runlist 0.95.1 → 0.95.2

package/README.md

@@ -46,13 +46,16 @@ Stage filters, grouping and editing are included. Optional grepmax semantic
 controls are experimental; live retrieval depends on a compatible external
 provider. Local chat and push are deferred.
 
-The Apple Silicon GUI is **[0.94.1](https://github.com/reowens/runlist/releases/tag/desktop-v0.94.1)**,
-signed, accepted by Apple and stapled. It replaces the installers withdrawn
-during the privacy cleanup. The desktop app is separate from CLI 0.94.1,
-which includes optional plan-filing checks and the owner-written product yardstick,
-corrected hub-category inheritance, updates for every saved Claude plugin scope,
-and `runlist desktop install`.
-Updating the CLI does not replace the GUI's bundled engine; this GUI reports 0.94.1.
+<!-- runlist:release:start -->
+CLI and desktop release version: **0.95.2**.
+[Mac installer and release notes](https://github.com/reowens/runlist/releases/tag/desktop-v0.95.2).
+Normal product releases publish both components; an installed Mac app is updated with rollback after it has quit.
+<!-- runlist:release:end -->
+
+The desktop app bundles the matching engine and runtime. Publishing a product
+release now includes building, qualifying, signing/notarizing and publishing the
+Mac installer. `runlist update` also updates an existing Mac app; installing the
+npm package alone does not download an app onto a machine without one.
 Earlier development packages and their qualification results are historical;
 see the [desktop validation record](desktop/VALIDATION.md).
 
@@ -84,8 +87,8 @@ Deferred work awaiting selection:
    older distributions, real-version upgrades, fresh/minimum-version and Intel
    Macs, plus native rendering, focus, accessibility and whole-window memory.
 
-Mac GUI 0.94.1 is available from the [desktop release](https://github.com/reowens/runlist/releases/tag/desktop-v0.94.1).
-CLI 0.94.1 includes the optional product yardstick.
+The current Mac installer is linked in the release-version section above.
+CLI and desktop include the optional product yardstick.
 The supported desktop
 release is Apple Silicon macOS 13.5 or newer. Broader platform work and
 experimental semantic search remain separate follow-up work.
@@ -109,10 +112,10 @@ without opening it. The app bundles its runtime and reads local files through
 private pipes, with no listening server. Choose your checkout folder in the app.
 No checkout configuration is loaded by these CLI commands.
 
-The GUI is versioned separately from the CLI. `runlist desktop install` selects
-the public Mac 0.94.1 installer.
+`runlist desktop install` selects the newest published Mac installer and
+updates an older installed app after you quit it.
 Windows, Linux and Intel Mac GUI downloads are not yet available through this
-command. An existing app is kept as-is. To replace it using a downloaded signed
+command. Current or newer installed apps are preserved. To use a downloaded signed
 DMG, quit Runlist and run:
 
 ```bash
@@ -280,13 +283,13 @@ runlist desktop install --from /path/to/Runlist.dmg  # install a local signed DM
 
 The installer currently supports Apple Silicon Macs. It verifies the published
 download checksum, Runlist developer signature and Apple approval, and installs
-without opening the app. An existing app is kept unless `--from` supplies a
-replacement; replacement keeps a rollback copy. `--dry-run` uses no network and
-changes no files. The public Mac 0.94.1 download replaces the withdrawn
+without opening the app. An older installed app is updated after it has quit;
+replacement keeps a rollback copy. `--dry-run` uses no network and
+changes no files. The current Mac download replaces the withdrawn
 installers. These commands ship
 in [CLI 0.92.0](https://github.com/reowens/runlist/releases/tag/v0.92.0) and can also
-be used from this checkout as `node bin/runlist.mjs desktop …`. The GUI remains
-separately versioned at **0.94.1**; npm installation does not download it.
+be used from this checkout as `node bin/runlist.mjs desktop …`. Normal product releases keep GUI and CLI versions together; an npm install
+does not add a GUI to a machine without one.
