Replace scheduled AUR imports with direct upstream watches

bin/add-package

@@ -6,7 +6,7 @@ source "$BUILD_ROOT/helpers/message-helpers.sh"
 source "$BUILD_ROOT/helpers/paths.sh"
 
 PACKAGE=""
-SOURCE="aur"
+SOURCE="local"
 SYNC="true"
 RELEASE_RING=""
 AUR_PACKAGE=""
@@ -17,14 +17,14 @@ usage() {
   cat <<EOF
 Usage: $0 <package> [OPTIONS]
 
-Create pkgbuilds/<package> with Omarchy metadata. AUR packages are synced
-immediately after metadata is written.
+Create an Omarchy-owned package. --source aur imports a starting recipe once;
+future releases must use an upstream watch, provider, or hook.
 
 Options:
-  --source <aur|local>       Package source (default: aur)
+  --source <aur|local>       Initial recipe source (default: local)
   --local                    Shortcut for --source local
   --aur <name>               AUR package name when different from local directory
-  --no-sync                  For AUR packages, mark sync disabled after initial setup
+  --no-sync                  Keep the imported recipe manually maintained
   --fast                     Put package in the fast release ring
   --release-ring <ring>      Release ring (currently: fast)
   --scaffold                 For local packages, create a starter PKGBUILD
@@ -32,9 +32,9 @@ Options:
   -h, --help                 Show this help message
 
 Examples:
-  $0 yay
-  $0 spotify --fast
-  $0 signal-desktop --no-sync
+  $0 yay --source aur
+  $0 spotify --source aur --fast
+  $0 signal-desktop --source aur --no-sync
   $0 omarchy-zsh --local --scaffold
 EOF
 }
@@ -97,6 +97,10 @@ if [[ -z "$PACKAGE" ]]; then
   usage
   exit 1
 fi
+if [[ ! $PACKAGE =~ ^[a-zA-Z0-9@_+][a-zA-Z0-9@._+-]*$ ]]; then
+  print_error "Invalid package name: $PACKAGE"
+  exit 1
+fi
 
 case "$SOURCE" in
   aur|local) ;;
@@ -112,6 +116,11 @@ PACKAGE_DIR="$PKGBUILDS_DIR/$PACKAGE"
 OMARCHY_DIR="$PACKAGE_DIR/.omarchy"
 METADATA_FILE="$OMARCHY_DIR/package.json"
 
+if [[ "$SOURCE" == aur && -f "$PACKAGE_DIR/PKGBUILD" ]]; then
+  print_error "Refusing to replace the maintained recipe for $PACKAGE"
+  exit 1
+fi
+
 if [[ -f "$METADATA_FILE" && "$FORCE" != true ]]; then
   print_error "Package metadata already exists: $METADATA_FILE"
   print_info "Use --force to overwrite it"
@@ -146,18 +155,8 @@ jq -n "${jq_args[@]}" "$jq_filter" > "$METADATA_FILE"
 print_success "Wrote $METADATA_FILE"
 
 if [[ "$SOURCE" == "aur" ]]; then
-  if [[ "$SYNC" == "false" ]]; then
-    # Temporarily sync once, then restore sync=false so future automated syncs skip it.
-    tmpfile=$(mktemp)
-    jq 'del(.sync)' "$METADATA_FILE" > "$tmpfile"
-    mv "$tmpfile" "$METADATA_FILE"
-    "$BUILD_ROOT/bin/sync-aur" "$PACKAGE"
-    jq '. + {sync: false}' "$METADATA_FILE" > "$tmpfile"
-    mv "$tmpfile" "$METADATA_FILE"
-    print_info "AUR sync disabled for future runs"
-  else
-    "$BUILD_ROOT/bin/sync-aur" "$PACKAGE"
-  fi
+  "$BUILD_ROOT/bin/import-aur" "$PACKAGE"
+
 else
   if [[ "$SCAFFOLD" == true && ! -f "$PACKAGE_DIR/PKGBUILD" ]]; then
     cat > "$PACKAGE_DIR/PKGBUILD" <<EOF

