@ainova-systems/intelligence 0.11.5 → 0.11.6

package/cli/internal/check.sh

@@ -82,7 +82,7 @@ while IFS= read -r name; do
             warn "$name is locked but not installed — run 'intelligence sync'"
             continue
         fi
-        ok "$name @ $(qmap_field "$lock" "packages" "$name" "resolved")"
+        ok "$name @ $(pin_label "$m_ref" "$l_res" "$(qmap_field "$lock" "packages" "$name" "sha")")"
     fi
 done < <(qmap_keys "$manifest" "packages")
 

package/cli/internal/package-list.sh

@@ -14,6 +14,7 @@ while IFS= read -r name; do
     range="$(qmap_field "$manifest" "packages" "$name" "version")"
     ref="$(qmap_field "$manifest" "packages" "$name" "ref")"
     resolved="$(qmap_field "$lock" "packages" "$name" "resolved")"
+    sha="$(qmap_field "$lock" "packages" "$name" "sha")"
     if [ ! -f "$lock" ]; then
         state="lock missing — restore committed intelligence.lock"
     elif [ -d "$IP_ROOT/.intelligence/packages/$name" ]; then
@@ -24,7 +25,7 @@ while IFS= read -r name; do
     printf '%s  %s  locked:%s  %s\n' \
         "$name" \
         "${ref:+ref:$ref}${ref:-${range:-*}}" \
-        "${resolved:-<none>}" \
+        "$(pin_label "$ref" "$resolved" "$sha")" \
         "$state"
 done < <(qmap_keys "$manifest" "packages")
 

package/cli/internal/package-update.sh

@@ -22,6 +22,20 @@ require_cli_project
 manifest="$IP_ROOT/intelligence.yaml"
 lock="$IP_ROOT/intelligence.lock"
 
+# move_label <ref-or-empty> <from-resolved> <to-resolved> <from-sha> <to-sha>
+# A version pin moves between tags, a ref pin between commits under one name —
+# printing "main -> main" would report the move by hiding what moved.
+move_label() {
+    local ref="$1" from="$2" to="$3" from_sha="$4" to_sha="$5"
+    if [ -z "$ref" ]; then
+        printf '%s -> %s' "${from:-<none>}" "$to"
+    elif [ -n "$from" ] && [ "$from" != "$ref" ]; then
+        printf '%s -> %s@%s' "$from" "$ref" "$(short_sha "$to_sha")"
+    else
+        printf '%s %s -> %s' "$ref" "$(short_sha "$from_sha")" "$(short_sha "$to_sha")"
+    fi
+}
+
 moved=0 found=0
 while IFS= read -r name; do
     [ -n "$name" ] || continue
@@ -37,6 +51,7 @@ while IFS= read -r name; do
     fi
     current="$(qmap_field "$lock" "packages" "$name" "resolved")"
     locked_requested="$(qmap_field "$lock" "packages" "$name" "requested")"
+    locked_sha="$(qmap_field "$lock" "packages" "$name" "sha")"
     url="$(qmap_field "$lock" "packages" "$name" "url")"
     path="$(qmap_field "$lock" "packages" "$name" "path")"
     [ -n "$url" ] || die "$name has no source in intelligence.lock — restore the committed lock or re-add the package"
@@ -44,32 +59,69 @@ while IFS= read -r name; do
     range="$(qmap_field "$manifest" "packages" "$name" "version")"
     [ -n "$ref" ] || [ -n "$range" ] || die "$name has neither version nor ref in the manifest"
 