 
 The optional browser document app is available from this source checkout (unreleased):
 
@@ -828,13 +831,13 @@ local model or server. GUI controls are implemented in the source checkout:
 Product goal shows the saved statement, delivery and assessment, with reviewed
 Serves/Clear/Close/Fold actions and retained recovery. Structured plans display
 the comparison with an explanation when assessment changes are unavailable.
-These controls are included in the public desktop package 0.94.1;
-updating the CLI alone does not replace an existing app.
+These controls are included in the public desktop package.
+`runlist update` updates an existing Mac app alongside the CLI and integrations.
 
 ### Plan Homes And Filing Checks
 
 This policy is available in CLI 0.93.0. From a source checkout, invoke the
-commands below as `node bin/runlist.mjs …`. The separately versioned GUI
+commands below as `node bin/runlist.mjs …`. The bundled GUI
 The desktop app also includes a read-only Filing view. The correction
 for category inheritance from status-less hub indexes is included in CLI
 0.93.1.
@@ -880,7 +883,7 @@ is labeled and suppresses absence/uniqueness findings. Path/type-scoped output
 keeps the full hub/ancestor evidence while reporting only selected plans.
 The source checkout also includes a read-only Filing view: open it to scan,
 filter 50-plan pages, and inspect exact hub rows in 20-row evidence pages. Saved
-edits invalidate the report. This view is included in public desktop package 0.94.1.
+edits invalidate the report. This view is included in the public desktop package.
 The policy is off when `filing` is unset, false, or `{ enabled: false }`.
 It can replace a repository's older “any link counts” coverage script once
 that repository enables it and retires its custom check.

package/bin/runlist.mjs

@@ -1509,8 +1509,8 @@ runlist desktop install [--from /path/to/installer.dmg] — install the optional
 
 Install downloads the latest Mac Apple Silicon GUI from Runlist's GitHub
 releases, or uses a local signed DMG with --from. It verifies the Runlist
-developer signature and Apple approval before installing. An existing app is
-kept as-is unless --from is given; replacements retain a rollback copy.
+developer signature and Apple approval before installing. Older installed apps
+are updated after you quit Runlist; replacements retain a rollback copy.
 Installation does not open the app. Windows/Linux installers are not yet
 available through this command. --dry-run uses no network and changes no files.
 
@@ -2206,7 +2206,7 @@ async function main() {
   }
   if (command === 'hud') { const { runHud } = await import('../src/hud.mjs'); runHud(restArgs, config); return; }
   if (command === 'guard') { const { runGuard } = await import('../src/guard.mjs'); await runGuard(restArgs, config, { dryRun }); return; }
-  if (command === 'update') { const { runUpdate } = await import('../src/update.mjs'); runUpdate(restArgs, config, { dryRun }); return; }
+  if (command === 'update') { const { runUpdate } = await import('../src/update.mjs'); await runUpdate(restArgs, config, { dryRun }); return; }
   if (command === 'install') { const { runInstall } = await import('../src/install.mjs'); runInstall(restArgs, config, { dryRun }); return; }
   if (command === 'errors') { const { runErrors } = await import('../src/errors-read.mjs'); runErrors(restArgs); return; }
