jorgex-stack 1.3.1 → 1.4.0

package/dist/cli.js

@@ -2442,1922 +2442,2390 @@ async function runInstall(opts) {
 }
 
 // src/uninstall.ts
+import fs17 from "fs";
+import path25 from "path";
+import * as p2 from "@clack/prompts";
+
+// src/lib/pi-projection-lifecycle.ts
 import fs16 from "fs";
+import path24 from "path";
+
+// src/adapters/pi.ts
 import path22 from "path";
-import * as p2 from "@clack/prompts";
-function resolvePlaywrightUninstallPlan(input) {
+var piAdapter = {
+  id: "pi",
+  paths(configDir) {
+    const piConfigDir = process.env.PI_CODING_AGENT_DIR ?? path22.join(HOME, ".pi", "agent");
+    const agentsHome = samePath(configDir, piConfigDir) ? HOME : path22.join(path22.dirname(configDir), "home");
+    return {
+      systemPromptFile: path22.join(configDir, "AGENTS.md"),
+      agentsDir: path22.join(configDir, "agents"),
+      skillsDir: path22.join(agentsHome, ".agents", "skills"),
+      commandsDir: path22.join(configDir, "prompts"),
+      pluginsDir: null,
+      scriptsDir: path22.join(configDir, "scripts"),
+      outputStylesDir: null,
+      profilesDir: null
+    };
+  },
+  renderCommand(file, content) {
+    return { file, content: content.replace(/\{\{input\}\}/g, "$ARGUMENTS") };
+  },
+  injectEngramProtocol() {
+    return true;
+  }
+};
+
+// src/lib/pi-package-lifecycle.ts
+import path23 from "path";
+var REQUIRED_CAPABILITIES = /* @__PURE__ */ new Set([
+  "foundation-contract-v1",
+  "runner-json-v1",
+  "managed-primary-model-v1"
+]);
+var ALLOWED_EXTERNAL_WRITES = /* @__PURE__ */ new Set([
+  "settings.json",
+  "models.json",
+  "jorgex-pi/sol-lifecycle.v1.json"
+]);
+function sameRecord(left, right) {
+  return JSON.stringify(left) === JSON.stringify(right);
+}
+function managedExternalWritesAreSafe(writes) {
+  if (writes.length !== ALLOWED_EXTERNAL_WRITES.size) return false;
+  const seen = /* @__PURE__ */ new Set();
+  for (const write of writes) {
+    if (write === null || typeof write !== "object" || Array.isArray(write)) return false;
+    if (Object.keys(write).sort().join(",") !== "owner,relativePath,root,semantics") return false;
+    if (write.owner !== "jorgex-pi" || write.root !== "PI_CODING_AGENT_DIR") return false;
+    if (typeof write.relativePath !== "string" || !ALLOWED_EXTERNAL_WRITES.has(write.relativePath)) return false;
+    if (/^(?:[A-Za-z]:|[\\/])/.test(write.relativePath) || write.relativePath.split(/[\\/]/).includes("..")) return false;
+    if (typeof write.semantics !== "string" || write.semantics.trim() === "" || seen.has(write.relativePath)) return false;
+    seen.add(write.relativePath);
+  }
+  return seen.size === ALLOWED_EXTERNAL_WRITES.size;
+}
+function ownership(receipt) {
+  return { receipt, adapters: false, manifest: false, modelMap: false };
+}
+function blocked(input, reason) {
   return {
-    actions: input.removePackage ? ["remove"] : [],
-    preserveBrowserData: true
+    kind: "blocked",
+    reason,
+    receiptPath: input.scope.receiptPath,
+    ownership: ownership(input.receiptJson !== null)
   };
 }
-async function runUninstall(opts) {
-  p2.intro(`jorgex-stack ${opts.dryRun ? "uninstall (dry-run)" : "uninstall"}`);
-  const useBrowserPreferences = opts.targetDir === void 0;
-  const preferenceErrors = useBrowserPreferences ? [...browserPreferenceErrors(), primaryModelOwnershipError()].filter((error) => error !== null) : [];
-  if (preferenceErrors.length > 0) {
-    for (const error of preferenceErrors) p2.log.error(error);
-    p2.outro("Uninstall cancelado: corrige el estado de configuraci\xF3n indicado arriba antes de reintentar.");
-    return 1;
+function packageSource(entry) {
+  if (typeof entry === "string") return entry;
+  if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return null;
+  const source = Reflect.get(entry, "source");
+  return typeof source === "string" ? source : null;
+}
+function isJorgeXPiSource(source) {
+  return source.includes("jorgex-pi");
+}
+function parsePackageSources(settingsJson) {
+  try {
+    const parsed = JSON.parse(settingsJson);
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+    const packages = Reflect.get(parsed, "packages");
+    if (!Array.isArray(packages)) return null;
+    const sources = packages.map((entry) => ({ entry, source: packageSource(entry) }));
+    return sources.every((value) => value.source !== null) ? sources : null;
+  } catch {
+    return null;
   }
-  const stackDir = stackRoot();
-  const mcp = loadCanonicalMcp(stackDir);
-  const hooks = loadCanonicalHooks(stackDir);
-  let exitCode = 0;
-  let removeEngram = opts.removeEngram;
-  if (!removeEngram && !opts.yes && !opts.dryRun && process.stdout.isTTY) {
-    const answer = await p2.confirm({
-      message: "\xBFQuitar tambi\xE9n el registro de Engram (MCP/plugin) de los runtimes? Tus memorias (~/.engram) y el binario NO se tocan en ning\xFAn caso.",
-      initialValue: false
+}
+function isExactManagedPackage(entry, source) {
+  if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return false;
+  const keys = Object.keys(entry);
+  const skills = Reflect.get(entry, "skills");
+  const prompts = Reflect.get(entry, "prompts");
+  return keys.length === 3 && keys.includes("source") && keys.includes("skills") && keys.includes("prompts") && Reflect.get(entry, "source") === source && Array.isArray(skills) && skills.length === 0 && Array.isArray(prompts) && prompts.length === 0;
+}
+function filterProjectedPiPackage(settingsJson, source) {
+  try {
+    const parsed = JSON.parse(settingsJson);
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+    const packages = Reflect.get(parsed, "packages");
+    if (!Array.isArray(packages)) return null;
+    const matchingSources = packages.filter((entry) => {
+      const entrySource = packageSource(entry);
+      return entrySource !== null && isJorgeXPiSource(entrySource);
     });
-    if (p2.isCancel(answer)) {
-      p2.cancel("Cancelado \u2014 no se ha tocado nada.");
-      return 1;
-    }
-    removeEngram = answer === true;
-  }
-  const mcpForUnmerge = removeEngram ? mcp : { servers: Object.fromEntries(Object.entries(mcp.servers).filter(([name]) => name !== "engram")) };
-  if (!removeEngram) {
-    p2.log.info("Engram se conserva: memorias, binario y registro intactos (usa --remove-engram para desregistrarlo).");
-  }
-  const retained = /* @__PURE__ */ new Set();
-  if (useBrowserPreferences) {
-    for (const keep of Object.values(ADAPTERS)) {
-      if (opts.runtimes.includes(keep.id)) continue;
-      const detection = keep.detect();
-      if (!detection.installed) continue;
-      const keepCtx = makeContext(keep, detection.configDir);
-      if (!keepCtx) continue;
-      for (const action of buildPlan(keep, keepCtx)) retained.add(path22.resolve(action.target));
-    }
+    if (matchingSources.length !== 1) return null;
+    const managedEntry = matchingSources[0];
+    if (isExactManagedPackage(managedEntry, source)) return JSON.stringify(parsed);
+    if (managedEntry !== source) return null;
+    Reflect.set(parsed, "packages", packages.map((entry) => entry === source ? {
+      source,
+      skills: [],
+      prompts: []
+    } : entry));
+    return JSON.stringify(parsed);
+  } catch {
+    return null;
   }
-  for (const id of opts.runtimes) {
-    const adapter = ADAPTERS[id];
-    if (!adapter) {
-      p2.log.warn(`${id}: sin adapter \u2014 omitido.`);
-      continue;
-    }
-    const detection = adapter.detect();
-    const configDir = opts.targetDir ?? detection.configDir;
-    if (!detection.installed && opts.targetDir === void 0) {
-      p2.log.warn(`${adapter.name} no detectado \u2014 omitido.`);
-      continue;
-    }
-    const ctx = makeContext(adapter, configDir, void 0, useBrowserPreferences);
-    if (!ctx) continue;
-    ctx.preserveEngram = !removeEngram;
-    const unmerge = adapter.planUnmerge(mcpForUnmerge, hooks, ctx);
-    const mergedTargets = new Set(unmerge.map((a) => path22.resolve(a.target)));
-    const usingRealConfig = opts.targetDir === void 0;
-    const prevOwned = usingRealConfig ? readManifest().runtimes[id]?.owned ?? [] : [];
-    const pruneRoot = usingRealConfig ? HOME : path22.dirname(configDir);
-    const planTargets = [
-      .../* @__PURE__ */ new Set([...buildPlan(adapter, ctx).map((a) => path22.resolve(a.target)), ...prevOwned.map((t) => path22.resolve(t))])
-    ].filter((t) => !mergedTargets.has(t) && fs16.existsSync(t));
-    const deleteTargets = planTargets.filter(
-      (t) => !retained.has(t) && !(ctx.preserveEngram && path22.basename(t) === "engram.ts") && isContainedIn(t, pruneRoot)
-    );
-    const sharedKept = planTargets.length - deleteTargets.length;
-    p2.log.step(`${adapter.name} \u2192 ${configDir}`);
-    p2.log.info(`${deleteTargets.length} archivos a borrar, ${unmerge.length} archivos compartidos a limpiar`);
-    if (sharedKept > 0) p2.log.info(`${sharedKept} archivos se conservan: otros runtimes instalados los siguen usando.`);
-    if (opts.dryRun) continue;
-    let backup;
-    try {
-      backup = createBackup(
-        [...deleteTargets, ...unmerge.map((a) => a.target).filter((t) => fs16.existsSync(t))],
-        `uninstall-${id}`
-      );
-    } catch (error) {
-      p2.log.error(`${adapter.name}: no se pudo respaldar una configuraci\xF3n ilegible en ${configDir} \u2014 ${error instanceof Error ? error.message : String(error)}.`);
-      exitCode = 1;
-      continue;
+}
+function expectedReceipt(candidate, state, scope, engramBin) {
+  return {
+    schemaVersion: 1,
+    state,
+    candidate: {
+      package: candidate.package,
+      tarball: candidate.tarball,
+      provenance: candidate.provenance
+    },
+    scope,
+    engram: { binary: engramBin }
+  };
+}
+function parseReceiptShape(receiptJson) {
+  try {
+    const parsed = JSON.parse(receiptJson);
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+    const schemaVersion = Reflect.get(parsed, "schemaVersion");
+    if (schemaVersion !== 1) return null;
+    const state = Reflect.get(parsed, "state");
+    const candidate = Reflect.get(parsed, "candidate");
+    if (state !== "installing" && state !== "installed" || candidate === null || typeof candidate !== "object" || Array.isArray(candidate)) {
+      return null;
     }
-    if (backup) p2.log.info(`Backup: ${backup.id} (${backup.files.length} archivos)`);
-    for (const target of deleteTargets) {
-      fs16.rmSync(target, { force: true });
-      pruneEmptyDirs(target, pruneRoot);
+    const packageValue = Reflect.get(candidate, "package");
+    const tarball = Reflect.get(candidate, "tarball");
+    const provenance = Reflect.get(candidate, "provenance");
+    const scope = Reflect.get(parsed, "scope");
+    const engram = Reflect.get(parsed, "engram");
+    if (packageValue === null || typeof packageValue !== "object" || tarball === null || typeof tarball !== "object" || provenance === null || typeof provenance !== "object" || scope === null || typeof scope !== "object" || Array.isArray(scope)) {
+      return null;
     }
-    for (const action of unmerge) {
-      if (action.kind !== "write") continue;
-      if (action.content.trim() === "") {
-        fs16.rmSync(action.target, { force: true });
-      } else {
-        writeText(action.target, action.content);
-      }
-      if (usingRealConfig) {
-        for (const change of action.mcpOwnership ?? []) {
-          saveDevtoolsMcpOwnership(devtoolsMcpPreferenceFile(), id, change.server, change.owned);
-        }
-        for (const change of action.primaryModelOwnership ?? []) {
-          savePrimaryModelOwnership(primaryModelOwnershipFile(), id, configDir, change.field, change.owned);
-        }
-      }
+    const source = Reflect.get(packageValue, "source");
+    const name = Reflect.get(packageValue, "name");
+    const version = Reflect.get(packageValue, "version");
+    const scopeKind = Reflect.get(scope, "kind");
+    const codingAgentDir = Reflect.get(scope, "codingAgentDir");
+    if (name !== "jorgex-pi" || typeof version !== "string" || typeof source !== "string" || source !== `npm:jorgex-pi@${version}` || scopeKind !== "real" && scopeKind !== "target-dir" || typeof codingAgentDir !== "string") {
+      return null;
     }
-    if (usingRealConfig) {
-      for (const field of ctx.ownedPrimaryModelFields ?? []) {
-        savePrimaryModelOwnership(primaryModelOwnershipFile(), id, configDir, field, false);
-      }
+    if (engram === void 0) return "upgrade-required";
+    if (engram === null || typeof engram !== "object" || Array.isArray(engram) || typeof Reflect.get(engram, "binary") !== "string" || !path23.isAbsolute(Reflect.get(engram, "binary"))) {
+      return null;
     }
-    if (usingRealConfig) removeRuntimeManifest(id);
-    p2.log.success(`${adapter.name}: stack retirado (lo tuyo queda intacto).`);
+    return parsed;
+  } catch {
+    return null;
   }
-  const playwrightPlan = resolvePlaywrightUninstallPlan({
-    removePackage: opts.targetDir === void 0 && opts.removePlaywright
-  });
-  if (opts.removePlaywright && opts.targetDir !== void 0) {
-    p2.log.info("Playwright CLI: --target-dir conserva el paquete global y los datos del navegador.");
-  } else if (playwrightPlan.actions.length > 0) {
-    if (opts.dryRun) {
-      p2.log.info("Playwright CLI: se retirar\xEDa solo el paquete global; los datos y navegadores se conservan.");
-    } else {
-      const removal = executePlaywrightToolAction2("remove");
-      if (removal.ok) {
-        try {
-          savePlaywrightCliPreference(playwrightCliPreferenceFile(), false);
-          p2.log.success("Playwright CLI: paquete global retirado; los datos y navegadores se conservan.");
-        } catch (error) {
-          p2.log.error(`Playwright CLI: paquete global retirado, pero no se pudo guardar la preferencia (${error instanceof Error ? error.message : String(error)}). Corrige la preferencia antes de reintentar.`);
-          exitCode = 1;
-        }
-      } else {
-        const pnpmRemedy = resolvePnpmFailureRemedy(removal.reason);
-        const recovery = pnpmRemedy === null ? " Revisa el error de pnpm anterior y ejecuta 'jorgex-stack uninstall --remove-playwright' para reintentar." : ` ${pnpmRemedy} Despu\xE9s, ejecuta 'jorgex-stack uninstall --remove-playwright' para reintentar.`;
-        p2.log.error(`Playwright CLI: no se pudo retirar el paquete global; los datos y la preferencia se conservan.${recovery}`);
-        exitCode = 1;
-      }
-    }
-  } else {
-    p2.log.info("Playwright CLI: paquete global y datos del navegador conservados (usa --remove-playwright para retirar solo el paquete).");
-  }
-  p2.outro(opts.dryRun ? "Dry-run: no se ha tocado nada." : exitCode === 0 ? "Hecho. Usa 'restore' si quieres volver atr\xE1s." : "Uninstall completado con errores (revisa arriba).");
-  return exitCode;
-}
-
-// src/doctor.ts
-import path23 from "path";
-import fs17 from "fs";
-import * as p3 from "@clack/prompts";
-function engramVersion(bin) {
-  const out = runDetectedBin(bin, ["--version"], 5e3);
-  if (out === null) return null;
-  return /(\d+\.\d+\.\d+)/.exec(out)?.[1] ?? out.trim().split("\n")[0] ?? null;
 }
-function resolvePlaywrightDoctorState(input) {
-  if (input.enabled !== true) return { status: "disabled" };
-  if (input.cli.status === "absent") return { status: "missing", missing: "package" };
-  if (input.cli.status === "broken") return { status: "broken" };
-  if (input.cli.status === "outdated") return { status: "outdated" };
-  if (input.browserCache?.status === "unreadable") {
-    return { status: "unreadable", path: input.browserCache.path, errorCode: input.browserCache.errorCode };
-  }
-  if (!input.browserReady) return { status: "missing", missing: "browser" };
-  return { status: "healthy" };
+function parseReceipt(receiptJson, candidate, scope, engramBin) {
+  const parsed = parseReceiptShape(receiptJson);
+  if (parsed === null || parsed === "upgrade-required") return parsed;
+  const expected = expectedReceipt(candidate, parsed.state, scope, engramBin);
+  return sameRecord(parsed, expected) ? expected : null;
 }
-function context7KeyConfigured(id, configDir) {
-  const file = id === "codex" ? path23.join(configDir, "config.toml") : id === "claude-code" ? path23.join(path23.dirname(configDir), `${path23.basename(configDir)}.json`) : path23.join(configDir, "opencode.json");
-  const content = readTextIfExists(file);
-  if (content === null) return null;
-  const match = /CONTEXT7_API_KEY"?\s*[:=]\s*"([^"]*)"/.exec(content);
-  if (!match) return null;
-  return match[1] !== "";
+function candidateIsValid(candidate, observed) {
+  return candidate.package.name === "jorgex-pi" && candidate.package.source === `npm:${candidate.package.name}@${candidate.package.version}` && candidate.contract.schemaVersion === 1 && candidate.contract.runner.schemaVersion === 1 && candidate.contract.runner.bin === "jorgex-pi" && candidate.contract.runner.maxStdoutBytes === 65536 && managedExternalWritesAreSafe(candidate.contract.managedExternalWrites) && [...REQUIRED_CAPABILITIES].every((capability) => candidate.contract.capabilities.includes(capability)) && sameRecord(candidate.tarball, observed);
 }
-async function runDoctor() {
-  p3.intro("jorgex-stack doctor");
-  let problems = 0;
-  const engramBin = detectEngram();
-  if (engramBin === null) {
-    p3.log.warn("Engram: NO detectado. El protocolo de memoria no funcionar\xE1 \u2014 inst\xE1lalo: github.com/Gentleman-Programming/engram");
-    problems++;
-  } else {
-    const version = engramVersion(engramBin);
-    if (version === null) {
-      p3.log.error(`Engram: binario en ${engramBin} pero no responde a --version.`);
-      problems++;
-    } else {
-      p3.log.success(`Engram: ${version} (${engramBin})`);
-    }
+function planPiPackageLifecycle(input) {
+  if (!candidateIsValid(input.candidate, input.observedTarball)) {
+    return blocked(input, "tarball-integrity");
   }
-  const engramDataDir = process.env.ENGRAM_DATA_DIR ?? path23.join(HOME, ".engram");
-  const engramDb = path23.join(engramDataDir, "engram.db");
-  if (fs17.existsSync(engramDb)) {
-    const sizeMb = (fs17.statSync(engramDb).size / 1024 / 1024).toFixed(1);
-    p3.log.info(`Engram DB: ${engramDb} (${sizeMb} MB de memorias \u2014 el stack no la toca JAM\xC1S).`);
+  if (!input.candidate.pi.testedVersions.includes(input.pi.version)) {
+    return blocked(input, "unsupported-pi-version");
   }
-  if (!fs17.existsSync(modelMapFile())) p3.log.info("model-map: a\xFAn no creado (se crea en el primer install o con 'models').");
-  const preferenceErrors = browserPreferenceErrors();
-  const primaryOwnershipError = primaryModelOwnershipError();
-  if (primaryOwnershipError !== null) {
-    p3.log.error(primaryOwnershipError);
-    problems++;
+  if (input.engramBin === null) return blocked(input, "engram-missing");
+  const sources = parsePackageSources(input.pi.settingsJson);
+  if (sources === null) return blocked(input, "settings-corrupt");
+  const matchingSources = sources.filter(({ source }) => isJorgeXPiSource(source));
+  const exactSources = matchingSources.filter(({ source }) => source === input.candidate.package.source);
+  if (exactSources.length > 1) return blocked(input, "duplicate-package");
+  if (matchingSources.some(({ source }) => source !== input.candidate.package.source)) {
+    return blocked(input, "source-divergent");
   }
-  if (preferenceErrors.length > 0) {
-    for (const error of preferenceErrors) p3.log.error(error);
-    problems += preferenceErrors.length;
-  } else {
-    const browserCache = isPlaywrightBrowserReady();
-    const playwright = resolvePlaywrightDoctorState({
-      enabled: loadPlaywrightCliPreference(),
-      cli: detectPlaywrightCli(),
-      browserReady: browserCache.status === "ready",
-      browserCache
-    });
-    if (playwright.status === "disabled") {
-      p3.log.info("Playwright CLI: deshabilitado (opcional). Usa 'install --playwright' para instalarlo de forma expl\xEDcita.");
-    } else if (playwright.status === "healthy") {
-      p3.log.success("Playwright CLI: paquete y navegador listos.");
-    } else if (playwright.status === "missing") {
-      const target = playwright.missing === "package" ? "el paquete global" : "el navegador de Playwright";
-      p3.log.warn(`Playwright CLI: habilitado, pero falta ${target} \u2192 ejecuta 'jorgex-stack install --playwright'.`);
-      problems++;
-    } else if (playwright.status === "broken") {
-      p3.log.error("Playwright CLI: el binario detectado no responde correctamente \u2192 ejecuta 'jorgex-stack install --playwright'.");
-      problems++;
-    } else if (playwright.status === "unreadable") {
-      p3.log.error(`Playwright CLI: no se puede leer la cach\xE9 de navegadores en ${playwright.path} (${playwright.errorCode}) \u2192 revisa permisos o ejecuta 'jorgex-stack install --playwright'.`);
-      problems++;
-    } else {
-      p3.log.warn("Playwright CLI: versi\xF3n distinta del pin aprobado \u2192 ejecuta 'jorgex-stack update' o 'install --playwright'.");
-      problems++;
+  let receipt = null;
+  if (input.receiptJson !== null) {
+    const parsedReceipt = parseReceipt(input.receiptJson, input.candidate, {
+      kind: input.scope.kind,
+      codingAgentDir: path23.resolve(input.scope.codingAgentDir)
+    }, input.engramBin);
+    if (parsedReceipt === "upgrade-required") return blocked(input, "receipt-upgrade-required");
+    if (parsedReceipt === null) return blocked(input, "receipt-corrupt");
+    receipt = parsedReceipt;
+    if (receipt.state === "installing") return blocked(input, "partial-state");
+    const exactSource = exactSources[0];
+    if (exactSources.length !== 1 || exactSource === void 0 || !isExactManagedPackage(exactSource.entry, input.candidate.package.source)) {
+      return blocked(input, "source-divergent");
     }
   }
-  const manifest = readManifest();
-  const modePreference = loadInstallModePreference();
-  const current = collectAllCurrentTargets(modePreference);
-  if (!current.complete || current.warnings.length > 0) {
-    p3.log.warn("Limpieza de hu\xE9rfanos deshabilitada: no se pudo construir el plan completo de todos los runtimes.");
-    for (const warning of current.warnings) p3.log.warn(warning);
-    problems++;
-  }
-  for (const adapter of Object.values(ADAPTERS)) {
-    const detection = adapter.detect();
-    if (!detection.installed) {
-      p3.log.warn(`${adapter.name}: no instalado en esta m\xE1quina.`);
-      continue;
-    }
-    const ctx = makeContext(adapter, detection.configDir, modePreference);
-    if (!ctx) continue;
-    let pending;
-    try {
-      pending = diffPlan(buildPlan(adapter, ctx)).filter((d) => d.status !== "unchanged").length;
-    } catch (err) {
-      p3.log.error(
-        `${adapter.name}: config ilegible en ${detection.configDir} \u2014 ${err instanceof Error ? err.message : err}`
-      );
-      problems++;
-      continue;
-    }
-    if (pending > 0) {
-      p3.log.warn(`${adapter.name}: ${pending} archivos gestionados desactualizados o ausentes \u2192 ejecuta 'sync'.`);
-      problems++;
-    } else {
-      p3.log.success(`${adapter.name}: config del stack al d\xEDa (${detection.configDir}).`);
-    }
-    const prev = manifest.runtimes[adapter.id];
-    const orphans = prev && current.complete ? findOrphans(prev.owned, current.targets) : [];
-    if (orphans.length > 0) {
-      p3.log.warn(`${adapter.name}: ${orphans.length} archivos hu\xE9rfanos de versiones previas \u2192 ejecuta 'sync'.`);
-      problems++;
-    }
-    if (adapter.id === "codex" && fs17.existsSync(path23.join(detection.configDir, "hooks.json"))) {
-      p3.log.info("Codex: recuerda que los hooks requieren aprobaci\xF3n manual \u2014 verifica con /hooks dentro de codex.");
-    }
-    if (adapter.id === "codex" && fs17.existsSync(path23.join(detection.configDir, "AGENTS.override.md"))) {
-      p3.log.warn(
-        "Codex: existe ~/.codex/AGENTS.override.md \u2014 tiene prioridad ABSOLUTA y tapa el AGENTS.md gestionado por el stack."
