runlist 0.95.2 → 0.95.3

package/README.md

@@ -47,8 +47,8 @@ controls are experimental; live retrieval depends on a compatible external
 provider. Local chat and push are deferred.
 
 <!-- runlist:release:start -->
-CLI and desktop release version: **0.95.2**.
-[Mac installer and release notes](https://github.com/reowens/runlist/releases/tag/desktop-v0.95.2).
+CLI and desktop release version: **0.95.3**.
+[Mac installer and release notes](https://github.com/reowens/runlist/releases/tag/desktop-v0.95.3).
 Normal product releases publish both components; an installed Mac app is updated with rollback after it has quit.
 <!-- runlist:release:end -->
 
@@ -219,7 +219,14 @@ and managed scopes are reported rather than silently updating another scope.
 The release workflow uses the same scope selection and verifies every entry
 against the released version.
 
-Restart Claude Code, or run `/reload-plugins`, after a plugin update.
+Updates also refresh already installed OpenCode and Codex integrations. After
+upgrading the CLI, host installers run from the updated package so their version
+and assets match. Codex verification checks the host's installed copy separately
+from its marketplace source. Releases use these same checks and remain resumable
+if an installed host fails to update. Uninstalled hosts are not added.
+
+Restart the affected host sessions to load updated integrations; Claude Code also
+supports `/reload-plugins`.
 
 ## Quick Start
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runlist",
-  "version": "0.95.2",
+  "version": "0.95.3",
   "description": "CLI for managing markdown documents with YAML frontmatter — index, query, validate, graph, export, lifecycle, and AI summaries.",
   "type": "module",
   "license": "MIT",

package/plugins/runlist-codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "runlist-codex",
-  "version": "0.95.2",
+  "version": "0.95.3",
   "description": "Runlist workflow skill, session orientation, and tool guard for Codex",
   "author": {
     "name": "Reo Owens"

package/src/codex-integration.mjs

@@ -4,6 +4,8 @@ import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, r
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+import { executableName } from './util.mjs';
 
 const SOURCE = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', 'plugins', 'runlist-codex');
 const NAME = 'runlist-codex';
@@ -33,6 +35,26 @@ export function codexStatus({ version, homedir = os.homedir() } = {}) {
   return { ...paths, exists, foreign: exists && !installed, version: installed, stale: Boolean(installed && version && installed !== version) };
 }
 
+// The marketplace source is not the plugin Codex loads. Ask the host about its
+// installed copy rather than treating our generated source marker as proof.
+export function installedCodexStatus({ homedir = os.homedir(), run = spawnSync } = {}) {
+  try {
+    const marketplace = marketplaceAt(codexPaths(homedir).marketplace).name;
+    const pluginId = `${NAME}@${marketplace}`;
+    const result = run(executableName('codex'), ['plugin', 'list', '--marketplace', marketplace, '--json'], {
+      encoding: 'utf8', shell: process.platform === 'win32', timeout: 30_000,
+    });
+    if (result.status !== 0) return { ok: false, reason: result.error?.message ?? `codex plugin list exited ${result.status ?? '?'}` };
+    const installed = JSON.parse(result.stdout).installed;
+    if (!Array.isArray(installed)) return { ok: false, reason: 'codex plugin list returned no installed plugin records' };
+    const plugin = installed.find(entry => entry.pluginId === pluginId && entry.installed === true);
+    return plugin?.version ? { ok: true, version: plugin.version, pluginId }
+      : { ok: false, reason: `${pluginId} is not installed in Codex` };
+  } catch (err) {
+    return { ok: false, reason: `cannot verify installed Codex plugin: ${err.message}` };
+  }
+}
+
 export function installCodexPlugin({ version, homedir = os.homedir(), dryRun = false } = {}) {
   const sourceVersion = JSON.parse(readFileSync(path.join(SOURCE, '.codex-plugin', 'plugin.json'), 'utf8')).version;
   if (sourceVersion !== version) throw new Error(`Codex plugin source is ${sourceVersion}, CLI is ${version}`);

