runlist 0.95.1 → 0.95.3

package/README.md

@@ -46,13 +46,16 @@ Stage filters, grouping and editing are included. Optional grepmax semantic
 controls are experimental; live retrieval depends on a compatible external
 provider. Local chat and push are deferred.
 
-The Apple Silicon GUI is **[0.94.1](https://github.com/reowens/runlist/releases/tag/desktop-v0.94.1)**,
-signed, accepted by Apple and stapled. It replaces the installers withdrawn
-during the privacy cleanup. The desktop app is separate from CLI 0.94.1,
-which includes optional plan-filing checks and the owner-written product yardstick,
-corrected hub-category inheritance, updates for every saved Claude plugin scope,
-and `runlist desktop install`.
-Updating the CLI does not replace the GUI's bundled engine; this GUI reports 0.94.1.
+<!-- runlist:release:start -->
+CLI and desktop release version: **0.95.3**.
+[Mac installer and release notes](https://github.com/reowens/runlist/releases/tag/desktop-v0.95.3).
+Normal product releases publish both components; an installed Mac app is updated with rollback after it has quit.
+<!-- runlist:release:end -->
+
+The desktop app bundles the matching engine and runtime. Publishing a product
+release now includes building, qualifying, signing/notarizing and publishing the
+Mac installer. `runlist update` also updates an existing Mac app; installing the
+npm package alone does not download an app onto a machine without one.
 Earlier development packages and their qualification results are historical;
 see the [desktop validation record](desktop/VALIDATION.md).
 
@@ -84,8 +87,8 @@ Deferred work awaiting selection:
    older distributions, real-version upgrades, fresh/minimum-version and Intel
    Macs, plus native rendering, focus, accessibility and whole-window memory.
 
-Mac GUI 0.94.1 is available from the [desktop release](https://github.com/reowens/runlist/releases/tag/desktop-v0.94.1).
-CLI 0.94.1 includes the optional product yardstick.
+The current Mac installer is linked in the release-version section above.
+CLI and desktop include the optional product yardstick.
 The supported desktop
 release is Apple Silicon macOS 13.5 or newer. Broader platform work and
 experimental semantic search remain separate follow-up work.
@@ -109,10 +112,10 @@ without opening it. The app bundles its runtime and reads local files through
 private pipes, with no listening server. Choose your checkout folder in the app.
 No checkout configuration is loaded by these CLI commands.
 
-The GUI is versioned separately from the CLI. `runlist desktop install` selects
-the public Mac 0.94.1 installer.
+`runlist desktop install` selects the newest published Mac installer and
+updates an older installed app after you quit it.
 Windows, Linux and Intel Mac GUI downloads are not yet available through this
-command. An existing app is kept as-is. To replace it using a downloaded signed
+command. Current or newer installed apps are preserved. To use a downloaded signed
 DMG, quit Runlist and run:
 
 ```bash
@@ -216,7 +219,14 @@ and managed scopes are reported rather than silently updating another scope.
 The release workflow uses the same scope selection and verifies every entry
 against the released version.
 
-Restart Claude Code, or run `/reload-plugins`, after a plugin update.
+Updates also refresh already installed OpenCode and Codex integrations. After
+upgrading the CLI, host installers run from the updated package so their version
+and assets match. Codex verification checks the host's installed copy separately
+from its marketplace source. Releases use these same checks and remain resumable
+if an installed host fails to update. Uninstalled hosts are not added.
+
+Restart the affected host sessions to load updated integrations; Claude Code also
+supports `/reload-plugins`.
 
 ## Quick Start
 
@@ -280,13 +290,13 @@ runlist desktop install --from /path/to/Runlist.dmg  # install a local signed DM
 
 The installer currently supports Apple Silicon Macs. It verifies the published
 download checksum, Runlist developer signature and Apple approval, and installs
-without opening the app. An existing app is kept unless `--from` supplies a
-replacement; replacement keeps a rollback copy. `--dry-run` uses no network and
-changes no files. The public Mac 0.94.1 download replaces the withdrawn
+without opening the app. An older installed app is updated after it has quit;
+replacement keeps a rollback copy. `--dry-run` uses no network and
+changes no files. The current Mac download replaces the withdrawn
 installers. These commands ship
 in [CLI 0.92.0](https://github.com/reowens/runlist/releases/tag/v0.92.0) and can also
-be used from this checkout as `node bin/runlist.mjs desktop …`. The GUI remains
-separately versioned at **0.94.1**; npm installation does not download it.
