@ainova-systems/intelligence 0.11.0-rc.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025-2026 Ainova Systems (Dmitrij Zykovic)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,46 @@
+# @ainova-systems/intelligence
+
+**npm for AI agent intelligence.** One CLI that builds, versions and distributes the rules, agents and skills your AI coding tools run on — rendered natively for Claude Code, Cursor, GitHub Copilot, OpenAI Codex, Pi, OpenCode and `AGENTS.md`.
+
+```bash
+npm install -g @ainova-systems/intelligence
+
+cd your-project
+intelligence init
+intelligence add @ainova-systems/core
+intelligence sync
+```
+
+That's the whole setup. Your project gets:
+
+```
+intelligence.yaml      # manifest — what the project consumes, where it goes
+intelligence.lock      # resolved versions (commit it)
+intelligence/          # your own rules / agents / skills
+.intelligence/         # installed packages + engine content (gitignored)
+.claude/ .cursor/ …    # generated per-tool output
+AGENTS.md
+```
+
+Teammates need one command after cloning:
+
+```bash
+intelligence install
+```
+
+## Commands
+
+| Command | What it does |
+|---|---|
+| `intelligence init` | Detect your tools, write the manifest, first sync |
+| `intelligence add <pkg>` | `@scope/name[@range]`, `github:org/repo[#path]`, or `git+<url>[@ref][#path]` |
+| `intelligence install [--frozen]` | Restore `.intelligence/` exactly from the lockfile |
+| `intelligence update [pkg]` | Re-resolve version ranges, rewrite the lock |
+| `intelligence sync [target]` | Render intelligence to every enabled tool |
+| `intelligence list` / `doctor` / `status` | Inspect and verify |
+| `intelligence registry add @scope <url>` | Bind a scope to a private registry index |
+| `intelligence migrate` | Convert a vendored intelligence-sync setup to the CLI |
+
+Any git repo with `rules/`, `agents/` or `skills/` at its root is already an Intelligence Package: `intelligence add @your-org/your-repo` resolves it straight from GitHub — versions come from its `x.y.z` git tags. A monorepo of packages needs one line in a registry index.
+
+Requires `git` (and on Windows the bash it ships with — Git for Windows). Engine and docs: [ainova-systems/intelligence-sync](https://github.com/ainova-systems/intelligence-sync).

package/bin/intelligence.js

@@ -0,0 +1,59 @@
+#!/usr/bin/env node
+'use strict';
+// Thin launcher for the intelligence CLI. All logic lives in bash (cli/ and
+// engine/ inside this package); this shim only finds a usable bash and execs
+// the dispatcher with stdio passed through. It never rewrites paths — Git
+// Bash accepts forward-slash Windows paths, and the engine re-normalizes.
+
+const { spawnSync, execSync } = require('child_process');
+const path = require('path');
+const fs = require('fs');
+
+function isWslStub(p) {
+  // System32\bash.exe is the WSL launcher: a Linux userland that cannot see
+  // this package's files the way Git Bash can. Never pick it.
+  return /system32[\\/]+bash\.exe$/i.test(p);
+}
+
+function findBash() {
+  const override = process.env.INTELLIGENCE_BASH;
+  if (override && fs.existsSync(override)) return override;
+  if (process.platform !== 'win32') return 'bash';
+
+  const candidates = [];
+  try {
+    const git = execSync('where git', { encoding: 'utf8' }).split(/\r?\n/)[0].trim();
+    if (git) {
+      // <git-root>\cmd\git.exe (or \bin\git.exe) → <git-root>\bin\bash.exe
+      candidates.push(path.join(path.dirname(git), '..', 'bin', 'bash.exe'));
+      candidates.push(path.join(path.dirname(git), '..', 'usr', 'bin', 'bash.exe'));
+    }
+  } catch (_) { /* git not on PATH — fall through to the fixed locations */ }
+  candidates.push(
+    'C:\\Program Files\\Git\\bin\\bash.exe',
+    'C:\\Program Files (x86)\\Git\\bin\\bash.exe'
+  );
+  for (const c of candidates) {
+    if (!isWslStub(c) && fs.existsSync(c)) return c;
+  }
+  try {
+    const found = execSync('where bash', { encoding: 'utf8' })
+      .split(/\r?\n/).map((s) => s.trim()).filter((s) => s && !isWslStub(s));
+    if (found.length > 0) return found[0];
+  } catch (_) { /* no bash anywhere */ }
+  console.error('intelligence: bash not found. Install Git for Windows (https://git-scm.com) — its bash is all this CLI needs.');
+  process.exit(1);
+}
+
+const cli = path.join(__dirname, '..', 'cli', 'intelligence').replace(/\\/g, '/');
+const pkg = require(path.join(__dirname, '..', 'package.json'));
+
+const result = spawnSync(findBash(), [cli].concat(process.argv.slice(2)), {
+  stdio: 'inherit',
+  env: Object.assign({}, process.env, { INTELLIGENCE_NPM_VERSION: pkg.version }),
+});
+if (result.error) {
+  console.error('intelligence: failed to launch bash: ' + result.error.message);
+  process.exit(1);
+}
+process.exit(result.status === null ? 1 : result.status);

