@ainova-systems/intelligence 0.11.8 → 0.12.0

package/cli/commands/init.sh

@@ -123,6 +123,7 @@ case "$IP_MODE" in
         [ "$force" -eq 0 ] || die "--force applies only when converting a legacy Intelligence Sync project"
         if [ "$preview" -eq 1 ]; then
             check_version_compat "$IP_ROOT/intelligence.yaml"
+            validate_project_lock "$IP_ROOT"
             echo "project: Intelligence CLI at $IP_ROOT"
             if project_stamped_ahead "$IP_ROOT"; then
                 echo "  project schema $(read_schema_version "$IP_ROOT/intelligence.yaml") is ahead of engine $(bundled_engine_version) — left as is (update the CLI)"
@@ -223,9 +224,20 @@ if [ -n "$targets_arg" ]; then
 else
     if [ -d "$root/.claude" ] || [ -f "$root/CLAUDE.md" ]; then targets="$targets claude"; fi
     if [ -d "$root/.cursor" ] || [ -f "$root/.cursorrules" ]; then targets="$targets cursor"; fi
-    if [ -d "$root/.codex" ] || [ -d "$root/.agents" ]; then targets="$targets codex"; fi
+    # `.agents/skills` is the only part of the shared root Codex reads, so it is
+    # the only part that may imply Codex. `.agents/` as a whole cannot: its
+    # `rules/`, `agents/` and `workflows/` siblings belong to Antigravity, and
+    # treating them as a Codex marker would invent a tool the project shows no
+    # trace of.
+    if [ -d "$root/.codex" ] || [ -d "$root/.agents/skills" ]; then targets="$targets codex"; fi
     [ -d "$root/.pi" ] && targets="$targets pi"
     [ -d "$root/.opencode" ] && targets="$targets opencode"
+    if [ -f "$root/GEMINI.md" ] \
+        || [ -d "$root/.agents/rules" ] \
+        || [ -d "$root/.agents/agents" ] \
+        || [ -d "$root/.agents/workflows" ]; then
+        targets="$targets antigravity"
+    fi
     if [ -f "$root/.github/copilot-instructions.md" ] \
         || [ -d "$root/.github/instructions" ] \
         || [ -d "$root/.github/agents" ] \

package/cli/commands/status.sh

@@ -12,22 +12,32 @@ esac
 detect_project
 case "$IP_MODE" in
     cli)
+        lock_valid=1
         echo "Project:  $IP_ROOT (Intelligence project)"
         echo "Manifest: intelligence.yaml (schema_version $(read_schema_version "$IP_ROOT/intelligence.yaml"))"
-        if [ -f "$IP_ROOT/intelligence.lock" ]; then
+        if ! check_project_lock "$IP_ROOT"; then
+            lock_valid=0
+            echo "Lockfile: INVALID (locked state unchecked)"
+        elif [ -f "$IP_ROOT/intelligence.lock" ]; then
             echo "Lockfile: intelligence.lock"
         elif [ -n "$(qmap_keys "$IP_ROOT/intelligence.yaml" "packages")" ]; then
             echo "Lockfile: MISSING (manifest declares packages)"
         else
             echo "Lockfile: none (no packages added yet)"
         fi
-        sync_locked="$(qmap_field "$IP_ROOT/intelligence.lock" "packages" "$SYNC_PKG_NAME" "resolved")"
-        if [ -n "$sync_locked" ]; then
+        sync_locked=""
+        if [ "$lock_valid" -eq 1 ]; then
+            sync_locked="$(qmap_field "$IP_ROOT/intelligence.lock" "packages" "$SYNC_PKG_NAME" "resolved")"
+        fi
+        if [ "$lock_valid" -eq 0 ]; then
+            echo "Content:  unchecked"
+        elif [ -n "$sync_locked" ]; then
             echo "Content:  $SYNC_PKG_NAME at $sync_locked"
         else
             echo "Content:  no $SYNC_PKG_NAME (bare setup)"
         fi
         echo "Engine:   $(bundled_engine_version) (bundled with the CLI)"
+        [ "$lock_valid" -eq 1 ] || exit 1
         ;;
     legacy)
         echo "Project:  $IP_ROOT (legacy Intelligence Sync)"

package/cli/commands/update.sh

@@ -22,6 +22,7 @@ done
 require_cli_project
 manifest="$IP_ROOT/intelligence.yaml"
 check_version_compat "$manifest"
+validate_project_lock "$IP_ROOT"
 eng="$(bundled_engine_version)"
 stamp="$(read_schema_version "$manifest")"
 project_change=0

package/cli/internal/check.sh

@@ -31,6 +31,12 @@ esac
 echo "project: $IP_ROOT"
 manifest="$IP_ROOT/intelligence.yaml"
 lock="$IP_ROOT/intelligence.lock"
+lock_valid=1
+if ! check_project_lock "$IP_ROOT"; then
+    problems=$((problems + 1))
+    lock_valid=0
+    note "locked package identities cannot be inspected; continuing independent project checks"
+fi
 
 stamp="$(read_schema_version "$manifest")"
 eng="$(bundled_engine_version)"
@@ -50,7 +56,10 @@ fi
 
 # The engine-content package must sit at the bundled engine version — the
 # content documents exactly the scripts the CLI executes.
-sync_locked="$(qmap_field "$lock" "packages" "$SYNC_PKG_NAME" "resolved")"
+sync_locked=""
+if [ "$lock_valid" -eq 1 ]; then
+    sync_locked="$(qmap_field "$lock" "packages" "$SYNC_PKG_NAME" "resolved")"
+fi
 if [ -n "$sync_locked" ]; then
     if [ "${sync_locked#v}" = "$eng" ]; then
         ok "$SYNC_PKG_NAME at $sync_locked (matches the engine)"
@@ -70,6 +79,10 @@ fi
 while IFS= read -r name; do
     [ -n "$name" ] || continue
     assert_valid_pkg_name "$name"
+    if [ "$lock_valid" -eq 0 ]; then
+        note "$name: locked state unchecked"
+        continue
+    fi
     if [ -z "$(qmap_field "$lock" "packages" "$name" "url")" ]; then
         warn "$name is in the manifest but not in intelligence.lock — run 'intelligence init'"
     else
@@ -143,7 +156,7 @@ while IFS= read -r target; do
 done < <(target_names "$manifest")
 