+be used from this checkout as `node bin/runlist.mjs desktop …`. Normal product releases keep GUI and CLI versions together; an npm install
+does not add a GUI to a machine without one.
 
 The optional browser document app is available from this source checkout (unreleased):
 
@@ -828,13 +838,13 @@ local model or server. GUI controls are implemented in the source checkout:
 Product goal shows the saved statement, delivery and assessment, with reviewed
 Serves/Clear/Close/Fold actions and retained recovery. Structured plans display
 the comparison with an explanation when assessment changes are unavailable.
-These controls are included in the public desktop package 0.94.1;
-updating the CLI alone does not replace an existing app.
+These controls are included in the public desktop package.
+`runlist update` updates an existing Mac app alongside the CLI and integrations.
 
 ### Plan Homes And Filing Checks
 
 This policy is available in CLI 0.93.0. From a source checkout, invoke the
-commands below as `node bin/runlist.mjs …`. The separately versioned GUI
+commands below as `node bin/runlist.mjs …`. The bundled GUI
 The desktop app also includes a read-only Filing view. The correction
 for category inheritance from status-less hub indexes is included in CLI
 0.93.1.
@@ -880,7 +890,7 @@ is labeled and suppresses absence/uniqueness findings. Path/type-scoped output
 keeps the full hub/ancestor evidence while reporting only selected plans.
 The source checkout also includes a read-only Filing view: open it to scan,
 filter 50-plan pages, and inspect exact hub rows in 20-row evidence pages. Saved
-edits invalidate the report. This view is included in public desktop package 0.94.1.
+edits invalidate the report. This view is included in the public desktop package.
 The policy is off when `filing` is unset, false, or `{ enabled: false }`.
 It can replace a repository's older “any link counts” coverage script once
 that repository enables it and retires its custom check.

package/bin/runlist.mjs

@@ -1509,8 +1509,8 @@ runlist desktop install [--from /path/to/installer.dmg] — install the optional
 
 Install downloads the latest Mac Apple Silicon GUI from Runlist's GitHub
 releases, or uses a local signed DMG with --from. It verifies the Runlist
-developer signature and Apple approval before installing. An existing app is
-kept as-is unless --from is given; replacements retain a rollback copy.
+developer signature and Apple approval before installing. Older installed apps
+are updated after you quit Runlist; replacements retain a rollback copy.
 Installation does not open the app. Windows/Linux installers are not yet
 available through this command. --dry-run uses no network and changes no files.
 
@@ -2206,7 +2206,7 @@ async function main() {
   }
   if (command === 'hud') { const { runHud } = await import('../src/hud.mjs'); runHud(restArgs, config); return; }
   if (command === 'guard') { const { runGuard } = await import('../src/guard.mjs'); await runGuard(restArgs, config, { dryRun }); return; }
-  if (command === 'update') { const { runUpdate } = await import('../src/update.mjs'); runUpdate(restArgs, config, { dryRun }); return; }
+  if (command === 'update') { const { runUpdate } = await import('../src/update.mjs'); await runUpdate(restArgs, config, { dryRun }); return; }
   if (command === 'install') { const { runInstall } = await import('../src/install.mjs'); runInstall(restArgs, config, { dryRun }); return; }
   if (command === 'errors') { const { runErrors } = await import('../src/errors-read.mjs'); runErrors(restArgs); return; }
   if (command === 'misuse') { const { runMisuse } = await import('../src/misuse-read.mjs'); runMisuse(restArgs, config); return; }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runlist",
-  "version": "0.95.1",
+  "version": "0.95.3",
   "description": "CLI for managing markdown documents with YAML frontmatter — index, query, validate, graph, export, lifecycle, and AI summaries.",
   "type": "module",
   "license": "MIT",

package/plugins/runlist-codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "runlist-codex",
-  "version": "0.95.1",
+  "version": "0.95.3",
   "description": "Runlist workflow skill, session orientation, and tool guard for Codex",
   "author": {
     "name": "Reo Owens"

package/src/codex-integration.mjs

@@ -4,6 +4,8 @@ import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, r
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+import { executableName } from './util.mjs';
 
 const SOURCE = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', 'plugins', 'runlist-codex');
 const NAME = 'runlist-codex';
@@ -33,6 +35,26 @@ export function codexStatus({ version, homedir = os.homedir() } = {}) {
   return { ...paths, exists, foreign: exists && !installed, version: installed, stale: Boolean(installed && version && installed !== version) };
 }
 
+// The marketplace source is not the plugin Codex loads. Ask the host about its
+// installed copy rather than treating our generated source marker as proof.