-      );
-      problems++;
-    }
-    const key = context7KeyConfigured(adapter.id, detection.configDir);
-    if (key === false) p3.log.info(`${adapter.name}: context7 sin key (opcional \u2014 con\xE9ctala cuando quieras).`);
+  if (exactSources.length === 1 && receipt === null) {
+    return {
+      kind: "manual-existing",
+      receiptPath: input.scope.receiptPath,
+      ownership: ownership(false)
+    };
   }
-  p3.outro(problems === 0 ? "Todo sano." : `${problems} avisos \u2014 revisa arriba.`);
-  return problems > 0 ? 1 : 0;
-}
-
-// src/update.ts
-import fs20 from "fs";
-import path26 from "path";
-import os4 from "os";
-import { execFileSync as execFileSync5 } from "child_process";
-import * as p4 from "@clack/prompts";
-
-// src/lib/github.ts
-import fs18 from "fs";
-import path24 from "path";
-import { execFileSync as execFileSync3 } from "child_process";
-import os3 from "os";
-import { Readable } from "stream";
-import { pipeline } from "stream/promises";
-var cachedToken;
-var ghTokenFailed = false;
-function githubToken() {
-  if (cachedToken !== void 0) return cachedToken;
-  const env = process.env["GH_TOKEN"]?.trim() || process.env["GITHUB_TOKEN"]?.trim();
-  if (env) return cachedToken = env;
-  const gh = lookPath("gh");
-  if (gh) {
-    const fromGh = runDetectedBin(gh, ["auth", "token"], 5e3)?.trim();
-    if (fromGh) return cachedToken = fromGh;
-    ghTokenFailed = true;
+  if (exactSources.length === 1 && receipt !== null) {
+    return {
+      kind: "ready",
+      receiptPath: input.scope.receiptPath,
+      ownership: ownership(true)
+    };
   }
-  return cachedToken = null;
-}
-function ghPresentButTokenFailed() {
-  return ghTokenFailed;
-}
-function authHeaders() {
-  const token = githubToken();
-  return token ? { Authorization: `Bearer ${token}` } : {};
-}
-var rateLimitHit = false;
-function githubRateLimited() {
-  return rateLimitHit;
-}
-function githubHeaders() {
   return {
-    Accept: "application/vnd.github+json",
-    "User-Agent": "jorgex-stack",
-    ...authHeaders()
+    kind: "install",
+    receiptPath: input.scope.receiptPath,
+    invocation: {
+      executable: input.pi.executable,
+      args: ["install", input.candidate.package.source, "--no-approve"],
+      environment: input.scope.environment
+    },
+    receipt: expectedReceipt(input.candidate, "installing", {
+      kind: input.scope.kind,
+      codingAgentDir: path23.resolve(input.scope.codingAgentDir)
+    }, input.engramBin),
+    ownership: ownership(true)
   };
 }
-async function latestGithubRelease(repo) {
+function parseRunnerRecord(stdout, stderr, command, candidate, packageRunner) {
+  if (stderr !== "" || !stdout.endsWith("\n") || Buffer.byteLength(stdout) > candidate.contract.runner.maxStdoutBytes) {
+    return null;
+  }
+  const body = stdout.slice(0, -1);
+  if (body === "" || body.includes("\n") || body.includes("\r")) return null;
   try {
-    const res = await fetch(`https://api.github.com/repos/${repo}/releases/latest`, {
-      headers: githubHeaders(),
-      signal: AbortSignal.timeout(1e4)
-    });
-    if (!res.ok) {
-      if (res.status === 403 || res.status === 429) rateLimitHit = true;
+    const parsed = JSON.parse(body);
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+    const record = parsed;
+    if (record.schemaVersion !== candidate.contract.runner.schemaVersion || record.command !== command || record.ok !== true || record.package === null || typeof record.package !== "object" || record.package.name !== candidate.package.name || record.package.version !== candidate.package.version || typeof record.package.root !== "string" || !path23.isAbsolute(record.package.root) || path23.resolve(packageRunner) !== path23.resolve(record.package.root, "bin", "jorgex-pi.mjs")) {
       return null;
     }
-    const data = await res.json();
-    return data.tag_name?.replace(/^v/, "") ?? null;
+    return record;
   } catch {
     return null;
   }
 }
-async function latestGithubCommit(repo) {
-  try {
-    const res = await fetch(`https://api.github.com/repos/${repo}/commits?per_page=1`, {
-      headers: githubHeaders(),
-      signal: AbortSignal.timeout(1e4)
-    });
-    if (!res.ok) {
-      if (res.status === 403 || res.status === 429) rateLimitHit = true;
-      return null;
-    }
-    const data = await res.json();
-    return data[0]?.sha ?? null;
-  } catch {
-    return null;
-  }
-}
-function validateExtractedTree(destDir) {
-  const resolved = path24.resolve(destDir);
-  const walk = (dir) => {
-    let entries;
-    try {
-      entries = fs18.readdirSync(dir, { withFileTypes: true });
-    } catch {
-      return false;
-    }
-    for (const entry of entries) {
-      const full = path24.join(dir, entry.name);
-      let stat;
-      try {
-        stat = fs18.lstatSync(full);
-      } catch {
-        return false;
-      }
-      if (stat.isSymbolicLink()) return false;
-      if (!isContainedIn(full, resolved)) return false;
-      if (entry.isDirectory()) {
-        if (!walk(full)) return false;
-      }
-    }
-    return true;
-  };
-  return walk(resolved);
+function runPackageCommand(input, deps, command) {
+  const result = deps.run({
+    executable: input.packageRunner,
+    args: [command, "--json"],
+    environment: input.environment
+  });
+  if (result.exitCode !== 0) return { kind: "blocked", reason: "runner-unhealthy" };
+  return parseRunnerRecord(result.stdout, result.stderr, command, input.candidate, input.packageRunner) ?? { kind: "blocked", reason: "runner-output" };
 }
-function resolveTarBin() {
-  if (process.platform !== "win32") return "tar";
-  const winTar = path24.join(process.env["SystemRoot"] ?? "C:\\Windows", "System32", "tar.exe");
-  return fs18.existsSync(winTar) ? winTar : "tar";
+function isBlockedResult(value) {
+  return "kind" in value;
 }
-async function downloadRepoTarball(repo, sha, destDir, validateSubdir) {
-  const url = `https://codeload.github.com/${repo}/tar.gz/${sha}`;
-  const tmp = path24.join(os3.tmpdir(), `jorgex-tarball-${Date.now()}.tar.gz`);
-  const fail = (reason) => {
-    try {
-      fs18.rmSync(destDir, { recursive: true, force: true });
-    } catch {
-    }
-    return { ok: false, reason };
-  };
-  try {
-    const res = await fetch(url, {
-      headers: { "User-Agent": "jorgex-stack", ...authHeaders() },
-      signal: AbortSignal.timeout(12e4)
-    });
-    if (!res.ok) {
-      if (res.status === 403 || res.status === 429) rateLimitHit = true;
-      return fail(
-        `HTTP ${res.status}${res.status === 403 || res.status === 429 ? " \u2014 rate limit; define GH_TOKEN o inicia sesi\xF3n en gh" : ""}`
-      );
-    }
-    if (!res.body) return fail("respuesta HTTP sin cuerpo");
-    await pipeline(
-      Readable.fromWeb(res.body),
-      fs18.createWriteStream(tmp)
-    );
-    fs18.rmSync(destDir, { recursive: true, force: true });
-    fs18.mkdirSync(destDir, { recursive: true });
-    try {
-      execFileSync3(resolveTarBin(), ["-xzf", tmp, "--strip-components=1", "-C", destDir], { stdio: "pipe" });
-    } catch (err) {
-      const e = err;
-      const detail = (e.stderr?.toString().trim() || e.message || "").split("\n")[0];
-      return fail(detail ? `tar fall\xF3: ${detail}` : "tar no disponible o fall\xF3 la extracci\xF3n");
-    }
-    const resolvedDest = path24.resolve(destDir);
-    const validateRoot = validateSubdir ? path24.resolve(resolvedDest, validateSubdir) : resolvedDest;
-    if (validateRoot !== resolvedDest && !isContainedIn(validateRoot, resolvedDest)) {
-      return fail(`la ruta de validaci\xF3n "${validateSubdir}" escapa del destino`);
+function executePiPackageLifecycle(input, deps) {
+  if (input.plan.kind === "manual-existing") return { kind: "manual-existing" };
+  if (input.operation === "install") {
+    if (input.plan.kind !== "install" || input.plan.receipt === void 0 || input.plan.invocation === void 0) {
+      return { kind: "blocked", reason: "runner-unhealthy" };
     }
-    if (fs18.existsSync(validateRoot) && !validateExtractedTree(validateRoot)) {
-      return fail("el \xE1rbol extra\xEDdo contiene symlinks o rutas fuera del destino");
+    deps.writeReceipt(input.plan.receipt);
+    const installed = deps.run(input.plan.invocation);
+    if (installed.exitCode !== 0 || installed.stderr !== "") {
+      return { kind: "blocked", reason: "pi-install-failed" };
     }
-    const validated = fs18.existsSync(validateRoot);
-    return { ok: true, validated };
-  } catch (err) {
-    const timedOut = err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError");
-    return fail(timedOut ? "timeout de descarga (120s)" : err instanceof Error ? `fallo de red: ${err.message}` : "error desconocido");
-  } finally {
-    try {
-      fs18.rmSync(tmp, { force: true });
-    } catch {
+    const doctor = runPackageCommand(input, deps, "doctor");
+    if (isBlockedResult(doctor)) return doctor;
+    const doctorResult = doctor.result;
+    if (doctorResult === null || typeof doctorResult !== "object" || Reflect.get(doctorResult, "healthy") !== true) {
+      return { kind: "blocked", reason: "runner-unhealthy" };
     }
+    const receipt = { ...input.plan.receipt, state: "installed" };
+    deps.writeReceipt(receipt);
+    return { kind: "installed", receipt };
   }
-}
-
-// src/lib/skill-update.ts
-import fs19 from "fs";
-import path25 from "path";
-import { execFileSync as execFileSync4 } from "child_process";
-var PROTECTED_SKILLS = /* @__PURE__ */ new Set([
-  "agent-delegation",
-  "lean-code",
-  "orchestrator",
-  "work-lifecycle",
-  "xreview"
-]);
-function sameTextContentNormalized(a, b) {
-  const ba = fs19.readFileSync(a);
-  const bb = fs19.readFileSync(b);
-  if (ba.equals(bb)) return true;
-  const sa = ba.toString("utf8").replace(/\r\n/g, "\n");
-  const sb = bb.toString("utf8").replace(/\r\n/g, "\n");
-  return sa === sb;
-}
-function diffSkillDirs(upstreamDir, localDir) {
-  const upstreamFiles = new Set(
-    listFilesRecursive(upstreamDir).map((f) => path25.relative(upstreamDir, f))
-  );
-  const localFiles = new Set(
-    listFilesRecursive(localDir).map((f) => path25.relative(localDir, f))
-  );
-  const added = [];
-  const modified = [];
-  const deleted = [];
-  for (const rel of upstreamFiles) {
-    if (!localFiles.has(rel)) {
-      added.push(rel);
-    } else if (!sameTextContentNormalized(path25.join(upstreamDir, rel), path25.join(localDir, rel))) {
-      modified.push(rel);
+  if (input.plan.kind !== "ready") return { kind: "blocked", reason: "runner-unhealthy" };
+  const command = runPackageCommand(input, deps, input.operation);
+  if (isBlockedResult(command)) return command;
+  if (input.operation === "sync") {
+    const result = command.result;
+    if (result === null || typeof result !== "object" || Reflect.get(result, "changed") !== true && Reflect.get(result, "changed") !== false || !Array.isArray(Reflect.get(result, "actions"))) {
+      return { kind: "blocked", reason: "runner-unhealthy" };
     }
+    return { kind: "synced", actions: Reflect.get(result, "actions") };
   }
-  for (const rel of localFiles) {
-    if (!upstreamFiles.has(rel)) {
-      deleted.push(rel);
-    }
+  const models = command.result;
+  if (models === null || typeof models !== "object" || Reflect.get(models, "mode") !== "inherit-session" || !sameRecord(Reflect.get(models, "tiers"), ["strong", "standard", "cheap"])) {
+    return { kind: "blocked", reason: "runner-unhealthy" };
   }
+  return { kind: "models", models: { mode: "inherit-session", tiers: ["strong", "standard", "cheap"] } };
+}
+function receiptUpgradeRequired() {
   return {
-    added: added.sort(),
-    modified: modified.sort(),
-    deleted: deleted.sort()
+    kind: "blocked",
+    reason: "receipt-upgrade-required",
+    remedy: "El receipt no enlaza Engram; usa la versi\xF3n anterior de Stack para desinstalarlo y luego reinstala."
   };
 }
-var DIFF_MAX_LINES = 400;
-function renderSkillDiff(upstreamDir, localDir) {
-  try {
-    execFileSync4("git", ["diff", "--no-index", "--stat", "--", localDir, upstreamDir], {
-      stdio: "pipe",
-      encoding: "utf8"
-    });
-    return "";
-  } catch (statErr) {
-    const se = statErr;
-    if (typeof se.stdout !== "string" || se.status !== 1) {
-      const d = diffSkillDirs(upstreamDir, localDir);
-      const total = d.added.length + d.modified.length + d.deleted.length;
-      if (total === 0) return "";
-      return `[git no disponible \u2014 resumen de cambios]
-  a\xF1adidos: ${d.added.length}, modificados: ${d.modified.length}, eliminados: ${d.deleted.length}`;
-    }
-    const stat = se.stdout;
-    let fullDiff = "";
-    try {
-      execFileSync4("git", ["diff", "--no-index", "--", localDir, upstreamDir], {
-        stdio: "pipe",
-        encoding: "utf8"
-      });
-    } catch (diffErr) {
-      const de = diffErr;
-      if (typeof de.stdout === "string" && de.status === 1) {
-        const lines = de.stdout.split("\n");
-        if (lines.length > DIFF_MAX_LINES) {
-          fullDiff = lines.slice(0, DIFF_MAX_LINES).join("\n") + `
-(truncado \u2014 ${lines.length - DIFF_MAX_LINES} l\xEDneas omitidas)`;
-        } else {
-          fullDiff = de.stdout;
-        }
-      }
-    }
-    return fullDiff ? `${stat}
-${fullDiff}` : stat;
-  }
-}
-function replaceSkill(name, upstreamSkillDir, newCommit, opts) {
-  const upstreamsFilePath = opts?.upstreamsFilePath;
-  const localSkillsRoot = opts?.localSkillsRoot;
-  const backupsRoot2 = opts?.backupsRoot;
-  if (PROTECTED_SKILLS.has(name)) {
-    throw new Error(`La skill "${name}" es propia del stack y no se actualiza desde upstream.`);
+function validateOwnedOperationState(input) {
+  const sources = parsePackageSources(input.detected.settingsJson);
+  if (sources === null) return { kind: "blocked", reason: "settings-corrupt" };
+  const matchingSources = sources.filter(({ source: source2 }) => isJorgeXPiSource(source2));
+  if (matchingSources.length > 1) return { kind: "blocked", reason: "duplicate-package" };
+  if (input.receiptJson === null) {
+    const matchingSource2 = matchingSources[0];
+    return matchingSource2 !== void 0 && matchingSource2.source === input.registry.candidate.package.source && isExactManagedPackage(matchingSource2.entry, matchingSource2.source) ? { kind: "blocked", reason: "manual-existing" } : { kind: "blocked", reason: "source-divergent" };
   }
-  const upstreamsFile = upstreamsFilePath ?? path25.join(path25.dirname(stackRoot()), "upstreams.json");
-  const raw = fs19.readFileSync(upstreamsFile, "utf8");
-  const data = JSON.parse(raw);
-  const skillEntry = data?.skills?.[name];
-  if (!skillEntry) {
-    throw new Error(`Skill "${name}" no encontrada en upstreams.json.`);
+  const parsedReceipt = parseReceiptShape(input.receiptJson);
+  if (parsedReceipt === "upgrade-required") return receiptUpgradeRequired();
+  if (parsedReceipt === null) return { kind: "blocked", reason: "receipt-corrupt" };
+  const receipt = parsedReceipt;
+  if (receipt.state !== "installed") return { kind: "blocked", reason: "partial-state" };
+  const accepted = input.registry.acceptedCandidates ?? [input.registry.candidate];
+  if (!accepted.some((candidate) => sameRecord(receipt.candidate, {
+    package: candidate.package,
+    tarball: candidate.tarball,
+    provenance: candidate.provenance
+  }))) {
+    return { kind: "blocked", reason: "receipt-untrusted" };
   }
-  if (skillEntry.kind === "release") {
-    throw new Error(`La skill "${name}" es de tipo release y no se actualiza con replaceSkill.`);
+  if (receipt.scope.kind !== (input.paths.targetDir ? "target-dir" : "real") || path23.resolve(receipt.scope.codingAgentDir) !== path23.resolve(input.paths.codingAgentDir)) {
+    return { kind: "blocked", reason: "source-divergent" };
   }
-  const skillsRoot = localSkillsRoot ?? path25.join(stackRoot(), "skills");
-  const localSkillDir = path25.join(skillsRoot, name);
-  const localFiles = listFilesRecursive(localSkillDir);
-  if (localFiles.length > 0) {
-    createBackup(localFiles, `skill-update-${name}`, backupsRoot2);
+  if (input.engramBin !== null && path23.resolve(receipt.engram.binary) !== path23.resolve(input.engramBin)) {
+    return { kind: "blocked", reason: "receipt-corrupt" };
   }
-  const stagingDir = `${localSkillDir}.staging-${process.pid}`;
-  try {
-    const upstreamFiles = listFilesRecursive(upstreamSkillDir);
-    for (const src of upstreamFiles) {
-      const st = fs19.lstatSync(src);
-      if (st.isSymbolicLink()) {
-        throw new Error(`Symlink rechazado en upstream de skill "${name}": ${src}`);
-      }
-      const rel = path25.relative(upstreamSkillDir, src);
-      const dest = path25.join(stagingDir, rel);
-      ensureDir(path25.dirname(dest));
-      copyFile(src, dest);
-    }
-    const oldDir = `${localSkillDir}.old-${process.pid}`;
-    if (fs19.existsSync(localSkillDir)) {
-      fs19.renameSync(localSkillDir, oldDir);
-    }
-    fs19.renameSync(stagingDir, localSkillDir);
-    fs19.rmSync(oldDir, { recursive: true, force: true });
-  } catch (err) {
-    try {
-      fs19.rmSync(stagingDir, { recursive: true, force: true });
-    } catch {
-    }
-    throw err;
+  const source = receipt.candidate.package.source;
+  const matchingSource = matchingSources[0];
+  if (matchingSources.length !== 1 || matchingSource === void 0 || matchingSource.source !== source || !isExactManagedPackage(matchingSource.entry, source)) {
+    return { kind: "blocked", reason: "source-divergent" };
   }
-  skillEntry.commit = newCommit;
-  writeText(upstreamsFile, JSON.stringify(data, null, 2) + "\n");
+  return { receipt, source };
 }
-
-// src/update.ts
-function rateLimitHint(prefix) {
-  return ghPresentButTokenFailed() ? `${prefix} Tienes gh instalado pero \`gh auth token\` no devolvi\xF3 credencial (\xBFsesi\xF3n caducada?) \u2014 prueba \`gh auth login\` o define GH_TOKEN.` : `${prefix} Define GH_TOKEN o inicia sesi\xF3n en gh CLI.`;
+function operationWasBlocked(value) {
+  return "kind" in value;
 }
-function loadUpstreams() {
-  const file = path26.join(path26.dirname(stackRoot()), "upstreams.json");
-  return JSON.parse(fs20.readFileSync(file, "utf8"));
-}
-function skillsToScan(maintainer, upstreams) {
-  return maintainer ? Object.keys(upstreams.skills) : [];
-}
-async function querySkillHeads(skillNames, upstreams) {
-  const requests = /* @__PURE__ */ new Map();
-  for (const name of skillNames) {
-    const info = upstreams.skills[name];
-    const repo = info.source.replace(/^github:/, "");
-    if (!requests.has(repo)) requests.set(repo, latestGithubCommit(repo));
-  }
-  const heads = /* @__PURE__ */ new Map();
-  await Promise.all(
-    [...requests.entries()].map(async ([repo, request]) => {
-      heads.set(repo, await request);
-    })
-  );
-  return skillNames.map((name) => {
-    const info = upstreams.skills[name];
-    const repo = info.source.replace(/^github:/, "");
-    return { name, repo, info, head: heads.get(repo) ?? null };
+function runManagedRunner(input, deps, command) {
+  const result = deps.run({
+    executable: input.detected.packageRunner,
+    args: [command, "--json"],
+    environment: input.paths.environment
   });
+  if (result.exitCode !== 0) return { kind: "blocked", reason: "runner-unhealthy" };
+  const parsed = parseRunnerRecord(
+    result.stdout,
+    result.stderr,
+    command,
+    input.registry.candidate,
+    input.detected.packageRunner
+  );
+  return parsed ?? { kind: "blocked", reason: "runner-output" };
 }
-async function latestNpmVersion(pkg) {
-  try {
-    const res = await fetch(`https://registry.npmjs.org/${pkg}/latest`, {
-      signal: AbortSignal.timeout(1e4)
-    });
-    if (!res.ok) return null;
-    const data = await res.json();
-    return data.version ?? null;
-  } catch {
-    return null;
-  }
+function managedRunnerWasBlocked(value) {
+  return "kind" in value;
 }
-function resolvePlaywrightUpdateCheck(input) {
-  if (input.enabled !== true) return null;
-  if (input.cli.status === "current") {
+function runPiPackageManagedOperation(input, deps) {
+  if (input.engramBin === null && input.operation !== "uninstall") {
     return {
-      level: "success",
-      message: `Playwright CLI: ${PLAYWRIGHT_CLI.version} \u2014 al d\xEDa con el pin aprobado.`
+      kind: "blocked",
+      reason: "engram-missing",
+      remedy: "Instala Engram o configura un ENGRAM_BIN absoluto antes de reintentar."
     };
   }
-  const local = input.cli.detectedVersion ?? (input.cli.status === "absent" ? "no instalado" : "no verificable");
-  return {
-    level: "warn",
-    message: `Playwright CLI: ${local} local, pin aprobado ${PLAYWRIGHT_CLI.version} \u2192 ejecuta 'jorgex-stack update' o 'jorgex-stack install --playwright'.`
-  };
-}
-async function runUpdateCheck(localVersion, includeBrowserState = true) {
-  p4.intro("jorgex-stack update --check");
-  if (includeBrowserState) {
-    const preferenceErrors = browserPreferenceErrors();
-    if (preferenceErrors.length > 0) {
-      for (const error of preferenceErrors) p4.log.error(error);
-      p4.outro("Check cancelado: corrige las preferencias de navegador antes de reintentar.");
-      return 1;
+  if (input.operation === "uninstall" && input.receiptJson === null) {
+    const sources = parsePackageSources(input.detected.settingsJson);
+    if (sources === null) return { kind: "blocked", reason: "settings-corrupt" };
+    if (!sources.some(({ source }) => isJorgeXPiSource(source))) {
+      return deps.isPackageAbsent() ? { kind: "uninstalled" } : { kind: "blocked", reason: "absence-unverified" };
     }
   }
-  const upstreams = loadUpstreams();
-  const npmLatest = await latestNpmVersion("jorgex-stack");
-  if (npmLatest === null)
-    p4.log.info(`jorgex-stack: v${localVersion} local (a\xFAn no publicado en npm o sin red).`);
-  else if (npmLatest === localVersion)
-    p4.log.success(`jorgex-stack: v${localVersion} \u2014 al d\xEDa.`);
-  else
-    p4.log.warn(
-      `jorgex-stack: v${localVersion} local, v${npmLatest} en npm \u2192 pnpm dlx jorgex-stack@latest`
-    );
-  const engramRepo = upstreams.tools["engram"]?.source.replace(/^github:/, "");
-  if (engramRepo) {
-    const bin = detectEngram();
-    const local = bin ? engramVersion(bin) : null;
-    const latest = await latestGithubRelease(engramRepo);
-    if (local === null) p4.log.warn("engram: no detectado en esta m\xE1quina.");
-    else if (latest === null)
-      p4.log.info(`engram: ${local} local (no se pudo consultar el upstream).`);
-    else if (latest === local) p4.log.success(`engram: ${local} \u2014 al d\xEDa.`);
-    else
-      p4.log.warn(
-        `engram: ${local} local, ${latest} disponible. Tu instalaci\xF3n NO se toca (D7) \u2014 actualiza t\xFA: github.com/${engramRepo}/releases`
-      );
+  const owned = validateOwnedOperationState(input);
+  if (operationWasBlocked(owned)) return owned;
+  if (input.operation === "doctor") {
+    if (!sameRecord(owned.receipt.candidate, {
+      package: input.registry.candidate.package,
+      tarball: input.registry.candidate.tarball,
+      provenance: input.registry.candidate.provenance
+    })) {
+      return { kind: "blocked", reason: "source-divergent" };
+    }
+    const doctor = runManagedRunner(input, deps, "doctor");
+    if (managedRunnerWasBlocked(doctor)) return doctor;
+    const result = doctor.result;
+    return result !== null && typeof result === "object" && Reflect.get(result, "healthy") === true ? { kind: "healthy" } : { kind: "blocked", reason: "runner-unhealthy" };
   }
-  if (includeBrowserState && loadPlaywrightCliPreference() === true) {
-    const playwright = resolvePlaywrightUpdateCheck({
-      enabled: true,
-      cli: detectPlaywrightCli()
+  if (input.operation === "uninstall") {
+    if (!sameRecord(owned.receipt.candidate, {
+      package: input.registry.candidate.package,
+      tarball: input.registry.candidate.tarball,
+      provenance: input.registry.candidate.provenance
+    })) {
+      return { kind: "blocked", reason: "source-divergent" };
+    }
+    const cleanup = runManagedRunner(input, deps, "cleanup");
+    if (managedRunnerWasBlocked(cleanup)) return cleanup;
+    deps.backupSettings();
+    const removed = deps.run({
+      executable: input.detected.executable,
+      args: ["remove", owned.source, "--no-approve"],
+      environment: input.paths.environment
     });
-    if (playwright) p4.log[playwright.level](playwright.message);
+    if (removed.exitCode !== 0 || removed.stderr !== "") return { kind: "blocked", reason: "remove-failed" };
+    if (!deps.isPackageAbsent()) return { kind: "blocked", reason: "absence-unverified" };
+    deps.deleteReceipt();
+    return { kind: "uninstalled" };
   }
-  const checkSkillNames = skillsToScan(isGitClone(), upstreams);
-  if (checkSkillNames.length === 0) {
-    p4.log.info(
-      "Skills de terceros: pineadas con la versi\xF3n del stack (su revisi\xF3n upstream se hace desde el clon del repo)."
-    );
-  } else {
-    const skillQueries = await querySkillHeads(checkSkillNames, upstreams);
-    let moved = 0;
-    for (const { name, repo, info, head } of skillQueries) {
-      const label = info.modified ? `${name} (modificada localmente)` : name;
-      const pinned = info.commit;
-      if (!pinned)
-        p4.log.warn(`${label}: sin pin en upstreams.json \u2014 a\xF1ade el commit revisado.`);
-      else if (head === null)
-        p4.log.info(`${label}: pin ${pinned.slice(0, 7)} (no se pudo consultar el upstream).`);
-      else if (head === pinned)
-        p4.log.success(`${label}: al d\xEDa con el pin ${pinned.slice(0, 7)}.`);
-      else {
-        moved++;
-        p4.log.warn(
-          `${label}: el upstream se movi\xF3 (pin ${pinned.slice(0, 7)} \u2192 ${head.slice(0, 7)}).
-  Revisa el diff y, si lo aceptas, actualiza la copia vendorizada y el pin: github.com/${repo}/compare/${pinned.slice(0, 7)}...${head.slice(0, 7)}`
-        );
-      }
-    }
-    if (moved === 0 && skillQueries.every(({ head }) => head !== null)) {
-      p4.log.info("Skills de terceros: ning\xFAn upstream se ha movido respecto a su pin.");
-    }
+  const nextSource = input.registry.candidate.package.source;
+  if (nextSource === owned.source) return { kind: "healthy" };
+  return {
+    kind: "blocked",
+    reason: "verified-update-required",
+    remedy: "A cross-version Pi update requires verified replacement and rollback tgz artifacts."
