feat(agent): add safe pack update scripts

README.md

@@ -1,6 +1,6 @@
 # GEWU local research-agent pack
 
-Version 0.20.11. Clarifies Antigravity's MCP argument envelope and required project/budget fields, enforces the one-pass diagnostics/context/run sequence, and distinguishes staged sources from registered sources. It keeps prepared proposal JSON byte-for-byte intact, records safe recovery from one missing outer brace in a copied proposal, distinguishes malformed proposals from valid policy holds, makes clear that run state is created through GEWU MCP rather than local run files, avoids headless shell/cache lookups and run-ID reuse across pack changes, groups proposals by semantic learning, guards against placeholder probes, uses server-side canonical digest preparation, stores compact run pins, requires explicit shared scope, checks duplicates, bounds citation reads and checkpoints per-source budgets.
+Version 0.20.12. Adds safe pack update scripts for Windows and POSIX workspaces. Clarifies Antigravity's MCP argument envelope and required project/budget fields, enforces the one-pass diagnostics/context/run sequence, and distinguishes staged sources from registered sources. It keeps prepared proposal JSON byte-for-byte intact, records safe recovery from one missing outer brace in a copied proposal, distinguishes malformed proposals from valid policy holds, makes clear that run state is created through GEWU MCP rather than local run files, avoids headless shell/cache lookups and run-ID reuse across pack changes, groups proposals by semantic learning, guards against placeholder probes, uses server-side canonical digest preparation, stores compact run pins, requires explicit shared scope, checks duplicates, bounds citation reads and checkpoints per-source budgets.
 
 This pack contains the [agent profile](AGENTS.md), Claude harness pointer ([CLAUDE.md](CLAUDE.md)), shared protocols, four skills and separate pipeline procedures. An existing local host supplies the model and tools. There is no standalone agent engine here.
 
@@ -74,6 +74,24 @@ GEWU can be deployed in two configurations: a **dedicated research workspace** o
 
 To remove an installation, run `python .agents/gewu/scripts/install.py uninstall my-project` from the installed pack or original source. Removal restores exact pre-install instruction bytes and removes only unchanged pack files. If a managed file has changed since installation, removal stops and preserves all content for manual review.
 
+### Updating an installed project
+
+The installer is for first-time setup and safe removal; do not run `uninstall` followed by `install` to update a workspace. Older installations may not have an installation receipt, so uninstall can refuse while install correctly refuses to overwrite the existing pack.
+
+When the `GEWU_agent` checkout is a sibling of the project directory, update from the project root with:
+
+```powershell
+.\GEWU_agent\update_gewu.bat
+```
+
+On Linux or macOS:
+
+```bash
+./GEWU_agent/update_gewu.sh
+```
+
+Both scripts pull the pack with a fast-forward-only Git update, verify its manifest, back up the installed `.agents/gewu` directory under `.agents/gewu-backup-<timestamp>`, synchronize the pack, and verify the installed copy. They leave project-root instruction files in place. Pack-local edits are replaced by the pulled version; the backup preserves the previous copy. The POSIX script requires `rsync`. The optional first argument is the project directory when the checkout is stored elsewhere, for example `./GEWU_agent/update_gewu.sh /path/to/project`.
+
 ## Working with existing agents, skills, and folders
 
 In real user projects, developers often already have agent configurations, custom skills, and active development workflows. GEWU is explicitly designed to coexist cleanly without clobbering existing setups:

manifest.json

@@ -1,6 +1,6 @@
 {
   "pack_id": "gewu-research",
-  "pack_version": "0.20.11",
+  "pack_version": "0.20.12",
   "manifest_version": "1.0.0",
   "status": "local-contract-and-checkpoint-bound-hosts-not-qualified",
   "execution": "existing-local-agent-host",
@@ -397,7 +397,7 @@
       "compatible_checkpoint_contracts": [
         "gewu.local-checkpoint@0.1.0"
       ],
-      "sha256": "c892ec1cc26670b2ecc6644ca3bed665569e9474e7b45f8d72a69abc3d9c73ce",
+      "sha256": "964fc6944b63e457855f558182cf3ab83c9c3bebc8fa6448087e3072a3f821d0",
       "hash_encoding": "utf8-no-bom-lf"
     },
     {
@@ -516,6 +516,6 @@
   "snapshot": {
     "algorithm": "sha256",
     "scope": "modules array serialized as UTF-8 JSON with sorted keys and compact separators",
-    "digest": "e9b1ea3991237382224500a01371f52bc137d4eb32d750a34d9176c456edca5a"
+    "digest": "54f6dd1e9fbb9b3e7dcf4de99d43df36dd06cd796afa65a510df5978e6cee6f5"
   }
 }