+    ref_moved=0 remote_sha=""
     if [ -n "$ref" ]; then
         tag="$ref"
         requested=""
+        # A ref is requested INTENT, and the lock's `resolved` column holds
+        # that same ref name — comparing the two asks a question no branch can
+        # ever answer differently. The sha column is the only record of where
+        # the ref actually pointed, so a ref pin is compared commit to commit:
+        # a moved branch, a re-cut tag and a `HEAD` pin all become visible,
+        # while a pin that IS a commit stays immutable by construction.
+        probe_rc=0
+        remote_sha="$(remote_sha_for_ref "$url" "$ref")" || probe_rc=$?
+        if [ "$probe_rc" -ne 0 ]; then
+            # No answer is not "no change": reporting up to date here would
+            # freeze the pin exactly as the ref-name comparison used to.
+            echo "  WARN: $name: cannot reach $url — ref '$ref' was not checked" >&2
+            echo "  $name: $ref (not checked — remote unreachable)"
+            continue
+        fi
+        # ls-remote advertises refs, not arbitrary objects, so a commit pin
+        # legitimately matches nothing — and cannot move. This verdict applies
+        # only once the lock already resolved to this ref; a manifest that now
+        # names a ref the lock never resolved is an ordinary move, and falls
+        # through to the fetch below.
+        if [ -z "$remote_sha" ] && [ "$ref" = "$current" ]; then
+            # The lock records the commit this ref resolved to, so a ref that
+            # prefixes it IS that commit. Asking the lock beats guessing from
+            # the ref's shape: a deleted branch named like a hex string would
+            # otherwise pass for a pin and swallow its own disappearance.
+            case "$locked_sha" in
+                "$ref"*)
+                    echo "  $name: $(short_sha "$ref") (pinned commit)"
+                    ;;
+                *)
+                    echo "  WARN: $name pins ref '$ref', which $url no longer advertises" >&2
+                    echo "  $name: $ref (unresolvable — gone upstream)"
+                    ;;
+            esac
+            continue
+        fi
+        [ -z "$remote_sha" ] || [ "$remote_sha" = "$locked_sha" ] || ref_moved=1
     else
         picked="$(list_remote_versions "$url" | semver_pick_highest "$range")"
         [ -n "$picked" ] || { echo "  $name: nothing satisfies '$range' at $url" >&2; continue; }
         read -r tag _ <<< "$(remote_tag_for_version "$url" "$picked")"
         requested="$range"
     fi
-    if [ "$tag" = "$current" ] && [ "$requested" != "$locked_requested" ]; then
+    if [ "$ref_moved" -eq 0 ] && [ "$tag" = "$current" ] && [ "$requested" != "$locked_requested" ]; then
         if [ "$preview" -eq 1 ]; then
             echo "  $name: request ${locked_requested:-<none>} -> ${requested:-<ref>} (keeps $current)"
         else
-            locked_sha="$(qmap_field "$lock" "packages" "$name" "sha")"
             lock_upsert "$lock" "$name" "$requested" "$url" "$path" "$current" "$locked_sha"
             echo "  $name: request ${locked_requested:-<none>} -> ${requested:-<ref>} (kept $current)"
         fi
         moved=$((moved + 1))
         continue
     fi
-    if [ "$tag" = "$current" ]; then
-        echo "  $name: ${current:-<none>} (up to date)"
+    if [ "$ref_moved" -eq 0 ] && [ "$tag" = "$current" ]; then
+        echo "  $name: $(pin_label "$ref" "$current" "$locked_sha") (up to date)"
         continue
     fi
     if [ "$preview" -eq 1 ]; then
-        echo "  $name: ${current:-<none>} -> $tag"
+        echo "  $name: $(move_label "$ref" "$current" "$tag" "$locked_sha" "$remote_sha")"
         moved=$((moved + 1))
         continue
     fi
@@ -87,7 +139,7 @@ while IFS= read -r name; do
     mv "$staging" "$IP_ROOT/$rel"
     wire_package_sources "$manifest" "$name" "$rel" "$IP_ROOT"
     lock_upsert "$lock" "$name" "$requested" "$url" "$path" "$tag" "$sha"
-    echo "  $name: ${current:-<none>} -> $tag"
+    echo "  $name: $(move_label "$ref" "$current" "$tag" "$locked_sha" "$sha")"
     moved=$((moved + 1))
 done < <(qmap_keys "$manifest" "packages")
 

