-  return runStatus([filePath, 'pending'], config, opts);
-}

package/src/update.mjs

@@ -5,7 +5,7 @@ import os from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { green, dim, yellow } from './color.mjs';
 import { executableName, which } from './util.mjs';
-import { installOpencodePlugin, opencodeStatus } from './host-integration.mjs';
+import { CLAUDE_MARKETPLACE, claudeMarketplaceRefusalHint, installOpencodePlugin, opencodeStatus } from './host-integration.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const pkg = JSON.parse(readFileSync(path.join(__dirname, '..', 'package.json'), 'utf8'));
@@ -50,10 +50,54 @@ export function readInstalledPluginRecords(opts = {}) {
   }
 }
 
+// Claude Code's marketplace registry, keyed by marketplace name. A plugin id
+// is `<plugin>@<marketplace>`, and the plugin only loads while its marketplace
+// is registered here — an install record alone is not an installed plugin.
+export function readKnownMarketplaces(opts = {}) {
+  const home = opts.home || os.homedir();
+  const file = path.join(home, '.claude', 'plugins', 'known_marketplaces.json');
+  try {
+    const parsed = JSON.parse(readFileSync(file, 'utf8'));
+    return parsed && typeof parsed === 'object' ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+
+// `marketplaceRegistered: false` is the state `claude plugin list` shows as
+// "failed to load: Marketplace dotmd not found": the install record survived,
+// the marketplace registration did not (a settings.json declaration that no
+// longer matches, a wiped registry). Reading only the install record called
+// that "installed", so `dotmd install claude` skipped the one repair it owns
+// and `dotmd update` ran a `plugin update` that could only fail.
 export function readInstalledPlugin(opts = {}) {
   const records = readInstalledPluginRecords(opts);
   if (!records) return null;
-  return { id: records.id, version: records.entries[0]?.version ?? null };
+  const marketplace = records.id.split('@')[1] || null;
+  const known = readKnownMarketplaces(opts);
+  return {
+    id: records.id,
+    version: records.entries[0]?.version ?? null,
+    marketplace,
+    marketplaceRegistered: Boolean(marketplace && known[marketplace]),
+  };
+}
+
+// The steps that put a plugin whose marketplace registration is gone back on
+// its feet. Only the marketplace dotmd publishes has a source dotmd knows; a
+// plugin installed from some other marketplace names a source we cannot guess.
+export function planMarketplaceRepair(plugin, { hasClaude, verb }) {
+  const reason = `marketplace "${plugin.marketplace}" is not registered, so the installed plugin cannot load`;
+  if (plugin.marketplace !== 'dotmd') {
+    return [{ kind: 'skip', reason: `${reason} — re-add that marketplace (dotmd does not know its source), then rerun` }];
+  }
+  if (!hasClaude) {
+    return [{ kind: 'manual', reason, lines: [`/plugin marketplace add ${CLAUDE_MARKETPLACE}`, `/plugin ${verb} ${plugin.id}`] }];
+  }
+  return [
+    { kind: 'marketplace', reason: `${reason} — re-adding it first`, cmd: ['claude', 'plugin', 'marketplace', 'add', CLAUDE_MARKETPLACE] },
+    { kind: 'plugin', needs: 'marketplace', cmd: ['claude', 'plugin', verb, plugin.id] },
+  ];
 }
 
