@ainova-systems/intelligence 0.11.0-rc.5 → 0.11.0-rc.7

package/README.md

@@ -38,9 +38,9 @@ intelligence install
 | `intelligence update [pkg]` | Re-resolve version ranges, rewrite the lock |
 | `intelligence sync [target]` | Render intelligence to every enabled tool |
 | `intelligence list` / `doctor` / `status` | Inspect and verify |
-| `intelligence registry add @scope <url>` | Bind a scope to a private registry index |
+| `intelligence registry add <repo-url>` | Trust a registry (a git repo with an `index.yaml`) |
 | `intelligence migrate` | Convert a vendored intelligence-sync setup to the CLI |
 
-Any git repo with `rules/`, `agents/` or `skills/` at its root is already an Intelligence Package: `intelligence add @your-org/your-repo` resolves it straight from GitHub — versions come from its `x.y.z` git tags. A monorepo of packages needs one line in a registry index.
+Any git repo with `rules/`, `agents/` or `skills/` at its root is already an Intelligence Package: install it from an explicit source — `intelligence add github:your-org/your-repo` — with versions from its `x.y.z` git tags. Names (`@scope/name`) resolve only through registries this project explicitly trusts; a monorepo of packages needs one line in such an index.
 
 Requires `git` (and on Windows the bash it ships with — Git for Windows). Engine and docs: [ainova-systems/intelligence-sync](https://github.com/ainova-systems/intelligence-sync).

package/cli/commands/add.sh

@@ -2,9 +2,9 @@
 # intelligence add <spec> [--name @scope/name] [--no-sync]
 #
 # Specs:
-#   @scope/name[@range]            resolved via registries / index / convention
-#   github:org/repo[#path]         direct from GitHub, no registry involved
-#   git+<url>[@ref][#path]         direct from any git host
+#   @scope/name[@range]            resolved ONLY through the manifest's trusted registries
+#   github:org/repo[#path]         explicit source: direct from GitHub, no registry involved
+#   git+<url>[@ref][#path]         explicit source: direct from any git host
 set -euo pipefail
 source "$CLI_DIR/lib/cli-common.sh"
 
@@ -43,14 +43,15 @@ case "$spec" in
         rest="${spec#git+}"
         case "$rest" in *#*) path="${rest#*#}"; rest="${rest%%#*}" ;; esac
         # ref = the part after the last `@` in the post-scheme URL, unless it
-        # contains `/` (then it is a user@host, not a ref) — the engine's own
-        # git+ grammar.
+        # contains `/` or `:` — either marks a user@host part (scp-like
+        # `git@host:repo.git` included), not a ref. A branch name containing
+        # `/` cannot be expressed here; pin it via `ref:` in the manifest.
         base="${rest#*://}"
         case "$base" in
             *@*)
                 tail="${base##*@}"
                 case "$tail" in
-                    */*) ;;
+                    */*|*:*) ;;
                     *) ref="$tail"; rest="${rest%@"$tail"}" ;;
                 esac
                 ;;
@@ -78,23 +79,24 @@ assert_valid_pkg_name "$name"
 if [ "$mode" = "registry" ]; then
     resolve_package_source "$manifest" "$name"
     url="$RES_URL"; path="$RES_PATH"
+    if [ -z "$url" ]; then
+        echo "ERROR: no trusted registry declares '$name'." >&2
+        echo "  A name installs only through a registry this project added explicitly" >&2
+        echo "  ('intelligence registry list' shows them). Either add its registry:" >&2
+        echo "    intelligence registry add <registry-repo-url>" >&2
+        echo "  or install from an explicit source you name yourself:" >&2
+        echo "    intelligence add github:org/repo   |   intelligence add git+<url>[@ref][#path]" >&2
+        suggest_similar "$manifest" "$name"
+        exit 1
+    fi
     echo "  resolving $name via $RES_VIA -> $url${path:+ ($path)}"
 fi
 