package/src/install.mjs

@@ -9,7 +9,7 @@ import {
 } from './host-integration.mjs';
 import { LEGACY_PLUGIN_ID, readInstalledPlugin, readInstalledPluginRecords } from './update.mjs';
 import { executableName, which } from './util.mjs';
-import { codexStatus, installCodexPlugin } from './codex-integration.mjs';
+import { codexStatus, installCodexPlugin, installedCodexStatus } from './codex-integration.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const pkg = JSON.parse(readFileSync(path.join(__dirname, '..', 'package.json'), 'utf8'));
@@ -111,9 +111,12 @@ function installCodex(argv, dryRun, json) {
     stdio: json ? 'pipe' : 'inherit', encoding: json ? 'utf8' : undefined,
     shell: process.platform === 'win32',
   });
-  if (json) process.stdout.write(JSON.stringify({ ...result, pluginAdd: added.status === 0 ? 'installed' : 'failed', pluginAddExit: added.status }, null, 2) + '\n');
-  if (added.status !== 0) {
-    process.stderr.write(`Codex plugin source is ready; finish installation with: codex plugin add ${selector}\n`);
+  const installed = added.status === 0 ? installedCodexStatus() : { ok: false, reason: added.error?.message ?? `codex plugin add exited ${added.status ?? '?'}` };
+  const verified = installed.ok && installed.version === pkg.version;
+  if (json) process.stdout.write(JSON.stringify({ ...result, pluginAdd: verified ? 'installed' : 'failed', pluginAddExit: added.status,
+    installedVersion: installed.version ?? null, ...(!verified ? { reason: installed.reason ?? `Codex has ${installed.version}, expected ${pkg.version}` } : {}) }, null, 2) + '\n');
+  if (!verified) {
+    process.stderr.write(`Codex plugin installation is unverified: ${installed.reason ?? `has ${installed.version}, expected ${pkg.version}`}. Retry: codex plugin add ${selector}\n`);
     process.exitCode = 1;
   } else if (!json) {
     process.stdout.write('Start a new Codex thread and review/trust the plugin hooks to enable the primer and guard.\n');

package/src/update.mjs

@@ -5,8 +5,8 @@ import os from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { green, dim, yellow } from './color.mjs';
 import { executableName, which } from './util.mjs';
-import { CLAUDE_MARKETPLACE, claudeMarketplaceRefusalHint, installOpencodePlugin, opencodeStatus } from './host-integration.mjs';
-import { codexStatus } from './codex-integration.mjs';
+import { CLAUDE_MARKETPLACE, claudeMarketplaceRefusalHint, opencodeStatus } from './host-integration.mjs';
+import { codexStatus, installedCodexStatus } from './codex-integration.mjs';
 import { desktopLaunch } from './desktop.mjs';
 import { compareDesktopVersions, installedDesktopVersion } from './desktop-install.mjs';
 
@@ -203,10 +203,10 @@ export function planUpdate(opts, ctx) {
     // the moment the CLI moves on. Refresh it here — but only if it is already
     // installed. `update` keeps hosts in lockstep; it never adopts a new one,
     // which stays the job of the explicit `runlist install`.
-    if (ctx.opencode?.exists && ctx.opencode.stale) {
-      steps.push({ kind: 'opencode', path: ctx.opencode.path });
-    } else if (ctx.opencode?.foreign) {
+    if (ctx.opencode?.foreign) {
       steps.push({ kind: 'skip', reason: `${ctx.opencode.path} was not written by runlist — leaving it alone` });
+    } else if (ctx.opencode?.exists && (ctx.opencode.stale || (!opts.pluginOnly && ctx.hasNpm))) {
+      steps.push({ kind: 'opencode', cmd: ['runlist', 'install', 'opencode'] });
     }
     if (ctx.codex?.foreign) {
       steps.push({ kind: 'skip', reason: `${ctx.codex.plugin} was not written by runlist — leaving it alone` });
@@ -220,6 +220,28 @@ export function planUpdate(opts, ctx) {
   return steps;
 }
 