+  };
+}
+
+// src/lib/pi-projection-lifecycle.ts
+var preparedPiProjectionUninstalls = /* @__PURE__ */ new WeakMap();
+function projectionScope(scope) {
+  return {
+    ...scope,
+    settingsFile: path24.join(scope.codingAgentDir, "settings.json")
+  };
+}
+function isInside(root, file) {
+  const relative = path24.relative(path24.resolve(root), path24.resolve(file));
+  return relative === "" || relative !== ".." && !relative.startsWith(`..${path24.sep}`) && !path24.isAbsolute(relative);
+}
+function isManagedPath(scope, file) {
+  return isInside(scope.home, file) || isInside(scope.codingAgentDir, file);
+}
+function isAllowedPath(scope, file) {
+  return isManagedPath(scope, file) || path24.resolve(file) === path24.resolve(scope.receiptFile);
+}
+function projectedPiAdapter(scope) {
+  const paths = piAdapter.paths(scope.codingAgentDir);
+  return {
+    ...piAdapter,
+    paths: () => ({
+      ...paths,
+      skillsDir: path24.join(scope.home, ".agents", "skills")
+    })
+  };
+}
+function projectionPlan(input, scope) {
+  const ctx = {
+    stackDir: input.stackDir,
+    configDir: scope.codingAgentDir,
+    engramBin: input.engramBin,
+    models: DEFAULT_MODEL_MAP.codex,
+    warnings: [],
+    playwrightCliEnabled: input.playwrightCliEnabled
+  };
+  const adapter = projectedPiAdapter(scope);
+  return [
+    ...planSystemPrompt(adapter, ctx),
+    ...planSkills(adapter, ctx),
+    ...planCommands(adapter, ctx)
+  ];
+}
+function canonicalActionContent(action) {
+  return action.kind === "write" ? action.content : fs16.readFileSync(action.source, "utf8");
+}
+function hasActionDrift(action, deps) {
+  return deps.readText(action.target) !== canonicalActionContent(action);
+}
+function applyActions(actions, deps) {
+  for (const action of actions) {
+    if (action.kind === "write") deps.writeText(action.target, action.content);
+    else deps.copyFile(action.source, action.target);
   }
-  if (githubRateLimited()) {
-    p4.log.warn(rateLimitHint("GitHub limit\xF3 algunas consultas (rate limit sin token)."));
+}
+function assertPlanContained(plan, scope) {
+  for (const action of plan) {
+    if (!isAllowedPath(scope, action.target)) {
+      throw new Error(`La proyecci\xF3n de Pi intent\xF3 escribir fuera del scope permitido: ${action.target}`);
+    }
   }
-  p4.outro("Check completado.");
-  return 0;
 }
-function isEngramRunning() {
+function receiptFor(plan, scope) {
+  const systemPrompt = path24.join(scope.codingAgentDir, "AGENTS.md");
+  const owned = [...new Set(
+    plan.map((action) => path24.resolve(action.target)).filter((target) => target !== systemPrompt)
+  )];
+  return {
+    schemaVersion: 1,
+    scope: {
+      kind: scope.kind,
+      home: scope.home,
+      codingAgentDir: scope.codingAgentDir,
+      receiptFile: scope.receiptFile
+    },
+    owned
+  };
+}
+function receiptContent(receipt) {
+  return `${JSON.stringify(receipt, null, 2)}
+`;
+}
+function hasExactKeys(record, expected) {
+  const keys = Object.keys(record);
+  return keys.length === expected.length && expected.every((key) => keys.includes(key));
+}
+function parseReceipt2(raw, expected) {
+  if (raw === null) return null;
   try {
-    if (process.platform === "win32") {
-      const ps = lookPath("powershell") ?? lookPath("pwsh");
-      if (ps) {
-        const out = runDetectedBin(ps, ["-NoProfile", "-Command", "Get-Process -Name engram -ErrorAction SilentlyContinue | Measure-Object | Select-Object -ExpandProperty Count"], 5e3);
-        return out !== null ? parseInt(out.trim(), 10) > 0 : null;
-      }
+    const receipt = JSON.parse(raw);
+    if (receipt === null || typeof receipt !== "object" || Array.isArray(receipt)) return null;
+    const version = Reflect.get(receipt, "schemaVersion");
+    const receivedScope = Reflect.get(receipt, "scope");
+    const owned = Reflect.get(receipt, "owned");
+    if (version !== expected.schemaVersion || !hasExactKeys(receipt, ["schemaVersion", "scope", "owned"]) || receivedScope === null || typeof receivedScope !== "object" || Array.isArray(receivedScope) || !hasExactKeys(receivedScope, ["kind", "home", "codingAgentDir", "receiptFile"])) {
+      return null;
+    }
+    if (Reflect.get(receivedScope, "kind") !== expected.scope.kind || Reflect.get(receivedScope, "home") !== expected.scope.home || Reflect.get(receivedScope, "codingAgentDir") !== expected.scope.codingAgentDir || Reflect.get(receivedScope, "receiptFile") !== expected.scope.receiptFile || !Array.isArray(owned) || owned.length !== expected.owned.length) {
+      return null;
+    }
+    if (!owned.every((file, index) => typeof file === "string" && file === expected.owned[index])) {
       return null;
-    } else {
-      const pgrep = lookPath("pgrep");
-      if (!pgrep) return null;
-      try {
-        execFileSync5(pgrep, ["-x", "engram"], { stdio: "ignore" });
-        return true;
-      } catch {
-        return false;
-      }
     }
+    return expected;
   } catch {
     return null;
   }
 }
-function isGitClone(projectRoot = path26.dirname(stackRoot())) {
-  return fs20.existsSync(path26.join(projectRoot, ".git"));
+function expectedProjectionReceipt(input, scope) {
+  const plan = projectionPlan(input, scope);
+  assertPlanContained(plan, scope);
+  return receiptFor(plan, scope);
 }
-var STACK_METHOD_CLONE = "git pull + pnpm install + pnpm build";
-function resolvePnpm() {
-  const bin = lookPath("pnpm") ?? lookPath("pnpm.cmd") ?? lookPath("pnpm.ps1");
-  if (!bin) throw new Error("pnpm no encontrado en PATH.");
-  return bin;
+function realPiProjectionScope() {
+  return {
+    kind: "real",
+    home: HOME,
+    codingAgentDir: process.env.PI_CODING_AGENT_DIR ?? path24.join(HOME, ".pi", "agent"),
+    receiptFile: path24.join(dataDir(), "pi-projection-receipt.json")
+  };
 }
-function cleanupTmp(dir) {
+function readTextOnlyIfMissing(file) {
   try {
-    fs20.rmSync(dir, { recursive: true, force: true });
-  } catch {
+    return fs16.readFileSync(file, "utf8");
+  } catch (error) {
+    if (typeof error === "object" && error !== null && Reflect.get(error, "code") === "ENOENT") return null;
+    throw error;
   }
 }
-function updateStackGitClone() {
-  const projectRoot = path26.dirname(stackRoot());
-  const git = lookPath("git");
-  if (!git) throw new Error("git no encontrado en PATH.");
-  const pnpm = resolvePnpm();
-  p4.log.info("Ejecutando git pull\u2026");
-  execFileSync5(git, ["pull"], { cwd: projectRoot, stdio: "inherit" });
-  p4.log.info("Ejecutando pnpm install\u2026");
-  execFileSync5(pnpm, ["install"], { cwd: projectRoot, stdio: "inherit" });
-  p4.log.info("Ejecutando pnpm build\u2026");
-  execFileSync5(pnpm, ["build"], { cwd: projectRoot, stdio: "inherit" });
+function readRealPiProjectionOwned() {
+  const scope = projectionScope(realPiProjectionScope());
+  const expected = expectedProjectionReceipt({
+    operation: "doctor",
+    scope,
+    packageSource: "",
+    stackDir: stackRoot(),
+    engramBin: "",
+    playwrightCliEnabled: false
+  }, scope);
+  let receiptContent2;
+  try {
+    receiptContent2 = readTextOnlyIfMissing(scope.receiptFile);
+  } catch (error) {
+    const code = error instanceof Error && "code" in error && typeof error.code === "string" ? error.code : "UNKNOWN";
+    return { kind: "unreadable", file: scope.receiptFile, code };
+  }
+  if (receiptContent2 === null) {
+    return { kind: "absent" };
+  }
+  const receipt = parseReceipt2(receiptContent2, expected);
+  return receipt === null ? { kind: "corrupt", file: scope.receiptFile } : { kind: "valid", owned: receipt.owned };
 }
-function updateStackGlobal() {
-  const pnpm = resolvePnpm();
-  p4.log.info("Ejecutando pnpm add -g jorgex-stack@latest\u2026");
-  execFileSync5(pnpm, ["add", "-g", "jorgex-stack@latest"], { stdio: "inherit" });
+function manifestOwned(manifest) {
+  return new Set([
+    ...manifest.runtimes.codex?.owned ?? [],
+    ...manifest.runtimes.opencode?.owned ?? []
+  ].map((file) => path24.resolve(file)));
 }
-async function downloadSkillToTemp(repo, sha, skillPath) {
-  const root = fs20.mkdtempSync(path26.join(os4.tmpdir(), "jorgex-skill-"));
+function withoutManagedPromptSections(content) {
+  return ["system-prompt", "engram-protocol", "browser"].reduce((current, section) => removeMarkdownSection(current, section), content);
+}
+function uniquePaths(paths) {
+  return [...new Set(paths.map((file) => path24.resolve(file)))];
+}
+function blocked2(reason, paths, remedy) {
+  return { kind: "blocked", reason, paths: uniquePaths(paths), remedy };
+}
+function backupExisting(paths, deps) {
+  const candidates = uniquePaths(paths);
+  let existing;
   try {
-    const result = await downloadRepoTarball(repo, sha, root, skillPath);
-    if (!result.ok) {
-      cleanupTmp(root);
-      return { error: result.reason };
-    }
-    if (skillPath) {
-      const sub = path26.resolve(path26.join(root, skillPath));
-      if (!isContainedIn(sub, root)) {
-        cleanupTmp(root);
-        return { error: `la ruta "${skillPath}" escapa del directorio temporal` };
-      }
-      if (fs20.existsSync(sub)) return { dir: sub, root };
-      const lastSeg = skillPath.split("/").pop();
-      const sub2 = path26.resolve(path26.join(root, lastSeg));
-      if (isContainedIn(sub2, root) && fs20.existsSync(sub2)) {
-        if (!validateExtractedTree(sub2)) {
-          cleanupTmp(root);
-          return { error: `el sub\xE1rbol "${lastSeg}" contiene symlinks o rutas fuera del destino` };
-        }
-        return { dir: sub2, root };
-      }
-      cleanupTmp(root);
-      return { error: `la ruta "${skillPath}" no existe en el tarball del upstream` };
-    }
-    return { dir: root, root };
-  } catch (err) {
-    cleanupTmp(root);
-    return { error: err instanceof Error ? err.message : "error desconocido" };
+    existing = candidates.filter((file) => deps.readText(file) !== null);
+  } catch {
+    return { kind: "backup-failed", paths: candidates };
+  }
+  if (existing.length === 0) return { kind: "backed-up" };
+  try {
+    deps.backup(existing);
+    return { kind: "backed-up" };
+  } catch {
+    return { kind: "backup-failed", paths: existing };
   }
 }
-function pruneEngramDbBackups() {
+function backupFailure(paths) {
+  return blocked2(
+    "projection-backup-failed",
+    paths,
+    "Revisa permisos y espacio disponible para crear las copias de seguridad indicadas antes de reintentar."
+  );
+}
+function cleanupFailure(paths) {
+  return blocked2(
+    "projection-cleanup-failed",
+    paths,
+    "Revisa permisos, cierra procesos que usen estas rutas y vuelve a ejecutar la desinstalaci\xF3n."
+  );
+}
+function receiptInvalid(receiptFile) {
+  return blocked2(
+    "projection-receipt-invalid",
+    [receiptFile],
+    "Restaura un receipt de proyecci\xF3n \xEDntegro o elimina manualmente solo los archivos gestionados tras verificar su propiedad."
+  );
+}
+function receiptUnreadable(receiptFile) {
+  return blocked2(
+    "projection-receipt-unreadable",
+    [receiptFile],
+    "Revisa los permisos o el estado de E/S del receipt de proyecci\xF3n y vuelve a intentarlo."
+  );
+}
+function writeFailure(file) {
+  return blocked2(
+    "projection-write-failed",
+    [file],
+    "Revisa los permisos de escritura de esta ruta y vuelve a ejecutar la desinstalaci\xF3n."
+  );
+}
+function readProjectionReceipt(receiptFile, deps) {
   try {
-    const dir = dataDir();
-    if (!fs20.existsSync(dir)) return;
-    const backups = fs20.readdirSync(dir).filter((f) => f.startsWith("engram-db-backup-") && f.endsWith(".db")).map((f) => ({ name: f, mtime: fs20.statSync(path26.join(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
-    for (const old of backups.slice(3)) {
-      try {
-        fs20.rmSync(path26.join(dir, old.name));
-      } catch {
-      }
+    const content = deps.readText(receiptFile);
+    return content === null ? { kind: "absent" } : { kind: "present", content };
+  } catch (error) {
+    if (typeof error === "object" && error !== null && Reflect.get(error, "code") === "ENOENT") {
+      return { kind: "absent" };
     }
-  } catch {
+    return { kind: "unreadable" };
   }
 }
-function rotateLockedBinary(binPath, sweepRoot = HOME) {
-  if (!fs20.existsSync(binPath)) return null;
-  const dir = path26.dirname(binPath);
-  const base = path26.basename(binPath);
-  const escapedBase = base.replace(/[.*+?^$()|[\]{}\\]/g, "\\$&");
-  const oldPattern = new RegExp("^" + escapedBase + "\\.old-\\d+$");
-  const resolvedDir = path26.resolve(dir);
-  if (resolvedDir === path26.resolve(sweepRoot) || isContainedIn(resolvedDir, sweepRoot)) {
+function preparePiProjectionUninstall(input, deps) {
+  if (input.operation !== "uninstall") {
+    return cleanupFailure([]);
+  }
+  const scope = projectionScope(input.scope);
+  const expectedReceipt2 = expectedProjectionReceipt(input, scope);
+  const prompt = path24.join(scope.codingAgentDir, "AGENTS.md");
+  let existingPrompt;
+  try {
+    existingPrompt = deps.readText(prompt);
+  } catch {
+    return cleanupFailure([prompt]);
+  }
+  const promptContent = existingPrompt === null ? null : withoutManagedPromptSections(existingPrompt);
+  const promptUpdate = promptContent === null || promptContent === existingPrompt ? null : { file: path24.resolve(prompt), content: promptContent };
+  const receiptRead = readProjectionReceipt(scope.receiptFile, deps);
+  if (receiptRead.kind === "unreadable") return receiptUnreadable(scope.receiptFile);
+  let ownedToRemove = [];
+  let receiptFile = null;
+  let backupTargets = promptUpdate === null ? [] : [promptUpdate.file];
+  if (receiptRead.kind === "present") {
+    const receipt = parseReceipt2(receiptRead.content, expectedReceipt2);
+    if (receipt === null) return receiptInvalid(scope.receiptFile);
+    let retained;
     try {
-      for (const entry of fs20.readdirSync(dir)) {
-        if (oldPattern.test(entry)) {
-          try {
-            fs20.rmSync(path26.join(dir, entry), { force: true });
-          } catch {
-          }
-        }
-      }
+      retained = manifestOwned(deps.readManifest());
     } catch {
-    }
-  }
-  const rotated = path26.join(dir, `${base}.old-${Date.now()}`);
-  fs20.renameSync(binPath, rotated);
-  return rotated;
+      return cleanupFailure([scope.receiptFile]);
+    }
+    ownedToRemove = receipt.owned.filter((owned) => !retained.has(owned));
+    receiptFile = path24.resolve(scope.receiptFile);
+    backupTargets = [...backupTargets, ...receipt.owned, receiptFile];
+  }
+  const backup = backupExisting(backupTargets, deps);
+  if (backup.kind === "backup-failed") return backupFailure(backup.paths);
+  const token = {};
+  preparedPiProjectionUninstalls.set(token, {
+    prompt: promptUpdate,
+    ownedToRemove,
+    receiptFile
+  });
+  return { kind: "prepared", plan: token };
 }
-async function updateEngram(engramRepo, latestVersion) {
-  if (isEngramRunning()) {
-    p4.log.info(
-      "Engram est\xE1 en ejecuci\xF3n: los procesos vivos seguir\xE1n usando la versi\xF3n antigua hasta que reinicies los clientes (Claude Code/OpenCode/Codex)."
-    );
+function completePiProjectionUninstall(plan, deps) {
+  if (typeof plan !== "object" || plan === null) {
+    return cleanupFailure([]);
   }
-  const engramDataDir = process.env.ENGRAM_DATA_DIR ?? path26.join(HOME, ".engram");
-  const engramDb = path26.join(engramDataDir, "engram.db");
-  if (fs20.existsSync(engramDb)) {
-    const doBackup = await p4.confirm({
-      message: `\xBFHacer backup de la DB de Engram antes de actualizar? (${engramDb})`,
-      initialValue: true
-    });
-    if (!p4.isCancel(doBackup) && doBackup) {
-      const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-      const dest = path26.join(dataDir(), `engram-db-backup-${ts}.db`);
-      try {
-        if (!fs20.existsSync(dataDir())) fs20.mkdirSync(dataDir(), { recursive: true });
-        fs20.copyFileSync(engramDb, dest);
-        p4.log.success(`DB respaldada en ${dest} (la DB original NO se modifica jam\xE1s).`);
-        pruneEngramDbBackups();
-      } catch (err) {
-        p4.log.warn(`No se pudo copiar la DB: ${err instanceof Error ? err.message : err}. Continuando sin backup.`);
-      }
-    }
+  const prepared = preparedPiProjectionUninstalls.get(plan);
+  if (prepared === void 0) {
+    return cleanupFailure([]);
   }
-  let anyChannelTried = false;
-  const brew = lookPath("brew");
-  if (brew) {
-    let brewManages = false;
+  if (prepared.prompt !== null) {
     try {
-      execFileSync5(brew, ["list", "engram"], { stdio: "pipe" });
-      brewManages = true;
+      deps.writeText(prepared.prompt.file, prepared.prompt.content);
     } catch {
-    }
-    if (brewManages) {
-      anyChannelTried = true;
-      p4.log.info("Actualizando engram con brew\u2026");
-      try {
-        execFileSync5(brew, ["upgrade", "engram"], { stdio: "inherit" });
-        return true;
-      } catch (err) {
-        p4.log.error(`brew upgrade engram fall\xF3: ${err instanceof Error ? err.message : err}`);
-        return false;
-      }
+      return writeFailure(prepared.prompt.file);
     }
   }
-  const go = lookPath("go");
-  if (go) {
-    anyChannelTried = true;
-    let rotated = null;
-    const bin = detectEngram();
-    if (process.platform === "win32" && bin) {
-      try {
-        rotated = rotateLockedBinary(bin);
-      } catch (err) {
-        p4.log.warn(
-          `No se pudo rotar el binario en uso: ${err instanceof Error ? err.message : err}. go install puede fallar por bloqueo.`
-        );
-      }
-    }
-    p4.log.info(`Actualizando engram con go install (${latestVersion})\u2026`);
+  for (const owned of prepared.ownedToRemove) {
     try {
-      execFileSync5(
-        go,
-        ["install", `github.com/Gentleman-Programming/engram/cmd/engram@v${latestVersion}`],
-        { stdio: "inherit" }
-      );
-      const rollbackOk = resolveEngramRollback({ installOk: true, rotated, bin, binExists: fs20.existsSync(bin ?? "") });
-      if (rollbackOk.action === "restore") {
-        try {
-          fs20.renameSync(rotated, bin);
-          p4.log.warn(rollbackOk.messages.onRestore);
-        } catch {
-          p4.log.warn(rollbackOk.messages.onRenameFail);
-        }
-      }
-      return true;
-    } catch (err) {
-      const rollbackFail = resolveEngramRollback({ installOk: false, rotated, bin, binExists: fs20.existsSync(bin ?? "") });
-      if (rollbackFail.action === "restore") {
-        try {
-          fs20.renameSync(rotated, bin);
-          p4.log.info(rollbackFail.messages.onRestore);
-        } catch {
-          p4.log.error(rollbackFail.messages.onRenameFail);
-        }
-      } else if (rollbackFail.action === "leave_old") {
-        p4.log.warn(rollbackFail.messages.onLeaveOld);
-      }
-      p4.log.error(`go install fall\xF3: ${err instanceof Error ? err.message : err}`);
-      return false;
+      deps.removeFile(owned);
+    } catch {
+      return cleanupFailure([owned]);
     }
   }
-  if (anyChannelTried) {
-    p4.log.error(
-      `Los canales de actualizaci\xF3n disponibles fallaron \u2014 revisa el error arriba; descarga manual: github.com/${engramRepo}/releases/tag/v${latestVersion}`
-    );
-  } else {
-    p4.log.warn(
-      `No se encontr\xF3 brew ni go en PATH.
