---
name: update-component
description: Updates a stale skill or subagent to its latest upstream version. Always asks for confirmation before any write. Updates `.maxv-source.json` (for manually-cloned skills) or runs `/plugin update` (for plugin-managed components). Used by `orchestrate` after `check-version` reports stale components.
when_to_use: |
  Called by `orchestrate` in step 7 for each component the user approved for update.
  Also invocable directly: "atualize anthropic-skills",
  "/maxvision-orchestration:update-component shadcn-ui".
disable-model-invocation: true
allowed-tools: Read Bash(test *) Bash(jq *) Bash(gh api *) Bash(git -C * fetch *) Bash(git -C * pull *) Bash(git -C * sparse-checkout *) Bash(git -C * rev-parse *) Bash(date *) Bash(cat *)
---

# Update component

Argument: $ARGUMENTS — component id (skill or subagent name).

> **Hard rule:** this skill writes to disk. It must always confirm with the user before executing any update. Never auto-run.

## Workflow

### 1. Resolve component → method

Read `installed_plugins.json` and the catalog (`../discover-skill/references/skill-sources.json`) to determine which update method applies:

| Component shape | Update method |
| --- | --- |
| Plugin from a known marketplace | `/plugin update <plugin>@<marketplace>` (interactive — needs user to confirm in the UI) |
| Skill cloned into `~/.claude/skills/<name>/` with `.maxv-source.json` | `git -C <path> fetch + pull` (or sparse-checkout refresh) |
| Skill installed via npx antigravity | re-run `npx antigravity-awesome-skills --claude --tags <skill-tag>` |
| Personal skill with no upstream | refuse — there is nothing to update |

### 2. Show the diff intent

Before writing anything, print:

```
About to update: <component>
  From: <local_sha or version>
  To:   <remote_sha or version>
  Method: <selected method>
  Files affected: <expected paths>

Proceed? [sim/skip]
```

Wait for user response. If `skip`, exit without changes and log to `~/.claude/projects/<workspace>/maxv-orchestration.log`.

### 3. Execute the update

#### Plugin path

Echo the command for the user to run, since `/plugin update` is interactive:
```
Run: /plugin update <plugin>@<marketplace>
```
Then ask: "Did the update succeed? [sim/no]". Update the cache only on `sim`.

#### Sparse-clone path

```bash
SKILL_PATH=~/.claude/skills/<name>
git -C "$SKILL_PATH" fetch origin <branch>
git -C "$SKILL_PATH" pull --ff-only origin <branch>
NEW_SHA=$(git -C "$SKILL_PATH" rev-parse HEAD)
```

If `pull --ff-only` fails (non-FF), surface an error and abort. Do not force-pull.

#### npx path

```bash
npx antigravity-awesome-skills --claude --tags <component-tag>
```

After execution, the user must confirm the install completed (the npx command prints its own status).

### 4. Update `.maxv-source.json` and cache

For sparse-clone skills:

```bash
cat > "$SKILL_PATH/.maxv-source.json" <<EOF
{
  "\$schema_version": "1.0.0",
  "repo": "<repo>",
  "branch": "<branch>",
  "source_path": "<path>",
  "commit_sha": "$NEW_SHA",
  "last_check": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
  "install_method": "sparse_clone",
  "installed_via": "maxvision-orchestration",
  "installed_at": "<keep original install time>"
}
EOF
```

Update `~/.claude/cache/maxv-orchestration/version-check.json` for this entry: `local_sha = NEW_SHA`, `status = up_to_date`, `last_check_iso = now`.

### 5. Report

```
✓ Updated: shadcn-ui (skill)
  Old sha: abc1234
  New sha: def5678
  Source:  shadcn-ui/ui @ main
  Files:   ~/.claude/skills/shadcn-ui/
  Cache:   refreshed
```

Append to log:
```
2026-04-28T14:35:21Z  update  shadcn-ui  abc1234 -> def5678  ok
```

## Guardrails

- **Single confirmation per component.** Never assume "all" from a previous answer unless `orchestrate` explicitly passed the user's batch approval.
- **Never `git pull` without `--ff-only`.** A non-fast-forward situation usually means the user customized the skill locally — stop and ask.
- **Never force-push, hard-reset, or rebase user state.**
- **Never delete user-authored files.** If a skill folder has files not tracked by upstream, leave them alone.
- After plugin updates, suggest `/reload-plugins` to the user (do not run it automatically — that command is interactive in some Claude Code versions).
- If the update path is `/plugin update <name>` and the user runs it, capture the result in the cache only after they confirm success.