   if (command === 'misuse') { const { runMisuse } = await import('../src/misuse-read.mjs'); runMisuse(restArgs, config); return; }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runlist",
-  "version": "0.95.1",
+  "version": "0.95.2",
   "description": "CLI for managing markdown documents with YAML frontmatter — index, query, validate, graph, export, lifecycle, and AI summaries.",
   "type": "module",
   "license": "MIT",

package/plugins/runlist-codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "runlist-codex",
-  "version": "0.95.1",
+  "version": "0.95.2",
   "description": "Runlist workflow skill, session orientation, and tool guard for Codex",
   "author": {
     "name": "Reo Owens"

package/src/desktop-install.mjs

@@ -1,7 +1,7 @@
 import {createHash,randomUUID} from 'node:crypto';
 import {execFileSync} from 'node:child_process';
 import {createWriteStream} from 'node:fs';
-import {lstat,mkdir,mkdtemp,rename,rm} from 'node:fs/promises';
+import {lstat,mkdir,mkdtemp,readFile,rename,rm} from 'node:fs/promises';
 import {homedir,tmpdir} from 'node:os';
 import path from 'node:path';
 import {Readable,Transform} from 'node:stream';
@@ -12,6 +12,35 @@ const RELEASES='https://api.github.com/repos/reowens/runlist/releases';
 const DOWNLOADS='https://github.com/reowens/runlist/releases/download/';
 const TEAM='7GSPYYN5X8';
 const MAX_DOWNLOAD=512*1024*1024;
+
+export function compareDesktopVersions(a,b) {
+ const parse=value=>/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([\w.-]+))?$/.exec(value??'');
+ const left=parse(a),right=parse(b);
+ if(!left||!right)throw new Error('Cannot compare the installed and published desktop versions. Nothing was replaced.');
+ for(let i=1;i<=3;i++)if(Number(left[i])!==Number(right[i]))return Number(left[i])<Number(right[i])?-1:1;
+ if(left[4]===right[4])return 0;
+ if(!left[4]||!right[4])return left[4]?-1:1;
+ const x=left[4].split('.'),y=right[4].split('.');
+ for(let i=0;i<Math.max(x.length,y.length);i++) {
+  if(x[i]===y[i])continue;
+  if(x[i]===undefined||y[i]===undefined)return x[i]===undefined?-1:1;
+  const xn=/^\d+$/.test(x[i]),yn=/^\d+$/.test(y[i]);
+  if(xn!==yn)return xn?-1:1;
+  return xn?(Number(x[i])<Number(y[i])?-1:1):(x[i]<y[i]?-1:1);
+ }
+ return 0;
+}
+
+export async function installedDesktopVersion(app) {
+ try {
+  const engine=path.join(app,'Contents/Resources/engine');
+  const manifest=JSON.parse(await readFile(path.join(engine,'bundle-manifest.json'),'utf8'));
+  const pkg=JSON.parse(await readFile(path.join(engine,'package.json'),'utf8'));
+  if(manifest.version!==pkg.version||manifest.protocol!==1)throw new Error('Bundle version mismatch.');
+  compareDesktopVersions(pkg.version,pkg.version);
+  return pkg.version;
+ } catch(error) {throw new Error('Cannot verify the installed desktop version. Use a reviewed local installer with --from to repair it.',{cause:error});}
+}
 const nativeExec=(exe,args)=>{
  try {return {stdout:execFileSync(exe,args,{encoding:'utf8',timeout:60000,stdio:['ignore','pipe','pipe']})};}
  catch(error) {throw new Error(`${path.basename(exe)} failed: ${(error.stderr?.toString()||error.message).trim()}`,{cause:error});}
@@ -19,6 +48,7 @@ const nativeExec=(exe,args)=>{
 
 export function selectDesktopRelease(releases) {
  if(!Array.isArray(releases))throw new Error('Runlist release information is unavailable.');
+ let selected=null;
  for(const release of releases) {
   if(release.draft)continue;
   for(const asset of release.assets??[]) {