+export function installedCodexStatus({ homedir = os.homedir(), run = spawnSync } = {}) {
+  try {
+    const marketplace = marketplaceAt(codexPaths(homedir).marketplace).name;
+    const pluginId = `${NAME}@${marketplace}`;
+    const result = run(executableName('codex'), ['plugin', 'list', '--marketplace', marketplace, '--json'], {
+      encoding: 'utf8', shell: process.platform === 'win32', timeout: 30_000,
+    });
+    if (result.status !== 0) return { ok: false, reason: result.error?.message ?? `codex plugin list exited ${result.status ?? '?'}` };
+    const installed = JSON.parse(result.stdout).installed;
+    if (!Array.isArray(installed)) return { ok: false, reason: 'codex plugin list returned no installed plugin records' };
+    const plugin = installed.find(entry => entry.pluginId === pluginId && entry.installed === true);
+    return plugin?.version ? { ok: true, version: plugin.version, pluginId }
+      : { ok: false, reason: `${pluginId} is not installed in Codex` };
+  } catch (err) {
+    return { ok: false, reason: `cannot verify installed Codex plugin: ${err.message}` };
+  }
+}
+
 export function installCodexPlugin({ version, homedir = os.homedir(), dryRun = false } = {}) {
   const sourceVersion = JSON.parse(readFileSync(path.join(SOURCE, '.codex-plugin', 'plugin.json'), 'utf8')).version;
   if (sourceVersion !== version) throw new Error(`Codex plugin source is ${sourceVersion}, CLI is ${version}`);

package/src/desktop-install.mjs

@@ -1,7 +1,7 @@
 import {createHash,randomUUID} from 'node:crypto';
 import {execFileSync} from 'node:child_process';
 import {createWriteStream} from 'node:fs';
-import {lstat,mkdir,mkdtemp,rename,rm} from 'node:fs/promises';
+import {lstat,mkdir,mkdtemp,readFile,rename,rm} from 'node:fs/promises';
 import {homedir,tmpdir} from 'node:os';
 import path from 'node:path';
 import {Readable,Transform} from 'node:stream';
@@ -12,6 +12,35 @@ const RELEASES='https://api.github.com/repos/reowens/runlist/releases';
 const DOWNLOADS='https://github.com/reowens/runlist/releases/download/';
 const TEAM='7GSPYYN5X8';
 const MAX_DOWNLOAD=512*1024*1024;
+
+export function compareDesktopVersions(a,b) {
+ const parse=value=>/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([\w.-]+))?$/.exec(value??'');
+ const left=parse(a),right=parse(b);
+ if(!left||!right)throw new Error('Cannot compare the installed and published desktop versions. Nothing was replaced.');
+ for(let i=1;i<=3;i++)if(Number(left[i])!==Number(right[i]))return Number(left[i])<Number(right[i])?-1:1;
+ if(left[4]===right[4])return 0;
+ if(!left[4]||!right[4])return left[4]?-1:1;
+ const x=left[4].split('.'),y=right[4].split('.');
+ for(let i=0;i<Math.max(x.length,y.length);i++) {
+  if(x[i]===y[i])continue;
+  if(x[i]===undefined||y[i]===undefined)return x[i]===undefined?-1:1;
+  const xn=/^\d+$/.test(x[i]),yn=/^\d+$/.test(y[i]);
+  if(xn!==yn)return xn?-1:1;
+  return xn?(Number(x[i])<Number(y[i])?-1:1):(x[i]<y[i]?-1:1);
+ }
+ return 0;
+}
+
+export async function installedDesktopVersion(app) {
+ try {