bin/import-aur

@@ -0,0 +1,62 @@
+#!/bin/bash
+# Internal initial-recipe import used by add-package. Maintained recipes are
+# never replaced; subsequent releases go through sync-upstream.
+set -euo pipefail
+
+BUILD_ROOT=$(realpath "${BASH_SOURCE[0]%/*}/..")
+source "$BUILD_ROOT/helpers/message-helpers.sh"
+source "$BUILD_ROOT/helpers/paths.sh"
+
+if [[ ${1:-} == --help || ${1:-} == -h ]]; then
+  echo "Usage: bin/add-package <package> --source aur [--aur <upstream-name>]"
+  exit 0
+fi
+if [[ $# != 1 || ! $1 =~ ^[a-zA-Z0-9@_+][a-zA-Z0-9@._+-]*$ ]]; then
+  print_error "Use bin/add-package <package> --source aur for an initial import"
+  exit 1
+fi
+package=$1
+package_dir="$PKGBUILDS_DIR/$package"
+metadata="$package_dir/.omarchy/package.json"
+if [[ -f "$package_dir/PKGBUILD" ]]; then
+  print_error "Refusing to replace the maintained recipe for $package"
+  exit 1
+fi
+if [[ ! -f "$metadata" ]] || [[ $(jq -r .source "$metadata") != aur ]]; then
+  print_error "Initial import requires metadata created by bin/add-package --source aur"
+  exit 1
+fi
+aur_package=$(jq -r --arg name "$package" '.aur // $name' "$metadata")
+if [[ ! $aur_package =~ ^[a-zA-Z0-9@_+][a-zA-Z0-9@._+-]*$ ]]; then
+  print_error "Invalid AUR package name"
+  exit 1
+fi
+# Refuse unrelated package files: an import only starts from .omarchy metadata.
+shopt -s dotglob nullglob
+for item in "$package_dir"/*; do
+  if [[ ${item##*/} != .omarchy ]]; then
+    print_error "Initial import needs an empty package directory: $package_dir"
+    exit 1
+  fi
+done
+
+work=$(mktemp -d "$PKGBUILDS_DIR/.import-aur.XXXXXX")
+trap 'rm -rf "$work"' EXIT
+print_info "Importing $package from AUR package $aur_package..."
+git clone --quiet "https://aur.archlinux.org/${aur_package}.git" "$work/recipe"
+[[ -f "$work/recipe/PKGBUILD" ]] || { print_error "AUR package has no PKGBUILD"; exit 1; }
+commit=$(git -C "$work/recipe" rev-parse HEAD)
+rm -rf "$work/recipe/.git" "$work/recipe/.omarchy"
+rm -f "$work/recipe/.SRCINFO" "$work/recipe/.gitignore"
+cp -a "$package_dir/.omarchy" "$work/recipe/.omarchy"
+jq --arg name "$aur_package" --arg commit "$commit" '
+  .source = "local" | .origin = {aur: $name, commit: $commit}
+  | del(.aur, .upstream_commit)
+' "$metadata" > "$work/recipe/.omarchy/package.json"
+# Stage on the same filesystem, restoring the metadata directory on failure.
+mv "$package_dir" "$work/original"
+if ! mv "$work/recipe" "$package_dir"; then
+  mv "$work/original" "$package_dir"
+  exit 1
+fi
+print_success "Imported $package; review the recipe and configure its direct upstream watch"

bin/package-worktree

@@ -17,13 +17,13 @@ Usage: $0 <package> [OPTIONS]
 Create a scratch workspace for inspecting an AUR-backed package.
 
