@ainova-systems/intelligence 0.17.2 → 0.17.3

package/cli/internal/check.sh

@@ -102,7 +102,20 @@ while IFS= read -r name; do
             warn "$name is locked but not installed — run 'intelligence sync'"
             continue
         fi
-        ok "$name @ $(pin_label "$m_ref" "$l_res" "$(qmap_field "$lock" "packages" "$name" "sha")")"
+        # Report what the store holds, never what the lock pins: they differ
+        # after a pull that moved the lock and left the ignored store behind.
+        l_url="$(qmap_field "$lock" "packages" "$name" "url")"
+        l_path="$(qmap_field "$lock" "packages" "$name" "path")"
+        l_sha="$(qmap_field "$lock" "packages" "$name" "sha")"
+        if ! store_record_get "$IP_ROOT" "$name"; then
+            warn "$name is installed, but the store does not record which commit it holds; the lock pins $(pin_label "$m_ref" "$l_res" "$l_sha") — run 'intelligence sync'"
+        elif [ "$IS_REC_URL" != "$l_url" ] || [ "$IS_REC_PATH" != "$l_path" ]; then
+            warn "$name was installed from ${IS_REC_URL}${IS_REC_PATH:+ (path $IS_REC_PATH)} but the lock names ${l_url}${l_path:+ (path $l_path)} — run 'intelligence sync'"
+        elif [ "$IS_REC_RESOLVED" != "$l_res" ] || [ "$IS_REC_SHA" != "$l_sha" ]; then
+            warn "$name holds $IS_REC_RESOLVED@$(short_sha "$IS_REC_SHA") but the lock pins $l_res@$(short_sha "$l_sha") — run 'intelligence sync'"
+        else
+            ok "$name @ $(pin_label "$m_ref" "$IS_REC_RESOLVED" "$IS_REC_SHA")"
+        fi
     fi
 done < <(qmap_keys "$manifest" "packages")
 

package/cli/internal/convert-legacy.sh

@@ -406,6 +406,11 @@ trap 'rollback; exit 130' INT TERM
 mv "$stage/.intelligence" "$root/.intelligence"
 cp "$manifest_stage" "$root/intelligence.yaml"
 lock_write_from_tsv "$root/intelligence.lock" "$lock_rows"
+# The staged store holds exactly these rows; record them so sync trusts it.
+while IFS="$LOCK_SEP" read -r rec_name _ rec_url rec_path rec_resolved rec_sha; do
+    [ -n "$rec_name" ] || continue
+    store_record_set "$root" "$rec_name" "$rec_url" "$rec_path" "$rec_resolved" "$rec_sha"
+done < "$lock_rows"
 ensure_manifest_gitignore "$root" "$root/intelligence.yaml"
 ensure_manifest_publisher_ignores "$root" "$root/intelligence.yaml"
 

package/cli/internal/package-add.sh

@@ -123,6 +123,10 @@ if [ -z "$ref" ]; then
 fi
 
 rel=".intelligence/packages/$name"
+# Forget what the directory held before replacing it: an interruption then
+# leaves the package unrecorded, which the next sync repairs, never a stale
+# record vouching for new bytes.
+store_record_remove "$IP_ROOT" "$name"
 sha="$(fetch_package "$url" "${ref:-$resolved_tag}" "$path" "$IP_ROOT/$rel")"
 
 wire_package_sources "$manifest" "$name" "$rel" "$IP_ROOT"
@@ -140,6 +144,7 @@ else
 fi
 
 lock_upsert "$lock" "$name" "$requested" "$url" "$path" "${ref:-$resolved_tag}" "$sha"
+store_record_set "$IP_ROOT" "$name" "$url" "$path" "${ref:-$resolved_tag}" "$sha"
 
 sections=""
 for s in rules agents skills; do

package/cli/internal/package-remove.sh

@@ -43,6 +43,7 @@ unwire_package_sources "$manifest" "$rel"
 qmap_delete_key "$manifest" "packages" "$name"
 lock_remove "$lock" "$name"
 rm -rf "${IP_ROOT:?}/$rel"
+store_record_remove "$IP_ROOT" "$name"
 # Drop the now-empty scope dir so the store stays tidy.
 rmdir "$IP_ROOT/.intelligence/packages/${name%%/*}" 2>/dev/null || true
 echo "- $name"

