@ainova-systems/intelligence 0.11.0-rc.5 → 0.11.0-rc.7

package/cli/lib/cli-common.sh

@@ -7,32 +7,67 @@
 # CLI-owned parsing lives in lib/manifest.sh (quoted-key `packages:` /
 # `registries:` blocks, which the engine deliberately never reads).
 
-# Engine libraries (readers, is_status, IS_RC_*, engine_version). Sourced in
-# the same order sync.sh uses. CLI_DIR / IS_ENGINE_DIR come exported from the
-# dispatcher.
-source "$IS_ENGINE_DIR/scripts/lib/common.sh"
-source "$IS_ENGINE_DIR/scripts/lib/layout.sh"
-source "$IS_ENGINE_DIR/scripts/lib/migrations.sh"
+# Engine libraries (readers, is_status, IS_RC_*, engine_version). CLI_DIR /
+# IS_ENGINE_DIR come exported from the dispatcher.
+source "$IS_ENGINE_DIR/lib/common.sh"
+source "$IS_ENGINE_DIR/lib/contract.sh"
 
 die() {
     echo "ERROR: $*" >&2
     exit 1
 }
 
+# --- Untrusted-input guards ----------------------------------------------
+# Manifest, lock and registry indexes arrive with a cloned repo: every value
+# they carry is attacker-adjacent. URLs and refs reach git argv (a leading
+# `-` would be an option — `--upload-pack=<cmd>` is code execution), names
+# become store paths fed to rm -rf. Guard at the choke points, loudly.
+
+# assert_safe_source_url <url> — scheme allowlist (the engine's own list) or
+# scp-like user@host:path; never option-shaped, never quote-bearing.
+assert_safe_source_url() {
+    local url="$1"
+    case "$url" in
+        ""|-*) die "unsafe source url '$url' — option-shaped or empty" ;;
+        *[\"\'\ ]*) die "unsafe source url '$url' — quotes or spaces" ;;
+        https://*|http://*|ssh://*|git://*|file://*) ;;
+        *@*:*) ;;
+        *) die "unsafe source url '$url' — allowed: https, http, ssh, git, file, or user@host:path" ;;
+    esac
+}
+
+# assert_safe_ref <ref-or-empty> — tags/branches/SHAs; never option-shaped.
+assert_safe_ref() {
+    local ref="$1"
+    [ -z "$ref" ] && return 0
+    case "$ref" in
+        -*) die "unsafe git ref '$ref' — option-shaped" ;;
+        *[\"\'\ \\]*) die "unsafe git ref '$ref'" ;;
+    esac
+}
+
 source "$CLI_DIR/lib/manifest.sh"
 source "$CLI_DIR/lib/semver.sh"
 source "$CLI_DIR/lib/registry.sh"
 source "$CLI_DIR/lib/lockfile.sh"
 
-# The engine's own content as a package: OPTIONAL but auto-selected at init.
-# Package by UX (manifest entry, lockfile row, list/search/remove), bundle by
-# mechanics — at the version the CLI ships, it materializes from the npm
-# bundle without network; only a cross-version install reaches git. The pin
-# is held exactly at the bundled engine version and moved only by `upgrade`.
-SYNC_PKG_NAME="@ainova-systems/sync"
-SYNC_PKG_URL="https://github.com/ainova-systems/intelligence-sync.git"
-SYNC_PKG_PATH="intelligence/sync"
-SYNC_PKG_STORE=".intelligence/packages/@ainova-systems/sync"
+# The engine-content package: OPTIONAL but auto-selected at init. Package by
+# UX (manifest entry, lockfile row, list/search/remove), bundle by mechanics —
+# at the version the CLI ships, it materializes from the npm bundle without
+# network; only a cross-version install reaches git. The pin is held exactly
+# at the bundled engine version and moved only by `upgrade`.
+#
+# Its identity is DATA shipped with the distribution (cli/engine-package.yaml),
+# never a name compiled into cli code — a fork edits the file.
+_EPKG="$CLI_DIR/engine-package.yaml"
+SYNC_PKG_NAME="$(top_scalar "$_EPKG" "name")"
+SYNC_PKG_URL="$(top_scalar "$_EPKG" "url")"
+SYNC_PKG_PATH="$(top_scalar "$_EPKG" "path")"
+# Read by commands (init seeds it) — per-file shellcheck cannot see that.
+# shellcheck disable=SC2034
+DEFAULT_REGISTRY_URL="$(top_scalar "$_EPKG" "default_registry")"
+[ -n "$SYNC_PKG_NAME" ] || die "corrupt CLI installation: $_EPKG is missing or has no 'name'"
+SYNC_PKG_STORE=".intelligence/packages/$SYNC_PKG_NAME"
 