-  Descarga manual: github.com/${engramRepo}/releases/tag/v${latestVersion}`
-    );
+  if (prepared.receiptFile !== null) {
+    try {
+      deps.removeFile(prepared.receiptFile);
+    } catch {
+      return cleanupFailure([prepared.receiptFile]);
+    }
   }
-  return false;
+  return { kind: "uninstalled" };
 }
-function resolveEngramRollback(input) {
-  const { installOk, rotated, bin, binExists } = input;
-  if (!rotated || !bin) return { action: "none" };
-  if (installOk && !binExists) {
-    return {
-      action: "restore",
-      messages: {
-        onRestore: `go install instal\xF3 en otra ruta (GOBIN distinto); el binario activo en ${bin} se ha restaurado. Comprueba qu\xE9 engram resuelve tu PATH.`,
-        onRenameFail: `go install instal\xF3 en otra ruta y no se pudo restaurar ${bin}; tu binario anterior est\xE1 en ${rotated}.`
-      }
-    };
-  }
-  if (!installOk && !binExists) {
-    return {
-      action: "restore",
-      messages: {
-        onRestore: "Rotaci\xF3n revertida \u2014 el binario anterior sigue en su sitio.",
-        onRenameFail: `No se pudo revertir la rotaci\xF3n: tu binario anterior est\xE1 en ${rotated} \u2014 ren\xF3mbralo a ${bin} a mano.`
-      }
-    };
-  }
-  if (!installOk && binExists) {
-    return {
-      action: "leave_old",
-      messages: {
-        onLeaveOld: `El install fall\xF3 pero dej\xF3 un binario en ${bin}; tu copia anterior queda en ${rotated}.`
-      }
-    };
+function runPiProjectionLifecycle(input, deps) {
+  const scope = projectionScope(input.scope);
+  if (input.operation === "uninstall") {
+    const prepared = preparePiProjectionUninstall(input, deps);
+    return prepared.kind === "blocked" ? prepared : completePiProjectionUninstall(prepared.plan, deps);
+  }
+  const plan = projectionPlan(input, scope);
+  assertPlanContained(plan, scope);
+  const receipt = receiptFor(plan, scope);
+  const expectedReceipt2 = receiptContent(receipt);
+  const drifted = plan.filter((action) => hasActionDrift(action, deps));
+  if (input.operation === "doctor") {
+    const paths = drifted.map((action) => path24.resolve(action.target));
+    const currentSettings2 = deps.readText(scope.settingsFile);
+    if (currentSettings2 === null || filterProjectedPiPackage(currentSettings2, input.packageSource) !== currentSettings2) {
+      paths.push(scope.settingsFile);
+    }
+    if (deps.readText(scope.receiptFile) !== expectedReceipt2) paths.push(scope.receiptFile);
+    const unique = uniquePaths(paths);
+    return unique.length === 0 ? { kind: "healthy" } : { kind: "drift", paths: unique };
+  }
+  const currentSettings = deps.readText(scope.settingsFile);
+  const filteredSettings = currentSettings === null ? null : filterProjectedPiPackage(currentSettings, input.packageSource);
+  if (currentSettings !== null && filteredSettings === null) {
+    return { kind: "blocked", reason: "source-divergent" };
   }
-  return { action: "none" };
+  const packageWillChange = filteredSettings !== null && filteredSettings !== currentSettings;
+  const receiptChanged = deps.readText(scope.receiptFile) !== expectedReceipt2;
+  if (drifted.length > 0 || packageWillChange || receiptChanged) {
+    const backup = backupExisting([
+      ...drifted.map((action) => action.target),
+      ...packageWillChange ? [scope.settingsFile] : [],
+      ...receiptChanged ? [scope.receiptFile] : []
+    ], deps);
+    if (backup.kind === "backup-failed") return backupFailure(backup.paths);
+  }
+  applyActions(drifted, deps);
+  if (packageWillChange && filteredSettings !== null) deps.writeText(scope.settingsFile, filteredSettings);
+  if (receiptChanged) deps.writeText(scope.receiptFile, expectedReceipt2);
+  if (input.operation === "install") return { kind: "installed", receipt };
+  return { kind: "synced", changed: drifted.length > 0 || packageWillChange || receiptChanged };
+}
+function systemProjectionLifecycle(input) {
+  const targetRoot = input.targetDir === void 0 ? null : path24.resolve(input.targetDir);
+  const scope = targetRoot === null ? realPiProjectionScope() : {
+    kind: "target-dir",
+    home: path24.join(targetRoot, "home"),
+    codingAgentDir: path24.join(targetRoot, "pi-agent"),
+    receiptFile: path24.join(targetRoot, "state", "pi-projection-receipt.json")
+  };
+  return {
+    input: {
+      operation: input.operation,
+      scope,
+      packageSource: input.packageSource,
+      stackDir: stackRoot(),
+      engramBin: input.engramBin ?? "",
+      playwrightCliEnabled: input.playwrightCliEnabled
+    },
+    deps: {
+      readText: readTextOnlyIfMissing,
+      backup: (paths) => createBackup(
+        paths,
+        `pi-projection-${input.operation}`,
+        targetRoot === null ? void 0 : path24.join(targetRoot, "backups")
+      ),
+      writeText,
+      copyFile,
+      removeFile: (file) => fs16.rmSync(file, { force: true }),
+      readManifest: targetRoot === null ? readManifest : () => ({ runtimes: {} })
+    }
+  };
 }
-function buildEligibleSkillUpdates(skills) {
-  const result = [];
-  for (const { name, repo, info, head } of skills) {
-    if (info.kind === "release") continue;
-    const pinned = info.commit;
-    if (!pinned) continue;
-    if (head === null) continue;
-    if (head === pinned) continue;
-    result.push({
-      name,
-      repo,
-      head,
-      pinned,
-      skillPath: info.path,
-      modified: info.modified ?? false
-    });
-  }
-  return result;
+function preparePiProjectionUninstallSystem(input) {
+  const lifecycle = systemProjectionLifecycle(input);
+  return preparePiProjectionUninstall(lifecycle.input, lifecycle.deps);
 }
-function hasIncompleteSkillScan(skills) {
-  return skills.some(({ info, head }) => info.kind !== "release" && (!info.commit || head === null));
+function completePiProjectionUninstallSystem(plan, input) {
+  const lifecycle = systemProjectionLifecycle(input);
+  return completePiProjectionUninstall(plan, lifecycle.deps);
 }
-function resolveUpdateSyncRequired(updated) {
-  return updated.some((item) => item === "stack" || item === "skill" || item.startsWith("skill:"));
+function runPiProjectionLifecycleSystem(input) {
+  const lifecycle = systemProjectionLifecycle(input);
+  return runPiProjectionLifecycle(lifecycle.input, lifecycle.deps);
 }
-async function runInteractiveUpdate(localVersion, yes, dryRun = false, includeBrowserState = true) {
-  if (dryRun || yes || !process.stdout.isTTY) {
-    return { exitCode: await runUpdateCheck(localVersion, includeBrowserState), appliedUpdates: false, syncRequired: false };
+
+// src/uninstall.ts
+function resolvePlaywrightUninstallPlan(input) {
+  return {
+    actions: input.removePackage ? ["remove"] : [],
+    preserveBrowserData: true
+  };
+}
+async function runUninstall(opts) {
+  p2.intro(`jorgex-stack ${opts.dryRun ? "uninstall (dry-run)" : "uninstall"}`);
+  const useBrowserPreferences = opts.targetDir === void 0;
+  const preferenceErrors = useBrowserPreferences ? [...browserPreferenceErrors(), primaryModelOwnershipError()].filter((error) => error !== null) : [];
+  if (preferenceErrors.length > 0) {
+    for (const error of preferenceErrors) p2.log.error(error);
+    p2.outro("Uninstall cancelado: corrige el estado de configuraci\xF3n indicado arriba antes de reintentar.");
+    return 1;
   }
-  p4.intro("jorgex-stack update");
-  if (includeBrowserState) {
-    const preferenceErrors = browserPreferenceErrors();
-    if (preferenceErrors.length > 0) {
-      for (const error of preferenceErrors) p4.log.error(error);
-      p4.outro("Update cancelado: corrige las preferencias de navegador antes de reintentar.");
-      return { exitCode: 1, appliedUpdates: false, syncRequired: false };
-    }
+  const removesSharedSkills = opts.runtimes.some((runtime) => runtime === "codex" || runtime === "opencode");
+  const piProjection = useBrowserPreferences && removesSharedSkills ? readRealPiProjectionOwned() : { kind: "absent" };
+  if (piProjection.kind === "corrupt") {
+    p2.log.error(`Pi: receipt de proyecci\xF3n inv\xE1lido en ${piProjection.file}. Restaura o repara ese receipt antes de reintentar.`);
+    p2.outro("Uninstall cancelado: restaura o repara el receipt de proyecci\xF3n de Pi antes de reintentar.");
+    return 1;
   }
-  const upstreams = loadUpstreams();
+  if (piProjection.kind === "unreadable") {
+    p2.log.error(`Pi: receipt de proyecci\xF3n ilegible en ${piProjection.file} (${piProjection.code}). Revisa los permisos o el estado de E/S antes de reintentar.`);
+    p2.outro("Uninstall cancelado: revisa los permisos o el estado de E/S del receipt de proyecci\xF3n de Pi antes de reintentar.");
+    return 1;
+  }
+  const stackDir = stackRoot();
+  const mcp = loadCanonicalMcp(stackDir);
+  const hooks = loadCanonicalHooks(stackDir);
   let exitCode = 0;
-  let appliedUpdates = false;
-  const updated = [];
-  const maintainer = isGitClone();
-  const spin = p4.spinner();
-  spin.start("Consultando versiones upstream\u2026");
-  const skillNames = skillsToScan(maintainer, upstreams);
-  const [npmLatest, engramLatestRaw, skillHeads] = await Promise.all([
-    latestNpmVersion("jorgex-stack"),
-    (async () => {
-      const repo = upstreams.tools["engram"]?.source.replace(/^github:/, "");
-      if (!repo) return null;
-      return { repo, version: await latestGithubRelease(repo) };
-    })(),
-    querySkillHeads(skillNames, upstreams)
-  ]);
-  spin.stop("Consulta completada.");
-  if (githubRateLimited()) {
-    p4.log.warn(rateLimitHint("GitHub limit\xF3 algunas consultas \u2014 los upstreams 'sin conexi\xF3n' pueden ser eso."));
-  }
-  const updateItems = [];
-  const engramData = engramLatestRaw;
-  let stackNeedsUpdate = false;
-  if (npmLatest === null) {
-    p4.log.info(`jorgex-stack: v${localVersion} local (a\xFAn no publicado en npm o sin red).`);
-  } else if (npmLatest === localVersion) {
-    p4.log.success(`jorgex-stack: v${localVersion} \u2014 al d\xEDa.`);
-  } else {
-    stackNeedsUpdate = true;
-    const mode = maintainer ? STACK_METHOD_CLONE : `pnpm add -g jorgex-stack@${npmLatest}`;
-    updateItems.push({
-      value: "stack",
-      label: `jorgex-stack: v${localVersion} \u2192 v${npmLatest}`,
-      hint: mode
+  let removeEngram = opts.removeEngram;
+  if (!removeEngram && !opts.yes && !opts.dryRun && process.stdout.isTTY) {
+    const answer = await p2.confirm({
+      message: "\xBFQuitar tambi\xE9n el registro de Engram (MCP/plugin) de los runtimes? Tus memorias (~/.engram) y el binario NO se tocan en ning\xFAn caso.",
+      initialValue: false
     });
-  }
-  let engramNeedsUpdate = false;
-  let engramLocalVersion = null;
-  if (engramData) {
-    const engramBinLocal = detectEngram();
-    engramLocalVersion = engramBinLocal ? engramVersion(engramBinLocal) : null;
-    if (engramLocalVersion === null) {
-      p4.log.warn("engram: no detectado en esta m\xE1quina.");
-    } else if (engramData.version === null) {
-      p4.log.info(`engram: ${engramLocalVersion} local (no se pudo consultar el upstream).`);
-    } else if (engramData.version === engramLocalVersion) {
-      p4.log.success(`engram: ${engramLocalVersion} \u2014 al d\xEDa.`);
-    } else {
-      engramNeedsUpdate = true;
-      updateItems.push({
-        value: "engram",
-        label: `engram: ${engramLocalVersion} \u2192 ${engramData.version}`,
-        hint: "canal nativo (brew \u2192 go install \u2192 URL)"
-      });
+    if (p2.isCancel(answer)) {
+      p2.cancel("Cancelado \u2014 no se ha tocado nada.");
+      return 1;
     }
+    removeEngram = answer === true;
   }
-  let playwrightNeedsUpdate = false;
-  if (includeBrowserState && loadPlaywrightCliPreference() === true) {
-    const playwright = detectPlaywrightCli();
-    if (playwright.status === "current") {
-      p4.log.success("Playwright CLI: al d\xEDa.");
-    } else {
-      playwrightNeedsUpdate = true;
-      const current = playwright.detectedVersion ?? playwright.status;
-      updateItems.push({
-        value: "playwright-cli",
-        label: `Playwright CLI: ${current} \u2192 pin aprobado`,
-        hint: "pnpm add --global @playwright/cli@0.1.18"
-      });
+  const mcpForUnmerge = removeEngram ? mcp : { servers: Object.fromEntries(Object.entries(mcp.servers).filter(([name]) => name !== "engram")) };
+  if (!removeEngram) {
+    p2.log.info("Engram se conserva: memorias, binario y registro intactos (usa --remove-engram para desregistrarlo).");
+  }
+  const retained = /* @__PURE__ */ new Set();
+  if (useBrowserPreferences) {
+    if (piProjection.kind === "valid") {
+      for (const target of piProjection.owned) retained.add(target);
+    }
+    for (const keep of Object.values(ADAPTERS)) {
+      if (opts.runtimes.includes(keep.id)) continue;
+      const detection = keep.detect();
+      if (!detection.installed) continue;
+      const keepCtx = makeContext(keep, detection.configDir);
+      if (!keepCtx) continue;
+      for (const action of buildPlan(keep, keepCtx)) retained.add(path25.resolve(action.target));
     }
   }
-  const typedSkillHeads = skillHeads;
-  for (const { name, repo, info, head } of typedSkillHeads) {
-    if (info.kind === "release") {
-      if (head !== null && info.commit && head !== info.commit) {
-        p4.log.warn(`${name} (release): upstream se movi\xF3. Revisa: github.com/${repo}/releases`);
-      }
+  for (const id of opts.runtimes) {
+    const adapter = ADAPTERS[id];
+    if (!adapter) {
+      p2.log.warn(`${id}: sin adapter \u2014 omitido.`);
       continue;
     }
-    const label = info.modified ? `${name} (modificada localmente)` : name;
-    const pinned = info.commit;
-    if (!pinned) {
-      p4.log.warn(`${label}: sin pin \u2014 no se puede actualizar.`);
-    } else if (head === null) {
-      p4.log.info(`${label}: sin conexi\xF3n al upstream.`);
-    } else if (head === pinned) {
-      p4.log.success(`${label}: al d\xEDa (pin ${pinned.slice(0, 7)}).`);
+    const detection = adapter.detect();
+    const configDir = opts.targetDir ?? detection.configDir;
+    if (!detection.installed && opts.targetDir === void 0) {
+      p2.log.warn(`${adapter.name} no detectado \u2014 omitido.`);
+      continue;
     }
-  }
-  if (!maintainer) {
-    p4.log.info(
-      "Skills de terceros: pineadas con esta versi\xF3n del stack \u2014 su revisi\xF3n upstream se hace desde el clon del repo."
+    const ctx = makeContext(adapter, configDir, void 0, useBrowserPreferences);
+    if (!ctx) continue;
+    ctx.preserveEngram = !removeEngram;
+    const unmerge = adapter.planUnmerge(mcpForUnmerge, hooks, ctx);
+    const mergedTargets = new Set(unmerge.map((a) => path25.resolve(a.target)));
+    const usingRealConfig = opts.targetDir === void 0;
+    const prevOwned = usingRealConfig ? readManifest().runtimes[id]?.owned ?? [] : [];
+    const pruneRoot = usingRealConfig ? HOME : path25.dirname(configDir);
+    const planTargets = [
+      .../* @__PURE__ */ new Set([...buildPlan(adapter, ctx).map((a) => path25.resolve(a.target)), ...prevOwned.map((t) => path25.resolve(t))])
+    ].filter((t) => !mergedTargets.has(t) && fs17.existsSync(t));
+    const deleteTargets = planTargets.filter(
+      (t) => !retained.has(t) && !(ctx.preserveEngram && path25.basename(t) === "engram.ts") && isContainedIn(t, pruneRoot)
     );
-  }
-  const skillUpdates = buildEligibleSkillUpdates(typedSkillHeads);
-  for (const skillInfo of skillUpdates) {
-    const modifiedWarning = skillInfo.modified ? " \u26A0 modificada localmente" : "";
-    updateItems.push({
-      value: `skill:${skillInfo.name}`,
-      label: `skill ${skillInfo.name}: ${skillInfo.pinned.slice(0, 7)} \u2192 ${skillInfo.head.slice(0, 7)}${modifiedWarning}`,
-      hint: `github.com/${skillInfo.repo}/compare/${skillInfo.pinned.slice(0, 7)}...${skillInfo.head.slice(0, 7)}`
-    });
-  }
-  if (updateItems.length === 0) {
-    if (maintainer && hasIncompleteSkillScan(typedSkillHeads)) {
-      p4.outro("Escaneo incompleto: no se pudo comprobar el estado de todas las skills.");
-      return { exitCode: 1, appliedUpdates: false, syncRequired: false };
+    const sharedKept = planTargets.length - deleteTargets.length;
+    p2.log.step(`${adapter.name} \u2192 ${configDir}`);
+    p2.log.info(`${deleteTargets.length} archivos a borrar, ${unmerge.length} archivos compartidos a limpiar`);
+    if (sharedKept > 0) p2.log.info(`${sharedKept} archivos se conservan: otros runtimes instalados los siguen usando.`);
+    if (opts.dryRun) continue;
+    let backup;
+    try {
+      backup = createBackup(
+        [...deleteTargets, ...unmerge.map((a) => a.target).filter((t) => fs17.existsSync(t))],
+        `uninstall-${id}`
+      );
+    } catch (error) {
+      p2.log.error(`${adapter.name}: no se pudo respaldar una configuraci\xF3n ilegible en ${configDir} \u2014 ${error instanceof Error ? error.message : String(error)}.`);
+      exitCode = 1;
+      continue;
     }
-    p4.outro("Todo al d\xEDa. No hay actualizaciones disponibles.");
-    return { exitCode: 0, appliedUpdates: false, syncRequired: false };
+    if (backup) p2.log.info(`Backup: ${backup.id} (${backup.files.length} archivos)`);
+    for (const target of deleteTargets) {
+      fs17.rmSync(target, { force: true });
+      pruneEmptyDirs(target, pruneRoot);
+    }
+    for (const action of unmerge) {
+      if (action.kind !== "write") continue;
+      if (action.content.trim() === "") {
+        fs17.rmSync(action.target, { force: true });
+      } else {
+        writeText(action.target, action.content);
+      }
+      if (usingRealConfig) {
+        for (const change of action.mcpOwnership ?? []) {
+          saveDevtoolsMcpOwnership(devtoolsMcpPreferenceFile(), id, change.server, change.owned);
+        }
+        for (const change of action.primaryModelOwnership ?? []) {
+          savePrimaryModelOwnership(primaryModelOwnershipFile(), id, configDir, change.field, change.owned);
+        }
+      }
+    }
+    if (usingRealConfig) {
+      for (const field of ctx.ownedPrimaryModelFields ?? []) {
+        savePrimaryModelOwnership(primaryModelOwnershipFile(), id, configDir, field, false);
+      }
+    }
+    if (usingRealConfig) removeRuntimeManifest(id);
+    p2.log.success(`${adapter.name}: stack retirado (lo tuyo queda intacto).`);
   }
-  const selected = await p4.multiselect({
-    message: "Selecciona qu\xE9 actualizar (espacio para marcar, intro para confirmar):",
-    options: updateItems,
-    initialValues: updateItems.map((i) => i.value),
-    required: false
+  const playwrightPlan = resolvePlaywrightUninstallPlan({
+    removePackage: opts.targetDir === void 0 && opts.removePlaywright
   });
-  if (p4.isCancel(selected)) {
-    p4.outro("Update cancelado.");
-    return { exitCode: 0, appliedUpdates: false, syncRequired: false };
-  }
-  if (selected.length === 0) {
-    p4.outro("Nada seleccionado.");
-    return { exitCode: 0, appliedUpdates: false, syncRequired: false };
-  }
-  const sel = selected;
-  if (stackNeedsUpdate && sel.includes("stack")) {
-    const isClone = isGitClone();
-    const method = isClone ? STACK_METHOD_CLONE : "pnpm add -g jorgex-stack@latest";
-    const confirm5 = await p4.confirm({
-      message: `Actualizar el stack con: ${method}`,
-      initialValue: true
-    });
-    if (p4.isCancel(confirm5) || !confirm5) {
-      p4.log.info("Stack: actualizaci\xF3n omitida.");
+  if (opts.removePlaywright && opts.targetDir !== void 0) {
+    p2.log.info("Playwright CLI: --target-dir conserva el paquete global y los datos del navegador.");
+  } else if (playwrightPlan.actions.length > 0) {
+    if (opts.dryRun) {
+      p2.log.info("Playwright CLI: se retirar\xEDa solo el paquete global; los datos y navegadores se conservan.");
     } else {
-      try {
-        if (isClone) {
-          updateStackGitClone();
-        } else {
-          updateStackGlobal();
+      const removal = executePlaywrightToolAction2("remove");
+      if (removal.ok) {
+        try {
+          savePlaywrightCliPreference(playwrightCliPreferenceFile(), false);
+          p2.log.success("Playwright CLI: paquete global retirado; los datos y navegadores se conservan.");
+        } catch (error) {
+          p2.log.error(`Playwright CLI: paquete global retirado, pero no se pudo guardar la preferencia (${error instanceof Error ? error.message : String(error)}). Corrige la preferencia antes de reintentar.`);
+          exitCode = 1;
         }
-        p4.log.success("Stack actualizado correctamente.");
-        appliedUpdates = true;
-        updated.push("stack");
-      } catch (err) {
-        p4.log.error(`Stack: error al actualizar \u2014 ${err instanceof Error ? err.message : err}`);
+      } else {
+        const pnpmRemedy = resolvePnpmFailureRemedy(removal.reason);
+        const recovery = pnpmRemedy === null ? " Revisa el error de pnpm anterior y ejecuta 'jorgex-stack uninstall --remove-playwright' para reintentar." : ` ${pnpmRemedy} Despu\xE9s, ejecuta 'jorgex-stack uninstall --remove-playwright' para reintentar.`;
+        p2.log.error(`Playwright CLI: no se pudo retirar el paquete global; los datos y la preferencia se conservan.${recovery}`);
         exitCode = 1;
       }
     }
+  } else {
+    p2.log.info("Playwright CLI: paquete global y datos del navegador conservados (usa --remove-playwright para retirar solo el paquete).");
   }
-  for (const skillInfo of skillUpdates) {
-    if (!sel.includes(`skill:${skillInfo.name}`)) continue;
-    if (skillInfo.modified) {
-      p4.log.warn(
-        `skill ${skillInfo.name}: TIENE CAMBIOS LOCALES. Actualizar sobreescribir\xE1 esas modificaciones (backup autom\xE1tico).`
-      );
-      const forceConfirm = await p4.confirm({
-        message: `\xBFConfirmas sobreescribir los cambios locales de ${skillInfo.name}?`,
-        initialValue: false
-      });
-      if (p4.isCancel(forceConfirm) || !forceConfirm) {
-        p4.log.info(`skill ${skillInfo.name}: omitida.`);
-        continue;
-      }
-    }
-    const spin2 = p4.spinner();
-    spin2.start(`Descargando upstream de ${skillInfo.name}\u2026`);
-    const tmpResult = await downloadSkillToTemp(skillInfo.repo, skillInfo.head, skillInfo.skillPath);
-    spin2.stop("error" in tmpResult ? "Error de descarga." : "Descargado.");
-    if ("error" in tmpResult) {
-      p4.log.error(`skill ${skillInfo.name}: descarga fallida \u2014 ${tmpResult.error}. Omitiendo.`);
-      exitCode = 1;
-      continue;
-    }
-    const { dir: tmpDir, root: tmpRoot } = tmpResult;
-    const localSkillDir = path26.join(stackRoot(), "skills", skillInfo.name);
-    const diff = renderSkillDiff(tmpDir, localSkillDir);
-    if (diff) {
-      p4.log.info(`Diff de ${skillInfo.name}:
-${diff}`);
+  p2.outro(opts.dryRun ? "Dry-run: no se ha tocado nada." : exitCode === 0 ? "Hecho. Usa 'restore' si quieres volver atr\xE1s." : "Uninstall completado con errores (revisa arriba).");
+  return exitCode;
+}
+
+// src/doctor.ts
+import path26 from "path";
+import fs18 from "fs";
+import * as p3 from "@clack/prompts";
+function engramVersion(bin) {
+  const out = runDetectedBin(bin, ["--version"], 5e3);
+  if (out === null) return null;
+  return /(\d+\.\d+\.\d+)/.exec(out)?.[1] ?? out.trim().split("\n")[0] ?? null;
+}
+function resolvePlaywrightDoctorState(input) {
+  if (input.enabled !== true) return { status: "disabled" };
+  if (input.cli.status === "absent") return { status: "missing", missing: "package" };
+  if (input.cli.status === "broken") return { status: "broken" };
+  if (input.cli.status === "outdated") return { status: "outdated" };
+  if (input.browserCache?.status === "unreadable") {
+    return { status: "unreadable", path: input.browserCache.path, errorCode: input.browserCache.errorCode };
+  }
+  if (!input.browserReady) return { status: "missing", missing: "browser" };
+  return { status: "healthy" };
+}
+function context7KeyConfigured(id, configDir) {
+  const file = id === "codex" ? path26.join(configDir, "config.toml") : id === "claude-code" ? path26.join(path26.dirname(configDir), `${path26.basename(configDir)}.json`) : path26.join(configDir, "opencode.json");
+  const content = readTextIfExists(file);
+  if (content === null) return null;
+  const match = /CONTEXT7_API_KEY"?\s*[:=]\s*"([^"]*)"/.exec(content);
+  if (!match) return null;
+  return match[1] !== "";
+}
+async function runDoctor() {
+  p3.intro("jorgex-stack doctor");
+  let problems = 0;
+  const engramBin = detectEngram();
+  if (engramBin === null) {
+    p3.log.warn("Engram: NO detectado. El protocolo de memoria no funcionar\xE1 \u2014 inst\xE1lalo: github.com/Gentleman-Programming/engram");
+    problems++;
+  } else {
+    const version = engramVersion(engramBin);
+    if (version === null) {
+      p3.log.error(`Engram: binario en ${engramBin} pero no responde a --version.`);
+      problems++;
     } else {
-      p4.log.info(`${skillInfo.name}: sin cambios en contenido (el repo se movi\xF3 pero la skill no cambi\xF3).`);
-      cleanupTmp(tmpRoot);
-      continue;
+      p3.log.success(`Engram: ${version} (${engramBin})`);
     }
-    const applySkill = await p4.confirm({
-      message: `\xBFAplicar la actualizaci\xF3n de ${skillInfo.name}?`,
-      // Default No — política deliberate-pin (el diff es de contenido)
-      initialValue: false
+  }
+  const engramDataDir = process.env.ENGRAM_DATA_DIR ?? path26.join(HOME, ".engram");
+  const engramDb = path26.join(engramDataDir, "engram.db");
+  if (fs18.existsSync(engramDb)) {
+    const sizeMb = (fs18.statSync(engramDb).size / 1024 / 1024).toFixed(1);
+    p3.log.info(`Engram DB: ${engramDb} (${sizeMb} MB de memorias \u2014 el stack no la toca JAM\xC1S).`);
+  }
+  if (!fs18.existsSync(modelMapFile())) p3.log.info("model-map: a\xFAn no creado (se crea en el primer install o con 'models').");
+  const preferenceErrors = browserPreferenceErrors();
+  const primaryOwnershipError = primaryModelOwnershipError();
+  if (primaryOwnershipError !== null) {
+    p3.log.error(primaryOwnershipError);
+    problems++;
+  }
+  if (preferenceErrors.length > 0) {
+    for (const error of preferenceErrors) p3.log.error(error);
+    problems += preferenceErrors.length;
+  } else {
+    const browserCache = isPlaywrightBrowserReady();
+    const playwright = resolvePlaywrightDoctorState({
+      enabled: loadPlaywrightCliPreference(),
+      cli: detectPlaywrightCli(),
+      browserReady: browserCache.status === "ready",
+      browserCache
     });
-    if (p4.isCancel(applySkill) || !applySkill) {
-      p4.log.info(`skill ${skillInfo.name}: omitida.`);
-      cleanupTmp(tmpRoot);
+    if (playwright.status === "disabled") {
+      p3.log.info("Playwright CLI: deshabilitado (opcional). Usa 'install --playwright' para instalarlo de forma expl\xEDcita.");
+    } else if (playwright.status === "healthy") {
+      p3.log.success("Playwright CLI: paquete y navegador listos.");
+    } else if (playwright.status === "missing") {
+      const target = playwright.missing === "package" ? "el paquete global" : "el navegador de Playwright";
+      p3.log.warn(`Playwright CLI: habilitado, pero falta ${target} \u2192 ejecuta 'jorgex-stack install --playwright'.`);
+      problems++;
+    } else if (playwright.status === "broken") {
+      p3.log.error("Playwright CLI: el binario detectado no responde correctamente \u2192 ejecuta 'jorgex-stack install --playwright'.");
+      problems++;
+    } else if (playwright.status === "unreadable") {
+      p3.log.error(`Playwright CLI: no se puede leer la cach\xE9 de navegadores en ${playwright.path} (${playwright.errorCode}) \u2192 revisa permisos o ejecuta 'jorgex-stack install --playwright'.`);
+      problems++;
+    } else {
+      p3.log.warn("Playwright CLI: versi\xF3n distinta del pin aprobado \u2192 ejecuta 'jorgex-stack update' o 'install --playwright'.");
+      problems++;
+    }
+  }
+  const manifest = readManifest();
+  const modePreference = loadInstallModePreference();
+  const current = collectAllCurrentTargets(modePreference);
+  if (!current.complete || current.warnings.length > 0) {
+    p3.log.warn("Limpieza de hu\xE9rfanos deshabilitada: no se pudo construir el plan completo de todos los runtimes.");
+    for (const warning of current.warnings) p3.log.warn(warning);
+    problems++;
+  }
+  for (const adapter of Object.values(ADAPTERS)) {
+    const detection = adapter.detect();
+    if (!detection.installed) {
+      p3.log.warn(`${adapter.name}: no instalado en esta m\xE1quina.`);
       continue;
     }
+    const ctx = makeContext(adapter, detection.configDir, modePreference);
+    if (!ctx) continue;
+    let pending;
     try {
-      replaceSkill(skillInfo.name, tmpDir, skillInfo.head, {});
-      p4.log.success(`skill ${skillInfo.name}: actualizada y re-pineada a ${skillInfo.head.slice(0, 7)}.`);
-      appliedUpdates = true;
-      updated.push("skill");
+      pending = diffPlan(buildPlan(adapter, ctx)).filter((d) => d.status !== "unchanged").length;
     } catch (err) {
-      p4.log.error(`skill ${skillInfo.name}: error \u2014 ${err instanceof Error ? err.message : err}`);
-      exitCode = 1;
-    } finally {
-      cleanupTmp(tmpRoot);
+      p3.log.error(
+        `${adapter.name}: config ilegible en ${detection.configDir} \u2014 ${err instanceof Error ? err.message : err}`
+      );
+      problems++;
+      continue;
     }
-  }
-  if (playwrightNeedsUpdate && sel.includes("playwright-cli")) {
-    const confirmPlaywright = await p4.confirm({
-      message: "Actualizar Playwright CLI global al pin aprobado con pnpm add --global?",
-      initialValue: true
-    });
-    if (p4.isCancel(confirmPlaywright) || !confirmPlaywright) {
-      p4.log.info("Playwright CLI: actualizaci\xF3n omitida.");
+    if (pending > 0) {
+      p3.log.warn(`${adapter.name}: ${pending} archivos gestionados desactualizados o ausentes \u2192 ejecuta 'sync'.`);
+      problems++;
     } else {
-      const packageResult = executePlaywrightToolAction2("update");
-      const browserResult = packageResult.ok ? executePlaywrightToolAction2("install-browser") : null;
-      if (packageResult.ok && browserResult?.ok) {
-        p4.log.success("Playwright CLI actualizado al pin aprobado.");
-        appliedUpdates = true;
-        updated.push("playwright-cli");
-      } else {
-        const failedResult = packageResult.ok ? browserResult : packageResult;
-        const pnpmRemedy = failedResult && !failedResult.ok ? resolvePnpmFailureRemedy(failedResult.reason) : null;
-        const recovery = pnpmRemedy === null ? "Ejecuta 'jorgex-stack install --playwright' para reintentar el paquete y el navegador." : `${pnpmRemedy} Despu\xE9s, ejecuta 'jorgex-stack update' para reintentar.`;
-        const failedStep = packageResult.ok ? "descargar el navegador" : "actualizar el paquete global";
-        p4.log.error(`Playwright CLI: no se pudo ${failedStep}. ${recovery}`);
-        exitCode = 1;
-      }
+      p3.log.success(`${adapter.name}: config del stack al d\xEDa (${detection.configDir}).`);
     }
-  }
-  if (engramNeedsUpdate && sel.includes("engram") && engramData?.version) {
-    const confirmEngram = await p4.confirm({
-      message: `Actualizar engram a v${engramData.version} (canal nativo: brew \u2192 go install \u2192 URL)`,
-      initialValue: true
-    });
-    if (p4.isCancel(confirmEngram) || !confirmEngram) {
-      p4.log.info("Engram: actualizaci\xF3n omitida.");
-    } else {
-      const ok = await updateEngram(engramData.repo, engramData.version);
-      if (!ok) {
-        exitCode = 1;
-      } else {
-        const binPost = detectEngram();
-        const versionPost = binPost ? engramVersion(binPost) : null;
-        if (versionPost) {
-          p4.log.success(`Engram: ahora en v${versionPost}.`);
-        } else {
-          p4.log.warn("Engram actualizado, pero no se pudo verificar la versi\xF3n \u2014 comprueba con engram --version");
-        }
-        p4.log.info("Reinicia los clientes (Claude Code/OpenCode/Codex) para que sus MCP usen la versi\xF3n nueva.");
-        appliedUpdates = true;
-        updated.push("engram");
-      }
+    const prev = manifest.runtimes[adapter.id];
+    const orphans = prev && current.complete ? findOrphans(prev.owned, current.targets) : [];
+    if (orphans.length > 0) {
+      p3.log.warn(`${adapter.name}: ${orphans.length} archivos hu\xE9rfanos de versiones previas \u2192 ejecuta 'sync'.`);
+      problems++;
+    }
+    if (adapter.id === "codex" && fs18.existsSync(path26.join(detection.configDir, "hooks.json"))) {
+      p3.log.info("Codex: recuerda que los hooks requieren aprobaci\xF3n manual \u2014 verifica con /hooks dentro de codex.");
     }
+    if (adapter.id === "codex" && fs18.existsSync(path26.join(detection.configDir, "AGENTS.override.md"))) {
+      p3.log.warn(
+        "Codex: existe ~/.codex/AGENTS.override.md \u2014 tiene prioridad ABSOLUTA y tapa el AGENTS.md gestionado por el stack."
