@ainova-systems/intelligence 0.11.0-rc.6 → 0.11.0-rc.7

package/README.md

@@ -38,9 +38,9 @@ intelligence install
 | `intelligence update [pkg]` | Re-resolve version ranges, rewrite the lock |
 | `intelligence sync [target]` | Render intelligence to every enabled tool |
 | `intelligence list` / `doctor` / `status` | Inspect and verify |
-| `intelligence registry add @scope <url>` | Bind a scope to a private registry index |
+| `intelligence registry add <repo-url>` | Trust a registry (a git repo with an `index.yaml`) |
 | `intelligence migrate` | Convert a vendored intelligence-sync setup to the CLI |
 
-Any git repo with `rules/`, `agents/` or `skills/` at its root is already an Intelligence Package: `intelligence add @your-org/your-repo` resolves it straight from GitHub — versions come from its `x.y.z` git tags. A monorepo of packages needs one line in a registry index.
+Any git repo with `rules/`, `agents/` or `skills/` at its root is already an Intelligence Package: install it from an explicit source — `intelligence add github:your-org/your-repo` — with versions from its `x.y.z` git tags. Names (`@scope/name`) resolve only through registries this project explicitly trusts; a monorepo of packages needs one line in such an index.
 
 Requires `git` (and on Windows the bash it ships with — Git for Windows). Engine and docs: [ainova-systems/intelligence-sync](https://github.com/ainova-systems/intelligence-sync).

package/cli/commands/add.sh

@@ -2,9 +2,9 @@
 # intelligence add <spec> [--name @scope/name] [--no-sync]
 #
 # Specs:
-#   @scope/name[@range]            resolved via registries / index / convention
-#   github:org/repo[#path]         direct from GitHub, no registry involved
-#   git+<url>[@ref][#path]         direct from any git host
+#   @scope/name[@range]            resolved ONLY through the manifest's trusted registries
+#   github:org/repo[#path]         explicit source: direct from GitHub, no registry involved
+#   git+<url>[@ref][#path]         explicit source: direct from any git host
 set -euo pipefail
 source "$CLI_DIR/lib/cli-common.sh"
 
@@ -43,14 +43,15 @@ case "$spec" in
         rest="${spec#git+}"
         case "$rest" in *#*) path="${rest#*#}"; rest="${rest%%#*}" ;; esac
         # ref = the part after the last `@` in the post-scheme URL, unless it
-        # contains `/` (then it is a user@host, not a ref) — the engine's own
-        # git+ grammar.
+        # contains `/` or `:` — either marks a user@host part (scp-like
+        # `git@host:repo.git` included), not a ref. A branch name containing
+        # `/` cannot be expressed here; pin it via `ref:` in the manifest.
         base="${rest#*://}"
         case "$base" in
             *@*)
                 tail="${base##*@}"
                 case "$tail" in
-                    */*) ;;
+                    */*|*:*) ;;
                     *) ref="$tail"; rest="${rest%@"$tail"}" ;;
                 esac
                 ;;
@@ -93,7 +94,7 @@ fi
 
 # The source must exist before anything else is attempted — never die
 # mid-pipeline with no message.
-if ! GIT_TERMINAL_PROMPT=0 git ls-remote "$url" >/dev/null 2>&1; then
+if ! GIT_TERMINAL_PROMPT=0 git ls-remote -- "$url" >/dev/null 2>&1; then
     echo "ERROR: no reachable repository at $url" >&2
     echo "  Declared by ${RES_VIA:-the spec} — check the URL and your git access." >&2
     exit 1

package/cli/commands/install.sh

@@ -63,6 +63,7 @@ fi
 missing=""
 while IFS= read -r name; do
     [ -n "$name" ] || continue
+    assert_valid_pkg_name "$name"
     if [ ! -f "$lock" ] || [ -z "$(qmap_field "$lock" "packages" "$name" "url")" ]; then
         missing="$missing $name"
     fi
@@ -101,8 +102,14 @@ fi
 if [ -f "$lock" ]; then
     while IFS="$LOCK_SEP" read -r name requested url path resolved sha; do
         [ -n "$name" ] || continue
+        # The lock arrives with a cloned repo — its keys are untrusted input
+        # on their way into rm -rf paths, and its urls into git argv.
+        assert_valid_pkg_name "$name"
         rel=".intelligence/packages/$name"
-        if [ -d "$IP_ROOT/$rel" ] && [ "$force" -eq 0 ]; then
+        # --frozen never trusts what is already on disk: a pre-existing
+        # (possibly substituted) store dir would otherwise be synced with no
+        # sha verification at all.
+        if [ -d "$IP_ROOT/$rel" ] && [ "$force" -eq 0 ] && [ "$frozen" -eq 0 ]; then
             continue
         fi
         # Fetch into staging and commit to the store only after the integrity