 # --- Project detection ---------------------------------------------------
 # Sets: IP_MODE (v2|legacy|none), IP_ROOT, IP_UMBRELLA, IP_MODULE_DIR.
@@ -92,7 +127,7 @@ manifest_intelligence_dir() {
 }
 
 bundled_engine_version() {
-    tr -d ' \t\r\n' < "$IS_ENGINE_DIR/scripts/VERSION"
+    tr -d ' \t\r\n' < "$IS_ENGINE_DIR/VERSION"
 }
 
 # --- The sync package's manifest/lock plumbing ---------------------------
@@ -127,7 +162,7 @@ export_engine_env() {
     export CONFIG_FILE="$root/intelligence.yaml"
     export REPO_ROOT="$root"
     export IS_UMBRELLA_REL="$umbrella"
-    export IS_MODULE_REL=".intelligence/engine"
+    export IS_MODULE_REL="$SYNC_PKG_STORE"
     export IS_SYNC_CMD="intelligence sync"
     export IS_MANIFEST_NAME="intelligence.yaml"
     export IS_PROTECTED_DIRS="$umbrella:.intelligence"

package/cli/lib/lockfile.sh

@@ -54,14 +54,18 @@ lock_write_from_tsv() {
         echo "lockfile_version: $LOCKFILE_VERSION"
         echo "engine_version: \"$(bundled_engine_version)\""
         echo "packages:"
+        # Values reach a double-quoted YAML scalar: a `"` or `\` in any of
+        # them (registry-supplied url/path included) must be escaped, or it
+        # would break or alias the neighbouring field.
         awk -F"$LOCK_SEP" '
+            function esc(s) { gsub(/\\/, "\\\\", s); gsub(/"/, "\\\"", s); return s }
             NF >= 6 {
-                print "  \"" $1 "\":"
-                if ($2 != "") print "    requested: \"" $2 "\""
-                print "    url: \"" $3 "\""
-                if ($4 != "") print "    path: \"" $4 "\""
-                if ($5 != "") print "    resolved: \"" $5 "\""
-                print "    sha: \"" $6 "\""
+                print "  \"" esc($1) "\":"
+                if ($2 != "") print "    requested: \"" esc($2) "\""
+                print "    url: \"" esc($3) "\""
+                if ($4 != "") print "    path: \"" esc($4) "\""
+                if ($5 != "") print "    resolved: \"" esc($5) "\""
+                print "    sha: \"" esc($6) "\""
             }
         ' "$tsv"
     } > "$tmp"
@@ -72,7 +76,8 @@ lock_write_from_tsv() {
 # Replace-or-append one entry, keeping the others.
 lock_upsert() {
     local lock="$1" name="$2" requested="$3" url="$4" path="$5" resolved="$6" sha="$7"
-    local tsv="${TMPDIR:-/tmp}/intelligence-lock-$$.tsv"
+    local tsv
+    tsv="$(mktemp -t intelligence-lock-XXXXXX 2>/dev/null || mktemp)"
     {
         lock_to_tsv "$lock" | awk -F"$LOCK_SEP" -v n="$name" '$1 != n'
         printf '%s\037%s\037%s\037%s\037%s\037%s\n' \
@@ -86,7 +91,8 @@ lock_upsert() {
 lock_remove() {
     local lock="$1" name="$2"
     [ -f "$lock" ] || return 0
-    local tsv="${TMPDIR:-/tmp}/intelligence-lock-$$.tsv"
+    local tsv
+    tsv="$(mktemp -t intelligence-lock-XXXXXX 2>/dev/null || mktemp)"
     lock_to_tsv "$lock" | awk -F"$LOCK_SEP" -v n="$name" '$1 != n' > "$tsv"
     if [ -s "$tsv" ]; then
         lock_write_from_tsv "$lock" "$tsv"