@@ -29,10 +59,11 @@ export function selectDesktopRelease(releases) {
    if(!Number.isSafeInteger(asset.size)||asset.size<=0||asset.size>MAX_DOWNLOAD)throw new Error('The Runlist installer size is invalid.');
    const checksum=/^sha256:([a-f0-9]{64})$/i.exec(asset.digest??'')?.[1].toLowerCase();
    if(!checksum)throw new Error('The published Runlist installer is missing its SHA-256 digest.');
-   return {url:url.href,version:match[1],size:asset.size,sha256:checksum};
+   const candidate={url:url.href,version:match[1],size:asset.size,sha256:checksum};
+   if(!selected||compareDesktopVersions(candidate.version,selected.version)>0)selected=candidate;
   }
  }
- return null;
+ return selected;
 }
 
 async function latestInstaller(fetcher) {
@@ -93,7 +124,16 @@ export async function runDesktopInstall(argv,{dryRun=false,platform=process.plat
  if(fromAt>=0&&(!from||from.startsWith('--')))throw new Error('--from requires a local Runlist installer.dmg path.');
  if(dryRun){write(`Would install the optional Runlist GUI from ${from?path.resolve(from):'Runlist GitHub releases'} without opening it. No download or files changed.\n`);return {dryRun:true};}
  const installed=desktopLaunch([],{platform,home}).app;
- if(installed&&!from){write(`Runlist is already installed at ${installed}. Open it with runlist desktop.\n`);return {installed,alreadyInstalled:true};}
+ let installer;
+ if(installed&&!from) {
+  const version=await installedDesktopVersion(installed);
+  installer=await latestInstaller(fetcher);
+  if(compareDesktopVersions(version,installer.version)>=0) {
+   write(`Runlist desktop ${version} is current at ${installed}.\n`);
+   return {installed,version,alreadyInstalled:true};
+  }
+  write(`Updating Runlist desktop ${version} → ${installer.version}…\n`);
+ }
  if(!exec) {
   // Imported only for this explicit installer; no subprocess or download at import time.
   const {spawnSync}=await import('node:child_process');
@@ -119,7 +159,7 @@ export async function runDesktopInstall(argv,{dryRun=false,platform=process.plat
    image=path.resolve(from);const info=await entry(image);
    if(!image.toLowerCase().endsWith('.dmg')||!info?.isFile()||info.isSymbolicLink()||info.size>MAX_DOWNLOAD)throw new Error('--from must name a regular signed Runlist .dmg installer.');
   } else {
-   const installer=await latestInstaller(fetcher);write(`Downloading Runlist ${installer.version} for Mac Apple Silicon…\n`);
+   installer??=await latestInstaller(fetcher);write(`Downloading Runlist ${installer.version} for Mac Apple Silicon…\n`);
    image=path.join(work,'Runlist.dmg');await download(installer,image,fetcher);
   }
   verifySigned(image,exec);
@@ -128,6 +168,8 @@ export async function runDesktopInstall(argv,{dryRun=false,platform=process.plat
   const source=path.join(mount,'Runlist.app');const info=await entry(source);
   if(!info?.isDirectory()||info.isSymbolicLink())throw new Error('The installer does not contain a regular Runlist.app.');
   verifySigned(source,exec,'dev.reowens.runlist');
+  const version=await installedDesktopVersion(source);
+  if(installer&&version!==installer.version)throw new Error('The downloaded app version differs from the published installer. Nothing was replaced.');
   stage=path.join(parent,`.Runlist-install-${randomUUID()}.app`);
   exec('/usr/bin/ditto',[source,stage]);
   // Keep normal Mac download identification instead of stripping quarantine.
