@ainova-systems/intelligence 0.11.0-rc.6 → 0.11.0-rc.8

package/cli/commands/update.sh

@@ -1,78 +1,93 @@
 #!/bin/bash
-# intelligence update [name] [--no-sync]
+# intelligence update [@scope/name] [--preview|--apply]
 #
-# Re-resolve version ranges against the remotes and rewrite the lock. Pinned
-# packages (`ref:`) never move here — repin by editing the manifest or
-# re-adding. `update <name>` limits the pass to one package.
+# One update surface: show the installed-CLI/project/package plan, then either
+# stop, ask interactively, or apply without a prompt. Updating the global npm
+# installation remains an explicit package-manager operation.
 set -euo pipefail
 source "$CLI_DIR/lib/cli-common.sh"
 
-only="" no_sync=0
+only="" mode="ask" preview_seen=0 apply_seen=0
 while [ $# -gt 0 ]; do
     case "$1" in
-        --no-sync) no_sync=1 ;;
-        @*) only="$1" ;;
-        *) die "unknown argument '$1'" ;;
+        --preview) preview_seen=1; mode="preview" ;;
+        --apply) apply_seen=1; mode="apply" ;;
+        @*) [ -z "$only" ] || die "only one package may be selected"; only="$1" ;;
+        *) die "usage: intelligence update [@scope/name] [--preview|--apply]" ;;
     esac
-    shift || true
+    shift
 done
+[ "$preview_seen" -eq 0 ] || [ "$apply_seen" -eq 0 ] || die "choose either --preview or --apply"
 
 require_v2
 manifest="$IP_ROOT/intelligence.yaml"
-lock="$IP_ROOT/intelligence.lock"
+check_version_compat "$manifest"
+eng="$(bundled_engine_version)"
+stamp="$(read_schema_version "$manifest")"
+project_change=0
 
-moved=0 found=0
-while IFS= read -r name; do
-    [ -n "$name" ] || continue
-    [ -n "$only" ] && [ "$name" != "$only" ] && continue
-    # A named package that exists is "found" whatever happens next — a skip
-    # message followed by "not in the manifest" would contradict itself.
-    found=1
-    if [ "$name" = "$SYNC_PKG_NAME" ]; then
-        echo "  $name: engine content moves with the engine — 'intelligence upgrade' owns it"
-        continue
+echo "Update plan"
+echo ""
+echo "CLI:"
+if [ -n "${INTELLIGENCE_NPM_VERSION:-}" ] && [ "${IS_SKIP_NPM_CHECK:-0}" != "1" ] && command -v npm >/dev/null 2>&1; then
+    channel="latest"
+    case "$INTELLIGENCE_NPM_VERSION" in *-*) channel="next" ;; esac
+    available="$(npm view "@ainova-systems/intelligence" "dist-tags.$channel" 2>/dev/null || true)"
+    if [ -z "$available" ]; then
+        echo "  installed: $INTELLIGENCE_NPM_VERSION; registry check unavailable"
+    elif [ "$available" = "$INTELLIGENCE_NPM_VERSION" ]; then
+        echo "  $INTELLIGENCE_NPM_VERSION (up to date on npm $channel)"
+    else
+        echo "  $INTELLIGENCE_NPM_VERSION -> $available (npm $channel)"
+        echo "  run: npm install -g @ainova-systems/intelligence@$channel"
+        echo "  then rerun: intelligence update --apply"
     fi
-    ref="$(qmap_field "$manifest" "packages" "$name" "ref")"
-    [ -n "$ref" ] && { echo "  $name: pinned to ref '$ref' — skipped"; continue; }
-    range="$(qmap_field "$manifest" "packages" "$name" "version")"
-    # An exact version is a pin, same as ref: — update never moves pins.
-    if [ -n "$range" ] && semver_is_stable "$range"; then
-        echo "  $name: pinned to $range — edit the manifest to move it"
-        continue
-    fi
-    url="$(qmap_field "$manifest" "packages" "$name" "url")"
-    path="$(qmap_field "$manifest" "packages" "$name" "path")"
-    if [ -z "$url" ]; then
-        resolve_package_source "$manifest" "$name"
-        url="$RES_URL"; path="$RES_PATH"
-    fi
-    picked="$(list_remote_versions "$url" | semver_pick_highest "$range")"
-    [ -n "$picked" ] || { echo "  $name: nothing satisfies '${range:-*}' at $url" >&2; continue; }
-    read -r tag _ <<< "$(remote_tag_for_version "$url" "$picked")"
-    current="$(qmap_field "$lock" "packages" "$name" "resolved")"
-    cur_url="$(qmap_field "$lock" "packages" "$name" "url")"
-    cur_path="$(qmap_field "$lock" "packages" "$name" "path")"
-    # Same tag is not enough: a registry may re-point a name's source while
-    # keeping the version — the move doctor warns about must be actionable
-    # here, so url/path changes refetch too.
-    if [ "$tag" = "$current" ] && [ "$url" = "$cur_url" ] && [ "$path" = "$cur_path" ]; then
-        echo "  $name: ${current:-<none>} (up to date)"
-        continue
-    fi
-    rel=".intelligence/packages/$name"
-    # The new version may have dropped a top-level section dir: unwire the old
-    # shape first, or a dangling store-backed source bricks the next sync.
-    unwire_package_sources "$manifest" "$rel"
-    sha="$(fetch_package "$url" "$tag" "$path" "$IP_ROOT/$rel")"
-    wire_package_sources "$manifest" "$name" "$rel" "$IP_ROOT"
-    lock_upsert "$lock" "$name" "$range" "$url" "$path" "$tag" "$sha"
-    echo "  $name: ${current:-<none>} -> $tag"
-    moved=$((moved + 1))
-done < <(qmap_keys "$manifest" "packages")
+else
+    echo "  source checkout/registry check skipped; engine $eng"
+fi
+
+echo ""
+echo "Project:"
+if project_needs_upgrade "$IP_ROOT"; then
+    echo "  lifecycle alignment required (stamp ${stamp:-unstamped}, engine $eng)"
+    project_change=1
+else
+    echo "  schema/content $eng (up to date)"
+fi
 