 The workspace contains:
-  upstream/  Raw AUR package at .omarchy/package.json upstream_commit, or HEAD
+  upstream/  Raw AUR package at the recorded origin.commit, or HEAD
   patched/   Raw AUR package with Omarchy .omarchy patches/hooks/pkgrel applied
   current/   Current checked-in package directory
 
 Options:
   --dir <path>       Workspace directory (default: mktemp under /tmp)
-  --commit <sha>     Use a specific AUR commit instead of upstream_commit
+  --commit <sha>     Use a specific AUR commit instead of origin.commit
   -h, --help         Show this help message
 
 Examples:
@@ -75,13 +75,13 @@ if [[ ! -f "$METADATA" ]]; then
   exit 1
 fi
 
-if [[ "$(jq -r '.source // ""' "$METADATA")" != "aur" ]]; then
+if [[ "$(jq -r '.origin.aur // .aur // (if .source == "aur" then "legacy" else "" end)' "$METADATA")" == "" ]]; then
   print_error "package-worktree only supports AUR-backed packages"
   exit 1
 fi
 
-AUR_PACKAGE=$(jq -r --arg package "$PACKAGE" '.aur // $package' "$METADATA")
-UPSTREAM_COMMIT=${COMMIT_OVERRIDE:-$(jq -r '.upstream_commit // ""' "$METADATA")}
+AUR_PACKAGE=$(jq -r --arg package "$PACKAGE" '.origin.aur // .aur // $package' "$METADATA")
+UPSTREAM_COMMIT=${COMMIT_OVERRIDE:-$(jq -r '.origin.commit // .upstream_commit // ""' "$METADATA")}
 
 if [[ -z "$DEST_DIR" ]]; then
   DEST_DIR=$(mktemp -d "${TMPDIR:-/tmp}/omarchy-${PACKAGE}.XXXXXX")
@@ -224,7 +224,7 @@ print_info "AUR package: $AUR_PACKAGE"
 if [[ -n "$UPSTREAM_COMMIT" ]]; then
   print_info "Upstream commit: $UPSTREAM_COMMIT"
 else
-  print_warning "No upstream_commit recorded; using AUR HEAD"
+  print_warning "No origin.commit recorded; using AUR HEAD"
 fi
 
 rm -rf "$UPSTREAM_DIR" "$PATCHED_DIR" "$CURRENT_DIR"

