litclaude-ai 0.3.40 → 0.3.42

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 0.3.42 - 2026-08-11 — reviewed local Wikify knowledge
+
+- Add LitClaude-native Wikify capture, save, review, query, and configuration
+  flows through the CLI, command route, prompt hook, and MCP tools.
+- Store bounded structured claims in the project-local knowledge ledger. New
+  claims remain `review-needed`, and queries inject only accepted relevant
+  claims with local provenance, bounded output, and fail-closed persistence.
+
+## 0.3.41 - 2026-08-09 — foreground automatic updates
+
+- Add a default-on SessionStart update barrier that installs an exact stable
+  package candidate only after a cached check, runs doctor/version verification,
+  records a transaction receipt, and fails closed when rollback is unknown.
+- Keep the detached notifier cache-only, with sanitized npm environment,
+  bounded locking, recursion/opt-out guards, and the documented
+  `--no-auto-update` escape hatch.
+
 ## 0.3.39 - 2026-08-04 — executable plan validation
 
 - Require planner handoff to use a generated plan that passes

package/README.md

@@ -9,7 +9,7 @@
 </p>
 <p align="center">
   <img src="https://img.shields.io/badge/npm-litclaude--ai-cb3837" />
-  <img src="https://img.shields.io/badge/version-0.3.40-2ea44f" />
+  <img src="https://img.shields.io/badge/version-0.3.42-2ea44f" />
   <img src="https://img.shields.io/badge/Claude%20Code-plugin-blueviolet" />
   <img src="https://img.shields.io/badge/license-MIT-blue" />
 </p>
@@ -85,6 +85,26 @@ later mode change or uninstall.
   `autoconference` skill routes core/analyze/debate/plan/resume/ship/survey and
   fails with `BLOCKED_MULTI_AGENT_UNAVAILABLE` when root multi-agent capability is
   absent; one task-local `wikify` skill routes init/ingest/query/save/lint
+- **Reviewed local knowledge** - Wikify captures only bounded structured facts,
+  decisions, failures, risks, rules, and checkpoints under
+  `.litclaude/knowledge/claims.jsonl`. A leading `wikify` or `$wikify` prompt
+  reaches Claude Code's `UserPromptSubmit` hook and routes to `Skill(wikify)`.
+  The native `/litclaude:wikify` command, `litclaude wikify ...` CLI, and MCP
+  tools `wikify_capture`, `wikify_review`, and `wikify_query` use this runtime.
+  Capture is default-on, but
+  `litclaude wikify config --capture off` disables it for the project. New claims
+  stay `review-needed`; `save` accepts one claim, and `review` sets `accepted`,
+  `rejected`, or `stale`. Deterministic local queries return accepted relevant
+  claims only. A no-match query emits no injected knowledge block. It uses a
+  2048-byte normal budget and a 4096-byte hard limit for injected knowledge.
+  These byte budgets are not Claude's model context window. The runtime never
+  mines raw chat or source bodies. The local state is git-ignored and excluded
+  from the npm package. Wikify local state is user-owned and cooperative.
+  LitClaude writers cooperate through the `.claims-lock` owner lock. Symlinks,
+  unsafe file types, pre-existing hardlinks, and observed path or descriptor
+  identity changes fail closed. Atomic rename protects target readers and crash consistency.
+  The lock is not a security boundary, and the state is not
+  tamper-proof or confidential against another process with the same uid.
 - **Bundled owner-authorized skills** - `lit-handoff` reads the complete immutable
   four-file handoff source and supports the exact bare `handoff` prompt;
   `lit-scientific-visualization` reads its complete immutable authored
@@ -174,18 +194,18 @@ cd /tmp
 npx --yes litclaude-ai@latest install
 ```
 
-`0.3.40` is the version prepared by this checkout. Registry lookup is authoritative
+`0.3.42` is the version prepared by this checkout. Registry lookup is authoritative
 for whether that exact version can be installed:
 
 ```bash
-npm view litclaude-ai@0.3.40 version
+npm view litclaude-ai@0.3.42 version
 ```
 
-If that lookup returns 0.3.40, the exact install is available:
+If that lookup returns 0.3.42, the exact install is available:
 
 ```bash
 cd /tmp
-npx --yes litclaude-ai@0.3.40 install
+npx --yes litclaude-ai@0.3.42 install
 ```
 
 Otherwise, wait for explicit human publication and repeat the lookup before using
@@ -205,18 +225,26 @@ offline, failed, or interrupted refreshes while preserving the last successful
 version and check time. A transition/recovery mutex and per-attempt ownership
 generation serialize stale takeover and completion, so an old worker cannot
 remove a newer reservation or overwrite its result. The refresh is a detached, three-second request to the
-official npm registry, so the management command does not wait. Noncanonical or
-future cache timestamps are not trusted. The notice is disabled for CI, JSON,
-dry-run, or non-TTY use and by either `NO_UPDATE_NOTIFIER` or
-`LITCLAUDE_NO_UPDATE_CHECK`. It never reads npm credentials or installs an
-update. Follow the version-pinned `npx --yes litclaude-ai@<version> install`
-command shown in the notice, then restart Claude Code.