package/cli/internal/package-update.sh

@@ -174,11 +174,13 @@ while IFS= read -r name; do
     rm -rf "$staging"
     sha="$(fetch_package "$url" "$tag" "$path" "$staging")"
     unwire_package_sources "$manifest" "$rel"
+    store_record_remove "$IP_ROOT" "$name"
     rm -rf "${IP_ROOT:?}/$rel"
     mkdir -p "$(dirname "$IP_ROOT/$rel")"
     mv "$staging" "$IP_ROOT/$rel"
     wire_package_sources "$manifest" "$name" "$rel" "$IP_ROOT"
     lock_upsert "$lock" "$name" "$requested" "$url" "$path" "$tag" "$sha"
+    store_record_set "$IP_ROOT" "$name" "$url" "$path" "$tag" "$sha"
     # The widened intent is recorded only once its content is installed and
     # wired: a manifest saying ^0.6.1 over a failed fetch would describe a
     # state the project never reached.

package/cli/internal/restore.sh

@@ -82,14 +82,16 @@ if [ -n "$missing" ]; then
             read -r resolved_tag _ <<< "$(remote_tag_for_version "$url" "$picked")"
         fi
         rel=".intelligence/packages/$name"
+        store_record_remove "$IP_ROOT" "$name"
         sha="$(fetch_package "$url" "${ref:-$resolved_tag}" "$path" "$IP_ROOT/$rel")"
         wire_package_sources "$manifest" "$name" "$rel" "$IP_ROOT"
         lock_upsert "$lock" "$name" "$range" "$url" "$path" "${ref:-$resolved_tag}" "$sha"
+        store_record_set "$IP_ROOT" "$name" "$url" "$path" "${ref:-$resolved_tag}" "$sha"
         echo "+ $name@${resolved_tag:-${ref:-HEAD}} (resolved)"
     done
 fi
 
-# Restore every locked package that is not already in the store.
+# Restore every locked package the store does not hold at its locked commit.
 if [ -f "$lock" ]; then
     while IFS="$LOCK_SEP" read -r name _requested url path resolved sha; do
         [ -n "$name" ] || continue
@@ -97,10 +99,11 @@ if [ -f "$lock" ]; then
         # on their way into rm -rf paths, and its urls into git argv.
         assert_valid_pkg_name "$name"
         rel=".intelligence/packages/$name"
-        # --frozen never trusts what is already on disk: a pre-existing
-        # (possibly substituted) store dir would otherwise be synced with no
-        # sha verification at all.
-        if [ -d "$IP_ROOT/$rel" ] && [ "$force" -eq 0 ] && [ "$frozen" -eq 0 ]; then
+        # A directory counts only with a record of the lock row it satisfies:
+        # one present without it may hold any commit. --frozen never trusts
+        # what is already on disk: a pre-existing (possibly substituted) store
+        # dir would otherwise be synced with no sha verification at all.
+        if [ -d "$IP_ROOT/$rel" ] && [ "$force" -eq 0 ] && [ "$frozen" -eq 0 ]             && store_record_matches "$IP_ROOT" "$name" "$url" "$path" "$resolved" "$sha"; then
             continue
         fi
         # Fetch into staging and commit to the store only after the integrity
@@ -109,9 +112,11 @@ if [ -f "$lock" ]; then
         staging="$IP_ROOT/.intelligence/.staging-$$"
         rm -rf "$staging"
         fetch_package "$url" "$resolved" "$path" "$staging" "$sha" >/dev/null
+        store_record_remove "$IP_ROOT" "$name"
         rm -rf "${IP_ROOT:?}/$rel"
         mkdir -p "$(dirname "$IP_ROOT/$rel")"
         mv "$staging" "$IP_ROOT/$rel"
+        store_record_set "$IP_ROOT" "$name" "$url" "$path" "$resolved" "$sha"
         wire_package_sources "$manifest" "$name" "$rel" "$IP_ROOT"
         echo "= $name@${resolved:-HEAD}"
     done < <(lock_to_tsv "$lock")

package/cli/lib/cli-common.sh

@@ -303,9 +303,11 @@ sync_pkg_entry() {
 sync_pkg_install() {
     local root="$1" ver sha
     ver="$(bundled_engine_version)"
+    store_record_remove "$root" "$SYNC_PKG_NAME"
     sha="$(fetch_package "$SYNC_PKG_URL" "v$ver" "$SYNC_PKG_PATH" "$root/$SYNC_PKG_STORE")"
     wire_package_sources "$root/intelligence.yaml" "$SYNC_PKG_NAME" "$SYNC_PKG_STORE" "$root"
     lock_upsert "$root/intelligence.lock" "$SYNC_PKG_NAME" "$ver" "$SYNC_PKG_URL" "$SYNC_PKG_PATH" "v$ver" "$sha"
+    store_record_set "$root" "$SYNC_PKG_NAME" "$SYNC_PKG_URL" "$SYNC_PKG_PATH" "v$ver" "$sha"
     echo "  engine content installed: $SYNC_PKG_STORE (v$ver)"
 }
 