+  const engine=path.join(app,'Contents/Resources/engine');
+  const manifest=JSON.parse(await readFile(path.join(engine,'bundle-manifest.json'),'utf8'));
+  const pkg=JSON.parse(await readFile(path.join(engine,'package.json'),'utf8'));
+  if(manifest.version!==pkg.version||manifest.protocol!==1)throw new Error('Bundle version mismatch.');
+  compareDesktopVersions(pkg.version,pkg.version);
+  return pkg.version;
+ } catch(error) {throw new Error('Cannot verify the installed desktop version. Use a reviewed local installer with --from to repair it.',{cause:error});}
+}
 const nativeExec=(exe,args)=>{
  try {return {stdout:execFileSync(exe,args,{encoding:'utf8',timeout:60000,stdio:['ignore','pipe','pipe']})};}
  catch(error) {throw new Error(`${path.basename(exe)} failed: ${(error.stderr?.toString()||error.message).trim()}`,{cause:error});}
@@ -19,6 +48,7 @@ const nativeExec=(exe,args)=>{
 
 export function selectDesktopRelease(releases) {
  if(!Array.isArray(releases))throw new Error('Runlist release information is unavailable.');
+ let selected=null;
  for(const release of releases) {
   if(release.draft)continue;
   for(const asset of release.assets??[]) {
@@ -29,10 +59,11 @@ export function selectDesktopRelease(releases) {
    if(!Number.isSafeInteger(asset.size)||asset.size<=0||asset.size>MAX_DOWNLOAD)throw new Error('The Runlist installer size is invalid.');
    const checksum=/^sha256:([a-f0-9]{64})$/i.exec(asset.digest??'')?.[1].toLowerCase();
    if(!checksum)throw new Error('The published Runlist installer is missing its SHA-256 digest.');
-   return {url:url.href,version:match[1],size:asset.size,sha256:checksum};
+   const candidate={url:url.href,version:match[1],size:asset.size,sha256:checksum};
+   if(!selected||compareDesktopVersions(candidate.version,selected.version)>0)selected=candidate;
   }
  }
- return null;
+ return selected;
 }
 
 async function latestInstaller(fetcher) {
@@ -93,7 +124,16 @@ export async function runDesktopInstall(argv,{dryRun=false,platform=process.plat
  if(fromAt>=0&&(!from||from.startsWith('--')))throw new Error('--from requires a local Runlist installer.dmg path.');
  if(dryRun){write(`Would install the optional Runlist GUI from ${from?path.resolve(from):'Runlist GitHub releases'} without opening it. No download or files changed.\n`);return {dryRun:true};}
  const installed=desktopLaunch([],{platform,home}).app;
- if(installed&&!from){write(`Runlist is already installed at ${installed}. Open it with runlist desktop.\n`);return {installed,alreadyInstalled:true};}
+ let installer;
+ if(installed&&!from) {
+  const version=await installedDesktopVersion(installed);
+  installer=await latestInstaller(fetcher);
+  if(compareDesktopVersions(version,installer.version)>=0) {
+   write(`Runlist desktop ${version} is current at ${installed}.\n`);
+   return {installed,version,alreadyInstalled:true};
+  }
+  write(`Updating Runlist desktop ${version} → ${installer.version}…\n`);
+ }
  if(!exec) {
   // Imported only for this explicit installer; no subprocess or download at import time.
