jorgex-stack 1.0.7 → 1.0.9

package/README.md

@@ -1,6 +1,6 @@
 # JorgeX Stack
 
-Portable multi-agent harness: one configuration source — 15 agents, 18 skills, hooks, persistent memory ([Engram](https://github.com/Gentleman-Programming/engram)), MCPs, and system prompt — installable with one command in **Claude Code**, **Codex CLI**, and **OpenCode**.
+Portable multi-agent harness: one configuration source — 15 agents, 17 skills, hooks, persistent memory ([Engram](https://github.com/Gentleman-Programming/engram)), MCPs, and system prompt — installable with one command in **Claude Code**, **Codex CLI**, and **OpenCode**.
 
 > Inspired by [gentle-ai](https://github.com/Gentleman-Programming/gentle-ai), rebuilt for the JorgeX stack.
 
@@ -13,7 +13,7 @@ pnpm dlx jorgex-stack install    # interactive: choose runtimes and confirm
 pnpm dlx jorgex-stack models     # model picker by runtime and tier (strong/standard/cheap)
 pnpm dlx jorgex-stack sync       # reapplies config (idempotent; removes orphans)
 pnpm dlx jorgex-stack doctor     # checks that everything is healthy (Engram, drift, hooks, keys)
-pnpm dlx jorgex-stack update     # interactive: scans stack/Engram/skills, multiselect, diff/confirm
+pnpm dlx jorgex-stack update     # interactive: scans stack + Engram, multiselect, diff/confirm
                                  # With --check: report only, no changes
                                  # With --yes: batch mode (report only)
 pnpm dlx jorgex-stack restore    # restores a backup
@@ -26,11 +26,11 @@ Every command supports `--dry-run`, `--yes`, and `--target-dir <dir>` for testin
 
 ### Update: Interactive Flow
 
-`update` manages three sources:
+`update` manages two sources for the end user, plus a maintainer-only one:
 
 1. **Stack** (jorgex-stack): detects whether it is a git clone or a global install, then offers an update with confirmation.
 2. **Engram** (binary): detects the installed version and offers an update through the **native channel** (brew -> `go install` -> release URL). Nothing needs to be stopped: as in upstream macOS/Linux, live processes keep using the old version until clients restart; on Windows, the in-use `.exe` is rotated by rename before installation. **Automatic DB backup before updating**. The database and memories are never touched.
-3. **Vendored skills**: detects changes in upstreams registered in `upstreams.json`, downloads the upstream to a temp directory, **shows a mandatory diff**, and asks for confirmation. Skills with local changes (`modified: true`) warn and require double confirmation.
+3. **Vendored skills** (maintainer only): third-party skills ship **pinned** with the stack version, so the installed package never reaches out to their upstreams. Only when running from a git clone (`pnpm cli update`) does `update` scan the upstreams in `upstreams.json`, download to a temp directory, **show a mandatory diff**, and ask for confirmation — so the review and re-pin persist in the repo and get published. Skills with local changes (`modified: true`) warn and require double confirmation.
 
 Usage:
 - `update --check`: scans versions without applying changes.