@@ -145,7 +187,7 @@ export async function runDesktopInstall(argv,{dryRun=false,platform=process.plat
   catch(error){if(backup)await rename(backup,target);throw error;}
   write(`Installed Runlist at ${target}. Open it with runlist desktop.\n`);
   if(backup)write(`Previous app kept at ${backup}.\n`);
-  return {installed:target,backup:backup??null};
+  return {installed:target,version,backup:backup??null};
  } finally {
   if(stage)await rm(stage,{recursive:true,force:true});
   if(attached) {

package/src/update.mjs

@@ -7,6 +7,8 @@ import { green, dim, yellow } from './color.mjs';
 import { executableName, which } from './util.mjs';
 import { CLAUDE_MARKETPLACE, claudeMarketplaceRefusalHint, installOpencodePlugin, opencodeStatus } from './host-integration.mjs';
 import { codexStatus } from './codex-integration.mjs';
+import { desktopLaunch } from './desktop.mjs';
+import { compareDesktopVersions, installedDesktopVersion } from './desktop-install.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const pkg = JSON.parse(readFileSync(path.join(__dirname, '..', 'package.json'), 'utf8'));
@@ -212,15 +214,19 @@ export function planUpdate(opts, ctx) {
       steps.push({ kind: 'codex', cmd: ['runlist', 'install', 'codex'] });
     }
   }
+  if (!opts.cliOnly && !opts.pluginOnly && ctx.desktop) {
+    steps.push({ kind: 'desktop', cmd: ['runlist', 'desktop', 'install'] });
+  }
   return steps;
 }
 
-export function runUpdate(argv, _config, opts = {}) {
+export async function runUpdate(argv, _config, opts = {}) {
   const check = argv.includes('--check');
   const cliOnly = argv.includes('--cli-only');
   const pluginOnly = argv.includes('--plugin-only');
   const plugin = readInstalledPlugin();
   const legacyPlugin = readInstalledPluginRecords({ id: LEGACY_PLUGIN_ID });
+  const desktop = process.platform === 'darwin' && process.arch === 'arm64' ? desktopLaunch([]).app : null;
 
   if (check) {
     process.stdout.write(`runlist CLI:    ${pkg.version}\n`);
@@ -250,12 +256,16 @@ export function runUpdate(argv, _config, opts = {}) {
     if (!cx.exists) process.stdout.write(dim('runlist codex: not installed\n'));
     else if (cx.foreign) process.stdout.write(`runlist codex: ${yellow('unmanaged plugin directory')}\n`);
     else process.stdout.write(`runlist codex: ${cx.version} ${cx.stale ? yellow('behind — run `runlist update`') : green('in sync')}\n`);
+    if (desktop) {
+      const version = await installedDesktopVersion(desktop);
+      process.stdout.write(`runlist desktop: ${version} ${compareDesktopVersions(version, pkg.version) < 0 ? yellow('behind — quit Runlist and run `runlist update`') : green('in sync')}\n`);
+    }
     return;
   }
 
   const opencode = opencodeStatus({ version: pkg.version });
   const codex = codexStatus({ version: pkg.version });
-  const steps = planUpdate({ cliOnly, pluginOnly }, { plugin, legacyPlugin, opencode, codex, hasClaude: which('claude'), hasNpm: which('npm') });
+  const steps = planUpdate({ cliOnly, pluginOnly }, { plugin, legacyPlugin, opencode, codex, desktop, hasClaude: which('claude'), hasNpm: which('npm') });
   if (opts.dryRun) {
     for (const step of steps) {
       if (step.kind === 'skip') process.stdout.write(dim(`[dry-run] skip: ${step.reason}\n`));
@@ -324,6 +334,12 @@ export function runUpdate(argv, _config, opts = {}) {
       process.stdout.write(yellow(`${verified.reason}\n`));
     }
   }
+  if (desktop && steps.some(step => step.kind === 'desktop') && !failedKinds.has('desktop')) {
+    const currentVersion = JSON.parse(readFileSync(path.join(__dirname, '..', 'package.json'), 'utf8')).version;
+    if (compareDesktopVersions(await installedDesktopVersion(desktop), currentVersion) < 0) {
+      failures.push({ reason: 'The matching desktop installer is not published yet; retry `runlist update` after the product release completes.' });
+    }
+  }
   if (failures.length) {
     process.stdout.write(yellow(`\n${failures.length === 1 ? '1 step' : `${failures.length} steps`} failed: ${failures.map(s => s.cmd ? `${s.cmd.join(' ')}${s.cwd ? ` (in ${s.cwd})` : ''}` : s.reason).join('; ')}\n`));
     if (ran && failures.length < steps.filter(s => s.kind !== 'skip' && s.kind !== 'manual').length) {