@ainova-systems/intelligence 0.11.8 → 0.11.9

package/cli/commands/init.sh

@@ -123,6 +123,7 @@ case "$IP_MODE" in
         [ "$force" -eq 0 ] || die "--force applies only when converting a legacy Intelligence Sync project"
         if [ "$preview" -eq 1 ]; then
             check_version_compat "$IP_ROOT/intelligence.yaml"
+            validate_project_lock "$IP_ROOT"
             echo "project: Intelligence CLI at $IP_ROOT"
             if project_stamped_ahead "$IP_ROOT"; then
                 echo "  project schema $(read_schema_version "$IP_ROOT/intelligence.yaml") is ahead of engine $(bundled_engine_version) — left as is (update the CLI)"

package/cli/commands/status.sh

@@ -12,22 +12,32 @@ esac
 detect_project
 case "$IP_MODE" in
     cli)
+        lock_valid=1
         echo "Project:  $IP_ROOT (Intelligence project)"
         echo "Manifest: intelligence.yaml (schema_version $(read_schema_version "$IP_ROOT/intelligence.yaml"))"
-        if [ -f "$IP_ROOT/intelligence.lock" ]; then
+        if ! check_project_lock "$IP_ROOT"; then
+            lock_valid=0
+            echo "Lockfile: INVALID (locked state unchecked)"
+        elif [ -f "$IP_ROOT/intelligence.lock" ]; then
             echo "Lockfile: intelligence.lock"
         elif [ -n "$(qmap_keys "$IP_ROOT/intelligence.yaml" "packages")" ]; then
             echo "Lockfile: MISSING (manifest declares packages)"
         else
             echo "Lockfile: none (no packages added yet)"
         fi
-        sync_locked="$(qmap_field "$IP_ROOT/intelligence.lock" "packages" "$SYNC_PKG_NAME" "resolved")"
-        if [ -n "$sync_locked" ]; then
+        sync_locked=""
+        if [ "$lock_valid" -eq 1 ]; then
+            sync_locked="$(qmap_field "$IP_ROOT/intelligence.lock" "packages" "$SYNC_PKG_NAME" "resolved")"
+        fi
+        if [ "$lock_valid" -eq 0 ]; then
+            echo "Content:  unchecked"
+        elif [ -n "$sync_locked" ]; then
             echo "Content:  $SYNC_PKG_NAME at $sync_locked"
         else
             echo "Content:  no $SYNC_PKG_NAME (bare setup)"
         fi
         echo "Engine:   $(bundled_engine_version) (bundled with the CLI)"
+        [ "$lock_valid" -eq 1 ] || exit 1
         ;;
     legacy)
         echo "Project:  $IP_ROOT (legacy Intelligence Sync)"

package/cli/commands/update.sh

@@ -22,6 +22,7 @@ done
 require_cli_project
 manifest="$IP_ROOT/intelligence.yaml"
 check_version_compat "$manifest"
+validate_project_lock "$IP_ROOT"
 eng="$(bundled_engine_version)"
 stamp="$(read_schema_version "$manifest")"
 project_change=0

package/cli/internal/check.sh

@@ -31,6 +31,12 @@ esac
 echo "project: $IP_ROOT"
 manifest="$IP_ROOT/intelligence.yaml"
 lock="$IP_ROOT/intelligence.lock"
+lock_valid=1
+if ! check_project_lock "$IP_ROOT"; then
+    problems=$((problems + 1))
+    lock_valid=0
+    note "locked package identities cannot be inspected; continuing independent project checks"
+fi
 
 stamp="$(read_schema_version "$manifest")"
 eng="$(bundled_engine_version)"
@@ -50,7 +56,10 @@ fi
 
 # The engine-content package must sit at the bundled engine version — the
 # content documents exactly the scripts the CLI executes.
-sync_locked="$(qmap_field "$lock" "packages" "$SYNC_PKG_NAME" "resolved")"
+sync_locked=""
+if [ "$lock_valid" -eq 1 ]; then
+    sync_locked="$(qmap_field "$lock" "packages" "$SYNC_PKG_NAME" "resolved")"
+fi
 if [ -n "$sync_locked" ]; then
     if [ "${sync_locked#v}" = "$eng" ]; then
         ok "$SYNC_PKG_NAME at $sync_locked (matches the engine)"
@@ -70,6 +79,10 @@ fi
 while IFS= read -r name; do
     [ -n "$name" ] || continue
     assert_valid_pkg_name "$name"
+    if [ "$lock_valid" -eq 0 ]; then
+        note "$name: locked state unchecked"
+        continue
+    fi
     if [ -z "$(qmap_field "$lock" "packages" "$name" "url")" ]; then
         warn "$name is in the manifest but not in intelligence.lock — run 'intelligence init'"
     else
@@ -143,7 +156,7 @@ while IFS= read -r target; do
 done < <(target_names "$manifest")
 