+      );
+      problems++;
+    }
+    const key = context7KeyConfigured(adapter.id, detection.configDir);
+    if (key === false) p3.log.info(`${adapter.name}: context7 sin key (opcional \u2014 con\xE9ctala cuando quieras).`);
   }
-  p4.outro(exitCode === 0 ? "Update completado." : "Update completado con errores (revisa arriba).");
-  return { exitCode, appliedUpdates, syncRequired: resolveUpdateSyncRequired(updated) };
+  p3.outro(problems === 0 ? "Todo sano." : `${problems} avisos \u2014 revisa arriba.`);
+  return problems > 0 ? 1 : 0;
 }
 
-// src/models-picker.ts
+// src/update.ts
+import fs21 from "fs";
+import path29 from "path";
+import os4 from "os";
+import { execFileSync as execFileSync5 } from "child_process";
+import * as p4 from "@clack/prompts";
+
+// src/lib/github.ts
+import fs19 from "fs";
 import path27 from "path";
-import * as p5 from "@clack/prompts";
-var TIERS = ["strong", "standard", "cheap"];
-var EFFORTS = ["low", "medium", "high", "xhigh"];
-var CLAUDE_ALIASES = ["fable", "opus", "sonnet", "haiku", "inherit"];
-var CODEX_MODELS = [
-  "default",
-  "gpt-5.6-sol",
-  "gpt-5.6-terra",
-  "gpt-5.6-luna",
-  "gpt-5.5",
-  "gpt-5.4",
-  "gpt-5.4-mini"
-];
-var CODEX_CUSTOM = "__custom__";
-var CANCEL = /* @__PURE__ */ Symbol("cancel");
-function opencodeLiveModels(binPath) {
-  const out = runDetectedBin(binPath, ["models"], 2e4);
-  if (out === null) return null;
-  const models = out.split(/\r?\n/).map((l) => l.trim()).filter((l) => l !== "" && l.includes("/"));
-  return models.length > 0 ? models : null;
-}
-function agentsByTier() {
-  const grouped = { strong: [], standard: [], cheap: [] };
-  for (const agent of loadCanonicalAgents(path27.join(stackRoot(), "agents"))) {
-    if (agent.mode === "subagent") grouped[agent.tier].push(agent.name);
+import { execFileSync as execFileSync3 } from "child_process";
+import os3 from "os";
+import { Readable } from "stream";
+import { pipeline } from "stream/promises";
+var cachedToken;
+var ghTokenFailed = false;
+function githubToken() {
+  if (cachedToken !== void 0) return cachedToken;
+  const env = process.env["GH_TOKEN"]?.trim() || process.env["GITHUB_TOKEN"]?.trim();
+  if (env) return cachedToken = env;
+  const gh = lookPath("gh");
+  if (gh) {
+    const fromGh = runDetectedBin(gh, ["auth", "token"], 5e3)?.trim();
+    if (fromGh) return cachedToken = fromGh;
+    ghTokenFailed = true;
   }
-  return grouped;
+  return cachedToken = null;
 }
-function isCompleteRuntimeModelMap(models) {
-  return TIERS.every((tier) => models[tier]?.model);
+function ghPresentButTokenFailed() {
+  return ghTokenFailed;
 }
-async function askModel(det, subject, current) {
-  if (det.id === "codex") {
-    if (!current) throw new Error("Codex requiere un model-map base.");
-    const effort = await p5.select({
-      message: `${det.name} \xB7 ${subject} \u2014 reasoning effort`,
-      options: EFFORTS.map((v) => ({ value: v, label: v })),
-      initialValue: current.variant ?? "medium"
-    });
-    if (p5.isCancel(effort)) return CANCEL;
-    const modelOptions = [
-      ...CODEX_MODELS.includes(current.model) ? [] : [{ value: current.model, label: `${current.model} (actual)` }],
-      ...CODEX_MODELS.map((m) => ({
-        value: m,
-        label: m === "default" ? "default \u2014 el del CLI, se actualiza solo (recomendado)" : m
-      })),
-      { value: CODEX_CUSTOM, label: "otro\u2026 (escribir un ID a mano)" }
-    ];
-    let model = await p5.select({
-      message: `${det.name} \xB7 ${subject} \u2014 modelo`,
-      options: modelOptions,
-      initialValue: current.model
+function authHeaders() {
+  const token = githubToken();
+  return token ? { Authorization: `Bearer ${token}` } : {};
+}
+var rateLimitHit = false;
+function githubRateLimited() {
+  return rateLimitHit;
+}
+function githubHeaders() {
+  return {
+    Accept: "application/vnd.github+json",
+    "User-Agent": "jorgex-stack",
+    ...authHeaders()
+  };
+}
+async function latestGithubRelease(repo) {
+  try {
+    const res = await fetch(`https://api.github.com/repos/${repo}/releases/latest`, {
+      headers: githubHeaders(),
+      signal: AbortSignal.timeout(1e4)
     });
-    if (p5.isCancel(model)) return CANCEL;
-    if (model === CODEX_CUSTOM) {
-      const typed = await p5.text({
-        message: `${det.name} \xB7 ${subject} \u2014 ID exacto del modelo (min\xFAsculas; compru\xE9balo con /model dentro de codex)`,
-        initialValue: current.model,
-        validate: (v) => !v || v.trim() === "" ? 'Vac\xEDo no \u2014 usa "default" o un ID.' : void 0
-      });
-      if (p5.isCancel(typed)) return CANCEL;
-      model = typed.trim().toLowerCase();
+    if (!res.ok) {
+      if (res.status === 403 || res.status === 429) rateLimitHit = true;
+      return null;
     }
-    return { model, variant: effort };
-  }
-  const optionsList = det.options;
-  const options = optionsList.map((m) => ({ value: m, label: m }));
-  if (current && !optionsList.includes(current.model)) {
-    options.unshift({ value: current.model, label: `${current.model} (actual)` });
+    const data = await res.json();
+    return data.tag_name?.replace(/^v/, "") ?? null;
+  } catch {
+    return null;
   }
-  const choice = await p5.select({
-    message: `${det.name} \xB7 ${subject} \u2014 modelo`,
-    options,
-    initialValue: current?.model,
-    maxItems: 12
-  });
-  if (p5.isCancel(choice)) return CANCEL;
-  if (det.id === "claude-code") return { model: choice };
-  const keptCurrent = current && choice === current.model && current.variant ? current.variant : null;
-  const variant = await p5.select({
-    message: `${det.name} \xB7 ${subject} \u2014 reasoning effort (variant; solo si el modelo lo soporta)`,
-    options: [
-      { value: "", label: "(sin variant \u2014 el default del modelo)" },
-      ...EFFORTS.map((v) => ({ value: v, label: v })),
-      ...keptCurrent && !EFFORTS.includes(keptCurrent) ? [{ value: keptCurrent, label: `${keptCurrent} (actual)` }] : []
-    ],
-    initialValue: keptCurrent ?? ""
-  });
-  if (p5.isCancel(variant)) return CANCEL;
-  return { model: choice, ...variant ? { variant } : {} };
 }
-async function runModelsPicker(opts) {
-  const file = ensureModelMapFile();
-  const map = loadModelMap();
-  if (opts.yes || !process.stdout.isTTY) {
-    if (opts.runtimes.includes("opencode") && !map.opencode) {
-      console.error("OpenCode requiere selecci\xF3n interactiva desde los proveedores conectados; ejecuta 'models --agents opencode' sin --yes.");
-      return 1;
-    }
-    console.log(`Model-map en ${file}. Ed\xEDtalo o ejecuta 'models' sin --yes para el picker.`);
-    return 0;
-  }
-  p5.intro("jorgex-stack models \u2014 modelos por tier o por subagente");
-  const grouped = agentsByTier();
-  const tierLine = (tier) => grouped[tier].join(", ");
-  const agentCount = TIERS.reduce((n, tier) => n + grouped[tier].length, 0);
-  const detections = [];
-  if (opts.runtimes.includes("opencode")) {
-    const opencode = detectOpenCode();
-    detections.push({
-      id: "opencode",
-      name: "OpenCode",
-      installed: opencode.installed,
-      options: opencode.binPath ? opencodeLiveModels(opencode.binPath) : null
+async function latestGithubCommit(repo) {
+  try {
+    const res = await fetch(`https://api.github.com/repos/${repo}/commits?per_page=1`, {
+      headers: githubHeaders(),
+      signal: AbortSignal.timeout(1e4)
     });
-  }
-  if (opts.runtimes.includes("claude-code")) {
-    detections.push({ id: "claude-code", name: "Claude Code", installed: detectClaudeCode().installed, options: CLAUDE_ALIASES });
-  }
-  if (opts.runtimes.includes("codex")) {
-    detections.push({ id: "codex", name: "Codex CLI", installed: detectCodex().installed, options: null });
-  }
-  for (const det of detections) {
-    if (!det.installed) {
-      p5.log.info(`${det.name}: no instalado \u2014 se mantienen los defaults.`);
-      continue;
+    if (!res.ok) {
+      if (res.status === 403 || res.status === 429) rateLimitHit = true;
+      return null;
     }
-    if (det.id === "opencode" && det.options === null) {
-      p5.log.warn("OpenCode: no se pudo listar `opencode models` \u2014 se mantiene la selecci\xF3n actual.");
-      continue;
+    const data = await res.json();
+    return data[0]?.sha ?? null;
+  } catch {
+    return null;
+  }
+}
+function validateExtractedTree(destDir) {
+  const resolved = path27.resolve(destDir);
+  const walk = (dir) => {
+    let entries;
+    try {
+      entries = fs19.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return false;
     }
-    const existingRuntimeMap = map[det.id];
-    const runtimeMap = {
-      ...existingRuntimeMap
-    };
-    p5.log.message(
-      `${det.name} \u2014 tiers y sus subagentes:
-  strong   \u2192 ${tierLine("strong")}
-  standard \u2192 ${tierLine("standard")}
-  cheap    \u2192 ${tierLine("cheap")}`
-    );
-    const mode = await p5.select({
-      message: `${det.name} \u2014 \xBFc\xF3mo asignar los modelos?`,
-      options: [
-        { value: "tier", label: "Por tier \u2014 3 grupos (r\xE1pido)" },
-        { value: "agent", label: `Por subagente \u2014 uno a uno (${agentCount} subagentes, control total)` }
-      ],
-      initialValue: "tier"
-    });
-    if (p5.isCancel(mode)) return cancelled();
-    if (mode === "tier") {
-      for (const tier of TIERS) {
-        const asked = await askModel(det, `tier ${tier} (${tierLine(tier)})`, existingRuntimeMap?.[tier]);
-        if (asked === CANCEL) return cancelled();
-        runtimeMap[tier] = asked;
-      }
-      const overrideCount = Object.keys(runtimeMap.overrides ?? {}).length;
-      if (overrideCount > 0) {
-        p5.log.info(
-          `${det.name}: se conservan ${overrideCount} ajustes por subagente previos \u2014 elige "Por subagente" para revisarlos.`
-        );
+    for (const entry of entries) {
+      const full = path27.join(dir, entry.name);
+      let stat;
+      try {
+        stat = fs19.lstatSync(full);
+      } catch {
+        return false;
       }
-    } else {
-      const overrides = { ...runtimeMap.overrides ?? {} };
-      for (const tier of TIERS) {
-        let base = runtimeMap[tier];
-        for (const name of grouped[tier]) {
-          const current = existingRuntimeMap ? resolveAgentModel(existingRuntimeMap, name, tier) : void 0;
-          const asked = await askModel(det, `${name} (tier ${tier})`, current);
-          if (asked === CANCEL) return cancelled();
-          if (!base) {
-            base = asked;
-            runtimeMap[tier] = base;
-          }
-          const sameAsTier = asked.model === base.model && (asked.variant ?? "") === (base.variant ?? "");
-          if (sameAsTier) {
-            delete overrides[name];
-          } else {
-            overrides[name] = {
-              model: asked.model,
-              ...asked.variant ? { variant: asked.variant } : base.variant ? { variant: "" } : {}
-            };
-          }
-        }
+      if (stat.isSymbolicLink()) return false;
+      if (!isContainedIn(full, resolved)) return false;
+      if (entry.isDirectory()) {
+        if (!walk(full)) return false;
       }
-      if (Object.keys(overrides).length > 0) runtimeMap.overrides = overrides;
-      else delete runtimeMap.overrides;
     }
-    if (!isCompleteRuntimeModelMap(runtimeMap)) {
-      throw new Error(`${det.name}: selecci\xF3n de modelos incompleta.`);
+    return true;
+  };
+  return walk(resolved);
+}
+function resolveTarBin() {
+  if (process.platform !== "win32") return "tar";
+  const winTar = path27.join(process.env["SystemRoot"] ?? "C:\\Windows", "System32", "tar.exe");
+  return fs19.existsSync(winTar) ? winTar : "tar";
+}
+async function downloadRepoTarball(repo, sha, destDir, validateSubdir) {
+  const url = `https://codeload.github.com/${repo}/tar.gz/${sha}`;
+  const tmp = path27.join(os3.tmpdir(), `jorgex-tarball-${Date.now()}.tar.gz`);
+  const fail = (reason) => {
+    try {
+      fs19.rmSync(destDir, { recursive: true, force: true });
+    } catch {
+    }
+    return { ok: false, reason };
+  };
+  try {
+    const res = await fetch(url, {
+      headers: { "User-Agent": "jorgex-stack", ...authHeaders() },
+      signal: AbortSignal.timeout(12e4)
+    });
+    if (!res.ok) {
+      if (res.status === 403 || res.status === 429) rateLimitHit = true;
+      return fail(
+        `HTTP ${res.status}${res.status === 403 || res.status === 429 ? " \u2014 rate limit; define GH_TOKEN o inicia sesi\xF3n en gh" : ""}`
+      );
+    }
+    if (!res.body) return fail("respuesta HTTP sin cuerpo");
+    await pipeline(
+      Readable.fromWeb(res.body),
+      fs19.createWriteStream(tmp)
+    );
+    fs19.rmSync(destDir, { recursive: true, force: true });
+    fs19.mkdirSync(destDir, { recursive: true });
+    try {
+      execFileSync3(resolveTarBin(), ["-xzf", tmp, "--strip-components=1", "-C", destDir], { stdio: "pipe" });
+    } catch (err) {
+      const e = err;
+      const detail = (e.stderr?.toString().trim() || e.message || "").split("\n")[0];
+      return fail(detail ? `tar fall\xF3: ${detail}` : "tar no disponible o fall\xF3 la extracci\xF3n");
+    }
+    const resolvedDest = path27.resolve(destDir);
+    const validateRoot = validateSubdir ? path27.resolve(resolvedDest, validateSubdir) : resolvedDest;
+    if (validateRoot !== resolvedDest && !isContainedIn(validateRoot, resolvedDest)) {
+      return fail(`la ruta de validaci\xF3n "${validateSubdir}" escapa del destino`);
+    }
+    if (fs19.existsSync(validateRoot) && !validateExtractedTree(validateRoot)) {
+      return fail("el \xE1rbol extra\xEDdo contiene symlinks o rutas fuera del destino");
+    }
+    const validated = fs19.existsSync(validateRoot);
+    return { ok: true, validated };
+  } catch (err) {
+    const timedOut = err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError");
+    return fail(timedOut ? "timeout de descarga (120s)" : err instanceof Error ? `fallo de red: ${err.message}` : "error desconocido");
+  } finally {
+    try {
+      fs19.rmSync(tmp, { force: true });
+    } catch {
     }
-    map[det.id] = runtimeMap;
   }
-  writeText(file, JSON.stringify(map, null, 2) + "\n");
-  p5.log.success(`Guardado en ${file}`);
-  return 0;
-}
-function cancelled() {
-  p5.cancel("Cancelado \u2014 no se ha guardado nada.");
-  return 1;
 }
 
-// src/lib/release.ts
-import fs21 from "fs";
+// src/lib/skill-update.ts
+import fs20 from "fs";
 import path28 from "path";
-import { execFileSync as execFileSync6 } from "child_process";
-import { fileURLToPath as fileURLToPath2 } from "url";
-function findPackageJson() {
-  let dir = path28.dirname(fileURLToPath2(import.meta.url));
-  for (let i = 0; i < 6; i++) {
-    const candidate = path28.join(dir, "package.json");
-    if (fs21.existsSync(candidate)) return candidate;
-    dir = path28.dirname(dir);
-  }
-  throw new Error("No se encontr\xF3 package.json cerca del CLI.");
-}
-function readPackageVersion() {
-  return readPackageMetadata().version;
+import { execFileSync as execFileSync4 } from "child_process";
+var PROTECTED_SKILLS = /* @__PURE__ */ new Set([
+  "agent-delegation",
+  "lean-code",
+  "orchestrator",
+  "work-lifecycle",
+  "xreview"
+]);
+function sameTextContentNormalized(a, b) {
+  const ba = fs20.readFileSync(a);
+  const bb = fs20.readFileSync(b);
+  if (ba.equals(bb)) return true;
+  const sa = ba.toString("utf8").replace(/\r\n/g, "\n");
+  const sb = bb.toString("utf8").replace(/\r\n/g, "\n");
+  return sa === sb;
 }
-function readPackageMetadata() {
-  const packageJson = findPackageJson();
-  const raw = fs21.readFileSync(packageJson, "utf8");
-  const parsed = JSON.parse(raw);
-  const name = typeof parsed.name === "string" ? parsed.name.trim() : "";
-  const version = typeof parsed.version === "string" ? parsed.version.trim() : "";
-  if (name === "" || version === "") {
-    throw new Error("package.json no expone nombre o versi\xF3n v\xE1lidos.");
+function diffSkillDirs(upstreamDir, localDir) {
+  const upstreamFiles = new Set(
+    listFilesRecursive(upstreamDir).map((f) => path28.relative(upstreamDir, f))
+  );
+  const localFiles = new Set(
+    listFilesRecursive(localDir).map((f) => path28.relative(localDir, f))
+  );
+  const added = [];
+  const modified = [];
+  const deleted = [];
+  for (const rel of upstreamFiles) {
+    if (!localFiles.has(rel)) {
+      added.push(rel);
+    } else if (!sameTextContentNormalized(path28.join(upstreamDir, rel), path28.join(localDir, rel))) {
+      modified.push(rel);
+    }
   }
-  return { name, version };
+  for (const rel of localFiles) {
+    if (!upstreamFiles.has(rel)) {
+      deleted.push(rel);
+    }
+  }
+  return {
+    added: added.sort(),
+    modified: modified.sort(),
+    deleted: deleted.sort()
+  };
 }
-
-// src/lib/pi-runtime.ts
-import os5 from "os";
-import path30 from "path";
-import fs22 from "fs";
-import { spawnSync } from "child_process";
-import { createHash } from "crypto";
-
-// src/lib/pi-package-lifecycle.ts
-import path29 from "path";
-var REQUIRED_CAPABILITIES = /* @__PURE__ */ new Set([
-  "foundation-contract-v1",
-  "runner-json-v1",
-  "managed-primary-model-v1"
-]);
-var ALLOWED_EXTERNAL_WRITES = /* @__PURE__ */ new Set([
-  "settings.json",
-  "models.json",
-  "jorgex-pi/sol-lifecycle.v1.json"
-]);
-function sameRecord(left, right) {
-  return JSON.stringify(left) === JSON.stringify(right);
+var DIFF_MAX_LINES = 400;
+function renderSkillDiff(upstreamDir, localDir) {
+  try {
+    execFileSync4("git", ["diff", "--no-index", "--stat", "--", localDir, upstreamDir], {
+      stdio: "pipe",
+      encoding: "utf8"
+    });
+    return "";
+  } catch (statErr) {
+    const se = statErr;
+    if (typeof se.stdout !== "string" || se.status !== 1) {
+      const d = diffSkillDirs(upstreamDir, localDir);
+      const total = d.added.length + d.modified.length + d.deleted.length;
+      if (total === 0) return "";
+      return `[git no disponible \u2014 resumen de cambios]
+  a\xF1adidos: ${d.added.length}, modificados: ${d.modified.length}, eliminados: ${d.deleted.length}`;
+    }
+    const stat = se.stdout;
+    let fullDiff = "";
+    try {
+      execFileSync4("git", ["diff", "--no-index", "--", localDir, upstreamDir], {
+        stdio: "pipe",
+        encoding: "utf8"
+      });
+    } catch (diffErr) {
+      const de = diffErr;
+      if (typeof de.stdout === "string" && de.status === 1) {
+        const lines = de.stdout.split("\n");
+        if (lines.length > DIFF_MAX_LINES) {
+          fullDiff = lines.slice(0, DIFF_MAX_LINES).join("\n") + `
+(truncado \u2014 ${lines.length - DIFF_MAX_LINES} l\xEDneas omitidas)`;
+        } else {
+          fullDiff = de.stdout;
+        }
+      }
+    }
+    return fullDiff ? `${stat}
+${fullDiff}` : stat;
+  }
 }
-function managedExternalWritesAreSafe(writes) {
-  if (writes.length !== ALLOWED_EXTERNAL_WRITES.size) return false;
-  const seen = /* @__PURE__ */ new Set();
-  for (const write of writes) {
-    if (write === null || typeof write !== "object" || Array.isArray(write)) return false;
-    if (Object.keys(write).sort().join(",") !== "owner,relativePath,root,semantics") return false;
-    if (write.owner !== "jorgex-pi" || write.root !== "PI_CODING_AGENT_DIR") return false;
-    if (typeof write.relativePath !== "string" || !ALLOWED_EXTERNAL_WRITES.has(write.relativePath)) return false;
-    if (/^(?:[A-Za-z]:|[\\/])/.test(write.relativePath) || write.relativePath.split(/[\\/]/).includes("..")) return false;
-    if (typeof write.semantics !== "string" || write.semantics.trim() === "" || seen.has(write.relativePath)) return false;
-    seen.add(write.relativePath);
+function replaceSkill(name, upstreamSkillDir, newCommit, opts) {
+  const upstreamsFilePath = opts?.upstreamsFilePath;
+  const localSkillsRoot = opts?.localSkillsRoot;
+  const backupsRoot2 = opts?.backupsRoot;
+  if (PROTECTED_SKILLS.has(name)) {
+    throw new Error(`La skill "${name}" es propia del stack y no se actualiza desde upstream.`);
   }
-  return seen.size === ALLOWED_EXTERNAL_WRITES.size;
+  const upstreamsFile = upstreamsFilePath ?? path28.join(path28.dirname(stackRoot()), "upstreams.json");
+  const raw = fs20.readFileSync(upstreamsFile, "utf8");
+  const data = JSON.parse(raw);
+  const skillEntry = data?.skills?.[name];
+  if (!skillEntry) {
+    throw new Error(`Skill "${name}" no encontrada en upstreams.json.`);
+  }
+  if (skillEntry.kind === "release") {
+    throw new Error(`La skill "${name}" es de tipo release y no se actualiza con replaceSkill.`);
+  }
+  const skillsRoot = localSkillsRoot ?? path28.join(stackRoot(), "skills");
+  const localSkillDir = path28.join(skillsRoot, name);
+  const localFiles = listFilesRecursive(localSkillDir);
+  if (localFiles.length > 0) {
+    createBackup(localFiles, `skill-update-${name}`, backupsRoot2);
+  }
+  const stagingDir = `${localSkillDir}.staging-${process.pid}`;
+  try {
+    const upstreamFiles = listFilesRecursive(upstreamSkillDir);
+    for (const src of upstreamFiles) {
+      const st = fs20.lstatSync(src);
+      if (st.isSymbolicLink()) {
+        throw new Error(`Symlink rechazado en upstream de skill "${name}": ${src}`);
+      }
+      const rel = path28.relative(upstreamSkillDir, src);
+      const dest = path28.join(stagingDir, rel);
+      ensureDir(path28.dirname(dest));
+      copyFile(src, dest);
+    }
+    const oldDir = `${localSkillDir}.old-${process.pid}`;
+    if (fs20.existsSync(localSkillDir)) {
+      fs20.renameSync(localSkillDir, oldDir);
+    }
+    fs20.renameSync(stagingDir, localSkillDir);
+    fs20.rmSync(oldDir, { recursive: true, force: true });
+  } catch (err) {
+    try {
+      fs20.rmSync(stagingDir, { recursive: true, force: true });
+    } catch {
+    }
+    throw err;
+  }
+  skillEntry.commit = newCommit;
+  writeText(upstreamsFile, JSON.stringify(data, null, 2) + "\n");
 }
-function ownership(receipt) {
-  return { receipt, adapters: false, manifest: false, modelMap: false };
+
+// src/update.ts
+function rateLimitHint(prefix) {
+  return ghPresentButTokenFailed() ? `${prefix} Tienes gh instalado pero \`gh auth token\` no devolvi\xF3 credencial (\xBFsesi\xF3n caducada?) \u2014 prueba \`gh auth login\` o define GH_TOKEN.` : `${prefix} Define GH_TOKEN o inicia sesi\xF3n en gh CLI.`;
 }
-function blocked(input, reason) {
-  return {
-    kind: "blocked",
-    reason,
-    receiptPath: input.scope.receiptPath,
-    ownership: ownership(input.receiptJson !== null)
-  };
+function loadUpstreams() {
+  const file = path29.join(path29.dirname(stackRoot()), "upstreams.json");
+  return JSON.parse(fs21.readFileSync(file, "utf8"));
 }
-function packageSource(entry) {
-  if (typeof entry === "string") return entry;
-  if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return null;
-  const source = Reflect.get(entry, "source");
-  return typeof source === "string" ? source : null;
+function skillsToScan(maintainer, upstreams) {
+  return maintainer ? Object.keys(upstreams.skills) : [];
 }
-function isJorgeXPiSource(source) {
-  return source.includes("jorgex-pi");
+async function querySkillHeads(skillNames, upstreams) {
+  const requests = /* @__PURE__ */ new Map();
+  for (const name of skillNames) {
+    const info = upstreams.skills[name];
+    const repo = info.source.replace(/^github:/, "");
+    if (!requests.has(repo)) requests.set(repo, latestGithubCommit(repo));
+  }
+  const heads = /* @__PURE__ */ new Map();
+  await Promise.all(
+    [...requests.entries()].map(async ([repo, request]) => {
+      heads.set(repo, await request);
+    })
+  );
+  return skillNames.map((name) => {
+    const info = upstreams.skills[name];
+    const repo = info.source.replace(/^github:/, "");
+    return { name, repo, info, head: heads.get(repo) ?? null };
+  });
 }
-function parsePackageSources(settingsJson) {
+async function latestNpmVersion(pkg) {
   try {
-    const parsed = JSON.parse(settingsJson);
-    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
-    const packages = Reflect.get(parsed, "packages");
-    if (!Array.isArray(packages)) return null;
-    const sources = packages.map((entry) => ({ entry, source: packageSource(entry) }));
-    return sources.every((value) => value.source !== null) ? sources : null;
+    const res = await fetch(`https://registry.npmjs.org/${pkg}/latest`, {
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!res.ok) return null;
+    const data = await res.json();
+    return data.version ?? null;
   } catch {
     return null;
   }
 }
-function isExactManagedPackage(entry, source) {
-  if (entry === null || typeof entry !== "object" || Array.isArray(entry)) return false;
-  const keys = Object.keys(entry);
-  const skills = Reflect.get(entry, "skills");
-  return keys.length === 2 && keys.includes("source") && keys.includes("skills") && Reflect.get(entry, "source") === source && Array.isArray(skills) && skills.length === 0;
-}
-function expectedReceipt(candidate, state, scope, engramBin) {
+function resolvePlaywrightUpdateCheck(input) {
+  if (input.enabled !== true) return null;
+  if (input.cli.status === "current") {
+    return {
+      level: "success",
+      message: `Playwright CLI: ${PLAYWRIGHT_CLI.version} \u2014 al d\xEDa con el pin aprobado.`
+    };
+  }
+  const local = input.cli.detectedVersion ?? (input.cli.status === "absent" ? "no instalado" : "no verificable");
   return {
-    schemaVersion: 1,
-    state,
-    candidate: {
-      package: candidate.package,
-      tarball: candidate.tarball,
-      provenance: candidate.provenance
-    },
-    scope,
-    engram: { binary: engramBin }
+    level: "warn",
+    message: `Playwright CLI: ${local} local, pin aprobado ${PLAYWRIGHT_CLI.version} \u2192 ejecuta 'jorgex-stack update' o 'jorgex-stack install --playwright'.`
   };
 }
-function parseReceiptShape(receiptJson) {
-  try {
-    const parsed = JSON.parse(receiptJson);
-    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
-    const schemaVersion = Reflect.get(parsed, "schemaVersion");
-    if (schemaVersion !== 1) return null;
-    const state = Reflect.get(parsed, "state");
-    const candidate = Reflect.get(parsed, "candidate");
-    if (state !== "installing" && state !== "installed" || candidate === null || typeof candidate !== "object" || Array.isArray(candidate)) {
-      return null;
+async function runUpdateCheck(localVersion, includeBrowserState = true) {
+  p4.intro("jorgex-stack update --check");
+  if (includeBrowserState) {
+    const preferenceErrors = browserPreferenceErrors();
+    if (preferenceErrors.length > 0) {
+      for (const error of preferenceErrors) p4.log.error(error);
+      p4.outro("Check cancelado: corrige las preferencias de navegador antes de reintentar.");
+      return 1;
     }
-    const packageValue = Reflect.get(candidate, "package");
-    const tarball = Reflect.get(candidate, "tarball");
-    const provenance = Reflect.get(candidate, "provenance");
-    const scope = Reflect.get(parsed, "scope");
-    const engram = Reflect.get(parsed, "engram");
-    if (packageValue === null || typeof packageValue !== "object" || tarball === null || typeof tarball !== "object" || provenance === null || typeof provenance !== "object" || scope === null || typeof scope !== "object" || Array.isArray(scope)) {
-      return null;
+  }
+  const upstreams = loadUpstreams();
+  const npmLatest = await latestNpmVersion("jorgex-stack");
+  if (npmLatest === null)
+    p4.log.info(`jorgex-stack: v${localVersion} local (a\xFAn no publicado en npm o sin red).`);
+  else if (npmLatest === localVersion)
+    p4.log.success(`jorgex-stack: v${localVersion} \u2014 al d\xEDa.`);
+  else
+    p4.log.warn(
+      `jorgex-stack: v${localVersion} local, v${npmLatest} en npm \u2192 pnpm dlx jorgex-stack@latest`
+    );
+  const engramRepo = upstreams.tools["engram"]?.source.replace(/^github:/, "");
+  if (engramRepo) {
+    const bin = detectEngram();
+    const local = bin ? engramVersion(bin) : null;
+    const latest = await latestGithubRelease(engramRepo);
+    if (local === null) p4.log.warn("engram: no detectado en esta m\xE1quina.");
+    else if (latest === null)
+      p4.log.info(`engram: ${local} local (no se pudo consultar el upstream).`);
+    else if (latest === local) p4.log.success(`engram: ${local} \u2014 al d\xEDa.`);
+    else
+      p4.log.warn(
+        `engram: ${local} local, ${latest} disponible. Tu instalaci\xF3n NO se toca (D7) \u2014 actualiza t\xFA: github.com/${engramRepo}/releases`
+      );
+  }
+  if (includeBrowserState && loadPlaywrightCliPreference() === true) {
+    const playwright = resolvePlaywrightUpdateCheck({
+      enabled: true,
+      cli: detectPlaywrightCli()
+    });
+    if (playwright) p4.log[playwright.level](playwright.message);
+  }
+  const checkSkillNames = skillsToScan(isGitClone(), upstreams);
+  if (checkSkillNames.length === 0) {
+    p4.log.info(
+      "Skills de terceros: pineadas con la versi\xF3n del stack (su revisi\xF3n upstream se hace desde el clon del repo)."