-[ -n "$only" ] && [ "$found" -eq 0 ] && die "package '$only' is not in the manifest"
-echo "updated: $moved package(s)"
+if project_has_packages "$IP_ROOT" && [ ! -f "$IP_ROOT/intelligence.lock" ]; then
+    die "manifest declares packages but intelligence.lock is absent — restore the committed lock before planning or applying updates"
+fi
+
+pkg_args=(--preview)
+[ -z "$only" ] || pkg_args+=("$only")
+pkg_plan="$(bash "$CLI_DIR/internal/package-update.sh" "${pkg_args[@]}")"
+echo ""
+echo "Packages:"
+printf '%s\n' "$pkg_plan"
+package_changes="$(printf '%s\n' "$pkg_plan" | awk '/^updates available:/ {print $3; exit}')"
+package_changes="${package_changes:-0}"
 
-if [ "$moved" -gt 0 ] && [ "$no_sync" -eq 0 ]; then
-    exec bash "$CLI_DIR/commands/sync.sh"
+if [ "$mode" = "preview" ]; then
+    exit 0
+fi
+if [ "$project_change" -eq 0 ] && [ "$package_changes" -eq 0 ]; then
+    echo ""
+    echo "Nothing to apply with the currently installed CLI."
+    exit 0
 fi
+if [ "$mode" = "ask" ]; then
+    [ -t 0 ] || die "update requires confirmation — rerun with --preview or --apply"
+    printf '\nApply this plan? [Y/n] '
+    read -r answer
+    case "$answer" in
+        ""|y|Y|yes|YES) ;;
+        *) echo "update cancelled"; exit 0 ;;
+    esac
+fi
+
+ensure_project_current "$IP_ROOT"
+apply_args=(--no-sync)
+[ -z "$only" ] || apply_args+=("$only")
+bash "$CLI_DIR/internal/package-update.sh" "${apply_args[@]}"
+exec bash "$CLI_DIR/commands/sync.sh"

package/cli/engine-package.yaml

@@ -6,9 +6,9 @@
 # The engine-content package is the one package whose content documents the
 # engine scripts bundled with the CLI: init writes this entry into the
 # manifest (visible, removable), its pin always equals the engine VERSION,
-# `upgrade` moves it, and at the matching version it materializes from the
-# bundle without network.
+# lifecycle preflight aligns it with the installed CLI, and at the matching
+# version it materializes from the bundle without network.
 name: "@ainova-systems/sync"
-url: "https://github.com/ainova-systems/intelligence-sync.git"
-path: "intelligence/sync"
+url: "https://github.com/ainova-systems/intelligence.git"
+path: "packages/sync"
 default_registry: "https://github.com/ainova-systems/intelligence-registry.git"