bin/sync-aur

@@ -1,434 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-BUILD_ROOT=$(realpath "${BASH_SOURCE[0]%/*}/..")
-source "$BUILD_ROOT/helpers/message-helpers.sh"
-source "$BUILD_ROOT/helpers/paths.sh"
-source "$BUILD_ROOT/helpers/package-metadata.sh"
-
-TEMP_DIR=$(mktemp -d)
-trap 'rm -rf "$TEMP_DIR"' EXIT
-
-SPECIFIC_PACKAGES=()
-
-usage() {
-  cat <<EOF
-Usage: $0 [PACKAGE...]
-
-Sync AUR-backed packages into pkgbuilds/<package>/.
-
-Package selection is driven by pkgbuilds/<package>/.omarchy/package.json:
-  { "source": "aur" }                  # synced from matching AUR package name
-  { "source": "aur", "aur": "yaru" }  # synced from different AUR package name
-  { "source": "aur", "sync": false }  # AUR-origin, but not auto-synced
-
-Arguments:
-  PACKAGE    One or more package names to sync (optional)
-
-Examples:
-  $0                    # Sync all AUR packages with sync enabled
-  $0 yay cursor-bin     # Sync specific packages
-EOF
-}
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    -h|--help)
-      usage
-      exit 0
-      ;;
-    --tier)
-      print_error "--tier is no longer supported; package metadata controls sync behavior"
-      exit 1
-      ;;
-    --*)
-      print_error "Unknown option: $1"
-      exit 1
-      ;;
-    *)
-      SPECIFIC_PACKAGES+=("$1")
-      shift
-      ;;
-  esac
-done
-
-print_header "AUR Package Sync"
-mkdir -p "$PKGBUILDS_DIR"
-
-SYNCED=0
-SKIPPED=0
-FAILED=0
-SYNCED_PACKAGES=()
-SPECIFIC_MODE=false
-
-get_pkgbuild_field() {
-  local package_dir="$1"
-  local field="$2"
-  local value=""
-
-  if [[ -f "$package_dir/PKGBUILD" ]]; then
-    value=$(grep -m1 "^${field}=" "$package_dir/PKGBUILD" | cut -d= -f2- | tr -d "\"'") || true
-    if [[ -n "$value" ]]; then
-      echo "$value"
-      return
-    fi
-  fi
-
-  if [[ -f "$package_dir/.SRCINFO" ]]; then
-    awk -F' = ' -v field="$field" '$1 ~ "^[[:space:]]*" field "$" { print $2; exit }' "$package_dir/.SRCINFO"
-  fi
-}
-
-set_pkgrel() {
-  local package_dir="$1"
-  local pkgrel="$2"
-  local pkgbuild="$package_dir/PKGBUILD"
-
-  if [[ -f "$pkgbuild" ]]; then
-    sed -i "s/^pkgrel=.*/pkgrel=$pkgrel/" "$pkgbuild"
-  fi
-}
-
-display_package_name() {
-  local package_dir="$1"
-  local name
-  name=$(basename "$package_dir")
-  echo "${name%.work}"
-}
-
-remove_aur_only_files() {
-  local package_dir="$1"
-
-  rm -f "$package_dir/.SRCINFO" "$package_dir/.gitignore"
-}
-
-copy_aur_contents() {
-  local aur_dir="$1"
-  local target_dir="$2"
-
-  mkdir -p "$target_dir"
-
-  shopt -s dotglob nullglob
-  local item base
-  for item in "$aur_dir"/*; do
-    base=$(basename "$item")
-    [[ "$base" == ".git" ]] && continue
-    cp -a "$item" "$target_dir/"
-  done
-  shopt -u dotglob nullglob
-}
-
-commit_synced_worktree() {
-  local work_dir="$1"
-  local target_dir="$2"
-  local parent base staged_dir backup_root backup_dir
-
-  parent=$(dirname "$target_dir")
-  base=$(basename "$target_dir")
-  staged_dir=$(mktemp -d "$parent/.${base}.staged.XXXXXX")
-  backup_root=$(mktemp -d "$parent/.${base}.backup.XXXXXX")
-  backup_dir="$backup_root/$base"
-
-  # Copy to the package filesystem before swapping. This keeps the original
-  # package directory intact if copying from /tmp fails or is interrupted.
-  if ! cp -a "$work_dir/." "$staged_dir/"; then
-    print_error "Failed to stage synced package for $base"
-    rm -rf "$staged_dir" "$backup_root"
-    return 1
-  fi
-
-  if [[ -e "$target_dir" ]]; then
-    if ! mv "$target_dir" "$backup_dir"; then
-      print_error "Failed to back up existing package directory: $target_dir"
-      rm -rf "$staged_dir" "$backup_root"
-      return 1
-    fi
-  fi
-
-  if ! mv "$staged_dir" "$target_dir"; then
-    print_error "Failed to install synced package directory: $target_dir"
-    if [[ -e "$backup_dir" ]]; then
-      mv "$backup_dir" "$target_dir" || true
-    fi
-    rm -rf "$staged_dir" "$backup_root"