+    );
+  } else {
+    const skillQueries = await querySkillHeads(checkSkillNames, upstreams);
+    let moved = 0;
+    for (const { name, repo, info, head } of skillQueries) {
+      const label = info.modified ? `${name} (modificada localmente)` : name;
+      const pinned = info.commit;
+      if (!pinned)
+        p4.log.warn(`${label}: sin pin en upstreams.json \u2014 a\xF1ade el commit revisado.`);
+      else if (head === null)
+        p4.log.info(`${label}: pin ${pinned.slice(0, 7)} (no se pudo consultar el upstream).`);
+      else if (head === pinned)
+        p4.log.success(`${label}: al d\xEDa con el pin ${pinned.slice(0, 7)}.`);
+      else {
+        moved++;
+        p4.log.warn(
+          `${label}: el upstream se movi\xF3 (pin ${pinned.slice(0, 7)} \u2192 ${head.slice(0, 7)}).
+  Revisa el diff y, si lo aceptas, actualiza la copia vendorizada y el pin: github.com/${repo}/compare/${pinned.slice(0, 7)}...${head.slice(0, 7)}`
+        );
+      }
     }
-    const source = Reflect.get(packageValue, "source");
-    const name = Reflect.get(packageValue, "name");
-    const version = Reflect.get(packageValue, "version");
-    const scopeKind = Reflect.get(scope, "kind");
-    const codingAgentDir = Reflect.get(scope, "codingAgentDir");
-    if (name !== "jorgex-pi" || typeof version !== "string" || typeof source !== "string" || source !== `npm:jorgex-pi@${version}` || scopeKind !== "real" && scopeKind !== "target-dir" || typeof codingAgentDir !== "string") {
-      return null;
+    if (moved === 0 && skillQueries.every(({ head }) => head !== null)) {
+      p4.log.info("Skills de terceros: ning\xFAn upstream se ha movido respecto a su pin.");
     }
-    if (engram === void 0) return "upgrade-required";
-    if (engram === null || typeof engram !== "object" || Array.isArray(engram) || typeof Reflect.get(engram, "binary") !== "string" || !path29.isAbsolute(Reflect.get(engram, "binary"))) {
+  }
+  if (githubRateLimited()) {
+    p4.log.warn(rateLimitHint("GitHub limit\xF3 algunas consultas (rate limit sin token)."));
+  }
+  p4.outro("Check completado.");
+  return 0;
+}
+function isEngramRunning() {
+  try {
+    if (process.platform === "win32") {
+      const ps = lookPath("powershell") ?? lookPath("pwsh");
+      if (ps) {
+        const out = runDetectedBin(ps, ["-NoProfile", "-Command", "Get-Process -Name engram -ErrorAction SilentlyContinue | Measure-Object | Select-Object -ExpandProperty Count"], 5e3);
+        return out !== null ? parseInt(out.trim(), 10) > 0 : null;
+      }
       return null;
+    } else {
+      const pgrep = lookPath("pgrep");
+      if (!pgrep) return null;
+      try {
+        execFileSync5(pgrep, ["-x", "engram"], { stdio: "ignore" });
+        return true;
+      } catch {
+        return false;
+      }
     }
-    return parsed;
   } catch {
     return null;
   }
 }
-function parseReceipt(receiptJson, candidate, scope, engramBin) {
-  const parsed = parseReceiptShape(receiptJson);
-  if (parsed === null || parsed === "upgrade-required") return parsed;
-  const expected = expectedReceipt(candidate, parsed.state, scope, engramBin);
-  return sameRecord(parsed, expected) ? expected : null;
+function isGitClone(projectRoot = path29.dirname(stackRoot())) {
+  return fs21.existsSync(path29.join(projectRoot, ".git"));
 }
-function candidateIsValid(candidate, observed) {
-  return candidate.package.name === "jorgex-pi" && candidate.package.source === `npm:${candidate.package.name}@${candidate.package.version}` && candidate.contract.schemaVersion === 1 && candidate.contract.runner.schemaVersion === 1 && candidate.contract.runner.bin === "jorgex-pi" && candidate.contract.runner.maxStdoutBytes === 65536 && managedExternalWritesAreSafe(candidate.contract.managedExternalWrites) && [...REQUIRED_CAPABILITIES].every((capability) => candidate.contract.capabilities.includes(capability)) && sameRecord(candidate.tarball, observed);
+var STACK_METHOD_CLONE = "git pull + pnpm install + pnpm build";
+function resolvePnpm() {
+  const bin = lookPath("pnpm") ?? lookPath("pnpm.cmd") ?? lookPath("pnpm.ps1");
+  if (!bin) throw new Error("pnpm no encontrado en PATH.");
+  return bin;
 }
-function planPiPackageLifecycle(input) {
-  if (!candidateIsValid(input.candidate, input.observedTarball)) {
-    return blocked(input, "tarball-integrity");
-  }
-  if (!input.candidate.pi.testedVersions.includes(input.pi.version)) {
-    return blocked(input, "unsupported-pi-version");
-  }
-  if (input.engramBin === null) return blocked(input, "engram-missing");
-  const sources = parsePackageSources(input.pi.settingsJson);
-  if (sources === null) return blocked(input, "settings-corrupt");
-  const matchingSources = sources.filter(({ source }) => isJorgeXPiSource(source));
-  const exactSources = matchingSources.filter(({ source }) => source === input.candidate.package.source);
-  if (exactSources.length > 1) return blocked(input, "duplicate-package");
-  if (matchingSources.some(({ source }) => source !== input.candidate.package.source)) {
-    return blocked(input, "source-divergent");
+function cleanupTmp(dir) {
+  try {
+    fs21.rmSync(dir, { recursive: true, force: true });
+  } catch {
   }
-  let receipt = null;
-  if (input.receiptJson !== null) {
-    const parsedReceipt = parseReceipt(input.receiptJson, input.candidate, {
-      kind: input.scope.kind,
-      codingAgentDir: path29.resolve(input.scope.codingAgentDir)
-    }, input.engramBin);
-    if (parsedReceipt === "upgrade-required") return blocked(input, "receipt-upgrade-required");
-    if (parsedReceipt === null) return blocked(input, "receipt-corrupt");
-    receipt = parsedReceipt;
-    if (receipt.state === "installing") return blocked(input, "partial-state");
-    const exactSource = exactSources[0];
-    if (exactSources.length !== 1 || exactSource === void 0 || !isExactManagedPackage(exactSource.entry, input.candidate.package.source)) {
-      return blocked(input, "source-divergent");
+}
+function updateStackGitClone() {
+  const projectRoot = path29.dirname(stackRoot());
+  const git = lookPath("git");
+  if (!git) throw new Error("git no encontrado en PATH.");
+  const pnpm = resolvePnpm();
+  p4.log.info("Ejecutando git pull\u2026");
+  execFileSync5(git, ["pull"], { cwd: projectRoot, stdio: "inherit" });
+  p4.log.info("Ejecutando pnpm install\u2026");
+  execFileSync5(pnpm, ["install"], { cwd: projectRoot, stdio: "inherit" });
+  p4.log.info("Ejecutando pnpm build\u2026");
+  execFileSync5(pnpm, ["build"], { cwd: projectRoot, stdio: "inherit" });
+}
+function updateStackGlobal() {
+  const pnpm = resolvePnpm();
+  p4.log.info("Ejecutando pnpm add -g jorgex-stack@latest\u2026");
+  execFileSync5(pnpm, ["add", "-g", "jorgex-stack@latest"], { stdio: "inherit" });
+}
+async function downloadSkillToTemp(repo, sha, skillPath) {
+  const root = fs21.mkdtempSync(path29.join(os4.tmpdir(), "jorgex-skill-"));
+  try {
+    const result = await downloadRepoTarball(repo, sha, root, skillPath);
+    if (!result.ok) {
+      cleanupTmp(root);
+      return { error: result.reason };
     }
+    if (skillPath) {
+      const sub = path29.resolve(path29.join(root, skillPath));
+      if (!isContainedIn(sub, root)) {
+        cleanupTmp(root);
+        return { error: `la ruta "${skillPath}" escapa del directorio temporal` };
+      }
+      if (fs21.existsSync(sub)) return { dir: sub, root };
+      const lastSeg = skillPath.split("/").pop();
+      const sub2 = path29.resolve(path29.join(root, lastSeg));
+      if (isContainedIn(sub2, root) && fs21.existsSync(sub2)) {
+        if (!validateExtractedTree(sub2)) {
+          cleanupTmp(root);
+          return { error: `el sub\xE1rbol "${lastSeg}" contiene symlinks o rutas fuera del destino` };
+        }
+        return { dir: sub2, root };
+      }
+      cleanupTmp(root);
+      return { error: `la ruta "${skillPath}" no existe en el tarball del upstream` };
+    }
+    return { dir: root, root };
+  } catch (err) {
+    cleanupTmp(root);
+    return { error: err instanceof Error ? err.message : "error desconocido" };
   }
-  if (exactSources.length === 1 && receipt === null) {
-    return {
-      kind: "manual-existing",
-      receiptPath: input.scope.receiptPath,
-      ownership: ownership(false)
-    };
-  }
-  if (exactSources.length === 1 && receipt !== null) {
-    return {
-      kind: "ready",
-      receiptPath: input.scope.receiptPath,
-      ownership: ownership(true)
-    };
-  }
-  return {
-    kind: "install",
-    receiptPath: input.scope.receiptPath,
-    invocation: {
-      executable: input.pi.executable,
-      args: ["install", input.candidate.package.source, "--no-approve"],
-      environment: input.scope.environment
-    },
-    receipt: expectedReceipt(input.candidate, "installing", {
-      kind: input.scope.kind,
-      codingAgentDir: path29.resolve(input.scope.codingAgentDir)
-    }, input.engramBin),
-    ownership: ownership(true)
-  };
 }
-function parseRunnerRecord(stdout, stderr, command, candidate, packageRunner) {
-  if (stderr !== "" || !stdout.endsWith("\n") || Buffer.byteLength(stdout) > candidate.contract.runner.maxStdoutBytes) {
-    return null;
-  }
-  const body = stdout.slice(0, -1);
-  if (body === "" || body.includes("\n") || body.includes("\r")) return null;
+function pruneEngramDbBackups() {
   try {
-    const parsed = JSON.parse(body);
-    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
-    const record = parsed;
-    if (record.schemaVersion !== candidate.contract.runner.schemaVersion || record.command !== command || record.ok !== true || record.package === null || typeof record.package !== "object" || record.package.name !== candidate.package.name || record.package.version !== candidate.package.version || typeof record.package.root !== "string" || !path29.isAbsolute(record.package.root) || path29.resolve(packageRunner) !== path29.resolve(record.package.root, "bin", "jorgex-pi.mjs")) {
-      return null;
+    const dir = dataDir();
+    if (!fs21.existsSync(dir)) return;
+    const backups = fs21.readdirSync(dir).filter((f) => f.startsWith("engram-db-backup-") && f.endsWith(".db")).map((f) => ({ name: f, mtime: fs21.statSync(path29.join(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime);
+    for (const old of backups.slice(3)) {
+      try {
+        fs21.rmSync(path29.join(dir, old.name));
+      } catch {
+      }
     }
-    return record;
   } catch {
-    return null;
   }
 }
-function runPackageCommand(input, deps, command) {
-  const result = deps.run({
-    executable: input.packageRunner,
-    args: [command, "--json"],
-    environment: input.environment
-  });
-  if (result.exitCode !== 0) return { kind: "blocked", reason: "runner-unhealthy" };
-  return parseRunnerRecord(result.stdout, result.stderr, command, input.candidate, input.packageRunner) ?? { kind: "blocked", reason: "runner-output" };
-}
-function isBlockedResult(value) {
-  return "kind" in value;
-}
-function executePiPackageLifecycle(input, deps) {
-  if (input.plan.kind === "manual-existing") return { kind: "manual-existing" };
-  if (input.operation === "install") {
-    if (input.plan.kind !== "install" || input.plan.receipt === void 0 || input.plan.invocation === void 0) {
-      return { kind: "blocked", reason: "runner-unhealthy" };
-    }
-    deps.writeReceipt(input.plan.receipt);
-    const installed = deps.run(input.plan.invocation);
-    if (installed.exitCode !== 0 || installed.stderr !== "") {
-      return { kind: "blocked", reason: "pi-install-failed" };
+function rotateLockedBinary(binPath, sweepRoot = HOME) {
+  if (!fs21.existsSync(binPath)) return null;
+  const dir = path29.dirname(binPath);
+  const base = path29.basename(binPath);
+  const escapedBase = base.replace(/[.*+?^$()|[\]{}\\]/g, "\\$&");
+  const oldPattern = new RegExp("^" + escapedBase + "\\.old-\\d+$");
+  const resolvedDir = path29.resolve(dir);
+  if (resolvedDir === path29.resolve(sweepRoot) || isContainedIn(resolvedDir, sweepRoot)) {
+    try {
+      for (const entry of fs21.readdirSync(dir)) {
+        if (oldPattern.test(entry)) {
+          try {
+            fs21.rmSync(path29.join(dir, entry), { force: true });
+          } catch {
+          }
+        }
+      }
+    } catch {
+    }
+  }
+  const rotated = path29.join(dir, `${base}.old-${Date.now()}`);
+  fs21.renameSync(binPath, rotated);
+  return rotated;
+}
+async function updateEngram(engramRepo, latestVersion) {
+  if (isEngramRunning()) {
+    p4.log.info(
+      "Engram est\xE1 en ejecuci\xF3n: los procesos vivos seguir\xE1n usando la versi\xF3n antigua hasta que reinicies los clientes (Claude Code/OpenCode/Codex)."
+    );
+  }
+  const engramDataDir = process.env.ENGRAM_DATA_DIR ?? path29.join(HOME, ".engram");
+  const engramDb = path29.join(engramDataDir, "engram.db");
+  if (fs21.existsSync(engramDb)) {
+    const doBackup = await p4.confirm({
+      message: `\xBFHacer backup de la DB de Engram antes de actualizar? (${engramDb})`,
+      initialValue: true
+    });
+    if (!p4.isCancel(doBackup) && doBackup) {
+      const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+      const dest = path29.join(dataDir(), `engram-db-backup-${ts}.db`);
+      try {
+        if (!fs21.existsSync(dataDir())) fs21.mkdirSync(dataDir(), { recursive: true });
+        fs21.copyFileSync(engramDb, dest);
+        p4.log.success(`DB respaldada en ${dest} (la DB original NO se modifica jam\xE1s).`);
+        pruneEngramDbBackups();
+      } catch (err) {
+        p4.log.warn(`No se pudo copiar la DB: ${err instanceof Error ? err.message : err}. Continuando sin backup.`);
+      }
+    }
+  }
+  let anyChannelTried = false;
+  const brew = lookPath("brew");
+  if (brew) {
+    let brewManages = false;
+    try {
+      execFileSync5(brew, ["list", "engram"], { stdio: "pipe" });
+      brewManages = true;
+    } catch {
+    }
+    if (brewManages) {
+      anyChannelTried = true;
+      p4.log.info("Actualizando engram con brew\u2026");
+      try {
+        execFileSync5(brew, ["upgrade", "engram"], { stdio: "inherit" });
+        return true;
+      } catch (err) {
+        p4.log.error(`brew upgrade engram fall\xF3: ${err instanceof Error ? err.message : err}`);
+        return false;
+      }
+    }
+  }
+  const go = lookPath("go");
+  if (go) {
+    anyChannelTried = true;
+    let rotated = null;
+    const bin = detectEngram();
+    if (process.platform === "win32" && bin) {
+      try {
+        rotated = rotateLockedBinary(bin);
+      } catch (err) {
+        p4.log.warn(
+          `No se pudo rotar el binario en uso: ${err instanceof Error ? err.message : err}. go install puede fallar por bloqueo.`
+        );
+      }
+    }
+    p4.log.info(`Actualizando engram con go install (${latestVersion})\u2026`);
+    try {
+      execFileSync5(
+        go,
+        ["install", `github.com/Gentleman-Programming/engram/cmd/engram@v${latestVersion}`],
+        { stdio: "inherit" }
+      );
+      const rollbackOk = resolveEngramRollback({ installOk: true, rotated, bin, binExists: fs21.existsSync(bin ?? "") });
+      if (rollbackOk.action === "restore") {
+        try {
+          fs21.renameSync(rotated, bin);
+          p4.log.warn(rollbackOk.messages.onRestore);
+        } catch {
+          p4.log.warn(rollbackOk.messages.onRenameFail);
+        }
+      }
+      return true;
+    } catch (err) {
+      const rollbackFail = resolveEngramRollback({ installOk: false, rotated, bin, binExists: fs21.existsSync(bin ?? "") });
+      if (rollbackFail.action === "restore") {
+        try {
+          fs21.renameSync(rotated, bin);
+          p4.log.info(rollbackFail.messages.onRestore);
+        } catch {
+          p4.log.error(rollbackFail.messages.onRenameFail);
+        }
+      } else if (rollbackFail.action === "leave_old") {
+        p4.log.warn(rollbackFail.messages.onLeaveOld);
+      }
+      p4.log.error(`go install fall\xF3: ${err instanceof Error ? err.message : err}`);
+      return false;
+    }
+  }
+  if (anyChannelTried) {
+    p4.log.error(
+      `Los canales de actualizaci\xF3n disponibles fallaron \u2014 revisa el error arriba; descarga manual: github.com/${engramRepo}/releases/tag/v${latestVersion}`
+    );
+  } else {
+    p4.log.warn(
+      `No se encontr\xF3 brew ni go en PATH.
+  Descarga manual: github.com/${engramRepo}/releases/tag/v${latestVersion}`
+    );
+  }
+  return false;
+}
+function resolveEngramRollback(input) {
+  const { installOk, rotated, bin, binExists } = input;
+  if (!rotated || !bin) return { action: "none" };
+  if (installOk && !binExists) {
+    return {
+      action: "restore",
+      messages: {
+        onRestore: `go install instal\xF3 en otra ruta (GOBIN distinto); el binario activo en ${bin} se ha restaurado. Comprueba qu\xE9 engram resuelve tu PATH.`,
+        onRenameFail: `go install instal\xF3 en otra ruta y no se pudo restaurar ${bin}; tu binario anterior est\xE1 en ${rotated}.`
+      }
+    };
+  }
+  if (!installOk && !binExists) {
+    return {
+      action: "restore",
+      messages: {
+        onRestore: "Rotaci\xF3n revertida \u2014 el binario anterior sigue en su sitio.",
+        onRenameFail: `No se pudo revertir la rotaci\xF3n: tu binario anterior est\xE1 en ${rotated} \u2014 ren\xF3mbralo a ${bin} a mano.`
+      }
+    };
+  }
+  if (!installOk && binExists) {
+    return {
+      action: "leave_old",
+      messages: {
+        onLeaveOld: `El install fall\xF3 pero dej\xF3 un binario en ${bin}; tu copia anterior queda en ${rotated}.`
+      }
+    };
+  }
+  return { action: "none" };
+}
+function buildEligibleSkillUpdates(skills) {
+  const result = [];
+  for (const { name, repo, info, head } of skills) {
+    if (info.kind === "release") continue;
+    const pinned = info.commit;
+    if (!pinned) continue;
+    if (head === null) continue;
+    if (head === pinned) continue;
+    result.push({
+      name,
+      repo,
+      head,
+      pinned,
+      skillPath: info.path,
+      modified: info.modified ?? false
+    });
+  }
+  return result;
+}
+function hasIncompleteSkillScan(skills) {
+  return skills.some(({ info, head }) => info.kind !== "release" && (!info.commit || head === null));
+}
+function resolveUpdateSyncRequired(updated) {
+  return updated.some((item) => item === "stack" || item === "skill" || item.startsWith("skill:"));
+}
+async function runInteractiveUpdate(localVersion, yes, dryRun = false, includeBrowserState = true) {
+  if (dryRun || yes || !process.stdout.isTTY) {
+    return { exitCode: await runUpdateCheck(localVersion, includeBrowserState), appliedUpdates: false, syncRequired: false };
+  }
+  p4.intro("jorgex-stack update");
+  if (includeBrowserState) {
+    const preferenceErrors = browserPreferenceErrors();
+    if (preferenceErrors.length > 0) {
+      for (const error of preferenceErrors) p4.log.error(error);
+      p4.outro("Update cancelado: corrige las preferencias de navegador antes de reintentar.");
+      return { exitCode: 1, appliedUpdates: false, syncRequired: false };
+    }
+  }
+  const upstreams = loadUpstreams();
+  let exitCode = 0;
+  let appliedUpdates = false;
+  const updated = [];
+  const maintainer = isGitClone();
+  const spin = p4.spinner();
+  spin.start("Consultando versiones upstream\u2026");
+  const skillNames = skillsToScan(maintainer, upstreams);
+  const [npmLatest, engramLatestRaw, skillHeads] = await Promise.all([
+    latestNpmVersion("jorgex-stack"),
+    (async () => {
+      const repo = upstreams.tools["engram"]?.source.replace(/^github:/, "");
+      if (!repo) return null;
+      return { repo, version: await latestGithubRelease(repo) };
+    })(),
+    querySkillHeads(skillNames, upstreams)
+  ]);
+  spin.stop("Consulta completada.");
+  if (githubRateLimited()) {
+    p4.log.warn(rateLimitHint("GitHub limit\xF3 algunas consultas \u2014 los upstreams 'sin conexi\xF3n' pueden ser eso."));
+  }
+  const updateItems = [];
+  const engramData = engramLatestRaw;
+  let stackNeedsUpdate = false;
+  if (npmLatest === null) {
+    p4.log.info(`jorgex-stack: v${localVersion} local (a\xFAn no publicado en npm o sin red).`);
+  } else if (npmLatest === localVersion) {
+    p4.log.success(`jorgex-stack: v${localVersion} \u2014 al d\xEDa.`);
+  } else {
+    stackNeedsUpdate = true;
+    const mode = maintainer ? STACK_METHOD_CLONE : `pnpm add -g jorgex-stack@${npmLatest}`;
+    updateItems.push({
+      value: "stack",
+      label: `jorgex-stack: v${localVersion} \u2192 v${npmLatest}`,
+      hint: mode
+    });
+  }
+  let engramNeedsUpdate = false;
+  let engramLocalVersion = null;
+  if (engramData) {
+    const engramBinLocal = detectEngram();
+    engramLocalVersion = engramBinLocal ? engramVersion(engramBinLocal) : null;
+    if (engramLocalVersion === null) {
+      p4.log.warn("engram: no detectado en esta m\xE1quina.");
+    } else if (engramData.version === null) {
+      p4.log.info(`engram: ${engramLocalVersion} local (no se pudo consultar el upstream).`);
+    } else if (engramData.version === engramLocalVersion) {
+      p4.log.success(`engram: ${engramLocalVersion} \u2014 al d\xEDa.`);
+    } else {
+      engramNeedsUpdate = true;
+      updateItems.push({
+        value: "engram",
+        label: `engram: ${engramLocalVersion} \u2192 ${engramData.version}`,
+        hint: "canal nativo (brew \u2192 go install \u2192 URL)"
+      });
+    }
+  }
+  let playwrightNeedsUpdate = false;
+  if (includeBrowserState && loadPlaywrightCliPreference() === true) {
+    const playwright = detectPlaywrightCli();
+    if (playwright.status === "current") {
+      p4.log.success("Playwright CLI: al d\xEDa.");
+    } else {
+      playwrightNeedsUpdate = true;
+      const current = playwright.detectedVersion ?? playwright.status;
+      updateItems.push({
+        value: "playwright-cli",
+        label: `Playwright CLI: ${current} \u2192 pin aprobado`,
+        hint: "pnpm add --global @playwright/cli@0.1.18"
+      });
+    }
+  }
+  const typedSkillHeads = skillHeads;
+  for (const { name, repo, info, head } of typedSkillHeads) {
+    if (info.kind === "release") {
+      if (head !== null && info.commit && head !== info.commit) {
+        p4.log.warn(`${name} (release): upstream se movi\xF3. Revisa: github.com/${repo}/releases`);
+      }
+      continue;
+    }
+    const label = info.modified ? `${name} (modificada localmente)` : name;
+    const pinned = info.commit;
+    if (!pinned) {
+      p4.log.warn(`${label}: sin pin \u2014 no se puede actualizar.`);
+    } else if (head === null) {
+      p4.log.info(`${label}: sin conexi\xF3n al upstream.`);
+    } else if (head === pinned) {
+      p4.log.success(`${label}: al d\xEDa (pin ${pinned.slice(0, 7)}).`);
+    }
+  }
+  if (!maintainer) {
+    p4.log.info(
+      "Skills de terceros: pineadas con esta versi\xF3n del stack \u2014 su revisi\xF3n upstream se hace desde el clon del repo."