   const {spawnSync}=await import('node:child_process');
@@ -119,7 +159,7 @@ export async function runDesktopInstall(argv,{dryRun=false,platform=process.plat
    image=path.resolve(from);const info=await entry(image);
    if(!image.toLowerCase().endsWith('.dmg')||!info?.isFile()||info.isSymbolicLink()||info.size>MAX_DOWNLOAD)throw new Error('--from must name a regular signed Runlist .dmg installer.');
   } else {
-   const installer=await latestInstaller(fetcher);write(`Downloading Runlist ${installer.version} for Mac Apple Silicon…\n`);
+   installer??=await latestInstaller(fetcher);write(`Downloading Runlist ${installer.version} for Mac Apple Silicon…\n`);
    image=path.join(work,'Runlist.dmg');await download(installer,image,fetcher);
   }
   verifySigned(image,exec);
@@ -128,6 +168,8 @@ export async function runDesktopInstall(argv,{dryRun=false,platform=process.plat
   const source=path.join(mount,'Runlist.app');const info=await entry(source);
   if(!info?.isDirectory()||info.isSymbolicLink())throw new Error('The installer does not contain a regular Runlist.app.');
   verifySigned(source,exec,'dev.reowens.runlist');
+  const version=await installedDesktopVersion(source);
+  if(installer&&version!==installer.version)throw new Error('The downloaded app version differs from the published installer. Nothing was replaced.');
   stage=path.join(parent,`.Runlist-install-${randomUUID()}.app`);
   exec('/usr/bin/ditto',[source,stage]);
   // Keep normal Mac download identification instead of stripping quarantine.
@@ -145,7 +187,7 @@ export async function runDesktopInstall(argv,{dryRun=false,platform=process.plat
   catch(error){if(backup)await rename(backup,target);throw error;}
   write(`Installed Runlist at ${target}. Open it with runlist desktop.\n`);
   if(backup)write(`Previous app kept at ${backup}.\n`);
-  return {installed:target,backup:backup??null};
+  return {installed:target,version,backup:backup??null};
  } finally {
   if(stage)await rm(stage,{recursive:true,force:true});
   if(attached) {

package/src/install.mjs

@@ -9,7 +9,7 @@ import {
 } from './host-integration.mjs';
 import { LEGACY_PLUGIN_ID, readInstalledPlugin, readInstalledPluginRecords } from './update.mjs';
 import { executableName, which } from './util.mjs';
-import { codexStatus, installCodexPlugin } from './codex-integration.mjs';
+import { codexStatus, installCodexPlugin, installedCodexStatus } from './codex-integration.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const pkg = JSON.parse(readFileSync(path.join(__dirname, '..', 'package.json'), 'utf8'));
@@ -111,9 +111,12 @@ function installCodex(argv, dryRun, json) {
     stdio: json ? 'pipe' : 'inherit', encoding: json ? 'utf8' : undefined,
     shell: process.platform === 'win32',
   });
-  if (json) process.stdout.write(JSON.stringify({ ...result, pluginAdd: added.status === 0 ? 'installed' : 'failed', pluginAddExit: added.status }, null, 2) + '\n');
-  if (added.status !== 0) {
-    process.stderr.write(`Codex plugin source is ready; finish installation with: codex plugin add ${selector}\n`);
+  const installed = added.status === 0 ? installedCodexStatus() : { ok: false, reason: added.error?.message ?? `codex plugin add exited ${added.status ?? '?'}` };
+  const verified = installed.ok && installed.version === pkg.version;
+  if (json) process.stdout.write(JSON.stringify({ ...result, pluginAdd: verified ? 'installed' : 'failed', pluginAddExit: added.status,
+    installedVersion: installed.version ?? null, ...(!verified ? { reason: installed.reason ?? `Codex has ${installed.version}, expected ${pkg.version}` } : {}) }, null, 2) + '\n');
+  if (!verified) {
+    process.stderr.write(`Codex plugin installation is unverified: ${installed.reason ?? `has ${installed.version}, expected ${pkg.version}`}. Retry: codex plugin add ${selector}\n`);
