@ainova-systems/intelligence 0.17.1 → 0.17.2

package/cli/commands/adapter.sh

@@ -118,6 +118,8 @@ adapter_remove() {
         read -r answer
         case "$answer" in y|Y|yes|YES) ;; *) echo "removal cancelled"; exit 0 ;; esac
     fi
+    # A render sources project adapters: never remove one under it.
+    project_lock_hold "$IP_ROOT"
     rm -f "$file"
     echo "removed: $content_dir/adapters/$name.sh"
     echo "  generated output was kept"
@@ -136,6 +138,8 @@ case "$action" in
         [ -n "$name" ] && [ $# -eq 2 ] || die "usage: intelligence adapter <enable|disable> <name>"
         assert_valid_target_name "$name"
         require_cli_project
+        # Held through the final render: target-state and sync join it.
+        project_lock_hold "$IP_ROOT"
         ensure_project_current "$IP_ROOT"
         if [ "$action" = "enable" ]; then
             state_stage="$(mktemp -d -t intelligence-adapter-state-XXXXXX)"

package/cli/commands/sync.sh

@@ -29,6 +29,9 @@ run_sync() {
     detect_project || return $?
     case "$IP_MODE" in
         cli)
+            # One writer per project at a time: the store restore and the
+            # render below both rewrite shared state (sync-lock.sh).
+            project_lock_hold "$IP_ROOT"
             # `sync` is the normal fresh-clone command. A newer globally installed
             # CLI aligns the current Intelligence project first (except in CI, where a
             # tracked migration must be reviewed and committed locally), and a

package/cli/commands/update.sh

@@ -105,6 +105,9 @@ if [ "$mode" = "ask" ]; then
     esac
 fi
 
+# Held from alignment through the final render: the package pass and the sync
+# it execs join this lock instead of taking their own.
+project_lock_hold "$IP_ROOT"
 ensure_project_current "$IP_ROOT"
 apply_args=(--no-sync)
 [ -z "$only" ] || apply_args+=("$only")

package/cli/intelligence

@@ -7,15 +7,21 @@
 
 set -euo pipefail
 
-CLI_DIR="$(cd "$(dirname "$0")" && pwd)"
+case "$0" in
+    */*) CLI_DIR="${0%/*}"; [ -n "$CLI_DIR" ] || CLI_DIR="/" ;;
+    *) CLI_DIR="." ;;
+esac
+CLI_DIR="$(cd "$CLI_DIR" && pwd)"
 export CLI_DIR
 
 # Engine discovery, by role (sync.sh + VERSION). The repo and the npm package
 # ship one layout — <root>/{cli,engine,packages/sync} — so there is a single
-# candidate rather than a per-distribution list.
+# candidate rather than a per-distribution list. CLI_DIR is already the logical
+# `pwd` spelling, so its textual parent is what `cd "$CLI_DIR/.."` would print.
+CLI_ROOT="${CLI_DIR%/*}"
 IS_ENGINE_DIR=""
 if [ -f "$CLI_DIR/../engine/sync.sh" ] && [ -f "$CLI_DIR/../engine/VERSION" ]; then
-    IS_ENGINE_DIR="$(cd "$CLI_DIR/../engine" && pwd)"
+    IS_ENGINE_DIR="$CLI_ROOT/engine"
 fi
 if [ -z "$IS_ENGINE_DIR" ]; then
     echo "ERROR: bundled sync engine not found next to the CLI ($CLI_DIR)." >&2
@@ -29,7 +35,7 @@ export IS_ENGINE_DIR
 # engine dir: the store must receive rules/agents/skills, never engine scripts.
 IS_BUNDLED_PKG_DIR=""
 if [ -d "$CLI_DIR/../packages/sync" ]; then
-    IS_BUNDLED_PKG_DIR="$(cd "$CLI_DIR/../packages/sync" && pwd)"
+    IS_BUNDLED_PKG_DIR="$CLI_ROOT/packages/sync"
 fi
 export IS_BUNDLED_PKG_DIR
 

package/cli/internal/align-project.sh

@@ -15,6 +15,7 @@ while [ $# -gt 0 ]; do
 done
 
 require_cli_project
+project_lock_hold "$IP_ROOT"
 manifest="$IP_ROOT/intelligence.yaml"
 
 stamp="$(read_schema_version "$manifest")"