+    );
+  }
+  const skillUpdates = buildEligibleSkillUpdates(typedSkillHeads);
+  for (const skillInfo of skillUpdates) {
+    const modifiedWarning = skillInfo.modified ? " \u26A0 modificada localmente" : "";
+    updateItems.push({
+      value: `skill:${skillInfo.name}`,
+      label: `skill ${skillInfo.name}: ${skillInfo.pinned.slice(0, 7)} \u2192 ${skillInfo.head.slice(0, 7)}${modifiedWarning}`,
+      hint: `github.com/${skillInfo.repo}/compare/${skillInfo.pinned.slice(0, 7)}...${skillInfo.head.slice(0, 7)}`
+    });
+  }
+  if (updateItems.length === 0) {
+    if (maintainer && hasIncompleteSkillScan(typedSkillHeads)) {
+      p4.outro("Escaneo incompleto: no se pudo comprobar el estado de todas las skills.");
+      return { exitCode: 1, appliedUpdates: false, syncRequired: false };
+    }
+    p4.outro("Todo al d\xEDa. No hay actualizaciones disponibles.");
+    return { exitCode: 0, appliedUpdates: false, syncRequired: false };
+  }
+  const selected = await p4.multiselect({
+    message: "Selecciona qu\xE9 actualizar (espacio para marcar, intro para confirmar):",
+    options: updateItems,
+    initialValues: updateItems.map((i) => i.value),
+    required: false
+  });
+  if (p4.isCancel(selected)) {
+    p4.outro("Update cancelado.");
+    return { exitCode: 0, appliedUpdates: false, syncRequired: false };
+  }
+  if (selected.length === 0) {
+    p4.outro("Nada seleccionado.");
+    return { exitCode: 0, appliedUpdates: false, syncRequired: false };
+  }
+  const sel = selected;
+  if (stackNeedsUpdate && sel.includes("stack")) {
+    const isClone = isGitClone();
+    const method = isClone ? STACK_METHOD_CLONE : "pnpm add -g jorgex-stack@latest";
+    const confirm5 = await p4.confirm({
+      message: `Actualizar el stack con: ${method}`,
+      initialValue: true
+    });
+    if (p4.isCancel(confirm5) || !confirm5) {
+      p4.log.info("Stack: actualizaci\xF3n omitida.");
+    } else {
+      try {
+        if (isClone) {
+          updateStackGitClone();
+        } else {
+          updateStackGlobal();
+        }
+        p4.log.success("Stack actualizado correctamente.");
+        appliedUpdates = true;
+        updated.push("stack");
+      } catch (err) {
+        p4.log.error(`Stack: error al actualizar \u2014 ${err instanceof Error ? err.message : err}`);
+        exitCode = 1;
+      }
     }
-    const doctor = runPackageCommand(input, deps, "doctor");
-    if (isBlockedResult(doctor)) return doctor;
-    const doctorResult = doctor.result;
-    if (doctorResult === null || typeof doctorResult !== "object" || Reflect.get(doctorResult, "healthy") !== true) {
-      return { kind: "blocked", reason: "runner-unhealthy" };
+  }
+  for (const skillInfo of skillUpdates) {
+    if (!sel.includes(`skill:${skillInfo.name}`)) continue;
+    if (skillInfo.modified) {
+      p4.log.warn(
+        `skill ${skillInfo.name}: TIENE CAMBIOS LOCALES. Actualizar sobreescribir\xE1 esas modificaciones (backup autom\xE1tico).`
+      );
+      const forceConfirm = await p4.confirm({
+        message: `\xBFConfirmas sobreescribir los cambios locales de ${skillInfo.name}?`,
+        initialValue: false
+      });
+      if (p4.isCancel(forceConfirm) || !forceConfirm) {
+        p4.log.info(`skill ${skillInfo.name}: omitida.`);
+        continue;
+      }
+    }
+    const spin2 = p4.spinner();
+    spin2.start(`Descargando upstream de ${skillInfo.name}\u2026`);
+    const tmpResult = await downloadSkillToTemp(skillInfo.repo, skillInfo.head, skillInfo.skillPath);
+    spin2.stop("error" in tmpResult ? "Error de descarga." : "Descargado.");
+    if ("error" in tmpResult) {
+      p4.log.error(`skill ${skillInfo.name}: descarga fallida \u2014 ${tmpResult.error}. Omitiendo.`);
+      exitCode = 1;
+      continue;
+    }
+    const { dir: tmpDir, root: tmpRoot } = tmpResult;
+    const localSkillDir = path29.join(stackRoot(), "skills", skillInfo.name);
+    const diff = renderSkillDiff(tmpDir, localSkillDir);
+    if (diff) {
+      p4.log.info(`Diff de ${skillInfo.name}:
+${diff}`);
+    } else {
+      p4.log.info(`${skillInfo.name}: sin cambios en contenido (el repo se movi\xF3 pero la skill no cambi\xF3).`);
+      cleanupTmp(tmpRoot);
+      continue;
+    }
+    const applySkill = await p4.confirm({
+      message: `\xBFAplicar la actualizaci\xF3n de ${skillInfo.name}?`,
+      // Default No — política deliberate-pin (el diff es de contenido)
+      initialValue: false
+    });
+    if (p4.isCancel(applySkill) || !applySkill) {
+      p4.log.info(`skill ${skillInfo.name}: omitida.`);
+      cleanupTmp(tmpRoot);
+      continue;
+    }
+    try {
+      replaceSkill(skillInfo.name, tmpDir, skillInfo.head, {});
+      p4.log.success(`skill ${skillInfo.name}: actualizada y re-pineada a ${skillInfo.head.slice(0, 7)}.`);
+      appliedUpdates = true;
+      updated.push("skill");
+    } catch (err) {
+      p4.log.error(`skill ${skillInfo.name}: error \u2014 ${err instanceof Error ? err.message : err}`);
+      exitCode = 1;
+    } finally {
+      cleanupTmp(tmpRoot);
     }
-    const receipt = { ...input.plan.receipt, state: "installed" };
-    deps.writeReceipt(receipt);
-    return { kind: "installed", receipt };
   }
-  if (input.plan.kind !== "ready") return { kind: "blocked", reason: "runner-unhealthy" };
-  const command = runPackageCommand(input, deps, input.operation);
-  if (isBlockedResult(command)) return command;
-  if (input.operation === "sync") {
-    const result = command.result;
-    if (result === null || typeof result !== "object" || Reflect.get(result, "changed") !== false) {
-      return { kind: "blocked", reason: "runner-unhealthy" };
+  if (playwrightNeedsUpdate && sel.includes("playwright-cli")) {
+    const confirmPlaywright = await p4.confirm({
+      message: "Actualizar Playwright CLI global al pin aprobado con pnpm add --global?",
+      initialValue: true
+    });
+    if (p4.isCancel(confirmPlaywright) || !confirmPlaywright) {
+      p4.log.info("Playwright CLI: actualizaci\xF3n omitida.");
+    } else {
+      const packageResult = executePlaywrightToolAction2("update");
+      const browserResult = packageResult.ok ? executePlaywrightToolAction2("install-browser") : null;
+      if (packageResult.ok && browserResult?.ok) {
+        p4.log.success("Playwright CLI actualizado al pin aprobado.");
+        appliedUpdates = true;
+        updated.push("playwright-cli");
+      } else {
+        const failedResult = packageResult.ok ? browserResult : packageResult;
+        const pnpmRemedy = failedResult && !failedResult.ok ? resolvePnpmFailureRemedy(failedResult.reason) : null;
+        const recovery = pnpmRemedy === null ? "Ejecuta 'jorgex-stack install --playwright' para reintentar el paquete y el navegador." : `${pnpmRemedy} Despu\xE9s, ejecuta 'jorgex-stack update' para reintentar.`;
+        const failedStep = packageResult.ok ? "descargar el navegador" : "actualizar el paquete global";
+        p4.log.error(`Playwright CLI: no se pudo ${failedStep}. ${recovery}`);
+        exitCode = 1;
+      }
     }
-    return { kind: "synced", actions: [] };
   }
-  const models = command.result;
-  if (models === null || typeof models !== "object" || Reflect.get(models, "mode") !== "inherit-session" || !sameRecord(Reflect.get(models, "tiers"), ["strong", "standard", "cheap"])) {
-    return { kind: "blocked", reason: "runner-unhealthy" };
+  if (engramNeedsUpdate && sel.includes("engram") && engramData?.version) {
+    const confirmEngram = await p4.confirm({
+      message: `Actualizar engram a v${engramData.version} (canal nativo: brew \u2192 go install \u2192 URL)`,
+      initialValue: true
+    });
+    if (p4.isCancel(confirmEngram) || !confirmEngram) {
+      p4.log.info("Engram: actualizaci\xF3n omitida.");
+    } else {
+      const ok = await updateEngram(engramData.repo, engramData.version);
+      if (!ok) {
+        exitCode = 1;
+      } else {
+        const binPost = detectEngram();
+        const versionPost = binPost ? engramVersion(binPost) : null;
+        if (versionPost) {
+          p4.log.success(`Engram: ahora en v${versionPost}.`);
+        } else {
+          p4.log.warn("Engram actualizado, pero no se pudo verificar la versi\xF3n \u2014 comprueba con engram --version");
+        }
+        p4.log.info("Reinicia los clientes (Claude Code/OpenCode/Codex) para que sus MCP usen la versi\xF3n nueva.");
+        appliedUpdates = true;
+        updated.push("engram");
+      }
+    }
   }
-  return { kind: "models", models: { mode: "inherit-session", tiers: ["strong", "standard", "cheap"] } };
+  p4.outro(exitCode === 0 ? "Update completado." : "Update completado con errores (revisa arriba).");
+  return { exitCode, appliedUpdates, syncRequired: resolveUpdateSyncRequired(updated) };
 }
-function receiptUpgradeRequired() {
-  return {
-    kind: "blocked",
-    reason: "receipt-upgrade-required",
-    remedy: "El receipt no enlaza Engram; usa la versi\xF3n anterior de Stack para desinstalarlo y luego reinstala."
-  };
+
+// src/models-picker.ts
+import path30 from "path";
+import * as p5 from "@clack/prompts";
+var TIERS = ["strong", "standard", "cheap"];
+var EFFORTS = ["low", "medium", "high", "xhigh"];
+var CLAUDE_ALIASES = ["fable", "opus", "sonnet", "haiku", "inherit"];
+var CODEX_MODELS = [
+  "default",
+  "gpt-5.6-sol",
+  "gpt-5.6-terra",
+  "gpt-5.6-luna",
+  "gpt-5.5",
+  "gpt-5.4",
+  "gpt-5.4-mini"
+];
+var CODEX_CUSTOM = "__custom__";
+var CANCEL = /* @__PURE__ */ Symbol("cancel");
+function opencodeLiveModels(binPath) {
+  const out = runDetectedBin(binPath, ["models"], 2e4);
+  if (out === null) return null;
+  const models = out.split(/\r?\n/).map((l) => l.trim()).filter((l) => l !== "" && l.includes("/"));
+  return models.length > 0 ? models : null;
+}
+function agentsByTier() {
+  const grouped = { strong: [], standard: [], cheap: [] };
+  for (const agent of loadCanonicalAgents(path30.join(stackRoot(), "agents"))) {
+    if (agent.mode === "subagent") grouped[agent.tier].push(agent.name);
+  }
+  return grouped;
+}
+function isCompleteRuntimeModelMap(models) {
+  return TIERS.every((tier) => models[tier]?.model);
+}
+async function askModel(det, subject, current) {
+  if (det.id === "codex") {
+    if (!current) throw new Error("Codex requiere un model-map base.");
+    const effort = await p5.select({
+      message: `${det.name} \xB7 ${subject} \u2014 reasoning effort`,
+      options: EFFORTS.map((v) => ({ value: v, label: v })),
+      initialValue: current.variant ?? "medium"
+    });
+    if (p5.isCancel(effort)) return CANCEL;
+    const modelOptions = [
+      ...CODEX_MODELS.includes(current.model) ? [] : [{ value: current.model, label: `${current.model} (actual)` }],
+      ...CODEX_MODELS.map((m) => ({
+        value: m,
+        label: m === "default" ? "default \u2014 el del CLI, se actualiza solo (recomendado)" : m
+      })),
+      { value: CODEX_CUSTOM, label: "otro\u2026 (escribir un ID a mano)" }
+    ];
+    let model = await p5.select({
+      message: `${det.name} \xB7 ${subject} \u2014 modelo`,
+      options: modelOptions,
+      initialValue: current.model
+    });
+    if (p5.isCancel(model)) return CANCEL;
+    if (model === CODEX_CUSTOM) {
+      const typed = await p5.text({
+        message: `${det.name} \xB7 ${subject} \u2014 ID exacto del modelo (min\xFAsculas; compru\xE9balo con /model dentro de codex)`,
+        initialValue: current.model,
+        validate: (v) => !v || v.trim() === "" ? 'Vac\xEDo no \u2014 usa "default" o un ID.' : void 0
+      });
+      if (p5.isCancel(typed)) return CANCEL;
+      model = typed.trim().toLowerCase();
+    }
+    return { model, variant: effort };
+  }
+  const optionsList = det.options;
+  const options = optionsList.map((m) => ({ value: m, label: m }));
+  if (current && !optionsList.includes(current.model)) {
+    options.unshift({ value: current.model, label: `${current.model} (actual)` });
+  }
+  const choice = await p5.select({
+    message: `${det.name} \xB7 ${subject} \u2014 modelo`,
+    options,
+    initialValue: current?.model,
+    maxItems: 12
+  });
+  if (p5.isCancel(choice)) return CANCEL;
+  if (det.id === "claude-code") return { model: choice };
+  const keptCurrent = current && choice === current.model && current.variant ? current.variant : null;
+  const variant = await p5.select({
+    message: `${det.name} \xB7 ${subject} \u2014 reasoning effort (variant; solo si el modelo lo soporta)`,
+    options: [
+      { value: "", label: "(sin variant \u2014 el default del modelo)" },
+      ...EFFORTS.map((v) => ({ value: v, label: v })),
+      ...keptCurrent && !EFFORTS.includes(keptCurrent) ? [{ value: keptCurrent, label: `${keptCurrent} (actual)` }] : []
+    ],
+    initialValue: keptCurrent ?? ""
+  });
+  if (p5.isCancel(variant)) return CANCEL;
+  return { model: choice, ...variant ? { variant } : {} };
 }
-function validateOwnedOperationState(input) {
-  const sources = parsePackageSources(input.detected.settingsJson);
-  if (sources === null) return { kind: "blocked", reason: "settings-corrupt" };
-  const matchingSources = sources.filter(({ source: source2 }) => isJorgeXPiSource(source2));
-  if (matchingSources.length > 1) return { kind: "blocked", reason: "duplicate-package" };
-  if (input.receiptJson === null) {
-    return { kind: "blocked", reason: matchingSources.length === 1 ? "manual-existing" : "source-divergent" };
+async function runModelsPicker(opts) {
+  const file = ensureModelMapFile();
+  const map = loadModelMap();
+  if (opts.yes || !process.stdout.isTTY) {
+    if (opts.runtimes.includes("opencode") && !map.opencode) {
+      console.error("OpenCode requiere selecci\xF3n interactiva desde los proveedores conectados; ejecuta 'models --agents opencode' sin --yes.");
+      return 1;
+    }
+    console.log(`Model-map en ${file}. Ed\xEDtalo o ejecuta 'models' sin --yes para el picker.`);
+    return 0;
   }
-  const parsedReceipt = parseReceiptShape(input.receiptJson);
-  if (parsedReceipt === "upgrade-required") return receiptUpgradeRequired();
-  if (parsedReceipt === null) return { kind: "blocked", reason: "receipt-corrupt" };
-  const receipt = parsedReceipt;
-  if (receipt.state !== "installed") return { kind: "blocked", reason: "partial-state" };
-  const accepted = input.registry.acceptedCandidates ?? [input.registry.candidate];
-  if (!accepted.some((candidate) => sameRecord(receipt.candidate, {
-    package: candidate.package,
-    tarball: candidate.tarball,
-    provenance: candidate.provenance
-  }))) {
-    return { kind: "blocked", reason: "receipt-untrusted" };
+  p5.intro("jorgex-stack models \u2014 modelos por tier o por subagente");
+  const grouped = agentsByTier();
+  const tierLine = (tier) => grouped[tier].join(", ");
+  const agentCount = TIERS.reduce((n, tier) => n + grouped[tier].length, 0);
+  const detections = [];
+  if (opts.runtimes.includes("opencode")) {
+    const opencode = detectOpenCode();
+    detections.push({
+      id: "opencode",
+      name: "OpenCode",
+      installed: opencode.installed,
+      options: opencode.binPath ? opencodeLiveModels(opencode.binPath) : null
+    });
   }
-  if (receipt.scope.kind !== (input.paths.targetDir ? "target-dir" : "real") || path29.resolve(receipt.scope.codingAgentDir) !== path29.resolve(input.paths.codingAgentDir)) {
-    return { kind: "blocked", reason: "source-divergent" };
+  if (opts.runtimes.includes("claude-code")) {
+    detections.push({ id: "claude-code", name: "Claude Code", installed: detectClaudeCode().installed, options: CLAUDE_ALIASES });
   }
-  if (input.engramBin !== null && path29.resolve(receipt.engram.binary) !== path29.resolve(input.engramBin)) {
-    return { kind: "blocked", reason: "receipt-corrupt" };
+  if (opts.runtimes.includes("codex")) {
+    detections.push({ id: "codex", name: "Codex CLI", installed: detectCodex().installed, options: null });
   }
-  const source = receipt.candidate.package.source;
-  const matchingSource = matchingSources[0];
-  if (matchingSources.length !== 1 || matchingSource === void 0 || matchingSource.source !== source || !isExactManagedPackage(matchingSource.entry, source)) {
-    return { kind: "blocked", reason: "source-divergent" };
+  for (const det of detections) {
+    if (!det.installed) {
+      p5.log.info(`${det.name}: no instalado \u2014 se mantienen los defaults.`);
+      continue;
+    }
+    if (det.id === "opencode" && det.options === null) {
+      p5.log.warn("OpenCode: no se pudo listar `opencode models` \u2014 se mantiene la selecci\xF3n actual.");
+      continue;
+    }
+    const existingRuntimeMap = map[det.id];
+    const runtimeMap = {
+      ...existingRuntimeMap
+    };
+    p5.log.message(
+      `${det.name} \u2014 tiers y sus subagentes:
+  strong   \u2192 ${tierLine("strong")}
+  standard \u2192 ${tierLine("standard")}
+  cheap    \u2192 ${tierLine("cheap")}`
+    );
+    const mode = await p5.select({
+      message: `${det.name} \u2014 \xBFc\xF3mo asignar los modelos?`,
+      options: [
+        { value: "tier", label: "Por tier \u2014 3 grupos (r\xE1pido)" },
+        { value: "agent", label: `Por subagente \u2014 uno a uno (${agentCount} subagentes, control total)` }
+      ],
+      initialValue: "tier"
+    });
+    if (p5.isCancel(mode)) return cancelled();
+    if (mode === "tier") {
+      for (const tier of TIERS) {
+        const asked = await askModel(det, `tier ${tier} (${tierLine(tier)})`, existingRuntimeMap?.[tier]);
+        if (asked === CANCEL) return cancelled();
+        runtimeMap[tier] = asked;
+      }
+      const overrideCount = Object.keys(runtimeMap.overrides ?? {}).length;
+      if (overrideCount > 0) {
+        p5.log.info(
+          `${det.name}: se conservan ${overrideCount} ajustes por subagente previos \u2014 elige "Por subagente" para revisarlos.`
+        );
+      }
+    } else {
+      const overrides = { ...runtimeMap.overrides ?? {} };
+      for (const tier of TIERS) {
+        let base = runtimeMap[tier];
+        for (const name of grouped[tier]) {
+          const current = existingRuntimeMap ? resolveAgentModel(existingRuntimeMap, name, tier) : void 0;
+          const asked = await askModel(det, `${name} (tier ${tier})`, current);
+          if (asked === CANCEL) return cancelled();
+          if (!base) {
+            base = asked;
+            runtimeMap[tier] = base;
+          }
+          const sameAsTier = asked.model === base.model && (asked.variant ?? "") === (base.variant ?? "");
+          if (sameAsTier) {
+            delete overrides[name];
+          } else {
+            overrides[name] = {
+              model: asked.model,
+              ...asked.variant ? { variant: asked.variant } : base.variant ? { variant: "" } : {}
+            };
+          }
+        }
+      }
+      if (Object.keys(overrides).length > 0) runtimeMap.overrides = overrides;
+      else delete runtimeMap.overrides;
+    }
+    if (!isCompleteRuntimeModelMap(runtimeMap)) {
+      throw new Error(`${det.name}: selecci\xF3n de modelos incompleta.`);
+    }
+    map[det.id] = runtimeMap;
   }
-  return { receipt, source };
+  writeText(file, JSON.stringify(map, null, 2) + "\n");
+  p5.log.success(`Guardado en ${file}`);
+  return 0;
 }
-function operationWasBlocked(value) {
-  return "kind" in value;
+function cancelled() {
+  p5.cancel("Cancelado \u2014 no se ha guardado nada.");
+  return 1;
 }
-function runManagedRunner(input, deps, command) {
-  const result = deps.run({
-    executable: input.detected.packageRunner,
-    args: [command, "--json"],
-    environment: input.paths.environment
-  });
-  if (result.exitCode !== 0) return { kind: "blocked", reason: "runner-unhealthy" };
-  const parsed = parseRunnerRecord(
-    result.stdout,
-    result.stderr,
-    command,
-    input.registry.candidate,
-    input.detected.packageRunner
-  );
-  return parsed ?? { kind: "blocked", reason: "runner-output" };
+
+// src/lib/release.ts
+import fs22 from "fs";
+import path31 from "path";
+import { execFileSync as execFileSync6 } from "child_process";
+import { fileURLToPath as fileURLToPath2 } from "url";
+function findPackageJson() {
+  let dir = path31.dirname(fileURLToPath2(import.meta.url));
+  for (let i = 0; i < 6; i++) {
+    const candidate = path31.join(dir, "package.json");
+    if (fs22.existsSync(candidate)) return candidate;
+    dir = path31.dirname(dir);
+  }
+  throw new Error("No se encontr\xF3 package.json cerca del CLI.");
 }
-function managedRunnerWasBlocked(value) {
-  return "kind" in value;
+function readPackageVersion() {
+  return readPackageMetadata().version;
 }
-function runPiPackageManagedOperation(input, deps) {
-  if (input.engramBin === null && input.operation !== "uninstall") {
-    return {
-      kind: "blocked",
-      reason: "engram-missing",
-      remedy: "Instala Engram o configura un ENGRAM_BIN absoluto antes de reintentar."
-    };
-  }
-  const owned = validateOwnedOperationState(input);
-  if (operationWasBlocked(owned)) return owned;
-  if (input.operation === "doctor") {
-    if (!sameRecord(owned.receipt.candidate, {
-      package: input.registry.candidate.package,
-      tarball: input.registry.candidate.tarball,
-      provenance: input.registry.candidate.provenance
-    })) {
-      return { kind: "blocked", reason: "source-divergent" };
-    }
-    const doctor = runManagedRunner(input, deps, "doctor");
-    if (managedRunnerWasBlocked(doctor)) return doctor;
-    const result = doctor.result;
-    return result !== null && typeof result === "object" && Reflect.get(result, "healthy") === true ? { kind: "healthy" } : { kind: "blocked", reason: "runner-unhealthy" };
-  }
-  if (input.operation === "uninstall") {
-    if (!sameRecord(owned.receipt.candidate, {
-      package: input.registry.candidate.package,
-      tarball: input.registry.candidate.tarball,
-      provenance: input.registry.candidate.provenance
-    })) {
-      return { kind: "blocked", reason: "source-divergent" };
-    }
-    const cleanup = runManagedRunner(input, deps, "cleanup");
-    if (managedRunnerWasBlocked(cleanup)) return cleanup;
-    deps.backupSettings();
-    const removed = deps.run({
-      executable: input.detected.executable,
-      args: ["remove", owned.source, "--no-approve"],
-      environment: input.paths.environment
-    });
-    if (removed.exitCode !== 0 || removed.stderr !== "") return { kind: "blocked", reason: "remove-failed" };
-    if (!deps.isPackageAbsent()) return { kind: "blocked", reason: "absence-unverified" };
-    deps.deleteReceipt();
-    return { kind: "uninstalled" };
+function readPackageMetadata() {
+  const packageJson = findPackageJson();
+  const raw = fs22.readFileSync(packageJson, "utf8");
+  const parsed = JSON.parse(raw);
+  const name = typeof parsed.name === "string" ? parsed.name.trim() : "";
+  const version = typeof parsed.version === "string" ? parsed.version.trim() : "";
+  if (name === "" || version === "") {
+    throw new Error("package.json no expone nombre o versi\xF3n v\xE1lidos.");
   }
-  const nextSource = input.registry.candidate.package.source;
-  if (nextSource === owned.source) return { kind: "healthy" };
-  return {
-    kind: "blocked",
-    reason: "verified-update-required",
-    remedy: "A cross-version Pi update requires verified replacement and rollback tgz artifacts."