-    return 1
-  fi
-
-  rm -rf "$backup_root" "$work_dir"
-}
-
-set_upstream_commit() {
-  local package_dir="$1"
-  local commit="$2"
-  local metadata="$package_dir/.omarchy/package.json"
-  local tmpfile
-
-  tmpfile=$(mktemp)
-  jq --arg commit "$commit" '.upstream_commit = $commit' "$metadata" > "$tmpfile"
-  mv "$tmpfile" "$metadata"
-}
-
-apply_omarchy_patches() {
-  local package_dir="$1"
-  local patches_dir="$package_dir/.omarchy/patches"
-  local applied=false
-
-  [[ -d "$patches_dir" ]] || return 1
-
-  shopt -s nullglob
-  local patch_files=("$patches_dir"/*.patch)
-  local patch_dir_files=("$patches_dir"/*)
-  shopt -u nullglob
-
-  if [[ ${#patch_files[@]} -eq 0 ]]; then
-    if [[ ${#patch_dir_files[@]} -gt 0 ]]; then
-      print_warning "No .patch files found in $patches_dir"
-    fi
-    return 1
-  fi
-
-  print_info "Applying Omarchy patches for $(display_package_name "$package_dir")..."
-  local patch_file
-  for patch_file in "${patch_files[@]}"; do
-    print_info "  $(basename "$patch_file")"
-    if ! (cd "$package_dir" && patch -p1 --forward --batch --no-backup-if-mismatch < "$patch_file"); then
-      print_error "Failed to apply patch: $patch_file"
-      return 2
-    fi
-    applied=true
-  done
-
-  [[ "$applied" == true ]]
-}
-
-run_omarchy_post_sync_hook() {
-  local package_dir="$1"
-  local package="$2"
-  local aur_package="$3"
-  local aur_pkgrel="$4"
-  local hook="$package_dir/.omarchy/post-sync.sh"
-
-  [[ -f "$hook" ]] || return 1
-
-  print_info "Running Omarchy post-sync hook for $(display_package_name "$package_dir")..."
-  if ! (
-    cd "$package_dir"
-    PACKAGE_NAME="$package" \
-      AUR_PACKAGE_NAME="$aur_package" \
-      AUR_PKGREL="$aur_pkgrel" \
-      bash ".omarchy/post-sync.sh"
-  ); then
-    print_error "Failed to run post-sync hook: $hook"
-    return 2
-  fi
-
-  return 0
-}
-
-apply_pkgrel_suffix_if_customized() {
-  local package_dir="$1"
-  local aur_pkgrel="$2"
-
-  [[ -n "$aur_pkgrel" ]] || return 0
-
-  print_info "Applying Omarchy pkgrel suffix for $(display_package_name "$package_dir"): pkgrel=$aur_pkgrel.1"
-  set_pkgrel "$package_dir" "$aur_pkgrel.1"
-}
-
-apply_pkgrel_override() {
-  local package_dir="$1"
-  local aur_pkgrel="$2"
-  local previous_pkgver="$3"
-  local metadata="$package_dir/.omarchy/package.json"
-  local pkgbuild="$package_dir/PKGBUILD"
-
-  [[ -f "$metadata" ]] || return 1
-  jq -e 'has("pkgrel")' "$metadata" >/dev/null || return 1
-
-  local current_pkgver suffix offset base rel tmpfile
-  # Read through the same accessor that produced previous_pkgver. Parsing it a
-  # second time here let a quoted pkgver= compare unequal to itself, which threw
-  # away the pkgrel metadata of an unchanged package on every sync.
-  current_pkgver=$(get_pkgbuild_field "$package_dir" pkgver)
-
-  if [[ -n "$previous_pkgver" && "$current_pkgver" != "$previous_pkgver" ]]; then
-    print_info "Removing stale pkgrel metadata for $(display_package_name "$package_dir") (pkgver changed: $previous_pkgver -> $current_pkgver)"
-    tmpfile=$(mktemp)
-    jq 'del(.pkgrel)' "$metadata" > "$tmpfile"
-    mv "$tmpfile" "$metadata"
-    return 1
-  fi
-
-  suffix=$(jq -r '.pkgrel.suffix // 1' "$metadata")
-  offset=$(jq -r '.pkgrel.offset // 0' "$metadata")
-
-  if [[ ! "$offset" =~ ^[0-9]+$ || ! "$aur_pkgrel" =~ ^[0-9]+$ ]]; then
-    print_error "pkgrel offset requires numeric AUR pkgrel for $(display_package_name "$package_dir")"
-    return 2
-  fi
-
-  base=$((aur_pkgrel + offset))
-  rel="$base.$suffix"
-
-  print_info "Applying pkgrel suffix for $(display_package_name "$package_dir"): AUR pkgrel=$aur_pkgrel, offset=$offset, suffix=$suffix -> pkgrel=$rel"
-  set_pkgrel "$package_dir" "$rel"
-  return 0
-}
-
-clone_aur_package() {
-  local aur_package="$1"
-  local dest="$2"
-  local clone_log="$TEMP_DIR/clone.log"
-  local attempt
-
-  for attempt in 1 2 3; do
-    rm -rf "$dest"