 # Lock orphans.
-if [ -f "$lock" ]; then
+if [ "$lock_valid" -eq 1 ] && [ -f "$lock" ]; then
     while IFS= read -r name; do
         [ -n "$name" ] || continue
         found=0
@@ -165,7 +178,13 @@ for section in rules agents skills; do
         if [ ! -d "$IP_ROOT/$src" ]; then
             case "$src" in
                 # Store content is restorable state: absent means un-installed.
-                .intelligence/*) warn "sources.$section '$src' missing — run 'intelligence sync'" ;;
+                .intelligence/*)
+                    if [ "$lock_valid" -eq 1 ]; then
+                        warn "sources.$section '$src' missing — run 'intelligence sync'"
+                    else
+                        warn "sources.$section '$src' missing — resolve the lock problem first"
+                    fi
+                    ;;
                 # A project-owned dir that does not exist yet is a legitimate
                 # state — a project consuming only packages authors nothing of
                 # its own — and the engine simply skips it. Declared up front so

package/cli/internal/convert-legacy.sh

@@ -183,7 +183,9 @@ while IFS="$LOCK_SEP" read -r pack name url ref mirror; do
         mkdir -p "$dest"
         cp -R "$root/$mirror/." "$dest/"
         if [ -f "$dest/.pack" ]; then
-            sha="$(awk -F= '$1 == "sha" {print $2; exit}' "$dest/.pack")"
+            sha="$(awk -F= '{ sub(/\r$/, "") } $1 == "sha" {print $2; exit}' "$dest/.pack")"
+            [[ "$sha" =~ ^[0-9a-f]{40}$ || "$sha" =~ ^[0-9a-f]{64}$ ]] \
+                || die "pack '$pack' mirror '$mirror' has a missing or invalid recorded commit SHA in .pack — legacy project unchanged; restore its trusted ownership stamp from history or refresh the mirror with its archived engine, then rerun 'intelligence init'"
             rm -f "$dest/.pack"
         fi
         echo "  pack '$pack' -> $name (from mirror $mirror)"
@@ -191,9 +193,8 @@ while IFS="$LOCK_SEP" read -r pack name url ref mirror; do
         sha="$(fetch_package "$url" "$ref" "" "$dest")"
         echo "  pack '$pack' -> $name (fetched)"
     fi
-    if [ -z "$sha" ] || [ "$sha" = "unknown" ]; then
-        sha="$(GIT_TERMINAL_PROMPT=0 git ls-remote -- "$url" "$ref" 2>/dev/null | awk '{print $1; exit}')"
-    fi
+    # A ref currently advertised by the remote cannot prove which commit
+    # produced an existing mirror. Only its recorded identity can do that.
     [ -n "$ref" ] || ref="HEAD"
     printf '%s\037%s\037%s\037%s\037%s\037%s\n' \
         "$name" "" "$url" "" "$ref" "$sha" >> "$lock_rows"

package/cli/internal/package-list.sh

@@ -6,6 +6,8 @@ source "$CLI_DIR/lib/cli-common.sh"
 require_cli_project
 manifest="$IP_ROOT/intelligence.yaml"
 lock="$IP_ROOT/intelligence.lock"
+lock_valid=1
+if ! check_project_lock "$IP_ROOT"; then lock_valid=0; fi
 
 count=0
 while IFS= read -r name; do
@@ -13,9 +15,14 @@ while IFS= read -r name; do
     count=$((count + 1))
     range="$(qmap_field "$manifest" "packages" "$name" "version")"
     ref="$(qmap_field "$manifest" "packages" "$name" "ref")"
-    resolved="$(qmap_field "$lock" "packages" "$name" "resolved")"
-    sha="$(qmap_field "$lock" "packages" "$name" "sha")"
-    if [ ! -f "$lock" ]; then
+    resolved="" sha=""
+    if [ "$lock_valid" -eq 1 ]; then
+        resolved="$(qmap_field "$lock" "packages" "$name" "resolved")"
+        sha="$(qmap_field "$lock" "packages" "$name" "sha")"
+    fi
+    if [ "$lock_valid" -eq 0 ]; then
+        state="invalid lock — locked state unchecked"
+    elif [ ! -f "$lock" ]; then
         state="lock missing — restore committed intelligence.lock"
     elif [ -d "$IP_ROOT/.intelligence/packages/$name" ]; then
         state="installed"
@@ -30,5 +37,8 @@ while IFS= read -r name; do
 done < <(qmap_keys "$manifest" "packages")
 
 if [ "$count" -eq 0 ]; then
-    echo "No packages. Add one: intelligence package add @ainova-systems/core"
+    if [ "$lock_valid" -eq 1 ]; then
+        echo "No packages. Add one: intelligence package add @ainova-systems/core"
+    fi
 fi
+[ "$lock_valid" -eq 1 ] || exit 1

package/cli/internal/restore.sh

@@ -21,6 +21,7 @@ done
 require_cli_project
 manifest="$IP_ROOT/intelligence.yaml"
 lock="$IP_ROOT/intelligence.lock"
+validate_project_lock "$IP_ROOT" --restore
 
 # --frozen is the reproducibility contract: the lock must agree with the
 # manifest on the package SET and on every requested-intent field before a
@@ -50,20 +51,6 @@ if [ "$frozen" -eq 1 ]; then
     done < <(qmap_keys "$lock" "packages")
 fi
 
-# Check every required commit identity before restoring any package. Only the
-# matching bundled content may carry the historical empty development-build SHA.
-while IFS="$LOCK_SEP" read -r name _requested url path resolved sha; do
-    [ -n "$name" ] || continue
-    assert_valid_pkg_name "$name"
-    assert_safe_source_url "$url"
-    assert_safe_ref "$resolved"
-    if [ -z "$sha" ] && is_bundle_source "$url" "$resolved" "$path"; then
-        continue
-    fi
-    [[ "$sha" =~ ^[0-9a-f]{40}$ || "$sha" =~ ^[0-9a-f]{64}$ ]] \
-        || die "locked restore: $name has a missing or invalid commit SHA — restore a valid intelligence.lock"
-done < <(lock_to_tsv "$lock")
-
 # Manifest packages missing from the lock: resolve them now (npm install
 # semantics). Under --frozen the drift gate above has already refused.
 missing=""

package/cli/lib/cli-common.sh

@@ -14,7 +14,7 @@ source "$IS_ENGINE_DIR/lib/contract.sh"
 source "$IS_ENGINE_DIR/lib/adapter-contract.sh"
 
 die() {
-    echo "ERROR: $*" >&2
+    echo "ERROR: ${CLI_INPUT_CONTEXT:-}$*" >&2
     exit 1
 }
 
@@ -30,7 +30,7 @@ assert_safe_source_url() {
     local url="$1"
     case "$url" in
         ""|-*) die "unsafe source url '$url' — option-shaped or empty" ;;
-        *[\"\'\ ]*) die "unsafe source url '$url' — quotes or spaces" ;;
+        *[\"\'\ ]*|*[[:cntrl:]]*) die "unsafe source url '$url' — quotes or whitespace" ;;
         https://*|http://*|ssh://*|git://*|file://*) ;;
         *@*:*) ;;
         *) die "unsafe source url '$url' — allowed: https, http, ssh, git, file, or user@host:path" ;;
@@ -43,7 +43,17 @@ assert_safe_ref() {
     [ -z "$ref" ] && return 0
     case "$ref" in
         -*) die "unsafe git ref '$ref' — option-shaped" ;;
-        *[\"\'\ \\]*) die "unsafe git ref '$ref'" ;;
+        *[\"\'\ \\]*|*[[:cntrl:]]*) die "unsafe git ref '$ref'" ;;
+    esac
+}
+
+# Lexical package-subdirectory validation shared by acquisition and lock
+# preflight. Physical containment of acquired content is a separate boundary.
+assert_safe_package_path() {
+    # Preserve literal Git paths, but also guard Windows separator semantics.
+    local normalized="${1//\\//}"
+    case "$normalized" in
+        *..*|/*|[A-Za-z]:*|*[\"\']*|*[[:cntrl:]]*) die "unsafe path '$1'" ;;
     esac
 }
 