package/cli/commands/migrate.sh

@@ -3,7 +3,7 @@
 # to the CLI setup: root intelligence.yaml, .intelligence/ store,
 # intelligence.lock, no vendored engine.
 #
-# Transactional in the migrations.sh spirit: STAGE everything next to the
+# Transactional: STAGE everything next to the
 # project, VERIFY the staged state, then COMMIT in an order where every
 # destructive step happens only after a real sync of the new state reported
 # IS_STATUS=ok. Any earlier failure leaves the project untouched.
@@ -44,6 +44,12 @@ stamp="$(read_engine_stamp "$config")"
 eng="$(bundled_engine_version)"
 [ -n "$stamp" ] && _ver_gt "$stamp" "$eng" && die "project schema $stamp is newer than this CLI's engine $eng — update the CLI first"
 
+# The v1 `packs:` block is the one v1 shape migrate still has to read, and the
+# engine no longer knows it — the reader lives here, with its only consumer.
+get_pack_field() {
+    get_nested_yaml_value "$1" "packs" "$2" "$3"
+}
+
 # ---- Stage ----------------------------------------------------------------
 stage="$root/.intelligence-migrate-stage.$$"
 [ "$dry_run" -eq 1 ] && stage="$(mktemp -d -t intelligence-migrate-XXXXXX 2>/dev/null || mktemp -d)"
@@ -51,22 +57,18 @@ cleanup_stage() { rm -rf "$stage"; }
 trap cleanup_stage EXIT INT TERM
 mkdir -p "$stage/.intelligence/packages"
 
-# A schema gap is closed by the engine's own proven chain before conversion.
-# Dry-run must preview the SAME pipeline, so it runs the chain too — against
-# a staged copy of the umbrella, leaving the project untouched.
-if [ -z "$stamp" ] || _ver_gt "$eng" "$stamp"; then
-    if [ "$dry_run" -eq 1 ]; then
-        echo "== applying the engine migration chain ($stamp -> $eng) to a staged copy =="
-        cp -R "$umbrella" "$stage/umbrella"
-        run_migrations "$stage/umbrella" "$(basename "$module_dir")" "" > "$stage/chain.log" 2>&1 \
-            || { tail -5 "$stage/chain.log" >&2; die "engine migration chain failed in the staged copy — a real migrate would fail the same way"; }
-        stamp_version "$stage/umbrella/config.yaml" "$eng"
-        config="$stage/umbrella/config.yaml"
-    else
-        echo "== applying the engine migration chain ($stamp -> $eng) =="
-        run_migrations "$umbrella" "$(basename "$module_dir")" "" || die "engine migration chain failed (IS_STATUS above) — nothing converted"
-        stamp_version "$config" "$eng"
-    fi
+# v2 carries no v1 migration chain: v1 is archived, and the archived engine is
+# what knows how to walk an old project forward. So migrate accepts only a
+# project already at the final v1 schema and names the exact remedy otherwise —
+# a remedy that keeps working indefinitely, because the archive stays at the
+# URL the project's own update.sh already clones.
+V1_FINAL_SCHEMA="0.10.0"
+if [ -z "$stamp" ] || _ver_gt "$V1_FINAL_SCHEMA" "$stamp"; then
+    echo "ERROR: project schema is ${stamp:-absent (pre-0.3.1)}, older than the final v1 schema $V1_FINAL_SCHEMA." >&2
+    echo "       Bring it forward with its own engine first — that still works:" >&2
+    echo "         bash $module_rel/scripts/update.sh --yes" >&2
+    echo "       then re-run: intelligence migrate" >&2
+    exit 1
 fi
 