package/cli/lib/manifest.sh

@@ -24,6 +24,16 @@ assert_valid_pkg_name() {
     case "$1" in
         *[!@/A-Za-z0-9._-]*|*/*/*) die "invalid package name '$1' — allowed: letters, digits, . _ -, one '/'" ;;
     esac
+    # Both segments become store path components fed to rm -rf: an empty one
+    # ('@scope/') resolves to the whole scope dir, and a dot segment walks the
+    # tree — either would turn one bad --name into deleting other packages.
+    local scope="${1%%/*}" short="${1#*/}"
+    case "${scope#@}" in
+        ""|.|..) die "invalid package name '$1' — empty or dot scope" ;;
+    esac
+    case "$short" in
+        ""|.|..) die "invalid package name '$1' — empty or dot name" ;;
+    esac
 }
 
 # qmap_keys <file> <block> — quoted keys, one per line.
@@ -104,9 +114,19 @@ _qmap_stage() {
 
 # qmap_set <file> <block> <key> <field> <value> — upsert one field, creating
 # the block and the key as needed.
+# _yq_esc <string> — escape \ and " for a double-quoted YAML scalar.
+_yq_esc() {
+    local s="$1"
+    s="${s//\\/\\\\}"
+    printf '%s' "${s//\"/\\\"}"
+}
+
 qmap_set() {
     local file="$1" block="$2" key="$3" field="$4" value="$5"
     [ -f "$file" ] || die "no such file: $file"
+    # url/path values can carry a `"`; escape before it reaches the quoted
+    # scalar the writer emits.
+    value="$(_yq_esc "$value")"
     _qmap_stage "$file" -v block="$block" -v key="$key" -v field="$field" -v value="$value" '
         function keyline()   { return "  \"" key "\":" }
         function fieldline() { return "    " field ": \"" value "\"" }
@@ -153,6 +173,7 @@ qmap_set() {
 qmap_set_value() {
     local file="$1" block="$2" key="$3" value="$4"
     [ -f "$file" ] || die "no such file: $file"
+    value="$(_yq_esc "$value")"
     _qmap_stage "$file" -v block="$block" -v key="$key" -v value="$value" '
         function entry() { return "  \"" key "\": \"" value "\"" }
         { sub(/\r$/, "") }
@@ -272,9 +293,46 @@ registries_remove() {
         { print }
     '
 }
+# True (0) if <config> already lists <entry> under any sources section. Quoted
+# and bare spellings both count - a manifest may hold either.
+_mig_has_source() {
+    local config="$1" entry="$2"
+    [ -f "$config" ] || return 1
+    grep -Fq -- "\"$entry\"" "$config" || grep -Fq -- "- $entry" "$config"
+}
+
+
+# sources_add_entry_first <file> <section> <entry> — idempotent insert at the
+# TOP of sources.<section> (creating sources:/section as needed). Package
+# entries go through this so project-owned entries stay later in the list —
+# adapters copy sources in order and the last write wins, which is exactly
+# the documented "your file overrides the package's" behavior.
+sources_add_entry_first() {
+    local file="$1" section="$2" entry="$3"
+    _mig_has_source "$file" "$entry" && return 0
+    _qmap_stage "$file" -v section="$section" -v entry="$entry" '
+        function line() { return "    - \"" entry "\"" }
+        { sub(/\r$/, "") }
+        /^sources:[ \t]*$/ { ins = 1; sourceseen = 1; print; next }
+        ins && /^[^ #]/ {
+            if (!secseen && !done) { print "  " section ":"; print line(); done = 1 }
+            ins = 0
+        }
+        ins && $0 ~ "^  " section ":[ \t]*$" { secseen = 1; print; print line(); done = 1; next }
+        { print }
+        END {
+            if (ins && !secseen && !done) { print "  " section ":"; print line(); done = 1 }
+            if (!sourceseen) {
+                print "sources:"
+                print "  " section ":"
+                print line()
+            }
+        }
+    '
+}
 