+official npm registry, so the management command does not wait; this advisory
+refresh is cache-only.
+
+When a fresh cache entry identifies a newer strict stable version, an interactive
+Claude `SessionStart` or TTY `install`/`update`/`doctor` command now performs a
+foreground automatic update. It invokes the exact `litclaude-ai@<version>` package,
+passes `--no-auto-update` to the child, strips npm credential variables, takes a bounded
+backup, runs the exact-version doctor, and rolls back on timeout or verification
+failure. A receipt and journal are written under `~/.litclaude/update-notifier/automatic/`.
+The automatic lane is disabled by `--no-auto-update`, `LITCLAUDE_NO_AUTO_UPDATE`,
+`NO_UPDATE_NOTIFIER`, or `LITCLAUDE_NO_UPDATE_CHECK`; it is also a no-op for CI,
+JSON, dry-run, non-TTY management commands, imports, and tool surfaces. The
+SessionStart hook is the host-owned interactive lifecycle exception to the TTY
+check. The legacy cache refresh never installs a package by itself.
 
 The installer also sets Claude Code's `statusLine` command to the packaged
 LitClaude HUD. A typical no-color render starts like:
 
 ```text
-[🔥LITCLAUDE v0.3.40] | O4.8 │ ctx [▎░░] 9%/1000k │ 5h [▏░] 4% ↻2h15m │ 1w [▊░] 35% ↻3d6h │ git main +3 ✓
+[🔥LITCLAUDE v0.3.42] | O4.8 │ ctx [▎░░] 9%/1000k │ 5h [▏░] 4% ↻2h15m │ 1w [▊░] 35% ↻3d6h │ git main +3 ✓
 ```
 
 The `↻` suffix is a compact rate-limit reset countdown. It is separated from
@@ -320,6 +348,7 @@ same route work too, and the full trigger list with activation rules lives in
 | `lit-scientific-visualization` | Publication figures. Also `/litclaude:lit-scientific-visualization` |
 | `autoresearch <mode> <objective>` | Autonomous research loop. Also `/litclaude:autoresearch` |
 | `autoconference <mode> <objective>` | Multi-agent research conference. Also `/litclaude:autoconference` |
+| `wikify <capture|save|review|query|config>` | Manage reviewed local structured knowledge. Also `$wikify` and `/litclaude:wikify` |
 
 
 Expected behavior: LitClaude's prompt hook adds mode-specific `LITWORK MODE
@@ -573,6 +602,7 @@ unavailable capabilities are reported as `DEGRADED` with the affected workflow.
 | `npx --yes litclaude-ai doctor` | Validate files, Claude plugin validation, and plugin details |
 | `npx --yes litclaude-ai path` | Print the installed Claude plugin path |
 | `npx --yes litclaude-ai start-work <command> --json` | Manage schema-3 bounded-authority work state |
+| `npx --yes litclaude-ai wikify <capture|save|review|query|config>` | Manage reviewed local structured knowledge |
 | `npx --yes litclaude-ai public-read <url> --json` | Read a public source with SSRF/auth safety stops |
 | `npx --yes litclaude-ai run -- --help` | Run plain `claude` after verifying install state |
 | `npx --yes litclaude-ai update` | Reinstall the current package version |

package/README_ko-KR.md

@@ -9,7 +9,7 @@
 </p>
 <p align="center">
   <img src="https://img.shields.io/badge/npm-litclaude--ai-cb3837" />
-  <img src="https://img.shields.io/badge/version-0.3.40-2ea44f" />
+  <img src="https://img.shields.io/badge/version-0.3.42-2ea44f" />
   <img src="https://img.shields.io/badge/Claude%20Code-plugin-blueviolet" />
   <img src="https://img.shields.io/badge/license-MIT-blue" />
 </p>
@@ -86,6 +86,27 @@ mode 변경이나 uninstall 때도 그 항목만 제거합니다.
   `autoconference`는 core/analyze/debate/plan/resume/ship/survey를 라우팅하며 root
   multi-agent capability가 없으면 `BLOCKED_MULTI_AGENT_UNAVAILABLE`로 멈춥니다.
   task-local `wikify`는 init/ingest/query/save/lint를 라우팅합니다.
+- **검토 기반 로컬 지식** - Wikify의 구조화 지식은
+  `.litclaude/knowledge/claims.jsonl`에만 저장됩니다. 선두 `wikify` 또는
+  `$wikify` prompt는 Claude Code의 `UserPromptSubmit` hook에 도달해
+  `Skill(wikify)`로 라우팅됩니다. Native `/litclaude:wikify` command,
+  `litclaude wikify ...` CLI, MCP tools `wikify_capture`, `wikify_review`,
+  `wikify_query`는 이 runtime을 사용합니다. 새 레코드는 `review-needed`(검토 필요)
+  상태로 시작합니다. `save`는 하나의 레코드를 accepted로 만들고, `review`는
+  `accepted`, `rejected`, `stale` 상태를 설정합니다. `capture`, `save`, `review`,
+  `query`, `config` 작업은 모두 CLI에서 사용할 수 있습니다.