 echo "== staging =="
@@ -78,6 +80,7 @@ sync_pkg_sha="$(fetch_package "$SYNC_PKG_URL" "v$eng" "$SYNC_PKG_PATH" "$stage/$
 # per-pack source facts. Recorded as rows for the config rewrite and the lock.
 pack_rows="$stage/packs.rows"
 : > "$pack_rows"
+seen_names=" "
 while IFS= read -r pack; do
     [ -n "$pack" ] || continue
     url="$(get_pack_field "$config" "$pack" "url")"
@@ -91,6 +94,12 @@ while IFS= read -r pack; do
     case "$repo" in ""|*[!A-Za-z0-9._-]*) repo="$(printf '%s' "$repo" | tr -c 'A-Za-z0-9._-' '-')" ;; esac
     name="@$org/$repo"
     assert_valid_pkg_name "$name"
+    # Two packs deriving the same @org/repo would overwrite one store dir and
+    # duplicate the lock key — fail closed, the user renames a source.
+    case "$seen_names" in
+        *" $name "*) die "packs '$pack' and another both derive package name '$name' — sources must map to distinct names" ;;
+    esac
+    seen_names="$seen_names $name "
     printf '%s\n' "$pack$LOCK_SEP$name$LOCK_SEP$url$LOCK_SEP$ref$LOCK_SEP$mirror"
 done < <(read_yaml_keys "$config" "packs") >> "$pack_rows"
 
@@ -164,8 +173,19 @@ while IFS= read -r line || [ -n "$line" ]; do
             *"- "*)
                 indent="${line%%-*}"
                 v="${line#*- }"
+                # A trailing inline comment survives the rewrite — split it
+                # off before touching quotes, or it would be mangled into the
+                # value.
+                trail=""
+                case "$v" in
+                    *[[:space:]]"#"*)
+                        trail=" #${v#*[[:space:]]#}"
+                        v="${v%%[[:space:]]#*}"
+                        ;;
+                esac
+                v="${v%"${v##*[![:space:]]}"}"
                 v="${v%\"}"; v="${v#\"}"; v="${v%\'}"; v="${v#\'}"
-                echo "$indent- \"$(rewrite_source_value "$v")\""
+                echo "$indent- \"$(rewrite_source_value "$v")\"$trail"
                 continue
                 ;;
         esac
@@ -246,6 +266,8 @@ rollback() {
     fi
     echo "rolled back — the vendored setup is untouched" >&2
 }
+# From the first moved file until success, an interrupt must roll back too.
+trap 'rollback; exit 130' INT TERM
 mv "$stage/.intelligence" "$root/.intelligence"
 cp "$manifest_stage" "$root/intelligence.yaml"
 lock_write_from_tsv "$root/intelligence.lock" "$lock_rows"
@@ -260,13 +282,21 @@ echo "$sync_out" | grep -q '^IS_STATUS=ok' || {
     rollback
     die "sync of the migrated state did not report ok — rolled back"
 }
+# Point of no return: the new state is verified. From here an interrupt must
+# NOT roll back (the old setup is being removed) — only clean the stage.
+trap cleanup_stage EXIT INT TERM
 
 # Only now is anything of the old setup removed — and config.yaml is kept as
 # a reviewable backup inside the store.
 mkdir -p "$root/.intelligence/backup"
 cp "$config" "$root/.intelligence/backup/config.yaml"
 while IFS="$LOCK_SEP" read -r pack name url ref mirror; do
-    if [ -n "$mirror" ] && [ -d "$root/$mirror" ]; then
+    # Containment before deletion: a mirror value is config input, and rm -rf
+    # must never follow it out of the repository.
+    case "$mirror" in
+        ""|/*|*..*) [ -n "$mirror" ] && echo "  WARN: mirror '$mirror' not repo-contained — left in place" >&2; continue ;;
+    esac
+    if [ -d "$root/$mirror" ]; then
         rm -rf "${root:?}/$mirror"
         # An emptied mirror parent (e.g. <umbrella>/external/) goes with it.
         rmdir "$(dirname "$root/$mirror")" 2>/dev/null || true

package/cli/commands/registry.sh

@@ -38,6 +38,7 @@ case "$sub" in
         case "$url" in
             @*) die "registries are added by URL — names carry their own scope. To install a package: intelligence add $url/<name>" ;;
         esac
+        assert_safe_source_url "${url#git+}"
         require_v2
         # Fail closed: a URL that cannot produce an index is not a registry,
         # and recording it would turn a typo here into a confusing failure at

package/cli/commands/sync.sh

@@ -26,7 +26,7 @@ case "$IP_MODE" in
             die "installed content missing on disk:$missing — run 'intelligence install'"
         fi
         export_engine_env "$IP_ROOT"
-        exec bash "$IS_ENGINE_DIR/scripts/sync.sh" "$@"
+        exec bash "$IS_ENGINE_DIR/sync.sh" "$@"
         ;;
     legacy)
         # A vendored project syncs with ITS engine — its pin is the contract,