@@ -154,13 +164,16 @@ manifest_intelligence_dir() {
 default_target_output() {
     case "$1" in
         agents) printf '%s' "AGENTS.md" ;;
+        antigravity) printf '%s' ".agents" ;;
         copilot) printf '%s' ".github" ;;
         *) printf '.%s' "$1" ;;
     esac
 }
 
 bundled_engine_version() {
-    tr -d ' \t\r\n' < "$IS_ENGINE_DIR/VERSION"
+    local version
+    version="$(< "$IS_ENGINE_DIR/VERSION")"
+    printf '%s' "${version//[$' \t\r\n']/}"
 }
 
 # --- The sync package's manifest/lock plumbing ---------------------------
@@ -297,6 +310,7 @@ project_has_packages() {
 ensure_project_current() {
     local root="$1" explicit="${2:-}" manifest="$1/intelligence.yaml" stamp eng
     check_version_compat "$manifest" || return $?
+    validate_project_lock "$root" || return $?
     if project_has_packages "$root" && [ ! -f "$root/intelligence.lock" ]; then
         die "manifest declares packages but intelligence.lock is absent — restore the committed lock before running project lifecycle commands"
     fi
@@ -310,6 +324,39 @@ ensure_project_current() {
     bash "$CLI_DIR/internal/align-project.sh" --no-sync
 }
 
+# A present lock is validated even when there is no missing store to restore.
+# Keep this before alignment: repairing the sync pin must not rewrite bad input.
+validate_project_lock() {
+    local lock="$1/intelligence.lock" output line rc=0
+    if [ -e "$lock" ] || [ -L "$lock" ]; then
+        output="$(lock_validate "$lock" "${2---metadata}" "$1/intelligence.yaml" 2>&1)" || rc=$?
+        while IFS= read -r line; do
+            [ -n "$line" ] || continue
+            case "$line" in
+                WARNING:*)
+                    case "${IS_LOCK_WARNINGS:-}" in *"$line"*) continue ;; esac
+                    # Suppress only duplicate messages across lifecycle children;
+                    # the lock itself is always parsed and validated again.
+                    export IS_LOCK_WARNINGS="${IS_LOCK_WARNINGS:-}$line"$'\n'
+                    ;;
+            esac
+            echo "$line" >&2
+        done <<< "$output"
+        if [ "$rc" -ne 0 ]; then
+            echo "ERROR: invalid intelligence.lock — recovery: https://github.com/ainova-systems/intelligence/blob/main/docs/cli.md#recovering-a-lock" >&2
+            return 1
+        fi
+    fi
+}
+
+# Read-only diagnosis must distinguish usable installed metadata from metadata
+# which could actually restore a missing store.
+check_project_lock() {
+    local mode=--metadata
+    if project_store_missing "$1"; then mode=--restore; fi
+    validate_project_lock "$1" "$mode"
+}
+
 project_store_missing() {
     local root="$1" manifest="$1/intelligence.yaml" name src
     while IFS= read -r name; do

package/cli/lib/lockfile.sh

@@ -10,38 +10,74 @@
 LOCKFILE_VERSION=1
 LOCK_SEP=$'\x1f'
 
-# top_scalar <file> <key> — one top-level scalar (`key: "value"`), quotes and
-# trailing comment stripped. The declared exception to "no new parsing": the
-# engine's read_schema_version is hardwired to its own key.
+# lock_validate <lock> [--metadata|--restore] [manifest] — read-only preflight. A subshell
+# contains the fail-fast input guards so status can report a failed verdict too.
+lock_validate() (
+    local lock="$1" mode="${2---metadata}" manifest="${3:-}" count=0
+    local kind name requested url path resolved sha line rows current
+    local -x CLI_INPUT_CONTEXT=""
+    [ "$#" -le 3 ] || die "internal: too many lock validation arguments"
+    case "$mode" in
+        --metadata|--restore) ;;
+        *) die "internal: unknown lock validation mode '$mode'" ;;
+    esac
+    # The same tokenizer supplies ordinary lock rows and strict metadata. Buffer
+    # before consumption: a failed parser must never yield a partial package set.
+    rows="$(_qmap_read lock "$lock" packages '' '' "$LOCKFILE_VERSION")" || return $?
+    current="$(bundled_engine_version)"
+    while IFS="$LOCK_SEP" read -r kind name requested url path resolved sha line; do
+        case "$kind" in
+            V)
+                [[ "$requested" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] \
+                    || die "$lock has missing or invalid engine_version"
+                continue
+                ;;
+            R) ;;
+            *) die "internal: unexpected lock record '$kind'" ;;
+        esac
+        count=$((count + 1))
+        CLI_INPUT_CONTEXT="$lock:$line: package $name, field name: "
+        assert_valid_pkg_name "$name"
+        CLI_INPUT_CONTEXT="$lock:$line: package $name, field url: "
+        assert_safe_source_url "$url"
+        CLI_INPUT_CONTEXT="$lock:$line: package $name, field resolved: "
+        [ -n "$resolved" ] || die "locked restore: $name has a missing resolved ref"
+        assert_safe_ref "$resolved"
+        CLI_INPUT_CONTEXT="$lock:$line: package $name, field path: "
+        assert_safe_package_path "$path"
+        CLI_INPUT_CONTEXT="$lock:$line: package $name, field sha: "
+        if [ -z "$sha" ]; then
+            if [ "$url" = "$SYNC_PKG_URL" ] && [ "$path" = "$SYNC_PKG_PATH" ] \
+                && [ "$resolved" = "v$current" ]; then
+                continue
+            fi
+            # engine_version records the writer CLI, which can differ from the
+            # preserved bundle pin after a same-major older CLI adds a package.
+            # Versioned bundle metadata admits alignment/installed content only;
+            # it must never authorize an unpinned cross-version acquisition.
+            if [ "$mode" = "--metadata" ] && [ "$url" = "$SYNC_PKG_URL" ] \
+                && [ "$path" = "$SYNC_PKG_PATH" ] && [[ "$resolved" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] \
+                && [ "${resolved%%.*}" = "v${current%%.*}" ]; then
+                echo "WARNING: $name at $resolved has no locked commit SHA; commit verification is unavailable for this development-bundle metadata" >&2
+                continue
+            fi
+        fi
+        [[ "$sha" =~ ^[0-9a-f]{40}$ || "$sha" =~ ^[0-9a-f]{64}$ ]] \
+            || die "locked restore: $name has a missing or invalid commit SHA — restore a valid intelligence.lock"
+    done <<< "$rows"
+    if [ "$count" -eq 0 ] && [ -n "$manifest" ] && [ -n "$(qmap_keys "$manifest" packages)" ]; then
+        die "$lock: packages is empty but the manifest declares packages — restore their recorded identities"
+    fi
+)
+
+# top_scalar <file> <key> — one top-level scalar through the shared tokenizer.
 top_scalar() {
-    [ -f "$1" ] || return 0
-    awk -v key="$2" '
-        { sub(/\r$/, "") }
-        $0 ~ "^" key ":" {
-            v = substr($0, length(key) + 2)
-            sub(/^[ \t]+/, "", v)
-            if (v ~ /^"/) { v = substr(v, 2); q = index(v, "\""); if (q > 0) v = substr(v, 1, q - 1) }
-            else { sub(/[ \t]+#.*$/, "", v); sub(/[ \t]+$/, "", v) }
-            print v
-            exit
-        }
-    ' "$1"
+    _qmap_read top "$1" '' "$2"
 }
 