package/cli/commands/add.sh

@@ -0,0 +1,133 @@
+#!/bin/bash
+# intelligence add <spec> [--name @scope/name] [--no-sync]
+#
+# Specs:
+#   @scope/name[@range]            resolved via registries / index / convention
+#   github:org/repo[#path]         direct from GitHub, no registry involved
+#   git+<url>[@ref][#path]         direct from any git host
+set -euo pipefail
+source "$CLI_DIR/lib/cli-common.sh"
+
+spec="${1:-}"
+[ -n "$spec" ] || die "usage: intelligence add <@scope/name[@range] | github:org/repo[#path] | git+<url>[@ref][#path]>"
+shift || true
+
+no_sync=0
+name_override=""
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --no-sync) no_sync=1 ;;
+        --name) shift; name_override="${1:-}" ;;
+        *) die "unknown option '$1'" ;;
+    esac
+    shift || true
+done
+
+require_v2
+manifest="$IP_ROOT/intelligence.yaml"
+lock="$IP_ROOT/intelligence.lock"
+
+name="" range="" url="" path="" ref="" mode=""
+case "$spec" in
+    github:*)
+        mode="direct"
+        rest="${spec#github:}"
+        case "$rest" in *#*) path="${rest#*#}"; rest="${rest%%#*}" ;; esac
+        org="${rest%%/*}"; repo="${rest#*/}"
+        { [ -n "$org" ] && [ -n "$repo" ] && [ "$repo" != "$rest" ]; } || die "bad spec '$spec' — expected github:org/repo[#path]"
+        name="@$org/$repo"
+        url="https://github.com/$org/$repo.git"
+        ;;
+    git+*)
+        mode="direct"
+        rest="${spec#git+}"
+        case "$rest" in *#*) path="${rest#*#}"; rest="${rest%%#*}" ;; esac
+        # ref = the part after the last `@` in the post-scheme URL, unless it
+        # contains `/` (then it is a user@host, not a ref) — the engine's own
+        # git+ grammar.
+        base="${rest#*://}"
+        case "$base" in
+            *@*)
+                tail="${base##*@}"
+                case "$tail" in
+                    */*) ;;
+                    *) ref="$tail"; rest="${rest%@"$tail"}" ;;
+                esac
+                ;;
+        esac
+        url="$rest"
+        repo="$(basename "${url%.git}")"
+        org="$(basename "$(dirname "${url%.git}")")"
+        name="@${org:-direct}/$repo"
+        ;;
+    @*)
+        mode="registry"
+        body="${spec#@}"
+        case "$body" in
+            *@*) range="${body##*@}"; body="${body%@"$range"}" ;;
+        esac
+        name="@$body"
+        ;;
+    *)