 # Lock orphans.
-if [ -f "$lock" ]; then
+if [ "$lock_valid" -eq 1 ] && [ -f "$lock" ]; then
     while IFS= read -r name; do
         [ -n "$name" ] || continue
         found=0
@@ -165,7 +178,13 @@ for section in rules agents skills; do
         if [ ! -d "$IP_ROOT/$src" ]; then
             case "$src" in
                 # Store content is restorable state: absent means un-installed.
-                .intelligence/*) warn "sources.$section '$src' missing — run 'intelligence sync'" ;;
+                .intelligence/*)
+                    if [ "$lock_valid" -eq 1 ]; then
+                        warn "sources.$section '$src' missing — run 'intelligence sync'"
+                    else
+                        warn "sources.$section '$src' missing — resolve the lock problem first"
+                    fi
+                    ;;
                 # A project-owned dir that does not exist yet is a legitimate
                 # state — a project consuming only packages authors nothing of
                 # its own — and the engine simply skips it. Declared up front so

package/cli/internal/convert-legacy.sh

@@ -183,7 +183,9 @@ while IFS="$LOCK_SEP" read -r pack name url ref mirror; do
         mkdir -p "$dest"
         cp -R "$root/$mirror/." "$dest/"
         if [ -f "$dest/.pack" ]; then
-            sha="$(awk -F= '$1 == "sha" {print $2; exit}' "$dest/.pack")"
+            sha="$(awk -F= '{ sub(/\r$/, "") } $1 == "sha" {print $2; exit}' "$dest/.pack")"
+            [[ "$sha" =~ ^[0-9a-f]{40}$ || "$sha" =~ ^[0-9a-f]{64}$ ]] \
+                || die "pack '$pack' mirror '$mirror' has a missing or invalid recorded commit SHA in .pack — legacy project unchanged; restore its trusted ownership stamp from history or refresh the mirror with its archived engine, then rerun 'intelligence init'"
             rm -f "$dest/.pack"
         fi
         echo "  pack '$pack' -> $name (from mirror $mirror)"
@@ -191,9 +193,8 @@ while IFS="$LOCK_SEP" read -r pack name url ref mirror; do
         sha="$(fetch_package "$url" "$ref" "" "$dest")"
         echo "  pack '$pack' -> $name (fetched)"
     fi
-    if [ -z "$sha" ] || [ "$sha" = "unknown" ]; then
-        sha="$(GIT_TERMINAL_PROMPT=0 git ls-remote -- "$url" "$ref" 2>/dev/null | awk '{print $1; exit}')"
-    fi
+    # A ref currently advertised by the remote cannot prove which commit
+    # produced an existing mirror. Only its recorded identity can do that.
     [ -n "$ref" ] || ref="HEAD"
     printf '%s\037%s\037%s\037%s\037%s\037%s\n' \
         "$name" "" "$url" "" "$ref" "$sha" >> "$lock_rows"

package/cli/internal/package-list.sh

@@ -6,6 +6,8 @@ source "$CLI_DIR/lib/cli-common.sh"
 require_cli_project
 manifest="$IP_ROOT/intelligence.yaml"
 lock="$IP_ROOT/intelligence.lock"
+lock_valid=1
+if ! check_project_lock "$IP_ROOT"; then lock_valid=0; fi
 
 count=0
 while IFS= read -r name; do
@@ -13,9 +15,14 @@ while IFS= read -r name; do
     count=$((count + 1))
     range="$(qmap_field "$manifest" "packages" "$name" "version")"
     ref="$(qmap_field "$manifest" "packages" "$name" "ref")"
-    resolved="$(qmap_field "$lock" "packages" "$name" "resolved")"
-    sha="$(qmap_field "$lock" "packages" "$name" "sha")"
-    if [ ! -f "$lock" ]; then
+    resolved="" sha=""
+    if [ "$lock_valid" -eq 1 ]; then
+        resolved="$(qmap_field "$lock" "packages" "$name" "resolved")"
+        sha="$(qmap_field "$lock" "packages" "$name" "sha")"
+    fi
+    if [ "$lock_valid" -eq 0 ]; then
+        state="invalid lock — locked state unchecked"
+    elif [ ! -f "$lock" ]; then
         state="lock missing — restore committed intelligence.lock"
     elif [ -d "$IP_ROOT/.intelligence/packages/$name" ]; then
         state="installed"
@@ -30,5 +37,8 @@ while IFS= read -r name; do
 done < <(qmap_keys "$manifest" "packages")
 
 if [ "$count" -eq 0 ]; then
-    echo "No packages. Add one: intelligence package add @ainova-systems/core"
+    if [ "$lock_valid" -eq 1 ]; then
+        echo "No packages. Add one: intelligence package add @ainova-systems/core"
+    fi
 fi
+[ "$lock_valid" -eq 1 ] || exit 1

package/cli/internal/restore.sh

@@ -21,6 +21,7 @@ done
 require_cli_project
 manifest="$IP_ROOT/intelligence.yaml"
 lock="$IP_ROOT/intelligence.lock"
+validate_project_lock "$IP_ROOT" --restore
 
