fix(update,housekeeping): handle directory-source marketplace (the primary AIOS mode)

Both commands hardcoded the GitHub-source marketplace path for command-sync.
But directory-source (the-aios → Directory ~/aios) is the primary mode — it's
what carries ventures + custom/ a GitHub clone would miss. On directory-source
that path doesn't exist: the marketplace copy silently no-op'd and Bucket 11
mis-flagged the absent dir as drift.

Fix: marketplace copy is now [ -d ]-guarded (cache stays runtime-authoritative);
Bucket 11 detects source type and verifies cache-only on directory-source.
Folded into the same 2026-06-30 CHANGELOG entry. Found dogfooding the update.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018N6fJz3Pd3sQtA7DtEZo6C

Author: chuycepeda

CHANGELOG.md

@@ -35,6 +35,8 @@
 > - **`/aios:housekeeping`** — Bucket 22 (agent-output gate health): spot-check that gates still catch the failure modes you care about ("gates rot") + a 30-day permission re-audit clock.
 > - Skill counts bumped across both additions (`skills/aios/` 20→22; total bundled 45→47).
 >
+> **Plus — marketplace source-type fix (`/aios:update` + `/housekeeping` Bucket 11):** both commands hard-assumed a **GitHub-source** marketplace and hardcoded `~/.claude/plugins/marketplaces/the-aios/…` for the command-sync copy. But the **primary AIOS mode is a directory-source marketplace** (`the-aios` registered as `Directory → ~/aios`) — that's what carries ventures + `custom/` a GitHub clone would miss. On directory-source that path doesn't exist, so the marketplace copy silently no-op'd and Bucket 11 would mis-flag the absent dir as drift. Fix: the marketplace copy is now `[ -d ]`-guarded (cache is runtime-authoritative either way), and Bucket 11 detects the source type and verifies the **cache only** on directory-source. Found dogfooding this very update.
+>
 > **Action required:** None — `/aios:update` delivers both skills, the two new agents, the CLAUDE.md + command edits, and the index updates automatically (skills + root docs are Tier-1 sync; bundled command/agent edits self-sync; the skills registrar re-runs). **One reload, LAST:** after the update applies, **restart your Claude Code sessions** so the new skills + agents load. If you'd locally edited any touched bundled file, your version is backed up before overwrite — standard Tier-1 behavior.
 
 ---

plugins/aios/commands/housekeeping.md

@@ -183,19 +183,21 @@ Read `~/.claude/settings.json` (global) and the project's `.claude/settings.loca
 
 #### Bucket 11: Plugin cache verification (NEW)
 
-The `plugins/aios/commands/` repo folder is the source of truth. Two derived locations must stay in sync — the plugin marketplace and the runtime cache:
+The `plugins/aios/commands/` repo folder is the source of truth. The runtime **cache** must stay in sync with it. A **marketplace** copy is a *second* derived location **only on a GitHub-source install**:
 
-- `~/.claude/plugins/marketplaces/the-aios/plugins/aios/commands/{name}.md`
-- `~/.claude/plugins/cache/the-aios/aios/<version>/commands/{name}.md` (the *installed* version dir — glob `the-aios/aios/*/commands/`, never a fixed version; the plugin bumps but this path must not pin a version)
+- `~/.claude/plugins/cache/the-aios/aios/<version>/commands/{name}.md` (the *installed* version dir — glob `the-aios/aios/*/commands/`, never a fixed version; the plugin bumps but this path must not pin a version) — **always present, runtime-authoritative.**
+- `~/.claude/plugins/marketplaces/the-aios/plugins/aios/commands/{name}.md` — **only exists on a GitHub-source marketplace install.**
 
-**Scan:** for each `plugins/aios/commands/{name}.md` in the repo, `diff` against both derived locations. Surface any drift:
+> **Detect the marketplace source type FIRST** (`claude plugin marketplace list`). The **primary AIOS mode is a directory-source marketplace** (`the-aios` registered as `Directory → ~/aios`) — that's what carries ventures + `custom/`; a GitHub-source clone would miss them. On a **directory-source** install the marketplace *reads `~/aios` in place*: the `marketplaces/the-aios/…` path **does not exist**, the repo folder IS the marketplace source, and there is **nothing to copy or compare** there. So: if `marketplaces/the-aios/plugins/aios/commands` is absent (directory-source), **verify the cache only and skip the marketplace check entirely** — do not report the absent marketplace dir as drift. Only when that dir exists (GitHub-source) does the marketplace comparison apply.
 
-- **Repo file present, marketplace/cache file missing** → command was added but never synced
-- **Files exist in all 3 but content differs** → command was edited in source but not propagated
-- **Marketplace/cache file exists, repo file missing** → command was deleted in source but stale copy lingers in plugin paths
+**Scan:** for each `plugins/aios/commands/{name}.md` in the repo, `diff` against the cache (and the marketplace **only if its dir exists**). Surface any drift:
+
+- **Repo file present, cache file missing** (or marketplace-missing on a GitHub-source install) → command was added but never synced
+- **Files differ between repo and a present derived location** → command was edited in source but not propagated
+- **A present derived file has no repo counterpart** → command was deleted in source but stale copy lingers
 
 **Auto-apply candidates** (low-stakes, deterministic):
-- Repo → marketplace + cache copy when repo is the only authoritative source. Use `cp ~/aios/plugins/aios/commands/{name}.md ~/.claude/plugins/marketplaces/the-aios/plugins/aios/commands/` and the equivalent for cache. Confirm post-copy that all 3 files match (`diff -q`).
+- Repo → cache copy (always), and repo → marketplace copy **only if the marketplace dir exists**. Guard both with `[ -d ]`: `mp=~/.claude/plugins/marketplaces/the-aios/plugins/aios/commands; [ -d "$mp" ] && cp ~/aios/plugins/aios/commands/{name}.md "$mp/"` + the cache-glob equivalent. Confirm post-copy that the synced locations match (`diff -q`). On directory-source there's nothing to copy — the source is live.
 
