wood-fired-tasks 2.1.0 → 2.1.1

package/CHANGELOG.md

@@ -13,6 +13,21 @@ vulnerabilities, supply-chain pinning) are always called out under `Security`.
 
 _No changes yet._
 
+## [v2.1.1] - 2026-06-09
+
+### Fixed
+- **`tasks self-update` now re-syncs bundled skills/agents into `~/.claude`**
+  (PR #57, task #934). The command previously only ran
+  `npm i -g wood-fired-tasks@latest`, so a release that added or changed a
+  skill (first hit: v2.1.0's `/tasks:set-models`) left self-updaters with
+  stale `~/.claude/commands/tasks/` while reporting success — violating the
+  README's "keep it up to date" contract. After a clean install, self-update
+  now runs the same idempotent `copySkills()`/`copyAgents()` sync `tasks
+  setup` uses, reports what it refreshed, and exits non-zero with a
+  `tasks setup` remediation hint if the sync itself fails. A contract test
+  pins the default sync to setup's own implementation so the update and
+  onboarding paths cannot drift.
+
 ## [v2.1.0] - 2026-06-09
 
 ### Added
@@ -814,7 +829,9 @@ and the task/project/dependency/comment/subtask domain model.
 - Task hierarchy (subtasks), dependency service, comments, time estimates
   (phase 06).
 
-[Unreleased]: https://github.com/Wood-Fired-Games/wood-fired-tasks/compare/v2.0.0...HEAD
+[Unreleased]: https://github.com/Wood-Fired-Games/wood-fired-tasks/compare/v2.1.1...HEAD
+[v2.1.1]: https://github.com/Wood-Fired-Games/wood-fired-tasks/compare/v2.1.0...v2.1.1
+[v2.1.0]: https://github.com/Wood-Fired-Games/wood-fired-tasks/compare/v2.0.6...v2.1.0
 [v2.0.0]: https://github.com/Wood-Fired-Games/wood-fired-tasks/compare/v1.18.2...v2.0.0
 [v1.15]: https://github.com/Wood-Fired-Games/wood-fired-tasks/compare/v1.14...v1.15
 [v1.14]: https://github.com/Wood-Fired-Games/wood-fired-tasks/compare/v1.13...v1.14

package/README.md

@@ -143,7 +143,7 @@ user scope.
 
 ```bash
 wood-fired-tasks service install   # Linux: user-scoped systemd unit (admin-free)
-wood-fired-tasks self-update       # npm i -g wood-fired-tasks@latest (no sudo)
+wood-fired-tasks self-update       # npm i -g @latest + re-sync skills (no sudo)
 ```
 
 **Point at a shared remote server** (the *Remote client* mode above) with

package/SECURITY.md

@@ -14,11 +14,11 @@ security updates. Older tags are provided as-is.
 | Version           | Supported          |
 | ----------------- | ------------------ |
 | `main` (HEAD)     | :white_check_mark: |
-| `v2.1.0` (latest) | :white_check_mark: |
+| `v2.1.1` (latest) | :white_check_mark: |
 | `v1.0` – `v2.0.6` | :x:                |
 
 "Latest" tracks whichever tag is most recent on GitHub; at the time of
-writing that is `v2.1.0`. If you are reading this on an older checkout,
+writing that is `v2.1.1`. If you are reading this on an older checkout,
 verify the current latest release via
 `git tag --sort=-creatordate | head -1` or the GitHub Releases page.
 

package/dist/cli/commands/self-update.d.ts

@@ -1,12 +1,20 @@
 import { Command } from 'commander';
 import { type ChildProcess, type SpawnOptions } from 'child_process';
+import { type CopySkillsResult, type CopyAgentsResult } from './setup.js';
 /**
  * `tasks self-update` — frictionless self-update for npm-global installs
  * (project #36, task #739).
  *
- * Spawns `npm i -g wood-fired-tasks@latest` and exits with that child's exit
- * code. The DB schema does NOT need touching here — migrate-on-next-serve
- * handles it the next time the service boots against the upgraded binary.
+ * Spawns `npm i -g wood-fired-tasks@latest`, then re-syncs the bundled
+ * skills/agents into ~/.claude (task #934): the npm install replaces the
+ * files under the global prefix in place, so the post-install copySkills /
+ * copyAgents read the NEW version's assets even though this process is still
+ * running the old binary. Without this step, any release that adds or
+ * changes a skill leaves self-updaters with stale ~/.claude/commands/tasks
+ * while self-update reports success — violating the README's "keep it up to
+ * date" contract. The DB schema does NOT need touching here —
+ * migrate-on-next-serve handles it the next time the service boots against
+ * the upgraded binary.
  *
  * EACCES policy: a global npm install under a root-owned prefix fails with
  * EACCES. We DO NOT escalate (no sudo / runas / elevation of ANY kind).
@@ -17,9 +25,14 @@ import { type ChildProcess, type SpawnOptions } from 'child_process';
  */
 export type SpawnFn = (command: string, args: readonly string[], options: SpawnOptions) => ChildProcess;
 export type NotifyFn = (currentVersion: string) => void | Promise<void>;
+export type SyncAssetsFn = () => {
+    skills: CopySkillsResult;
+    agents: CopyAgentsResult;
+};
 export interface SelfUpdateDeps {
     spawn?: SpawnFn;
     notify?: NotifyFn;
+    syncAssets?: SyncAssetsFn;
 }
 /**
  * True when a spawn error / non-zero exit looks like an EACCES-class