 # --frozen is the reproducibility contract: the lock must agree with the
 # manifest on the package SET and on every requested-intent field before a
@@ -50,20 +51,6 @@ if [ "$frozen" -eq 1 ]; then
     done < <(qmap_keys "$lock" "packages")
 fi
 
-# Check every required commit identity before restoring any package. Only the
-# matching bundled content may carry the historical empty development-build SHA.
-while IFS="$LOCK_SEP" read -r name _requested url path resolved sha; do
-    [ -n "$name" ] || continue
-    assert_valid_pkg_name "$name"
-    assert_safe_source_url "$url"
-    assert_safe_ref "$resolved"
-    if [ -z "$sha" ] && is_bundle_source "$url" "$resolved" "$path"; then
-        continue
-    fi
-    [[ "$sha" =~ ^[0-9a-f]{40}$ || "$sha" =~ ^[0-9a-f]{64}$ ]] \
-        || die "locked restore: $name has a missing or invalid commit SHA — restore a valid intelligence.lock"
-done < <(lock_to_tsv "$lock")
-
 # Manifest packages missing from the lock: resolve them now (npm install
 # semantics). Under --frozen the drift gate above has already refused.
 missing=""

package/cli/lib/cli-common.sh

@@ -14,7 +14,7 @@ source "$IS_ENGINE_DIR/lib/contract.sh"
 source "$IS_ENGINE_DIR/lib/adapter-contract.sh"
 
 die() {
-    echo "ERROR: $*" >&2
+    echo "ERROR: ${CLI_INPUT_CONTEXT:-}$*" >&2
     exit 1
 }
 
@@ -30,7 +30,7 @@ assert_safe_source_url() {
     local url="$1"
     case "$url" in
         ""|-*) die "unsafe source url '$url' — option-shaped or empty" ;;
-        *[\"\'\ ]*) die "unsafe source url '$url' — quotes or spaces" ;;
+        *[\"\'\ ]*|*[[:cntrl:]]*) die "unsafe source url '$url' — quotes or whitespace" ;;
         https://*|http://*|ssh://*|git://*|file://*) ;;
         *@*:*) ;;
         *) die "unsafe source url '$url' — allowed: https, http, ssh, git, file, or user@host:path" ;;
@@ -43,7 +43,17 @@ assert_safe_ref() {
     [ -z "$ref" ] && return 0
     case "$ref" in
         -*) die "unsafe git ref '$ref' — option-shaped" ;;
-        *[\"\'\ \\]*) die "unsafe git ref '$ref'" ;;
+        *[\"\'\ \\]*|*[[:cntrl:]]*) die "unsafe git ref '$ref'" ;;
+    esac
+}
+
+# Lexical package-subdirectory validation shared by acquisition and lock
+# preflight. Physical containment of acquired content is a separate boundary.
+assert_safe_package_path() {
+    # Preserve literal Git paths, but also guard Windows separator semantics.
+    local normalized="${1//\\//}"
+    case "$normalized" in
+        *..*|/*|[A-Za-z]:*|*[\"\']*|*[[:cntrl:]]*) die "unsafe path '$1'" ;;
     esac
 }
 
@@ -160,7 +170,9 @@ default_target_output() {
 }
 
 bundled_engine_version() {
-    tr -d ' \t\r\n' < "$IS_ENGINE_DIR/VERSION"
+    local version
+    version="$(< "$IS_ENGINE_DIR/VERSION")"
+    printf '%s' "${version//[$' \t\r\n']/}"
 }
 
 # --- The sync package's manifest/lock plumbing ---------------------------
@@ -297,6 +309,7 @@ project_has_packages() {
 ensure_project_current() {
     local root="$1" explicit="${2:-}" manifest="$1/intelligence.yaml" stamp eng
     check_version_compat "$manifest" || return $?
+    validate_project_lock "$root" || return $?
     if project_has_packages "$root" && [ ! -f "$root/intelligence.lock" ]; then
         die "manifest declares packages but intelligence.lock is absent — restore the committed lock before running project lifecycle commands"
     fi
@@ -310,6 +323,39 @@ ensure_project_current() {
     bash "$CLI_DIR/internal/align-project.sh" --no-sync
 }
 