package/cli/commands/update.sh

@@ -24,6 +24,8 @@ lock="$IP_ROOT/intelligence.lock"
 moved=0 found=0
 while IFS= read -r name; do
     [ -n "$name" ] || continue
+    # Manifest keys are untrusted input on their way into store paths.
+    assert_valid_pkg_name "$name"
     [ -n "$only" ] && [ "$name" != "$only" ] && continue
     # A named package that exists is "found" whatever happens next — a skip
     # message followed by "not in the manifest" would contradict itself.
@@ -60,10 +62,17 @@ while IFS= read -r name; do
         continue
     fi
     rel=".intelligence/packages/$name"
-    # The new version may have dropped a top-level section dir: unwire the old
-    # shape first, or a dangling store-backed source bricks the next sync.
+    # Fetch into staging FIRST: a failed clone must leave the current install
+    # fully wired and intact. Only after success is the old shape unwired
+    # (the new version may have dropped a section dir), the store swapped,
+    # and the new shape wired.
+    staging="$IP_ROOT/.intelligence/.staging-$$"
+    rm -rf "$staging"
+    sha="$(fetch_package "$url" "$tag" "$path" "$staging")"
     unwire_package_sources "$manifest" "$rel"
-    sha="$(fetch_package "$url" "$tag" "$path" "$IP_ROOT/$rel")"
+    rm -rf "${IP_ROOT:?}/$rel"
+    mkdir -p "$(dirname "$IP_ROOT/$rel")"
+    mv "$staging" "$IP_ROOT/$rel"
     wire_package_sources "$manifest" "$name" "$rel" "$IP_ROOT"
     lock_upsert "$lock" "$name" "$range" "$url" "$path" "$tag" "$sha"
     echo "  $name: ${current:-<none>} -> $tag"

package/cli/engine-package.yaml

@@ -9,6 +9,6 @@
 # `upgrade` moves it, and at the matching version it materializes from the
 # bundle without network.
 name: "@ainova-systems/sync"
-url: "https://github.com/ainova-systems/intelligence-sync.git"
-path: "intelligence/sync"
+url: "https://github.com/ainova-systems/intelligence.git"
+path: "packages/sync"
 default_registry: "https://github.com/ainova-systems/intelligence-registry.git"

package/cli/intelligence

@@ -3,25 +3,20 @@
 #
 # Dispatcher only: each command lives in commands/<name>.sh so commands can be
 # ported to Node one at a time without touching the others. The engine is the
-# vendored bash engine bundled next to the CLI (npm package) or, when running
-# from the intelligence-sync repo itself, the repo's own module.
+# bash engine shipped next to the CLI.
 
 set -euo pipefail
 
 CLI_DIR="$(cd "$(dirname "$0")" && pwd)"
 export CLI_DIR
 
-# Engine discovery, by role (scripts/sync.sh + scripts/VERSION), never by
-# guessing names beyond the two shipped layouts:
-#   1. npm package:  <pkg>/cli/intelligence + <pkg>/engine/scripts/
-#   2. this repo:    <repo>/cli/intelligence + <repo>/intelligence/sync/scripts/
+# Engine discovery, by role (sync.sh + VERSION). The repo and the npm package
+# ship one layout — <root>/{cli,engine,packages/sync} — so there is a single
+# candidate rather than a per-distribution list.
 IS_ENGINE_DIR=""
-for _cand in "$CLI_DIR/../engine" "$CLI_DIR/../intelligence/sync"; do
-    if [ -f "$_cand/scripts/sync.sh" ] && [ -f "$_cand/scripts/VERSION" ]; then
-        IS_ENGINE_DIR="$(cd "$_cand" && pwd)"
-        break
-    fi
-done
+if [ -f "$CLI_DIR/../engine/sync.sh" ] && [ -f "$CLI_DIR/../engine/VERSION" ]; then
+    IS_ENGINE_DIR="$(cd "$CLI_DIR/../engine" && pwd)"
+fi
 if [ -z "$IS_ENGINE_DIR" ]; then
     echo "ERROR: bundled sync engine not found next to the CLI ($CLI_DIR)." >&2
     echo "       Reinstall: npm i -g @ainova-systems/intelligence" >&2
@@ -29,10 +24,19 @@ if [ -z "$IS_ENGINE_DIR" ]; then
 fi
 export IS_ENGINE_DIR
 