 # sources_remove_entry <file> <section> <entry> — remove `- "entry"` from
-# sources.<section>. Inverse of the engine-side _mig_add_source.
+# sources.<section>.
 sources_remove_entry() {
     local file="$1" section="$2" entry="$3"
     [ -f "$file" ] || return 0

package/cli/lib/registry.sh

@@ -1,42 +1,46 @@
 #!/bin/bash
 # Name -> source resolution and package fetching.
 #
-# Resolution order (first registry to DECLARE the name wins):
-#   1. project `registries:` — a trust LIST of registry repos (git repos
-#      holding index.yaml), consulted in manifest order; adding one is an
-#      explicit, committed act of trust in the names it declares
-#   2. the bundled default index (registry/index.yaml next to the CLI)
-#   3. convention: @org/name -> https://github.com/org/name.git, content at
-#      the repo root — the zero-infrastructure default
+# A name resolves ONLY through the manifest's `registries:` trust list (git
+# repos holding index.yaml, consulted in order; the first to declare the name
+# wins). There is deliberately no built-in catalog and no name->github
+# convention: the CLI core knows no vendor, and a name nobody explicitly
+# trusted must never silently turn into an install from a guessed URL.
+# Sources without a registry are always EXPLICIT: github:org/repo, git+<url>.
+# Vendor defaults exist only as lines `init` writes into the manifest —
+# visible, reviewable, deletable.
 #
 # The NAME is the trust anchor a developer reasons with; source integrity is
-# a separate mechanism: the lock pins url+sha, a project-registry hit that
-# shadows a bundled name with a different url warns loudly, and doctor flags
+# a separate mechanism: the lock pins url+sha, and doctor flags
 # resolution/lock url drift.
 #
 # An index is itself fetched with git (never curl): auth, proxies and private
 # hosting all come for free, and the CLI keeps the engine's bash+awk+git-only
 # dependency footprint.
 