     process.exitCode = 1;
   } else if (!json) {
     process.stdout.write('Start a new Codex thread and review/trust the plugin hooks to enable the primer and guard.\n');

package/src/update.mjs

@@ -5,8 +5,10 @@ import os from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { green, dim, yellow } from './color.mjs';
 import { executableName, which } from './util.mjs';
-import { CLAUDE_MARKETPLACE, claudeMarketplaceRefusalHint, installOpencodePlugin, opencodeStatus } from './host-integration.mjs';
-import { codexStatus } from './codex-integration.mjs';
+import { CLAUDE_MARKETPLACE, claudeMarketplaceRefusalHint, opencodeStatus } from './host-integration.mjs';
+import { codexStatus, installedCodexStatus } from './codex-integration.mjs';
+import { desktopLaunch } from './desktop.mjs';
+import { compareDesktopVersions, installedDesktopVersion } from './desktop-install.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const pkg = JSON.parse(readFileSync(path.join(__dirname, '..', 'package.json'), 'utf8'));
@@ -201,10 +203,10 @@ export function planUpdate(opts, ctx) {
     // the moment the CLI moves on. Refresh it here — but only if it is already
     // installed. `update` keeps hosts in lockstep; it never adopts a new one,
     // which stays the job of the explicit `runlist install`.
-    if (ctx.opencode?.exists && ctx.opencode.stale) {
-      steps.push({ kind: 'opencode', path: ctx.opencode.path });
-    } else if (ctx.opencode?.foreign) {
+    if (ctx.opencode?.foreign) {
       steps.push({ kind: 'skip', reason: `${ctx.opencode.path} was not written by runlist — leaving it alone` });
+    } else if (ctx.opencode?.exists && (ctx.opencode.stale || (!opts.pluginOnly && ctx.hasNpm))) {
+      steps.push({ kind: 'opencode', cmd: ['runlist', 'install', 'opencode'] });
     }
     if (ctx.codex?.foreign) {
       steps.push({ kind: 'skip', reason: `${ctx.codex.plugin} was not written by runlist — leaving it alone` });
@@ -212,15 +214,41 @@ export function planUpdate(opts, ctx) {
       steps.push({ kind: 'codex', cmd: ['runlist', 'install', 'codex'] });
     }
   }
+  if (!opts.cliOnly && !opts.pluginOnly && ctx.desktop) {
+    steps.push({ kind: 'desktop', cmd: ['runlist', 'desktop', 'install'] });
+  }
   return steps;
 }
 
-export function runUpdate(argv, _config, opts = {}) {
+export function verifyManagedHostUpdates(before, after, expectedVersion) {
+  const failures = [];
+  for (const host of ['opencode', 'codex']) {
+    if (!before[host]?.exists || before[host].foreign) continue;
+    const current = after[host];
+    if (!current?.exists || current.foreign || current.version !== expectedVersion || current.stale) {
+      failures.push(`${host} integration has ${current?.version ?? 'no managed installation'}, expected ${expectedVersion}`);
+    }
+    if (host === 'codex' && (!current?.installed?.ok || current.installed.version !== expectedVersion)) {
+      failures.push(`Codex installed plugin ${current?.installed?.reason ?? `has ${current?.installed?.version ?? 'unknown'}, expected ${expectedVersion}`}`);
+    }
+  }
+  return failures;
+}
+
+function currentCodexStatus(version) {
+  const source = codexStatus({ version });
+  if (!source.exists || source.foreign) return source;
+  const installed = which('codex') ? installedCodexStatus() : { ok: false, reason: 'codex CLI not found; installed plugin is unverified' };
+  return { ...source, installed, stale: source.stale || !installed.ok || installed.version !== version };
+}
+
+export async function runUpdate(argv, _config, opts = {}) {
   const check = argv.includes('--check');
   const cliOnly = argv.includes('--cli-only');