+        die "unrecognized spec '$spec' — expected @scope/name, github:…, or git+…"
+        ;;
+esac
+[ -n "$name_override" ] && name="$name_override"
+assert_valid_pkg_name "$name"
+
+if [ "$mode" = "registry" ]; then
+    resolve_package_source "$manifest" "$name"
+    url="$RES_URL"; path="$RES_PATH"
+    echo "  resolving $name via $RES_VIA -> $url${path:+ ($path)}"
+fi
+
+# Pick the version: an explicit ref pins; otherwise the highest stable tag
+# matching the range (npm's behaviour, `^highest` becoming the requested range
+# when none was given).
+resolved_tag="" requested="$range"
+if [ -z "$ref" ]; then
+    picked="$(list_remote_versions "$url" | semver_pick_highest "$range")"
+    if [ -n "$picked" ]; then
+        read -r resolved_tag _ <<< "$(remote_tag_for_version "$url" "$picked")"
+        [ -n "$requested" ] || requested="^$picked"
+    else
+        if [ -n "$range" ]; then
+            die "no tag of $url satisfies '$range' (stable x.y.z tags only)"
+        fi
+        if [ "$mode" = "registry" ]; then
+            die "'$name' has no stable version tags at $url — a registry package must be versioned; use github:/git+ with @<ref> to pin a branch or commit"
+        fi
+        echo "  NOTE: no version tags at $url — pinning the default branch head" >&2
+    fi
+fi
+
+rel=".intelligence/packages/$name"
+sha="$(fetch_package "$url" "${ref:-$resolved_tag}" "$path" "$IP_ROOT/$rel")"
+
+wire_package_sources "$manifest" "$name" "$rel" "$IP_ROOT"
+
+# Manifest entry: a registry package records its range; a direct one records
+# its source so resolution never has to guess it again.
+if [ "$mode" = "registry" ]; then
+    qmap_set "$manifest" "packages" "$name" "version" "$requested"
+else
+    qmap_set "$manifest" "packages" "$name" "url" "$url"
+    [ -n "$path" ] && qmap_set "$manifest" "packages" "$name" "path" "$path"
+    if [ -n "$ref" ]; then
+        qmap_set "$manifest" "packages" "$name" "ref" "$ref"
+    elif [ -n "$requested" ]; then
+        qmap_set "$manifest" "packages" "$name" "version" "$requested"
+    fi
+fi
+
+lock_upsert "$lock" "$name" "$requested" "$url" "$path" "${ref:-$resolved_tag}" "$sha"
+
+sections=""
+for s in rules agents skills; do
+    [ -d "$IP_ROOT/$rel/$s" ] && sections="$sections $s"
+done
+echo "+ $name@${resolved_tag:-${ref:-HEAD}} (${sections# })"
+
+if [ "$no_sync" -eq 0 ]; then
+    exec bash "$CLI_DIR/commands/sync.sh"
+fi