package/cli/internal/convert-legacy.sh

@@ -227,7 +227,38 @@ rewrite_source_value() {
     esac
     printf '%s' "$v"
 }
-in_packs=0 in_sources=0
+# The project's own content stays where the legacy layout kept it. When that
+# directory is not `intelligence/`, the manifest names it: the content directory
+# is where project adapters live, what no output may overwrite, and the source of
+# truth AGENTS.md points readers at. Left at the default, all three name a
+# directory that only a case-insensitive filesystem confuses with the real one.
+legacy_content_dir=""
+case "$umbrella_rel" in
+    "$umbrella"|intelligence|*/*|.intelligence*|*[\"\'\\]*|*[[:cntrl:]]*) ;;
+    *)
+        # Only content that stays counts: the vendored module and pack mirrors
+        # move into the store and leave, so a config-only umbrella is not one.
+        if [ -z "$(get_yaml_field "$config" "project" "intelligence_dir")" ]; then
+            for section in rules agents skills; do
+                while IFS= read -r src; do
+                    case "$src" in ""|git+*|@*) continue ;; esac
+                    src_canon="$(normalize_path "$root/$src")"
+                    case "$src_canon" in "$root"/*) src_rel="${src_canon#"$root"/}" ;; *) continue ;; esac
+                    case "$src_rel" in "$module_rel"|"$module_rel"/*) continue ;; esac
+                    leaving=0
+                    while IFS="$LOCK_SEP" read -r _ _ _ _ mirror; do
+                        [ -n "$mirror" ] || continue
+                        mirror="$(normalize_path "$root/$mirror")"
+                        case "$src_canon" in "$mirror"|"$mirror"/*) leaving=1 ;; esac
+                    done < "$pack_rows"
+                    [ "$leaving" -eq 0 ] || continue
+                    case "$src_rel" in "$umbrella_rel"|"$umbrella_rel"/*) legacy_content_dir="$umbrella_rel" ;; esac
+                done < <(read_yaml_list "$config" "$section")
+            done
+        fi
+        ;;
+esac
+in_packs=0 in_sources=0 project_key=0 content_dir_written=0
 while IFS= read -r line || [ -n "$line" ]; do
     line="${line%$'\r'}"
     case "$line" in
@@ -236,6 +267,18 @@ while IFS= read -r line || [ -n "$line" ]; do
         sources:*) in_sources=1; in_packs=0; echo "$line"; continue ;;
         [!\ \#]*) in_packs=0; in_sources=0 ;;
     esac
+    case "$line" in project:*) project_key=1 ;; esac
+    if [ -n "$legacy_content_dir" ] && [ "$content_dir_written" -eq 0 ]; then
+        # Only the block form takes a child line; `project: {...}` does not.
+        key_part="${line%%#*}"
+        key_part="${key_part%"${key_part##*[![:space:]]}"}"
+        if [ "$key_part" = "project:" ]; then
+            echo "$line"
+            echo "  intelligence_dir: \"$legacy_content_dir\""
+            content_dir_written=1
+            continue
+        fi
+    fi
     [ "$in_packs" -eq 1 ] && continue
     if [ "$in_sources" -eq 1 ]; then
         case "$line" in
@@ -261,6 +304,9 @@ while IFS= read -r line || [ -n "$line" ]; do
     fi
     echo "$line"
 done < "$config" > "$manifest_stage"
+if [ -n "$legacy_content_dir" ] && [ "$content_dir_written" -eq 0 ] && [ "$project_key" -eq 0 ]; then
+    printf 'project:\n  intelligence_dir: "%s"\n' "$legacy_content_dir" >> "$manifest_stage"
+fi
 stamp_schema_version "$manifest_stage" "$eng"
 
 # packages: requested pins only; resolved source details live in the lock.

package/cli/internal/package-add.sh

@@ -24,6 +24,7 @@ while [ $# -gt 0 ]; do
 done
 
 require_cli_project
+project_lock_hold "$IP_ROOT"
 manifest="$IP_ROOT/intelligence.yaml"
 lock="$IP_ROOT/intelligence.lock"
 

package/cli/internal/package-remove.sh

@@ -16,6 +16,7 @@ for a in "$@"; do
 done
 
 require_cli_project
+project_lock_hold "$IP_ROOT"
 
 # Removing the engine-content package guts the outputs (meta-skills, the
 # authoring rule, both engine agents disappear) while everything still

package/cli/internal/package-update.sh

@@ -25,6 +25,7 @@ done
     || die "--latest needs the package to move: intelligence update @scope/name --latest"
 
 require_cli_project
+[ "$preview" -eq 1 ] || project_lock_hold "$IP_ROOT"
 manifest="$IP_ROOT/intelligence.yaml"
 lock="$IP_ROOT/intelligence.lock"
 

package/cli/internal/restore.sh

@@ -19,6 +19,7 @@ while [ $# -gt 0 ]; do
 done
 
 require_cli_project
+project_lock_hold "$IP_ROOT"
 manifest="$IP_ROOT/intelligence.yaml"
 lock="$IP_ROOT/intelligence.lock"
 validate_project_lock "$IP_ROOT" --restore

package/cli/internal/target-state.sh

@@ -15,6 +15,7 @@ case "$action" in enable|disable) ;; *) die "internal target state: expected <en
 assert_valid_target_name "$name"
 
 require_cli_project
+project_lock_hold "$IP_ROOT"
 manifest="$IP_ROOT/intelligence.yaml"
 content_dir="$(manifest_intelligence_dir "$manifest")"
 

package/cli/lib/cli-common.sh

@@ -87,6 +87,7 @@ source "$CLI_DIR/lib/adapter-lifecycle.sh"
 source "$CLI_DIR/lib/gitignore.sh"
 source "$CLI_DIR/lib/onboarding.sh"
 source "$CLI_DIR/lib/sync-cache.sh"
+source "$CLI_DIR/lib/sync-lock.sh"
 
 # The engine-content package: OPTIONAL but auto-selected at init. Package by
 # UX (manifest entry, lockfile row, list/search/remove), bundle by mechanics —
@@ -97,12 +98,21 @@ source "$CLI_DIR/lib/sync-cache.sh"
 # Its identity is DATA shipped with the distribution (cli/engine-package.yaml),
 # never a name compiled into cli code — a fork edits the file.
 _EPKG="$CLI_DIR/engine-package.yaml"
-SYNC_PKG_NAME="$(top_scalar "$_EPKG" "name")"
-SYNC_PKG_URL="$(top_scalar "$_EPKG" "url")"
-SYNC_PKG_PATH="$(top_scalar "$_EPKG" "path")"
+SYNC_PKG_NAME="" SYNC_PKG_URL="" SYNC_PKG_PATH=""
 # Read by commands (init seeds it) — per-file shellcheck cannot see that.
 # shellcheck disable=SC2034
-DEFAULT_REGISTRY_URL="$(top_scalar "$_EPKG" "default_registry")"
+DEFAULT_REGISTRY_URL=""
+# Every command loads this file first: read the four fields in one pass.
+# shellcheck disable=SC2034  # DEFAULT_REGISTRY_URL is read by commands, as above
+while IFS="$LOCK_SEP" read -r _epkg_key _epkg_value; do
+    case "$_epkg_key" in
+        name) SYNC_PKG_NAME="$_epkg_value" ;;
+        url) SYNC_PKG_URL="$_epkg_value" ;;
+        path) SYNC_PKG_PATH="$_epkg_value" ;;
+        default_registry) DEFAULT_REGISTRY_URL="$_epkg_value" ;;
+    esac
+done <<< "$(_qmap_read tops "$_EPKG" '' 'name url path default_registry')"
+unset _epkg_key _epkg_value
 [ -n "$SYNC_PKG_NAME" ] || die "corrupt CLI installation: $_EPKG is missing or has no 'name'"
 SYNC_PKG_STORE=".intelligence/packages/$SYNC_PKG_NAME"
 
@@ -116,15 +126,18 @@ SYNC_PKG_STORE=".intelligence/packages/$SYNC_PKG_NAME"
 # by role — scripts/sync.sh + scripts/VERSION — never by name.
 detect_project() {
     IP_MODE="none"; IP_ROOT=""; IP_UMBRELLA=""; IP_MODULE_DIR=""
-    local dir="$PWD"
+    # PWD is already the logical `pwd` spelling, and so is each textual parent.
+    local dir="$PWD" parent
     while :; do
         if [ -f "$dir/intelligence.yaml" ]; then
             IP_MODE="cli"
-            IP_ROOT="$(cd "$dir" && pwd)"
+            IP_ROOT="$dir"
             return 0
         fi
-        [ "$dir" = "$(dirname "$dir")" ] && break
-        dir="$(dirname "$dir")"
+        parent="${dir%/*}"
+        [ -n "$parent" ] || parent="/"
+        [ "$dir" = "$parent" ] && break
+        dir="$parent"
     done
     local root
     root="$(git rev-parse --show-toplevel 2>/dev/null || true)"
@@ -257,10 +270,23 @@ default_target_output() {
     esac
 }
 
+# bundled_engine_version_var sets IS_BUNDLED_ENGINE_VERSION, reading VERSION
+# once per process; lifecycle preflight compares against it several times.
+bundled_engine_version_var() {
+    [ -z "${IS_BUNDLED_ENGINE_VERSION_READ:-}" ] || return 0
+    local version=""
+    [ -r "$IS_ENGINE_DIR/VERSION" ] || {
+        echo "ERROR: cannot read $IS_ENGINE_DIR/VERSION" >&2
+        return 1
+    }
+    IFS= read -r -d '' version < "$IS_ENGINE_DIR/VERSION" || true
+    IS_BUNDLED_ENGINE_VERSION="${version//[$' \t\r\n']/}"
+    IS_BUNDLED_ENGINE_VERSION_READ=1
+}
+
 bundled_engine_version() {
-    local version
-    version="$(< "$IS_ENGINE_DIR/VERSION")"
-    printf '%s' "${version//[$' \t\r\n']/}"
+    bundled_engine_version_var
+    printf '%s' "$IS_BUNDLED_ENGINE_VERSION"
 }
 
 # --- The sync package's manifest/lock plumbing ---------------------------
@@ -345,15 +371,19 @@ assert_safe_content_dir() {
 # the admitted minor/patch gap; the predicate itself does not re-judge the gap.
 project_stamped_ahead() {
     local stamp
-    stamp="$(read_schema_version "$1/intelligence.yaml")"
-    [ -n "$stamp" ] && _ver_gt "$stamp" "$(bundled_engine_version)"
+    read_schema_version_var "$1/intelligence.yaml"
+    stamp="$IS_SCHEMA_VERSION"
+    bundled_engine_version_var
+    [ -n "$stamp" ] && _ver_gt "$stamp" "$IS_BUNDLED_ENGINE_VERSION"
 }
 
 project_needs_upgrade() {
-    local root="$1" manifest="$1/intelligence.yaml" stamp eng pinned locked name
+    local root="$1" manifest="$1/intelligence.yaml" stamp eng pinned locked name url path rows
     [ -f "$manifest" ] || return 1
-    stamp="$(read_schema_version "$manifest")"
-    eng="$(bundled_engine_version)"
+    read_schema_version_var "$manifest"
+    stamp="$IS_SCHEMA_VERSION"
+    bundled_engine_version_var
+    eng="$IS_BUNDLED_ENGINE_VERSION"
     [ -z "$stamp" ] && return 0
     # A project stamped ahead belongs to a newer CLI. Aligning it here would
     # restamp the schema and re-pin the engine content DOWNWARD, and the next
@@ -363,14 +393,15 @@ project_needs_upgrade() {
     _ver_gt "$eng" "$stamp" && return 0
     [ -d "$root/.intelligence/engine" ] && return 0
 
-    while IFS= read -r name; do
+    # One manifest pass for every package's fields, not a reader per field.
+    rows="$(_qmap_read fieldrows "$manifest" packages '' 'url path version')"
+    while IFS="$LOCK_SEP" read -r name url path pinned; do
         [ -n "$name" ] || continue
         # Early RC manifests mixed requested intent with resolved source
         # details. Source URL/path now live only in the required lockfile.
-        [ -n "$(qmap_field "$manifest" "packages" "$name" "url")" ] && return 0
-        [ -n "$(qmap_field "$manifest" "packages" "$name" "path")" ] && return 0
+        [ -n "$url" ] && return 0
+        [ -n "$path" ] && return 0
         if [ "$name" = "$SYNC_PKG_NAME" ]; then
-            pinned="$(qmap_field "$manifest" "packages" "$name" "version")"
             locked="$(qmap_field "$root/intelligence.lock" "packages" "$name" "resolved")"
             [ "$pinned" = "$eng" ] || return 0
             if [ -f "$root/intelligence.lock" ]; then
@@ -378,7 +409,7 @@ project_needs_upgrade() {
                 [ "${locked#v}" = "$eng" ] || return 0
             fi
         fi
-    done < <(qmap_keys "$manifest" "packages")
+    done <<< "$rows"
     return 1
 }
 
@@ -402,8 +433,10 @@ ensure_project_current() {
         die "manifest declares packages but intelligence.lock is absent — restore the committed lock before running project lifecycle commands"
     fi
     project_needs_upgrade "$root" || return 0
-    stamp="$(read_schema_version "$manifest")"
-    eng="$(bundled_engine_version)"
+    read_schema_version_var "$manifest"
+    stamp="$IS_SCHEMA_VERSION"
+    bundled_engine_version_var
+    eng="$IS_BUNDLED_ENGINE_VERSION"
     if is_ci_environment && [ "$explicit" != "--explicit" ]; then
         die "project lifecycle requires alignment (stamp ${stamp:-unstamped}, engine $eng) — run 'intelligence init --apply' locally, review and commit the diff"
     fi

package/cli/lib/lockfile.sh

@@ -24,7 +24,8 @@ lock_validate() (
     # The same tokenizer supplies ordinary lock rows and strict metadata. Buffer
     # before consumption: a failed parser must never yield a partial package set.
     rows="$(_qmap_read lock "$lock" packages '' '' "$LOCKFILE_VERSION")" || return $?
-    current="$(bundled_engine_version)"
+    bundled_engine_version_var
+    current="$IS_BUNDLED_ENGINE_VERSION"
     while IFS="$LOCK_SEP" read -r kind name requested url path resolved sha line; do
         case "$kind" in
             V)

package/cli/lib/qmap.awk

@@ -177,7 +177,17 @@ END {
         exit 1
     }
     if (mode == "lock") print "V" sep top_value["lockfile_version"] sep top_value["engine_version"]
-    if (mode == "rows" || mode == "lock" || mode == "keys") {
+    if (mode == "fieldrows") {
+        # One row per package key, as `keys` lists them: the name, then each
+        # field QMAP_FIELD names (space separated), as qmap_field decodes it.
+        count = split(wanted_field, fields, " ")
+        for (i = 1; i <= row_count; i++) {
+            name = row_name[i]
+            row = name
+            for (f = 1; f <= count; f++) row = row sep field_value[name SUBSEP fields[f]]
+            print row
+        }
+    } else if (mode == "rows" || mode == "lock" || mode == "keys") {
         for (i = 1; i <= row_count; i++) {
             name = row_name[i]
             if (mode == "keys") print name
@@ -187,5 +197,10 @@ END {
                 else print row
             }
         }
+    } else if (mode == "tops") {
+        # Several top-level scalars in one pass: QMAP_KEY lists them, space
+        # separated; each present one prints as key<US>value.
+        count = split(wanted_key, tops, " ")
+        for (i = 1; i <= count; i++) if (tops[i] in top_value) print tops[i] sep top_value[tops[i]]
     } else if (found) print result
 }

package/cli/lib/sync-cache.sh

@@ -111,14 +111,17 @@ sync_cache_dependencies() {
 }
 
 sync_cache_input_hash() {
-    local fingerprint
+    local fingerprint payload
     fingerprint="$(sync_cache_fingerprint "$1" "${SC_INPUTS[@]}")" || return 1
+    [ -n "${SC_UMASK:-}" ] || SC_UMASK="$(umask)"
     # Explicit environment values that affect rendering, discovery or parsing.
     # No secrets or inherited environment dump are persisted.
-    printf '%s\n' "$fingerprint" "$2" "$REPO_ROOT" "$CONFIG_FILE" \
+    printf -v payload '%s\n' "$fingerprint" "$2" "$REPO_ROOT" "$CONFIG_FILE" \
         "$IS_CONTENT_REL" "$IS_MODULE_REL" "$IS_SYNC_CMD" "$IS_MANIFEST_NAME" \
         "$IS_PROTECTED_DIRS" "$BASH_VERSION" "${OSTYPE:-}" "${LANG:-}" \
-        "${LC_ALL:-}" "${LC_CTYPE:-}" "${LC_COLLATE:-}" "${PATH:-}" "$(umask)" | git hash-object --stdin
+        "${LC_ALL:-}" "${LC_CTYPE:-}" "${LC_COLLATE:-}" "${PATH:-}" "$SC_UMASK"
+    # A here-string appends the final newline the payload already ends with.
+    git hash-object --stdin <<< "${payload%$'\n'}"
 }
 
 sync_cache_directory() {
@@ -164,6 +167,8 @@ sync_with_cache() (
     work="$(mktemp -d -t intelligence-cache-XXXXXX)" || return 1
     trap 'rm -rf "$work"' EXIT
     echo "Checking source files..."
+    # Read once here so both input hashes, one in a background job, reuse it.
+    SC_UMASK="$(umask)"
     if sync_cache_dependencies && sync_cache_directory; then
         before="$(sync_cache_input_hash "$work" "$target")" || before=""
         [ -z "$before" ] || cacheable=1
@@ -197,11 +202,19 @@ sync_with_cache() (
     if [ "$cacheable" = 1 ]; then
         (
             echo "Checking sync results..."
-            after="$(sync_cache_input_hash "$work" "$target")" || return 0
+            # The input recheck and the output fingerprint only read files, so
+            # they run side by side, each in its own scratch directory.
+            local after_pid after_rc=0
+            mkdir "$work/after" "$work/outputs" || return 0
+            sync_cache_input_hash "$work/after" "$target" > "$work/after/hash" &
+            after_pid=$!
+            outputs="$(sync_cache_fingerprint "$work/outputs" "${SC_OUTPUTS[@]}")" || outputs=""
+            sync_cache_report "$work/log" > "$work/report" || outputs=""
+            report_hash="$(git hash-object --stdin < "$work/report")" || outputs=""
+            wait "$after_pid" || after_rc=$?
+            [ "$after_rc" = 0 ] && [ -n "$outputs" ] || return 0
+            IFS= read -r after < "$work/after/hash" || return 0
             [ "$before" = "$after" ] || return 0
-            outputs="$(sync_cache_fingerprint "$work" "${SC_OUTPUTS[@]}")" || return 0
-            sync_cache_report "$work/log" > "$work/report" || return 0
-            report_hash="$(git hash-object --stdin < "$work/report")" || return 0
             # Recheck containment before publishing. mktemp+rename avoids following a
             # pre-existing state-file link, and readers see only complete records.
             sync_cache_directory create || return 0

