Two owners write ~/.red-skills/current, and the standalone installer's target has no plugins/

[filipeforattini]

Observed on red-dev 1.0.50, WSL2 Ubuntu 24.04, red-skills 3.19.5 -> 3.22.0.

What happens

~/.red-skills/current has two writers with incompatible layouts:

• The package-set composer (src/red-skills-set.ts) writes ~/.red-skills/sets/<revisionKey> — a composed tree carrying plugins/dev, plugins/memory, plugins/brain, opencode.json and .red/ — and points current at it.
• The standalone installer writes ~/.red-skills/versions/<tag> and points current there. retire() in red-skills-set.ts already acknowledges the split: "versions/ belongs to the standalone installer and the retention module".

On this machine the installer won last, and ~/.red-skills/versions/v3.22.0 is a symlink into mise's install tree:

~/.red-skills/current -> ~/.red-skills/versions/v3.22.0
  -> ~/.local/share/mise/installs/red-skills/3.22.0/node_modules/.mise/@reddb-io+red-skills@3.22.0/node_modules/@reddb-io/red-skills

That tree is the raw npm package. It ships .claude-plugin/marketplace.json, and that manifest declares its plugins as ./plugins/dev, ./plugins/memory, ./plugins/brain, ./plugins/internal — none of which exist in it. The npm tarball carries no top-level plugins/; only the composed set does.

So the moment the installer wins, every host that resolves plugins through current breaks:

✘ Failed to update plugin "dev@red-skills": Plugin source not found at ~/.red-skills/current/plugins/dev

The user-visible symptom is the opposite of a broken path: claude /plugin reports "dev is already at the latest version (3.19.5)" forever, because the update cannot find the source to compare against. Nothing says the pointer is wrong.

Why it matters beyond the plugin

Anything pinned to the plugin version follows it. Here the Claude-side MCP launcher pins the proxy to the plugin's own version (npx -p @reddb-io/red-skills@$ver red-skills-redskilled-mcp) while the redskilled daemon self-updates to npm latest through its own npx path. Stuck at 3.19.5 against a 3.21.0/3.22.0 resident, every MCP call returns ACP connection closed, and worker birth is refused (granted this Worker no fork SHA, exit 78). One stale symlink ends as "the autonomous queue will not start", with no error naming the symlink.

Expected

One owner for current, or a defined precedence between them. If versions/ is to remain a supported target, whatever current names must satisfy the same contract the composed set does — the paths its own marketplace.json declares have to resolve.

Reproduction

1. Converge a machine so current names a composed set under sets/.
2. Let the standalone installer materialise a newer release into versions/.
3. readlink -f ~/.red-skills/current now resolves into the mise install tree, and test -d "$(readlink -f ~/.red-skills/current)/plugins/dev" fails.

Related

Spec #201 — one local RedSkills package set for the complete workstation.