package/cli/intelligence

@@ -3,25 +3,20 @@
 #
 # Dispatcher only: each command lives in commands/<name>.sh so commands can be
 # ported to Node one at a time without touching the others. The engine is the
-# vendored bash engine bundled next to the CLI (npm package) or, when running
-# from the intelligence-sync repo itself, the repo's own module.
+# bash engine shipped next to the CLI.
 
 set -euo pipefail
 
 CLI_DIR="$(cd "$(dirname "$0")" && pwd)"
 export CLI_DIR
 
-# Engine discovery, by role (scripts/sync.sh + scripts/VERSION), never by
-# guessing names beyond the two shipped layouts:
-#   1. npm package:  <pkg>/cli/intelligence + <pkg>/engine/scripts/
-#   2. this repo:    <repo>/cli/intelligence + <repo>/intelligence/sync/scripts/
+# Engine discovery, by role (sync.sh + VERSION). The repo and the npm package
+# ship one layout — <root>/{cli,engine,packages/sync} — so there is a single
+# candidate rather than a per-distribution list.
 IS_ENGINE_DIR=""
-for _cand in "$CLI_DIR/../engine" "$CLI_DIR/../intelligence/sync"; do
-    if [ -f "$_cand/scripts/sync.sh" ] && [ -f "$_cand/scripts/VERSION" ]; then
-        IS_ENGINE_DIR="$(cd "$_cand" && pwd)"
-        break
-    fi
-done
+if [ -f "$CLI_DIR/../engine/sync.sh" ] && [ -f "$CLI_DIR/../engine/VERSION" ]; then
+    IS_ENGINE_DIR="$(cd "$CLI_DIR/../engine" && pwd)"
+fi
 if [ -z "$IS_ENGINE_DIR" ]; then
     echo "ERROR: bundled sync engine not found next to the CLI ($CLI_DIR)." >&2
     echo "       Reinstall: npm i -g @ainova-systems/intelligence" >&2
@@ -29,41 +24,56 @@ if [ -z "$IS_ENGINE_DIR" ]; then
 fi
 export IS_ENGINE_DIR
 
+# The engine's own content, shipped beside the engine as the seed for the
+# @ainova-systems/sync package at exactly this CLI's version. Separate from the
+# engine dir: the store must receive rules/agents/skills, never engine scripts.
+IS_BUNDLED_PKG_DIR=""
+if [ -d "$CLI_DIR/../packages/sync" ]; then
+    IS_BUNDLED_PKG_DIR="$(cd "$CLI_DIR/../packages/sync" && pwd)"
+fi
+export IS_BUNDLED_PKG_DIR
+
 cmd="${1:-}"
 case "$cmd" in
     ""|help|-h|--help)
-        engine_ver="$(tr -d ' \t\r\n' < "$IS_ENGINE_DIR/scripts/VERSION")"
+        engine_ver="$(tr -d ' \t\r\n' < "$IS_ENGINE_DIR/VERSION")"
         cat <<EOF
 intelligence — build, version and distribute AI agent intelligence
 (engine $engine_ver${INTELLIGENCE_NPM_VERSION:+, package $INTELLIGENCE_NPM_VERSION})
 
 Usage: intelligence <command> [args]
 