package/dist/cli.js

@@ -1947,6 +1947,9 @@ function loadUpstreams() {
   const file = path22.join(path22.dirname(stackRoot()), "upstreams.json");
   return JSON.parse(fs16.readFileSync(file, "utf8"));
 }
+function skillsToScan(maintainer, upstreams) {
+  return maintainer ? Object.keys(upstreams.skills) : [];
+}
 async function latestNpmVersion(pkg) {
   try {
     const res = await fetch(`https://registry.npmjs.org/${pkg}/latest`, {
@@ -1985,37 +1988,45 @@ async function runUpdateCheck(localVersion) {
         `engram: ${local} local, ${latest} disponible. Tu instalaci\xF3n NO se toca (D7) \u2014 actualiza t\xFA: github.com/${engramRepo}/releases`
       );
   }
-  const byRepo = /* @__PURE__ */ new Map();
-  for (const [name, info] of Object.entries(upstreams.skills)) {
-    const repo = info.source.replace(/^github:/, "");
-    const entry = byRepo.get(repo) ?? { skills: [], pinned: info.commit };
-    entry.skills.push(info.modified ? `${name} (modificada localmente)` : name);
-    byRepo.set(repo, entry);
-  }
-  const heads = await Promise.all(
-    [...byRepo.keys()].map(async (repo) => [repo, await latestGithubCommit(repo)])
-  );
-  let moved = 0;
-  for (const [repo, head] of heads) {
-    const { skills, pinned } = byRepo.get(repo);
-    if (!pinned)
-      p4.log.warn(
-        `${repo}: sin pin en upstreams.json \u2014 a\xF1ade el commit revisado. Skills: ${skills.join(", ")}`
-      );
-    else if (head === null)
-      p4.log.info(`${repo}: pin ${pinned.slice(0, 7)} (no se pudo consultar el upstream).`);
-    else if (head === pinned)
-      p4.log.success(`${repo}: al d\xEDa con el pin ${pinned.slice(0, 7)} (${skills.join(", ")}).`);
-    else {
-      moved++;
-      p4.log.warn(
-        `${repo}: el upstream se movi\xF3 (pin ${pinned.slice(0, 7)} \u2192 ${head.slice(0, 7)}). Skills: ${skills.join(", ")}.
+  const checkSkillNames = skillsToScan(isGitClone(), upstreams);
+  if (checkSkillNames.length === 0) {
+    p4.log.info(
+      "Skills de terceros: pineadas con la versi\xF3n del stack (su revisi\xF3n upstream se hace desde el clon del repo)."
+    );
+  } else {
+    const byRepo = /* @__PURE__ */ new Map();
+    for (const name of checkSkillNames) {
+      const info = upstreams.skills[name];
+      const repo = info.source.replace(/^github:/, "");
+      const entry = byRepo.get(repo) ?? { skills: [], pinned: info.commit };
+      entry.skills.push(info.modified ? `${name} (modificada localmente)` : name);
+      byRepo.set(repo, entry);
+    }
+    const heads = await Promise.all(
+      [...byRepo.keys()].map(async (repo) => [repo, await latestGithubCommit(repo)])
+    );
+    let moved = 0;
+    for (const [repo, head] of heads) {
+      const { skills, pinned } = byRepo.get(repo);
+      if (!pinned)
+        p4.log.warn(
+          `${repo}: sin pin en upstreams.json \u2014 a\xF1ade el commit revisado. Skills: ${skills.join(", ")}`
+        );
+      else if (head === null)
+        p4.log.info(`${repo}: pin ${pinned.slice(0, 7)} (no se pudo consultar el upstream).`);
+      else if (head === pinned)
+        p4.log.success(`${repo}: al d\xEDa con el pin ${pinned.slice(0, 7)} (${skills.join(", ")}).`);
+      else {
+        moved++;
+        p4.log.warn(
+          `${repo}: el upstream se movi\xF3 (pin ${pinned.slice(0, 7)} \u2192 ${head.slice(0, 7)}). Skills: ${skills.join(", ")}.
   Revisa el diff y, si lo aceptas, actualiza la copia vendorizada y el pin: github.com/${repo}/compare/${pinned.slice(0, 7)}...${head.slice(0, 7)}`
-      );
+        );
+      }
+    }
+    if (moved === 0 && heads.every(([, head]) => head !== null)) {
+      p4.log.info("Skills de terceros: ning\xFAn upstream se ha movido respecto a su pin.");
     }
-  }
-  if (moved === 0 && heads.every(([, head]) => head !== null)) {
-    p4.log.info("Skills de terceros: ning\xFAn upstream se ha movido respecto a su pin.");
   }
   if (githubRateLimited()) {
