# GHOST Local Patch System

Starting with GHOST 3.3.0, future changes can be delivered as a small `.ghostupdate` file instead of reinstalling the full extension.

## User flow

1. Open **GHOST CACHE** or **GHOST COMMAND**.
2. Click the **Update** button.
3. Choose an official `.ghostupdate` file.
4. Review the source version, target version and changed-file count.
5. Click **Apply Selected Update**.
6. Close After Effects. The updater creates a full backup and applies the patch.
7. Restart After Effects.

A rollback button restores the most recent patch backup after After Effects closes.

## Package rules

A `.ghostupdate` file is a ZIP container with:

- `ghost-update.json`
- `payload/` containing only added or replaced files

The manifest uses schema `ghost.patch.v1` and declarative `add`, `replace`, and `delete` operations. Every payload file requires a SHA-256 hash. Absolute paths and `..` traversal are rejected. No PowerShell or arbitrary installer command is executed from the package.

## Creating a patch

```powershell
powershell -ExecutionPolicy Bypass -File .\developer\Create-GhostPatch.ps1 `
  -BaseRoot "C:\Builds\GHOST-3.3.0\GHOST Creative System" `
  -NewRoot "C:\Builds\GHOST-3.3.1\GHOST Creative System" `
  -FromVersion "3.3.0" `
  -ToVersion "3.3.1" `
  -OutputPath "C:\Releases\GHOST_3.3.1.ghostupdate" `
  -Title "Live Layer Control" `
  -Notes "Adds live selected-layer targeting and property controls."
```

The new build must already contain the new version in `CSXS/manifest.xml`; otherwise installation is rejected.

## Security

A patch can replace JavaScript and JSX, so it is executable software. Users must apply only official GHOST patches. The current local system validates product ID, compatible version, safe paths and SHA-256 payload integrity. Public commercial distribution should additionally sign patch manifests with a publisher private key and verify them with a bundled public key.
