@ainova-systems/intelligence 0.11.0-rc.6 → 0.11.0-rc.8

package/cli/internal/target-state.sh

@@ -0,0 +1,57 @@
+#!/bin/bash
+# Internal adapter target-state operation.
+#
+# Change only the manifest. Syncing and deleting generated output are separate
+# explicit actions: a generic target command cannot infer a custom adapter's
+# ownership safely.
+set -euo pipefail
+source "$CLI_DIR/lib/cli-common.sh"
+
+action="${1:-}"
+name="${2:-}"
+[ $# -le 2 ] || die "internal target state: expected <enable|disable> <name>"
+case "$action" in enable|disable) ;; *) die "internal target state: expected <enable|disable> <name>" ;; esac
+[ -n "$name" ] || die "internal target state: missing adapter name"
+assert_valid_target_name "$name"
+
+require_v2
+manifest="$IP_ROOT/intelligence.yaml"
+content_dir="$(manifest_intelligence_dir "$manifest")"
+
+if [ "$action" = "enable" ]; then
+    project_adapter="$IP_ROOT/$content_dir/adapters/$name.sh"
+    bundled_adapter="$IS_ENGINE_DIR/adapters/$name.sh"
+    if [ ! -f "$project_adapter" ] && [ ! -f "$bundled_adapter" ]; then
+        die "adapter '$name' not found — create it first: intelligence adapter create $name"
+    fi
+
+    # These adapters intentionally omit always-on rules because their tools
+    # read AGENTS.md. Do not create a manifest that full sync must refuse.
+    case "$name" in
+        cursor|copilot|codex|pi|opencode)
+            if [ "$(is_target_enabled "$manifest" "agents")" != "1" ]; then
+                die "target '$name' requires target 'agents' — enable it first"
+            fi
+            ;;
+    esac
+
+    output="$(get_target_output "$manifest" "$name")"
+    [ -n "$output" ] || output="$(default_target_output "$name")"
+    target_set_enabled "$manifest" "$name" true "$output"
+    echo "enabled: $name (output: $output)"
+    exit 0
+fi
+
+target_exists "$manifest" "$name" || die "target '$name' is not in the manifest"
+if [ "$name" = "agents" ]; then
+    for dependent in cursor copilot codex pi opencode; do
+        if [ "$(is_target_enabled "$manifest" "$dependent")" = "1" ]; then
+            die "target 'agents' is required by enabled target '$dependent' — disable '$dependent' first"
+        fi
+    done
+fi
+output="$(get_target_output "$manifest" "$name")"
+[ -n "$output" ] || output="$(default_target_output "$name")"
+target_set_enabled "$manifest" "$name" false "$output"
+echo "disabled: $name"
+echo "  generated output was kept; remove only paths owned by this adapter"

package/cli/{commands/upgrade.sh → internal/upgrade-v2.sh}

@@ -1,17 +1,34 @@
 #!/bin/bash
-# intelligence upgrade — bring the project to this CLI's engine: apply v2
+# Internal: bring the project to this CLI's engine: apply v2
 # schema migrations, align the engine-content package to the bundled version,
-# restamp sync_version, sync.
+# restamp schema_version, sync.
 set -euo pipefail
 source "$CLI_DIR/lib/cli-common.sh"
 
+no_sync=0
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --no-sync) no_sync=1 ;;
+        *) die "internal upgrade: unknown option '$1'" ;;
+    esac
+    shift
+done
+
 require_v2
 manifest="$IP_ROOT/intelligence.yaml"
 
-stamp="$(read_engine_stamp "$manifest")"
+stamp="$(read_schema_version "$manifest")"
+legacy_stamp="$(top_scalar "$manifest" "sync_version")"
+schema_key_count="$(awk '/^schema_version:[[:space:]]*/ { n++ } END { print n + 0 }' "$manifest")"
+legacy_key_count="$(awk '/^sync_version:[[:space:]]*/ { n++ } END { print n + 0 }' "$manifest")"
 eng="$(bundled_engine_version)"
+[ "$schema_key_count" -le 1 ] || die "manifest has duplicate schema_version keys"
+[ "$legacy_key_count" -le 1 ] || die "manifest has duplicate sync_version keys"
 if [ -n "$stamp" ] && _ver_gt "$stamp" "$eng"; then
-    die "manifest schema $stamp is newer than this CLI's engine $eng — update the CLI first: npm i -g @ainova-systems/intelligence@latest"
+    die "manifest schema $stamp is newer than this CLI's engine $eng — update the global CLI first"
+fi
+if [ -n "$legacy_stamp" ] && _ver_gt "$legacy_stamp" "$eng"; then
+    die "manifest schema $legacy_stamp is newer than this CLI's engine $eng — update the global CLI first"
 fi
 