+# A present lock is validated even when there is no missing store to restore.
+# Keep this before alignment: repairing the sync pin must not rewrite bad input.
+validate_project_lock() {
+    local lock="$1/intelligence.lock" output line rc=0
+    if [ -e "$lock" ] || [ -L "$lock" ]; then
+        output="$(lock_validate "$lock" "${2---metadata}" "$1/intelligence.yaml" 2>&1)" || rc=$?
+        while IFS= read -r line; do
+            [ -n "$line" ] || continue
+            case "$line" in
+                WARNING:*)
+                    case "${IS_LOCK_WARNINGS:-}" in *"$line"*) continue ;; esac
+                    # Suppress only duplicate messages across lifecycle children;
+                    # the lock itself is always parsed and validated again.
+                    export IS_LOCK_WARNINGS="${IS_LOCK_WARNINGS:-}$line"$'\n'
+                    ;;
+            esac
+            echo "$line" >&2
+        done <<< "$output"
+        if [ "$rc" -ne 0 ]; then
+            echo "ERROR: invalid intelligence.lock — recovery: https://github.com/ainova-systems/intelligence/blob/main/docs/cli.md#recovering-a-lock" >&2
+            return 1
+        fi
+    fi
+}
+
+# Read-only diagnosis must distinguish usable installed metadata from metadata
+# which could actually restore a missing store.
+check_project_lock() {
+    local mode=--metadata
+    if project_store_missing "$1"; then mode=--restore; fi
+    validate_project_lock "$1" "$mode"
+}
+
 project_store_missing() {
     local root="$1" manifest="$1/intelligence.yaml" name src
     while IFS= read -r name; do

package/cli/lib/lockfile.sh

@@ -10,38 +10,74 @@
 LOCKFILE_VERSION=1
 LOCK_SEP=$'\x1f'
 
-# top_scalar <file> <key> — one top-level scalar (`key: "value"`), quotes and
-# trailing comment stripped. The declared exception to "no new parsing": the
-# engine's read_schema_version is hardwired to its own key.
+# lock_validate <lock> [--metadata|--restore] [manifest] — read-only preflight. A subshell
+# contains the fail-fast input guards so status can report a failed verdict too.
+lock_validate() (
+    local lock="$1" mode="${2---metadata}" manifest="${3:-}" count=0
+    local kind name requested url path resolved sha line rows current
+    local -x CLI_INPUT_CONTEXT=""
+    [ "$#" -le 3 ] || die "internal: too many lock validation arguments"
+    case "$mode" in
+        --metadata|--restore) ;;
+        *) die "internal: unknown lock validation mode '$mode'" ;;
+    esac
+    # The same tokenizer supplies ordinary lock rows and strict metadata. Buffer
+    # before consumption: a failed parser must never yield a partial package set.
+    rows="$(_qmap_read lock "$lock" packages '' '' "$LOCKFILE_VERSION")" || return $?
+    current="$(bundled_engine_version)"
+    while IFS="$LOCK_SEP" read -r kind name requested url path resolved sha line; do
+        case "$kind" in
+            V)
+                [[ "$requested" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] \
+                    || die "$lock has missing or invalid engine_version"
+                continue
+                ;;
+            R) ;;
+            *) die "internal: unexpected lock record '$kind'" ;;
+        esac
+        count=$((count + 1))
+        CLI_INPUT_CONTEXT="$lock:$line: package $name, field name: "
+        assert_valid_pkg_name "$name"
+        CLI_INPUT_CONTEXT="$lock:$line: package $name, field url: "
+        assert_safe_source_url "$url"
+        CLI_INPUT_CONTEXT="$lock:$line: package $name, field resolved: "
+        [ -n "$resolved" ] || die "locked restore: $name has a missing resolved ref"
+        assert_safe_ref "$resolved"
+        CLI_INPUT_CONTEXT="$lock:$line: package $name, field path: "
+        assert_safe_package_path "$path"
+        CLI_INPUT_CONTEXT="$lock:$line: package $name, field sha: "
+        if [ -z "$sha" ]; then
+            if [ "$url" = "$SYNC_PKG_URL" ] && [ "$path" = "$SYNC_PKG_PATH" ] \
+                && [ "$resolved" = "v$current" ]; then
+                continue
+            fi
+            # engine_version records the writer CLI, which can differ from the
+            # preserved bundle pin after a same-major older CLI adds a package.
+            # Versioned bundle metadata admits alignment/installed content only;
+            # it must never authorize an unpinned cross-version acquisition.
+            if [ "$mode" = "--metadata" ] && [ "$url" = "$SYNC_PKG_URL" ] \
+                && [ "$path" = "$SYNC_PKG_PATH" ] && [[ "$resolved" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] \
+                && [ "${resolved%%.*}" = "v${current%%.*}" ]; then
+                echo "WARNING: $name at $resolved has no locked commit SHA; commit verification is unavailable for this development-bundle metadata" >&2
+                continue
+            fi
+        fi
+        [[ "$sha" =~ ^[0-9a-f]{40}$ || "$sha" =~ ^[0-9a-f]{64}$ ]] \
+            || die "locked restore: $name has a missing or invalid commit SHA — restore a valid intelligence.lock"
+    done <<< "$rows"
+    if [ "$count" -eq 0 ] && [ -n "$manifest" ] && [ -n "$(qmap_keys "$manifest" packages)" ]; then
+        die "$lock: packages is empty but the manifest declares packages — restore their recorded identities"
+    fi
+)
+
+# top_scalar <file> <key> — one top-level scalar through the shared tokenizer.
 top_scalar() {
-    [ -f "$1" ] || return 0
-    awk -v key="$2" '
-        { sub(/\r$/, "") }
-        $0 ~ "^" key ":" {
-            v = substr($0, length(key) + 2)
-            sub(/^[ \t]+/, "", v)
-            if (v ~ /^"/) { v = substr(v, 2); q = index(v, "\""); if (q > 0) v = substr(v, 1, q - 1) }
-            else { sub(/[ \t]+#.*$/, "", v); sub(/[ \t]+$/, "", v) }
-            print v
-            exit
-        }
-    ' "$1"
+    _qmap_read top "$1" '' "$2"
 }
 