update_gewu.bat

@@ -0,0 +1,68 @@
+@echo off
+setlocal
+
+set "PACK=%~dp0"
+if "%~1"=="" (
+    for %%I in ("%PACK%..") do set "WORKSPACE=%%~fI"
+) else (
+    for %%I in ("%~1") do set "WORKSPACE=%%~fI"
+)
+set "DEST=%WORKSPACE%\.agents\gewu"
+
+echo [1/3] Pulling GEWU agent updates...
+git -C "%PACK%" pull --ff-only
+if errorlevel 1 goto :pull_failed
+
+echo [2/3] Verifying the pulled pack...
+python "%PACK%scripts\manifest_tool.py" verify
+if errorlevel 1 goto :source_verify_failed
+
+if not exist "%DEST%\" (
+    echo Installed GEWU pack not found: "%DEST%"
+    echo For a new project, use scripts\install.py install first.
+    exit /b 1
+)
+
+for /f %%I in ('powershell -NoProfile -Command "Get-Date -Format yyyyMMdd-HHmmss"') do set "STAMP=%%I"
+if not defined STAMP (
+    echo Could not create a backup timestamp.
+    exit /b 1
+)
+set "BACKUP=%WORKSPACE%\.agents\gewu-backup-%STAMP%"
+
+echo Backing up the installed pack to "%BACKUP%"...
+robocopy "%DEST%" "%BACKUP%" /E /COPY:DAT /R:2 /W:1
+if errorlevel 8 goto :backup_failed
+
+echo [3/3] Updating the installed pack...
+robocopy "%PACK%" "%DEST%" /MIR /XD .git __pycache__ /XF .git /R:2 /W:1
+if errorlevel 8 goto :copy_failed
+
+python "%DEST%\scripts\manifest_tool.py" verify
+if errorlevel 1 goto :installed_verify_failed
+
+echo GEWU agent pack successfully updated and verified!
+echo Backup: "%BACKUP%"
+exit /b 0
+
+:pull_failed
+echo Git pull failed.
+exit /b 1
+
+:source_verify_failed
+echo The pulled GEWU pack failed manifest verification.
+exit /b 1
+
+:backup_failed
+echo Backup failed; the installed pack was not updated.
+exit /b 1
+
+:copy_failed
+echo Pack copy failed. The previous pack backup is at "%BACKUP%".
+exit /b 1
+
+:installed_verify_failed
+echo Installed pack verification failed. Restoring the backup...
+robocopy "%BACKUP%" "%DEST%" /MIR /R:2 /W:1
+echo Check the backup at "%BACKUP%" if restore or verification still fails.
+exit /b 1

update_gewu.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+PACK_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+WORKSPACE="${1:-$(dirname -- "$PACK_DIR")}"
+if [[ ! -d "$WORKSPACE" ]]; then
+  printf 'Project directory does not exist: %s\n' "$WORKSPACE" >&2
+  exit 1
+fi
+WORKSPACE="$(cd -- "$WORKSPACE" && pwd)"
+DEST="$WORKSPACE/.agents/gewu"
+
+echo '[1/3] Pulling GEWU agent updates...'
+git -C "$PACK_DIR" pull --ff-only
+
+echo '[2/3] Verifying the pulled pack...'
+python3 "$PACK_DIR/scripts/manifest_tool.py" verify
+
+if [[ ! -d "$DEST" || -L "$DEST" ]]; then
+  printf 'Installed GEWU pack not found or unsafe: %s\n' "$DEST" >&2
+  echo 'For a new project, use scripts/install.py install first.' >&2
+  exit 1
+fi
+if ! command -v rsync >/dev/null 2>&1; then
+  echo 'rsync is required to update the installed pack.' >&2
+  exit 1
+fi
+
+STAMP="$(date +%Y%m%d-%H%M%S)"
+BACKUP="$WORKSPACE/.agents/gewu-backup-$STAMP"
+if [[ -e "$BACKUP" ]]; then
+  printf 'Backup path already exists: %s\n' "$BACKUP" >&2
+  exit 1
+fi
+
+echo "Backing up the installed pack to $BACKUP..."
+cp -a -- "$DEST" "$BACKUP"
+
+echo '[3/3] Updating the installed pack...'
+rsync -a --delete --exclude='.git' --exclude='__pycache__/' "$PACK_DIR/" "$DEST/"
+
+if ! python3 "$DEST/scripts/manifest_tool.py" verify; then
+  echo 'Installed pack verification failed; restoring the backup...' >&2
+  rsync -a --delete "$BACKUP/" "$DEST/"
+  echo "Backup: $BACKUP" >&2
+  exit 1
+fi
+
+echo 'GEWU agent pack successfully updated and verified!'
+echo "Backup: $BACKUP"