package/cli/lib/cli-common.sh

@@ -47,6 +47,27 @@ assert_safe_ref() {
     esac
 }
 
+# --- Resolved-pin display ------------------------------------------------
+# A `ref:` pin's resolved column holds the ref NAME, which never changes: the
+# sha is the only field that says which commit is installed. Every surface
+# reporting such a pin prints both, so a branch that stopped moving is visible
+# without asking the remote.
+
+short_sha() {
+    [ -n "$1" ] || { printf '<none>'; return 0; }
+    printf '%s' "${1:0:7}"
+}
+
+# pin_label <ref-or-empty> <resolved> <sha>
+pin_label() {
+    local ref="$1" resolved="$2" sha="$3"
+    if [ -n "$ref" ]; then
+        printf '%s@%s' "${resolved:-$ref}" "$(short_sha "$sha")"
+    else
+        printf '%s' "${resolved:-<none>}"
+    fi
+}
+
 source "$CLI_DIR/lib/manifest.sh"
 source "$CLI_DIR/lib/semver.sh"
 source "$CLI_DIR/lib/registry.sh"

package/cli/lib/semver.sh

@@ -120,6 +120,39 @@ remote_tag_for_version() {
             }'
 }
 
+# remote_sha_for_ref <git-url> <ref> — the commit a branch/tag/HEAD pin points
+# at on the remote right now; empty when the remote advertises no such ref
+# (a pin that IS a commit, or a ref deleted upstream). Exit 2 means the remote
+# could not be asked at all: a check that produced no answer must never be
+# read by the caller as "nothing changed".
+#
+# Three git behaviours this mirrors deliberately, because a sha that is not the
+# one `fetch_package` would land on is worse than no answer:
+#   - `git ls-remote <url> main` also matches `refs/heads/feature/main`
+#     (patterns match at slash boundaries), so candidates are selected by full
+#     ref name, never by the pattern that fetched them;
+#   - an annotated tag advertises the tag OBJECT on `refs/tags/<t>` and the
+#     commit on the peeled `refs/tags/<t>^{}`, while the lock records the
+#     commit — so peeled wins, and the peel line only appears when its own
+#     pattern is asked for;
+#   - on a name shared by a branch and a tag, `git clone --branch <ref>` takes
+#     the branch, so `refs/heads` outranks `refs/tags` here too.
+remote_sha_for_ref() {
+    local url="$1" ref="$2" out
+    assert_safe_source_url "$url"
+    assert_safe_ref "$ref"
+    [ -n "$ref" ] || return 0
+    out="$(GIT_TERMINAL_PROMPT=0 git ls-remote -- "$url" \
+        "$ref" "$ref^{}" "refs/heads/$ref" "refs/tags/$ref" "refs/tags/$ref^{}" 2>/dev/null)" \
+        || return 2
+    printf '%s\n' "$out" | awk -v ref="$ref" '
+        { sub(/\r$/, ""); if ($2 != "") seen[$2] = $1 }
+        END {
+            split("refs/heads/" ref "\037refs/tags/" ref "^{}\037refs/tags/" ref "\037" ref "^{}\037" ref, C, "\037")
+            for (i = 1; i <= 5; i++) if (C[i] in seen) { print seen[C[i]]; exit }
+        }'
+}
+
 # semver_pick_highest <range> — reads versions on stdin, prints the highest
 # one matching the range (empty output when nothing matches).
 semver_pick_highest() {

package/engine/ENGINE_SHA

@@ -1 +1 @@
-bd688bcdb5443d808a72ed4e63805a65255a7d02
+512d06382f43fa910c32ccc275a5fc286500d4e2

package/engine/VERSION

@@ -1 +1 @@
-0.11.5
+0.11.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ainova-systems/intelligence",
-  "version": "0.11.5",
+  "version": "0.11.6",
   "description": "Build, version and distribute AI agent intelligence across your organization — one CLI, versioned Intelligence Packages, and a sync engine for Claude Code, Cursor, Copilot, Codex, Pi and OpenCode.",
   "bin": {
     "intelligence": "bin/intelligence.js"