+# The engine's own content, shipped beside the engine as the seed for the
+# @ainova-systems/sync package at exactly this CLI's version. Separate from the
+# engine dir: the store must receive rules/agents/skills, never engine scripts.
+IS_BUNDLED_PKG_DIR=""
+if [ -d "$CLI_DIR/../packages/sync" ]; then
+    IS_BUNDLED_PKG_DIR="$(cd "$CLI_DIR/../packages/sync" && pwd)"
+fi
+export IS_BUNDLED_PKG_DIR
+
 cmd="${1:-}"
 case "$cmd" in
     ""|help|-h|--help)
-        engine_ver="$(tr -d ' \t\r\n' < "$IS_ENGINE_DIR/scripts/VERSION")"
+        engine_ver="$(tr -d ' \t\r\n' < "$IS_ENGINE_DIR/VERSION")"
         cat <<EOF
 intelligence — build, version and distribute AI agent intelligence
 (engine $engine_ver${INTELLIGENCE_NPM_VERSION:+, package $INTELLIGENCE_NPM_VERSION})
@@ -48,7 +52,7 @@ Usage: intelligence <command> [args]
   list                    Installed packages with requested/locked versions
   search [term]           What the registries offer, and what this project has
   sync [target]           Render intelligence to every enabled tool (.claude, AGENTS.md, ...)
-  registry <list|add|remove>  Bind a scope to a registry index
+  registry <list|add|remove>  Manage the trusted registry list (add <repo-url>)
   migrate [--dry-run]     Convert a vendored (v1) setup to the CLI setup
   doctor                  Check manifest, lockfile, store and engine consistency
   status                  Project state at a glance
@@ -57,13 +61,21 @@ EOF
         exit 0
         ;;
     version|-v|--version)
-        engine_ver="$(tr -d ' \t\r\n' < "$IS_ENGINE_DIR/scripts/VERSION")"
+        engine_ver="$(tr -d ' \t\r\n' < "$IS_ENGINE_DIR/VERSION")"
         echo "${INTELLIGENCE_NPM_VERSION:-$engine_ver} (engine $engine_ver)"
         exit 0
         ;;
 esac
 shift
 
+# The command word builds a path — allow exactly lowercase words, so
+# `intelligence ../x` can never exec a neighbouring script.
+case "$cmd" in
+    *[!a-z-]*|-*)
+        echo "ERROR: unknown command '$cmd'. Run 'intelligence help'." >&2
+        exit 1
+        ;;
+esac
 cmd_file="$CLI_DIR/commands/$cmd.sh"
 if [ ! -f "$cmd_file" ]; then
     echo "ERROR: unknown command '$cmd'. Run 'intelligence help'." >&2

package/cli/lib/cli-common.sh

@@ -7,18 +7,45 @@
 # CLI-owned parsing lives in lib/manifest.sh (quoted-key `packages:` /
 # `registries:` blocks, which the engine deliberately never reads).
 
-# Engine libraries (readers, is_status, IS_RC_*, engine_version). Sourced in
-# the same order sync.sh uses. CLI_DIR / IS_ENGINE_DIR come exported from the
-# dispatcher.
-source "$IS_ENGINE_DIR/scripts/lib/common.sh"
-source "$IS_ENGINE_DIR/scripts/lib/layout.sh"
-source "$IS_ENGINE_DIR/scripts/lib/migrations.sh"
+# Engine libraries (readers, is_status, IS_RC_*, engine_version). CLI_DIR /
+# IS_ENGINE_DIR come exported from the dispatcher.
+source "$IS_ENGINE_DIR/lib/common.sh"
+source "$IS_ENGINE_DIR/lib/contract.sh"
 
 die() {
     echo "ERROR: $*" >&2
     exit 1
 }
 
+# --- Untrusted-input guards ----------------------------------------------
+# Manifest, lock and registry indexes arrive with a cloned repo: every value
+# they carry is attacker-adjacent. URLs and refs reach git argv (a leading
+# `-` would be an option — `--upload-pack=<cmd>` is code execution), names
+# become store paths fed to rm -rf. Guard at the choke points, loudly.
+
+# assert_safe_source_url <url> — scheme allowlist (the engine's own list) or
+# scp-like user@host:path; never option-shaped, never quote-bearing.
+assert_safe_source_url() {
+    local url="$1"
+    case "$url" in
+        ""|-*) die "unsafe source url '$url' — option-shaped or empty" ;;
+        *[\"\'\ ]*) die "unsafe source url '$url' — quotes or spaces" ;;
+        https://*|http://*|ssh://*|git://*|file://*) ;;
+        *@*:*) ;;
+        *) die "unsafe source url '$url' — allowed: https, http, ssh, git, file, or user@host:path" ;;
+    esac
+}
+
+# assert_safe_ref <ref-or-empty> — tags/branches/SHAs; never option-shaped.
+assert_safe_ref() {
+    local ref="$1"
+    [ -z "$ref" ] && return 0
+    case "$ref" in
+        -*) die "unsafe git ref '$ref' — option-shaped" ;;
+        *[\"\'\ \\]*) die "unsafe git ref '$ref'" ;;
+    esac
+}
+
 source "$CLI_DIR/lib/manifest.sh"
 source "$CLI_DIR/lib/semver.sh"
 source "$CLI_DIR/lib/registry.sh"
@@ -100,7 +127,7 @@ manifest_intelligence_dir() {
 }
 