 # lock_to_tsv <lock> — every locked package as one row.
 lock_to_tsv() {
-    local lock="$1" name
-    [ -f "$lock" ] || return 0
-    while IFS= read -r name; do
-        [ -n "$name" ] || continue
-        printf '%s\037%s\037%s\037%s\037%s\037%s\n' \
-            "$name" \
-            "$(qmap_field "$lock" "packages" "$name" "requested")" \
-            "$(qmap_field "$lock" "packages" "$name" "url")" \
-            "$(qmap_field "$lock" "packages" "$name" "path")" \
-            "$(qmap_field "$lock" "packages" "$name" "resolved")" \
-            "$(qmap_field "$lock" "packages" "$name" "sha")"
-    done < <(qmap_keys "$lock" "packages")
+    _qmap_read rows "$1" packages
 }
 
 # lock_write_from_tsv <lock> <tsv-file> — rebuild the lock. Entries are
@@ -58,7 +94,15 @@ lock_write_from_tsv() {
         # them (registry-supplied url/path included) must be escaped, or it
         # would break or alias the neighbouring field.
         awk -F"$LOCK_SEP" '
-            function esc(s) { gsub(/\\/, "\\\\", s); gsub(/"/, "\\\"", s); return s }
+            function esc(s,    i, c, out) {
+                out = ""
+                for (i = 1; i <= length(s); i++) {
+                    c = substr(s, i, 1)
+                    if (c == "\\" || c == "\"") out = out "\\"
+                    out = out c
+                }
+                return out
+            }
             NF >= 6 {
                 print "  \"" esc($1) "\":"
                 if ($2 != "") print "    requested: \"" esc($2) "\""

package/cli/lib/manifest.sh

@@ -87,7 +87,8 @@ target_set_enabled() {
     case "$enabled" in true|false) ;; *) die "internal: invalid target state '$enabled'" ;; esac
     target_exists "$file" "$target" && target_missing=0
     output="$(_yq_esc "$output")"
-    _qmap_stage "$file" -v target="$target" -v enabled="$enabled" -v output="$output" -v target_missing="$target_missing" '
+    QMAP_EDIT_VALUE="$output" _qmap_stage "$file" -v target="$target" -v enabled="$enabled" -v target_missing="$target_missing" '
+        BEGIN { output = ENVIRON["QMAP_EDIT_VALUE"] }
         function entry() { return "  " target ": { enabled: " enabled ", output: \"" output "\" }" }
         function insert_missing_target() {
             if (in_targets && target_missing && !target_seen) { print entry(); target_seen = 1 }
@@ -154,71 +155,33 @@ target_set_enabled() {
     '
 }
 
-# qmap_keys <file> <block> — quoted keys, one per line.
-qmap_keys() {
-    [ -f "$1" ] || return 0
-    awk -v block="$2" '
-        { sub(/\r$/, "") }
-        $0 ~ "^" block ":[ \t]*$" { inb = 1; next }
-        inb && /^[^ #]/ { inb = 0 }
-        inb {
-            if ($0 ~ /^  "/) {
-                s = substr($0, 4)
-                q = index(s, "\"")
-                if (q > 0) print substr(s, 1, q - 1)
-            }
-        }
-    ' "$1"
+# _qmap_read <mode> <file> <block> [key] [field] [expected-lock-version]
+# All scalar reads and strict lock records share one tokenizer. Environment
+# transport preserves literal backslashes that awk -v would interpret again.
+_qmap_read() {
+    local mode="$1" file="$2"
+    if [ ! -f "$file" ] || [ ! -r "$file" ]; then
+        case "$mode" in
+            lock|validate) echo "cannot read $file" >&2; return 1 ;;
+            *) return 0 ;;
+        esac
+    fi
+    QMAP_MODE="$mode" QMAP_FILE="$file" QMAP_BLOCK="${3:-}" \
+        QMAP_KEY="${4:-}" QMAP_FIELD="${5:-}" QMAP_EXPECTED_VERSION="${6:-}" \
+        LC_ALL=C awk -f "${BASH_SOURCE[0]%/*}/qmap.awk" < "$file"
 }
 
-# qmap_field <file> <block> <key> <field> — 4-indent field value under a
-# quoted key; strips surrounding quotes and a trailing unquoted comment.
-qmap_field() {
-    [ -f "$1" ] || return 0
-    awk -v block="$2" -v key="$3" -v field="$4" '
-        { sub(/\r$/, "") }
-        $0 ~ "^" block ":[ \t]*$" { inb = 1; next }
-        inb && /^[^ #]/ { inb = 0; ink = 0 }
-        inb && /^  "/ {
-            s = substr($0, 4); q = index(s, "\"")
-            ink = (q > 0 && substr(s, 1, q - 1) == key)
-            next
-        }
-        inb && ink && /^    [A-Za-z_]/ {
-            line = $0
-            sub(/^    /, "", line)
-            c = index(line, ":")
-            if (c == 0) next
-            if (substr(line, 1, c - 1) != field) next
-            v = substr(line, c + 1)
-            sub(/^[ \t]+/, "", v)
-            if (v ~ /^"/) { v = substr(v, 2); q2 = index(v, "\""); if (q2 > 0) v = substr(v, 1, q2 - 1) }
-            else { sub(/[ \t]+#.*$/, "", v); sub(/[ \t]+$/, "", v) }
-            print v
-            exit
-        }
-    ' "$1"
-}
+# qmap_validate_document <file> <block> — structural validation only.
+qmap_validate_document() { _qmap_read validate "$1" "$2"; }
 
-# qmap_value <file> <block> <key> — flat form: `  "key": "value"`.
-qmap_value() {
-    [ -f "$1" ] || return 0
-    awk -v block="$2" -v key="$3" '
-        { sub(/\r$/, "") }
-        $0 ~ "^" block ":[ \t]*$" { inb = 1; next }
-        inb && /^[^ #]/ { inb = 0 }
-        inb && /^  "/ {
-            s = substr($0, 4); q = index(s, "\"")
-            if (q == 0 || substr(s, 1, q - 1) != key) next
-            v = substr(s, q + 1)
-            sub(/^:[ \t]*/, "", v)
-            if (v ~ /^"/) { v = substr(v, 2); q2 = index(v, "\""); if (q2 > 0) v = substr(v, 1, q2 - 1) }
-            else { sub(/[ \t]+#.*$/, "", v); sub(/[ \t]+$/, "", v) }
-            if (v != "") print v
-            exit
-        }
-    ' "$1"
-}
+# qmap_keys <file> <block> — quoted keys in document order.
+qmap_keys() { _qmap_read keys "$1" "$2"; }
+
+# qmap_field <file> <block> <key> <field> — decoded nested scalar.
+qmap_field() { _qmap_read field "$1" "$2" "$3" "$4"; }
+
+# qmap_value <file> <block> <key> — decoded flat scalar.
+qmap_value() { _qmap_read value "$1" "$2" "$3"; }
 