-# The source must exist before anything else is attempted — a name that fell
-# through to the convention is often just a typo, and that must say so, not
-# die mid-pipeline with no message.
-if ! GIT_TERMINAL_PROMPT=0 git ls-remote "$url" >/dev/null 2>&1; then
+# The source must exist before anything else is attempted — never die
+# mid-pipeline with no message.
+if ! GIT_TERMINAL_PROMPT=0 git ls-remote -- "$url" >/dev/null 2>&1; then
     echo "ERROR: no reachable repository at $url" >&2
-    if [ "${RES_VIA:-}" = "convention" ]; then
-        echo "  No registry declares '$name', so it resolved by convention to github.com/${name#@}." >&2
-        echo "  Either the name is misspelled ('intelligence search' lists what registries offer)," >&2
-        echo "  the repo is private (check your git credentials), or its registry is not added yet:" >&2
-        echo "    intelligence registry add <registry-repo-url>" >&2
-        suggest_similar "$manifest" "$name"
-    else
-        echo "  Declared by ${RES_VIA:-the manifest} — check the URL and your git access." >&2
-    fi
+    echo "  Declared by ${RES_VIA:-the spec} — check the URL and your git access." >&2
     exit 1
 fi
 
@@ -124,7 +126,11 @@ sha="$(fetch_package "$url" "${ref:-$resolved_tag}" "$path" "$IP_ROOT/$rel")"
 wire_package_sources "$manifest" "$name" "$rel" "$IP_ROOT"
 
 # Manifest entry: a registry package records its range; a direct one records
-# its source so resolution never has to guess it again.
+# its source so resolution never has to guess it again. The entry is replaced
+# WHOLE — re-adding under a different spec must not leave the old spec's
+# fields behind (a stale ref: would freeze update, a stale url: would pin the
+# old source).
+qmap_delete_key "$manifest" "packages" "$name"
 if [ "$mode" = "registry" ]; then
     qmap_set "$manifest" "packages" "$name" "version" "$requested"
 else

package/cli/commands/init.sh

@@ -33,15 +33,24 @@ esac
 root="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
 root="$(cd "$root" && pwd)"
 
-targets="agents claude"
+# Never invent a tool the project shows no trace of: every per-tool target is
+# DETECTED from repo markers or named explicitly via --targets. Only `agents`
+# (AGENTS.md, the tool-neutral standard every AGENTS-reading tool shares, and
+# the invariant-required carrier once any of them is on) is unconditional.
+targets="agents"
 if [ -n "$targets_arg" ]; then
     targets="agents $(printf '%s' "$targets_arg" | tr ',' ' ')"
 else
+    if [ -d "$root/.claude" ] || [ -f "$root/CLAUDE.md" ]; then targets="$targets claude"; fi
     [ -d "$root/.cursor" ] && targets="$targets cursor"
     [ -d "$root/.codex" ] && targets="$targets codex"
     [ -d "$root/.pi" ] && targets="$targets pi"
     [ -d "$root/.opencode" ] && targets="$targets opencode"
     [ -d "$root/.github" ] && [ -d "$root/.github/instructions" ] && targets="$targets copilot"
+    if [ "$targets" = "agents" ]; then
+        echo "  NOTE: no tool markers found (.claude/, CLAUDE.md, .cursor/, …) — only AGENTS.md is enabled." >&2
+        echo "        Name your tools explicitly: intelligence init --targets claude,cursor  (or edit targets: later)" >&2
+    fi
 fi
 
 manifest="$root/intelligence.yaml"
@@ -88,14 +97,20 @@ manifest="$root/intelligence.yaml"
     echo "#   \"@ainova-systems/core\":"
     echo "#     version: \"^0.3.0\""
     echo ""
-    echo "# Registries are a TRUST LIST: git repos holding an index.yaml, consulted"
-    echo "# in order — the first to declare a name wins, then the CLI's bundled index,"
-    echo "# then the @org/name -> github.com/org/name convention. Adding one is a"
-    echo "# committed, reviewable act of trust in the names it declares; sources are"
-    echo "# pinned by url+sha in intelligence.lock, and overriding a bundled name"
-    echo "# warns loudly. Managed with 'intelligence registry add|remove'."
-    echo "# registries:"
-    echo "#   - \"https://github.com/acme/intelligence-registry.git\""
+    echo "# Registries are this project's TRUST LIST — the ONLY way a package name"
+    echo "# resolves (there is no built-in catalog and no name->github guessing;"
+    echo "# registry-less installs are always explicit: github:org/repo, git+<url>)."
+    echo "# Git repos holding an index.yaml, consulted in order; first to declare a"
+    echo "# name wins; sources are then pinned by url+sha in intelligence.lock."
+    echo "# Managed with 'intelligence registry add|remove'. Delete a line to"
+    echo "# distrust that catalog — including the default seeded below."
+    if [ "$bare" -eq 1 ] || [ -z "$DEFAULT_REGISTRY_URL" ]; then
+        echo "# registries:"
+        echo "#   - \"https://github.com/acme/intelligence-registry.git\""
+    else
+        echo "registries:"
+        echo "  - \"$DEFAULT_REGISTRY_URL\""
+    fi
 } > "$manifest"
 