 # --- v2 schema migrations -------------------------------------------------
@@ -19,6 +36,19 @@ fi
 # Same discipline: ascending, append-only, each migration self-detects and
 # no-ops when already applied.
 
+# v2 migration 0: the original RC manifest called the permanent schema key
+# `sync_version`. Rename it without changing its value; the final stamp below
+# then aligns it with this engine. The archived v1 reader remains separate.
+if [ -n "$legacy_stamp" ]; then
+    if [ -n "$stamp" ]; then
+        [ "$stamp" = "$legacy_stamp" ] || die "manifest has conflicting schema_version '$stamp' and sync_version '$legacy_stamp'"
+        _qmap_stage "$manifest" '$0 !~ /^sync_version:[[:space:]]*/'
+    else
+        _qmap_stage "$manifest" '{ sub(/^sync_version:/, "schema_version:"); print }'
+    fi
+    echo "  migrating: sync_version -> schema_version"
+fi
+
 # v2 migration 1: staged engine content -> the @ainova-systems/sync package.
 # Pre-package manifests listed `.intelligence/engine/{rules,agents,skills}`
 # as sources fed by a CLI-staged copy; that copy is now an ordinary package
@@ -59,10 +89,20 @@ if [ "$have_pkg" -eq 1 ] && [ "$migrated" -eq 0 ]; then
     sync_pkg_install "$IP_ROOT"
 fi
 if [ "$have_pkg" -eq 0 ] && [ "$migrated" -eq 0 ]; then
-    echo "  NOTE: $SYNC_PKG_NAME is not in this manifest (bare setup) — engine meta-skills stay uninstalled; 'intelligence add $SYNC_PKG_NAME' opts back in." >&2
+    echo "  NOTE: $SYNC_PKG_NAME is not in this manifest (bare setup) — engine meta-skills stay uninstalled; 'intelligence package add $SYNC_PKG_NAME' opts back in." >&2
 fi
 
-stamp_version "$manifest" "$eng"
-echo "  sync_version -> $eng"
+# A previous RC could leave this managed directory even after its source
+# entries were already removed. Its presence is itself an upgrade predicate,
+# so always close that post-condition.
+if [ -d "$IP_ROOT/.intelligence/engine" ]; then
+    rm -rf "$IP_ROOT/.intelligence/engine"
+    echo "  removed stale .intelligence/engine"
+fi
 
-exec bash "$CLI_DIR/commands/sync.sh"
+stamp_schema_version "$manifest" "$eng"
+echo "  schema_version -> $eng"
+
+if [ "$no_sync" -eq 0 ]; then
+    exec bash "$CLI_DIR/commands/sync.sh"
+fi

package/cli/lib/cli-common.sh

@@ -7,18 +7,45 @@
 # CLI-owned parsing lives in lib/manifest.sh (quoted-key `packages:` /
 # `registries:` blocks, which the engine deliberately never reads).
 
-# Engine libraries (readers, is_status, IS_RC_*, engine_version). Sourced in
-# the same order sync.sh uses. CLI_DIR / IS_ENGINE_DIR come exported from the
-# dispatcher.
-source "$IS_ENGINE_DIR/scripts/lib/common.sh"
-source "$IS_ENGINE_DIR/scripts/lib/layout.sh"
-source "$IS_ENGINE_DIR/scripts/lib/migrations.sh"
+# Engine libraries (readers, is_status, IS_RC_*, engine_version). CLI_DIR /
+# IS_ENGINE_DIR come exported from the dispatcher.
+source "$IS_ENGINE_DIR/lib/common.sh"
+source "$IS_ENGINE_DIR/lib/contract.sh"
 
