projectstore-claude 0.28.2 → 0.29.1

package/README.md

@@ -6,7 +6,9 @@ The Claude Code installer for [projectstore](https://www.npmjs.com/package/proje
 npx projectstore-claude install --project "$PWD"
 ```
 
-It registers the plugin for that checkout at the host's local scope, previews every write and every host command before it runs, and asks for nothing else — naming the shell is the confirmation. Restart Claude Code afterwards.
+It registers the plugin for that checkout at the host's local scope. It prints its plan first — every write and every host command, verbatim — and at a terminal asks `Apply N changes? [Y/n]` before anything runs; then each step as it runs, and what to do next. Without a terminal (a script, CI, an agent's tool) naming the shell is the confirmation; `--json` never asks. Restart Claude Code afterwards.
+
+- See before you write: `npx projectstore-claude plan --project "$PWD"` prints the same plan and writes nothing; `--verbose` adds every row's reasoning; `npx projectstore-claude <verb> --help` lists a verb's options with examples.
 
 - Upgrade, or pin: `npx projectstore-claude@<version> upgrade --project "$PWD"` — the version you name is the version you run.
 - Uninstall: `npx projectstore-claude uninstall --project "$PWD"` — forgets the registration for that checkout and nothing else; your vault is plain markdown and stays yours.

package/bin/projectstore-claude.mjs

@@ -8,8 +8,10 @@
 // `--harness claude-code` inserted after a verb that takes it. Every other
 // argument passes through, so `projectstore-claude <verb> …` is exactly
 // `projectstore <verb> --harness claude-code …` — the same preview, the
-// same files, the same exit code. Naming the shell is the confirmation the
-// core's install gate asks for, exactly as naming --harness is.
+// same files, the same exit code. Naming the shell names the harness, exactly
+// as --harness does: without a terminal that is the confirmation the core's
+// install gate asks for; at a terminal the core shows the plan and asks (the
+// install spec, contract 9 as amended 2026-10-04).
 import { existsSync } from "node:fs";
 import { spawnSync } from "node:child_process";
 import { constants as osConstants } from "node:os";
@@ -72,17 +74,20 @@ if (!core) {
     process.stderr.write(`${SHELL}: ${fixed.error}\n`);
     process.exitCode = 2;
   } else {
-    // stdio inherited: the core's install gate asks on a terminal and refuses
-    // without one, so the child must see the real stdin and stdout. No
-    // timeout — the child waits on a human at the preview. exitCode, not
-    // exit(): the core's own bin says why (a pending write on a pipe).
+    // stdio inherited: the core's install gate shows the plan and asks on a
+    // terminal, and refuses a bare run without one, so the child must see the
+    // real stdin and stdout. No timeout — the child waits on a human at the
+    // question. exitCode, not exit(): the core's own bin says why (a pending
+    // write on a pipe). PROJECTSTORE_SHELL lets the core's --help speak this
+    // shell's name; nothing the core plans or writes reads it.
     const r = spawnSync(process.execPath, [core, ...fixed.argv], {
       stdio: "inherit",
-      env: { ...process.env, PROJECTSTORE_DISTRIBUTION_ROOT: root },
+      env: { ...process.env, PROJECTSTORE_DISTRIBUTION_ROOT: root, PROJECTSTORE_SHELL: SHELL },
     });
     if (r.error) process.stderr.write(`${SHELL}: ${r.error.message}\n`);
-    // A signal is relayed the shell way (128 + its number): Ctrl-C at the
-    // preview is 130 here as it would be on the core itself.
+    // A signal is relayed the shell way (128 + its number): the core reads
+    // its answer in the terminal's line mode, so Ctrl-C at the question is a
+    // real SIGINT — 130 here as it would be on the core itself.
     process.exitCode = r.status ?? (r.signal ? 128 + (osConstants.signals[r.signal] || 0) : 2);
   }
 }

package/node_modules/projectstore/.claude-plugin/marketplace.json

@@ -12,7 +12,7 @@
       "name": "projectstore",
       "displayName": "projectstore",
       "description": "📚 Your agent runs the project through a verified loop: task → artifact (ADR · spec · epic · story) → adversarial critic → backlog → planner → reviewer → done. Plain markdown in an Obsidian-friendly vault, every write approved by you — and any model can pick the project up tomorrow.",
-      "version": "0.28.2",
+      "version": "0.29.1",
       "author": {
         "name": "Evgenii Konev",
         "email": "ekonev@smartandpoint.com",

package/node_modules/projectstore/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "projectstore",
   "displayName": "projectstore",
-  "version": "0.28.2",
+  "version": "0.29.1",
   "description": "Your agent runs the project through a verified loop: task → artifact (ADR / spec / epic / story) → adversarial critic → backlog → planner → reviewer → done. Plain markdown in git — any model can pick the project up tomorrow.",
   "author": {
     "name": "Evgenii Konev @ SmartAndPoint",

package/node_modules/projectstore/README.md

@@ -94,7 +94,7 @@ Contributors: `git clone` this repo, then `claude --plugin-dir ./ProjectStore`.
 npx projectstore-claude install --project "$PWD"
 ```
 