+  `litclaude wikify config --capture off`로 프로젝트별 캡처를 끌 수 있습니다.
+  query는 accepted 관련 레코드만 반환합니다. no-match query는 injected knowledge
+  block을 출력하지 않습니다. injected knowledge에는 2048-byte normal budget와
+  4096-byte hard limit을 적용합니다. 이 byte budget은 Claude의 model context
+  window가 아닙니다. runtime은 raw chat이나 source body를 mining하지 않습니다.
+  로컬 상태는 git-ignored이며 npm package에서 제외됩니다. Wikify 로컬 상태는
+  user-owned cooperative local state입니다. LitClaude writer는 `.claims-lock`
+  owner lock을 통해 협조합니다(cooperate). 이 lock은 같은 uid의 다른 process에
+  대한 security boundary가 아닙니다. symlink, unsafe file type, pre-existing hardlink,
+  관찰된 path 또는 descriptor identity 변경은 fail closed로 처리합니다.
+  atomic rename은 target reader와 crash consistency를 보호합니다. 같은 uid의 다른
+  process에 대해서는 tamper-proof하거나 confidential한 저장소가 아닙니다.
 - **원본 보존 bundled skills** - `lit-handoff`는 승인된 4개 handoff 원본
   파일을, `lit-scientific-visualization`은 승인된 authored 원본을
   byte-identical하게 포함합니다. Python 또는 matplotlib이 없으면 자동
@@ -183,18 +204,18 @@ cd /tmp
 npx --yes litclaude-ai@latest install
 ```
 
-`0.3.40`은 이 checkout에서 준비 중인 version입니다. exact version의 설치 가능
+`0.3.42`는 이 checkout에서 준비 중인 version입니다. exact version의 설치 가능
 여부에는 registry 조회 결과를 authoritative한 기준으로 사용합니다.
 
 ```bash
-npm view litclaude-ai@0.3.40 version
+npm view litclaude-ai@0.3.42 version
 ```
 
-조회 결과가 0.3.40이면 exact install을 사용할 수 있습니다.
+조회 결과가 0.3.42이면 exact install을 사용할 수 있습니다.
 
 ```bash
 cd /tmp
-npx --yes litclaude-ai@0.3.40 install
+npx --yes litclaude-ai@0.3.42 install
 ```
 
 그렇지 않으면 명시적인 human publication을 기다립니다. 게시 후 조회를 다시 실행해
@@ -214,18 +235,26 @@ time을 남겨 24시간 동안 재시도를 제한하되 마지막 성공 versio
 보존합니다. transition/recovery mutex와 attempt별 ownership generation이 stale
 takeover와 completion을 직렬화하므로 이전 worker가 새 reservation을 지우거나 새
 결과를 덮어쓸 수 없습니다. refresh는 official npm registry를 최대 3초 동안 조회하는 detached
-process이므로 management command는 기다리지 않습니다. canonical하지 않거나
-미래인 cache timestamp는 신뢰하지 않습니다. CI, JSON, dry-run, non-TTY에서는
-동작하지 않으며 `NO_UPDATE_NOTIFIER` 또는 `LITCLAUDE_NO_UPDATE_CHECK`로 끌 수
-있습니다. npm credential을 읽거나 update를 자동 설치하지 않습니다. notice가 제시한
-`npx --yes litclaude-ai@<version> install`을 실행한 뒤 Claude Code를 다시
-시작하세요.
+process이므로 management command는 기다리지 않습니다. 이 advisory refresh는
+cache만 갱신합니다.
+
+fresh cache가 더 높은 strict stable version을 가리키면 interactive Claude
+`SessionStart` 또는 TTY `install`/`update`/`doctor`가 foreground automatic update를
+수행합니다. exact `litclaude-ai@<version>` package만 실행하고 child에
+`--no-auto-update`를 전달하며 npm credential 변수를 제거한 환경, bounded backup,
+exact-version doctor, 실패 시 rollback을 사용합니다. receipt와 journal은
+`~/.litclaude/update-notifier/automatic/`에 남습니다. `--no-auto-update`,
+`LITCLAUDE_NO_AUTO_UPDATE`, `NO_UPDATE_NOTIFIER`, `LITCLAUDE_NO_UPDATE_CHECK`로
+자동 설치를 끌 수 있고 CI, JSON, dry-run, non-TTY management command, import,
+tool surface에서는 동작하지 않습니다. SessionStart hook은 host가 소유한
+interactive lifecycle이므로 TTY 검사만 예외입니다. 기존 cache refresh가
+package를 자동 설치하지는 않습니다.
 
 installer는 Claude Code의 `statusLine` command도 packaged LitClaude HUD로
 설정합니다. 색상을 제거한 예시는 다음처럼 시작합니다.