 die() {
     echo "ERROR: $*" >&2
     exit 1
 }
 
+# --- Untrusted-input guards ----------------------------------------------
+# Manifest, lock and registry indexes arrive with a cloned repo: every value
+# they carry is attacker-adjacent. URLs and refs reach git argv (a leading
+# `-` would be an option — `--upload-pack=<cmd>` is code execution), names
+# become store paths fed to rm -rf. Guard at the choke points, loudly.
+
+# assert_safe_source_url <url> — scheme allowlist (the engine's own list) or
+# scp-like user@host:path; never option-shaped, never quote-bearing.
+assert_safe_source_url() {
+    local url="$1"
+    case "$url" in
+        ""|-*) die "unsafe source url '$url' — option-shaped or empty" ;;
+        *[\"\'\ ]*) die "unsafe source url '$url' — quotes or spaces" ;;
+        https://*|http://*|ssh://*|git://*|file://*) ;;
+        *@*:*) ;;
+        *) die "unsafe source url '$url' — allowed: https, http, ssh, git, file, or user@host:path" ;;
+    esac
+}
+
+# assert_safe_ref <ref-or-empty> — tags/branches/SHAs; never option-shaped.
+assert_safe_ref() {
+    local ref="$1"
+    [ -z "$ref" ] && return 0
+    case "$ref" in
+        -*) die "unsafe git ref '$ref' — option-shaped" ;;
+        *[\"\'\ \\]*) die "unsafe git ref '$ref'" ;;
+    esac
+}
+
 source "$CLI_DIR/lib/manifest.sh"
 source "$CLI_DIR/lib/semver.sh"
 source "$CLI_DIR/lib/registry.sh"
@@ -27,8 +54,8 @@ source "$CLI_DIR/lib/lockfile.sh"
 # The engine-content package: OPTIONAL but auto-selected at init. Package by
 # UX (manifest entry, lockfile row, list/search/remove), bundle by mechanics —
 # at the version the CLI ships, it materializes from the npm bundle without
-# network; only a cross-version install reaches git. The pin is held exactly
-# at the bundled engine version and moved only by `upgrade`.
+# network; only a cross-version acquisition reaches git. The pin is held
+# exactly at the bundled engine version and moved by lifecycle alignment.
 #
 # Its identity is DATA shipped with the distribution (cli/engine-package.yaml),
 # never a name compiled into cli code — a fork edits the file.
@@ -86,7 +113,7 @@ require_v2() {
     detect_project
     case "$IP_MODE" in
         v2) ;;
-        legacy) die "this is a vendored (v1) setup — run 'intelligence migrate' first, or keep using its own flow" ;;
+        legacy) die "this is a vendored (v1) setup — run 'intelligence init' to migrate it, or keep using its own flow" ;;
         *) die "no intelligence project found here — run 'intelligence init'" ;;
     esac
 }
@@ -99,8 +126,16 @@ manifest_intelligence_dir() {
     printf '%s' "${v:-intelligence}"
 }
 
+default_target_output() {
+    case "$1" in
+        agents) printf '%s' "AGENTS.md" ;;
+        copilot) printf '%s' ".github" ;;
+        *) printf '.%s' "$1" ;;
+    esac
+}
+
 bundled_engine_version() {
-    tr -d ' \t\r\n' < "$IS_ENGINE_DIR/scripts/VERSION"
+    tr -d ' \t\r\n' < "$IS_ENGINE_DIR/VERSION"
 }
 