 # The package store is restorable state, never committed — the npm model.

package/cli/commands/install.sh

@@ -22,17 +22,53 @@ require_v2
 manifest="$IP_ROOT/intelligence.yaml"
 lock="$IP_ROOT/intelligence.lock"
 
+# --frozen is the reproducibility contract: the lock must agree with the
+# manifest on the package SET and on every requested-source field before a
+# single byte is restored. Anything less lets a manifest edit ride on a stale
+# lock — the exact drift the flag exists to refuse.
+if [ "$frozen" -eq 1 ]; then
+    while IFS= read -r name; do
+        [ -n "$name" ] || continue
+        [ -n "$(qmap_field "$lock" "packages" "$name" "url")" ] \
+            || die "--frozen: $name is in the manifest but not in intelligence.lock"
+        m_ver="$(qmap_field "$manifest" "packages" "$name" "version")"
+        m_ref="$(qmap_field "$manifest" "packages" "$name" "ref")"
+        m_url="$(qmap_field "$manifest" "packages" "$name" "url")"
+        m_path="$(qmap_field "$manifest" "packages" "$name" "path")"
+        l_req="$(qmap_field "$lock" "packages" "$name" "requested")"
+        l_res="$(qmap_field "$lock" "packages" "$name" "resolved")"
+        l_url="$(qmap_field "$lock" "packages" "$name" "url")"
+        l_path="$(qmap_field "$lock" "packages" "$name" "path")"
+        [ -z "$m_ver" ] || [ "$m_ver" = "$l_req" ] \
+            || die "--frozen: $name requests '$m_ver' but the lock recorded '$l_req' — run 'intelligence install' without --frozen"
+        [ -z "$m_ref" ] || [ "$m_ref" = "$l_res" ] \
+            || die "--frozen: $name pins ref '$m_ref' but the lock resolved '$l_res'"
+        [ -z "$m_url" ] || [ "$m_url" = "$l_url" ] \
+            || die "--frozen: $name declares url '$m_url' but the lock recorded '$l_url'"
+        [ -z "$m_path" ] || [ "$m_path" = "$l_path" ] \
+            || die "--frozen: $name declares path '$m_path' but the lock recorded '$l_path'"
+    done < <(qmap_keys "$manifest" "packages")
+    while IFS= read -r name; do
+        [ -n "$name" ] || continue
+        found=0
+        while IFS= read -r m; do
+            [ "$m" = "$name" ] && found=1
+        done < <(qmap_keys "$manifest" "packages")
+        [ "$found" -eq 1 ] || die "--frozen: $name is locked but absent from the manifest"
+    done < <(qmap_keys "$lock" "packages")
+fi
+
 # Manifest packages missing from the lock: resolve them now (npm install
-# semantics). Under --frozen that is an error instead.
+# semantics). Under --frozen the drift gate above has already refused.
 missing=""
 while IFS= read -r name; do
     [ -n "$name" ] || continue
+    assert_valid_pkg_name "$name"
     if [ ! -f "$lock" ] || [ -z "$(qmap_field "$lock" "packages" "$name" "url")" ]; then
         missing="$missing $name"
     fi
 done < <(qmap_keys "$manifest" "packages")
 if [ -n "$missing" ]; then
-    [ "$frozen" -eq 1 ] && die "lockfile is missing packages:$missing — run 'intelligence install' without --frozen"
     for name in $missing; do
         # The engine-content package needs no remote resolution: its pin IS
         # the bundled engine version and it seeds from the bundle, offline.
@@ -66,20 +102,35 @@ fi
 if [ -f "$lock" ]; then
     while IFS="$LOCK_SEP" read -r name requested url path resolved sha; do
         [ -n "$name" ] || continue
+        # The lock arrives with a cloned repo — its keys are untrusted input
+        # on their way into rm -rf paths, and its urls into git argv.
+        assert_valid_pkg_name "$name"
         rel=".intelligence/packages/$name"
-        if [ -d "$IP_ROOT/$rel" ] && [ "$force" -eq 0 ]; then
+        # --frozen never trusts what is already on disk: a pre-existing
+        # (possibly substituted) store dir would otherwise be synced with no
+        # sha verification at all.
+        if [ -d "$IP_ROOT/$rel" ] && [ "$force" -eq 0 ] && [ "$frozen" -eq 0 ]; then
             continue
         fi
-        got="$(fetch_package "$url" "$resolved" "$path" "$IP_ROOT/$rel")"
+        # Fetch into staging and commit to the store only after the integrity
+        # verdict: content that violates the lock must never be left where a
+        # re-run (whose dir-exists check skips verification) would sync it.
+        staging="$IP_ROOT/.intelligence/.staging-$$"
+        rm -rf "$staging"
+        got="$(fetch_package "$url" "$resolved" "$path" "$staging")"
         # An empty sha (bundle-seeded content on a dev build) means unknown,
         # not moved — only two known-and-different shas are a finding.
         if [ -n "$sha" ] && [ -n "$got" ] && [ "$got" != "$sha" ]; then
             if [ "$frozen" -eq 1 ]; then
+                rm -rf "$staging"
                 die "$name: fetched $got but the lock pins $sha — the ref moved; refusing under --frozen"
             fi
             echo "  WARN: $name resolved to $got, lock had $sha — updating the lock" >&2
             lock_upsert "$lock" "$name" "$requested" "$url" "$path" "$resolved" "$got"
         fi
+        rm -rf "${IP_ROOT:?}/$rel"
+        mkdir -p "$(dirname "$IP_ROOT/$rel")"
+        mv "$staging" "$IP_ROOT/$rel"
         wire_package_sources "$manifest" "$name" "$rel" "$IP_ROOT"
         echo "= $name@${resolved:-HEAD}"
     done < <(lock_to_tsv "$lock")