 
 ```text
-[🔥LITCLAUDE v0.3.40] | O4.8 │ ctx [▎░░] 9%/1000k │ 5h [▏░] 4% ↻2h15m │ 1w [▊░] 35% ↻3d6h │ git main +3 ✓
+[🔥LITCLAUDE v0.3.42] | O4.8 │ ctx [▎░░] 9%/1000k │ 5h [▏░] 4% ↻2h15m │ 1w [▊░] 35% ↻3d6h │ git main +3 ✓
 ```
 
 `↻` 표시는 rate-limit reset까지 남은 시간을 짧게 보여주는 countdown입니다.
@@ -342,6 +371,8 @@ autoconference <mode> <objective>
 /litclaude:autoconference <mode> <objective>
 wikify <init|ingest|query|save|lint> <scope 또는 question>
 /litclaude:wikify <init|ingest|query|save|lint> <scope 또는 question>
+wikify <capture|save|review|query|config> <scope, id 또는 question>
+/litclaude:wikify <capture|save|review|query|config> <scope, id 또는 question>
 ```
 
 기대 동작은 LitClaude prompt hook이 자연어 LIT route별 mode-specific
@@ -538,6 +569,7 @@ package는 몰래 설치하지 않고, 없으면 영향받는 workflow를 `DEGRA
 | `npx --yes litclaude-ai --version` | packaged LitClaude version 출력 |
 | `npx --yes litclaude-ai doctor` | 파일, Claude validation, plugin details 검증 |
 | `npx --yes litclaude-ai path` | 설치된 Claude plugin 경로 출력 |
+| `npx --yes litclaude-ai wikify <capture|save|review|query|config>` | 검토 기반 로컬 구조화 지식 관리 |
 | `npx --yes litclaude-ai public-read <url> --json` | SSRF/auth safety stop이 있는 공개 소스 read |
 | `npx --yes litclaude-ai run -- --help` | 설치 상태를 확인한 뒤 plain `claude` 실행 |
 | `npx --yes litclaude-ai update` | 현재 package version 재설치 |

package/RELEASE_CHECKLIST.md

@@ -1,6 +1,6 @@
 # LitClaude Release Checklist
 
-Status: `litclaude-ai@0.3.40` is the current release candidate — exact canonical
+Status: `litclaude-ai@0.3.42` is the current release candidate — exact canonical
 frontend corpus plus Claude-native `autoresearch`, `autoconference`, and `wikify`
 workflow-family integration. It byte-pins the frontend library, legal companions,
 family source closures, and adapters through independent commitments and package
@@ -45,9 +45,9 @@ side-effect-free, the launcher starts only a separate Claude Code
 print/background worker, and the release preserves the Korean polishing
 command, strict multi-agent review pipeline, fidelity guardrails, package
 hygiene checks, native route gates, and safe start-work handoff behavior.
-`package.json` is aligned to `0.3.40`,
-`plugins/litclaude/.claude-plugin/plugin.json` is aligned to `0.3.40`, and the
-plugin-local MCP server reports `0.3.40`.
+`package.json` is aligned to `0.3.42`,
+`plugins/litclaude/.claude-plugin/plugin.json` is aligned to `0.3.42`, and the
+plugin-local MCP server reports `0.3.42`.
 
 This release carries the v0.2.2 Dynamic workflow hardening surfaces:
 `/dynamic-workflow`, `workflow-check --json`, native `/goal` fallback guidance,
@@ -280,9 +280,9 @@ checkout and from an isolated install of the packed tarball:
 Before requesting publication approval, confirm these artifacts from the current
 checkout:
 
-- `package.json` version is `0.3.40`.
-- `plugins/litclaude/.claude-plugin/plugin.json` version is `0.3.40`.
-- `plugins/litclaude/bin/litclaude-mcp.js` reports server version `0.3.40`.
+- `package.json` version is `0.3.42`.
+- `plugins/litclaude/.claude-plugin/plugin.json` version is `0.3.42`.
+- `plugins/litclaude/bin/litclaude-mcp.js` reports server version `0.3.42`.
 - Prompt-hook tests cover bundled `SKILL.md` body injection for bare `hyperplan`, `litresearch`, `lit research`, `init-deep`, and explicit leading `$start-work`; diagnostic/copy mentions stay inert while leading natural-language `lit start work` stays BLOCKED.
 - `lit search` and `lit query` route to `/litclaude:litresearch` without activating on slash mentions, code spans, or non-lit prompts.
 - Litresearch web lanes require public API/feed preference, validator-first checks, route traces, prompt-injection quarantine, and honest auth/paywall/private-data stop reasons.