package/cli/commands/doctor.sh

@@ -0,0 +1,100 @@
+#!/bin/bash
+# intelligence doctor — consistency checks, no writes. Exit 1 on problems.
+set -euo pipefail
+source "$CLI_DIR/lib/cli-common.sh"
+
+problems=0
+warn() { echo "  ✗ $*"; problems=$((problems + 1)); }
+ok()   { echo "  ✓ $*"; }
+
+echo "environment:"
+command -v git >/dev/null 2>&1 && ok "git $(git --version | awk '{print $3}')" || warn "git not found"
+command -v awk >/dev/null 2>&1 && ok "awk present" || warn "awk not found"
+ok "bash $BASH_VERSION"
+ok "engine $(bundled_engine_version) at $IS_ENGINE_DIR"
+
+detect_project
+case "$IP_MODE" in
+    none)
+        echo "project: none here — 'intelligence init' starts one"
+        exit 0
+        ;;
+    legacy)
+        echo "project: vendored (v1) at $IP_ROOT"
+        ok "vendored engine $(tr -d ' \t\r\n' < "$IP_MODULE_DIR/scripts/VERSION")"
+        echo "  → 'intelligence migrate' converts it to the CLI setup"
+        exit 0
+        ;;
+esac
+
+echo "project: $IP_ROOT"
+manifest="$IP_ROOT/intelligence.yaml"
+lock="$IP_ROOT/intelligence.lock"
+
+stamp="$(read_engine_stamp "$manifest")"
+eng="$(bundled_engine_version)"
+if [ -z "$stamp" ]; then
+    warn "manifest has no sync_version — run 'intelligence upgrade'"
+elif _ver_gt "$stamp" "$eng"; then
+    warn "manifest schema $stamp is newer than this CLI's engine $eng — update the CLI: npm i -g @ainova-systems/intelligence@latest"
+elif _ver_gt "$eng" "$stamp"; then
+    warn "manifest schema $stamp behind engine $eng — run 'intelligence upgrade'"
+else
+    ok "sync_version $stamp matches the engine"
+fi
+
+if [ -f "$IP_ROOT/.intelligence/engine/.version" ]; then
+    staged="$(tr -d ' \t\r\n' < "$IP_ROOT/.intelligence/engine/.version")"
+    [ "$staged" = "$eng" ] && ok "engine content staged ($staged)" || warn "staged engine content is $staged, bundled is $eng — run 'intelligence install'"
+else
+    warn "engine content not staged — run 'intelligence install'"
+fi
+
+# Manifest packages: names valid, locked, installed.
+while IFS= read -r name; do
+    [ -n "$name" ] || continue
+    assert_valid_pkg_name "$name"
+    if [ -z "$(qmap_field "$lock" "packages" "$name" "url")" ]; then
+        warn "$name is in the manifest but not in intelligence.lock — run 'intelligence install'"
+    elif [ ! -d "$IP_ROOT/.intelligence/packages/$name" ]; then
+        warn "$name is locked but not installed — run 'intelligence install'"
+    else
+        ok "$name @ $(qmap_field "$lock" "packages" "$name" "resolved")"
+    fi
+done < <(qmap_keys "$manifest" "packages")
+
+# Lock orphans.
+if [ -f "$lock" ]; then
+    while IFS= read -r name; do
+        [ -n "$name" ] || continue
+        found=0
+        while IFS= read -r m; do
+            [ "$m" = "$name" ] && found=1
+        done < <(qmap_keys "$manifest" "packages")
+        [ "$found" -eq 1 ] || warn "$name is locked but absent from the manifest — 'intelligence remove $name' cleans it up"
+    done < <(qmap_keys "$lock" "packages")
+fi
+
+# Sources must exist (a missing dir is silently skipped by the engine, which
+# is exactly why doctor names it).
+for section in rules agents skills; do
+    while IFS= read -r src; do
+        [ -n "$src" ] || continue
+        case "$src" in
+            git+*|@*) continue ;;
+        esac
+        if [ ! -d "$IP_ROOT/$src" ]; then
+            case "$src" in
+                .intelligence/*) warn "sources.$section '$src' missing — run 'intelligence install'" ;;
+                *) warn "sources.$section '$src' does not exist" ;;
+            esac
+        fi
+    done < <(read_yaml_list "$manifest" "$section")
+done
+
+if [ "$problems" -eq 0 ]; then
+    echo "all good."
+else
+    echo "$problems problem(s)."
+    exit 1
+fi