 # --- The sync package's manifest/lock plumbing ---------------------------
@@ -129,14 +164,132 @@ sync_pkg_install() {
 # Everything the IS_CLI mode of sync.sh needs, derived from the manifest.
 export_engine_env() {
     local root="$1"
-    local umbrella
-    umbrella="$(manifest_intelligence_dir "$root/intelligence.yaml")"
+    local content_rel
+    content_rel="$(manifest_intelligence_dir "$root/intelligence.yaml")"
     export IS_CLI=1
     export CONFIG_FILE="$root/intelligence.yaml"
     export REPO_ROOT="$root"
-    export IS_UMBRELLA_REL="$umbrella"
+    export IS_CONTENT_REL="$content_rel"
     export IS_MODULE_REL="$SYNC_PKG_STORE"
     export IS_SYNC_CMD="intelligence sync"
     export IS_MANIFEST_NAME="intelligence.yaml"
-    export IS_PROTECTED_DIRS="$umbrella:.intelligence"
+    export IS_PROTECTED_DIRS="$content_rel:.intelligence"
+}
+
+# --- Project lifecycle preflight -----------------------------------------
+# Public commands are intentionally few. They share this state gate so a CLI
+# installed at a newer engine version brings the current v2 project forward
+# before a mutating operation. The npm install itself cannot do that: it runs
+# outside any project and does not know which repositories the user owns.
+
+is_ci_environment() {
+    case "${CI:-}" in
+        1|true|TRUE|True|yes|YES|Yes|on|ON|On) return 0 ;;
+        *) return 1 ;;
+    esac
+}
+
+# Validate a repository-relative project content directory, including every
+# existing symlinked path component. Call before writing a new manifest.
+assert_safe_content_dir() {
+    local root="$1" content_dir="$2" repo_phys probe old_ifs part probe_phys
+    local -a parts
+    case "$content_dir" in
+        ""|/*|.|..|../*|*/../*|*/..|.git|.git/*|.intelligence|.intelligence/*|*\\*|[A-Za-z]:*)
+            die "unsafe content directory '$content_dir'"
+            ;;
+    esac
+    repo_phys="$(cd "$root" && pwd -P)"
+    probe="$root"
+    old_ifs="$IFS"; IFS='/'; read -r -a parts <<< "$content_dir"; IFS="$old_ifs"
+    for part in "${parts[@]}"; do
+        [ -n "$part" ] || continue
+        probe="$probe/$part"
+        if [ -e "$probe" ] || [ -L "$probe" ]; then
+            probe_phys="$(cd "$probe" 2>/dev/null && pwd -P)" \
+                || die "cannot resolve project content path '$content_dir'"
+            case "$probe_phys" in
+                "$repo_phys"|"$repo_phys"/*) ;;
+                *) die "project content directory resolves outside the repository: '$content_dir'" ;;
+            esac
+        fi
+    done
+}
+
+project_needs_upgrade() {
+    local root="$1" manifest="$1/intelligence.yaml" stamp eng pinned locked name
+    [ -f "$manifest" ] || return 1
+    stamp="$(read_schema_version "$manifest")"
+    eng="$(bundled_engine_version)"
+    [ -z "$stamp" ] && return 0
+    [ -n "$(top_scalar "$manifest" "sync_version")" ] && return 0
+    _ver_gt "$eng" "$stamp" && return 0
+    [ -d "$root/.intelligence/engine" ] && return 0
+
+    while IFS= read -r name; do
+        [ "$name" = "$SYNC_PKG_NAME" ] || continue
+        pinned="$(qmap_field "$manifest" "packages" "$name" "version")"
+        locked="$(qmap_field "$root/intelligence.lock" "packages" "$name" "resolved")"
+        [ "$pinned" = "$eng" ] || return 0
+        if [ -f "$root/intelligence.lock" ]; then
+            [ -n "$locked" ] || return 0
+            [ "${locked#v}" = "$eng" ] || return 0
+        fi
+    done < <(qmap_keys "$manifest" "packages")
+    return 1
+}
+
+# A manifest with packages but no lock has no trustworthy resolved state from
+# which lifecycle alignment can proceed. Never manufacture a partial lock.
+project_has_packages() {
+    local root="$1" name found=1
+    while IFS= read -r name; do
+        [ -n "$name" ] || continue
+        assert_valid_pkg_name "$name"
+        found=0
+    done < <(qmap_keys "$root/intelligence.yaml" "packages")
+    return "$found"
+}
+
+ensure_project_current() {
+    local root="$1" explicit="${2:-}" manifest="$1/intelligence.yaml" stamp eng
+    check_version_compat "$manifest" || return $?
+    if project_has_packages "$root" && [ ! -f "$root/intelligence.lock" ]; then
+        die "manifest declares packages but intelligence.lock is absent — restore the committed lock before running project lifecycle commands"
+    fi
+    project_needs_upgrade "$root" || return 0
+    stamp="$(read_schema_version "$manifest")"
+    eng="$(bundled_engine_version)"
+    if is_ci_environment && [ "$explicit" != "--explicit" ]; then
+        die "project lifecycle requires alignment (stamp ${stamp:-unstamped}, engine $eng) — run 'intelligence init --apply' locally, review and commit the diff"
+    fi
+    echo "  project alignment: stamp ${stamp:-unstamped}, engine $eng"
+    bash "$CLI_DIR/internal/upgrade-v2.sh" --no-sync
+}
+
+project_store_missing() {
+    local root="$1" manifest="$1/intelligence.yaml" name src
+    while IFS= read -r name; do
+        [ -n "$name" ] || continue
+        assert_valid_pkg_name "$name"
+        [ -d "$root/.intelligence/packages/$name" ] || return 0
+    done < <(qmap_keys "$manifest" "packages")
+    for section in rules agents skills; do
+        while IFS= read -r src; do
+            case "$src" in
+                .intelligence/packages/*)
+                    [ -d "$root/$src" ] || return 0
+                    ;;
+            esac
+        done < <(read_yaml_list "$manifest" "$section")
+    done
+    return 1
+}
+
+restore_project_store_if_missing() {
+    local root="$1"
+    project_store_missing "$root" || return 0
+    [ -f "$root/intelligence.lock" ] || die "package store is missing and intelligence.lock is absent — run 'intelligence init'"
+    echo "  restoring package store from intelligence.lock"
+    bash "$CLI_DIR/internal/restore.sh" --frozen --no-sync
 }