-    if git clone "https://aur.archlinux.org/${aur_package}.git" "$dest" >"$clone_log" 2>&1; then
-      return 0
-    fi
-    if [[ $attempt -lt 3 ]]; then
-      print_warning "Clone of $aur_package failed (attempt $attempt/3), retrying in 10s..."
-      sleep 10
-    fi
-  done
-
-  print_warning "Failed to clone $aur_package after 3 attempts: $(tail -n 1 "$clone_log")"
-  return 1
-}
-
-sync_package() {
-  local package="$1"
-  local package_dir="$PKGBUILDS_DIR/$package"
-  local metadata="$package_dir/.omarchy/package.json"
-
-  if [[ ! -f "$metadata" ]]; then
-    if [[ "$SPECIFIC_MODE" == true ]]; then
-      print_error "Package $package is missing .omarchy/package.json"
-      ((++FAILED))
-    else
-      print_warning "Skipping $package: missing .omarchy/package.json"
-      ((++SKIPPED))
-    fi
-    return 0
-  fi
-
-  if [[ "$(jq -r '.source // ""' "$metadata")" != "aur" ]]; then
-    print_info "Skipping $package: source is not AUR"
-    ((++SKIPPED))
-    return 0
-  fi
-
-  if [[ "$(jq -r 'if has("sync") then .sync else true end' "$metadata")" == "false" ]]; then
-    print_info "Skipping $package: AUR sync disabled"
-    ((++SKIPPED))
-    return 0
-  fi
-
-  local aur_package
-  aur_package=$(jq -r --arg package "$package" '.aur // $package' "$metadata")
-
-  if [[ "$aur_package" == "$package" ]]; then
-    print_info "Syncing $package from AUR..."
-  else
-    print_info "Syncing $package from AUR package $aur_package..."
-  fi
-
-  cd "$TEMP_DIR"
-
-  if ! clone_aur_package "$aur_package" "$TEMP_DIR/$aur_package"; then
-    ((++FAILED))
-    return 0
-  fi
-
-  if [[ ! -f "$TEMP_DIR/$aur_package/PKGBUILD" ]]; then
-    print_warning "AUR repository for $aur_package is empty (package does not exist in AUR)"
-    ((++FAILED))
-    return 0
-  fi
-
-  local aur_dir="$TEMP_DIR/$aur_package"
-  local work_dir="$TEMP_DIR/${package}.work"
-  local aur_pkgrel previous_pkgver upstream_commit
-  aur_pkgrel=$(get_pkgbuild_field "$aur_dir" pkgrel)
-  previous_pkgver=$(get_pkgbuild_field "$package_dir" pkgver || true)
-  upstream_commit=$(git -C "$aur_dir" rev-parse HEAD)
-
-  rm -rf "$work_dir"
-  copy_aur_contents "$aur_dir" "$work_dir"
-  rm -rf "$work_dir/.omarchy"
-  cp -a "$package_dir/.omarchy" "$work_dir/.omarchy"
-
-  local customized=false
-
-  if apply_omarchy_patches "$work_dir"; then
-    customized=true
-  else
-    local patch_status=$?
-    if [[ $patch_status -eq 2 ]]; then
-      ((++FAILED))
-      return 0
-    fi
-  fi
-
-  if run_omarchy_post_sync_hook "$work_dir" "$package" "$aur_package" "$aur_pkgrel"; then
-    customized=true
-  else
-    local hook_status=$?
-    if [[ $hook_status -eq 2 ]]; then
-      ((++FAILED))
-      return 0
-    fi
-  fi
-
-  local pkgrel_overridden=false
-  set +e
-  apply_pkgrel_override "$work_dir" "$aur_pkgrel" "$previous_pkgver"
-  local pkgrel_status=$?
-  set -e
-  case "$pkgrel_status" in
-    0) pkgrel_overridden=true ;;
-    1) ;;
-    *) ((++FAILED)); return 0 ;;
-  esac
-
-  if [[ "$customized" == true && "$pkgrel_overridden" == false ]]; then
-    apply_pkgrel_suffix_if_customized "$work_dir" "$aur_pkgrel"
-  fi
-
-  remove_aur_only_files "$work_dir"
-
-  set_upstream_commit "$work_dir" "$upstream_commit"
-  if ! commit_synced_worktree "$work_dir" "$package_dir"; then
-    ((++FAILED))
-    return 0
-  fi
-
-  SYNCED_PACKAGES+=("$package")
-  ((++SYNCED))
-}
-
-if [[ ${#SPECIFIC_PACKAGES[@]} -gt 0 ]]; then
-  SPECIFIC_MODE=true
-  for package in "${SPECIFIC_PACKAGES[@]}"; do
-    sync_package "$package"
-  done
-else
-  while IFS= read -r package; do
-    sync_package "$package"
-  done < <(packages_for_aur_sync)
-fi
-
-echo ""
-if [[ $FAILED -gt 0 ]]; then
-  print_error "Sync completed with failures"
-else
-  print_success "Sync complete!"
-fi
-echo "  Target: $PKGBUILDS_DIR"
-echo "  Synced: $SYNCED"
-echo "  Skipped: $SKIPPED"
-echo "  Failed: $FAILED"
-
-if [[ $FAILED -gt 0 ]]; then
-  exit 1
-fi