@@ -477,6 +479,65 @@ check_project_lock() {
     validate_project_lock "$1" "$mode"
 }
 
+# --- What the store holds (decision 0012) ---------------------------------
+# The store keeps plain files only, so which commit a package directory holds is
+# recorded beside the packages, never inside one (the engine would render it):
+# .intelligence/packages/.installed, one row per package — name, url, path,
+# resolved, sha, separated like the lock's rows — written whenever a package is
+# installed from the lock row it now satisfies. A directory without a row, or
+# with one that differs from the lock, is not what the lock pins.
+STORE_RECORD=".intelligence/packages/.installed"
+
+# store_record_get <root> <name> — set IS_REC_URL / _PATH / _RESOLVED / _SHA;
+# returns 1 when the store records nothing for <name>.
+store_record_get() {
+    local file="$1/$STORE_RECORD" name url path resolved sha
+    IS_REC_URL="" IS_REC_PATH="" IS_REC_RESOLVED="" IS_REC_SHA=""
+    [ -f "$file" ] || return 1
+    while IFS="$LOCK_SEP" read -r name url path resolved sha; do
+        [ "$name" = "$2" ] || continue
+        IS_REC_URL="$url" IS_REC_PATH="$path" IS_REC_RESOLVED="$resolved" IS_REC_SHA="$sha"
+        return 0
+    done < "$file"
+    return 1
+}
+
+# store_record_matches <root> <name> <url> <path> <resolved> <sha>
+store_record_matches() {
+    store_record_get "$1" "$2" || return 1
+    [ "$IS_REC_URL" = "$3" ] && [ "$IS_REC_PATH" = "$4" ] \
+        && [ "$IS_REC_RESOLVED" = "$5" ] && [ "$IS_REC_SHA" = "$6" ]
+}
+
+# store_record_set <root> <name> <url> <path> <resolved> <sha> — record what
+# <name> now holds; store_record_remove <root> <name> forgets it. Both rewrite
+# the file through a temp file, so a reader never sees half a row.
+store_record_set() {
+    _store_record_write "$@"
+}
+
+store_record_remove() {
+    _store_record_write "$1" "$2"
+}
+
+_store_record_write() {
+    local root="$1" target="$2" file="$1/$STORE_RECORD" tmp name rest
+    mkdir -p "$root/.intelligence/packages" || die "cannot create $root/.intelligence/packages"
+    tmp="$file.tmp.$$"
+    {
+        if [ -f "$file" ]; then
+            while IFS="$LOCK_SEP" read -r name rest; do
+                [ -n "$name" ] && [ "$name" != "$target" ] || continue
+                printf '%s%s%s\n' "$name" "$LOCK_SEP" "$rest"
+            done < "$file"
+        fi
+        [ "$#" -lt 6 ] || printf '%s%s%s%s%s%s%s%s%s\n' "$target" "$LOCK_SEP" "$3" "$LOCK_SEP" "$4" "$LOCK_SEP" "$5" "$LOCK_SEP" "$6"
+    } > "$tmp" || { rm -f "$tmp"; die "cannot write $file"; }
+    mv -f "$tmp" "$file" || { rm -f "$tmp"; die "cannot write $file"; }
+}
+
+# project_store_missing <root> — a package the manifest or lock names is absent
+# from the store, or holds something other than its lock row pins.
 project_store_missing() {
     local root="$1" manifest="$1/intelligence.yaml" name src
     while IFS= read -r name; do
@@ -493,6 +554,17 @@ project_store_missing() {
             esac
         done < <(read_yaml_list "$manifest" "$section")
     done
+    # Present is not enough: a `git pull` moves the lock and leaves the ignored
+    # store on the commit it held before.
+    local rows _requested url path resolved sha
+    [ -f "$root/intelligence.lock" ] || return 1
+    rows="$(lock_to_tsv "$root/intelligence.lock")"
+    while IFS="$LOCK_SEP" read -r name _requested url path resolved sha; do
+        [ -n "$name" ] || continue
+        assert_valid_pkg_name "$name"
+        [ -d "$root/.intelligence/packages/$name" ] || return 0
+        store_record_matches "$root" "$name" "$url" "$path" "$resolved" "$sha" || return 0
+    done <<< "$rows"
     return 1
 }
 