package/cli/lib/lockfile.sh

@@ -12,7 +12,7 @@ LOCK_SEP=$'\x1f'
 
 # top_scalar <file> <key> — one top-level scalar (`key: "value"`), quotes and
 # trailing comment stripped. The declared exception to "no new parsing": the
-# engine's read_engine_stamp is hardwired to its own key.
+# engine's read_schema_version is hardwired to its own key.
 top_scalar() {
     [ -f "$1" ] || return 0
     awk -v key="$2" '
@@ -54,14 +54,18 @@ lock_write_from_tsv() {
         echo "lockfile_version: $LOCKFILE_VERSION"
         echo "engine_version: \"$(bundled_engine_version)\""
         echo "packages:"
+        # Values reach a double-quoted YAML scalar: a `"` or `\` in any of
+        # them (registry-supplied url/path included) must be escaped, or it
+        # would break or alias the neighbouring field.
         awk -F"$LOCK_SEP" '
+            function esc(s) { gsub(/\\/, "\\\\", s); gsub(/"/, "\\\"", s); return s }
             NF >= 6 {
-                print "  \"" $1 "\":"
-                if ($2 != "") print "    requested: \"" $2 "\""
-                print "    url: \"" $3 "\""
-                if ($4 != "") print "    path: \"" $4 "\""
-                if ($5 != "") print "    resolved: \"" $5 "\""
-                print "    sha: \"" $6 "\""
+                print "  \"" esc($1) "\":"
+                if ($2 != "") print "    requested: \"" esc($2) "\""
+                print "    url: \"" esc($3) "\""
+                if ($4 != "") print "    path: \"" esc($4) "\""
+                if ($5 != "") print "    resolved: \"" esc($5) "\""
+                print "    sha: \"" esc($6) "\""
             }
         ' "$tsv"
     } > "$tmp"
@@ -72,7 +76,8 @@ lock_write_from_tsv() {
 # Replace-or-append one entry, keeping the others.
 lock_upsert() {
     local lock="$1" name="$2" requested="$3" url="$4" path="$5" resolved="$6" sha="$7"
-    local tsv="${TMPDIR:-/tmp}/intelligence-lock-$$.tsv"
+    local tsv
+    tsv="$(mktemp -t intelligence-lock-XXXXXX 2>/dev/null || mktemp)"
     {
         lock_to_tsv "$lock" | awk -F"$LOCK_SEP" -v n="$name" '$1 != n'
         printf '%s\037%s\037%s\037%s\037%s\037%s\n' \
@@ -86,7 +91,8 @@ lock_upsert() {
 lock_remove() {
     local lock="$1" name="$2"
     [ -f "$lock" ] || return 0
-    local tsv="${TMPDIR:-/tmp}/intelligence-lock-$$.tsv"
+    local tsv
+    tsv="$(mktemp -t intelligence-lock-XXXXXX 2>/dev/null || mktemp)"
     lock_to_tsv "$lock" | awk -F"$LOCK_SEP" -v n="$name" '$1 != n' > "$tsv"
     if [ -s "$tsv" ]; then
         lock_write_from_tsv "$lock" "$tsv"