 bundled_engine_version() {
-    tr -d ' \t\r\n' < "$IS_ENGINE_DIR/scripts/VERSION"
+    tr -d ' \t\r\n' < "$IS_ENGINE_DIR/VERSION"
 }
 
 # --- The sync package's manifest/lock plumbing ---------------------------

package/cli/lib/lockfile.sh

@@ -54,14 +54,18 @@ lock_write_from_tsv() {
         echo "lockfile_version: $LOCKFILE_VERSION"
         echo "engine_version: \"$(bundled_engine_version)\""
         echo "packages:"
+        # Values reach a double-quoted YAML scalar: a `"` or `\` in any of
+        # them (registry-supplied url/path included) must be escaped, or it
+        # would break or alias the neighbouring field.
         awk -F"$LOCK_SEP" '
+            function esc(s) { gsub(/\\/, "\\\\", s); gsub(/"/, "\\\"", s); return s }
             NF >= 6 {
-                print "  \"" $1 "\":"
-                if ($2 != "") print "    requested: \"" $2 "\""
-                print "    url: \"" $3 "\""
-                if ($4 != "") print "    path: \"" $4 "\""
-                if ($5 != "") print "    resolved: \"" $5 "\""
-                print "    sha: \"" $6 "\""
+                print "  \"" esc($1) "\":"
+                if ($2 != "") print "    requested: \"" esc($2) "\""
+                print "    url: \"" esc($3) "\""
+                if ($4 != "") print "    path: \"" esc($4) "\""
+                if ($5 != "") print "    resolved: \"" esc($5) "\""
+                print "    sha: \"" esc($6) "\""
             }
         ' "$tsv"
     } > "$tmp"
@@ -72,7 +76,8 @@ lock_write_from_tsv() {
 # Replace-or-append one entry, keeping the others.
 lock_upsert() {
     local lock="$1" name="$2" requested="$3" url="$4" path="$5" resolved="$6" sha="$7"
-    local tsv="${TMPDIR:-/tmp}/intelligence-lock-$$.tsv"
+    local tsv
+    tsv="$(mktemp -t intelligence-lock-XXXXXX 2>/dev/null || mktemp)"
     {
         lock_to_tsv "$lock" | awk -F"$LOCK_SEP" -v n="$name" '$1 != n'
         printf '%s\037%s\037%s\037%s\037%s\037%s\n' \
@@ -86,7 +91,8 @@ lock_upsert() {
 lock_remove() {
     local lock="$1" name="$2"
     [ -f "$lock" ] || return 0
-    local tsv="${TMPDIR:-/tmp}/intelligence-lock-$$.tsv"
+    local tsv
+    tsv="$(mktemp -t intelligence-lock-XXXXXX 2>/dev/null || mktemp)"
     lock_to_tsv "$lock" | awk -F"$LOCK_SEP" -v n="$name" '$1 != n' > "$tsv"
     if [ -s "$tsv" ]; then
         lock_write_from_tsv "$lock" "$tsv"