bin/sync-upstream

@@ -9,6 +9,7 @@ source "$BUILD_ROOT/helpers/upstream-github.sh"
 
 TEMP_DIR=$(mktemp -d)
 trap 'rm -rf "$TEMP_DIR"' EXIT
+export UPSTREAM_CACHE_DIR="$TEMP_DIR/watch-cache"
 
 SPECIFIC_PACKAGES=()
 
@@ -332,6 +333,12 @@ sync_package() {
     return 0
   fi
 
+  if jq -e '.sync == false' "$package_dir/.omarchy/package.json" >/dev/null 2>&1; then
+    print_info "Skipping $package: upstream updates held by sync=false"
+    ((++SKIPPED))
+    return 0
+  fi
+
   local provider has_upstream=false
   provider=$(package_upstream_provider "$package_dir")
   if package_has_upstream_provider "$package_dir"; then
@@ -372,6 +379,21 @@ sync_package() {
 
   print_info "Checking $package for upstream releases..."
 
+  if [[ "$provider" == watch ]]; then
+    local result
+    if ! result=$(python3 "$BUILD_ROOT/helpers/upstream-watch.py" sync "$package_dir" --min-age "$min_age"); then
+      print_error "Upstream watch failed for $package"
+      ((++FAILED))
+    elif [[ $(jq -r .status <<<"$result") == updated ]]; then
+      print_success "  $(jq -r '.before + " -> " + .after' <<<"$result")"
+      ((++UPDATED))
+    else
+      print_info "  $(jq -r '.reason' <<<"$result")"
+      ((++SKIPPED))
+    fi
+    return 0
+  fi
+
   local release release_status=0
   if [[ -n "$provider" ]]; then
     case "$provider" in