-default_index_file() {
-    local f="$CLI_DIR/../registry/index.yaml"
-    [ -f "$f" ] && printf '%s' "$f"
-    return 0
-}
-
 # _fetch_index <registry-repo-url> — clones the registry repo (shallow) and
 # prints the path of its index.yaml; empty on failure. Cached per run+url.
 _fetch_index() {
-    local url="$1" cache key tmp
-    cache="${TMPDIR:-/tmp}/intelligence-cli-index-$$"
+    local url="$1" key tmp
+    assert_safe_source_url "$url"
+    # Per-run private cache dir under an UNPREDICTABLE mktemp path (a fixed
+    # /tmp/...-$$ would be trusted on cache hit and pre-creatable by others).
+    # No EXIT trap: _fetch_index is always called inside $( ), so a trap would
+    # fire in that subshell and delete the dir before the caller reads it. The
+    # dir is small and OS-reaped from the temp root; IS_REMOTE_CACHE-style
+    # persistence is exported so repeated calls in one command share it.
+    if [ -z "${IS_CLI_INDEX_CACHE:-}" ]; then
+        IS_CLI_INDEX_CACHE="$(mktemp -d -t intelligence-cli-index-XXXXXX 2>/dev/null || mktemp -d)"
+        export IS_CLI_INDEX_CACHE
+    fi
+    local cache="$IS_CLI_INDEX_CACHE"
     key="$(printf '%s' "$url" | cksum | awk '{print $1}')"
     if [ -f "$cache/$key/index.yaml" ]; then
         printf '%s' "$cache/$key/index.yaml"
         return 0
     fi
-    mkdir -p "$cache"
     tmp="$cache/$key"
-    if GIT_TERMINAL_PROMPT=0 git -c core.autocrlf=false clone --depth 1 --quiet "$url" "$tmp" 2>/dev/null \
+    if GIT_TERMINAL_PROMPT=0 git -c core.autocrlf=false clone --depth 1 --quiet -- "$url" "$tmp" 2>/dev/null \
         && [ -f "$tmp/index.yaml" ]; then
         printf '%s' "$tmp/index.yaml"
     fi
@@ -49,11 +53,9 @@ _fetch_index() {
 # shellcheck disable=SC2034
 resolve_package_source() {
     local manifest="$1" name="$2"
-    local scope="${name%%/*}" short="${name#*/}"
     RES_URL=""; RES_PATH=""; RES_VIA=""
 
-    local reg_url index bundled burl
-    bundled="$(default_index_file)"
+    local reg_url index
     if [ -n "$manifest" ] && [ -f "$manifest" ]; then
         while IFS= read -r reg_url; do
             [ -n "$reg_url" ] || continue
@@ -66,37 +68,18 @@ resolve_package_source() {
             if [ -n "$RES_URL" ]; then
                 RES_PATH="$(qmap_field "$index" "packages" "$name" "path")"
                 RES_VIA="registry:$reg_url"
-                # Shadowing a bundled name with a DIFFERENT source is legal
-                # (that is what overriding means) but never silent.
-                if [ -n "$bundled" ]; then
-                    burl="$(qmap_field "$bundled" "packages" "$name" "url")"
-                    if [ -n "$burl" ] && [ "$burl" != "$RES_URL" ]; then
-                        echo "  WARN: $name from this registry overrides the bundled source ($burl)" >&2
-                    fi
-                fi
                 return 0
             fi
         done < <(registries_list "$manifest")
     fi
-
-    if [ -n "$bundled" ]; then
-        RES_URL="$(qmap_field "$bundled" "packages" "$name" "url")"
-        if [ -n "$RES_URL" ]; then
-            RES_PATH="$(qmap_field "$bundled" "packages" "$name" "path")"
-            RES_VIA="index"
-            return 0
-        fi
-    fi
-
-    RES_URL="https://github.com/${scope#@}/$short.git"
-    RES_PATH=""
-    RES_VIA="convention"
+    # No trusted registry declares the name. Deliberately NOT an invented
+    # URL: the caller reports it, with suggestions.
     return 0
 }
 
 # suggest_similar <manifest-or-empty> <@scope/name> — "Did you mean" lines to
 # stderr, matched on the short name (singular/plural tolerant) across every
-# project registry and the bundled index.
+# trusted registry.
 suggest_similar() {
     local manifest="$1" name="$2"
     local want cand cshort reg_url index seen=" "
@@ -121,7 +104,6 @@ suggest_similar() {
             _suggest_from "$index"
         done < <(registries_list "$manifest")
     fi
-    _suggest_from "$(default_index_file)"
 }
 