 # _qmap_stage <file> <awk-program> [awk args…] — run an editing pass, verify
 # it produced output, commit.
@@ -245,7 +208,8 @@ qmap_set() {
     # url/path values can carry a `"`; escape before it reaches the quoted
     # scalar the writer emits.
     value="$(_yq_esc "$value")"
-    _qmap_stage "$file" -v block="$block" -v key="$key" -v field="$field" -v value="$value" '
+    QMAP_EDIT_VALUE="$value" _qmap_stage "$file" -v block="$block" -v key="$key" -v field="$field" '
+        BEGIN { value = ENVIRON["QMAP_EDIT_VALUE"] }
         function keyline()   { return "  \"" key "\":" }
         function fieldline() { return "    " field ": \"" value "\"" }
         function flush_key() {
@@ -292,7 +256,8 @@ qmap_set_value() {
     local file="$1" block="$2" key="$3" value="$4"
     [ -f "$file" ] || die "no such file: $file"
     value="$(_yq_esc "$value")"
-    _qmap_stage "$file" -v block="$block" -v key="$key" -v value="$value" '
+    QMAP_EDIT_VALUE="$value" _qmap_stage "$file" -v block="$block" -v key="$key" '
+        BEGIN { value = ENVIRON["QMAP_EDIT_VALUE"] }
         function entry() { return "  \"" key "\": \"" value "\"" }
         { sub(/\r$/, "") }
         $0 ~ "^" block ":[ \t]*$" { blockseen = 1; inb = 1; print; next }

package/cli/lib/qmap.awk

@@ -0,0 +1,191 @@
+# Shared tokenizer for the CLI-owned quoted-key map and scalar document shape.
+# Reader modes ignore unrelated YAML. Lock mode validates the whole document
+# before publishing rows, so a bad later entry never yields a partial result.
+BEGIN {
+    mode = ENVIRON["QMAP_MODE"]
+    block = ENVIRON["QMAP_BLOCK"]
+    wanted_key = ENVIRON["QMAP_KEY"]
+    wanted_field = ENVIRON["QMAP_FIELD"]
+    expected_version = ENVIRON["QMAP_EXPECTED_VERSION"]
+    source_file = ENVIRON["QMAP_FILE"]
+    strict = (mode == "lock" || mode == "validate")
+    sep = sprintf("%c", 31)
+    single_quote = sprintf("%c", 39)
+}
+
+function error_at(reason, line) {
+    if (problem == "") {
+        problem = reason
+        problem_line = line
+    }
+}
+
+# quoted() also parses keys. quote_end leaves the caller at the delimiter;
+# decoded contains literal bytes, with the writer's two escapes decoded once.
+function quoted(s,    i, c, escaped) {
+    decoded = ""
+    quote_end = 0
+    for (i = 2; i <= length(s); i++) {
+        c = substr(s, i, 1)
+        if (c == "\"") {
+            quote_end = i
+            return 1
+        }
+        if (c == "\\") {
+            if (++i > length(s)) return 0
+            escaped = substr(s, i, 1)
+            if (escaped == "\\" || escaped == "\"") c = escaped
+            else {
+                if (strict) return 0
+                c = "\\" escaped
+            }
+        }
+        if (strict && c ~ /[[:cntrl:]]/) return 0
+        decoded = decoded c
+    }
+    return 0
+}
+
+function scalar(s,    tail) {
+    decoded = ""
+    empty_scalar = 0
+    sub(/^[ \t]+/, "", s)
+    if (s == "" || s ~ /^#/) {
+        empty_scalar = 1
+        return 1
+    }
+    if (s ~ /^"/) {
+        if (!quoted(s)) return 0
+        tail = substr(s, quote_end + 1)
+        return !strict || tail ~ /^([ \t]*|[ \t]+#.*)$/
+    }
+    sub(/[ \t]+#.*$/, "", s)
+    sub(/[ \t]+$/, "", s)
+    if (strict) {
+        if (s ~ /[[:cntrl:]]/ || substr(s, 1, 1) == single_quote) return 0
+        if (s ~ /^[!&*\[\]{}>|%@`]/ || s ~ /^[?:-]([ \t]|$)/ || s ~ /"|:[ \t]/) return 0
+        if (s ~ /^(null|Null|NULL|~|true|True|TRUE|false|False|FALSE)$/) return 0
+    }
+    decoded = s
+    return 1
+}
+
+# Tokenization is shared by permissive reads and strict lock validation.
+function token(line,    text, colon, tail) {
+    kind = ""
+    key = ""
+    value = ""
+    empty = 0
+    if (line ~ /^[A-Za-z_]/) {
+        kind = "top"
+        text = line
+    } else if (line ~ /^    [A-Za-z_]/) {
+        kind = "field"
+        text = substr(line, 5)
+    } else if (line ~ /^  "/) {
+        kind = "package"
+        text = substr(line, 3)
+        if (!quoted(text)) return 0
+        key = decoded
+        tail = substr(text, quote_end + 1)
+        if (substr(tail, 1, 1) != ":") return 0
+        if (!scalar(substr(tail, 2))) return 0
+        value = decoded
+        empty = empty_scalar
+        return 1
+    } else return 0
+    colon = index(text, ":")
+    if (!colon) return 0
+    key = substr(text, 1, colon - 1)
+    if (strict && key !~ /^[A-Za-z_][A-Za-z0-9_]*$/) return 0
+    if (!scalar(substr(text, colon + 1))) return 0
+    value = decoded
+    empty = empty_scalar
+    return 1
+}
+
+{
+    sub(/\r$/, "")
+    if ($0 ~ /^[ \t]*(#.*)?$/) next
+    if (!token($0)) {
+        if (strict) {
+            context = ""
+            if (key ~ /^[A-Za-z_][A-Za-z0-9_]*$/) {
+                if (kind == "field" && package != "") context = "package " package ", field " key ": "
+                else if (kind == "top") context = "field " key ": "
+            }
+            error_at(context "malformed lock structure or unsupported scalar", NR)
+        }
+        if ($0 ~ /^[^ #\t]/) { in_block = 0; package = "" }
+        next
+    }
+    if (kind == "top") {
+        in_block = (key == block && empty)
+        package = ""
+        if (strict && top_seen[key]++) error_at("duplicate top-level field " key, NR)
+        if (!(key in top_value)) top_value[key] = value
+        if (mode == "top" && key == wanted_key && !found) { result = value; found = 1 }
+        if (strict) {
+            if (key == block) {
+                block_seen = 1
+                if (!empty) error_at(block " must be a block map", NR)
+            } else if (empty) error_at("expected scalar for " key, NR)
+        }
+        next
+    }
+    if (kind == "package" && in_block) {
+        package = key
+        row_count++
+        row_name[row_count] = key
+        row_line[row_count] = NR
+        if (strict) {
+            if (key == "") error_at("empty package key", NR)
+            if (package_seen[key]++) error_at("duplicate package " key, NR)
+            if (!empty) error_at("expected field map for " key, NR)
+        }
+        if (mode == "value" && key == wanted_key && !found) { result = value; found = 1 }
+        next
+    }
+    if (kind == "field" && in_block && package != "") {
+        identity = package SUBSEP key
+        if (strict && field_seen[identity]++) error_at("duplicate field " package "." key, NR)
+        if (!(identity in field_value)) field_value[identity] = value
+        if (strict && empty) error_at("expected scalar for " package "." key, NR)
+        if (mode == "field" && package == wanted_key && key == wanted_field && !found) {
+            result = value
+            found = 1
+        }
+        next
+    }
+    if (strict) error_at("malformed lock structure: expected top-level scalar or quoted package field", NR)
+}
+
+END {
+    # Read the format header before interpreting a future body's shape. Errors
+    # were retained during the single pass so header placement does not matter.
+    if (mode == "lock" && top_value["lockfile_version"] != expected_version) {
+        version = top_value["lockfile_version"]
+        print source_file " has unsupported or missing lockfile_version '" (version == "" ? "<missing>" : version) "' — expected " expected_version > "/dev/stderr"
+        exit 1
+    }
+    if (strict && problem != "") {
+        print source_file ":" problem_line ": " problem > "/dev/stderr"
+        exit 1
+    }
+    if (strict && !block_seen) {
+        print source_file ": missing " block " block" > "/dev/stderr"
+        exit 1
+    }
+    if (mode == "lock") print "V" sep top_value["lockfile_version"] sep top_value["engine_version"]
+    if (mode == "rows" || mode == "lock" || mode == "keys") {
+        for (i = 1; i <= row_count; i++) {
+            name = row_name[i]
+            if (mode == "keys") print name
+            else {
+                row = name sep field_value[name SUBSEP "requested"] sep field_value[name SUBSEP "url"] sep field_value[name SUBSEP "path"] sep field_value[name SUBSEP "resolved"] sep field_value[name SUBSEP "sha"]
+                if (mode == "lock") print "R" sep row sep row_line[i]
+                else print row
+            }
+        }
+    } else if (found) print result
+}

package/cli/lib/registry.sh

@@ -122,6 +122,7 @@ fetch_package() {
     local url="$1" ref="$2" subpath="$3" dest="$4" locked_sha="${5:-}" bundle_sha=""
     assert_safe_source_url "$url"
     assert_safe_ref "$ref"
+    assert_safe_package_path "$subpath"
     # Bundle seed: the engine-content package at the CLI's own version copies
     # from the npm bundle — no network, which keeps init, sync restoration and
     # archived-project conversion offline. Keyed on the
@@ -186,9 +187,6 @@ fetch_package() {
     fi
     src="$tmp/clone"
     if [ -n "$subpath" ]; then
-        case "$subpath" in
-            *..*|/*|*[\"\']*) rm -rf "$tmp"; die "unsafe path '$subpath'" ;;
-        esac
         src="$tmp/clone/$subpath"
         [ -d "$src" ] || { rm -rf "$tmp"; die "path '$subpath' not found in $url${ref:+@$ref}" ; }
     fi

package/engine/ENGINE_SHA

@@ -1 +1 @@
-3413f7d6f9ef181368b16b90e36d77360cb5f479
+b1242a74527d0295e9017fcd6b13ebfe00892710

package/engine/VERSION

@@ -1 +1 @@
-0.11.8
+0.12.0

package/engine/adapters/antigravity.sh

@@ -0,0 +1,197 @@
+#!/bin/bash
+# intelligence-sync: Google Antigravity adapter
+# Transforms source prompts to Antigravity's native resource model.
+#
+# Rules:
+#   - Always-on (no `paths:`) -> SKIPPED here. Antigravity reads AGENTS.md
+#     natively at the workspace root, and the `agents` adapter inlines
+#     always-on rule content into it. Emitting copies under .agents/rules/
+#     would double-load the same text.
+#   - Path-scoped (with `paths:`) -> .agents/rules/<name>.md carrying
+#     `trigger: glob` and `globs:` (activation modes: always_on, manual,
+#     model_decision, glob). Antigravity documents a 12,000-character limit
+#     per rule file, so scoped rules stay short.
+#   - GEMINI.md outranks AGENTS.md in Antigravity's rule precedence, so the
+#     contract quarantines it at onboarding: left in place it would silently
+#     override every synced rule.
+# Skills:
+#   - Copied to .agents/skills/ (Agent Skills open standard, shared with
+#     Codex, Pi and opencode). Antigravity reads that fixed workspace path,
+#     never the configured output, and selects skills by description.
+# Agents:
+#   - Converted to .agents/agents/<name>.md. `name` and `description` are
+#     required; `model` accepts only inherit|flash|pro; `subagent: true` with
+#     `mainAgent: false` matches how every other adapter exposes Intelligence
+#     agents — as delegates, not as chat personas. A readonly agent gets an
+#     explicit `tools:` allowlist.
+#
+# Every per-file loop batches its work into one awk process (see the batched
+# helpers in lib/common.sh): process spawns dominate sync time on Windows.
+
+source "$(dirname "${BASH_SOURCE[0]}")/../lib/common.sh"
+
+adapter_contract_antigravity() {
+    local output="${1%/}"
+    adapter_contract_version 1
+    adapter_contract_requires agents
+    adapter_contract_owned "$output/rules"
+    adapter_contract_owned "$output/agents"
+    adapter_contract_managed ".agents/skills"
+    adapter_contract_legacy "GEMINI.md"
+    adapter_contract_ignore "GEMINI.md"
+    adapter_contract_ignore "$output/rules/"
+    adapter_contract_ignore "$output/agents/"
+    adapter_contract_ignore ".agents/skills/"
+}
+
+sync_antigravity_rules() {
+    local repo_root="$1"
+    local config_file="$2"
+    local output_dir="$3"
+
+    local src f
+    local -a files=()
+    load_yaml_list "$config_file" "rules"
+    local list="$IS_YAML_LIST"
+    while IFS= read -r src; do
+        [ -z "$src" ] && continue
+        local dir="$repo_root/$src"
+        [ -d "$dir" ] || continue
+        for f in "$dir"/*.md; do
+            [ -f "$f" ] || continue
+            files+=("$f")
+        done
+    done <<< "$list"
+
+    # Skip always-on rules: AGENTS.md (canonical) carries them.
+    local path hp base
+    local -a scoped=()
+    if [ "${#files[@]}" -gt 0 ]; then
+        while IFS=$'\x1f' read -r path hp; do
+            [ -n "$path" ] || continue
+            [ "$hp" -eq 0 ] && continue
+            scoped+=("$path")
+        done < <(frontmatter_index "paths#" "${files[@]}")
+    fi
+    if [ "${#scoped[@]}" -eq 0 ]; then
+        echo "  -> Rules: 0 scoped (AGENTS.md carries always-on)"
+        return 0
+    fi
+
+    # Path-scoped rule -> Glob activation (paths -> globs)
+    is_fin_awk_vars
+    awk "${IS_FIN_V[@]}" -v dst="$output_dir/rules" "$IS_AWK_LIB"'
+        FNR == 1 {
+            if (out != "") close(out)
+            out = dst "/" base_name(FILENAME)
+        }
+        {
+            sub(/\r$/, "")
+            sub(/^paths:/, "globs:")
+        }
+        FNR == 1 {
+            print fin_line($0) > out
+            print fin_line("trigger: glob") > out
+            next
+        }
+        { print fin_line($0) > out }
+        END { if (out != "") close(out) }
+    ' "${scoped[@]}"
+
+    for f in "${scoped[@]}"; do
+        base="${f##*/}"
+        echo "  rule: $base (scoped)"
+    done
+    echo "  -> Rules: ${#scoped[@]} scoped"
+}
+
+sync_antigravity_agents() {
+    local repo_root="$1"
+    local config_file="$2"
+    local agents_dir="$3"
+
+    local src f
+    local -a files=()
+    load_yaml_list "$config_file" "agents"
+    local list="$IS_YAML_LIST"
+    while IFS= read -r src; do
+        [ -z "$src" ] && continue
+        local dir="$repo_root/$src"
+        [ -d "$dir" ] || continue
+        for f in "$dir"/*.md; do
+            [ -f "$f" ] || continue
+            files+=("$f")
+        done
+    done <<< "$list"
+
+    local count=0
+    if [ "${#files[@]}" -gt 0 ]; then
+        load_model_tiers "$config_file" "antigravity"
+
+        local path tier access description name spec="" report="" LS=$'\x1e'
+        while IFS=$'\x1f' read -r path tier access description; do
+            [ -n "$path" ] || continue
+            name="${path##*/}"; name="${name%.md}"
+            resolve_model_var "$tier"
+
+            local header
+            yaml_dq_escape_var "$name"
+            header="${LS}---"
+            header+="${LS}name: \"$IS_YAML_ESCAPED\""
+            yaml_dq_escape_var "$description"
+            header+="${LS}description: \"$IS_YAML_ESCAPED\""
+            if [ -n "$IS_MODEL" ]; then
+                yaml_dq_escape_var "$IS_MODEL"
+                header+="${LS}model: \"$IS_YAML_ESCAPED\""
+            fi
+            header+="${LS}subagent: true"
+            header+="${LS}mainAgent: false"
+            # A readonly agent gets an explicit allowlist. It holds only tool
+            # identifiers the official docs name, because an unknown entry in
+            # an allowlist silently removes a capability rather than failing:
+            # a directory-listing tool is left out until one is documented.
+            # An unrestricted agent declares no list and inherits the main
+            # agent's tools, which is Antigravity's default.
+            if [ "$access" = "readonly" ]; then
+                header+="${LS}tools:"
+                header+="${LS}  - view_file"
+                header+="${LS}  - grep_search"
+                header+="${LS}  - search_web"
+                header+="${LS}  - read_url_content"
+            fi
+            header+="${LS}---"
+            header+="${LS}"
+            header+="${LS}<!-- Generated by intelligence-sync. Do not edit manually. -->"
+            header+="${LS}"
+
+            spec+="$path"$'\x1f'"$agents_dir/$name.md"$'\x1f'"strip"$'\x1f'"1"$'\x1f'"none"$'\x1f'"$header"$'\x1f\n'
+            report+="  agent: $name.md"$'\n'
+            count=$((count + 1))
+        done < <(frontmatter_index "tier,access,description" "${files[@]}")
+
+        emit_wrapped_bodies "$spec"
+        printf '%s' "$report"
+    fi
+
+    echo "  -> Agents: $count"
+}
+
+sync_to_antigravity() {
+    local repo_root="$1"
+    local config_file="$2"
+    local output_dir="$3"
+
+    echo "=== Antigravity ==="
+
+    rm -rf "$output_dir/rules" "$output_dir/agents"
+    mkdir -p "$output_dir/rules" "$output_dir/agents"
+
+    sync_antigravity_rules "$repo_root" "$config_file" "$output_dir"
+
+    # Skills -> .agents/skills/ (open standard; Antigravity reads that fixed
+    # workspace path). `sync_open_skill_dirs` owns clean + populate of this
+    # shared dir, and replays it when Codex, Pi or opencode already filled it.
+    sync_open_skill_dirs "$repo_root" "$config_file" "$repo_root/.agents/skills"
+
+    sync_antigravity_agents "$repo_root" "$config_file" "$output_dir/agents"
+}

package/engine/lib/common.sh

@@ -830,6 +830,11 @@ get_model_default() {
         codex:heavy)      echo "gpt-5.6-sol" ;;
         codex:standard)   echo "gpt-5.6-terra" ;;
         codex:light)      echo "gpt-5.6-luna" ;;
+        # Antigravity accepts only inherit|flash|pro, so standard and light
+        # share `flash` — there is no third tier to map onto.
+        antigravity:heavy)     echo "pro" ;;
+        antigravity:standard)  echo "flash" ;;
+        antigravity:light)     echo "flash" ;;
         opencode:heavy)    echo "anthropic/claude-opus-4-8" ;;
         opencode:standard) echo "anthropic/claude-sonnet-5" ;;
         opencode:light)    echo "anthropic/claude-haiku-4-5-20251001" ;;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ainova-systems/intelligence",
-  "version": "0.11.8",
+  "version": "0.12.0",
   "description": "Build, version and distribute AI agent intelligence across your organization — one CLI, versioned Intelligence Packages, and a sync engine for Claude Code, Cursor, Copilot, Codex, Pi and OpenCode.",
   "bin": {
     "intelligence": "bin/intelligence.js"

package/packages/sync/references/adapters.md

@@ -163,6 +163,7 @@ Intelligence routes always-on rules once through `AGENTS.md` for tools that cons
 | Built-in | Always-on rules | Scoped rules |
 |---|---|---|
 | `agents` | Inline in `AGENTS.md` | List with links |
+| `antigravity` | Omit; reads `AGENTS.md` | `.agents/rules/*.md` with `trigger: glob` and `globs:` |
 | `claude` | Copy | Copy with `paths:` preserved |
 | `cursor` | Omit; reads `AGENTS.md` | `.mdc` with `globs:` |
 | `copilot` | Omit; reads `AGENTS.md` | `.instructions.md` with `applyTo:` |
@@ -186,7 +187,7 @@ copy_skill_bundle "$source_skill_dir" "$output_dir/skills/$skill_name"
 
 Do not use plain `cp` for skill bundles. `copy_skill_bundle` preserves non-Markdown assets, avoids materializing symlink targets, normalizes Markdown, expands layout tokens and quotes `description` and `argument-hint` where strict YAML readers require strings.
 
-Codex, Pi and OpenCode share `.agents/skills/`. Any adapter writing that open-standard directory must call `sync_open_skill_dirs`; it is the single lifecycle owner for immediate skill subdirectories.
+Antigravity, Codex, Pi and OpenCode share `.agents/skills/`. Any adapter writing that open-standard directory must call `sync_open_skill_dirs`; it is the single lifecycle owner for immediate skill subdirectories.
 
 ### Agents
 
@@ -300,6 +301,7 @@ For a built-in adapter, add the same assertions to the repository's smoke or lif
 | Adapter | Primary output |
 |---|---|
 | `agents` | `AGENTS.md` |
+| `antigravity` | `.agents/rules`, `.agents/agents`, `.agents/skills` |
 | `claude` | `.claude/rules`, `.claude/agents`, `.claude/skills` |
 | `cursor` | `.cursor/rules`, `.cursor/agents`, `.cursor/skills` |
 | `copilot` | `.github/instructions`, `.github/agents`, `.github/skills` |

package/packages/sync/references/conventions.md

@@ -156,7 +156,7 @@ Agent instructions in Markdown.
 
 An agent stays thin: **Expertise** → **Boundaries** → **Build & Verify**. Its role, limits and proof of completion belong here; reusable constraints belong in rules and reusable procedures belong in skills.
 
-Do not instruct an agent to read rules or restate their content. Claude loads its generated rules for its subagents, while Cursor, Copilot, Codex, Pi and OpenCode receive always-on rules through `AGENTS.md`. Duplicating a rule in an agent spends context twice and creates a copy that drifts.
+Do not instruct an agent to read rules or restate their content. Claude loads its generated rules for its subagents, while Cursor, Copilot, Codex, Pi, OpenCode and Antigravity receive always-on rules through `AGENTS.md`. Duplicating a rule in an agent spends context twice and creates a copy that drifts.
 
 ### Tier mappings
 
@@ -196,12 +196,12 @@ Rule content in Markdown.
 
 ### Routing
 
-| Source rule | Claude | Cursor | Copilot | Codex / Pi / OpenCode / `AGENTS.md` |
-|---|---|---|---|---|
-| Scoped | copied with `paths:` | `.mdc` with `globs:` | `.instructions.md` with `applyTo:` | listed in `AGENTS.md`; Pi also gets on-demand files and an extension |
-| Always-on | copied | omitted | omitted | inlined once into `AGENTS.md` |
+| Source rule | Claude | Cursor | Antigravity | Copilot | Codex / Pi / OpenCode / `AGENTS.md` |
+|---|---|---|---|---|---|
+| Scoped | copied with `paths:` | `.mdc` with `globs:` | `.md` with `trigger: glob` and `globs:` | `.instructions.md` with `applyTo:` | listed in `AGENTS.md`; Pi also gets on-demand files and an extension |
+| Always-on | copied | omitted | omitted | omitted | inlined once into `AGENTS.md` |
 
-Cursor, Copilot, Codex, Pi and OpenCode consume `AGENTS.md`, so always-on rules are not duplicated in their tool-specific channels. Claude does not consume `AGENTS.md`, so it receives the full rule set. OpenCode and Codex have no generated path-scoped rule channel; OpenCode users may configure `instructions:` globs themselves.
+Cursor, Copilot, Codex, Pi, OpenCode and Antigravity consume `AGENTS.md`, so always-on rules are not duplicated in their tool-specific channels. Claude does not consume `AGENTS.md`, so it receives the full rule set. OpenCode and Codex have no generated path-scoped rule channel; OpenCode users may configure `instructions:` globs themselves.
 
 Keep always-on rules small. Put narrow framework or component guidance behind `paths:` so unrelated tasks do not pay its context cost.
 
@@ -288,6 +288,7 @@ Every line enters a finite context budget. Prefer subtraction, consolidation and
 | Target | Rules | Skills | Agents |
 |---|---|---|---|
 | `agents` | Always-on inlined; scoped listed in `AGENTS.md` | Listed | Listed |
+| Antigravity | `AGENTS.md` plus scoped `.agents/rules/*.md` | `.agents/skills/` | `.agents/agents/*.md` |
 | Claude | `.claude/rules/` | `.claude/skills/` | `.claude/agents/` |
 | Cursor | scoped `.cursor/rules/*.mdc` | `.cursor/skills/` | `.cursor/agents/` |
 | Copilot | scoped `.github/instructions/*.instructions.md` | `.github/skills/` | `.github/agents/` |
@@ -306,6 +307,7 @@ By default, commit the manifest, lock, project-owned content, `AGENTS.md`, and s
 # Local root instructions migrate into project rules; local preferences stay ignored
 CLAUDE.md
 .cursorrules
+GEMINI.md
 
 # Generated Claude and Cursor content; shared settings remain trackable
 .claude/*
@@ -315,8 +317,11 @@ CLAUDE.md
 !.cursor/
 !.cursor/settings.json
 
-# Generated open-standard and Codex content
+# Generated open-standard, Codex and Antigravity content. `.agents/` is a
+# shared workspace root, so only the generated subdirectories are ignored.
 .agents/skills/
+.agents/rules/
+.agents/agents/
 .codex/agents/
 
 # Generated Pi content

package/packages/sync/rules/intelligence-authoring.md

@@ -25,7 +25,7 @@ Three ways to shorten, in order of what they are worth:
 
 ## Source of truth
 
-Edit the project-owned sources listed in `<manifest>` — the `rules/`, `agents/` and `skills/` directories it names — and `<manifest>` itself. An installed package source is replaced by CLI lifecycle/package operations; change it in its own repository. Everything else is derived: `.claude/`, `.cursor/`, `.github/{instructions,agents,skills}/`, `.codex/`, `.agents/skills/`, `.pi/`, `.opencode/` and `AGENTS.md` are **generated output**, and a hand edit there survives exactly until the next sync.
+Edit the project-owned sources listed in `<manifest>` — the `rules/`, `agents/` and `skills/` directories it names — and `<manifest>` itself. An installed package source is replaced by CLI lifecycle/package operations; change it in its own repository. Everything else is derived: `.claude/`, `.cursor/`, `.github/{instructions,agents,skills}/`, `.codex/`, `.agents/{rules,agents,skills}/`, `.pi/`, `.opencode/` and `AGENTS.md` are **generated output**, and a hand edit there survives exactly until the next sync.
 
 `<module>/` is the installed sync package's content. Package operations replace it, so a local edit there is lost. Fix it upstream instead.
 
@@ -68,7 +68,7 @@ The mistakes that actually happen, in order of frequency:
 
 An agent is **thin**: who it is, where it stops, how it verifies. Nothing else.
 
-- **Do not list rules for an agent to read.** They load on their own — Claude Code loads `.claude/rules/` into every custom subagent's startup context, and Cursor, Copilot, Codex, Pi and opencode receive always-on rules inlined in `AGENTS.md`. Naming a rule is fine; copying it is duplication that drifts.
+- **Do not list rules for an agent to read.** They load on their own — Claude Code loads `.claude/rules/` into every custom subagent's startup context, and Cursor, Copilot, Codex, Pi, OpenCode and Antigravity receive always-on rules inlined in `AGENTS.md`. Naming a rule is fine; copying it is duplication that drifts.
 - **Point at a rule, do not restate it.** Wanting to copy a rule into an agent means the rule is in the wrong place — move it.
 - **Do carry** what is genuinely the agent's own: its boundaries ("if the app will not start, stop — do not hand-write the output"), its verification commands, its definition of done.
 

package/packages/sync/skills/intelligence-add-agent/SKILL.md

@@ -52,7 +52,7 @@ argument-hint: <domain> [description]
 
 6. **Write body** with sections: **Expertise** -> **Boundaries** -> **Build & Verify**
    - An agent is **thin**: who it is, where it stops, how it verifies. Everything else already reaches it.
-   - **Do not tell the agent to read the rules.** Rules load on their own: Claude Code loads `.claude/rules/` into every custom subagent's startup context alongside `CLAUDE.md` (*Subagents → What loads at startup*), and Cursor / Copilot / Codex / Pi / opencode receive always-on rules inlined in `AGENTS.md`. A `Read <content-dir>/rules/<domain>.md before starting` line duplicates content the agent already has — double the tokens, and a second copy that drifts from the rule it copied.
+   - **Do not tell the agent to read the rules.** Rules load on their own: Claude Code loads `.claude/rules/` into every custom subagent's startup context alongside `CLAUDE.md` (*Subagents → What loads at startup*), and Cursor / Copilot / Codex / Pi / opencode / Antigravity receive always-on rules inlined in `AGENTS.md`. A `Read <content-dir>/rules/<domain>.md before starting` line duplicates content the agent already has — double the tokens, and a second copy that drifts from the rule it copied.
    - **Point at a rule, never restate it.** If you want to copy a rule into the agent, the rule is in the wrong place — move it, do not clone it.
    - **Do carry** what is genuinely the agent's own: its boundaries ("if the app is not running, stop — do not hand-write the output"), its verification commands, its definition of done.
    - All content must come from actual codebase analysis.