package/cli/lib/manifest.sh

@@ -36,6 +36,92 @@ assert_valid_pkg_name() {
     esac
 }
 
+# Target names become adapter filenames and shell function suffixes, so keep
+# them inside the portable shell-identifier subset used by built-in adapters.
+assert_valid_target_name() {
+    case "$1" in
+        ""|[!abcdefghijklmnopqrstuvwxyz]*|*[!abcdefghijklmnopqrstuvwxyz0123456789_]*)
+            die "invalid target name '$1' — expected [a-z][a-z0-9_]*"
+            ;;
+    esac
+}
+
+# target_exists <manifest> <name> — distinguish a disabled target from one
+# that is not declared at all. Both inline and block target shapes count.
+target_exists() {
+    local file="$1" target="$2"
+    [ -f "$file" ] || return 1
+    awk -v target="$target" '
+        { sub(/\r$/, "") }
+        /^targets:[[:space:]]*$/ { in_targets = 1; next }
+        /^[A-Za-z]/ { in_targets = 0 }
+        in_targets && $0 ~ "^  " target ":[[:space:]]*" { found = 1; exit }
+        END { exit(found ? 0 : 1) }
+    ' "$file"
+}
+
+# target_set_enabled <manifest> <name> <true|false> <default-output>
+# Transactionally update only `enabled`, preserving every other target field
+# and comment. A missing target is added in the compact form used by init.
+target_set_enabled() {
+    local file="$1" target="$2" enabled="$3" output="$4"
+    [ -f "$file" ] || die "no such file: $file"
+    case "$enabled" in true|false) ;; *) die "internal: invalid target state '$enabled'" ;; esac
+    output="$(_yq_esc "$output")"
+    _qmap_stage "$file" -v target="$target" -v enabled="$enabled" -v output="$output" '
+        function entry() { return "  " target ": { enabled: " enabled ", output: \"" output "\" }" }
+        function add_enabled_to_inline(line,    p) {
+            p = index(line, "{")
+            if (p > 0) return substr(line, 1, p) " enabled: " enabled "," substr(line, p + 1)
+            return line
+        }
+        function flush_target() {
+            if (in_target && !enabled_seen) print "    enabled: " enabled
+            in_target = 0
+        }
+        function flush_targets() {
+            flush_target()
+            if (in_targets && !target_seen) { print entry(); target_seen = 1 }
+            in_targets = 0
+        }
+        { sub(/\r$/, "") }
+        /^targets:[[:space:]]*$/ { targets_seen = 1; in_targets = 1; print; next }
+        in_targets && /^[A-Za-z]/ { flush_targets() }
+        in_targets && /^  [A-Za-z]/ {
+            flush_target()
+            if ($0 ~ "^  " target ":[[:space:]]*") {
+                target_seen = 1
+                if (match($0, /enabled:[[:space:]]*(true|false)/)) {
+                    print substr($0, 1, RSTART - 1) "enabled: " enabled substr($0, RSTART + RLENGTH)
+                    enabled_seen = 1
+                } else if ($0 ~ /\{/) {
+                    print add_enabled_to_inline($0)
+                    enabled_seen = 1
+                } else {
+                    print
+                    in_target = 1
+                    enabled_seen = 0
+                }
+                next
+            }
+        }
+        in_target && /^    enabled:[[:space:]]*/ {
+            print "    enabled: " enabled
+            enabled_seen = 1
+            next
+        }
+        { last = $0; print }
+        END {
+            flush_targets()
+            if (!targets_seen) {
+                if (last != "") print ""
+                print "targets:"
+                print entry()
+            }
+        }
+    '
+}
+
 # qmap_keys <file> <block> — quoted keys, one per line.
 qmap_keys() {
     [ -f "$1" ] || return 0
@@ -114,9 +200,19 @@ _qmap_stage() {
 