 **Propose-only candidates** (need user judgment):
 - Plugin paths have content the repo doesn't — possible accidental delete, or in-progress refactor. Ask before removing.

plugins/aios/commands/update.md

@@ -116,9 +116,10 @@ Concrete rules for what's currently in the framework (the operator-environment-s
   Same idempotency. (Hard-coding `pwsh` fails the install on a stock machine — surfaced by a Windows operator 2026-05-27.)
 - **Any `hooks/claude-identity/install-*.sh` / `install-*.ps1` updated** (current + future installers in that path) → auto-run by the same rule, under the same platform guard (`.sh` on non-Windows, `.ps1` on Windows).
 - **A bundled skill changed — any `skills/{aios,anthropic,superpowers}/**/SKILL.md` added/changed in the diff, OR `skills/setup.sh` itself updated** → run the skills registrar (an Installer/state-producer: it symlinks skills into `~/.claude/skills`; a newly-pulled bundled skill is NOT loadable until registered). Platform-guarded like the wrapper installer — `bash $HOME/aios/skills/setup.sh` on macOS/Linux; on Windows try `pwsh -File $HOME/aios/skills/setup.ps1` then fall back to `powershell -File …`. Idempotent (skips names already linked; the scan is venture-aware — `skills/*/*/SKILL.md` minus `anthropic`/`superpowers` source-peers). **Gate:** run ONLY when the diff touched a bundled `SKILL.md` or `skills/setup.sh` — not on every sync. Report: *"Registered {N} new skill(s) into `~/.claude/skills` — restart sessions to load them."* (Mirrors `/aios:company` Step 5.5, which does this for venture skills on sync.)
-- **Any `plugins/aios/commands/*.md` updated** → cp to both plugin pipeline locations:
+- **Any `plugins/aios/commands/*.md` updated** → sync to the plugin pipeline. **The marketplace copy applies ONLY to a GitHub-source install** — the **primary AIOS mode is a directory-source marketplace** (the local vault registered as `Directory → ~/aios`, which is what lets it carry ventures + `custom/` that a GitHub-source clone would miss). On a directory-source install the marketplace *reads `~/aios` in place*, the `marketplaces/the-aios/…` path **does not exist**, and the copy must skip silently. The cache is runtime-authoritative either way. **Guard both copies with `[ -d ]`** so directory-source no-ops cleanly:
   ```bash
-  cp $HOME/aios/plugins/aios/commands/*.md $HOME/.claude/plugins/marketplaces/the-aios/plugins/aios/commands/
+  # GitHub-source only — directory-source has no marketplace dir (reads ~/aios in place). Guard → no-op on directory-source.
+  mp="$HOME/.claude/plugins/marketplaces/the-aios/plugins/aios/commands"; [ -d "$mp" ] && cp $HOME/aios/plugins/aios/commands/*.md "$mp/"
   # cache path is VERSION-AGNOSTIC — glob the installed version dir (never hard-pin a version; the plugin bumps but this string outlives the bump). Guard handles the no-match case.
   for d in "$HOME"/.claude/plugins/cache/the-aios/aios/*/commands/; do [ -d "$d" ] && cp $HOME/aios/plugins/aios/commands/*.md "$d"; done
   ```
@@ -224,9 +225,9 @@ diff -q <(tr -d '\r' < "$HOME/aios/plugins/aios/commands/update.md") <(tr -d '\r
 1. Apply the replace for `update.md` immediately:
    - Backup local to `vault/04 - backups/aios-update-{date}/update.md` (operator divergence preserved per the standard rule).
    - Overwrite local `plugins/aios/commands/update.md` from upstream.
-2. Sync to BOTH plugin pipeline locations (marketplace + cache):
+2. Sync to the plugin pipeline (cache always; marketplace only if it's a GitHub-source install — directory-source reads `~/aios` in place, so its `marketplaces/…` path doesn't exist; both copies are `[ -d ]`-guarded):
    ```bash
-   cp $HOME/aios/plugins/aios/commands/update.md $HOME/.claude/plugins/marketplaces/the-aios/plugins/aios/commands/update.md
+   mp="$HOME/.claude/plugins/marketplaces/the-aios/plugins/aios/commands"; [ -d "$mp" ] && cp $HOME/aios/plugins/aios/commands/update.md "$mp/update.md"
    # cache path VERSION-AGNOSTIC — glob the installed version dir (was hard-pinned 0.1.0)
    for d in "$HOME"/.claude/plugins/cache/the-aios/aios/*/commands/; do [ -d "$d" ] && cp $HOME/aios/plugins/aios/commands/update.md "$d"; done
    ```