 # fetch_package <url> <ref> <subpath> <dest-dir>
@@ -131,6 +113,8 @@ suggest_similar() {
 # store holds the bytes the package published.
 fetch_package() {
     local url="$1" ref="$2" subpath="$3" dest="$4"
+    assert_safe_source_url "$url"
+    assert_safe_ref "$ref"
     # Bundle seed: the engine-content package at the CLI's own version copies
     # from the npm bundle — no network, which keeps init / fresh-clone install
     # / migrate offline exactly like the staging they replace. Keyed on the
@@ -138,12 +122,14 @@ fetch_package() {
     # to the normal clone.
     if [ "$url" = "$SYNC_PKG_URL" ] && [ "$subpath" = "$SYNC_PKG_PATH" ] \
         && [ "${ref#v}" = "$(bundled_engine_version)" ]; then
+        [ -n "${IS_BUNDLED_PKG_DIR:-}" ] && [ -d "$IS_BUNDLED_PKG_DIR" ] \
+            || die "bundled engine content not found next to the CLI — reinstall @ainova-systems/intelligence"
         rm -rf "$dest"
         mkdir -p "$dest"
-        cp -R "$IS_ENGINE_DIR/." "$dest/"
+        cp -R "$IS_BUNDLED_PKG_DIR/." "$dest/"
         rm -rf "$dest/.git"
-        if [ -f "$IS_ENGINE_DIR/scripts/ENGINE_SHA" ]; then
-            tr -d ' \t\r\n' < "$IS_ENGINE_DIR/scripts/ENGINE_SHA"
+        if [ -f "$IS_ENGINE_DIR/ENGINE_SHA" ]; then
+            tr -d ' \t\r\n' < "$IS_ENGINE_DIR/ENGINE_SHA"
         fi
         return 0
     fi
@@ -152,20 +138,20 @@ fetch_package() {
     [ -n "$ref" ] && branch_arg=(--branch "$ref")
     tmp="$(mktemp -d -t intelligence-pkg-XXXXXX 2>/dev/null || mktemp -d)"
     if ! GIT_TERMINAL_PROMPT=0 git -c core.symlinks=false -c core.autocrlf=false -c core.eol=lf \
-            clone --depth 1 "${branch_arg[@]+"${branch_arg[@]}"}" --quiet "$url" "$tmp/clone" 2>/dev/null; then
+            clone --depth 1 "${branch_arg[@]+"${branch_arg[@]}"}" --quiet -- "$url" "$tmp/clone" 2>/dev/null; then
         # A SHA is not clonable with --branch — fall back to a full clone + checkout.
         rm -rf "$tmp/clone"
         GIT_TERMINAL_PROMPT=0 git -c core.symlinks=false -c core.autocrlf=false -c core.eol=lf \
-            clone --quiet "$url" "$tmp/clone" 2>/dev/null \
+            clone --quiet -- "$url" "$tmp/clone" 2>/dev/null \
             || { rm -rf "$tmp"; die "cannot clone $url"; }
-        [ -z "$ref" ] || git -C "$tmp/clone" checkout --quiet "$ref" \
+        [ -z "$ref" ] || git -C "$tmp/clone" checkout --quiet "$ref" -- \
             || { rm -rf "$tmp"; die "ref '$ref' not found in $url"; }
     fi
     sha="$(git -C "$tmp/clone" rev-parse HEAD)"
     src="$tmp/clone"
     if [ -n "$subpath" ]; then
         case "$subpath" in
-            *..*) rm -rf "$tmp"; die "unsafe path '$subpath'" ;;
+            *..*|/*|*[\"\']*) rm -rf "$tmp"; die "unsafe path '$subpath'" ;;
         esac
         src="$tmp/clone/$subpath"
         [ -d "$src" ] || { rm -rf "$tmp"; die "path '$subpath' not found in $url${ref:+@$ref}" ; }
@@ -182,14 +168,14 @@ fetch_package() {
 