+export function verifyManagedHostUpdates(before, after, expectedVersion) {
+  const failures = [];
+  for (const host of ['opencode', 'codex']) {
+    if (!before[host]?.exists || before[host].foreign) continue;
+    const current = after[host];
+    if (!current?.exists || current.foreign || current.version !== expectedVersion || current.stale) {
+      failures.push(`${host} integration has ${current?.version ?? 'no managed installation'}, expected ${expectedVersion}`);
+    }
+    if (host === 'codex' && (!current?.installed?.ok || current.installed.version !== expectedVersion)) {
+      failures.push(`Codex installed plugin ${current?.installed?.reason ?? `has ${current?.installed?.version ?? 'unknown'}, expected ${expectedVersion}`}`);
+    }
+  }
+  return failures;
+}
+
+function currentCodexStatus(version) {
+  const source = codexStatus({ version });
+  if (!source.exists || source.foreign) return source;
+  const installed = which('codex') ? installedCodexStatus() : { ok: false, reason: 'codex CLI not found; installed plugin is unverified' };
+  return { ...source, installed, stale: source.stale || !installed.ok || installed.version !== version };
+}
+
 export async function runUpdate(argv, _config, opts = {}) {
   const check = argv.includes('--check');
   const cliOnly = argv.includes('--cli-only');
@@ -252,10 +274,10 @@ export async function runUpdate(argv, _config, opts = {}) {
     if (!oc.exists) process.stdout.write(dim('runlist opencode: not installed\n'));
     else if (oc.foreign) process.stdout.write(`runlist opencode: ${yellow('unmanaged file — not written by runlist')}\n`);
     else process.stdout.write(`runlist opencode: ${oc.version} ${oc.stale ? yellow('behind — run `runlist update`') : green('in sync')}\n`);
-    const cx = codexStatus({ version: pkg.version });
+    const cx = currentCodexStatus(pkg.version);
     if (!cx.exists) process.stdout.write(dim('runlist codex: not installed\n'));
     else if (cx.foreign) process.stdout.write(`runlist codex: ${yellow('unmanaged plugin directory')}\n`);
-    else process.stdout.write(`runlist codex: ${cx.version} ${cx.stale ? yellow('behind — run `runlist update`') : green('in sync')}\n`);
+    else process.stdout.write(`runlist codex: source ${cx.version}; installed ${cx.installed?.version ?? 'unverified'} ${cx.stale ? yellow('out of sync — run `runlist update`') : green('in sync')}\n`);
     if (desktop) {
       const version = await installedDesktopVersion(desktop);
       process.stdout.write(`runlist desktop: ${version} ${compareDesktopVersions(version, pkg.version) < 0 ? yellow('behind — quit Runlist and run `runlist update`') : green('in sync')}\n`);
@@ -264,13 +286,12 @@ export async function runUpdate(argv, _config, opts = {}) {
   }
 
