ship the capabilities repository, and update it from the same button as plugins

capabilities/ is the file-based item store, and most of it belongs to the
owner: the six item directories are created by the platform at boot and
extensions/tool-loader is written from platform source, so neither is tracked
anywhere. What IS tracked is the small set the platform ships — today one
affordance, telling an agent that markdown images render and that the USER'S
DEVICE fetches the URL, which it cannot discover from the filesystem.

That now lives in officerdev/capabilities, public so a fresh install can clone
it without credentials.

Two ways in. The setup script syncs it during the layout step — non-fatal, and
it says what an install without it costs rather than failing: agents go back to
guessing, which is what they did before this existed. And "Update all" on the
marketplace screen carries it alongside the plugins, because it is the same
question — get me what has been published since I installed — and a second
different gesture for it is one nobody remembers.

Three states in both places, and the third is the normal one on an existing
machine: a checkout is pulled, an empty directory is cloned into, and a
directory that already holds the platform's generated items gets a repository
initialised around them. UNTRACKED files never block a pull, because the
owner's own skills and tools living here is the ordinary state — only tracked
changes do.

`cloned` and `adopted` are reported in the UI where `pulled` is not: they mean
this machine had no affordances at all until the button was pressed.

Verified against the real checkout: sync reports pulled, and the loader finds
officer/core/image-rendering afterwards.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/plugins/update.ts

@@ -1,6 +1,7 @@
-import { existsSync } from 'node:fs';
+import { existsSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { PLUGINS_DIR } from './discover';
+import { OFFICER_ITEMS_DIR, PLATFORM_DIR } from '../data-path';
 import { installPlugin } from './install';
 import type { OnStep, PluginActionResult } from './install';
 import type { OnLog } from './run-logged';
@@ -109,3 +110,70 @@ export async function updatePlugin(
   const result = await installPlugin(appName, onStep, userId, onLog);
   return { ...result, steps: [...steps, ...result.steps] };
 }
+
+// ── The capabilities repository ──
+//
+// `capabilities/` is the file-based item store, and most of what is in it belongs to the owner. A small
+// part does not: the affordances the platform ships, which tell an agent what the client on the other
+// end will do. Those live in `officerdev/capabilities` and are cloned by the setup script.
+//
+// Updated from the same button as the plugins, because it is the same question — "get me what has been
+// published since I installed" — and because an owner who has to remember a second, different gesture for
+// it will not remember it.
+//
+// The three states mirror `capabilities_sync` in the setup script: a checkout is pulled, an empty
+// directory is cloned into, and a directory that already has the platform's generated items in it gets a
+// repository initialised around them. That last case is the normal one on a machine installed before this
+// existed.
+
+const CAPABILITIES_REPO = 'https://gitea.officer.dev/officerdev/capabilities.git';
+
+export type CapabilitiesResult = { ok: boolean; action: 'pulled' | 'cloned' | 'adopted' | 'failed'; error?: string };
+
+export async function syncCapabilities(onLog?: OnLog): Promise<CapabilitiesResult> {
+  const dir = OFFICER_ITEMS_DIR;
+  if (!Bun.which('git')) return { ok: false, action: 'failed', error: 'git is not installed on this machine' };
+
+  try {
+    if (existsSync(join(dir, '.git'))) {
+      // Refused rather than merged, exactly as a plugin is: whatever diverged here is somebody's work.
+      const dirty = await git(dir, ['status', '--porcelain']);
+      if (dirty.out) {
+        // Untracked files are the ORDINARY state — the owner's own skills and tools live here, and the
+        // platform writes its generated directories in. Only tracked changes block a pull.
+        const tracked = dirty.out.split('\n').filter((l) => !l.startsWith('??'));
+        if (tracked.length) {
+          return { ok: false, action: 'failed', error: `capabilities has ${tracked.length} uncommitted change(s)` };
+        }
+      }
+      const pulled = await git(dir, ['pull', '--ff-only', 'origin', 'main']);
+      if (pulled.code !== 0) return { ok: false, action: 'failed', error: pulled.err || 'git pull failed' };
+      onLog?.('[capabilities] pulled');
+      return { ok: true, action: 'pulled' };
+    }
+
+    if (!existsSync(dir) || readdirSync(dir).length === 0) {
+      const cloned = await git(PLATFORM_DIR, ['clone', '--quiet', CAPABILITIES_REPO, dir]);
+      if (cloned.code !== 0) return { ok: false, action: 'failed', error: cloned.err || 'git clone failed' };
+      onLog?.('[capabilities] cloned');
+      return { ok: true, action: 'cloned' };
+    }
+
+    for (const argv of [
+      ['init', '--quiet'],
+      ['remote', 'add', 'origin', CAPABILITIES_REPO],
+      ['fetch', '--quiet', 'origin', 'main'],
+      ['checkout', '--quiet', '-B', 'main', 'FETCH_HEAD'],
+    ]) {
+      const r = await git(dir, argv);
+      // `remote add` fails when one is already there, which is not a problem worth stopping for.
+      if (r.code !== 0 && argv[0] !== 'remote') {
+        return { ok: false, action: 'failed', error: r.err || `git ${argv[0]} failed` };
+      }
+    }
+    onLog?.('[capabilities] adopted the existing directory');
+    return { ok: true, action: 'adopted' };
+  } catch (err) {
+    return { ok: false, action: 'failed', error: err instanceof Error ? err.message : String(err) };
+  }
+}