git:20260908.6a78e4b to git:20260908.1723ca9

---

name: dough-update

description: Apply the latest released Open Dough guidance from this project's recorded source, or from a supplied repository URL on first install. Use when the user asks to update Open Dough or invokes dough-update.

---

# Update Open Dough

Install and update the latest numeric Open Dough release for Codex, Cursor, and

Claude Code together. Codex and Cursor share `.agents/skills/`; Claude Code

uses `.claude/skills/`. The running tool is only the entry context used to find

the recorded source for a no-URL update.

Pin that release with Git before any repository script runs, then call the

inspected snapshot's helper. Do not reimplement the helper's comparison or

installation decisions.

Local-guidance replacement is not supported by dough-update.

Do not inspect, assess, prepare, repair callers for, or remove an adopter's

local guidance. Do not fetch a source or run an installer for such a request. A

one-time adoption is project-specific work outside this reusable updater.

Ordinary Open Dough release updates remain available from the recorded source.

1. Capture the target project's absolute path before fetching anything. Use the

current project unless the user supplied another target.

2. If the user asked to install or update a specific version, tag, or branch,

stop. Say `Open Dough installs and updates the latest numeric release only.

Requested-version updates are not supported.` Do not fetch or write.

3. Identify the running tool from the current host. Do not infer it from which

skill directories exist. Pass it as the installer platform hint, then

install the same released payload into every native root:

| Running tool | `--platform` | Installed files |

| --- | --- | --- |

| Codex | `codex` (omitting `--platform` is equivalent) | `.agents/skills/` |

| Cursor | `cursor` | `.agents/skills/` (shared with Codex) |

| Claude Code | `claude` | `.claude/skills/` |

pinned release's installer and baseline-comparison helper. Treat that

release as authoritative: payload skills may be added between releases, so

a path absent from the installed release is not by itself a reason to stop.

The numeric `VERSION` record and the

recorded `SOURCE` live beside each `dough-update/SKILL.md`. Installation

writes the same `SOURCE` from the supplied repository URL or local path,

then `VERSION`, in both physical roots. Ordinary no-URL updates reuse the

invoking root's recorded `SOURCE`. Source recognition records are maintainer

material and are not installed.

4. Resolve the Open Dough source from the invoking root. If that updater

destination already exists and has a usable recorded

`dough-update/SOURCE`, use that source. For an ordinary update, if that

record is missing or unusable, stop and report that ordinary update cannot

establish the recorded baseline. Do not ask for a URL, do not treat the

destination as a first install, and do not substitute the target project's

remote or local working-tree content. If the destination does not exist,

use the repository URL supplied by the user; if none was supplied, ask for

it before proceeding. First installation takes a supplied source. Explicit

force uses the recorded SOURCE when present; otherwise it takes a supplied

`--url`.

5. Make a fresh temporary directory. Using only Git, pin the highest numeric

release before any repository script runs. Do not clone the default

branch, and do not execute `install.sh` or `open-dough-release.sh` from

the working tree or from an unpinned clone.

a. Run `git ls-remote --tags -- <source-url>`. Keep `vMAJOR.MINOR.PATCH`

tags. When both a tag object and a peeled `^{}` line exist, use the

peeled commit. Select the highest version by comparing each component

as a decimal integer string; do not use shell arithmetic.

b. `git init` the work directory, `git fetch --depth 1 <source-url>

<commit>`, and check out that commit detached. Confirm

`git rev-parse HEAD` equals the peeled commit.

c. Inspect that snapshot's `src/install/open-dough-release.sh`,

`src/install/open-dough-release-apply.sh`, `install.sh`, the helpers they

source, and every public payload source they declare under `src/skills/`.

d. Run the inspected helper, quoting paths. Codex may omit `--platform`.

For an ordinary update of a recorded installation, run

`bash <snapshot>/src/install/open-dough-release.sh apply --target

<captured-project> --platform <tool> --checkout <snapshot>` and do not

pass `--url`; the helper reads `SOURCE`. For a first installation, also

pass `--url <source-url>`. Pass `--force` only when the user explicitly

authorized a forced reinstall. When the invoking root has a usable

SOURCE, omit `--url`; otherwise include `--url <source-url>`.

If apply reports that HEAD is not the pinned latest, stop. Do not fetch

or check out replacement files after inspection. Proceed only if the

inspected files write solely to the release-declared public payload paths

under both native skill roots and each updater's `SOURCE` and

`VERSION` records in the captured target project, preserving

distributable source, unrelated project files, and home guidance.

6. Trust the helper's comparison. An ordinary update without a supplied URL

fetches the recorded VERSION tag as data and compares the installation with

the payload declared by that recorded release before any skip or

replacement. Candidate-only payload paths must be absent before the helper

may add them; a pre-existing collision refuses without writes. Equal

recorded versions that still match that baseline must not invoke

`install.sh` or write the selected files;

untagged source changes alone do not require writes. Changed or missing

managed files, or an unavailable recorded tag, refuse without writing even

when the recorded version equals latest. An older recorded installation is

replaced with latest only when those files are unchanged. If ordinary

update cannot establish that baseline — missing or unusable SOURCE or

VERSION, an unavailable recorded tag or source, baseline metadata mismatch,

or changed or missing managed files — refuse without writing, forcing, or

treating the destination as a first install. Explicit `--force` skips that

comparison and replaces the selected installation with latest, including

edited, incomplete, equal, or newer files, writing the payload then SOURCE

then VERSION. A supplied-URL missing selected record advances directly to

latest. A verified newer selected record is preserved with no downgrade; an

unverifiable newer record is unsupported without writes. A malformed

selected `VERSION` is an error, not unknown. Fetch, tag, and invalid-highest

release failures must not write the target or fall back to a lower release

or branch. If replacement starts and then fails, report that installed files

may be incomplete, that the last successful record was left unchanged, and

that explicit `--force` reinstall is the recovery path.

7. Report the helper's source URL, release tag and commit, running tool and

native skill root, all installed payload paths, previous version or

unknown, and actual outcome. After a replacement,

tell the user to start a fresh session in the same tool, then invoke

`/dough-update` in Cursor or Claude Code, or `$dough-update` in Codex, to

use the updated guidance. Do not claim an update succeeded if fetching,

validation, comparison, or installation failed. Manual reading of the tagged

`CHANGELOG.md` is sufficient; do not print changelog text here.