-The same tree is published to npm as [`projectstore`](https://www.npmjs.com/package/projectstore) — one source package carrying every harness's manifest — and `projectstore-claude` is its Claude Code shell: the core pinned at the same version and bundled inside, the harness fixed, so the one command has the same shape on every harness. It registers the plugin with Claude Code: it writes a small local marketplace of its own under your Claude home, then drives `claude plugin marketplace add` / `plugin install` **at local scope**, so the registration lands in this checkout's `.claude/settings.local.json` and nowhere else. Every host command is printed before it runs; naming the harness is the confirmation. Restart Claude Code afterwards. A git-marketplace copy already enabled for the checkout is silenced there (not globally) so the plugin does not load twice; `uninstall` turns it back on. Pin or upgrade with `npx projectstore-claude@<version> upgrade --project "$PWD"` — the version you name is the version you run. The core's low-level form, `npx projectstore <verb> --harness claude-code …`, is exactly what the shell runs. bun works the same on the packed bin.
+The same tree is published to npm as [`projectstore`](https://www.npmjs.com/package/projectstore) — one source package carrying every harness's manifest — and `projectstore-claude` is its Claude Code shell: the core pinned at the same version and bundled inside, the harness fixed, so the one command has the same shape on every harness. It registers the plugin with Claude Code: it writes a small local marketplace of its own under your Claude home, then drives `claude plugin marketplace add` / `plugin install` **at local scope**, so the registration lands in this checkout's `.claude/settings.local.json` and nowhere else. It prints its plan first — every file it writes and every host command, verbatim — and at a terminal asks `Apply N changes? [Y/n]`; then it shows each step as it runs and what to do next. Without a terminal (a script, CI, an agent's tool) naming the harness is the confirmation. `plan` prints the same plan and writes nothing; `--verbose` adds every row's reasoning; `npx projectstore-claude <verb> --help` lists a verb's options with examples. Restart Claude Code afterwards. A git-marketplace copy already enabled for the checkout is silenced there (not globally) so the plugin does not load twice; `uninstall` turns it back on. Pin or upgrade with `npx projectstore-claude@<version> upgrade --project "$PWD"` — the version you name is the version you run. The core's low-level form, `npx projectstore <verb> --harness claude-code …`, is exactly what the shell runs. bun works the same on the packed bin.
 
 **Codex has its own shell with the same one-command shape:**
 `npx projectstore-codex install --project "$PWD"`. It carries a Codex
@@ -120,7 +120,7 @@ The package also carries a `bin`. Without a session — in CI, or in a shell —
 
 ```
 npx projectstore doctor --json
-npx projectstore install --harness claude-code   # the low-level form the shell runs: previews, then writes the agents block and the status line; naming the harness is the confirmation, there is no --yes
+npx projectstore install --harness claude-code   # the low-level form the shell runs: shows the plan, asks at a terminal, then writes; without a terminal naming the harness is the confirmation — there is no --yes
 npx projectstore reconcile --write --only kanban
 ```
 

package/node_modules/projectstore/commands/review.md

@@ -23,7 +23,7 @@ You are running a peer review on a projectstore artifact.
 
 5. **Gather domain context**: read the vault's top-level `README.md` and the folder README of the artifact's parent (e.g. `adr/README.md`). Keep both short — they're context for the critic, not the focus.
 
-6. **Spawn the critic agent**. Prefer this plugin's own `projectstore:critic` (purpose-built fresh-context critic, no sycophancy; named `projectstore:projectstore-critic` before v0.13). If unavailable, fall back to `oh-my-claudecode:critic`, then `general-purpose`. Use this exact prompt template:
+6. **Spawn the critic agent**. Prefer this plugin's own `projectstore:critic` (purpose-built fresh-context critic, no sycophancy). If unavailable, fall back to `oh-my-claudecode:critic`, then `general-purpose`. Use this exact prompt template:
 