 # lock_to_tsv <lock> — every locked package as one row.
 lock_to_tsv() {
-    local lock="$1" name
-    [ -f "$lock" ] || return 0
-    while IFS= read -r name; do
-        [ -n "$name" ] || continue
-        printf '%s\037%s\037%s\037%s\037%s\037%s\n' \
-            "$name" \
-            "$(qmap_field "$lock" "packages" "$name" "requested")" \
-            "$(qmap_field "$lock" "packages" "$name" "url")" \
-            "$(qmap_field "$lock" "packages" "$name" "path")" \
-            "$(qmap_field "$lock" "packages" "$name" "resolved")" \
-            "$(qmap_field "$lock" "packages" "$name" "sha")"
-    done < <(qmap_keys "$lock" "packages")
+    _qmap_read rows "$1" packages
 }
 
 # lock_write_from_tsv <lock> <tsv-file> — rebuild the lock. Entries are
@@ -58,7 +94,15 @@ lock_write_from_tsv() {
         # them (registry-supplied url/path included) must be escaped, or it
         # would break or alias the neighbouring field.
         awk -F"$LOCK_SEP" '
-            function esc(s) { gsub(/\\/, "\\\\", s); gsub(/"/, "\\\"", s); return s }
+            function esc(s,    i, c, out) {
+                out = ""
+                for (i = 1; i <= length(s); i++) {
+                    c = substr(s, i, 1)
+                    if (c == "\\" || c == "\"") out = out "\\"
+                    out = out c
+                }
+                return out
+            }
             NF >= 6 {
                 print "  \"" esc($1) "\":"
                 if ($2 != "") print "    requested: \"" esc($2) "\""

package/cli/lib/manifest.sh

@@ -87,7 +87,8 @@ target_set_enabled() {
     case "$enabled" in true|false) ;; *) die "internal: invalid target state '$enabled'" ;; esac
     target_exists "$file" "$target" && target_missing=0
     output="$(_yq_esc "$output")"
-    _qmap_stage "$file" -v target="$target" -v enabled="$enabled" -v output="$output" -v target_missing="$target_missing" '
+    QMAP_EDIT_VALUE="$output" _qmap_stage "$file" -v target="$target" -v enabled="$enabled" -v target_missing="$target_missing" '
+        BEGIN { output = ENVIRON["QMAP_EDIT_VALUE"] }
         function entry() { return "  " target ": { enabled: " enabled ", output: \"" output "\" }" }
         function insert_missing_target() {
             if (in_targets && target_missing && !target_seen) { print entry(); target_seen = 1 }
@@ -154,71 +155,33 @@ target_set_enabled() {
     '
 }
 
-# qmap_keys <file> <block> — quoted keys, one per line.
-qmap_keys() {
-    [ -f "$1" ] || return 0
-    awk -v block="$2" '
-        { sub(/\r$/, "") }
-        $0 ~ "^" block ":[ \t]*$" { inb = 1; next }
-        inb && /^[^ #]/ { inb = 0 }
-        inb {
-            if ($0 ~ /^  "/) {
-                s = substr($0, 4)
-                q = index(s, "\"")
-                if (q > 0) print substr(s, 1, q - 1)
-            }
-        }
-    ' "$1"
+# _qmap_read <mode> <file> <block> [key] [field] [expected-lock-version]
+# All scalar reads and strict lock records share one tokenizer. Environment
+# transport preserves literal backslashes that awk -v would interpret again.
+_qmap_read() {
+    local mode="$1" file="$2"
+    if [ ! -f "$file" ] || [ ! -r "$file" ]; then
+        case "$mode" in
+            lock|validate) echo "cannot read $file" >&2; return 1 ;;
+            *) return 0 ;;
+        esac
+    fi
+    QMAP_MODE="$mode" QMAP_FILE="$file" QMAP_BLOCK="${3:-}" \
+        QMAP_KEY="${4:-}" QMAP_FIELD="${5:-}" QMAP_EXPECTED_VERSION="${6:-}" \
+        LC_ALL=C awk -f "${BASH_SOURCE[0]%/*}/qmap.awk" < "$file"
 }
 