-  };
+  return { name, version };
 }
 
 // src/lib/pi-runtime.ts
+import os5 from "os";
+import path32 from "path";
+import fs23 from "fs";
+import { spawnSync } from "child_process";
+import { createHash } from "crypto";
 var PI_RUNTIME_CANDIDATE = {
   package: {
     name: "jorgex-pi",
-    version: "0.3.0",
-    source: "npm:jorgex-pi@0.3.0"
+    version: "0.4.0",
+    source: "npm:jorgex-pi@0.4.0"
   },
   provenance: {
-    commit: "cc8c66f1254e3f7a7c7f4679a30e7a0c7627498c"
+    commit: "40abf9a0f7139e54da25344699c907cbdd859e27"
   },
   tarball: {
-    bytes: 89104529,
-    sha256: "13919b9aaed407e4e08c774cd24a496d3befbd91de6aafd37725fd7263963a3b",
-    sha512: "85c9adf038e8a0e826009fc8cffe23006688c184a43602d81e29807516073e604b0e451bd8f6883f1d352fb858d232acd593d72af67689b8ef5f7467f17fc096"
+    bytes: 89116913,
+    sha256: "6a984cf270dc204e1ccec15bcccd52b9a9eac168be68e404ca588bd54d924cd1",
+    sha512: "8ec9424cb5bb313b9a29b30d39f84ab32af3004039f077573d3344c2d9564556679a370919912e1fb969780d989d56e5ccea0d06bd5056c00b67b248a68de661"
   },
   pi: {
     testedVersions: ["0.84.2"]
@@ -4366,7 +4834,7 @@ var PI_RUNTIME_CANDIDATE = {
     schemaVersion: 1,
     capabilities: [
       "foundation-contract-v1",
-      "stack-snapshot-v1",
+      "stack-snapshot-v2",
       "runtime-agents-v1",
       "permission-gated-tools-v1",
       "structured-questions-v1",
@@ -4482,7 +4950,7 @@ function normalizeInstalledSource(settingsJson, alias, canonical) {
     if (!Array.isArray(packages)) return null;
     const hasCanonical = packages.some((entry) => entry === canonical || entry !== null && typeof entry === "object" && !Array.isArray(entry) && Reflect.get(entry, "source") === canonical);
     if (packages.filter((entry) => entry === alias).length !== 1 || hasCanonical) return null;
-    Reflect.set(parsed, "packages", packages.map((entry) => entry === alias ? { source: canonical, skills: [] } : entry));
+    Reflect.set(parsed, "packages", packages.map((entry) => entry === alias ? canonical : entry));
     return JSON.stringify(parsed);
   } catch {
     return null;
@@ -4495,14 +4963,14 @@ function healthyDoctor(stdout, stderr, packageRunner, candidate) {
     if (record === null || typeof record !== "object" || Array.isArray(record)) return false;
     const packageValue = Reflect.get(record, "package");
     const result = Reflect.get(record, "result");
-    return Reflect.get(record, "schemaVersion") === 1 && Reflect.get(record, "command") === "doctor" && Reflect.get(record, "ok") === true && packageValue !== null && typeof packageValue === "object" && Reflect.get(packageValue, "name") === "jorgex-pi" && Reflect.get(packageValue, "version") === (candidate.package?.version ?? /^npm:jorgex-pi@([^\s]+)$/.exec(candidate.source)?.[1]) && path30.resolve(packageRunner) === path30.resolve(String(Reflect.get(packageValue, "root")), "bin", "jorgex-pi.mjs") && result !== null && typeof result === "object" && Reflect.get(result, "healthy") === true;
+    return Reflect.get(record, "schemaVersion") === 1 && Reflect.get(record, "command") === "doctor" && Reflect.get(record, "ok") === true && packageValue !== null && typeof packageValue === "object" && Reflect.get(packageValue, "name") === "jorgex-pi" && Reflect.get(packageValue, "version") === (candidate.package?.version ?? /^npm:jorgex-pi@([^\s]+)$/.exec(candidate.source)?.[1]) && path32.resolve(packageRunner) === path32.resolve(String(Reflect.get(packageValue, "root")), "bin", "jorgex-pi.mjs") && result !== null && typeof result === "object" && Reflect.get(result, "healthy") === true;
   } catch {
     return false;
   }
 }
 function installPiFromVerifiedTarball(input, deps) {
   const paths = input.targetDir === void 0 ? userPaths(input.engramBin, input.piExecutable) : targetPaths(input.targetDir, input.engramBin, input.piExecutable);
-  const destination = input.targetDir === void 0 ? path30.join(dataDir(), "packages", `jorgex-pi-${PI_RUNTIME_CANDIDATE.package.version}.tgz`) : path30.join(path30.resolve(input.targetDir), "downloads", `jorgex-pi-${PI_RUNTIME_CANDIDATE.package.version}.tgz`);
+  const destination = input.targetDir === void 0 ? path32.join(dataDir(), "packages", `jorgex-pi-${PI_RUNTIME_CANDIDATE.package.version}.tgz`) : path32.join(path32.resolve(input.targetDir), "downloads", `jorgex-pi-${PI_RUNTIME_CANDIDATE.package.version}.tgz`);
   const artifact = deps.download(destination);
   if (artifact.bytes !== input.candidate.bytes || artifact.sha256 !== input.candidate.sha256 || artifact.sha512 !== input.candidate.sha512) {
     return { kind: "blocked", reason: "tarball-integrity" };
@@ -4510,7 +4978,7 @@ function installPiFromVerifiedTarball(input, deps) {
   deps.backupSettings();
   const scope = {
     kind: input.targetDir === void 0 ? "real" : "target-dir",
-    codingAgentDir: path30.resolve(paths.codingAgentDir)
+    codingAgentDir: path32.resolve(paths.codingAgentDir)
   };
   const installing = flatCandidateReceipt(input.candidate, scope, "installing", input.engramBin);
   deps.writeReceiptAtomic(`${JSON.stringify(installing)}
@@ -4539,30 +5007,30 @@ function installPiFromVerifiedTarball(input, deps) {
   return { kind: "installed", receipt };
 }
 function runtimePath(piExecutable) {
-  const entries = process.platform === "win32" ? [piExecutable === void 0 ? null : path30.dirname(piExecutable), path30.dirname(process.execPath), process.env.SystemRoot ? path30.join(process.env.SystemRoot, "System32") : null] : [piExecutable === void 0 ? null : path30.dirname(piExecutable), path30.dirname(process.execPath), "/usr/local/bin", "/usr/bin", "/bin"];
-  return [...new Set(entries.filter((entry) => entry !== null))].join(path30.delimiter);
+  const entries = process.platform === "win32" ? [piExecutable === void 0 ? null : path32.dirname(piExecutable), path32.dirname(process.execPath), process.env.SystemRoot ? path32.join(process.env.SystemRoot, "System32") : null] : [piExecutable === void 0 ? null : path32.dirname(piExecutable), path32.dirname(process.execPath), "/usr/local/bin", "/usr/bin", "/bin"];
+  return [...new Set(entries.filter((entry) => entry !== null))].join(path32.delimiter);
 }
 function targetPaths(targetDir, engramBin, piExecutable) {
-  const root = path30.resolve(targetDir);
-  const codingAgentDir = path30.join(root, "pi-agent");
-  const home = path30.join(root, "home");
-  const temporary = path30.join(root, "tmp");
+  const root = path32.resolve(targetDir);
+  const codingAgentDir = path32.join(root, "pi-agent");
+  const home = path32.join(root, "home");
+  const temporary = path32.join(root, "tmp");
   return {
     codingAgentDir,
-    receiptPath: path30.join(root, "state", "pi-receipt.json"),
-    packageRunner: path30.join(codingAgentDir, "npm", "node_modules", "jorgex-pi", "bin", "jorgex-pi.mjs"),
+    receiptPath: path32.join(root, "state", "pi-receipt.json"),
+    packageRunner: path32.join(codingAgentDir, "npm", "node_modules", "jorgex-pi", "bin", "jorgex-pi.mjs"),
     environment: {
       HOME: home,
       USERPROFILE: home,
-      APPDATA: path30.join(root, "appdata"),
-      LOCALAPPDATA: path30.join(root, "localappdata"),
-      XDG_CONFIG_HOME: path30.join(root, "xdg-config"),
-      XDG_DATA_HOME: path30.join(root, "xdg-data"),
-      XDG_CACHE_HOME: path30.join(root, "xdg-cache"),
+      APPDATA: path32.join(root, "appdata"),
+      LOCALAPPDATA: path32.join(root, "localappdata"),
+      XDG_CONFIG_HOME: path32.join(root, "xdg-config"),
+      XDG_DATA_HOME: path32.join(root, "xdg-data"),
+      XDG_CACHE_HOME: path32.join(root, "xdg-cache"),
       TEMP: temporary,
       TMP: temporary,
       TMPDIR: temporary,
-      npm_config_cache: path30.join(root, "npm-cache"),
+      npm_config_cache: path32.join(root, "npm-cache"),
       NPM_CONFIG_IGNORE_SCRIPTS: "true",
       NPM_CONFIG_UPDATE_NOTIFIER: "false",
       PI_CODING_AGENT_DIR: codingAgentDir,
@@ -4573,15 +5041,15 @@ function targetPaths(targetDir, engramBin, piExecutable) {
 }
 function userPaths(engramBin, piExecutable) {
   const home = os5.homedir();
-  const codingAgentDir = process.env.PI_CODING_AGENT_DIR ?? path30.join(home, ".pi", "agent");
+  const codingAgentDir = process.env.PI_CODING_AGENT_DIR ?? path32.join(home, ".pi", "agent");
   return {
     codingAgentDir,
-    receiptPath: path30.join(dataDir(), "pi-receipt.json"),
-    packageRunner: path30.join(codingAgentDir, "npm", "node_modules", "jorgex-pi", "bin", "jorgex-pi.mjs"),
+    receiptPath: path32.join(dataDir(), "pi-receipt.json"),
+    packageRunner: path32.join(codingAgentDir, "npm", "node_modules", "jorgex-pi", "bin", "jorgex-pi.mjs"),
     environment: {
       HOME: home,
-      XDG_CONFIG_HOME: process.env.XDG_CONFIG_HOME ?? path30.join(home, ".config"),
-      XDG_CACHE_HOME: process.env.XDG_CACHE_HOME ?? path30.join(home, ".cache"),
+      XDG_CONFIG_HOME: process.env.XDG_CONFIG_HOME ?? path32.join(home, ".config"),
+      XDG_CACHE_HOME: process.env.XDG_CACHE_HOME ?? path32.join(home, ".cache"),
       TMPDIR: os5.tmpdir(),
       NPM_CONFIG_IGNORE_SCRIPTS: "true",
       NPM_CONFIG_UPDATE_NOTIFIER: "false",
@@ -4609,7 +5077,7 @@ function runPiRuntime(input, deps) {
     return { kind: "blocked", reason: "tarball-integrity" };
   }
   const paths = input.targetDir === void 0 ? userPaths(input.engramBin, input.detected.executable) : targetPaths(input.targetDir, input.engramBin, input.detected.executable);
-  const settingsJson = deps.readSettings(path30.join(paths.codingAgentDir, "settings.json"));
+  const settingsJson = deps.readSettings(path32.join(paths.codingAgentDir, "settings.json"));
   const receiptJson = deps.readReceipt(paths.receiptPath);
   const lifecycleInput = {
     candidate: PI_RUNTIME_CANDIDATE,
@@ -4664,19 +5132,19 @@ function runPiRuntime(input, deps) {
   return result;
 }
 function readJsonFile(file) {
-  return JSON.parse(fs22.readFileSync(file, "utf8"));
+  return JSON.parse(fs23.readFileSync(file, "utf8"));
 }
 function packageVersionFromExecutable(executable) {
   let current;
   try {
-    current = path30.dirname(fs22.realpathSync(executable));
+    current = path32.dirname(fs23.realpathSync(executable));
   } catch {
     return null;
   }
   for (let depth = 0; depth < 8; depth++) {
     const manifests = [
-      path30.join(current, "package.json"),
-      path30.join(current, "node_modules", "@earendil-works", "pi-coding-agent", "package.json")
+      path32.join(current, "package.json"),
+      path32.join(current, "node_modules", "@earendil-works", "pi-coding-agent", "package.json")
     ];
     for (const manifest of manifests) {
       try {
@@ -4687,7 +5155,7 @@ function packageVersionFromExecutable(executable) {
       } catch {
       }
     }
-    const parent = path30.dirname(current);
+    const parent = path32.dirname(current);
     if (parent === current) break;
     current = parent;
   }
@@ -4702,35 +5170,35 @@ function detectPiRuntime() {
     installed: executable !== null,
     executable,
     version: executable === null ? null : packageVersionFromExecutable(executable),
-    codingAgentDir: process.env.PI_CODING_AGENT_DIR ?? path30.join(home, ".pi", "agent")
+    codingAgentDir: process.env.PI_CODING_AGENT_DIR ?? path32.join(home, ".pi", "agent")
   };
 }
 function hasManagedPiRuntime(targetDir) {
-  const receipt = targetDir === void 0 ? path30.join(dataDir(), "pi-receipt.json") : path30.join(path30.resolve(targetDir), "state", "pi-receipt.json");
-  return fs22.statSync(receipt, { throwIfNoEntry: false })?.isFile() === true;
+  const receipt = targetDir === void 0 ? path32.join(dataDir(), "pi-receipt.json") : path32.join(path32.resolve(targetDir), "state", "pi-receipt.json");
+  return fs23.statSync(receipt, { throwIfNoEntry: false })?.isFile() === true;
 }
 function resolvePiEngramBin(targetDir) {
   if (targetDir === void 0) return detectEngram();
-  const candidate = path30.join(path30.resolve(targetDir), "bin", process.platform === "win32" ? "engram.exe" : "engram");
-  return fs22.statSync(candidate, { throwIfNoEntry: false })?.isFile() ? candidate : null;
+  const candidate = path32.join(path32.resolve(targetDir), "bin", process.platform === "win32" ? "engram.exe" : "engram");
+  return fs23.statSync(candidate, { throwIfNoEntry: false })?.isFile() ? candidate : null;
 }
 function readOptional(file, fallback) {
   try {
-    return fs22.readFileSync(file, "utf8");
+    return fs23.readFileSync(file, "utf8");
   } catch (error) {
     if (error.code === "ENOENT") return fallback;
     throw error;
   }
 }
 function hashPiTarball(file) {
-  const descriptor = fs22.openSync(file, "r");
+  const descriptor = fs23.openSync(file, "r");
   const sha256 = createHash("sha256");
   const sha512 = createHash("sha512");
   const buffer = Buffer.allocUnsafe(1024 * 1024);
   let bytes = 0;
   try {
     while (true) {
-      const read = fs22.readSync(descriptor, buffer, 0, buffer.length, null);
+      const read = fs23.readSync(descriptor, buffer, 0, buffer.length, null);
       if (read === 0) break;
       bytes += read;
       const chunk = buffer.subarray(0, read);
@@ -4738,27 +5206,27 @@ function hashPiTarball(file) {
       sha512.update(chunk);
     }
   } finally {
-    fs22.closeSync(descriptor);
+    fs23.closeSync(descriptor);
   }
   return { path: file, bytes, sha256: sha256.digest("hex"), sha512: sha512.digest("hex") };
 }
 async function acquirePiTarball(destination) {
-  const existing = fs22.statSync(destination, { throwIfNoEntry: false });
+  const existing = fs23.statSync(destination, { throwIfNoEntry: false });
   if (existing?.isFile()) {
     const observed = hashPiTarball(destination);
     if (observed.bytes === PI_RUNTIME_CANDIDATE.tarball.bytes && observed.sha256 === PI_RUNTIME_CANDIDATE.tarball.sha256 && observed.sha512 === PI_RUNTIME_CANDIDATE.tarball.sha512) {
       return observed;
     }
-    fs22.rmSync(destination, { force: true });
+    fs23.rmSync(destination, { force: true });
   }
-  fs22.mkdirSync(path30.dirname(destination), { recursive: true });
+  fs23.mkdirSync(path32.dirname(destination), { recursive: true });
   const partial = `${destination}.partial-${process.pid}`;
   const response = await fetch(`https://registry.npmjs.org/jorgex-pi/-/jorgex-pi-${PI_RUNTIME_CANDIDATE.package.version}.tgz`, {
     redirect: "error",
     headers: { accept: "application/octet-stream" }
   });
   if (!response.ok || response.body === null) throw new Error(`No se pudo descargar jorgex-pi@${PI_RUNTIME_CANDIDATE.package.version} (${response.status}).`);
-  const descriptor = fs22.openSync(partial, "wx", 384);
+  const descriptor = fs23.openSync(partial, "wx", 384);
   let bytes = 0;
   try {
     for await (const chunk of response.body) {
@@ -4766,15 +5234,15 @@ async function acquirePiTarball(destination) {
       bytes += buffer.length;
       if (bytes > PI_RUNTIME_CANDIDATE.tarball.bytes) throw new Error("El tarball de jorgex-pi excede el tama\xF1o fijado.");
       let offset = 0;
-      while (offset < buffer.length) offset += fs22.writeSync(descriptor, buffer, offset);
+      while (offset < buffer.length) offset += fs23.writeSync(descriptor, buffer, offset);
     }
   } catch (error) {
-    fs22.closeSync(descriptor);
-    fs22.rmSync(partial, { force: true });
+    fs23.closeSync(descriptor);
+    fs23.rmSync(partial, { force: true });
     throw error;
   }
-  fs22.closeSync(descriptor);
-  fs22.renameSync(partial, destination);
+  fs23.closeSync(descriptor);
+  fs23.renameSync(partial, destination);
   return hashPiTarball(destination);
 }
 function runProcess(invocation) {
@@ -4824,7 +5292,7 @@ async function runPiRuntimeSystem(input) {
         remedy: "Instala Engram o configura un ENGRAM_BIN absoluto antes de reintentar."
       };
     }
-    const destination = input.targetDir === void 0 ? path30.join(dataDir(), "packages", `jorgex-pi-${PI_RUNTIME_CANDIDATE.package.version}.tgz`) : path30.join(path30.resolve(input.targetDir), "downloads", `jorgex-pi-${PI_RUNTIME_CANDIDATE.package.version}.tgz`);
+    const destination = input.targetDir === void 0 ? path32.join(dataDir(), "packages", `jorgex-pi-${PI_RUNTIME_CANDIDATE.package.version}.tgz`) : path32.join(path32.resolve(input.targetDir), "downloads", `jorgex-pi-${PI_RUNTIME_CANDIDATE.package.version}.tgz`);
     let artifact;
     try {
       artifact = await acquirePiTarball(destination);
@@ -4844,18 +5312,18 @@ async function runPiRuntimeSystem(input) {
     }, {
       download: () => artifact,
       backupSettings: () => createBackup(
-        [path30.join(paths.codingAgentDir, "settings.json")],
+        [path32.join(paths.codingAgentDir, "settings.json")],
         "pi-package-install",
-        input.targetDir === void 0 ? void 0 : path30.join(path30.resolve(input.targetDir), "backups")
+        input.targetDir === void 0 ? void 0 : path32.join(path32.resolve(input.targetDir), "backups")
       ),
       run: runProcess,
-      readSettings: () => readOptional(path30.join(paths.codingAgentDir, "settings.json"), '{"packages":[]}'),
-      rewriteSettings: (content) => writeText(path30.join(paths.codingAgentDir, "settings.json"), `${content}
+      readSettings: () => readOptional(path32.join(paths.codingAgentDir, "settings.json"), '{"packages":[]}'),
+      rewriteSettings: (content) => writeText(path32.join(paths.codingAgentDir, "settings.json"), `${content}
 `),
       writeReceiptAtomic: (content) => writeText(paths.receiptPath, content)
     });
   }
-  const packageRoot = path30.dirname(path30.dirname(paths.packageRunner));
+  const packageRoot = path32.dirname(path32.dirname(paths.packageRunner));
   const writeReceipt = (receipt) => {
     writeText(paths.receiptPath, `${JSON.stringify(receipt, null, 2)}
 `);
@@ -4873,19 +5341,108 @@ async function runPiRuntimeSystem(input) {
       value,
       {
         backupSettings: () => createBackup(
-          [path30.join(paths.codingAgentDir, "settings.json")],
+          [path32.join(paths.codingAgentDir, "settings.json")],
           "pi-package-uninstall",
-          input.targetDir === void 0 ? void 0 : path30.join(path30.resolve(input.targetDir), "backups")
+          input.targetDir === void 0 ? void 0 : path32.join(path32.resolve(input.targetDir), "backups")
         ),
         run: runProcess,
-        isPackageAbsent: () => !fs22.existsSync(packageRoot),
-        deleteReceipt: () => fs22.rmSync(paths.receiptPath, { force: true })
+        isPackageAbsent: () => !fs23.existsSync(packageRoot),
+        deleteReceipt: () => fs23.rmSync(paths.receiptPath, { force: true })
       }
     )
   };
   return runPiRuntime(input, deps);
 }
 
+// src/lib/pi-managed-runtime.ts
+function projectionOperation(operation) {
+  return operation === "update" ? "sync" : operation;
+}
+function manualExistingResult(packageResult) {
+  return packageResult.remedy === void 0 ? { kind: "blocked", reason: "manual-existing" } : { kind: "blocked", reason: "manual-existing", remedy: packageResult.remedy };
+}
+async function completeProjection(operation, packageResult, deps) {
+  const projectionResult = await deps.runProjection(operation);
+  if (projectionResult.kind === "drift") {
+    return {
+      kind: "blocked",
+      reason: "projection-drift",
+      paths: projectionResult.paths,
+      remedy: projectionResult.remedy
+    };
+  }
+  return projectionResult.kind === "blocked" ? projectionResult : packageResult;
+}
+async function runManagedPiOperation(operation, deps) {
+  if (operation === "uninstall") {
+    const preparation = await deps.prepareProjectionUninstall();
+    if (preparation.kind === "blocked") return preparation;
+    const packageResult2 = await deps.runPackage(operation);
+    if (packageResult2.kind === "manual-existing") return manualExistingResult(packageResult2);
+    if (packageResult2.kind === "blocked") return packageResult2;
+    return deps.completeProjectionUninstall(preparation.token);
+  }
+  const packageResult = await deps.runPackage(operation);
+  if (packageResult.kind === "manual-existing") return manualExistingResult(packageResult);
+  if (operation === "models") return packageResult;
+  const nextProjectionOperation = projectionOperation(operation);
+  if (packageResult.kind !== "blocked") {
+    return completeProjection(nextProjectionOperation, packageResult, deps);
+  }
+  if (packageResult.reason !== "source-divergent" || operation !== "sync" && operation !== "update") {
+    return packageResult;
+  }
+  const recoveryProjection = await deps.runProjection("sync");
+  if (recoveryProjection.kind === "blocked") return recoveryProjection;
+  if (recoveryProjection.kind !== "synced" || !recoveryProjection.changed) return packageResult;
+  const retryResult = await deps.runPackage(operation);
+  if (retryResult.kind === "manual-existing") return manualExistingResult(retryResult);
+  if (retryResult.kind === "blocked") return retryResult;
+  return completeProjection("sync", retryResult, deps);
+}
+function managedPackageResult(result) {
+  if (result.kind === "manual-existing") {
+    return {
+      kind: "manual-existing",
+      remedy: result.remedy ?? "Pi ya est\xE1 configurado manualmente; conserva esa configuraci\xF3n o elim\xEDnala antes de ejecutar sync --agents pi."
+    };
+  }
+  if (result.kind === "models") return { kind: "models", models: result.models };
+  return result;
+}
+async function runManagedPiSystem(input) {
+  const playwrightCliEnabled = input.targetDir === void 0 && loadPlaywrightCliPreference() === true;
+  const projectionInput = {
+    targetDir: input.targetDir,
+    packageSource: PI_RUNTIME_CANDIDATE.package.source,
+    engramBin: input.engramBin,
+    playwrightCliEnabled
+  };
+  return runManagedPiOperation(input.operation, {
+    async runPackage(operation) {
+      return managedPackageResult(await runPiRuntimeSystem({ ...input, operation }));
+    },
+    runProjection(operation) {
+      const result = runPiProjectionLifecycleSystem({
+        operation,
+        ...projectionInput
+      });
+      return Promise.resolve(result.kind === "drift" ? {
+        kind: "drift",
+        paths: result.paths,
+        remedy: "Ejecuta sync --agents pi para reparar la proyecci\xF3n de Pi."
+      } : result);
+    },
+    prepareProjectionUninstall() {
+      const result = preparePiProjectionUninstallSystem({ operation: "uninstall", ...projectionInput });
+      return Promise.resolve(result.kind === "prepared" ? { kind: "prepared", token: result.plan } : result);
+    },
+    completeProjectionUninstall(token) {
+      return Promise.resolve(completePiProjectionUninstallSystem(token, { operation: "uninstall", ...projectionInput }));
+    }
+  });
+}
+
 // src/cli.ts
 var VERSION = readPackageVersion();
 var COMMANDS = ["install", "sync", "models", "update", "doctor", "restore", "uninstall"];
@@ -5105,6 +5662,13 @@ async function resolveRuntimes(flags, includeAvailablePi = false) {
   return choice;
 }
 async function runSelectedPi(operation, targetDir, yes = false) {
+  if (targetDir === void 0 && operation !== "models") {
+    const preferenceErrors = browserPreferenceErrors();
+    if (preferenceErrors.length > 0) {
+      for (const error of preferenceErrors) console.error(error);
+      return 1;
+    }
+  }
   const detected = detectPiRuntime();
   if (!detected.installed || detected.executable === null) {
     console.error("Pi no detectado. Instala el runtime Pi antes de gestionar jorgex-pi.");
@@ -5135,14 +5699,15 @@ async function runSelectedPi(operation, targetDir, yes = false) {
     }
     engramBin = requirement.bin;
   }
-  const result = await runPiRuntimeSystem({
+  const result = await runManagedPiSystem({
     operation,
     targetDir,
     detected: { executable: detected.executable, version: detected.version },
     engramBin
   });
   if (result.kind === "blocked") {
-    console.error(`Pi: ${result.reason ?? "operaci\xF3n bloqueada"}${result.remedy ? `. ${result.remedy}` : ""}`);
+    const paths = "paths" in result ? `: ${result.paths.join(", ")}` : "";
+    console.error(`Pi: ${result.reason ?? "operaci\xF3n bloqueada"}${paths}${result.remedy ? `. ${result.remedy}` : ""}`);
     return 1;
   }
   if (result.kind === "models" && result.models !== void 0) console.log(JSON.stringify(result.models));
@@ -5244,7 +5809,26 @@ Flags disponibles: jorgex-stack --help`
           devtoolsMcpSelection
         });
       }
-      if (runtimes.includes("pi")) {
+      let piCanRun = true;
+      if (command === "install" && fileRuntimes.length === 0 && runtimes.includes("pi")) {
+        const playwrightToolConsent = await resolvePlaywrightToolConsent(command, flags);
+        if (playwrightToolConsent === null) return;
+        if (resolvePlaywrightToolPlan(playwrightToolConsent).actions.length > 0) {
+          if (flags.dryRun) {
+            p6.log.info("Playwright CLI: instalaci\xF3n global y navegador previstos (dry-run; no se ejecutan).");
+          } else {
+            exitCode = await runInstall({
+              runtimes: [],
+              targetDir: flags.targetDir,
+              dryRun: false,
+              yes: flags.yes,
+              playwrightToolConsent
+            });
+            piCanRun = exitCode === 0;
+          }
+        }
+      }
+      if (runtimes.includes("pi") && piCanRun) {
         if (flags.dryRun) p6.log.info(`Pi: ${command} previsto; dry-run no ejecuta subprocess ni escribe receipt.`);
         else exitCode = Math.max(exitCode, await runSelectedPi(command, flags.targetDir, flags.yes));
       }