    ```
    You are a critic-mode reviewer. You have ONLY the artifact and the

package/node_modules/projectstore/harnesses/claude-code.json

@@ -1,5 +1,5 @@
 {
-  "_comment": "Harness capability manifest — Claude Code. This is the SOURCE layout (generation spec, contract 2): the plugin's own commands/, agents/, skills/ and hooks/hooks.json are already in Claude Code's shapes, so nothing is emitted for it (emit: false). The manifest still exists in full because the portability lint reads every harness's vocabulary, and a token only Claude Code understands is only detectable as unmapped in another harness's tree if Claude Code's own names are written down somewhere. It carries no `lint` block and an empty `rewrites` because linting runs over emitted trees only. Shape contributed by Maxim Podreshetnikov (PR #13); `verified`, `output_channels`, `scope_reason`, `root_placeholder_literal` and `agent_overrides` are the spec's additions.",
+  "_comment": "Harness capability manifest — Claude Code. This is the SOURCE layout (generation spec, contract 2): the plugin's own commands/, agents/, skills/ and hooks/hooks.json are already in Claude Code's shapes, so nothing is emitted for it (emit: false). The manifest still exists in full because the portability lint reads every harness's vocabulary, and a token only Claude Code understands is only detectable as unmapped in another harness's tree if Claude Code's own names are written down somewhere. It carries no `lint` block and an empty `rewrites` because linting runs over emitted trees only; its `ui_vocabulary` lists the UI affordances that mean nothing elsewhere, read by the generator's leak check and by the runtime vocabulary lint over what the core prints for another harness (generation spec, contracts 2 and 18). Shape contributed by Maxim Podreshetnikov (PR #13); `verified`, `output_channels`, `scope_reason`, `root_placeholder_literal` and `agent_overrides` are the spec's additions.",
   "id": "claude-code",
   "display_name": "Claude Code",
   "emit": false,
@@ -20,6 +20,9 @@
       "/plugin marketplace add SmartAndPoint/ProjectStore && /plugin install projectstore@SmartAndPoint   (git marketplace, user-wide)",
       "restart Claude Code"
     ],
+    "next": [
+      "restart Claude Code in this project"
+    ],
     "notes": [
       "Git marketplace only: auto-update is OFF by default for third-party plugins: /plugin -> Marketplaces -> SmartAndPoint -> toggle auto-update. The npm registration updates when you run `npx projectstore-claude upgrade --project <dir>`.",
       "Pin a git-marketplace release with: /plugin marketplace add SmartAndPoint/ProjectStore#<tag>; pin the npm registration with npx projectstore-claude@<version>.",
@@ -461,9 +464,24 @@
     "interactive_approval_tool": true,
     "permission_decision_hook": "PreToolUse",
     "subagent_tool_allowlist": true,
-    "subagent_model_per_invocation": true
+    "subagent_model_per_invocation": true,
+    "session_rename": "/rename <name>",
+    "session_rename_reason": "Claude Code's own command for naming a session; the session-name offer prints it filled (generation spec, contract 18). A harness without one gets no offer.",
+    "bind_inherit": true,
+    "bind_inherit_reason": "commands/bind.md adopts the binding of the checkout a worktree was forked from (`bind --inherit`), so an unbound worktree is told to run that. A harness whose bind cannot inherit is told the explicit vault instead (generation spec, contract 18)."
   },
   "rewrites": [],
+  "ui_vocabulary": [
+    "/plugin",
+    "/reload-plugins",
+    "AskUserQuestion"
+  ],
+  "ui_vocabulary_reason": "This harness's UI affordances and tool names: words that mean nothing on another harness. The generator refuses them in another harness's rendered tree, and the runtime vocabulary lint refuses them in what the core prints for another harness (generation spec, contracts 6 and 18). A word here must be followed by a non-word character to count, so `/plugins/` in a path is not `/plugin`.",
+  "update_hint": {
+    "line": "See /plugin → Marketplaces to enable auto-update.",
+    "welcome": ["**About future updates**: Claude Code does NOT auto-update third-party marketplaces by default. To get notified of new releases (v0.7+):", "1. Open `/plugin` → **Marketplaces** tab.", "2. Find **SmartAndPoint**.", "3. Toggle **auto-update** on.", "", "Without it, you'd run `/plugin marketplace update SmartAndPoint` manually. See https://github.com/SmartAndPoint/ProjectStore#updates for details."],
+    "reason": "What the first-run welcome and its one-line notice say about updates (generation spec, contract 18): `line` ends the notice, `welcome` is the welcome's update block. update_instructions is the long-form guidance; this is the part a session prints, kept here so no hook names a harness's update path."
+  },
   "update_instructions": [
     "**About future updates**: installed from the git marketplace, Claude Code does NOT auto-update third-party marketplaces by default (an npm registration updates with `npx projectstore-claude upgrade --project <dir>`). To get notified of new releases (v0.7+):",
     "1. Open `/plugin` → **Marketplaces** tab.",