 # wire_package_sources <manifest> <@scope/name> <store-rel-dir>
 # The provides convention: whichever of rules/agents/skills the installed
-# package has becomes a sources entry. Reuses the engine's idempotent,
-# comment-preserving _mig_add_source.
+# package has becomes a sources entry — inserted FIRST in its section, so
+# project-owned entries come later and win on same-named artifacts.
 wire_package_sources() {
     local manifest="$1" name="$2" rel="$3" root="$4"
     local section
     for section in rules agents skills; do
         if [ -d "$root/$rel/$section" ]; then
-            _mig_add_source "$manifest" "$section" "$rel/$section"
+            sources_add_entry_first "$manifest" "$section" "$rel/$section"
         fi
     done
 }

package/cli/lib/semver.sh

@@ -75,10 +75,11 @@ semver_match() {
 # onto their tag.
 list_remote_versions() {
     local url="$1"
+    assert_safe_source_url "$url"
     # `|| true` inside the pipeline: an unreachable repo must read as "no
     # versions", not kill a pipefail caller mid-command-substitution —
     # reachability is the CALLER's question (add probes it explicitly).
-    { GIT_TERMINAL_PROMPT=0 git ls-remote --tags "$url" 2>/dev/null || true; } \
+    { GIT_TERMINAL_PROMPT=0 git ls-remote --tags -- "$url" 2>/dev/null || true; } \
         | awk '{
             sub(/\r$/, "")
             ref = $2
@@ -95,7 +96,8 @@ list_remote_versions() {
 # prints "<tag> <sha>". Peeled sha (the commit a tag object points at) wins.
 remote_tag_for_version() {
     local url="$1" ver="${2#v}"
-    { GIT_TERMINAL_PROMPT=0 git ls-remote --tags "$url" 2>/dev/null || true; } \
+    assert_safe_source_url "$url"
+    { GIT_TERMINAL_PROMPT=0 git ls-remote --tags -- "$url" 2>/dev/null || true; } \
         | awk -v want="$ver" '
             {
                 sub(/\r$/, "")

package/engine/ENGINE_SHA

@@ -0,0 +1 @@
+557cde6997dce612e0e8a5a11adc2472173dcec0

package/engine/{scripts/adapters → adapters}/agents.sh

@@ -13,25 +13,20 @@
 
 source "$(dirname "${BASH_SOURCE[0]}")/../lib/common.sh"
 
-# Repo-relative paths to the umbrella folder and the engine module, DERIVED —
-# never hardcoded. The umbrella is named by the project (`intelligence/`,
-# `Intelligence/`, a codename) and the engine lives in a module inside it;
-# detect_layout resolved both before any adapter ran. A literal path here would
-# print a sync command that does not exist, and would be wrong outright on a
-# case-sensitive filesystem — in the one document Cursor, Copilot and Codex all
-# read as canonical.
-# sync.sh exports both as layout tokens; recompute only when an adapter is
-# driven directly (tests), never assume a folder name.
+# Repo-relative paths to the project's content dir and to the installed sync
+# package, taken from the env contract — never hardcoded. The content dir is
+# named by the project (`intelligence/`, a codename) and the package sits in
+# the store; a literal path here would print a sync command that does not
+# exist, and would be wrong outright on a case-sensitive filesystem — in the
+# one document Cursor, Copilot and Codex all read as canonical.
+# The defaults only cover an adapter driven directly (tests); sync.sh always
+# exports both.
 agents_md_umbrella_rel() {
-    local repo_root="$1" rel="${IS_UMBRELLA_REL:-}"
-    [ -n "$rel" ] || rel="$(repo_rel_dir "$repo_root" "${LS_UMBRELLA_DIR:-$repo_root/intelligence}")"
-    printf '%s' "${rel:-intelligence}"
+    printf '%s' "${IS_UMBRELLA_REL:-intelligence}"
 }
 
 agents_md_module_rel() {
-    local repo_root="$1" rel="${IS_MODULE_REL:-}"
-    [ -n "$rel" ] || rel="$(repo_rel_dir "$repo_root" "${LS_MODULE_DIR:-$repo_root/intelligence/sync}")"
-    printf '%s' "${rel:-intelligence/sync}"
+    printf '%s' "${IS_MODULE_REL:-.intelligence/packages/@ainova-systems/sync}"
 }
 
 # Append the static header block from config.yaml (or a fallback).