package/cli/commands/init.sh

@@ -0,0 +1,96 @@
+#!/bin/bash
+# intelligence init [--targets a,b,c] [--no-sync]
+#
+# Set up a project: root manifest, content skeleton, .gitignore, staged
+# engine content, first sync. Targets are detected from IDE markers unless
+# named explicitly; `agents` and `claude` are always on (AGENTS.md is the
+# canonical carrier of always-on rules, Claude Code does not read it).
+set -euo pipefail
+source "$CLI_DIR/lib/cli-common.sh"
+
+targets_arg="" no_sync=0
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --targets) shift; targets_arg="${1:-}" ;;
+        --no-sync) no_sync=1 ;;
+        *) die "unknown option '$1'" ;;
+    esac
+    shift || true
+done
+
+detect_project
+case "$IP_MODE" in
+    v2) die "already set up — manifest at $IP_ROOT/intelligence.yaml (use 'intelligence status')" ;;
+    legacy) die "this is a vendored (v1) setup at $IP_UMBRELLA — run 'intelligence migrate' instead" ;;
+esac
+
+root="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+root="$(cd "$root" && pwd)"
+
+targets="agents claude"
+if [ -n "$targets_arg" ]; then
+    targets="agents $(printf '%s' "$targets_arg" | tr ',' ' ')"
+else
+    [ -d "$root/.cursor" ] && targets="$targets cursor"
+    [ -d "$root/.codex" ] && targets="$targets codex"
+    [ -d "$root/.pi" ] && targets="$targets pi"
+    [ -d "$root/.opencode" ] && targets="$targets opencode"
+    [ -d "$root/.github" ] && [ -d "$root/.github/instructions" ] && targets="$targets copilot"
+fi
+
+manifest="$root/intelligence.yaml"
+{
+    echo "# Intelligence manifest — what this project's AI tooling knows and where it goes."
+    echo "# Managed by the intelligence CLI (https://github.com/ainova-systems/intelligence-sync)."
+    echo "project:"
+    echo "  name: \"$(basename "$root")\""
+    echo ""
+    echo "sync_version: \"$(bundled_engine_version)\""
+    echo ""
+    echo "sources:"
+    echo "  rules:"
+    echo "    - \"intelligence/rules\""
+    echo "    - \".intelligence/engine/rules\""
+    echo "  agents:"
+    echo "    - \"intelligence/agents\""
+    echo "    - \".intelligence/engine/agents\""
+    echo "  skills:"
+    echo "    - \"intelligence/skills\""
+    echo "    - \".intelligence/engine/skills\""
+    echo ""
+    echo "targets:"
+    for t in $targets; do
+        case "$t" in
+            agents) echo "  agents: { enabled: true, output: \"AGENTS.md\" }" ;;
+            *) echo "  $t: { enabled: true, output: \".$t\" }" ;;
+        esac
+    done
+} > "$manifest"
+
+mkdir -p "$root/intelligence/rules" "$root/intelligence/agents" "$root/intelligence/skills"
+if [ ! -f "$root/intelligence/rules/context.md" ]; then
+    cat > "$root/intelligence/rules/context.md" <<EOF
+# Project Context
+
+<!-- Always-on context every AI tool receives. Describe what this project is,
+     its stack, and the constraints an agent must respect. -->
+EOF
+fi
+
+# The package store is restorable state, never committed — the npm model.
+if [ ! -f "$root/.gitignore" ] || ! grep -q '^\.intelligence/' "$root/.gitignore"; then
+    {
+        [ -f "$root/.gitignore" ] && [ -n "$(tail -c 1 "$root/.gitignore" 2>/dev/null)" ] && echo ""
+        echo "# intelligence CLI package store (restored by 'intelligence install')"
+        echo ".intelligence/"
+    } >> "$root/.gitignore"
+fi
+
+ensure_engine_staged "$root"
+echo "initialized: intelligence.yaml (targets:$(printf ' %s' $targets))"
+echo "next: add intelligence packages — e.g. 'intelligence add @ainova-systems/core'"
+
+if [ "$no_sync" -eq 0 ]; then
+    cd "$root"
+    exec bash "$CLI_DIR/commands/sync.sh"
+fi