package/node_modules/projectstore/harnesses/codex.json

@@ -29,7 +29,7 @@
     ],
     "shared_env_reason": "Codex sets Claude Code's plugin-root names too, for compatibility — measured in every one of the 759 captured hook payloads. Without declaring them, a Codex session scores a strong detection hit for claude-code, ties with codex, and loses the tie to manifest filename order. A variable two harnesses both set identifies neither, so these are demoted to weak for every manifest (generation spec, contract 1, amended 2026-09-08).",
     "session_env": [],
-    "session_env_reason": "Unmeasured. CODEX_HOME never appeared in a hook environment — it is a shell-profile signal, not a session marker — and no equivalent of CLAUDECODE was observed."
+    "session_env_reason": "Deliberately empty, though measured. Codex's exec tool sets CODEX_THREAD_ID and CODEX_SESSION_ID in every command (measured 2026-10-05, codex-cli 0.160.0; CODEX_SANDBOX* depend on the sandbox mode), and CODEX_HOME never appeared in a hook environment. Declaring them would identify a session, but session_env also defers the registration and the layout move inside a session (insideHostSession), which would stop the doctor skill's upgrade --json fix from running there. Splitting identity from deferral is the question of *Codex hook contract measured in a live session* (PS-HARNESS); until then a core run from a rendered skill is identified by the shell that bundles it (generation spec, contract 18)."
   },
   "tools": {
     "write_tools": [
@@ -161,7 +161,10 @@
       "kind": "host",
       "scope": "user",
       "scope_reason": "Codex spawns subagents through a tool (collaborationspawn_agent), not by loading a plugin's agents/ directory.",
-      "why_unsupported": "Measured: told to run projectstore:critic, Codex spawned six of its own generic subagents named after our roster and briefed them itself; none of our agents/*.md prose reached them. No route from a plugin's agents/ entry to that mechanism has been found (roadmap B4)."
+      "why_unsupported": "Measured: told to run projectstore:critic, Codex spawned six of its own generic subagents named after our roster and briefed them itself; none of our agents/*.md prose reached them. No route from a plugin's agents/ entry to that mechanism has been found (roadmap B4).",
+      "rendered_as": "skill",
+      "rendered_name": "projectstore-<name>",
+      "rendered_reason": "Each role is rendered as a skill of this name (the generator reads this key), so a role is called through skills.invocation: $projectstore-critic. Messages name roles this way (generation spec, contract 18)."
     },
     "agents_block": {
       "supported": true,
@@ -186,7 +189,10 @@
       "kind": "host",
       "scope": "user",
       "scope_reason": "Codex has no registrable root slash command; the /prompts: mechanism is deprecated.",
-      "why_unsupported": "Shipping commands/ is actively harmful here: Codex rewrites them into skills itself and keeps ${CLAUDE_PLUGIN_ROOT} in the body, producing entry points that exit 1 with Cannot find module '/bin/projectstore.mjs' (reproduced). The generator renders them as skills instead (roadmap B5)."
+      "why_unsupported": "Shipping commands/ is actively harmful here: Codex rewrites them into skills itself and keeps ${CLAUDE_PLUGIN_ROOT} in the body, producing entry points that exit 1 with Cannot find module '/bin/projectstore.mjs' (reproduced). The generator renders them as skills instead (roadmap B5).",
+      "rendered_as": "skill",
+      "rendered_name": "projectstore-<name>",
+      "rendered_reason": "Each command is rendered as a skill of this name (the generator reads this key), so a command is called through skills.invocation: $projectstore-doctor. Messages name commands this way (generation spec, contract 18)."
     },
     "hooks": {
       "supported": true,
@@ -286,7 +292,12 @@
       }
     }
   },
-  "capabilities": {},
+  "capabilities": {
+    "session_rename": null,
+    "session_rename_reason": "No session-rename command is known for Codex, so it gets no session-name offer (generation spec, contract 18).",
+    "bind_inherit": false,
+    "bind_inherit_reason": "The rendered bind skill and the CLI's bind verb have no inherit path; only Claude Code's command does. An unbound worktree is told to bind the parent checkout's vault explicitly. A follow-up story gives the core an inherit path and flips this."
+  },
   "rewrites": [],
   "install": {
     "mechanism": "the package's portable plugin root, registered through its distribution shell and Codex's own marketplace CLI",
@@ -298,6 +309,10 @@
       "restart Codex and approve the ProjectStore hooks when prompted",
       "run `$projectstore-bind <vault-path>` in Codex"
     ],
+    "next": [
+      "restart Codex from a terminal and approve the ProjectStore hooks when it asks",
+      "in an unbound project, run `$projectstore-bind <vault-path>` in Codex"
+    ],
     "notes": [
       "The installation is user-global because Codex's marketplace, plugin row and cache live in CODEX_HOME; the AGENTS.md block is project-local.",
       "Upgrade with `npx projectstore-codex@<version> upgrade --project \"$PWD\"`; the named package version is also the plugin version.",
@@ -306,6 +321,11 @@
     ],
     "docs": "https://github.com/SmartAndPoint/ProjectStore#install--one-message"
   },
+  "update_hint": {
+    "line": "Update with `{upgrade}`.",
+    "welcome": ["**About future updates**: run `{upgrade}` from a terminal, then restart Codex and approve any hook it asks about.", "", "See https://github.com/SmartAndPoint/ProjectStore#updates for details."],
+    "reason": "What the first-run welcome and its one-line notice say about updates (generation spec, contract 18): `line` ends the notice, `welcome` is the welcome's update block, and `{upgrade}` is filled with this harness's shell command at latest, so what is printed runs as printed. update_instructions is the long-form guidance; this is the part a session prints, kept here so no hook names a harness's update path."
+  },
   "update_instructions": "Run `npx projectstore-codex@<version> upgrade --project <dir>`. The installer atomically replaces its stable source and `codex plugin add projectstore@projectstore-npx` materialises the new version; this was measured across two dev builds on codex-cli 0.153.4. Restart Codex afterwards so the new skills and hooks are loaded.",
   "agent_translation": {
     "carries_model": false,

package/node_modules/projectstore/hooks/pre-compact.mjs

@@ -31,6 +31,7 @@ import {
   readActivityAsync,
   resolveInFlightArtifact,
   pathCell,
+  commandForm,
 } from "../scripts/lib.mjs";
 
 // Exits after the flush, never before: process.exit does not drain a pending
@@ -110,7 +111,7 @@ async function main() {
   } else {
     // True on every path: plugin commands are installation-scoped and not
     // gated by auto_inject.
-    parts.push("run /projectstore:status to reorient");
+    parts.push(`run ${commandForm("status")} to reorient`);
   }
 
   emit(`projectstore: compacting — ${parts.join(", ")}`);

package/node_modules/projectstore/hooks/session-rules.mjs

@@ -16,22 +16,34 @@
 // Spec: "Entry-rule detection: the score, the open-story predicate, and the
 // delivery seams", contract 17.
 
-import { readConfig, readStdinJson, adoptHookInput } from "../scripts/lib.mjs";
+import { readConfig, readStdinJson, adoptHookInput, roleForm, sharedRoleForm } from "../scripts/lib.mjs";
 
-// Kept well under the cap; asserted by a test rather than by intention.
-const RULES = `# projectstore — standing rules for this session
+// Kept well under the cap; asserted by a test rather than by intention. The
+// roles are named the way the session's harness calls them (generation spec,
+// contract 18). The shared AGENTS.md block names them in the source harness's
+// form until that block is per-harness, so a session whose form differs is
+// told once that both name one role — otherwise the second rule below would
+// have it report the block as a contradiction every session.
+function rules() {
+  const critic = roleForm("critic"), reviewer = roleForm("reviewer");
+  const shared = sharedRoleForm("critic");
+  const bridge = shared === critic
+    ? ""
+    : `\n\nThe \`AGENTS.md\` block may name roles as \`${shared}\`; that is the same role, called \`${critic}\` here.`;
+  return `# projectstore — standing rules for this session
 
 **Artifact-first order.** A feature-sized request opens a vault artifact before
 it opens an editor: analysis → placement (which epic, which story) → an ADR
-and/or spec when the "how" is non-trivial → \`projectstore:critic\` → only then
-implementation → \`projectstore:reviewer\`. "Feature-sized" is not a judgement
+and/or spec when the "how" is non-trivial → \`${critic}\` → only then
+implementation → \`${reviewer}\`. "Feature-sized" is not a judgement
 call about how the request was phrased — it is about what the work touches. If
 you are about to write across several source files, open the story first.
 
