update

ChainGPT Skill Update Manager

When the user invokes this skill, follow these steps in order:

Step 1: Check the Prepared Local Checkout

Use the prepared local checkout described in the root README. Do not update a marketplace cache or replace files in a running plugin session. Have the user stop that session before applying changes, or prepare a separate checkout for the next session.

From the checkout root, read the installed version and check for local changes:

cat VERSION
git status --short

Report the current version. If there are local changes, stop the update and let the user preserve them; do not stash, reset, overwrite, or merge them automatically.

Step 2: Check for Updates

Verify that origin is the intended ChainGPT repository. Fetch updates without applying them, then record the full commit SHA from the fetched origin/main:

git -c core.hooksPath=/dev/null fetch origin main
CHAINGPT_REVIEWED_COMMIT="$(git rev-parse --verify origin/main)"
printf '%s\n' "$CHAINGPT_REVIEWED_COMMIT"
git log --oneline "HEAD..$CHAINGPT_REVIEWED_COMMIT"
git diff --stat HEAD "$CHAINGPT_REVIEWED_COMMIT"

Retain that exact SHA throughout review and application. If a later command runs in a fresh shell, set CHAINGPT_REVIEWED_COMMIT to the recorded literal SHA, never to a freshly resolved remote ref.

• If HEAD equals the recorded SHA, report that no update is available.
• If the histories diverge or the local checkout is ahead, stop and report the difference. Do not reset or create a merge commit.
• Otherwise, proceed to review the fetched commit before changing the checkout or installing dependencies.

Step 3: Review the Exact Update

Inspect the full diff against the recorded SHA. Pay particular attention to dependency manifests and lockfiles, mcp-server/dist/, the launcher, hooks, .mcp.json, plugin metadata, scripts and skills:

git diff HEAD "$CHAINGPT_REVIEWED_COMMIT"

Check the candidate revision's security and build results. Do not execute downloaded hooks, build scripts or dependency lifecycle scripts during review. Explain material changes and unresolved findings before asking to apply the exact recorded SHA. Categorize changes where useful: