@ainova-systems/intelligence 0.11.7 → 0.11.8

package/cli/internal/restore.sh

@@ -2,8 +2,8 @@
 # Internal locked-store restore operation.
 #
 # Restore .intelligence/ from intelligence.lock — the fresh-clone command.
-# --frozen additionally refuses any manifest/lock divergence (CI mode) and
-# fails on a sha mismatch instead of re-resolving.
+# --frozen additionally refuses manifest/lock divergence (CI mode).
+# Locked packages always restore their recorded commit, never the ref's new HEAD.
 set -euo pipefail
 source "$CLI_DIR/lib/cli-common.sh"
 
@@ -50,6 +50,20 @@ if [ "$frozen" -eq 1 ]; then
     done < <(qmap_keys "$lock" "packages")
 fi
 
+# Check every required commit identity before restoring any package. Only the
+# matching bundled content may carry the historical empty development-build SHA.
+while IFS="$LOCK_SEP" read -r name _requested url path resolved sha; do
+    [ -n "$name" ] || continue
+    assert_valid_pkg_name "$name"
+    assert_safe_source_url "$url"
+    assert_safe_ref "$resolved"
+    if [ -z "$sha" ] && is_bundle_source "$url" "$resolved" "$path"; then
+        continue
+    fi
+    [[ "$sha" =~ ^[0-9a-f]{40}$ || "$sha" =~ ^[0-9a-f]{64}$ ]] \
+        || die "locked restore: $name has a missing or invalid commit SHA — restore a valid intelligence.lock"
+done < <(lock_to_tsv "$lock")
+
 # Manifest packages missing from the lock: resolve them now (npm install
 # semantics). Under --frozen the drift gate above has already refused.
 missing=""
@@ -89,7 +103,7 @@ fi
 
 # Restore every locked package that is not already in the store.
 if [ -f "$lock" ]; then
-    while IFS="$LOCK_SEP" read -r name requested url path resolved sha; do
+    while IFS="$LOCK_SEP" read -r name _requested url path resolved sha; do
         [ -n "$name" ] || continue
         # The lock arrives with a cloned repo — its keys are untrusted input
         # on their way into rm -rf paths, and its urls into git argv.
@@ -106,17 +120,7 @@ if [ -f "$lock" ]; then
         # re-run (whose dir-exists check skips verification) would sync it.
         staging="$IP_ROOT/.intelligence/.staging-$$"
         rm -rf "$staging"
-        got="$(fetch_package "$url" "$resolved" "$path" "$staging")"
-        # An empty sha (bundle-seeded content on a dev build) means unknown,
-        # not moved — only two known-and-different shas are a finding.
-        if [ -n "$sha" ] && [ -n "$got" ] && [ "$got" != "$sha" ]; then
-            if [ "$frozen" -eq 1 ]; then
-                rm -rf "$staging"
-                die "$name: fetched $got but the lock pins $sha — the ref moved; refusing under --frozen"
-            fi
-            echo "  WARN: $name resolved to $got, lock had $sha — updating the lock" >&2
-            lock_upsert "$lock" "$name" "$requested" "$url" "$path" "$resolved" "$got"
-        fi
+        fetch_package "$url" "$resolved" "$path" "$staging" "$sha" >/dev/null
         rm -rf "${IP_ROOT:?}/$rel"
         mkdir -p "$(dirname "$IP_ROOT/$rel")"
         mv "$staging" "$IP_ROOT/$rel"