package/cli/lib/manifest.sh

@@ -114,9 +114,19 @@ _qmap_stage() {
 
 # qmap_set <file> <block> <key> <field> <value> — upsert one field, creating
 # the block and the key as needed.
+# _yq_esc <string> — escape \ and " for a double-quoted YAML scalar.
+_yq_esc() {
+    local s="$1"
+    s="${s//\\/\\\\}"
+    printf '%s' "${s//\"/\\\"}"
+}
+
 qmap_set() {
     local file="$1" block="$2" key="$3" field="$4" value="$5"
     [ -f "$file" ] || die "no such file: $file"
+    # url/path values can carry a `"`; escape before it reaches the quoted
+    # scalar the writer emits.
+    value="$(_yq_esc "$value")"
     _qmap_stage "$file" -v block="$block" -v key="$key" -v field="$field" -v value="$value" '
         function keyline()   { return "  \"" key "\":" }
         function fieldline() { return "    " field ": \"" value "\"" }
@@ -163,6 +173,7 @@ qmap_set() {
 qmap_set_value() {
     local file="$1" block="$2" key="$3" value="$4"
     [ -f "$file" ] || die "no such file: $file"
+    value="$(_yq_esc "$value")"
     _qmap_stage "$file" -v block="$block" -v key="$key" -v value="$value" '
         function entry() { return "  \"" key "\": \"" value "\"" }
         { sub(/\r$/, "") }
@@ -282,6 +293,14 @@ registries_remove() {
         { print }
     '
 }
+# True (0) if <config> already lists <entry> under any sources section. Quoted
+# and bare spellings both count - a manifest may hold either.
+_mig_has_source() {
+    local config="$1" entry="$2"
+    [ -f "$config" ] || return 1
+    grep -Fq -- "\"$entry\"" "$config" || grep -Fq -- "- $entry" "$config"
+}
+
 
 # sources_add_entry_first <file> <section> <entry> — idempotent insert at the
 # TOP of sources.<section> (creating sources:/section as needed). Package
@@ -313,7 +332,7 @@ sources_add_entry_first() {
 }
 
 # sources_remove_entry <file> <section> <entry> — remove `- "entry"` from
-# sources.<section>. Inverse of the engine-side _mig_add_source.
+# sources.<section>.
 sources_remove_entry() {
     local file="$1" section="$2" entry="$3"
     [ -f "$file" ] || return 0

