jorgex-stack 1.9.51 → 1.9.52

package/dist/cli.js

@@ -5235,6 +5235,45 @@ async function querySkillHeads(skillNames, upstreams) {
     return { name, repo, info, head: heads.get(repo) ?? null };
   });
 }
+function complementsToScan(upstreams) {
+  return Object.keys(upstreams.complements ?? {}).filter((name) => !name.startsWith("$"));
+}
+function resolveComplementUpdateCheck(name, info, upstream) {
+  const pinned = info.version ?? null;
+  if (!pinned)
+    return {
+      level: "warn",
+      message: `${name}: sin pin en upstreams.json \u2014 fija la versi\xF3n revisada antes de instalar.`
+    };
+  if (upstream === null)
+    return { level: "info", message: `${name}: pin ${pinned} (no se pudo consultar el upstream).` };
+  if (upstream === pinned)
+    return { level: "success", message: `${name}: al d\xEDa con el pin ${pinned}.` };
+  return {
+    level: "warn",
+    message: `${name}: difiere del upstream (pin ${pinned}, upstream ${upstream}). Revisa el cambio y, si lo aceptas, re-pinea en upstreams.json \u2014 nunca auto-update.`
+  };
+}
+async function queryComplementUpstreams(names, upstreams) {
+  const requests = /* @__PURE__ */ new Map();
+  const keyOf = (source) => {
+    if (source.startsWith("npm:")) return `npm:${source.slice(4)}`;
+    if (source.startsWith("github:")) return `github:${source.slice("github:".length).split("#")[0]}`;
+    return null;
+  };
+  for (const name of names) {
+    const key = keyOf(upstreams.complements[name].source);
+    if (key && !requests.has(key)) {
+      requests.set(key, key.startsWith("npm:") ? latestNpmVersion(key.slice("npm:".length)) : latestGithubRelease(key.slice("github:".length)));
+    }
+  }
+  const observed = /* @__PURE__ */ new Map();
+  await Promise.all([...requests.entries()].map(async ([key, request]) => observed.set(key, await request)));
+  return names.map((name) => {
+    const key = keyOf(upstreams.complements[name].source);
+    return { name, upstream: key ? observed.get(key) ?? null : null };
+  });
+}
 async function latestNpmVersion(pkg) {
   try {
     const res = await fetch(`https://registry.npmjs.org/${pkg}/latest`, {
@@ -5331,6 +5370,21 @@ async function runUpdateCheck(localVersion, includeBrowserState = true) {
       p4.log.info("Skills de terceros: ning\xFAn upstream se ha movido respecto a su pin.");
     }
   }
+  const complementNames = complementsToScan(upstreams);
+  if (complementNames.length > 0) {
+    const complementQueries = await queryComplementUpstreams(complementNames, upstreams);
+    let movedComplement = false;
+    let unknownComplement = false;
+    for (const { name, upstream } of complementQueries) {
+      const report = resolveComplementUpdateCheck(name, upstreams.complements[name], upstream);
+      p4.log[report.level](report.message);
+      if (report.level === "warn") movedComplement = true;
+      if (report.level === "info") unknownComplement = true;
+    }
+    if (!movedComplement && !unknownComplement) {
+      p4.log.success("Complementos oficiales: al d\xEDa con sus pins.");
+    }
+  }
   if (githubRateLimited()) {
     p4.log.warn(rateLimitHint("GitHub limit\xF3 algunas consultas (rate limit sin token)."));
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jorgex-stack",
-  "version": "1.9.51",
+  "version": "1.9.52",
   "description": "Harness multi-agente portable: instala la config JorgeX (agentes, skills, hooks, Engram, MCPs) en Claude Code, Codex CLI, OpenCode y Pi",
   "type": "module",
   "license": "MIT",

package/upstreams.json

@@ -8,6 +8,53 @@
       "policy": "respect-existing — D7: si hay un Engram instalado (binario o DB), no se toca; update del binario solo con confirmación explícita y la DB jamás"
     }
   },
+  "complements": {
+    "$comment": "Complementos oficiales externos (ejecutan código en el runtime): pin exacto al instalar, nunca latest ni rangos flotantes. `reviewed` = última revisión aceptada; `update --check` es discovery-only y avisa si el upstream se movió; la adopción es re-pin deliberado con verificación, nunca auto-update.",
+    "gentle-engram": {
+      "source": "npm:gentle-engram",
+      "version": "0.1.12",
+      "reviewed": "2026-09-17",
+      "status": "pendiente-adopcion",
+      "note": "última publicada en npm (dist-tag latest); el setup oficial en main referencia 0.1.13 aún no publicada — re-pinear al salir. Incluye auto-cierre en session_shutdown. Issue: #155"
+    },
+    "pi-mcp-adapter": {
+      "source": "npm:pi-mcp-adapter",
+      "version": null,
+      "reviewed": "2026-09-17",
+      "status": "pendiente-pin",
+      "note": "upstream lo referencia sin versión (setup.go main): exigir pin exacto antes de adoptar. Issue: #155"
+    },
+    "engram-claude-plugin": {
+      "source": "github:Gentleman-Programming/engram#plugin/claude-code",
+      "version": "1.20.0",
+      "reviewed": "2026-09-17",
+      "note": "autocierre vía hook Stop (v1.20.0) / SessionEnd (main). Stack convive (detección + allowlists duales); falta instalación/verificación por Stack. Issue: #155"
+    },
+    "engram-codex-plugin": {
+      "source": "github:Gentleman-Programming/engram#plugin/codex",
+      "version": "1.20.0",
+      "reviewed": "2026-09-17",
+      "note": "autocierre vía hook Stop. Stack convive; falta instalación/verificación por Stack. Issue: #155"
+    },
+    "engram-opencode-plugin": {
+      "source": "github:Gentleman-Programming/engram#plugin/opencode",
+      "version": "1.20.0",
+      "reviewed": "2026-09-17",
+      "note": "auto-cierre (endSessionInEngram) solo en main; la copia vendorizada de Stack no lo tiene — migrar con transferencia de ownership de plugins/engram.ts. Issue: #155"
+    },
+    "chrome-devtools-mcp": {
+      "source": "npm:chrome-devtools-mcp",
+      "version": "1.6.0",
+      "reviewed": "2026-09-17",
+      "note": "opt-in, default-off; flags --isolated --redact-network-headers --no-performance-crux --no-usage-statistics"
+    },
+    "playwright-cli": {
+      "source": "npm:@playwright/cli",
+      "version": "0.1.18",
+      "reviewed": "2026-09-17",
+      "note": "CLI global compartido por la máquina; camino recomendado opt-in"
+    }
+  },
   "skills": {
     "deploy-to-vercel": {
       "source": "github:vercel-labs/agent-skills",