package/cli/lib/sync-lock.sh

@@ -0,0 +1,148 @@
+#!/bin/bash
+# One writer per project at a time. The engine clears and rewrites every
+# adapter's output, the store restore and package operations replace package
+# directories, and target and alignment edits rewrite the manifest. Two of these
+# overlapping interleave their writes and both report success over a corrupted
+# tree, so every script that writes shared project state holds this lock while it
+# does: `project_lock_hold` at its start.
+#
+# `mkdir` is the lock: it creates or fails atomically on every filesystem the
+# CLI supports. The owner file names the holder — pid, host, start time, process
+# group and a token — so a refusal says who it is, a child of the holder can
+# join instead of refusing, and a holder that died can be told from one whose
+# writers still run. Taking over a dead holder's lock happens under a second
+# lock, so two runs that judged the same lock stale cannot both take it.
+
+SYNC_LOCK_HELD=""
+SYNC_LOCK_TOKEN=""
+
+sync_lock_now() {
+    if [ -n "${EPOCHSECONDS:-}" ]; then
+        IS_NOW="$EPOCHSECONDS"
+    else
+        IS_NOW="$(date +%s)"
+    fi
+}
+
+# sync_lock_pgid — set IS_PGID to this process's group, "" when unknown. The
+# engine and its jobs inherit the group, so it outlives a killed wrapper for as
+# long as any writer it started still runs.
+sync_lock_pgid() {
+    local stat
+    local -a fields
+    IS_PGID=""
+    if [ -r "/proc/$$/stat" ] && IFS= read -r stat < "/proc/$$/stat"; then
+        # pid (comm) state ppid pgrp …: comm may hold spaces, so cut after it.
+        read -r -a fields <<< "${stat##*) }"
+        IS_PGID="${fields[2]:-}"
+    else
+        IS_PGID="$(ps -o pgid= -p "$$" 2>/dev/null || true)"
+        IS_PGID="${IS_PGID//[[:space:]]/}"
+    fi
+    case "$IS_PGID" in ''|*[!0-9]*|0|1) IS_PGID="" ;; esac
+}
+
+sync_lock_write_owner() {
+    sync_lock_now
+    sync_lock_pgid
+    SYNC_LOCK_TOKEN="$$.$IS_NOW.$RANDOM$RANDOM"
+    printf '%s %s %s %s %s\n' "$$" "${HOSTNAME:-unknown}" "$IS_NOW" "${IS_PGID:--}" "$SYNC_LOCK_TOKEN" > "$1/owner"
+}
+
+# sync_lock_read_owner <lock> — set IS_LOCK_PID / _HOST / _SINCE / _PGID /
+# _TOKEN; returns 1 when the folder has no readable owner yet.
+sync_lock_read_owner() {
+    IS_LOCK_PID="" IS_LOCK_HOST="" IS_LOCK_SINCE="" IS_LOCK_PGID="" IS_LOCK_TOKEN=""
+    [ -f "$1/owner" ] || return 1
+    read -r IS_LOCK_PID IS_LOCK_HOST IS_LOCK_SINCE IS_LOCK_PGID IS_LOCK_TOKEN < "$1/owner" \
+        || [ -n "$IS_LOCK_PID" ] || return 1
+    case "$IS_LOCK_PID" in ''|*[!0-9]*) return 1 ;; esac
+    case "$IS_LOCK_PGID" in ''|*[!0-9]*|0|1) IS_LOCK_PGID="" ;; esac
+}
+
+# sync_lock_holder_gone — true only when no process of the holder remains: its
+# whole process group when the owner recorded one, else its pid. Only "No such
+# process" proves that; a permission refusal is another user's live process,
+# and any other answer keeps the lock.
+sync_lock_holder_gone() {
+    local target="$IS_LOCK_PID" answer
+    [ -z "$IS_LOCK_PGID" ] || target="-$IS_LOCK_PGID"
+    answer="$(LC_ALL=C kill -0 -- "$target" 2>&1)" && return 1
+    case "$answer" in *"No such process"*) return 0 ;; esac
+    return 1
+}
+
+# sync_lock_is_stale <lock> — its holder can no longer write: gone from this
+# machine, or a folder that never got an owner and is past a minute old. A
+# holder on another machine (a shared filesystem) is never judged from here.
+sync_lock_is_stale() {
+    if sync_lock_read_owner "$1"; then
+        [ "$IS_LOCK_HOST" = "${HOSTNAME:-unknown}" ] || return 1
+        sync_lock_holder_gone
+        return
+    fi
+    [ -d "$1" ] && [ -n "$(find "$1" -maxdepth 0 -mmin +1 2>/dev/null)" ]
+}
+
+# sync_lock_acquire <root> — take <root>/.intelligence/sync.lock or refuse.
+sync_lock_acquire() {
+    local root="$1" lock="$1/.intelligence/sync.lock" took=0 age=""
+    mkdir -p "$root/.intelligence" || die "cannot create $root/.intelligence"
+    if mkdir "$lock" 2>/dev/null; then
+        took=1
+    elif mkdir "$lock.takeover" 2>/dev/null; then
+        # Judge again under the takeover lock: another run may have taken
+        # it over since this one looked.
+        if sync_lock_is_stale "$lock"; then
+            rm -rf "$lock"
+            mkdir "$lock" 2>/dev/null && took=1
+        fi
+        rmdir "$lock.takeover"
+    elif [ -n "$(find "$lock.takeover" -maxdepth 0 -mmin +1 2>/dev/null)" ]; then
+        # A takeover runs for milliseconds. Removing an abandoned one is itself
+        # a check-then-delete race, so it is left to a person.
+        die "a takeover of $lock was abandoned; if no intelligence command is running in this project, remove $lock.takeover"
+    fi
+    if [ "$took" = 1 ]; then
+        sync_lock_write_owner "$lock" || { rm -rf "$lock"; die "cannot write $lock/owner"; }
+        SYNC_LOCK_HELD="$lock"
+        return 0
+    fi
+    if sync_lock_read_owner "$lock"; then
+        sync_lock_now
+        case "$IS_LOCK_SINCE" in ''|*[!0-9]*) ;; *) age=", for $((IS_NOW - IS_LOCK_SINCE))s" ;; esac
+        die "another intelligence sync is running in this project (pid $IS_LOCK_PID on $IS_LOCK_HOST$age). Wait for it to finish; if no such process exists, remove $lock"
+    fi
+    die "another intelligence sync is starting in this project. Wait for it to finish; if none is running, remove $lock"
+}
+
+# project_lock_hold <root> — hold the project lock for the rest of this script.
+# A script started by the holder joins it instead (INTELLIGENCE_SYNC_LOCK names
+# the lock and its token): the holder releases it, unless `exec` made this
+# process the holder, which then releases it on exit.
+project_lock_hold() {
+    local root="$1" lock="$1/.intelligence/sync.lock" held="${INTELLIGENCE_SYNC_LOCK:-}"
+    if [ -n "$held" ] && [ "${held%%|*}" = "$lock" ] && sync_lock_read_owner "$lock" \
+        && [ -n "$IS_LOCK_TOKEN" ] && [ "$IS_LOCK_TOKEN" = "${held#*|}" ]; then
+        if [ "$IS_LOCK_PID" = "$$" ]; then
+            SYNC_LOCK_HELD="$lock"
+            SYNC_LOCK_TOKEN="$IS_LOCK_TOKEN"
+            trap 'sync_lock_release' EXIT
+            trap 'exit 130' INT TERM
+        fi
+        return 0
+    fi
+    sync_lock_acquire "$root"
+    export INTELLIGENCE_SYNC_LOCK="$lock|$SYNC_LOCK_TOKEN"
+    trap 'sync_lock_release' EXIT
+    trap 'exit 130' INT TERM
+}
+
+# sync_lock_release — drop the lock this process holds, and only that one.
+sync_lock_release() {
+    [ -n "$SYNC_LOCK_HELD" ] || return 0
+    if sync_lock_read_owner "$SYNC_LOCK_HELD" && [ "$IS_LOCK_TOKEN" = "$SYNC_LOCK_TOKEN" ]; then
+        rm -rf "$SYNC_LOCK_HELD"
+    fi
+    SYNC_LOCK_HELD=""
+}