package/bin/litclaude-ai.js

@@ -30,13 +30,15 @@ import { runStartWorkContinuationCli } from "../plugins/litclaude/lib/start-work
 import { runStartWorkCli } from "../plugins/litclaude/lib/start-work-cli.mjs";
 import { runLitgoalCli } from "../plugins/litclaude/lib/litgoal/cli.mjs";
 import { runWorkflowCheckCli } from "../plugins/litclaude/lib/workflow-check.mjs";
+import { runWikifyKnowledgeCli } from "../plugins/litclaude/lib/wikify-knowledge-cli.mjs";
+import { automaticUpdateRoot, runAutomaticUpdate } from "../plugins/litclaude/lib/automatic-update.mjs";
 import { runUpdateNotifier } from "./update-notifier.mjs";
 
 const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const packageJson = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
 const version = packageJson.version;
 
-const usage = `Usage: litclaude-ai [--dry-run] <install|doctor|path|run|update|uninstall|litgoal|workflow-check|start-work|start-work-next|public-read> [...args]
+const usage = `Usage: litclaude-ai [--dry-run] <install|doctor|path|run|update|uninstall|litgoal|wikify|workflow-check|start-work|start-work-next|public-read> [...args]
        litclaude-ai --version
 
 Commands:
@@ -45,6 +47,7 @@ Commands:
   path          Print the installed Claude plugin path.
   run -- ...    Run Claude Code after the global plugin install.
   litgoal       Manage litgoal runtime state and evidence.
+  wikify        Manage user-owned local knowledge with cooperative writers; same uid is not a tamper-proof or confidential boundary.
   workflow-check Verify Dynamic workflow, /goal, and subagent delegation readiness.
   start-work    Manage schema-3 bounded-authority lifecycle state.
   start-work-next Print the next active start-work continuation directive.
@@ -55,6 +58,11 @@ Commands:
 Public read options:
   --json        Emit a machine-readable JSON result.
 
+Update options:
+  --no-auto-update
+                Skip LitClaude's foreground automatic install for this command.
+                LITCLAUDE_NO_AUTO_UPDATE provides the same opt-out for a session.
+
 Install options:
   --permission-mode <safe|balanced|yolo>
                 Mutates global Claude settings permissions.allow/deny.
@@ -67,12 +75,24 @@ Install options:
 `;
 
 const parseArgs = (argv) => {
-  const args = [...argv];
+  const args = [];
+  let noAutoUpdate = false;
+  let invalidOption;
+  for (const arg of argv) {
+    if (arg === "--no-auto-update") {
+      noAutoUpdate = true;
+      continue;
+    }
+    if (arg.startsWith("--no-auto-update=")) {
+      invalidOption = arg;
+    }
+    args.push(arg);
+  }
   const wantsVersion = args[0] === "--version" || args[0] === "-v";
-  if (wantsVersion) return { dryRun: false, command: "version", rest: [] };
+  if (wantsVersion) return { dryRun: false, command: "version", rest: [], noAutoUpdate, invalidOption };
   const dryRun = args[0] === "--dry-run";
   if (dryRun) args.shift();
-  return { dryRun, command: args[0], rest: args.slice(1) };
+  return { dryRun, command: args[0], rest: args.slice(1), noAutoUpdate, invalidOption };
 };
 
 const litHome = () => resolve(process.env.LITCLAUDE_HOME ?? join(homedir(), ".litclaude"));
@@ -1044,6 +1064,7 @@ const doctor = ({ dryRun }) => {
     process.stdout.write(`Would check Claude plugin registry: ${pluginKey}\n`);
     process.stdout.write(`Would check Claude statusLine HUD: ${hudCommandForPlugin(pluginPath)}\n`);
     process.stdout.write("Would check global Claude settings permissions.allow/deny and LitClaude ownership-safe removal metadata\n");
+    process.stdout.write(`Would inspect automatic-update receipt/journal under: ${join(automaticUpdateRoot(litHome()), "receipt.json")}\n`);
     process.stdout.write(`Would run: node ${join(pluginPath, "bin", "litclaude-scientific-visualization-doctor.js")}\n`);
     process.stdout.write("Would verify exact canonical frontend corpus bytes, legal companions, no extras, and three canonical runtime closures\n");
     return;
@@ -1149,6 +1170,10 @@ const doctor = ({ dryRun }) => {
   }
 
   process.stdout.write(`Plugin path: ${pluginPath}\n`);
+  const automaticReceiptPath = join(automaticUpdateRoot(litHome()), "receipt.json");
+  if (existsSync(automaticReceiptPath)) {
+    process.stdout.write(`AUTOMATIC_UPDATE_RECEIPT: ${automaticReceiptPath}\n`);
+  }
   const settings = readClaudeSettings();
   const permissionFailures = permissionIntegrityFailures(settings);
   if (permissionFailures.length > 0) {
@@ -1238,6 +1263,48 @@ const uninstall = ({ dryRun }) => {
   process.stdout.write("UNINSTALL_PASS\n");
 };
 
+const emitAutomaticUpdateResult = (result) => {
+  if (!result || result.status === "gated" || result.status === "no-candidate" || result.status === "current" || result.status === "stale-cache" || result.status === "locked") return;
+  if (result.status === "installed") {
+    process.stdout.write(`AUTO_UPDATE_PASS: LitClaude ${result.targetVersion} installed\n`);
+    if (result.receiptPath) process.stdout.write(`AUTO_UPDATE_RECEIPT: ${result.receiptPath}\n`);
+    return;
+  }
+  const label = result.status === "rolled-back"
+    ? "ROLLBACK"
+    : result.status === "rollback-failed" ? "UNKNOWN_STATE" : "STOPPED";
+  process.stderr.write(`AUTO_UPDATE_${label}: automatic update did not replace the current install\n`);
+  if (result.receiptPath) process.stderr.write(`AUTO_UPDATE_RECEIPT: ${result.receiptPath}\n`);
+};
+
+const runEligibleAutomaticUpdate = (parsed) => {
+  if (!["install", "update", "doctor"].includes(parsed.command)) return { status: "gated" };
+  // Validate install/update flags before any automatic side effect. This keeps
+  // malformed or ambiguous requests fail-closed rather than forwarding them to npm.