package/cli/lib/registry.sh

@@ -106,13 +106,20 @@ suggest_similar() {
     fi
 }
 
-# fetch_package <url> <ref> <subpath> <dest-dir>
+# is_bundle_source <url> <ref> <subpath>
+is_bundle_source() {
+    [ "$1" = "$SYNC_PKG_URL" ] && [ "$3" = "$SYNC_PKG_PATH" ] \
+        && [ "${2#v}" = "$(bundled_engine_version)" ]
+}
+
+# fetch_package <url> <ref> <subpath> <dest-dir> [locked-sha]
 # Shallow-clones url@ref (tag, branch, or SHA fallback), copies <subpath>
 # (or the repo root) into <dest-dir>, prints the resolved commit sha.
+# A locked SHA selects and verifies the commit independently of the ref name.
 # The clone pins autocrlf/eol/symlinks exactly like the engine does, so the
 # store holds the bytes the package published.
 fetch_package() {
-    local url="$1" ref="$2" subpath="$3" dest="$4"
+    local url="$1" ref="$2" subpath="$3" dest="$4" locked_sha="${5:-}" bundle_sha=""
     assert_safe_source_url "$url"
     assert_safe_ref "$ref"
     # Bundle seed: the engine-content package at the CLI's own version copies
@@ -120,34 +127,63 @@ fetch_package() {
     # archived-project conversion offline. Keyed on the
     # full (url, path, ref) triple; any other version or source falls through
     # to the normal clone.
-    if [ "$url" = "$SYNC_PKG_URL" ] && [ "$subpath" = "$SYNC_PKG_PATH" ] \
-        && [ "${ref#v}" = "$(bundled_engine_version)" ]; then
+    if is_bundle_source "$url" "$ref" "$subpath"; then
+        if [ -f "$IS_ENGINE_DIR/ENGINE_SHA" ]; then
+            bundle_sha="$(tr -d ' \t\r\n' < "$IS_ENGINE_DIR/ENGINE_SHA")"
+        fi
+    fi
+    if is_bundle_source "$url" "$ref" "$subpath" \
+        && { [ -z "$locked_sha" ] || [ -z "$bundle_sha" ] || [ "$locked_sha" = "$bundle_sha" ]; }; then
         [ -n "${IS_BUNDLED_PKG_DIR:-}" ] && [ -d "$IS_BUNDLED_PKG_DIR" ] \
             || die "bundled engine content not found next to the CLI — reinstall @ainova-systems/intelligence"
         rm -rf "$dest"
         mkdir -p "$dest"
         cp -R "$IS_BUNDLED_PKG_DIR/." "$dest/"
         rm -rf "$dest/.git"
-        if [ -f "$IS_ENGINE_DIR/ENGINE_SHA" ]; then
-            tr -d ' \t\r\n' < "$IS_ENGINE_DIR/ENGINE_SHA"
+        if [ "$#" -ge 5 ] && { [ -z "$locked_sha" ] || [ -z "$bundle_sha" ]; }; then
+            echo "WARNING: bundled sync content restored without commit verification (development bundle or lock has no SHA)" >&2
         fi
+        printf '%s' "$bundle_sha"
         return 0
     fi
     local tmp sha src
     local -a branch_arg=()
     [ -n "$ref" ] && branch_arg=(--branch "$ref")
     tmp="$(mktemp -d -t intelligence-pkg-XXXXXX 2>/dev/null || mktemp -d)"
-    if ! GIT_TERMINAL_PROMPT=0 git -c core.symlinks=false -c core.autocrlf=false -c core.eol=lf \
+    if [ -n "$locked_sha" ]; then
+        local -a format_arg=()
+        [ "${#locked_sha}" -ne 64 ] || format_arg=(--object-format=sha256)
+        git init --quiet "${format_arg[@]+"${format_arg[@]}"}" "$tmp/clone" \
+            || { rm -rf "$tmp"; die "cannot stage locked commit $locked_sha"; }
+        # Request the object directly, including retained commits no longer named
+        # by a branch/tag. Servers that forbid SHA wants may still advertise a
+        # descendant; fetch their history before declaring the commit unavailable.
+        if ! GIT_TERMINAL_PROMPT=0 git -C "$tmp/clone" fetch --quiet --no-tags --depth 1 -- "$url" "$locked_sha" 2>/dev/null; then
+            GIT_TERMINAL_PROMPT=0 git -C "$tmp/clone" fetch --quiet --tags -- "$url" \
+                '+refs/heads/*:refs/remotes/locked/*' 2>/dev/null \
+                || { rm -rf "$tmp"; die "cannot fetch locked commit $locked_sha from $url — check source access and commit availability"; }
+        fi
+        [ "$(git -C "$tmp/clone" cat-file -t "$locked_sha" 2>/dev/null || true)" = commit ] \
+            || { rm -rf "$tmp"; die "locked commit $locked_sha unavailable from $url — refusing to substitute '$ref' or HEAD"; }
+        git -c core.symlinks=false -c core.autocrlf=false -c core.eol=lf \
+            -C "$tmp/clone" checkout --quiet --detach "$locked_sha" -- \
+            || { rm -rf "$tmp"; die "cannot check out locked commit $locked_sha from $url"; }
+    elif ! GIT_TERMINAL_PROMPT=0 git -c core.symlinks=false -c core.autocrlf=false -c core.eol=lf \
             clone --depth 1 "${branch_arg[@]+"${branch_arg[@]}"}" --quiet -- "$url" "$tmp/clone" 2>/dev/null; then
         # A SHA is not clonable with --branch — fall back to a full clone + checkout.
         rm -rf "$tmp/clone"
         GIT_TERMINAL_PROMPT=0 git -c core.symlinks=false -c core.autocrlf=false -c core.eol=lf \
             clone --quiet -- "$url" "$tmp/clone" 2>/dev/null \
             || { rm -rf "$tmp"; die "cannot clone $url"; }
-        [ -z "$ref" ] || git -C "$tmp/clone" checkout --quiet "$ref" -- \
+        [ -z "$ref" ] || git -c core.symlinks=false -c core.autocrlf=false -c core.eol=lf \
+            -C "$tmp/clone" checkout --quiet "$ref" -- \
             || { rm -rf "$tmp"; die "ref '$ref' not found in $url"; }
     fi
     sha="$(git -C "$tmp/clone" rev-parse HEAD)"
+    if [ -n "$locked_sha" ] && [ "$sha" != "$locked_sha" ]; then
+        rm -rf "$tmp"
+        die "fetched $sha but the lock pins $locked_sha — refusing package replacement"
+    fi
     src="$tmp/clone"
     if [ -n "$subpath" ]; then
         case "$subpath" in