-# qmap_field <file> <block> <key> <field> — 4-indent field value under a
-# quoted key; strips surrounding quotes and a trailing unquoted comment.
-qmap_field() {
-    [ -f "$1" ] || return 0
-    awk -v block="$2" -v key="$3" -v field="$4" '
-        { sub(/\r$/, "") }
-        $0 ~ "^" block ":[ \t]*$" { inb = 1; next }
-        inb && /^[^ #]/ { inb = 0; ink = 0 }
-        inb && /^  "/ {
-            s = substr($0, 4); q = index(s, "\"")
-            ink = (q > 0 && substr(s, 1, q - 1) == key)
-            next
-        }
-        inb && ink && /^    [A-Za-z_]/ {
-            line = $0
-            sub(/^    /, "", line)
-            c = index(line, ":")
-            if (c == 0) next
-            if (substr(line, 1, c - 1) != field) next
-            v = substr(line, c + 1)
-            sub(/^[ \t]+/, "", v)
-            if (v ~ /^"/) { v = substr(v, 2); q2 = index(v, "\""); if (q2 > 0) v = substr(v, 1, q2 - 1) }
-            else { sub(/[ \t]+#.*$/, "", v); sub(/[ \t]+$/, "", v) }
-            print v
-            exit
-        }
-    ' "$1"
-}
+# qmap_validate_document <file> <block> — structural validation only.
+qmap_validate_document() { _qmap_read validate "$1" "$2"; }
 
-# qmap_value <file> <block> <key> — flat form: `  "key": "value"`.
-qmap_value() {
-    [ -f "$1" ] || return 0
-    awk -v block="$2" -v key="$3" '
-        { sub(/\r$/, "") }
-        $0 ~ "^" block ":[ \t]*$" { inb = 1; next }
-        inb && /^[^ #]/ { inb = 0 }
-        inb && /^  "/ {
-            s = substr($0, 4); q = index(s, "\"")
-            if (q == 0 || substr(s, 1, q - 1) != key) next
-            v = substr(s, q + 1)
-            sub(/^:[ \t]*/, "", v)
-            if (v ~ /^"/) { v = substr(v, 2); q2 = index(v, "\""); if (q2 > 0) v = substr(v, 1, q2 - 1) }
-            else { sub(/[ \t]+#.*$/, "", v); sub(/[ \t]+$/, "", v) }
-            if (v != "") print v
-            exit
-        }
-    ' "$1"
-}
+# qmap_keys <file> <block> — quoted keys in document order.
+qmap_keys() { _qmap_read keys "$1" "$2"; }
+
+# qmap_field <file> <block> <key> <field> — decoded nested scalar.
+qmap_field() { _qmap_read field "$1" "$2" "$3" "$4"; }
+
+# qmap_value <file> <block> <key> — decoded flat scalar.
+qmap_value() { _qmap_read value "$1" "$2" "$3"; }
 
 # _qmap_stage <file> <awk-program> [awk args…] — run an editing pass, verify
 # it produced output, commit.
@@ -245,7 +208,8 @@ qmap_set() {
     # url/path values can carry a `"`; escape before it reaches the quoted
     # scalar the writer emits.
     value="$(_yq_esc "$value")"
-    _qmap_stage "$file" -v block="$block" -v key="$key" -v field="$field" -v value="$value" '
+    QMAP_EDIT_VALUE="$value" _qmap_stage "$file" -v block="$block" -v key="$key" -v field="$field" '
+        BEGIN { value = ENVIRON["QMAP_EDIT_VALUE"] }
         function keyline()   { return "  \"" key "\":" }
         function fieldline() { return "    " field ": \"" value "\"" }
         function flush_key() {
@@ -292,7 +256,8 @@ qmap_set_value() {
     local file="$1" block="$2" key="$3" value="$4"
     [ -f "$file" ] || die "no such file: $file"
     value="$(_yq_esc "$value")"
-    _qmap_stage "$file" -v block="$block" -v key="$key" -v value="$value" '
+    QMAP_EDIT_VALUE="$value" _qmap_stage "$file" -v block="$block" -v key="$key" '
+        BEGIN { value = ENVIRON["QMAP_EDIT_VALUE"] }
         function entry() { return "  \"" key "\": \"" value "\"" }
         { sub(/\r$/, "") }
         $0 ~ "^" block ":[ \t]*$" { blockseen = 1; inb = 1; print; next }