+  if (parsed.command === "install" || parsed.command === "update") {
+    const existing = readClaudeSettings()[litClaudeSettingsKey] ?? {};
+    parseInstallOptions(parsed.rest, existing.permissionMode);
+  }
+  const result = runAutomaticUpdate({
+    surface: "management",
+    command: parsed.command,
+    rest: parsed.rest,
+    dryRun: parsed.dryRun,
+    currentVersion: version,
+    cachePath: updateNotifierCachePath(),
+    litHome: litHome(),
+    claudeHome: claudeHome(),
+    env: process.env,
+    stdin: process.stdin,
+    stdout: process.stdout,
+    stderr: process.stderr,
+    noAutoUpdate: parsed.noAutoUpdate,
+    cwd: process.cwd(),
+  });
+  emitAutomaticUpdateResult(result);
+  return result;
+};
+
 const main = async () => {
   const parsed = parseArgs(process.argv.slice(2));
   const { command } = parsed;
@@ -1246,6 +1313,17 @@ const main = async () => {
     printUsage();
     process.exit(64);
   }
+  if (parsed.invalidOption) fail(`Unknown update option: ${parsed.invalidOption}`, 64);
+
+  const automaticUpdate = runEligibleAutomaticUpdate(parsed);
+  if (automaticUpdate.status === "rollback-failed") {
+    fail("AUTO_UPDATE_UNKNOWN_STATE: automatic update rollback failed; run `litclaude doctor` before using the install", 1);
+  }
+  if (automaticUpdate.status === "installed") {
+    // The automatic transaction already ran the exact-version install and its
+    // post-install doctor. Do not immediately re-run the old package's command.
+    return;
+  }
 
   switch (command) {
     case "install":
@@ -1267,6 +1345,9 @@ const main = async () => {
     case "litgoal":
       process.exit(runLitgoalCli(parsed.rest));
       break;
+    case "wikify":
+      process.exit(runWikifyKnowledgeCli(parsed.rest, undefined, process.cwd()));
+      break;
     case "workflow-check":
       process.exit(runWorkflowCheckCli(root, version, parsed.rest));
       break;

package/docs/hooks.md

@@ -99,7 +99,7 @@ incumbents are not silently removed.
 
 | Event | Runner | Purpose |
 | --- | --- | --- |
-| `SessionStart` | `plugins/litclaude/bin/litclaude-hook.js session-start` | Discovers repo-local rule files and injects the bodies of always-on rules, plus the rules-loaded context line. |
+| `SessionStart` | `plugins/litclaude/bin/litclaude-hook.js session-start` | Runs the bounded foreground automatic-update barrier when a fresh cache names a newer version, then discovers repo-local rule files and injects the bodies of always-on rules plus the rules-loaded context line. |
 | `UserPromptSubmit` | `plugins/litclaude/bin/litclaude-hook.js user-prompt-submit` | Detects prompt routes and injects workflow context; independently delivers static rules not already recorded for this session. |
 | `PreToolUse` | `plugins/litclaude/bin/litclaude-hook.js pre-tool-use` | Enforces semantic action/root grants before Write, Edit, MultiEdit, NotebookEdit, Bash, Agent, and bounded read tools execute. |
 | `PostToolUse` | `plugins/litclaude/bin/litclaude-hook.js post-tool-use` | Names the post-edit checks the edit actually earned, and injects any glob-scoped rule matching the edited paths. |
@@ -109,6 +109,21 @@ incumbents are not silently removed.
 | `SubagentStop` | `plugins/litclaude/bin/litclaude-hook.js subagent-stop` | Finalizes the lane without child continuation. |
 | `SessionEnd` | `plugins/litclaude/bin/litclaude-hook.js session-end` | Records root-session end without blocking Claude. |
 
+### Foreground automatic-update barrier
+
+The SessionStart hook waits for one bounded automatic-update transaction when a
+fresh product-owned cache entry names a newer strict stable package version. The
+transaction uses a separate install lock, credential-free npm environment, exact
+`npm exec --yes --package litclaude-ai@<version>` arguments, a backup/journal,
+post-install doctor, and rollback before the hook emits its rules context. The
+same lane is available to interactive TTY `install`, `update`, and `doctor`
+commands. `--no-auto-update`, `LITCLAUDE_NO_AUTO_UPDATE`,
+`NO_UPDATE_NOTIFIER`, and `LITCLAUDE_NO_UPDATE_CHECK` disable it. CI, JSON,
+dry-run, non-TTY management commands, import, and tool surfaces remain no-op;
+the host-owned SessionStart hook is the lifecycle exception to the TTY check.