 // Decide which steps `dotmd update` should run. Pure — no side effects — so the
@@ -69,6 +113,8 @@ export function planUpdate(opts, ctx) {
   if (!opts.cliOnly) {
     if (!ctx.plugin) {
       steps.push({ kind: 'skip', reason: 'dotmd plugin not installed — skipping plugin update' });
+    } else if (ctx.plugin.marketplaceRegistered === false) {
+      steps.push(...planMarketplaceRepair(ctx.plugin, { hasClaude: ctx.hasClaude, verb: 'update' }));
     } else if (!ctx.hasClaude) {
       steps.push({ kind: 'skip', reason: `claude CLI not found — run \`/plugin update ${ctx.plugin.id}\` from a session instead` });
     } else {
@@ -102,6 +148,9 @@ export function runUpdate(argv, _config, opts = {}) {
         : cmp < 0 ? yellow('behind — run `dotmd update`')
         : yellow('ahead — CLI is behind');
       process.stdout.write(`dotmd plugin: ${plugin.version ?? '?'} (${plugin.id}) ${tag}\n`);
+      if (plugin.marketplaceRegistered === false) {
+        process.stdout.write(yellow(`  marketplace "${plugin.marketplace}" is not registered — the plugin fails to load; run \`dotmd install claude\`\n`));
+      }
     } else {
       process.stdout.write(dim('dotmd plugin: not installed — `dotmd install claude`\n'));
     }
@@ -117,24 +166,41 @@ export function runUpdate(argv, _config, opts = {}) {
   if (opts.dryRun) {
     for (const step of steps) {
       if (step.kind === 'skip') process.stdout.write(dim(`[dry-run] skip: ${step.reason}\n`));
+      else if (step.kind === 'manual') for (const line of step.lines) process.stdout.write(dim(`[dry-run] Run from a session: ${line}\n`));
       else if (step.kind === 'opencode') process.stdout.write(dim(`[dry-run] Would refresh: ${step.path}\n`));
       else process.stdout.write(dim(`[dry-run] Would run: ${step.cmd.join(' ')}\n`));
     }
     return;
   }
+  // The hosts are independent: a failed `claude plugin update` says nothing
+  // about the OpenCode file, so every step runs and the failures are reported
+  // together at the end. Stopping at the first one left OpenCode stale behind a
+  // Claude registry problem — silently, since the abort said nothing about the
+  // steps it never reached.
   let ran = false;
-  let failed = false;
+  const failures = [];
+  const failedKinds = new Set();
   for (const s of steps) {
     if (s.kind === 'skip') {
       process.stdout.write(dim(`skip: ${s.reason}\n`));
       continue;
     }
+    if (s.kind === 'manual') {
+      process.stdout.write(`${yellow(s.reason)} — run these from a Claude Code session:\n`);
+      for (const line of s.lines) process.stdout.write(`  ${line}\n`);
+      continue;
+    }
+    if (s.needs && failedKinds.has(s.needs)) {
+      process.stdout.write(dim(`skip: ${s.cmd.join(' ')} — the ${s.needs} step it depends on failed\n`));
+      continue;
+    }
     if (s.kind === 'opencode') {
       const result = installOpencodePlugin({ version: pkg.version });
       process.stdout.write(dim(`refreshed opencode integration → ${pkg.version}  ${result.path}\n`));
       ran = true;
       continue;
     }
+    if (s.reason) process.stdout.write(dim(`${s.reason}\n`));
     process.stdout.write(dim(`$ ${s.cmd.join(' ')}\n`));
     const r = spawnSync(executableName(s.cmd[0]), s.cmd.slice(1), {
       stdio: 'inherit',
@@ -142,13 +208,21 @@ export function runUpdate(argv, _config, opts = {}) {
     });
     ran = true;
     if (r.status !== 0) {
-      failed = true;
+      failedKinds.add(s.kind);
+      failures.push(s);
       process.stdout.write(yellow(`(${s.cmd[0]} exited ${r.status ?? '?'})\n`));
-      break;
+      if (s.kind === 'marketplace') for (const line of claudeMarketplaceRefusalHint(plugin?.marketplace)) process.stdout.write(yellow(`${line}\n`));
+    }
+  }
+  if (failures.length) {
+    process.stdout.write(yellow(`\n${failures.length === 1 ? '1 step' : `${failures.length} steps`} failed: ${failures.map(s => s.cmd.join(' ')).join('; ')}\n`));
+    if (ran && failures.length < steps.filter(s => s.kind !== 'skip' && s.kind !== 'manual').length) {
+      process.stdout.write(dim('the other steps completed; restart your Claude Code session (or /reload-plugins) to apply them.\n'));
     }
+    process.exitCode = 1;
+    return;
   }
-  if (ran && !failed) {
+  if (ran) {
     process.stdout.write(green('\n✓ restart your Claude Code session (or /reload-plugins) to apply.\n'));
   }
-  if (failed) process.exitCode = 1;
 }

package/src/util.mjs

@@ -26,6 +26,15 @@ const SESSION_ID_SOURCES = [
   { variable: 'DOTMD_SESSION_ID', prefix: null, scope: 'session', host: 'explicit override' },
   { variable: 'CLAUDE_CODE_SESSION_ID', prefix: null, scope: 'session', host: 'Claude Code' },
   { variable: 'CLAUDE_SESSION_ID', prefix: null, scope: 'session', host: 'Claude Code' },
+  // Verified against codex-cli 0.153.4 (2026-09-07): `codex exec` ran
+  // `env | grep ^CODEX` in a tool shell and printed both variables, each equal
+  // to the "session id:" line Codex prints in its own header, so they name one
+  // Codex thread (session), not the Codex process. THREAD_ID is what the exec
+  // path (core/src/exec.rs) sets first; SESSION_ID is its older twin. No
+  // CODEX_PID exists, so a Codex claim records no owning process and reads as
+  // 'unverifiable' — a takeover stays an explicit --force.
+  { variable: 'CODEX_THREAD_ID', prefix: null, scope: 'session', host: 'Codex' },
+  { variable: 'CODEX_SESSION_ID', prefix: null, scope: 'session', host: 'Codex' },
   { variable: 'OPENCODE_SESSION_ID', prefix: null, scope: 'session', host: 'OpenCode' },
   { variable: 'OPENCODE_SESSION', prefix: null, scope: 'session', host: 'OpenCode' },
   { variable: 'OPENCODE_PID', prefix: 'opencode', scope: 'process', host: 'OpenCode' },