 **Report instruction conflicts; do not arbitrate them.** If a session-level or
 harness-level instruction contradicts these rules or the \`AGENTS.md\`
 registration block, say so and ask which wins. Resolving it silently is how the
-contradiction becomes invisible to the person who could have settled it.`;
+contradiction becomes invisible to the person who could have settled it.${bridge}`;
+}
 
 function emit(additionalContext) {
   process.stdout.write(JSON.stringify({
@@ -55,7 +67,7 @@ function main() {
   // Honour auto_inject: a session that opted out of context injection is
   // exactly the case for which the AGENTS.md block remains the durable copy.
   if (cfg.auto_inject === false) return;
-  emit(RULES);
+  emit(rules());
 }
 
 try { main(); } catch {

package/node_modules/projectstore/hooks/session-start.mjs

@@ -36,6 +36,11 @@ import {
   PATH_CELL,
   ERROR_CELL,
   TITLE_CELL,
+  commandForm,
+  updateHint,
+  speakingDisplayName,
+  inheritForm,
+  bindInherits,
 } from "../scripts/lib.mjs";
 import { runStartupChecks } from "../scripts/doctor.mjs";
 import { resolveBinding, bindingOfferText } from "../scripts/worktree.mjs";
@@ -60,8 +65,8 @@ function welcomedMarkerWritePath(proj) {
 // the same message.
 function buildWelcome(cfg = null) {
   const start = cfg && cfg.vault_path
-    ? `**Already bound**: this project's vault is \`${truncFront(String(cfg.vault_path), PATH_CELL)}\`. Ask for what you want — the agent picks up commands like \`/projectstore:adr\` and \`/projectstore:epic\` from the conversation, and you approve every write. If the vault has no folders yet, \`/projectstore:scaffold\` lays them out.`
-    : "**To start using it**: run `/projectstore:bind <vault-path>` and point it at an Obsidian vault (or any folder). After that, the agent will pick up commands like `/projectstore:adr` and `/projectstore:epic` from the conversation; you only approve the writes.";
+    ? `**Already bound**: this project's vault is \`${truncFront(String(cfg.vault_path), PATH_CELL)}\`. Ask for what you want — the agent picks up commands like \`${commandForm("adr")}\` and \`${commandForm("epic")}\` from the conversation, and you approve every write. If the vault has no folders yet, \`${commandForm("scaffold")}\` lays them out.`
+    : `**To start using it**: run \`${commandForm("bind", { args: "<vault-path>" })}\` and point it at an Obsidian vault (or any folder). After that, the agent will pick up commands like \`${commandForm("adr")}\` and \`${commandForm("epic")}\` from the conversation; you only approve the writes.`;
   return [
     "# 👋 projectstore is loaded for the first time in this project",
     "",
@@ -69,12 +74,9 @@ function buildWelcome(cfg = null) {
     "",
     start,
     "",
-    "**About future updates**: Claude Code does NOT auto-update third-party marketplaces by default. To get notified of new releases (v0.7+):",
-    "1. Open `/plugin` → **Marketplaces** tab.",
-    "2. Find **SmartAndPoint**.",
-    "3. Toggle **auto-update** on.",
-    "",
-    "Without it, you'd run `/plugin marketplace update SmartAndPoint` manually. See https://github.com/SmartAndPoint/ProjectStore#updates for details.",
+    // The update advice is the harness's own (its manifest's update_hint):
+    // a git marketplace's toggle means nothing to a harness installed from npm.
+    ...updateHint().welcome,
     "",
     "_This message appears once per project._",
     "",
@@ -128,7 +130,7 @@ function buildOthersWarning(others) {
     "",
     `## ⚠️ Multi-session warning — ${others.length} other projectstore session(s) active on this vault`,
     "",
-    "Another Claude Code session is currently working on the same vault.",
+    `Another ${speakingDisplayName()} session is currently working on the same vault.`,
     "Active session(s):",
     "",
   ];
@@ -143,13 +145,13 @@ function buildOthersWarning(others) {
     );
   }
   if (others.length > SIBLING_CAP) {
-    lines.push(`- …and ${others.length - SIBLING_CAP} more — run \`/projectstore:status\``);
+    lines.push(`- …and ${others.length - SIBLING_CAP} more — run \`${commandForm("status")}\``);
   }
   lines.push(
     "",
     "**Before creating new ADRs / epics / stories / research:**",
-    "1. Run `/projectstore:search <topic-keywords>` to check for in-flight artifacts on the same topic.",
-    "2. Run `/projectstore:status` to see what artifacts have been touched recently.",
+    `1. Run \`${commandForm("search", { args: "<topic-keywords>" })}\` to check for in-flight artifacts on the same topic.`,
+    `2. Run \`${commandForm("status")}\` to see what artifacts have been touched recently.`,
     "3. After creation, the plugin re-checks file existence right before write — collisions are detected, but topic / number reservation across sessions is on you and the other agent to coordinate.",
     "",
   );
@@ -179,8 +181,8 @@ async function main() {
   // one: a bound project is told what it is bound to, not to bind again.
   const welcomeSystemMessage = welcome
     ? (cfg && cfg.vault_path
-      ? `👋 projectstore: first-run welcome shown. Bound to ${cfg.vault_path}. See /plugin → Marketplaces to enable auto-update.`
-      : "👋 projectstore: first-run welcome shown. Start with /projectstore:bind <vault-path>. See /plugin → Marketplaces to enable auto-update.")
+      ? `👋 projectstore: first-run welcome shown. Bound to ${cfg.vault_path}. ${updateHint().line}`
+      : `👋 projectstore: first-run welcome shown. Start with ${commandForm("bind", { args: "<vault-path>" })}. ${updateHint().line}`)
     : null;
 
