Update mechanism + drift detection for drop-in installs

[maxfindel]

Problem

FlowChad installs via `git clone` into `.flowchad/`. Once cloned, there's no mechanism to:

1. Know if your installed version is outdated
2. Update safely (without clobbering your flows, config, snapshots)
3. Track what version you're running

This is the same problem Speckit has (manual `specify init --here --force`, no drift detection) and that the broader Claude Code ecosystem hasn't solved. The closest solutions are `npx skills check` (Vercel's skills.sh — checks HEAD, no pinning) and git submodules (`git submodule status` shows divergence).

Research

Surveyed the ecosystem:

Tool	Install	Update	Drift Detection
Speckit	Copy templates + scripts	`specify init --here --force` (manual)	None
Impeccable	Copy skills directory	Manual	None
skills.sh (Vercel, 90k skills)	`npx skills add`	`npx skills check/update`	Yes (HEAD tracking)
Claude Forge	`git clone` + symlinks	`git pull` (instant via symlinks)	Implicit
Skillshare	Go CLI, centralized sync	`skillshare update --all`	`skillshare audit`
Claude Octopus	`/plugin install`	`claude plugin update`	`--check` CI mode
Native plugins (Anthropic)	`/plugin install`	Manual	None

Key insight: Nobody has solved "detect drift in a copy-pasted directory." The symlink approach (Claude Forge) sidesteps it entirely — updates are instant because the files aren't copies.

Proposal

1. Version tracking

Add `.flowchad/.version`:
```
0.2.0
e97346d
2026-03-23
```
Three lines: semver, git SHA, date. Written on clone/install, checked on update.

2. `scripts/check-updates.sh`

Compares installed SHA against upstream:
```bash
INSTALLED_SHA=$(sed -n '2p' .flowchad/.version)
LATEST_SHA=$(git ls-remote https://github.com/Fellowship-dev/flowchad.git HEAD | cut -f1)
if [ "$INSTALLED_SHA" != "$LATEST_SHA" ]; then
echo "Update available: $INSTALLED_SHA → $LATEST_SHA"
fi
```

Run manually, or hook into `/flowchad-setup` as a first-run check.

3. `scripts/update.sh`

Safe update that protects user content:
```bash

Protected (never touched):

flows/ — user's flow definitions

config.yml — user's project config

snapshots/ — walk results

reports/ — generated reports

Updated (overwritten from upstream):

skills/ — AI skill instructions

commands/ — slash command definitions

knowledge/ — reference docs

templates/ — starter flow templates

.gitignore — internal gitignore

.version — version tracking

```

This mirrors Speckit's approach (specs/ protected, infrastructure overwritten) but makes it explicit and scripted.

4. Distribution channels (in priority order)

a) Git clone (current, keep as primary)
```bash
git clone https://github.com/Fellowship-dev/flowchad.git .flowchad
```
Simple, works everywhere, familiar. Add `.version` file + update scripts.

b) Native `/plugin install` support
The Anthropic plugin system (`/plugin install`) is becoming the standard distribution channel (14.3k stars). FlowChad should support it alongside git clone. Requires a `plugin.json` manifest.

c) `npx skills add` support
Vercel's skills.sh has 90k skills in its registry. Registration is free, increases discoverability. FlowChad already follows the SKILL.md + frontmatter convention it expects.

d) Install script (already done)
```bash
curl -fsSL https://raw.githubusercontent.com/Fellowship-dev/flowchad/main/install.sh | bash
```

5. Scope

• Add `.flowchad/.version` (written by install.sh and update.sh)
• Add `scripts/check-updates.sh` — compare installed vs upstream SHA
• Add `scripts/update.sh` — safe update with protected paths
• Add `plugin.json` manifest for native `/plugin install`
• Register on skills.sh registry
• Update install.sh to write `.version`
• `/flowchad-setup` checks for updates on first run