package/cli/commands/migrate.sh

@@ -3,7 +3,7 @@
 # to the CLI setup: root intelligence.yaml, .intelligence/ store,
 # intelligence.lock, no vendored engine.
 #
-# Transactional in the migrations.sh spirit: STAGE everything next to the
+# Transactional: STAGE everything next to the
 # project, VERIFY the staged state, then COMMIT in an order where every
 # destructive step happens only after a real sync of the new state reported
 # IS_STATUS=ok. Any earlier failure leaves the project untouched.
@@ -44,12 +44,11 @@ stamp="$(read_engine_stamp "$config")"
 eng="$(bundled_engine_version)"
 [ -n "$stamp" ] && _ver_gt "$stamp" "$eng" && die "project schema $stamp is newer than this CLI's engine $eng — update the CLI first"
 
-# A schema gap is closed by the engine's own proven chain before conversion.
-if [ "$dry_run" -eq 0 ] && { [ -z "$stamp" ] || _ver_gt "$eng" "$stamp"; }; then
-    echo "== applying the engine migration chain ($stamp -> $eng) =="
-    run_migrations "$umbrella" "$(basename "$module_dir")" "" || die "engine migration chain failed (IS_STATUS above) — nothing converted"
-    stamp_version "$config" "$eng"
-fi
+# The v1 `packs:` block is the one v1 shape migrate still has to read, and the
+# engine no longer knows it — the reader lives here, with its only consumer.
+get_pack_field() {
+    get_nested_yaml_value "$1" "packs" "$2" "$3"
+}
 
 # ---- Stage ----------------------------------------------------------------
 stage="$root/.intelligence-migrate-stage.$$"
@@ -58,6 +57,20 @@ cleanup_stage() { rm -rf "$stage"; }
 trap cleanup_stage EXIT INT TERM
 mkdir -p "$stage/.intelligence/packages"
 