package/dist/cli/commands/self-update.js

@@ -3,6 +3,7 @@ import { spawn as nodeSpawn } from 'child_process';
 import { colorError, colorInfo, colorSuccess, colorWarn } from '../output/formatters.js';
 import { VERSION } from '../../utils/version.js';
 import { buildNpmInvocation } from '../util/npm-spawn.js';
+import { copySkills, copyAgents } from './setup.js';
 const PACKAGE_NAME = 'wood-fired-tasks';
 /**
  * True when a spawn error / non-zero exit looks like an EACCES-class
@@ -98,6 +99,7 @@ export const selfUpdateCommand = new Command('self-update')
     const deps = selfUpdateCommand._deps ?? {};
     const spawn = deps.spawn ?? nodeSpawn;
     const notify = deps.notify ?? defaultNotify;
+    const syncAssets = deps.syncAssets ?? (() => ({ skills: copySkills(), agents: copyAgents() }));
     // update-notifier nudge: surface a "newer version available" hint before
     // we attempt the upgrade. Best-effort and never blocks the update.
     await notify(VERSION);
@@ -119,6 +121,25 @@ export const selfUpdateCommand = new Command('self-update')
         process.exitCode = code ?? 1;
         return;
     }
+    // npm replaced the package files under the global prefix in place, so the
+    // sync below reads the NEW version's dist/skills even though this process
+    // still runs the old binary. A sync failure is loud and non-zero: "update
+    // succeeded but your skills are stale" is exactly the silent state this
+    // step exists to eliminate (task #934).
+    try {
+        const { skills, agents } = syncAssets();
+        const refreshed = skills.written.length + agents.written.length;
+        console.log(refreshed > 0
+            ? colorInfo(`Refreshed ${skills.written.length} skill(s) in ${skills.destDir} and ${agents.written.length} agent(s) in ${agents.destDir}`)
+            : colorInfo(`Skills and agents already up to date in ${skills.destDir}`));
+    }
+    catch (syncError) {
+        const message = syncError instanceof Error ? syncError.message : String(syncError);
+        console.error(colorError(`Update installed, but syncing bundled skills/agents into ~/.claude failed: ${message}`));
+        console.error(colorWarn(`Run \`${PACKAGE_NAME} setup\` to retry the skills sync.`));
+        process.exitCode = 1;
+        return;
+    }
     console.log(colorSuccess(`Updated ${PACKAGE_NAME}. The schema migrates automatically on next serve.`));
     process.exitCode = 0;
 });

package/docs/SETUP.md

@@ -158,8 +158,13 @@ unless `--port` overrides it. The unauthenticated `GET /health` route returns
 wood-fired-tasks self-update
 ```
 
-This runs `npm i -g wood-fired-tasks@latest` and exits with npm's exit code. It
-**never escalates**: on an EACCES (root-owned global prefix) it prints the
+This runs `npm i -g wood-fired-tasks@latest`, then re-syncs the bundled
+skills into `~/.claude/commands/tasks/` and the subagent definitions into
+`~/.claude/agents/` — the same idempotent copy `setup` performs, so a release
+that adds or changes a skill is fully picked up by `self-update` alone (no
+`setup` re-run needed). If the install succeeds but the skills sync fails, it
+says so and exits non-zero; re-run `wood-fired-tasks setup` to retry the sync.
+It **never escalates**: on an EACCES (root-owned global prefix) it prints the
 writable-prefix remediation (the same `~/.npm-global` fix as `--fix-npm-prefix`)
 and exits non-zero rather than suggesting sudo. The database schema needs no
 special handling — it migrates automatically the next time `serve` (or the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wood-fired-tasks",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "description": "Network-wide task tracking system for Wood Fired Games",
   "keywords": [
     "task-tracker",