   if (!cfg) {
@@ -191,7 +193,7 @@ async function main() {
     // redundancy is accepted rather than papered over with copy that will rot.
     const offer = binding && binding.state === "inheritable" ? bindingOfferText(binding) : "";
     const offerSystemMessage = offer
-      ? "projectstore: this worktree is unbound — /projectstore:bind --inherit adopts the binding of the checkout it was forked from."
+      ? `projectstore: this worktree is unbound — ${inheritForm(binding.vaultPath, { layout: binding.layout, language: binding.language })} ${bindInherits() ? "adopts the binding of" : "binds it to the vault, layout and language of"} the checkout it was forked from.`
       : null;
     const body = offer + (welcome || "");
     if (body) {
@@ -273,9 +275,9 @@ async function main() {
   try {
     const r = runStartupChecks(cfg, proj);
     if (r.skipped) {
-      doctorMsg = "projectstore doctor: startup checks skipped — run /projectstore:doctor";
+      doctorMsg = `projectstore doctor: startup checks skipped — run ${commandForm("doctor")}`;
     } else if (r.count > 0) {
-      doctorMsg = `projectstore doctor: ${r.count} install issue(s) — run /projectstore:doctor`;
+      doctorMsg = `projectstore doctor: ${r.count} install issue(s) — run ${commandForm("doctor")}`;
     }
     // Offers (doctor's OFFER_CHECKS): one-time steps a user should see once,
     // e.g. the re-stamp after a plugin update — not issues, not silent.
@@ -287,7 +289,7 @@ async function main() {
   if (gatherError) {
     emit(
       welcome +
-        `# projectstore: vault load failed\n\n${truncEnd(String(gatherError.message), ERROR_CELL)}\n\nFix \`.projectstore/projectstore.json\` or run \`/projectstore:bind <path>\` again.`,
+        `# projectstore: vault load failed\n\n${truncEnd(String(gatherError.message), ERROR_CELL)}\n\nFix \`.projectstore/projectstore.json\` or run \`${commandForm("bind", { args: "<path>" })}\` again.`,
       systemMessage,
     );
     return;

package/node_modules/projectstore/package.json

@@ -1,6 +1,6 @@
 {
   "name": "projectstore",
-  "version": "0.28.2",
+  "version": "0.29.1",
   "description": "Your agent runs the project through a verified loop: task → artifact (ADR / spec / epic / story) → adversarial critic → backlog → planner → reviewer → done. Plain markdown in git — any model can pick the project up tomorrow.",
   "keywords": [
     "project-management",
@@ -57,7 +57,7 @@
     "access": "public"
   },
   "scripts": {
-    "test": "node --test tests/*.test.mjs",
+    "test": "node --test --import ./tests/fixtures/hermetic.mjs tests/*.test.mjs",
     "guard": "node scripts/version-guard.mjs",
     "packlist": "node scripts/version-guard.mjs --write-packlist",
     "adapters": "node scripts/build-adapters.mjs --write",

package/node_modules/projectstore/scripts/binding.mjs

@@ -27,7 +27,7 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, realpathSync } from "node:fs";
 import { join, resolve, isAbsolute, dirname } from "node:path";
 import { homedir } from "node:os";
-import { writeFileAtomic, pluginRoot, ensureRuntimeDir, layoutPaths } from "./lib.mjs";
+import { writeFileAtomic, pluginRoot, ensureRuntimeDir, layoutPaths, commandForm } from "./lib.mjs";
 import { configPath as harnessConfigPath } from "./harness.mjs";
 
 export const DEFAULT_LAYOUT = "engineering";
@@ -154,12 +154,12 @@ export function renderBindPlan(p, done = null) {
   const lines = [];
   if (!p.ok) { for (const r of p.refusals) lines.push(r.message); return lines.join("\n") + "\n"; }
   if (p.state === "same") {
-    lines.push(`Already bound to ${p.vault}${p.ignored.length ? ` — --${p.ignored.join(" and --")} ignored: a change of ${p.ignored.join("/")} is not a rebind (edit the config, or rebind to another vault)` : ""}. Run /projectstore:scaffold to (re)create the layout, or \`projectstore status\` to inspect it.`);
+    lines.push(`Already bound to ${p.vault}${p.ignored.length ? ` — --${p.ignored.join(" and --")} ignored: a change of ${p.ignored.join("/")} is not a rebind (edit the config, or rebind to another vault)` : ""}. Run ${commandForm("scaffold")} to (re)create the layout, or \`projectstore status\` to inspect it.`);
     return lines.join("\n") + "\n";
   }
   if (done && done.created_vault) lines.push(`Created ${p.vault}`);
   lines.push(`Wrote ${p.configPath}${p.state === "different" ? ` (rebind from ${p.before.vault_path}; kept: ${p.keptKeys.join(", ") || "nothing else"})` : ""}`);
   lines.push(`  vault_path: ${p.vault}`, `  layout:     ${p.layout}`, `  language:   ${p.language}`);
-  if (done) lines.push("", p.vaultExists && !done.created_vault ? "Next: `projectstore status`, or /projectstore:scaffold if the vault has no layout folders yet." : "Next: /projectstore:scaffold in a session creates the layout's folders and READMEs.");
+  if (done) lines.push("", p.vaultExists && !done.created_vault ? `Next: \`projectstore status\`, or ${commandForm("scaffold")} if the vault has no layout folders yet.` : `Next: ${commandForm("scaffold")} in a session creates the layout's folders and READMEs.`);
   return lines.join("\n") + "\n";
 }