package/engine/ENGINE_SHA

@@ -1 +1 @@
-3580413cb402a47d3defc33afbdd190ef23cc430
+97484ac7ccc2e093642b833edfa8cae7bfe47c9e

package/engine/VERSION

@@ -1 +1 @@
-0.17.1
+0.17.2

package/engine/adapters/claude.sh

@@ -173,9 +173,7 @@ sync_to_claude() {
     sync_claude_skills "$repo_root" "$config_file" "$output_dir"
     sync_claude_agents "$repo_root" "$config_file" "$output_dir"
 
-    local rules_count skills_count agents_count
-    rules_count=$(find "$output_dir/rules" -name "*.md" 2>/dev/null | wc -l)
-    skills_count=$(find "$output_dir/skills" -name "SKILL.md" 2>/dev/null | wc -l)
-    agents_count=$(find "$output_dir/agents" -name "*.md" 2>/dev/null | wc -l)
-    echo "  -> Rules: $rules_count, Skills: $skills_count, Agents: $agents_count"
+    count_matching_files "$output_dir/rules" "*.md" \
+        "$output_dir/skills" "SKILL.md" "$output_dir/agents" "*.md"
+    echo "  -> Rules: ${IS_FILE_COUNTS[0]}, Skills: ${IS_FILE_COUNTS[1]}, Agents: ${IS_FILE_COUNTS[2]}"
 }

package/engine/adapters/cursor.sh

@@ -204,9 +204,7 @@ sync_to_cursor() {
     sync_cursor_skills "$repo_root" "$config_file" "$output_dir"
     sync_cursor_agents "$repo_root" "$config_file" "$output_dir"
 
-    local rules_count skills_count agents_count
-    rules_count=$(find "$output_dir/rules" -name "*.mdc" 2>/dev/null | wc -l)
-    skills_count=$(find "$output_dir/skills" -name "SKILL.md" 2>/dev/null | wc -l)
-    agents_count=$(find "$output_dir/agents" -name "*.md" 2>/dev/null | wc -l)
-    echo "  -> Rules: $rules_count (.mdc), Skills: $skills_count, Agents: $agents_count"
+    count_matching_files "$output_dir/rules" "*.mdc" \
+        "$output_dir/skills" "SKILL.md" "$output_dir/agents" "*.md"
+    echo "  -> Rules: ${IS_FILE_COUNTS[0]} (.mdc), Skills: ${IS_FILE_COUNTS[1]}, Agents: ${IS_FILE_COUNTS[2]}"
 }