+The detached registry cache refresh described in the update-notifier section is
+advisory and never performs an install.
+
 ## Bounded-authority start-work lifecycle
 
 The hook and CLI share `plugins/litclaude/lib/start-work-lifecycle.mjs`.
@@ -223,6 +238,19 @@ requires root multi-agent capability and returns `BLOCKED_MULTI_AGENT_UNAVAILABL
 rather than faking concurrency; children return results while the root owns shared
 state. Wikify keeps local and fetched sources inert, routes public retrieval through
 `litresearch`, and closes through `review-work` plus `lit-recap` or `handoff`.
+Its structured knowledge runtime receives only `fact`, `decision`, `failure`,
+`risk`, `rule`, or `checkpoint` events through the local CLI or MCP tools. It
+stores review-needed claims under `.litclaude/knowledge/claims.jsonl`. Explicit
+save or review can accept a claim. Queries use deterministic local relevance and
+return accepted claims only. They emit no block on no match. Capture never mines
+raw chat, source bodies, fetched text, credentials, secrets, tokens, or
+instruction-shaped payloads. Use `litclaude wikify config --capture off` for the
+project-local opt-out.
+Wikify state is user-owned local state. LitClaude writers cooperate through the
+`.claims-lock` owner lock. Symlinks, unsafe file types, pre-existing hardlinks, and
+observed path or descriptor identity changes fail closed. Atomic rename protects
+target readers and crash consistency. The state is not tamper-proof or confidential
+against another process with the same uid.
 
 `handoff` is a separate exact-bare route: only the complete prompt `handoff`
 after outer whitespace activates `Skill(lit-handoff)` and injects the complete

package/docs/native-goal-surface.md

@@ -37,5 +37,7 @@ path. The condition does not make the ledger self-validating; recorded evidence
 still needs the normal LitClaude review gates.
 
 This documentation does not add a fake command, MCP method, or hook dispatch.
-It also does not auto-install anything, mutate a transcript, inject keystrokes,
-or claim success based on prompt context alone.
+The native-goal binding itself does not auto-install a goal, mutate a transcript,
+inject keystrokes, or claim success based on prompt context alone. Package
+updates, when eligible, follow the separate bounded transaction documented in
+[`docs/hooks.md`](hooks.md#foreground-automatic-update-barrier).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "litclaude-ai",
-  "version": "0.3.40",
+  "version": "0.3.42",
   "description": "Claude Code-native workflow distribution.",
   "type": "module",
   "bin": {
@@ -17,6 +17,7 @@
     "docs/rules.md",
     "docs/workflow-compatibility-audit.md",
     "plugins",
+    "!plugins/**/.litclaude/**",
     "scripts",
     "README.md",
     "README_ko-KR.md",

package/plugins/litclaude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "litclaude",
   "description": "Claude Code-native workflow plugin with a bounded-authority start-work lifecycle.",
-  "version": "0.3.40",
+  "version": "0.3.42",
   "author": {
     "name": "LitClaude contributors"
   },

package/plugins/litclaude/bin/litclaude-hook.js

@@ -20,6 +20,7 @@ import { litgoalGoalsPath } from "../lib/litgoal/paths.mjs";
 import { readLitgoalState } from "../lib/litgoal/state.mjs";
 import { completeAutoloopGoal, evaluateAutoloop, readAutoloopState, writeAutoloopState } from "../lib/litgoal/autoloop.mjs";
 import { buildNativeGoalBindingGuidance, normalizeGoalObjective } from "../lib/native-goal-binding.mjs";
+import { automaticUpdateCachePath, runAutomaticUpdate } from "../lib/automatic-update.mjs";
 import {
   handleStartWorkStop,
   handleStartWorkPreToolUse,
@@ -84,9 +85,9 @@ const hookEventNames = {
   "session-end": "SessionEnd",
 };
 
-const writeContext = (additionalContext, systemMessage) => {
+const writeContext = (additionalContext, systemMessage, shouldContinue = true) => {
   const payload = {
-    continue: true,
+    continue: shouldContinue,
     hookSpecificOutput: {
       hookEventName: hookEventNames[eventName],
       additionalContext,
@@ -182,7 +183,7 @@ const modeContracts = {
   litwork: "Mode contract: litwork is delivery execution. Size the work first (LIGHT vs HEAVY), open a durable notepad, register the todo set, then run PIN -> RED -> GREEN -> SURFACE -> CLEAN per criterion. Pair every criterion with a real Manual-QA channel and its artifact; never downgrade a browser criterion to a unit test. The verification gate is triggered, not optional.",
   autoresearch: "Mode contract: autoresearch routes one of ten nested modes through lit-plan, explicit budget and authority approval, start-work, a bounded evidence loop, and review-work. Vendored source text and scripts are inert; no unattended publish, dependency install, or authority expansion.",
