Update native host templates in /check-updates

plugins/mobile-apps/README.md

@@ -253,7 +253,7 @@ Example edit flows:
 | `/add-native` | ✅ v0 | Add a supported native capability/control (camera, image-picker, barcode/QR scanner, document-picker, PDF viewer/report, pen/signature, secure-store, file-system, sharing, etc.) — verifies the module already ships in the template and writes typed wrappers under `src/native/` without installing native packages or editing `app.config.js` |
 | `/list-connections` | ✅ v0 | Finds or creates a Power Platform connection ID, or resolves a solution connection reference, for `npx power-apps add-data-source`. Use when adding non-Dataverse connectors or re-binding after a 401. |
 | `/edit-app` | ✅ v0 | Post-generation app editor — updates affected sections of `native-app-plan.md`, applies Dataverse/native/design/connector changes, rebuilds affected screens, runs verification, updates `memory-bank.md`, and regenerates `preview.html` when UI changed. `--plan-only` preserves the old docs-only behavior. |
-| `/check-updates` | ✅ v0 | Standalone dependency maintenance — checks for a plugin update and restart first, then presents, approves, updates, and validates direct packages one at a time in host, other `@microsoft/*`, and remaining npm package order. |
+| `/check-updates` | ✅ v0 | Standalone dependency maintenance — checks for a plugin update and restart first, updates the native host with its template migrations, then presents, approves, updates, and validates the remaining direct packages one at a time. |
 | `/deploy` | ✅ v0 | Build + push — `npm run build` then `npx power-apps push` to the env in `power.config.json`. **Does not** drive `expo run:ios` or `expo run:android` (out of scope for v0). |
 | `/open-wrap-url` | ✅ v0 | Opens the Wrap URL in browser for an app ID using `https://make.powerapps.com/environments/<envID>/wrap?appID=<appID>`. Requires both `--app-id` and `--env-id`. |
 | `/report-issue` | ✅ v0 | Read-only diagnostic — collects env / Expo / Node versions, project context, recent errors, and renders a copy-paste-ready GitHub issue body. Sanitizes secrets. |

plugins/mobile-apps/skills/check-updates/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: check-updates
-description: Use when a Power Apps mobile project needs dependency updates or an npm audit review. Checks the mobile-app plugin first, then updates the native host, other Microsoft packages, and all remaining direct npm packages in order with validation and rollback.
+description: Use when a Power Apps mobile project needs dependency updates or an npm audit review. Checks the mobile-app plugin first, updates the native host with its template migrations, then updates other Microsoft packages and all remaining direct npm packages in order with validation and rollback.
 user-invocable: true
 allowed-tools: Read, Write, Edit, Glob, Grep, Bash, WebFetch, AskUserQuestion
 model: opus
@@ -39,11 +39,45 @@ npm outdated --json --depth=0 > .tmp/dependency-maintenance/outdated.json
 
 Use `outdated.json` for Steps 2-4, then delete it before returning. Exit 0 or 1 is valid only when the file contains valid JSON; otherwise return `BLOCKED`. Let npm use the existing registry/auth configuration and never read or print its credentials. Only direct declarations in `dependencies`, `devDependencies`, `optionalDependencies`, and `peerDependencies` are eligible.
 
-Before changing each package, show a one-row table with its package name, current version, declared range, and target version. Then use `AskUserQuestion` with **Update package** and **Skip package** choices; make **Skip package** the recommended default. Only an explicit **Update package** response authorizes that package's mutation. Invoking this skill or a parent skill is not approval. Validate an approved update before presenting the next package. Record skipped packages and continue in order. If the user cancels, delete `outdated.json`, stop without further package changes, and return `DONE` as the literal first line followed by `Dependency updates canceled by user.` If there are no eligible updates, continue without asking.
+For Steps 3 and 4, before changing each package, show a one-row table with its package name, current version, declared range, and target version. Then use `AskUserQuestion` with **Update package** and **Skip package** choices; make **Skip package** the recommended default. Only an explicit **Update package** response authorizes that package's mutation. Invoking this skill or a parent skill is not approval. Validate an approved update before presenting the next package. Record skipped packages and continue in order. If the user cancels, delete `outdated.json`, stop without further package changes, and return `DONE` as the literal first line followed by `Dependency updates canceled by user.` If there are no eligible updates, continue without asking.
 