   const pluginOnly = argv.includes('--plugin-only');
   const plugin = readInstalledPlugin();
   const legacyPlugin = readInstalledPluginRecords({ id: LEGACY_PLUGIN_ID });
+  const desktop = process.platform === 'darwin' && process.arch === 'arm64' ? desktopLaunch([]).app : null;
 
   if (check) {
     process.stdout.write(`runlist CLI:    ${pkg.version}\n`);
@@ -246,21 +274,24 @@ export function runUpdate(argv, _config, opts = {}) {
     if (!oc.exists) process.stdout.write(dim('runlist opencode: not installed\n'));
     else if (oc.foreign) process.stdout.write(`runlist opencode: ${yellow('unmanaged file — not written by runlist')}\n`);
     else process.stdout.write(`runlist opencode: ${oc.version} ${oc.stale ? yellow('behind — run `runlist update`') : green('in sync')}\n`);
-    const cx = codexStatus({ version: pkg.version });
+    const cx = currentCodexStatus(pkg.version);
     if (!cx.exists) process.stdout.write(dim('runlist codex: not installed\n'));
     else if (cx.foreign) process.stdout.write(`runlist codex: ${yellow('unmanaged plugin directory')}\n`);
-    else process.stdout.write(`runlist codex: ${cx.version} ${cx.stale ? yellow('behind — run `runlist update`') : green('in sync')}\n`);
+    else process.stdout.write(`runlist codex: source ${cx.version}; installed ${cx.installed?.version ?? 'unverified'} ${cx.stale ? yellow('out of sync — run `runlist update`') : green('in sync')}\n`);
+    if (desktop) {
+      const version = await installedDesktopVersion(desktop);
+      process.stdout.write(`runlist desktop: ${version} ${compareDesktopVersions(version, pkg.version) < 0 ? yellow('behind — quit Runlist and run `runlist update`') : green('in sync')}\n`);
+    }
     return;
   }
 
   const opencode = opencodeStatus({ version: pkg.version });
-  const codex = codexStatus({ version: pkg.version });
-  const steps = planUpdate({ cliOnly, pluginOnly }, { plugin, legacyPlugin, opencode, codex, hasClaude: which('claude'), hasNpm: which('npm') });
+  const codex = currentCodexStatus(pkg.version);
+  const steps = planUpdate({ cliOnly, pluginOnly }, { plugin, legacyPlugin, opencode, codex, desktop, hasClaude: which('claude'), hasNpm: which('npm') });
   if (opts.dryRun) {
     for (const step of steps) {
       if (step.kind === 'skip') process.stdout.write(dim(`[dry-run] skip: ${step.reason}\n`));
       else if (step.kind === 'manual') for (const line of step.lines) process.stdout.write(dim(`[dry-run] Run from a session: ${line}\n`));
-      else if (step.kind === 'opencode') process.stdout.write(dim(`[dry-run] Would refresh: ${step.path}\n`));
       else if (step.kind === 'refusal') process.stdout.write(yellow(`[dry-run] Refused: ${step.reason}\n`));
       else process.stdout.write(dim(`[dry-run] Would run: ${step.cmd.join(' ')}${step.cwd ? ` (in ${step.cwd})` : ''}\n`));
     }
@@ -294,18 +325,17 @@ export function runUpdate(argv, _config, opts = {}) {
       process.stdout.write(dim(`skip: ${s.cmd.join(' ')} — the ${s.needs} step it depends on failed\n`));
       continue;
     }
-    if (s.kind === 'opencode') {
-      const result = installOpencodePlugin({ version: pkg.version });
-      process.stdout.write(dim(`refreshed opencode integration → ${pkg.version}  ${result.path}\n`));
-      ran = true;
-      continue;
-    }
     if (s.reason) process.stdout.write(dim(`${s.reason}\n`));
     process.stdout.write(dim(`$ ${s.cmd.join(' ')}${s.cwd ? ` (in ${s.cwd})` : ''}\n`));
-    const r = spawnSync(executableName(s.cmd[0]), s.cmd.slice(1), {
+    // npm can replace this package during the CLI step. A new Node process
+    // reads the new installers/assets; this process still holds the old modules.
+    // Use this installation's entry point, not another runlist earlier on PATH.