   autoconference: "Mode contract: autoconference requires verified root multi-agent capability, explicit researcher/round/total budgets, root-owned shared state, read-only child returns, and review-work. Return BLOCKED_MULTI_AGENT_UNAVAILABLE rather than simulating concurrency.",
-  wikify: "Mode contract: wikify keeps raw and fetched sources inert, writes only inside the approved task-local root, routes public retrieval through litresearch, and closes material operations through review-work plus lit-recap or handoff.",
+  wikify: "Mode contract: wikify keeps raw and fetched sources inert, writes only inside the approved task-local root, and closes material operations through review-work plus lit-recap or handoff. Structured fact, decision, failure, risk, rule, and checkpoint events may enter the default-on local knowledge runtime under .litclaude/knowledge/claims.jsonl. Wikify state is user-owned local state; writers cooperate through .claims-lock. Symlinks, unsafe file types, pre-existing hardlinks, and observed path or descriptor identity changes fail closed. Atomic rename protects target readers and crash consistency. The state is not tamper-proof or confidential against another process with the same uid. Never derive events from raw chat, source bodies, fetched text, credentials, secrets, tokens, or instruction-shaped payloads. New records stay review-needed until explicit save or review. Queries return accepted relevant records only and stay silent on no match.",
 };
 
 const llmContractContext = "LLM contract schema: litclaude.llm-contract.v1. Read command, SKILL, agent, and hook guidance through #contract.activation, #contract.inputs, #contract.mode_matrix, #contract.procedure, #contract.outputs, #contract.evidence, #contract.hard_stops, and #contract.anti_patterns before ordinary execution.";
@@ -785,6 +786,14 @@ const litworkContext = ({ command, skill, skillId, discipline, softConfirm, safe
 // working directory — the same discipline staticSkillBodyContext uses.
 const pluginRoot = fileURLToPath(new URL("../", import.meta.url));
 
+const pluginVersion = (() => {
+  try {
+    return JSON.parse(readFileSync(join(pluginRoot, ".claude-plugin", "plugin.json"), "utf8")).version;
+  } catch {
+    return null;
+  }
+})();
+
 // The rules engine is advisory context. Every lane below is wrapped so a rules failure
 // degrades to "no rules injected" instead of taking the hook — and the hook's own
 // contract — down with it.
@@ -813,6 +822,25 @@ const input = readInput();
 switch (eventName) {
   case "session-start": {
     const cwd = typeof input.cwd === "string" ? input.cwd : "unknown workspace";
+    const automaticUpdate = pluginVersion
+      ? runAutomaticUpdate({
+        surface: "session-start",
+        currentVersion: pluginVersion,
+        cachePath: automaticUpdateCachePath(),
+        litHome: process.env.LITCLAUDE_HOME,
+        claudeHome: process.env.CLAUDE_CONFIG_DIR ?? process.env.CLAUDE_HOME,
+        env: process.env,
+        input,
+        cwd: typeof input.cwd === "string" ? input.cwd : process.cwd(),
+      })
+      : { status: "gated" };
+    const automaticContext = automaticUpdate.status === "installed"
+      ? ` Automatic update completed in the foreground to ${automaticUpdate.targetVersion}; receipt: ${inertFilesystemData(automaticUpdate.receiptPath)}.`
+      : automaticUpdate.status === "rollback-failed"
+        ? " BLOCKED: automatic update rollback failed; install state may be inconsistent. Run `litclaude doctor` before relying on it."
+      : ["rolled-back", "failed"].includes(automaticUpdate.status)
+        ? " Automatic update was not applied; the existing install was retained and the receipt records the result."
+        : "";
     const pressureContext = transcriptHasContextPressure(input.transcript_path)
       ? " Context pressure detected: before edits, reread HANDOFF.md, the active plan, .litclaude/start-work/ledger.jsonl, .litclaude/boulder.json, and git status --short."
       : "";
@@ -820,7 +848,11 @@ switch (eventName) {
     // AGENTS.md, plans). The engine now actually delivers the rule bodies themselves.
     const rules = staticRulesContext({ cwd, sessionId: input.session_id });
     const rulesSuffix = rules ? `\n\n${rules}` : "";
-    writeContext(`LitClaude rules loaded for ${inertFilesystemData(cwd)}. Read CLAUDE.md, AGENTS.md, .claude/rules/**/*.md, .github/instructions/**/*.md, and named plan or handoff files before edits.${pressureContext}${rulesSuffix}`);
+    writeContext(
+      `LitClaude rules loaded for ${inertFilesystemData(cwd)}. Read CLAUDE.md, AGENTS.md, .claude/rules/**/*.md, .github/instructions/**/*.md, and named plan or handoff files before edits.${automaticContext}${pressureContext}${rulesSuffix}`,
+      undefined,
+      automaticUpdate.status !== "rollback-failed",
+    );
     break;
   }
   case "user-prompt-submit": {