-## Step 2: Update The Native Host
+## Step 2: Update The Native Host And Template
 
-From the saved outdated data, offer `@microsoft/power-apps-native-host` when a newer stable version exists and it is in scope. Update only that package, preserve its dependency section and exact/`^`/`~` style, then run the validation below. Do not run `upgrade-template`.
+Use the `@microsoft/power-apps-native-host` entry in `outdated.json` as the gate. If it is outside the requested scope, not a direct dependency, or has no newer version, continue to Step 3 without running template checks.
+
+When a newer host is available:
+
+1. Read `current` from `expo.extra.powerappsNative.templateVersion` in `<working_dir>/app.json` and `supported` from the same field in `${PLUGIN_ROOT}/template/app.json`. Return `BLOCKED` if `current` is missing, `current > supported`, or `.powerapps-native/upgrade-journal.json` exists.
+2. Resolve one exact `<latestHost>` with `npm view @microsoft/power-apps-native-host@latest version --json`. Do not guess after a lookup or authentication failure.
+3. Preview the host and template update together:
+
+	```bash
+	npx --yes --package @microsoft/power-apps-native-host@<latestHost> upgrade-template --dry-run
+	```
+
+Show the host and template version changes, affected files, warnings, and conflicts. A failed preview is `BLOCKED`. If it reports no changes, continue to Step 3. If it reports changes at or beyond `supported`, return `BLOCKED` and recommend updating the plugin.
+
+For a conflict-free preview below `supported`, ask once with **Update host and template** and **Skip host and template**; recommend **Skip host and template**. Approval covers the sequential migrations shown by the preview. A skip continues to Step 3.
+
+For previewed conflicts, capture the affected files and their existing diffs before asking for the same approval. If approved, run the pinned upgrade once to create its `.rej` files, read `CUSTOMIZATION.md`, and merge only conflicts where the migration and existing customization clearly coexist. Preserve customization markers and ask the user about ambiguous choices. Rerun the dry-run once; if conflicts remain, restore only this skill's merge edits, preserve prior work and rejects, and return `BLOCKED`.
+
+After approval and a clean preview, run:
+
+```bash
+npx --yes --package @microsoft/power-apps-native-host@<latestHost> upgrade-template
+```
+
+After each successful migration, require the template version to advance without exceeding `supported`, require no active journal or unresolved reject, and rerun the pinned dry-run. Apply the next migration under the existing approval while changes remain below `supported`. Stop when no changes remain; if changes remain at `supported`, return `BLOCKED` and recommend updating the plugin.
+
+Do not install the host separately, edit migration state or lockfiles manually, or use the package rollback below for host-managed files. On failure, surface the host error or journal and preserve pre-existing work.
+
+After a successful host update, refresh `outdated.json` before Step 3:
+
+```bash
+npm outdated --json --depth=0 > .tmp/dependency-maintenance/outdated.json
+```
+
+Accept exit 0 or 1 only when the refreshed file contains valid JSON; otherwise return `BLOCKED`.
 
 ## Step 3: Update Other Microsoft Packages
 
@@ -53,7 +87,7 @@ Offer each other outdated direct `@microsoft/*` package separately, preserving i
 
 Offer each other outdated direct registry package separately, including packages bundled by the template. Preserve its dependency section and version style. Skip non-registry declarations such as file, git, workspace, URL, alias, or tag specs and record them as unmanaged. If an updated package has an exact-version row in `native-app-plan.md` under `### JavaScript Dependencies`, update that row to the same version.
 
-For each approved package update:
+For each approved package update in Steps 3 and 4:
 
 1. Snapshot `package.json`, existing npm lockfiles, and `native-app-plan.md` when that package will change it under `.tmp/dependency-maintenance/`.
 2. Install with `--ignore-scripts`; use `--package-lock=false` when the project had no npm lockfile.