package/cli/lib/registry.sh

@@ -21,16 +21,26 @@
 # _fetch_index <registry-repo-url> — clones the registry repo (shallow) and
 # prints the path of its index.yaml; empty on failure. Cached per run+url.
 _fetch_index() {
-    local url="$1" cache key tmp
-    cache="${TMPDIR:-/tmp}/intelligence-cli-index-$$"
+    local url="$1" key tmp
+    assert_safe_source_url "$url"
+    # Per-run private cache dir under an UNPREDICTABLE mktemp path (a fixed
+    # /tmp/...-$$ would be trusted on cache hit and pre-creatable by others).
+    # No EXIT trap: _fetch_index is always called inside $( ), so a trap would
+    # fire in that subshell and delete the dir before the caller reads it. The
+    # dir is small and OS-reaped from the temp root; IS_REMOTE_CACHE-style
+    # persistence is exported so repeated calls in one command share it.
+    if [ -z "${IS_CLI_INDEX_CACHE:-}" ]; then
+        IS_CLI_INDEX_CACHE="$(mktemp -d -t intelligence-cli-index-XXXXXX 2>/dev/null || mktemp -d)"
+        export IS_CLI_INDEX_CACHE
+    fi
+    local cache="$IS_CLI_INDEX_CACHE"
     key="$(printf '%s' "$url" | cksum | awk '{print $1}')"
     if [ -f "$cache/$key/index.yaml" ]; then
         printf '%s' "$cache/$key/index.yaml"
         return 0
     fi
-    mkdir -p "$cache"
     tmp="$cache/$key"
-    if GIT_TERMINAL_PROMPT=0 git -c core.autocrlf=false clone --depth 1 --quiet "$url" "$tmp" 2>/dev/null \
+    if GIT_TERMINAL_PROMPT=0 git -c core.autocrlf=false clone --depth 1 --quiet -- "$url" "$tmp" 2>/dev/null \
         && [ -f "$tmp/index.yaml" ]; then
         printf '%s' "$tmp/index.yaml"
     fi
@@ -103,6 +113,8 @@ suggest_similar() {
 # store holds the bytes the package published.
 fetch_package() {
     local url="$1" ref="$2" subpath="$3" dest="$4"
+    assert_safe_source_url "$url"
+    assert_safe_ref "$ref"
     # Bundle seed: the engine-content package at the CLI's own version copies
     # from the npm bundle — no network, which keeps init / fresh-clone install
     # / migrate offline exactly like the staging they replace. Keyed on the
@@ -110,12 +122,14 @@ fetch_package() {
     # to the normal clone.
     if [ "$url" = "$SYNC_PKG_URL" ] && [ "$subpath" = "$SYNC_PKG_PATH" ] \
         && [ "${ref#v}" = "$(bundled_engine_version)" ]; then
+        [ -n "${IS_BUNDLED_PKG_DIR:-}" ] && [ -d "$IS_BUNDLED_PKG_DIR" ] \
+            || die "bundled engine content not found next to the CLI — reinstall @ainova-systems/intelligence"
         rm -rf "$dest"
         mkdir -p "$dest"
-        cp -R "$IS_ENGINE_DIR/." "$dest/"
+        cp -R "$IS_BUNDLED_PKG_DIR/." "$dest/"
         rm -rf "$dest/.git"
-        if [ -f "$IS_ENGINE_DIR/scripts/ENGINE_SHA" ]; then
-            tr -d ' \t\r\n' < "$IS_ENGINE_DIR/scripts/ENGINE_SHA"
+        if [ -f "$IS_ENGINE_DIR/ENGINE_SHA" ]; then
+            tr -d ' \t\r\n' < "$IS_ENGINE_DIR/ENGINE_SHA"
         fi
         return 0
     fi
@@ -124,20 +138,20 @@ fetch_package() {
     [ -n "$ref" ] && branch_arg=(--branch "$ref")
     tmp="$(mktemp -d -t intelligence-pkg-XXXXXX 2>/dev/null || mktemp -d)"
     if ! GIT_TERMINAL_PROMPT=0 git -c core.symlinks=false -c core.autocrlf=false -c core.eol=lf \
-            clone --depth 1 "${branch_arg[@]+"${branch_arg[@]}"}" --quiet "$url" "$tmp/clone" 2>/dev/null; then
+            clone --depth 1 "${branch_arg[@]+"${branch_arg[@]}"}" --quiet -- "$url" "$tmp/clone" 2>/dev/null; then
         # A SHA is not clonable with --branch — fall back to a full clone + checkout.
         rm -rf "$tmp/clone"
         GIT_TERMINAL_PROMPT=0 git -c core.symlinks=false -c core.autocrlf=false -c core.eol=lf \
-            clone --quiet "$url" "$tmp/clone" 2>/dev/null \
+            clone --quiet -- "$url" "$tmp/clone" 2>/dev/null \
             || { rm -rf "$tmp"; die "cannot clone $url"; }
-        [ -z "$ref" ] || git -C "$tmp/clone" checkout --quiet "$ref" \
+        [ -z "$ref" ] || git -C "$tmp/clone" checkout --quiet "$ref" -- \
             || { rm -rf "$tmp"; die "ref '$ref' not found in $url"; }
     fi
     sha="$(git -C "$tmp/clone" rev-parse HEAD)"
     src="$tmp/clone"
     if [ -n "$subpath" ]; then
         case "$subpath" in
-            *..*) rm -rf "$tmp"; die "unsafe path '$subpath'" ;;
+            *..*|/*|*[\"\']*) rm -rf "$tmp"; die "unsafe path '$subpath'" ;;
         esac
         src="$tmp/clone/$subpath"
         [ -d "$src" ] || { rm -rf "$tmp"; die "path '$subpath' not found in $url${ref:+@$ref}" ; }

package/cli/lib/semver.sh

@@ -75,10 +75,11 @@ semver_match() {
 # onto their tag.
 list_remote_versions() {
     local url="$1"
+    assert_safe_source_url "$url"
     # `|| true` inside the pipeline: an unreachable repo must read as "no
     # versions", not kill a pipefail caller mid-command-substitution —
     # reachability is the CALLER's question (add probes it explicitly).
-    { GIT_TERMINAL_PROMPT=0 git ls-remote --tags "$url" 2>/dev/null || true; } \
+    { GIT_TERMINAL_PROMPT=0 git ls-remote --tags -- "$url" 2>/dev/null || true; } \
         | awk '{
             sub(/\r$/, "")
             ref = $2
@@ -95,7 +96,8 @@ list_remote_versions() {
 # prints "<tag> <sha>". Peeled sha (the commit a tag object points at) wins.
 remote_tag_for_version() {
     local url="$1" ver="${2#v}"
-    { GIT_TERMINAL_PROMPT=0 git ls-remote --tags "$url" 2>/dev/null || true; } \
+    assert_safe_source_url "$url"
+    { GIT_TERMINAL_PROMPT=0 git ls-remote --tags -- "$url" 2>/dev/null || true; } \
         | awk -v want="$ver" '
             {
                 sub(/\r$/, "")

package/engine/ENGINE_SHA

@@ -0,0 +1 @@
+557cde6997dce612e0e8a5a11adc2472173dcec0