+# v2 carries no v1 migration chain: v1 is archived, and the archived engine is
+# what knows how to walk an old project forward. So migrate accepts only a
+# project already at the final v1 schema and names the exact remedy otherwise —
+# a remedy that keeps working indefinitely, because the archive stays at the
+# URL the project's own update.sh already clones.
+V1_FINAL_SCHEMA="0.10.0"
+if [ -z "$stamp" ] || _ver_gt "$V1_FINAL_SCHEMA" "$stamp"; then
+    echo "ERROR: project schema is ${stamp:-absent (pre-0.3.1)}, older than the final v1 schema $V1_FINAL_SCHEMA." >&2
+    echo "       Bring it forward with its own engine first — that still works:" >&2
+    echo "         bash $module_rel/scripts/update.sh --yes" >&2
+    echo "       then re-run: intelligence migrate" >&2
+    exit 1
+fi
+
 echo "== staging =="
 # Engine content arrives as the @ainova-systems/sync package, seeded from the
 # bundle (fetch_package's guard — no network).
@@ -67,6 +80,7 @@ sync_pkg_sha="$(fetch_package "$SYNC_PKG_URL" "v$eng" "$SYNC_PKG_PATH" "$stage/$
 # per-pack source facts. Recorded as rows for the config rewrite and the lock.
 pack_rows="$stage/packs.rows"
 : > "$pack_rows"
+seen_names=" "
 while IFS= read -r pack; do
     [ -n "$pack" ] || continue
     url="$(get_pack_field "$config" "$pack" "url")"
@@ -80,6 +94,12 @@ while IFS= read -r pack; do
     case "$repo" in ""|*[!A-Za-z0-9._-]*) repo="$(printf '%s' "$repo" | tr -c 'A-Za-z0-9._-' '-')" ;; esac
     name="@$org/$repo"
     assert_valid_pkg_name "$name"
+    # Two packs deriving the same @org/repo would overwrite one store dir and
+    # duplicate the lock key — fail closed, the user renames a source.
+    case "$seen_names" in
+        *" $name "*) die "packs '$pack' and another both derive package name '$name' — sources must map to distinct names" ;;
+    esac
+    seen_names="$seen_names $name "
     printf '%s\n' "$pack$LOCK_SEP$name$LOCK_SEP$url$LOCK_SEP$ref$LOCK_SEP$mirror"
 done < <(read_yaml_keys "$config" "packs") >> "$pack_rows"
 
@@ -153,8 +173,19 @@ while IFS= read -r line || [ -n "$line" ]; do
             *"- "*)
                 indent="${line%%-*}"
                 v="${line#*- }"
+                # A trailing inline comment survives the rewrite — split it
+                # off before touching quotes, or it would be mangled into the
+                # value.
+                trail=""
+                case "$v" in
+                    *[[:space:]]"#"*)
+                        trail=" #${v#*[[:space:]]#}"
+                        v="${v%%[[:space:]]#*}"
+                        ;;
+                esac
+                v="${v%"${v##*[![:space:]]}"}"
                 v="${v%\"}"; v="${v#\"}"; v="${v%\'}"; v="${v#\'}"
-                echo "$indent- \"$(rewrite_source_value "$v")\""
+                echo "$indent- \"$(rewrite_source_value "$v")\"$trail"
                 continue
                 ;;
         esac
@@ -212,6 +243,13 @@ fi
 
 # ---- Commit ---------------------------------------------------------------
 echo "== committing =="
+# .gitignore is part of the transaction: rollback must leave it exactly as
+# found, absent included.
+gitignore_existed=0
+if [ -f "$root/.gitignore" ]; then
+    gitignore_existed=1
+    cp "$root/.gitignore" "$stage/gitignore.orig"
+fi
 if [ ! -f "$root/.gitignore" ] || ! grep -q '^\.intelligence/' "$root/.gitignore"; then
     {
         [ -f "$root/.gitignore" ] && [ -n "$(tail -c 1 "$root/.gitignore" 2>/dev/null)" ] && echo ""
@@ -221,8 +259,15 @@ if [ ! -f "$root/.gitignore" ] || ! grep -q '^\.intelligence/' "$root/.gitignore
 fi
 rollback() {
     rm -rf "$root/.intelligence" "$root/intelligence.yaml" "$root/intelligence.lock"
+    if [ "$gitignore_existed" -eq 1 ]; then
+        cp "$stage/gitignore.orig" "$root/.gitignore"
+    else
+        rm -f "$root/.gitignore"
+    fi
     echo "rolled back — the vendored setup is untouched" >&2
 }
+# From the first moved file until success, an interrupt must roll back too.
+trap 'rollback; exit 130' INT TERM
 mv "$stage/.intelligence" "$root/.intelligence"
 cp "$manifest_stage" "$root/intelligence.yaml"
 lock_write_from_tsv "$root/intelligence.lock" "$lock_rows"
@@ -237,13 +282,21 @@ echo "$sync_out" | grep -q '^IS_STATUS=ok' || {
     rollback
     die "sync of the migrated state did not report ok — rolled back"
 }
+# Point of no return: the new state is verified. From here an interrupt must
+# NOT roll back (the old setup is being removed) — only clean the stage.
+trap cleanup_stage EXIT INT TERM
 