-  init                    Set up this project (manifest, content skeleton, targets)
-  add <spec>              Add a package: @scope/name[@range] | github:org/repo[#path] | git+<url>[@ref][#path]
-  remove <name>           Remove a package
-  install [--frozen]      Restore .intelligence/ exactly from intelligence.lock
-  update [name]           Re-resolve version ranges and rewrite the lockfile
-  upgrade                 Upgrade the project to this CLI's engine (restage + restamp)
-  list                    Installed packages with requested/locked versions
-  search [term]           What the registries offer, and what this project has
-  sync [target]           Render intelligence to every enabled tool (.claude, AGENTS.md, ...)
-  registry <list|add|remove>  Bind a scope to a registry index
-  migrate [--dry-run]     Convert a vendored (v1) setup to the CLI setup
-  doctor                  Check manifest, lockfile, store and engine consistency
-  status                  Project state at a glance
+  init [--preview|--apply]  Initialize, migrate, restore or align this project
+    --targets a,b --dir name --bare --no-sync   New-project options
+    --force               Accept a dirty worktree during v1 conversion
+  sync [adapter]          Restore locked content if needed, then render enabled adapters
+  update [@scope/name]    Show an update plan; ask before applying it
+    --preview             Show the plan without asking or writing
+    --apply               Apply the plan without asking
+  package <command>       add | remove | list | search
+  adapter <command>       list | create | enable | disable | remove
+  status [--check]        Project state; --check runs deep consistency checks
+  registry <list|add|remove>  Manage the trusted registry list (add <repo-url>)
   version                 Print CLI and engine versions
 EOF
         exit 0
         ;;
     version|-v|--version)
-        engine_ver="$(tr -d ' \t\r\n' < "$IS_ENGINE_DIR/scripts/VERSION")"
+        engine_ver="$(tr -d ' \t\r\n' < "$IS_ENGINE_DIR/VERSION")"
         echo "${INTELLIGENCE_NPM_VERSION:-$engine_ver} (engine $engine_ver)"
         exit 0
         ;;
 esac
 shift
 
+# The command word builds a path — allow exactly lowercase words, so
+# `intelligence ../x` can never exec a neighbouring script.
+case "$cmd" in
+    *[!a-z-]*|-*)
+        echo "ERROR: unknown command '$cmd'. Run 'intelligence help'." >&2
+        exit 1
+        ;;
+esac
 cmd_file="$CLI_DIR/commands/$cmd.sh"
 if [ ! -f "$cmd_file" ]; then
     echo "ERROR: unknown command '$cmd'. Run 'intelligence help'." >&2

package/cli/{commands/doctor.sh → internal/check.sh}

@@ -1,5 +1,5 @@
 #!/bin/bash
-# intelligence doctor — consistency checks, no writes. Exit 1 on problems.
+# Internal deep consistency check. No writes; exits 1 on problems.
 set -euo pipefail
 source "$CLI_DIR/lib/cli-common.sh"
 
@@ -22,7 +22,7 @@ case "$IP_MODE" in
     legacy)
         echo "project: vendored (v1) at $IP_ROOT"
         ok "vendored engine $(tr -d ' \t\r\n' < "$IP_MODULE_DIR/scripts/VERSION")"
-        echo "  → 'intelligence migrate' converts it to the CLI setup"
+        echo "  → 'intelligence init' converts it to the CLI setup"
         exit 0
         ;;
 esac
@@ -31,16 +31,16 @@ echo "project: $IP_ROOT"
 manifest="$IP_ROOT/intelligence.yaml"
 lock="$IP_ROOT/intelligence.lock"
 
-stamp="$(read_engine_stamp "$manifest")"
+stamp="$(read_schema_version "$manifest")"
 eng="$(bundled_engine_version)"
 if [ -z "$stamp" ]; then
-    warn "manifest has no sync_version — run 'intelligence upgrade'"
+    warn "manifest has no schema_version — run 'intelligence init'"
 elif _ver_gt "$stamp" "$eng"; then
     warn "manifest schema $stamp is newer than this CLI's engine $eng — update the CLI: npm i -g @ainova-systems/intelligence@latest"
 elif _ver_gt "$eng" "$stamp"; then
-    warn "manifest schema $stamp behind engine $eng — run 'intelligence upgrade'"
+    warn "manifest schema $stamp behind engine $eng — run 'intelligence init'"
 else
-    ok "sync_version $stamp matches the engine"
+    ok "schema_version $stamp matches the engine"
 fi
 
 # The engine-content package must sit at the bundled engine version — the
@@ -50,11 +50,11 @@ if [ -n "$sync_locked" ]; then
     if [ "${sync_locked#v}" = "$eng" ]; then
         ok "$SYNC_PKG_NAME at $sync_locked (matches the engine)"
     else
-        warn "$SYNC_PKG_NAME locked at $sync_locked but the engine is $eng — run 'intelligence upgrade'"
+        warn "$SYNC_PKG_NAME locked at $sync_locked but the engine is $eng — run 'intelligence init'"
     fi
 fi
 if [ -d "$IP_ROOT/.intelligence/engine" ]; then
-    warn "stale .intelligence/engine directory (pre-package layout) — run 'intelligence upgrade'"
+    warn "stale .intelligence/engine directory (pre-package layout) — run 'intelligence init'"
 fi
 