 # qmap_set <file> <block> <key> <field> <value> — upsert one field, creating
 # the block and the key as needed.
+# _yq_esc <string> — escape \ and " for a double-quoted YAML scalar.
+_yq_esc() {
+    local s="$1"
+    s="${s//\\/\\\\}"
+    printf '%s' "${s//\"/\\\"}"
+}
+
 qmap_set() {
     local file="$1" block="$2" key="$3" field="$4" value="$5"
     [ -f "$file" ] || die "no such file: $file"
+    # url/path values can carry a `"`; escape before it reaches the quoted
+    # scalar the writer emits.
+    value="$(_yq_esc "$value")"
     _qmap_stage "$file" -v block="$block" -v key="$key" -v field="$field" -v value="$value" '
         function keyline()   { return "  \"" key "\":" }
         function fieldline() { return "    " field ": \"" value "\"" }
@@ -163,6 +259,7 @@ qmap_set() {
 qmap_set_value() {
     local file="$1" block="$2" key="$3" value="$4"
     [ -f "$file" ] || die "no such file: $file"
+    value="$(_yq_esc "$value")"
     _qmap_stage "$file" -v block="$block" -v key="$key" -v value="$value" '
         function entry() { return "  \"" key "\": \"" value "\"" }
         { sub(/\r$/, "") }
@@ -282,6 +379,14 @@ registries_remove() {
         { print }
     '
 }
+# True (0) if <config> already lists <entry> under any sources section. Quoted
+# and bare spellings both count - a manifest may hold either.
+_mig_has_source() {
+    local config="$1" entry="$2"
+    [ -f "$config" ] || return 1
+    grep -Fq -- "\"$entry\"" "$config" || grep -Fq -- "- $entry" "$config"
+}
+
 
 # sources_add_entry_first <file> <section> <entry> — idempotent insert at the
 # TOP of sources.<section> (creating sources:/section as needed). Package
@@ -313,7 +418,7 @@ sources_add_entry_first() {
 }
 
 # sources_remove_entry <file> <section> <entry> — remove `- "entry"` from
-# sources.<section>. Inverse of the engine-side _mig_add_source.
+# sources.<section>.
 sources_remove_entry() {
     local file="$1" section="$2" entry="$3"
     [ -f "$file" ] || return 0