 # Only now is anything of the old setup removed — and config.yaml is kept as
 # a reviewable backup inside the store.
 mkdir -p "$root/.intelligence/backup"
 cp "$config" "$root/.intelligence/backup/config.yaml"
 while IFS="$LOCK_SEP" read -r pack name url ref mirror; do
-    if [ -n "$mirror" ] && [ -d "$root/$mirror" ]; then
+    # Containment before deletion: a mirror value is config input, and rm -rf
+    # must never follow it out of the repository.
+    case "$mirror" in
+        ""|/*|*..*) [ -n "$mirror" ] && echo "  WARN: mirror '$mirror' not repo-contained — left in place" >&2; continue ;;
+    esac
+    if [ -d "$root/$mirror" ]; then
         rm -rf "${root:?}/$mirror"
         # An emptied mirror parent (e.g. <umbrella>/external/) goes with it.
         rmdir "$(dirname "$root/$mirror")" 2>/dev/null || true

package/cli/commands/registry.sh

@@ -28,15 +28,7 @@ case "$sub" in
             done < <(registries_list "$IP_ROOT/intelligence.yaml")
             [ "$found" -eq 0 ] && echo "  (none)"
         fi
-        bundled="$(default_index_file)"
-        if [ -n "$bundled" ]; then
-            echo "Bundled index:"
-            while IFS= read -r name; do
-                [ -n "$name" ] || continue
-                echo "  $name -> $(qmap_field "$bundled" "packages" "$name" "url")"
-            done < <(qmap_keys "$bundled" "packages")
-        fi
-        echo "Fallback: @org/name -> https://github.com/org/name.git"
+        echo "Names resolve ONLY through the list above. Registry-less installs are explicit: github:org/repo, git+<url>."
         ;;
     add)
         url="${2:-}"
@@ -46,6 +38,7 @@ case "$sub" in
         case "$url" in
             @*) die "registries are added by URL — names carry their own scope. To install a package: intelligence add $url/<name>" ;;
         esac
+        assert_safe_source_url "${url#git+}"
         require_v2
         # Fail closed: a URL that cannot produce an index is not a registry,
         # and recording it would turn a typo here into a confusing failure at

package/cli/commands/search.sh

@@ -4,7 +4,7 @@
 # "what does this project depend on", `search` answers "what could it".
 #
 # Sources, in resolution order (a name found earlier wins, exactly as `add`
-# resolves it): every scope bound in the manifest, then the bundled index.
+# resolves it): the manifest's trusted registries, in order.
 set -euo pipefail
 source "$CLI_DIR/lib/cli-common.sh"
 
@@ -69,15 +69,13 @@ if [ -n "$manifest" ]; then
         emit_index "$index" "$url"
     done < <(registries_list "$manifest")
 fi
-emit_index "$(default_index_file)" "bundled"
-
 if [ "$rows" -eq 0 ]; then
     if [ -n "$term" ]; then
-        echo "Nothing matching '$term' in the configured registries."
+        echo "Nothing matching '$term' in this project's trusted registries."
     else
-        echo "No registries hold any packages."
+        echo "No trusted registries (or they offer nothing) — intelligence registry add <repo-url>."
     fi
-    echo "Any git repo with rules/, agents/ or skills/ is a package: intelligence add @org/repo"
+    echo "Explicit installs need no registry: intelligence add github:org/repo"
     exit 0
 fi
 

package/cli/commands/sync.sh

@@ -26,7 +26,7 @@ case "$IP_MODE" in
             die "installed content missing on disk:$missing — run 'intelligence install'"
         fi
         export_engine_env "$IP_ROOT"
-        exec bash "$IS_ENGINE_DIR/scripts/sync.sh" "$@"
+        exec bash "$IS_ENGINE_DIR/sync.sh" "$@"
         ;;
     legacy)
         # A vendored project syncs with ITS engine — its pin is the contract,

package/cli/commands/update.sh

@@ -21,10 +21,15 @@ require_v2
 manifest="$IP_ROOT/intelligence.yaml"
 lock="$IP_ROOT/intelligence.lock"
 