package/cli/lib/qmap.awk

@@ -0,0 +1,191 @@
+# Shared tokenizer for the CLI-owned quoted-key map and scalar document shape.
+# Reader modes ignore unrelated YAML. Lock mode validates the whole document
+# before publishing rows, so a bad later entry never yields a partial result.
+BEGIN {
+    mode = ENVIRON["QMAP_MODE"]
+    block = ENVIRON["QMAP_BLOCK"]
+    wanted_key = ENVIRON["QMAP_KEY"]
+    wanted_field = ENVIRON["QMAP_FIELD"]
+    expected_version = ENVIRON["QMAP_EXPECTED_VERSION"]
+    source_file = ENVIRON["QMAP_FILE"]
+    strict = (mode == "lock" || mode == "validate")
+    sep = sprintf("%c", 31)
+    single_quote = sprintf("%c", 39)
+}
+
+function error_at(reason, line) {
+    if (problem == "") {
+        problem = reason
+        problem_line = line
+    }
+}
+
+# quoted() also parses keys. quote_end leaves the caller at the delimiter;
+# decoded contains literal bytes, with the writer's two escapes decoded once.
+function quoted(s,    i, c, escaped) {
+    decoded = ""
+    quote_end = 0
+    for (i = 2; i <= length(s); i++) {
+        c = substr(s, i, 1)
+        if (c == "\"") {
+            quote_end = i
+            return 1
+        }
+        if (c == "\\") {
+            if (++i > length(s)) return 0
+            escaped = substr(s, i, 1)
+            if (escaped == "\\" || escaped == "\"") c = escaped
+            else {
+                if (strict) return 0
+                c = "\\" escaped
+            }
+        }
+        if (strict && c ~ /[[:cntrl:]]/) return 0
+        decoded = decoded c
+    }
+    return 0
+}
+
+function scalar(s,    tail) {
+    decoded = ""
+    empty_scalar = 0
+    sub(/^[ \t]+/, "", s)
+    if (s == "" || s ~ /^#/) {
+        empty_scalar = 1
+        return 1
+    }
+    if (s ~ /^"/) {
+        if (!quoted(s)) return 0
+        tail = substr(s, quote_end + 1)
+        return !strict || tail ~ /^([ \t]*|[ \t]+#.*)$/
+    }
+    sub(/[ \t]+#.*$/, "", s)
+    sub(/[ \t]+$/, "", s)
+    if (strict) {
+        if (s ~ /[[:cntrl:]]/ || substr(s, 1, 1) == single_quote) return 0
+        if (s ~ /^[!&*\[\]{}>|%@`]/ || s ~ /^[?:-]([ \t]|$)/ || s ~ /"|:[ \t]/) return 0
+        if (s ~ /^(null|Null|NULL|~|true|True|TRUE|false|False|FALSE)$/) return 0
+    }
+    decoded = s
+    return 1
+}
+
+# Tokenization is shared by permissive reads and strict lock validation.
+function token(line,    text, colon, tail) {
+    kind = ""
+    key = ""
+    value = ""
+    empty = 0
+    if (line ~ /^[A-Za-z_]/) {
+        kind = "top"
+        text = line
+    } else if (line ~ /^    [A-Za-z_]/) {
+        kind = "field"
+        text = substr(line, 5)
+    } else if (line ~ /^  "/) {
+        kind = "package"
+        text = substr(line, 3)
+        if (!quoted(text)) return 0
+        key = decoded
+        tail = substr(text, quote_end + 1)
+        if (substr(tail, 1, 1) != ":") return 0
+        if (!scalar(substr(tail, 2))) return 0
+        value = decoded
+        empty = empty_scalar
+        return 1
+    } else return 0
+    colon = index(text, ":")
+    if (!colon) return 0
+    key = substr(text, 1, colon - 1)
+    if (strict && key !~ /^[A-Za-z_][A-Za-z0-9_]*$/) return 0
+    if (!scalar(substr(text, colon + 1))) return 0
+    value = decoded
+    empty = empty_scalar
+    return 1
+}
+
+{
+    sub(/\r$/, "")
+    if ($0 ~ /^[ \t]*(#.*)?$/) next
+    if (!token($0)) {
+        if (strict) {
+            context = ""
+            if (key ~ /^[A-Za-z_][A-Za-z0-9_]*$/) {
+                if (kind == "field" && package != "") context = "package " package ", field " key ": "
+                else if (kind == "top") context = "field " key ": "
+            }
+            error_at(context "malformed lock structure or unsupported scalar", NR)
+        }
+        if ($0 ~ /^[^ #\t]/) { in_block = 0; package = "" }
+        next
+    }
+    if (kind == "top") {
+        in_block = (key == block && empty)
+        package = ""
+        if (strict && top_seen[key]++) error_at("duplicate top-level field " key, NR)
+        if (!(key in top_value)) top_value[key] = value
+        if (mode == "top" && key == wanted_key && !found) { result = value; found = 1 }
+        if (strict) {
+            if (key == block) {
+                block_seen = 1
+                if (!empty) error_at(block " must be a block map", NR)
+            } else if (empty) error_at("expected scalar for " key, NR)
+        }
+        next
+    }
+    if (kind == "package" && in_block) {
+        package = key
+        row_count++
+        row_name[row_count] = key
+        row_line[row_count] = NR
+        if (strict) {
+            if (key == "") error_at("empty package key", NR)
+            if (package_seen[key]++) error_at("duplicate package " key, NR)
+            if (!empty) error_at("expected field map for " key, NR)
+        }
+        if (mode == "value" && key == wanted_key && !found) { result = value; found = 1 }
+        next
+    }
+    if (kind == "field" && in_block && package != "") {
+        identity = package SUBSEP key
+        if (strict && field_seen[identity]++) error_at("duplicate field " package "." key, NR)
+        if (!(identity in field_value)) field_value[identity] = value
+        if (strict && empty) error_at("expected scalar for " package "." key, NR)
+        if (mode == "field" && package == wanted_key && key == wanted_field && !found) {
+            result = value
+            found = 1
+        }
+        next
+    }
+    if (strict) error_at("malformed lock structure: expected top-level scalar or quoted package field", NR)
+}
+
+END {
+    # Read the format header before interpreting a future body's shape. Errors
+    # were retained during the single pass so header placement does not matter.
+    if (mode == "lock" && top_value["lockfile_version"] != expected_version) {
+        version = top_value["lockfile_version"]
+        print source_file " has unsupported or missing lockfile_version '" (version == "" ? "<missing>" : version) "' — expected " expected_version > "/dev/stderr"
+        exit 1
+    }
+    if (strict && problem != "") {
+        print source_file ":" problem_line ": " problem > "/dev/stderr"
+        exit 1
+    }
+    if (strict && !block_seen) {
+        print source_file ": missing " block " block" > "/dev/stderr"
+        exit 1
+    }
+    if (mode == "lock") print "V" sep top_value["lockfile_version"] sep top_value["engine_version"]
+    if (mode == "rows" || mode == "lock" || mode == "keys") {
+        for (i = 1; i <= row_count; i++) {
+            name = row_name[i]
+            if (mode == "keys") print name
+            else {
+                row = name sep field_value[name SUBSEP "requested"] sep field_value[name SUBSEP "url"] sep field_value[name SUBSEP "path"] sep field_value[name SUBSEP "resolved"] sep field_value[name SUBSEP "sha"]
+                if (mode == "lock") print "R" sep row sep row_line[i]
+                else print row
+            }
+        }
+    } else if (found) print result
+}