package/node_modules/projectstore/scripts/build-adapters.mjs

@@ -6,11 +6,28 @@
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync } from "node:fs";
 import { dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { emittingHarnesses, sourceHarness } from "./harness.mjs";
+import { emittingHarnesses, sourceHarness, invocation, uiWordPatterns } from "./harness.mjs";
 import { writeFileAtomic } from "./lib.mjs";
 
 const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const SOURCE = sourceHarness();
+// The source harness's UI affordances, from its manifest (ui_vocabulary): the
+// same list the runtime vocabulary lint reads (generation spec, contract 18).
+// The source's command form and the target's skill namespace, from the
+// manifests (generation spec, contract 18): the body rewrite, the passive-skill
+// name rule and the leak check read these, so a renamed form cannot leave
+// directory names and in-body references disagreeing.
+const escapeRe = (t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+const SOURCE_COMMAND_PREFIX = SOURCE.surfaces.commands.invocation.split("<name>")[0];
+const SOURCE_COMMAND = new RegExp(`${escapeRe(SOURCE_COMMAND_PREFIX)}([a-z0-9-]+|\\*)`, "g");
+const SOURCE_UI = uiWordPatterns(SOURCE);
+// The source's role form (`projectstore:<name>`) for each of its roles, by file
+// name: a rendered skill that says "spawn projectstore:critic" names a role the
+// way only the source harness calls it. Never inside another form
+// (`/projectstore:`, `$projectstore-`), never a longer name.
+const ROLE_SUFFIX = SOURCE.surfaces.agents.file.replace("<name>", "");
+const SOURCE_ROLES = readdirSync(join(ROOT, SOURCE.surfaces.agents.dir)).filter((f) => f.endsWith(ROLE_SUFFIX)).map((f) => f.slice(0, -ROLE_SUFFIX.length)).sort();
+const SOURCE_ROLE = new RegExp(`(?<![\\w/$:-])${escapeRe(SOURCE.surfaces.agents.invocation.split("<name>")[0])}(${SOURCE_ROLES.map(escapeRe).join("|")})(?![\\w-])`, "g");
 const TARGETS = emittingHarnesses();
 if (TARGETS.length !== 1) throw new Error(`this renderer currently requires exactly one emitting harness; found ${TARGETS.length}`);
 const TARGET = TARGETS[0];
@@ -61,8 +78,8 @@ function rewriteBody(body) {
     .replaceAll(sourceWord, TARGET.id)
     .replaceAll(SOURCE.surfaces.agents_block.reads_natively, TARGET.surfaces.agents_block.reads_natively)
     .replaceAll(SOURCE.runtime.harness_dir + "/", TARGET.runtime.harness_dir + "/")
-    .replaceAll("/projectstore:*", "$projectstore-*")
-    .replace(/\/projectstore:([a-z0-9-]+)/g, "$projectstore-$1")
+    .replace(SOURCE_COMMAND, (_, name) => invocation(TARGET, name, { kind: "commands" }))
+    .replace(SOURCE_ROLE, (_, name) => invocation(TARGET, name, { kind: "agents" }))
     .replaceAll("AskUserQuestion", "the harness's user-input mechanism")
     .replaceAll("Read tool", "file-reading tool")
     .replaceAll("Write tool", "file-writing tool")
@@ -80,10 +97,11 @@ const COMMAND_OVERRIDES = {
 
 ## register / unregister
 
-Preview the requested change and ask for explicit approval. On approval, run the
-core's \`install\` or \`uninstall\` verb with \`--harness codex --surface
-agents_block --project "$PWD"\`. Print its output verbatim. Never edit the
-managed block by hand.
+Preview the requested change with \`plan --harness codex --surface agents_block
+--project "$PWD"\` and ask for explicit approval. On approval, run the core's
+\`install\` or \`uninstall\` verb with \`--harness codex --surface agents_block
+--project "$PWD" --json\` — \`--json\` never waits on a terminal's question — and
+report the envelope's result. Never edit the managed block by hand.
 
 ## status
 
@@ -104,13 +122,15 @@ contract. A configured model is consumed by the role-orchestration skills on
 their next spawn; no restart is needed.`,
   },
   bind: {
-    description: "Bind this project to an existing ProjectStore vault, or initialize and bind a new vault, using the harness-neutral core. Arguments: [vault-path].",
+    description: "Bind this project to an existing ProjectStore vault, or initialize and bind a new vault, using the harness-neutral core. Arguments: [vault-path] [--layout <name>] [--language <code>].",
     body: `Bind the current project through the core; never write the binding by
 hand.
 
-1. Resolve the requested vault path. If it exists, use \`bind\`; if the user
-   explicitly asks to create it, use \`init\`. Ask for layout and language only
-   when the user has not supplied them.
+1. Resolve the requested vault path, and the layout and language when the
+   request passes \`--layout <name>\` or \`--language <code>\`. If the vault
+   exists, use \`bind\`; if the user explicitly asks to create it, use
+   \`init\`. Ask for layout and language only when the request has not
+   supplied them.
 2. Show the resolved project, vault, verb, layout and language. Ask for explicit
    approval. Naming the vault is the core's non-interactive confirmation.
 3. Run \`node "\${PROJECTSTORE_CORE_ROOT}/bin/projectstore.mjs" <bind|init>
@@ -134,7 +154,9 @@ arguments and \`--json\`. Summarize every finding without re-deriving it.
 When \`--fix\` is absent, remain read-only. When it is present, separate fixes
 by owner: derived vault views use \`$projectstore-reconcile\`; Codex plugin or
 agents-block drift uses the core's \`upgrade --harness codex\` path. Preview
-each mutation and ask for explicit approval before running it. Unsupported
+each mutation with \`plan --harness codex\` and ask for explicit approval before
+running it; then run \`upgrade --harness codex --json\`, whose envelope is the
+result — \`--json\` never waits on a terminal's question. Unsupported
 surfaces remain unsupported; do not create host configuration by hand. Never
 claim a fix after a non-zero exit.`,
   },
@@ -148,10 +170,21 @@ Codex application's own task and terminal UI.`,
   },
 };
 