   const opencode = opencodeStatus({ version: pkg.version });
-  const codex = codexStatus({ version: pkg.version });
+  const codex = currentCodexStatus(pkg.version);
   const steps = planUpdate({ cliOnly, pluginOnly }, { plugin, legacyPlugin, opencode, codex, desktop, hasClaude: which('claude'), hasNpm: which('npm') });
   if (opts.dryRun) {
     for (const step of steps) {
       if (step.kind === 'skip') process.stdout.write(dim(`[dry-run] skip: ${step.reason}\n`));
       else if (step.kind === 'manual') for (const line of step.lines) process.stdout.write(dim(`[dry-run] Run from a session: ${line}\n`));
-      else if (step.kind === 'opencode') process.stdout.write(dim(`[dry-run] Would refresh: ${step.path}\n`));
       else if (step.kind === 'refusal') process.stdout.write(yellow(`[dry-run] Refused: ${step.reason}\n`));
       else process.stdout.write(dim(`[dry-run] Would run: ${step.cmd.join(' ')}${step.cwd ? ` (in ${step.cwd})` : ''}\n`));
     }
@@ -304,18 +325,17 @@ export async function runUpdate(argv, _config, opts = {}) {
       process.stdout.write(dim(`skip: ${s.cmd.join(' ')} — the ${s.needs} step it depends on failed\n`));
       continue;
     }
-    if (s.kind === 'opencode') {
-      const result = installOpencodePlugin({ version: pkg.version });
-      process.stdout.write(dim(`refreshed opencode integration → ${pkg.version}  ${result.path}\n`));
-      ran = true;
-      continue;
-    }
     if (s.reason) process.stdout.write(dim(`${s.reason}\n`));
     process.stdout.write(dim(`$ ${s.cmd.join(' ')}${s.cwd ? ` (in ${s.cwd})` : ''}\n`));
-    const r = spawnSync(executableName(s.cmd[0]), s.cmd.slice(1), {
+    // npm can replace this package during the CLI step. A new Node process
+    // reads the new installers/assets; this process still holds the old modules.
+    // Use this installation's entry point, not another runlist earlier on PATH.
+    const ownCli = s.cmd[0] === 'runlist';
+    const r = spawnSync(ownCli ? process.execPath : executableName(s.cmd[0]),
+      ownCli ? [path.join(__dirname, '..', 'bin', 'runlist.mjs'), ...s.cmd.slice(1)] : s.cmd.slice(1), {
       stdio: 'inherit',
       ...(s.cwd ? { cwd: s.cwd } : {}),
-      shell: process.platform === 'win32',
+      shell: !ownCli && process.platform === 'win32',
     });
     ran = true;
     if (r.status !== 0) {
@@ -325,17 +345,27 @@ export async function runUpdate(argv, _config, opts = {}) {
       if (s.kind === 'marketplace') for (const line of claudeMarketplaceRefusalHint(plugin?.marketplace)) process.stdout.write(yellow(`${line}\n`));
     }
   }
-  if (plugin?.id === DEFAULT_PLUGIN_ID && steps.some(step => step.kind === 'plugin') && !failedKinds.has('plugin') && !failedKinds.has('marketplace')) {
+  const currentVersion = opts.expectedVersion ?? JSON.parse(readFileSync(path.join(__dirname, '..', 'package.json'), 'utf8')).version;
+  if (!cliOnly) {
+    const after = { opencode: opencodeStatus({ version: currentVersion }), codex: currentCodexStatus(currentVersion) };
+    for (const reason of verifyManagedHostUpdates({ opencode, codex }, after, currentVersion)) {
+      failures.push({ reason });
+      process.stdout.write(yellow(`${reason}\n`));
+    }
+  }
+  if (!cliOnly && plugin?.id === DEFAULT_PLUGIN_ID && !failedKinds.has('plugin') && !failedKinds.has('marketplace')) {
     // npm may have replaced this package while this process was running.
-    const currentVersion = JSON.parse(readFileSync(path.join(__dirname, '..', 'package.json'), 'utf8')).version;
-    const verified = verifyPluginScopeUpdates(plugin, readInstalledPluginRecords({ id: plugin.id }), { minimumVersion: currentVersion });
+    const verified = verifyPluginScopeUpdates(plugin, readInstalledPluginRecords({ id: plugin.id }),
+      opts.expectedVersion ? { expectedVersion: currentVersion } : { minimumVersion: currentVersion });
     if (!verified.ok) {
       failures.push({ reason: verified.reason });
       process.stdout.write(yellow(`${verified.reason}\n`));
     }
   }
+  if (!cliOnly && legacyPlugin && readInstalledPluginRecords({ id: LEGACY_PLUGIN_ID })) {
+    failures.push({ reason: `legacy Claude plugin ${LEGACY_PLUGIN_ID} remains installed; migration is incomplete` });
+  }
   if (desktop && steps.some(step => step.kind === 'desktop') && !failedKinds.has('desktop')) {
-    const currentVersion = JSON.parse(readFileSync(path.join(__dirname, '..', 'package.json'), 'utf8')).version;
     if (compareDesktopVersions(await installedDesktopVersion(desktop), currentVersion) < 0) {
       failures.push({ reason: 'The matching desktop installer is not published yet; retry `runlist update` after the product release completes.' });
     }
@@ -343,12 +373,12 @@ export async function runUpdate(argv, _config, opts = {}) {
   if (failures.length) {
     process.stdout.write(yellow(`\n${failures.length === 1 ? '1 step' : `${failures.length} steps`} failed: ${failures.map(s => s.cmd ? `${s.cmd.join(' ')}${s.cwd ? ` (in ${s.cwd})` : ''}` : s.reason).join('; ')}\n`));
     if (ran && failures.length < steps.filter(s => s.kind !== 'skip' && s.kind !== 'manual').length) {
-      process.stdout.write(dim('the other steps completed; restart your Claude Code session (or /reload-plugins) to apply them.\n'));
+      process.stdout.write(dim('the other steps completed; restart the affected host sessions to load the updated integrations.\n'));
     }
     process.exitCode = 1;
     return;
   }
   if (ran) {
-    process.stdout.write(green('\n✓ restart your Claude Code session (or /reload-plugins) to apply.\n'));
+    process.stdout.write(green('\n✓ restart the affected host sessions to load the updated integrations.\n'));
   }
 }