package/engine/ENGINE_SHA

@@ -1 +1 @@
-00308bfbdcd92ebf37924bb1083cee142e655fd7
+3413f7d6f9ef181368b16b90e36d77360cb5f479

package/engine/VERSION

@@ -1 +1 @@
-0.11.7
+0.11.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ainova-systems/intelligence",
-  "version": "0.11.7",
+  "version": "0.11.8",
   "description": "Build, version and distribute AI agent intelligence across your organization — one CLI, versioned Intelligence Packages, and a sync engine for Claude Code, Cursor, Copilot, Codex, Pi and OpenCode.",
   "bin": {
     "intelligence": "bin/intelligence.js"

package/packages/sync/skills/intelligence-sync/SKILL.md

@@ -11,12 +11,12 @@ context: fork
    was requested). For Intelligence projects, this command first aligns project schema/content
    with the installed CLI and restores a missing package store strictly from
    `intelligence.lock`.
-2. Require final `IS_STATUS=ok`; relay per-adapter counts and any model-drift
-   or unsynced-source warnings.
+2. Require final `IS_STATUS=ok`; relay per-adapter counts and any integrity,
+   model-drift or unsynced-source warnings.
 3. In CI, a required tracked project upgrade is intentionally refused. Report
    the instruction to run `intelligence init --apply` locally, review and
    commit its diff; never bypass the gate. A frozen restore refusal means the
-   manifest and lock disagree or a pinned ref moved—report it without
+   manifest and lock disagree or the locked commit cannot be verified/restored—report it without
    hand-copying package content.
 4. On a probable Intelligence defect, first ask whether to collect a sanitized
    issue draft; collect nothing before approval and never use telemetry. Include