package/cli/lib/registry.sh

@@ -11,7 +11,7 @@
 # visible, reviewable, deletable.
 #
 # The NAME is the trust anchor a developer reasons with; source integrity is
-# a separate mechanism: the lock pins url+sha, and doctor flags
+# a separate mechanism: the lock pins url+sha, and `status --check` flags
 # resolution/lock url drift.
 #
 # An index is itself fetched with git (never curl): auth, proxies and private
@@ -21,16 +21,26 @@
 # _fetch_index <registry-repo-url> — clones the registry repo (shallow) and
 # prints the path of its index.yaml; empty on failure. Cached per run+url.
 _fetch_index() {
-    local url="$1" cache key tmp
-    cache="${TMPDIR:-/tmp}/intelligence-cli-index-$$"
+    local url="$1" key tmp
+    assert_safe_source_url "$url"
+    # Per-run private cache dir under an UNPREDICTABLE mktemp path (a fixed
+    # /tmp/...-$$ would be trusted on cache hit and pre-creatable by others).
+    # No EXIT trap: _fetch_index is always called inside $( ), so a trap would
+    # fire in that subshell and delete the dir before the caller reads it. The
+    # dir is small and OS-reaped from the temp root; IS_REMOTE_CACHE-style
+    # persistence is exported so repeated calls in one command share it.
+    if [ -z "${IS_CLI_INDEX_CACHE:-}" ]; then
+        IS_CLI_INDEX_CACHE="$(mktemp -d -t intelligence-cli-index-XXXXXX 2>/dev/null || mktemp -d)"
+        export IS_CLI_INDEX_CACHE
+    fi
+    local cache="$IS_CLI_INDEX_CACHE"
     key="$(printf '%s' "$url" | cksum | awk '{print $1}')"
     if [ -f "$cache/$key/index.yaml" ]; then
         printf '%s' "$cache/$key/index.yaml"
         return 0
     fi
-    mkdir -p "$cache"
     tmp="$cache/$key"
-    if GIT_TERMINAL_PROMPT=0 git -c core.autocrlf=false clone --depth 1 --quiet "$url" "$tmp" 2>/dev/null \
+    if GIT_TERMINAL_PROMPT=0 git -c core.autocrlf=false clone --depth 1 --quiet -- "$url" "$tmp" 2>/dev/null \
         && [ -f "$tmp/index.yaml" ]; then
         printf '%s' "$tmp/index.yaml"
     fi
@@ -83,7 +93,7 @@ suggest_similar() {
             cshort="${cand#*/}"; cshort="${cshort%s}"
             if [ "$cshort" = "$want" ] && [ "$cand" != "$name" ]; then
                 seen="$seen$cand "
-                echo "  Did you mean: intelligence add $cand" >&2
+                echo "  Did you mean: intelligence package add $cand" >&2
             fi
         done < <(qmap_keys "$idx" "packages")
     }
@@ -103,19 +113,23 @@ suggest_similar() {
 # store holds the bytes the package published.
 fetch_package() {
     local url="$1" ref="$2" subpath="$3" dest="$4"
+    assert_safe_source_url "$url"
+    assert_safe_ref "$ref"
     # Bundle seed: the engine-content package at the CLI's own version copies
-    # from the npm bundle — no network, which keeps init / fresh-clone install
-    # / migrate offline exactly like the staging they replace. Keyed on the
+    # from the npm bundle — no network, which keeps init, sync restoration and
+    # archived-project conversion offline. Keyed on the
     # full (url, path, ref) triple; any other version or source falls through
     # to the normal clone.
     if [ "$url" = "$SYNC_PKG_URL" ] && [ "$subpath" = "$SYNC_PKG_PATH" ] \
         && [ "${ref#v}" = "$(bundled_engine_version)" ]; then
+        [ -n "${IS_BUNDLED_PKG_DIR:-}" ] && [ -d "$IS_BUNDLED_PKG_DIR" ] \
+            || die "bundled engine content not found next to the CLI — reinstall @ainova-systems/intelligence"
         rm -rf "$dest"
         mkdir -p "$dest"
-        cp -R "$IS_ENGINE_DIR/." "$dest/"
+        cp -R "$IS_BUNDLED_PKG_DIR/." "$dest/"
         rm -rf "$dest/.git"
-        if [ -f "$IS_ENGINE_DIR/scripts/ENGINE_SHA" ]; then
-            tr -d ' \t\r\n' < "$IS_ENGINE_DIR/scripts/ENGINE_SHA"
+        if [ -f "$IS_ENGINE_DIR/ENGINE_SHA" ]; then
+            tr -d ' \t\r\n' < "$IS_ENGINE_DIR/ENGINE_SHA"
         fi
         return 0
     fi
@@ -124,20 +138,20 @@ fetch_package() {
     [ -n "$ref" ] && branch_arg=(--branch "$ref")
     tmp="$(mktemp -d -t intelligence-pkg-XXXXXX 2>/dev/null || mktemp -d)"
     if ! GIT_TERMINAL_PROMPT=0 git -c core.symlinks=false -c core.autocrlf=false -c core.eol=lf \
-            clone --depth 1 "${branch_arg[@]+"${branch_arg[@]}"}" --quiet "$url" "$tmp/clone" 2>/dev/null; then
+            clone --depth 1 "${branch_arg[@]+"${branch_arg[@]}"}" --quiet -- "$url" "$tmp/clone" 2>/dev/null; then
         # A SHA is not clonable with --branch — fall back to a full clone + checkout.
         rm -rf "$tmp/clone"
         GIT_TERMINAL_PROMPT=0 git -c core.symlinks=false -c core.autocrlf=false -c core.eol=lf \
-            clone --quiet "$url" "$tmp/clone" 2>/dev/null \
+            clone --quiet -- "$url" "$tmp/clone" 2>/dev/null \
             || { rm -rf "$tmp"; die "cannot clone $url"; }
-        [ -z "$ref" ] || git -C "$tmp/clone" checkout --quiet "$ref" \
+        [ -z "$ref" ] || git -C "$tmp/clone" checkout --quiet "$ref" -- \
             || { rm -rf "$tmp"; die "ref '$ref' not found in $url"; }
     fi
     sha="$(git -C "$tmp/clone" rev-parse HEAD)"
     src="$tmp/clone"
     if [ -n "$subpath" ]; then
         case "$subpath" in
-            *..*) rm -rf "$tmp"; die "unsafe path '$subpath'" ;;
+            *..*|/*|*[\"\']*) rm -rf "$tmp"; die "unsafe path '$subpath'" ;;
         esac
         src="$tmp/clone/$subpath"
         [ -d "$src" ] || { rm -rf "$tmp"; die "path '$subpath' not found in $url${ref:+@$ref}" ; }