package/cli/lib/registry.sh

@@ -122,6 +122,7 @@ fetch_package() {
     local url="$1" ref="$2" subpath="$3" dest="$4" locked_sha="${5:-}" bundle_sha=""
     assert_safe_source_url "$url"
     assert_safe_ref "$ref"
+    assert_safe_package_path "$subpath"
     # Bundle seed: the engine-content package at the CLI's own version copies
     # from the npm bundle — no network, which keeps init, sync restoration and
     # archived-project conversion offline. Keyed on the
@@ -186,9 +187,6 @@ fetch_package() {
     fi
     src="$tmp/clone"
     if [ -n "$subpath" ]; then
-        case "$subpath" in
-            *..*|/*|*[\"\']*) rm -rf "$tmp"; die "unsafe path '$subpath'" ;;
-        esac
         src="$tmp/clone/$subpath"
         [ -d "$src" ] || { rm -rf "$tmp"; die "path '$subpath' not found in $url${ref:+@$ref}" ; }
     fi

package/engine/ENGINE_SHA

@@ -1 +1 @@
-3413f7d6f9ef181368b16b90e36d77360cb5f479
+fe187a9bee5923603cec51798bd1ea5c2860593e

package/engine/VERSION

@@ -1 +1 @@
-0.11.8
+0.11.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ainova-systems/intelligence",
-  "version": "0.11.8",
+  "version": "0.11.9",
   "description": "Build, version and distribute AI agent intelligence across your organization — one CLI, versioned Intelligence Packages, and a sync engine for Claude Code, Cursor, Copilot, Codex, Pi and OpenCode.",
   "bin": {
     "intelligence": "bin/intelligence.js"