-moved=0 checked=0
+moved=0 found=0
 while IFS= read -r name; do
     [ -n "$name" ] || continue
+    # Manifest keys are untrusted input on their way into store paths.
+    assert_valid_pkg_name "$name"
     [ -n "$only" ] && [ "$name" != "$only" ] && continue
+    # A named package that exists is "found" whatever happens next — a skip
+    # message followed by "not in the manifest" would contradict itself.
+    found=1
     if [ "$name" = "$SYNC_PKG_NAME" ]; then
         echo "  $name: engine content moves with the engine — 'intelligence upgrade' owns it"
         continue
@@ -32,30 +37,49 @@ while IFS= read -r name; do
     ref="$(qmap_field "$manifest" "packages" "$name" "ref")"
     [ -n "$ref" ] && { echo "  $name: pinned to ref '$ref' — skipped"; continue; }
     range="$(qmap_field "$manifest" "packages" "$name" "version")"
+    # An exact version is a pin, same as ref: — update never moves pins.
+    if [ -n "$range" ] && semver_is_stable "$range"; then
+        echo "  $name: pinned to $range — edit the manifest to move it"
+        continue
+    fi
     url="$(qmap_field "$manifest" "packages" "$name" "url")"
     path="$(qmap_field "$manifest" "packages" "$name" "path")"
     if [ -z "$url" ]; then
         resolve_package_source "$manifest" "$name"
         url="$RES_URL"; path="$RES_PATH"
     fi
-    checked=$((checked + 1))
     picked="$(list_remote_versions "$url" | semver_pick_highest "$range")"
     [ -n "$picked" ] || { echo "  $name: nothing satisfies '${range:-*}' at $url" >&2; continue; }
     read -r tag _ <<< "$(remote_tag_for_version "$url" "$picked")"
     current="$(qmap_field "$lock" "packages" "$name" "resolved")"
-    if [ "$tag" = "$current" ]; then
+    cur_url="$(qmap_field "$lock" "packages" "$name" "url")"
+    cur_path="$(qmap_field "$lock" "packages" "$name" "path")"
+    # Same tag is not enough: a registry may re-point a name's source while
+    # keeping the version — the move doctor warns about must be actionable
+    # here, so url/path changes refetch too.
+    if [ "$tag" = "$current" ] && [ "$url" = "$cur_url" ] && [ "$path" = "$cur_path" ]; then
         echo "  $name: ${current:-<none>} (up to date)"
         continue
     fi
     rel=".intelligence/packages/$name"
-    sha="$(fetch_package "$url" "$tag" "$path" "$IP_ROOT/$rel")"
+    # Fetch into staging FIRST: a failed clone must leave the current install
+    # fully wired and intact. Only after success is the old shape unwired
+    # (the new version may have dropped a section dir), the store swapped,
+    # and the new shape wired.
+    staging="$IP_ROOT/.intelligence/.staging-$$"
+    rm -rf "$staging"
+    sha="$(fetch_package "$url" "$tag" "$path" "$staging")"
+    unwire_package_sources "$manifest" "$rel"
+    rm -rf "${IP_ROOT:?}/$rel"
+    mkdir -p "$(dirname "$IP_ROOT/$rel")"
+    mv "$staging" "$IP_ROOT/$rel"
     wire_package_sources "$manifest" "$name" "$rel" "$IP_ROOT"
     lock_upsert "$lock" "$name" "$range" "$url" "$path" "$tag" "$sha"
     echo "  $name: ${current:-<none>} -> $tag"
     moved=$((moved + 1))
 done < <(qmap_keys "$manifest" "packages")
 
-[ -n "$only" ] && [ "$checked" -eq 0 ] && die "package '$only' is not in the manifest"
+[ -n "$only" ] && [ "$found" -eq 0 ] && die "package '$only' is not in the manifest"
 echo "updated: $moved package(s)"
 
 if [ "$moved" -gt 0 ] && [ "$no_sync" -eq 0 ]; then

package/cli/engine-package.yaml

@@ -0,0 +1,14 @@
+# What THIS CLI distribution ships as its engine-content package, and which
+# registry its init seeds into new manifests. Data, not code: a fork or an
+# enterprise mirror edits this file (or its copy in the npm build) — nothing
+# in cli/ names a vendor.
+#
+# The engine-content package is the one package whose content documents the
+# engine scripts bundled with the CLI: init writes this entry into the
+# manifest (visible, removable), its pin always equals the engine VERSION,
+# `upgrade` moves it, and at the matching version it materializes from the
+# bundle without network.
+name: "@ainova-systems/sync"
+url: "https://github.com/ainova-systems/intelligence.git"
+path: "packages/sync"
+default_registry: "https://github.com/ainova-systems/intelligence-registry.git"

package/cli/intelligence

@@ -3,25 +3,20 @@
 #
 # Dispatcher only: each command lives in commands/<name>.sh so commands can be
 # ported to Node one at a time without touching the others. The engine is the
-# vendored bash engine bundled next to the CLI (npm package) or, when running
-# from the intelligence-sync repo itself, the repo's own module.
+# bash engine shipped next to the CLI.
 