 # Manifest packages: names valid, locked, installed — and the lock's source
@@ -64,16 +64,34 @@ while IFS= read -r name; do
     [ -n "$name" ] || continue
     assert_valid_pkg_name "$name"
     if [ -z "$(qmap_field "$lock" "packages" "$name" "url")" ]; then
-        warn "$name is in the manifest but not in intelligence.lock — run 'intelligence install'"
-    elif [ ! -d "$IP_ROOT/.intelligence/packages/$name" ]; then
-        warn "$name is locked but not installed — run 'intelligence install'"
+        warn "$name is in the manifest but not in intelligence.lock — run 'intelligence init'"
     else
+        m_ver="$(qmap_field "$manifest" "packages" "$name" "version")"
+        m_ref="$(qmap_field "$manifest" "packages" "$name" "ref")"
+        m_url="$(qmap_field "$manifest" "packages" "$name" "url")"
+        m_path="$(qmap_field "$manifest" "packages" "$name" "path")"
+        l_req="$(qmap_field "$lock" "packages" "$name" "requested")"
+        l_res="$(qmap_field "$lock" "packages" "$name" "resolved")"
+        l_url="$(qmap_field "$lock" "packages" "$name" "url")"
+        l_path="$(qmap_field "$lock" "packages" "$name" "path")"
+        [ -z "$m_ver" ] || [ "$m_ver" = "$l_req" ] \
+            || warn "$name requests '$m_ver' but the lock recorded '$l_req' — run 'intelligence update --preview'"
+        [ -z "$m_ref" ] || [ "$m_ref" = "$l_res" ] \
+            || warn "$name pins ref '$m_ref' but the lock resolved '$l_res'"
+        [ -z "$m_url" ] || [ "$m_url" = "$l_url" ] \
+            || warn "$name declares url '$m_url' but the lock recorded '$l_url'"
+        [ -z "$m_path" ] || [ "$m_path" = "$l_path" ] \
+            || warn "$name declares path '$m_path' but the lock recorded '$l_path'"
+        if [ ! -d "$IP_ROOT/.intelligence/packages/$name" ]; then
+            warn "$name is locked but not installed — run 'intelligence sync'"
+            continue
+        fi
         ok "$name @ $(qmap_field "$lock" "packages" "$name" "resolved")"
         if [ -z "$(qmap_field "$manifest" "packages" "$name" "url")" ]; then
             locked_url="$(qmap_field "$lock" "packages" "$name" "url")"
             resolve_package_source "$manifest" "$name" 2>/dev/null || true
             if [ -n "${RES_URL:-}" ] && [ -n "$locked_url" ] && [ "$RES_URL" != "$locked_url" ]; then
-                warn "$name now resolves to $RES_URL but the lock pins $locked_url — a registry re-pointed the name; verify before 'intelligence update'"
+                warn "$name now resolves to $RES_URL but the lock pins $locked_url — a registry re-pointed the name; verify with 'intelligence update --preview'"
             fi
         fi
     fi
@@ -87,7 +105,7 @@ if [ -f "$lock" ]; then
         while IFS= read -r m; do
             [ "$m" = "$name" ] && found=1
         done < <(qmap_keys "$manifest" "packages")
-        [ "$found" -eq 1 ] || warn "$name is locked but absent from the manifest — 'intelligence remove $name' cleans it up"
+        [ "$found" -eq 1 ] || warn "$name is locked but absent from the manifest — 'intelligence package remove $name' cleans it up"
     done < <(qmap_keys "$lock" "packages")
 fi
 
@@ -102,7 +120,7 @@ for section in rules agents skills; do
         if [ ! -d "$IP_ROOT/$src" ]; then
             case "$src" in
                 # Store content is restorable state: absent means un-installed.
-                .intelligence/*) warn "sources.$section '$src' missing — run 'intelligence install'" ;;
+                .intelligence/*) warn "sources.$section '$src' missing — run 'intelligence sync'" ;;
                 # A project-owned dir that does not exist yet is a legitimate
                 # state — a project consuming only packages authors nothing of
                 # its own — and the engine simply skips it. Declared up front so