package/engine/ENGINE_SHA

@@ -1 +1 @@
-97484ac7ccc2e093642b833edfa8cae7bfe47c9e
+c7851685b484be141067e86ff826a1f16ffe9db6

package/engine/VERSION

@@ -1 +1 @@
-0.17.2
+0.17.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ainova-systems/intelligence",
-  "version": "0.17.2",
+  "version": "0.17.3",
   "description": "Build, version and distribute AI agent intelligence across your organization — one CLI, versioned Intelligence Packages, and a sync engine for Claude Code, Cursor, Copilot, Codex, Pi and OpenCode.",
   "bin": {
     "intelligence": "bin/intelligence.js"

package/packages/sync/references/conventions.md

@@ -121,7 +121,7 @@ Practice:
 - **`latest` and `*` are for a package you own and release in lockstep.** Anywhere else they hand an upstream author write access to your agents' behavior between two syncs.
 - **Never pin a range to dodge a broken release.** Pin the exact version (`1.4.2`), record why, and remove the pin when the fix ships — a narrowed range hides the reason and outlives the incident.
 
-Commit `intelligence.lock`. It records requested versions, source URLs and paths, resolved refs and commit SHAs. After cloning, `intelligence sync` restores a missing store strictly from that lock before rendering; manifest/lock or SHA drift is refused. Re-run `package add` when deliberately changing a source.
+Commit `intelligence.lock`. It records requested versions, source URLs and paths, resolved refs and commit SHAs. After cloning, or after a pull that moved the lock, `intelligence sync` restores every package the store lacks or holds at another commit, strictly from that lock, before rendering; manifest/lock or SHA drift is refused. Re-run `package add` when deliberately changing a source.
 
 `@ainova-systems/sync` is ordinary package content exact-pinned to the bundled engine version. `intelligence init` installs it unless `--bare` is used. Lifecycle preflight keeps that pin and `schema_version` aligned with the installed CLI; package-range updates never move it independently.
 
@@ -416,7 +416,7 @@ The permanent applied-schema key is the top-level scalar `schema_version` in `in
 The public lifecycle is deliberately compact:
 
 - `intelligence init [--preview|--apply]` is universal: it creates a new setup, aligns an existing Intelligence project, or plans/applies conversion of an eligible legacy Intelligence Sync project.
-- `intelligence sync [adapter] [--compact] [--force]` first aligns an existing Intelligence project with the installed CLI and restores a missing store strictly from `intelligence.lock`. It skips rendering when local inputs and outputs match a previous successful run. Changes or missing outputs trigger rendering; `--force` always renders and refreshes the search for unconfigured source directories. An unchanged run replays the last full run's useful diagnostics. Compact mode shows context sizes, actionable warnings and final status on success, and all diagnostics on failure. In CI it refuses an alignment that would change tracked files and points to a local `intelligence init --apply` plus review/commit.
+- `intelligence sync [adapter] [--compact] [--force]` first aligns an existing Intelligence project with the installed CLI and restores every package the store lacks or holds at another commit, strictly from `intelligence.lock`. It skips rendering when local inputs and outputs match a previous successful run. Changes or missing outputs trigger rendering; `--force` always renders and refreshes the search for unconfigured source directories. An unchanged run replays the last full run's useful diagnostics. Compact mode shows context sizes, actionable warnings and final status on success, and all diagnostics on failure. In CI it refuses an alignment that would change tracked files and points to a local `intelligence init --apply` plus review/commit.
 - `intelligence update [@scope/name] [--preview|--apply]` is the only update surface. It prints the CLI/project/package plan; default mode prompts, `--preview` never writes, and `--apply` does not prompt. It never moves `ref:` pins.
 - `intelligence upgrade [--next] [--preview|--apply]` replaces the installed CLI with the newest version on its npm channel (`next` for a prerelease or with `--next`, otherwise `latest`) with the same modes. It touches no project, never downgrades, and refuses an installation that npm did not make.
 - `intelligence package add|remove|list|search` owns package inventory.