package/cli/commands/install.sh

@@ -0,0 +1,84 @@
+#!/bin/bash
+# intelligence install [--frozen] [--force] [--no-sync]
+#
+# Restore .intelligence/ from intelligence.lock — the fresh-clone command.
+# --frozen additionally refuses any manifest/lock divergence (CI mode) and
+# fails on a sha mismatch instead of re-resolving.
+set -euo pipefail
+source "$CLI_DIR/lib/cli-common.sh"
+
+frozen=0 force=0 no_sync=0
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --frozen) frozen=1 ;;
+        --force) force=1 ;;
+        --no-sync) no_sync=1 ;;
+        *) die "unknown option '$1'" ;;
+    esac
+    shift || true
+done
+
+require_v2
+manifest="$IP_ROOT/intelligence.yaml"
+lock="$IP_ROOT/intelligence.lock"
+
+ensure_engine_staged "$IP_ROOT"
+
+# Manifest packages missing from the lock: resolve them now (npm install
+# semantics). Under --frozen that is an error instead.
+missing=""
+while IFS= read -r name; do
+    [ -n "$name" ] || continue
+    if [ ! -f "$lock" ] || [ -z "$(qmap_field "$lock" "packages" "$name" "url")" ]; then
+        missing="$missing $name"
+    fi
+done < <(qmap_keys "$manifest" "packages")
+if [ -n "$missing" ]; then
+    [ "$frozen" -eq 1 ] && die "lockfile is missing packages:$missing — run 'intelligence install' without --frozen"
+    for name in $missing; do
+        url="$(qmap_field "$manifest" "packages" "$name" "url")"
+        path="$(qmap_field "$manifest" "packages" "$name" "path")"
+        ref="$(qmap_field "$manifest" "packages" "$name" "ref")"
+        range="$(qmap_field "$manifest" "packages" "$name" "version")"
+        if [ -z "$url" ]; then
+            resolve_package_source "$manifest" "$name"
+            url="$RES_URL"; path="$RES_PATH"
+        fi
+        resolved_tag=""
+        if [ -z "$ref" ]; then
+            picked="$(list_remote_versions "$url" | semver_pick_highest "$range")"
+            [ -n "$picked" ] || die "no tag of $url satisfies '${range:-*}' for $name"
+            read -r resolved_tag _ <<< "$(remote_tag_for_version "$url" "$picked")"
+        fi
+        rel=".intelligence/packages/$name"
+        sha="$(fetch_package "$url" "${ref:-$resolved_tag}" "$path" "$IP_ROOT/$rel")"
+        wire_package_sources "$manifest" "$name" "$rel" "$IP_ROOT"
+        lock_upsert "$lock" "$name" "$range" "$url" "$path" "${ref:-$resolved_tag}" "$sha"
+        echo "+ $name@${resolved_tag:-${ref:-HEAD}} (resolved)"
+    done
+fi
+
+# Restore every locked package that is not already in the store.
+if [ -f "$lock" ]; then
+    while IFS="$LOCK_SEP" read -r name requested url path resolved sha; do
+        [ -n "$name" ] || continue
+        rel=".intelligence/packages/$name"
+        if [ -d "$IP_ROOT/$rel" ] && [ "$force" -eq 0 ]; then
+            continue
+        fi
+        got="$(fetch_package "$url" "$resolved" "$path" "$IP_ROOT/$rel")"
+        if [ -n "$sha" ] && [ "$got" != "$sha" ]; then
+            if [ "$frozen" -eq 1 ]; then
+                die "$name: fetched $got but the lock pins $sha — the ref moved; refusing under --frozen"
+            fi
+            echo "  WARN: $name resolved to $got, lock had $sha — updating the lock" >&2
+            lock_upsert "$lock" "$name" "$requested" "$url" "$path" "$resolved" "$got"
+        fi
+        wire_package_sources "$manifest" "$name" "$rel" "$IP_ROOT"
+        echo "= $name@${resolved:-HEAD}"
+    done < <(lock_to_tsv "$lock")
+fi
+
+if [ "$no_sync" -eq 0 ]; then
+    exec bash "$CLI_DIR/commands/sync.sh"
+fi

package/cli/commands/list.sh

@@ -0,0 +1,28 @@
+#!/bin/bash
+# intelligence list — packages with requested / locked / installed state.
+set -euo pipefail
+source "$CLI_DIR/lib/cli-common.sh"
+
+require_v2
+manifest="$IP_ROOT/intelligence.yaml"
+lock="$IP_ROOT/intelligence.lock"
+
+count=0
+while IFS= read -r name; do
+    [ -n "$name" ] || continue
+    count=$((count + 1))
+    range="$(qmap_field "$manifest" "packages" "$name" "version")"
+    ref="$(qmap_field "$manifest" "packages" "$name" "ref")"
+    resolved="$(qmap_field "$lock" "packages" "$name" "resolved")"
+    state="missing — run 'intelligence install'"
+    [ -d "$IP_ROOT/.intelligence/packages/$name" ] && state="installed"
+    printf '%s  %s  locked:%s  %s\n' \
+        "$name" \
+        "${ref:+ref:$ref}${ref:-${range:-*}}" \
+        "${resolved:-<none>}" \
+        "$state"
+done < <(qmap_keys "$manifest" "packages")
+
+if [ "$count" -eq 0 ]; then
+    echo "No packages. Add one: intelligence add @ainova-systems/core"
+fi