 set -euo pipefail
 
 CLI_DIR="$(cd "$(dirname "$0")" && pwd)"
 export CLI_DIR
 
-# Engine discovery, by role (scripts/sync.sh + scripts/VERSION), never by
-# guessing names beyond the two shipped layouts:
-#   1. npm package:  <pkg>/cli/intelligence + <pkg>/engine/scripts/
-#   2. this repo:    <repo>/cli/intelligence + <repo>/intelligence/sync/scripts/
+# Engine discovery, by role (sync.sh + VERSION). The repo and the npm package
+# ship one layout — <root>/{cli,engine,packages/sync} — so there is a single
+# candidate rather than a per-distribution list.
 IS_ENGINE_DIR=""
-for _cand in "$CLI_DIR/../engine" "$CLI_DIR/../intelligence/sync"; do
-    if [ -f "$_cand/scripts/sync.sh" ] && [ -f "$_cand/scripts/VERSION" ]; then
-        IS_ENGINE_DIR="$(cd "$_cand" && pwd)"
-        break
-    fi
-done
+if [ -f "$CLI_DIR/../engine/sync.sh" ] && [ -f "$CLI_DIR/../engine/VERSION" ]; then
+    IS_ENGINE_DIR="$(cd "$CLI_DIR/../engine" && pwd)"
+fi
 if [ -z "$IS_ENGINE_DIR" ]; then
     echo "ERROR: bundled sync engine not found next to the CLI ($CLI_DIR)." >&2
     echo "       Reinstall: npm i -g @ainova-systems/intelligence" >&2
@@ -29,10 +24,19 @@ if [ -z "$IS_ENGINE_DIR" ]; then
 fi
 export IS_ENGINE_DIR
 
+# The engine's own content, shipped beside the engine as the seed for the
+# @ainova-systems/sync package at exactly this CLI's version. Separate from the
+# engine dir: the store must receive rules/agents/skills, never engine scripts.
+IS_BUNDLED_PKG_DIR=""
+if [ -d "$CLI_DIR/../packages/sync" ]; then
+    IS_BUNDLED_PKG_DIR="$(cd "$CLI_DIR/../packages/sync" && pwd)"
+fi
+export IS_BUNDLED_PKG_DIR
+
 cmd="${1:-}"
 case "$cmd" in
     ""|help|-h|--help)
-        engine_ver="$(tr -d ' \t\r\n' < "$IS_ENGINE_DIR/scripts/VERSION")"
+        engine_ver="$(tr -d ' \t\r\n' < "$IS_ENGINE_DIR/VERSION")"
         cat <<EOF
 intelligence — build, version and distribute AI agent intelligence
 (engine $engine_ver${INTELLIGENCE_NPM_VERSION:+, package $INTELLIGENCE_NPM_VERSION})
@@ -48,7 +52,7 @@ Usage: intelligence <command> [args]
   list                    Installed packages with requested/locked versions
   search [term]           What the registries offer, and what this project has
   sync [target]           Render intelligence to every enabled tool (.claude, AGENTS.md, ...)
-  registry <list|add|remove>  Bind a scope to a registry index
+  registry <list|add|remove>  Manage the trusted registry list (add <repo-url>)
   migrate [--dry-run]     Convert a vendored (v1) setup to the CLI setup
   doctor                  Check manifest, lockfile, store and engine consistency
   status                  Project state at a glance
@@ -57,13 +61,21 @@ EOF
         exit 0
         ;;
     version|-v|--version)
-        engine_ver="$(tr -d ' \t\r\n' < "$IS_ENGINE_DIR/scripts/VERSION")"
+        engine_ver="$(tr -d ' \t\r\n' < "$IS_ENGINE_DIR/VERSION")"
         echo "${INTELLIGENCE_NPM_VERSION:-$engine_ver} (engine $engine_ver)"
         exit 0
         ;;
 esac
 shift
 
+# The command word builds a path — allow exactly lowercase words, so
+# `intelligence ../x` can never exec a neighbouring script.
+case "$cmd" in
+    *[!a-z-]*|-*)
+        echo "ERROR: unknown command '$cmd'. Run 'intelligence help'." >&2
+        exit 1
+        ;;
+esac
 cmd_file="$CLI_DIR/commands/$cmd.sh"
 if [ ! -f "$cmd_file" ]; then
     echo "ERROR: unknown command '$cmd'. Run 'intelligence help'." >&2