     p4.log.warn(rateLimitHint("GitHub limit\xF3 algunas consultas (rate limit sin token)."));
@@ -2046,8 +2057,7 @@ function isEngramRunning() {
     return null;
   }
 }
-function isGitClone() {
-  const projectRoot = path22.dirname(stackRoot());
+function isGitClone(projectRoot = path22.dirname(stackRoot())) {
   return fs16.existsSync(path22.join(projectRoot, ".git"));
 }
 var STACK_METHOD_CLONE = "git pull + pnpm install + pnpm build";
@@ -2325,8 +2335,10 @@ async function runInteractiveUpdate(localVersion, yes, dryRun = false) {
   const upstreams = loadUpstreams();
   let exitCode = 0;
   let appliedUpdates = false;
+  const maintainer = isGitClone();
   const spin = p4.spinner();
   spin.start("Consultando versiones upstream\u2026");
+  const skillNames = skillsToScan(maintainer, upstreams);
   const [npmLatest, engramLatestRaw, ...skillHeads] = await Promise.all([
     latestNpmVersion("jorgex-stack"),
     (async () => {
@@ -2334,7 +2346,7 @@ async function runInteractiveUpdate(localVersion, yes, dryRun = false) {
       if (!repo) return null;
       return { repo, version: await latestGithubRelease(repo) };
     })(),
-    ...Object.keys(upstreams.skills).map(async (name) => {
+    ...skillNames.map(async (name) => {
       const info = upstreams.skills[name];
       const repo = info.source.replace(/^github:/, "");
       const head = await latestGithubCommit(repo);
@@ -2354,7 +2366,7 @@ async function runInteractiveUpdate(localVersion, yes, dryRun = false) {
     p4.log.success(`jorgex-stack: v${localVersion} \u2014 al d\xEDa.`);
   } else {
     stackNeedsUpdate = true;
-    const mode = isGitClone() ? STACK_METHOD_CLONE : `pnpm add -g jorgex-stack@${npmLatest}`;
+    const mode = maintainer ? STACK_METHOD_CLONE : `pnpm add -g jorgex-stack@${npmLatest}`;
     updateItems.push({
       value: "stack",
       label: `jorgex-stack: v${localVersion} \u2192 v${npmLatest}`,
@@ -2406,6 +2418,11 @@ async function runInteractiveUpdate(localVersion, yes, dryRun = false) {
       p4.log.success(`${repo}: al d\xEDa (pin ${pinned.slice(0, 7)}). Skills: ${names.join(", ")}`);
     }
   }
+  if (!maintainer) {
+    p4.log.info(
+      "Skills de terceros: pineadas con esta versi\xF3n del stack \u2014 su revisi\xF3n upstream se hace desde el clon del repo."
+    );
+  }
   const skillUpdates = buildEligibleSkillUpdates(typedSkillHeads);
   for (const skillInfo of skillUpdates) {
     const modifiedWarning = skillInfo.modified ? " \u26A0 modificada localmente" : "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jorgex-stack",
-  "version": "1.0.7",
+  "version": "1.0.9",
   "description": "Harness multi-agente portable: instala la config JorgeX (agentes, skills, hooks, Engram, MCPs) en Claude Code, Codex CLI y OpenCode",
   "type": "module",
   "license": "MIT",

package/upstreams.json

@@ -23,20 +23,15 @@
     },
     "diagnose": {
       "source": "github:mattpocock/skills",
-      "path": "skills/engineering/diagnose",
-      "commit": "694fa30311e02c2639942308513555e61ee84a6f"
+      "path": "skills/engineering/diagnosing-bugs",
+      "commit": "694fa30311e02c2639942308513555e61ee84a6f",
+      "note": "upstream renombró la carpeta diagnose → diagnosing-bugs; mantenemos el nombre local 'diagnose'. El pin sigue en la última revisión aceptada hasta hacer diff y re-pin deliberado del contenido nuevo."
     },
     "find-skills": {
       "source": "github:vercel-labs/skills",
       "path": "skills/find-skills",
       "commit": "be0dd25b4a8665894a56f45ef582cc02ca802c39"
     },
-    "graphify": {
-      "source": "github:safishamsi/graphify",
-      "kind": "release",
-      "version": "0.7.16",
-      "commit": "cce26730212baab6d92ce5f390ef5aae56268f31"
-    },
     "mcp-builder": {
       "source": "github:anthropics/skills",
       "path": "skills/mcp-builder",

package/stack/skills/graphify/.graphify_version

@@ -1 +0,0 @@
-0.7.16