+// The rendered skills' namespace: the part of rendered_name before the name.
+const NAMESPACE = (TARGET.surfaces?.commands?.rendered_name || "").split("<name>")[0];
+
+// A command or role becomes the skill its manifest names (rendered_name), the
+// same name every message calls it by (generation spec, contract 18).
+const renderedName = (kind, name) => {
+  const tpl = TARGET.surfaces?.[kind]?.rendered_name;
+  if (!tpl) throw new Error(`${TARGET.id}: surfaces.${kind}.rendered_name is required to render ${kind} as skills`);
+  return tpl.split("<name>").join(name);
+};
+
 function renderCommand(file) {
   const { data, body } = frontmatter(read(file), file);
   const verb = file.split("/").pop().replace(/\.md$/, "");
-  const name = `projectstore-${verb}`;
+  const name = renderedName("commands", verb);
   const override = COMMAND_OVERRIDES[verb];
   if (override) return [join("skills", name, "SKILL.md"), skill(name, override.description, override.body)];
   const hint = data["argument-hint"] ? ` Arguments: ${data["argument-hint"]}.` : "";
@@ -162,14 +195,14 @@ function renderPassive(file) {
   const { data, body } = frontmatter(read(file), file);
   const dir = file.split("/").at(-2);
   const name = data.name || dir;
-  if (!name.startsWith("projectstore-")) throw new Error(`${relative(ROOT, file)}: skill name must be projectstore-*`);
+  if (!name.startsWith(NAMESPACE)) throw new Error(`${relative(ROOT, file)}: skill name must be ${NAMESPACE}*`);
   return [join("skills", name, "SKILL.md"), skill(name, data.description || name, body)];
 }
 
 function renderRole(file) {
   const { data, body } = frontmatter(read(file), file);
   const role = file.split("/").pop().replace(/\.md$/, "");
-  const name = `projectstore-${role}`;
+  const name = renderedName("agents", role);
   const orchestration = `## Codex orchestration\n\nThis is a role-orchestration skill, not a native agent registration. Resolve the\nrole model by running:\n\n\`\`\`bash\nnode "\${PROJECTSTORE_CORE_ROOT}/bin/projectstore.mjs" agents model ${role} --json --project "$PWD"\n\`\`\`\n\nSpawn a collaboration agent for the bounded task. If the result names a model,\npass that model and use an empty or bounded context fork; otherwise inherit the\ncurrent model. Do not pass a reasoning-effort override: per-role effort belongs\nto a separate accepted story. Give the spawned agent the role contract below\nand the exact artifact/diff it must inspect. Wait for its final result.\n\n## Role contract\n\n`;
   const description = (data.description || `Run the ProjectStore ${role} role in a fresh collaboration agent.`)
     .replace(/^(?:Opus|Sonnet) \(max-effort\)\s+/, "");
@@ -200,7 +233,7 @@ export function renderCodexAdapter(root = ROOT) {
     ...files(join(root, "commands")).map(renderCommand),
     ...files(join(root, "agents")).map(renderRole),
     ...readdirSync(join(root, "skills"), { withFileTypes: true })
-      .filter((e) => e.isDirectory() && e.name.startsWith("projectstore-"))
+      .filter((e) => e.isDirectory() && e.name.startsWith(NAMESPACE))
       .sort((a, b) => a.name.localeCompare(b.name))
       .map((e) => renderPassive(join(root, "skills", e.name, "SKILL.md"))),
     renderHooks(manifest, root),
@@ -214,8 +247,8 @@ export function renderCodexAdapter(root = ROOT) {
   for (const [rel, text] of out) {
     const sourceTokens = [SOURCE.runtime.plugin_root_env, SOURCE.runtime.project_dir_env, SOURCE.display_name, SOURCE.runtime.harness_dir + "/"].filter(Boolean);
     const sourceAgentEnvs = (SOURCE.runtime.agent_overrides || []).map((row) => row.env).filter(Boolean);
-    if (sourceTokens.some((token) => text.includes(token)) || sourceAgentEnvs.some((token) => text.includes(token)) || /\$ARGUMENTS|\/projectstore:|\bAskUserQuestion\b/.test(text)) throw new Error(`${rel}: source-harness vocabulary leaked into ${TARGET.display_name} adapter`);
-    if (/\/reload-plugins\b|\/plugin(?:\s|\b)|harness\/codex-code\.json|\b(?:opus|sonnet|fable)\b/i.test(text)) throw new Error(`${rel}: source-harness model, environment or UI semantics leaked into ${TARGET.display_name} adapter`);
+    if (sourceTokens.some((token) => text.includes(token)) || sourceAgentEnvs.some((token) => text.includes(token)) || text.includes(SOURCE_COMMAND_PREFIX) || new RegExp(SOURCE_ROLE.source).test(text) || /\$ARGUMENTS/.test(text)) throw new Error(`${rel}: source-harness vocabulary leaked into ${TARGET.display_name} adapter`);
+    if (SOURCE_UI.some(({ re }) => new RegExp(re.source).test(text)) || /harness\/codex-code\.json|\b(?:opus|sonnet|fable)\b/i.test(text)) throw new Error(`${rel}: source-harness model, environment or UI semantics leaked into ${TARGET.display_name} adapter`);
   }
   return out;
 }