+    const ownCli = s.cmd[0] === 'runlist';
+    const r = spawnSync(ownCli ? process.execPath : executableName(s.cmd[0]),
+      ownCli ? [path.join(__dirname, '..', 'bin', 'runlist.mjs'), ...s.cmd.slice(1)] : s.cmd.slice(1), {
       stdio: 'inherit',
       ...(s.cwd ? { cwd: s.cwd } : {}),
-      shell: process.platform === 'win32',
+      shell: !ownCli && process.platform === 'win32',
     });
     ran = true;
     if (r.status !== 0) {
@@ -315,24 +345,40 @@ export function runUpdate(argv, _config, opts = {}) {
       if (s.kind === 'marketplace') for (const line of claudeMarketplaceRefusalHint(plugin?.marketplace)) process.stdout.write(yellow(`${line}\n`));
     }
   }
-  if (plugin?.id === DEFAULT_PLUGIN_ID && steps.some(step => step.kind === 'plugin') && !failedKinds.has('plugin') && !failedKinds.has('marketplace')) {
+  const currentVersion = opts.expectedVersion ?? JSON.parse(readFileSync(path.join(__dirname, '..', 'package.json'), 'utf8')).version;
+  if (!cliOnly) {
+    const after = { opencode: opencodeStatus({ version: currentVersion }), codex: currentCodexStatus(currentVersion) };
+    for (const reason of verifyManagedHostUpdates({ opencode, codex }, after, currentVersion)) {
+      failures.push({ reason });
+      process.stdout.write(yellow(`${reason}\n`));
+    }
+  }
+  if (!cliOnly && plugin?.id === DEFAULT_PLUGIN_ID && !failedKinds.has('plugin') && !failedKinds.has('marketplace')) {
     // npm may have replaced this package while this process was running.
-    const currentVersion = JSON.parse(readFileSync(path.join(__dirname, '..', 'package.json'), 'utf8')).version;
-    const verified = verifyPluginScopeUpdates(plugin, readInstalledPluginRecords({ id: plugin.id }), { minimumVersion: currentVersion });
+    const verified = verifyPluginScopeUpdates(plugin, readInstalledPluginRecords({ id: plugin.id }),
+      opts.expectedVersion ? { expectedVersion: currentVersion } : { minimumVersion: currentVersion });
     if (!verified.ok) {
       failures.push({ reason: verified.reason });
       process.stdout.write(yellow(`${verified.reason}\n`));
     }
   }
+  if (!cliOnly && legacyPlugin && readInstalledPluginRecords({ id: LEGACY_PLUGIN_ID })) {
+    failures.push({ reason: `legacy Claude plugin ${LEGACY_PLUGIN_ID} remains installed; migration is incomplete` });
+  }
+  if (desktop && steps.some(step => step.kind === 'desktop') && !failedKinds.has('desktop')) {
+    if (compareDesktopVersions(await installedDesktopVersion(desktop), currentVersion) < 0) {
+      failures.push({ reason: 'The matching desktop installer is not published yet; retry `runlist update` after the product release completes.' });
+    }
+  }
   if (failures.length) {
     process.stdout.write(yellow(`\n${failures.length === 1 ? '1 step' : `${failures.length} steps`} failed: ${failures.map(s => s.cmd ? `${s.cmd.join(' ')}${s.cwd ? ` (in ${s.cwd})` : ''}` : s.reason).join('; ')}\n`));
     if (ran && failures.length < steps.filter(s => s.kind !== 'skip' && s.kind !== 'manual').length) {
-      process.stdout.write(dim('the other steps completed; restart your Claude Code session (or /reload-plugins) to apply them.\n'));
+      process.stdout.write(dim('the other steps completed; restart the affected host sessions to load the updated integrations.\n'));
     }
     process.exitCode = 1;
     return;
   }
   if (ran) {
-    process.stdout.write(green('\n✓ restart your Claude Code session (or /reload-plugins) to apply.\n'));
+    process.stdout.write(green('\n✓ restart the affected host sessions to load the updated integrations.\n'));
   }
 }