@ainova-systems/intelligence 0.18.1 → 0.19.0

package/cli/lib/gitignore.sh

@@ -13,12 +13,13 @@ IS_CR=$'\r'
 IS_LF=$'\n'
 IS_CRLF=$'\r\n'
 
-# An ignore file checked out on Windows can hold CRLF, and a CR belongs to the
-# pattern Git matches — so these two helpers decide presence ignoring it, and
-# append in whatever ending the file already uses. Comparing with the CR
-# attached made every existing line look absent on Linux and macOS (where it is
-# part of the line, unlike under MSYS), so each alignment appended an LF copy of
-# a line that was already there and the file grew forever.
+# An ignore file checked out on Windows can hold CRLF. Git drops one trailing
+# CR from each line before matching, so `foo` and `foo<CR>` are the same rule:
+# these helpers decide presence ignoring that CR, and append in whatever ending
+# the file already uses. Comparing with the CR attached made every existing
+# line look absent on Linux and macOS (where it is part of the line, unlike
+# under MSYS), so each alignment appended an LF copy of a line that was already
+# there and the file grew forever.
 
 # ignore_file_eol_var <file> — set IS_IGNORE_EOL from the file's first line.
 ignore_file_eol_var() {
@@ -32,12 +33,19 @@ ignore_file_eol_var() {
 }
 
 # ignore_file_has_line <file> <line> — true when the file lists exactly this
-# line, with or without a trailing CR.
+# line, with or without a trailing CR. The one presence test for an ignore
+# file: the writer and `status --check` both ask it, so a line one appends is a
+# line the other reports present. Decided in bash, because an exact-line grep
+# answers per platform — MSYS grep never sees the CR, Linux and macOS grep keep
+# it as part of the line.
 ignore_file_has_line() {
-    local file="$1" line="$2"
+    local file="$1" line="$2" entry=""
     [ -f "$file" ] || return 1
-    grep -Fqx -- "$line" "$file" 2>/dev/null && return 0
-    grep -Fqx -- "$line$IS_CR" "$file" 2>/dev/null
+    while IFS= read -r entry || [ -n "$entry" ]; do
+        [ "${entry%"$IS_CR"}" = "$line" ] && return 0
+        entry=""
+    done < "$file"
+    return 1
 }
 
 # ignore_file_append_line <file> <line> — append in the file's own ending.
@@ -88,29 +96,17 @@ gitignore_collapse_duplicates() {
     local root="$1" probe="$2"; shift 2
     local file="$root/.gitignore" tmp backup before=0 after=0
     local -a lines=() managed=("$@") last_idx=()
-    local line key i mi n hdr=-1 keep final_newline=1
+    local key i mi n hdr keep final_newline
     [ -f "$file" ] || return 0
 
-    # Read and write the file's own bytes, without awk: on Windows it reads in
-    # text mode and would hand back every line stripped of its CR, rewriting a
-    # CRLF file as LF. A line's CR is significant to Git, and either way the
-    # lines this function does not remove must survive byte-for-byte.
-    line=""
-    while IFS= read -r line; do
-        lines[${#lines[@]}]="$line"
-        line=""
-    done < "$file"
-    # `read` returns 1 at EOF but still fills `line` when the file's last line
-    # carries no newline; preserve that ending instead of adding one.
-    if [ -n "$line" ]; then
-        lines[${#lines[@]}]="$line"
-        final_newline=0
-    fi
-    n=${#lines[@]}
-    for ((i = 0; i < n; i++)); do
-        if [ "${lines[i]%"$IS_CR"}" = "$IS_GITIGNORE_HEADER" ]; then hdr=$i; break; fi
-    done
+    gitignore_read_var "$file"
+    hdr=$IS_GI_HEADER
     [ "$hdr" -ge 0 ] || return 0
+    # A header was found, so the array is not empty — Bash 3.2 under `set -u`
+    # cannot expand an empty one.
+    lines=("${IS_GI_LINES[@]}")
+    final_newline=$IS_GI_FINAL_NEWLINE
+    n=${#lines[@]}
 
     # Where each managed line last occurs below the header. Indexed arrays and
     # arithmetic `for` only — Bash 3.2 has no associative arrays.
@@ -161,6 +157,97 @@ gitignore_collapse_duplicates() {
     rm -f "$backup"
 }
 
+# gitignore_read_var <file> — load the file's lines as stored, CRs included, into
+# IS_GI_LINES. IS_GI_HEADER is the index of this policy's header (-1 when the
+# file has none) and IS_GI_FINAL_NEWLINE is 0 when the last line ends without
+# one. Every writer that rewrites .gitignore line by line reads it here.
+#
+# `read`, never awk: on Windows awk reads in text mode and would hand back every
+# line stripped of its CR, rewriting a CRLF file as LF. The lines a writer does
+# not remove must survive byte-for-byte, whatever their ending.
+gitignore_read_var() {
+    local file="$1" line i
+    IS_GI_LINES=()
+    IS_GI_HEADER=-1
+    IS_GI_FINAL_NEWLINE=1
+    line=""
+    while IFS= read -r line; do
+        IS_GI_LINES[${#IS_GI_LINES[@]}]="$line"
+        line=""
+    done < "$file"
+    # `read` returns 1 at EOF but still fills `line` when the file's last line
+    # carries no newline; preserve that ending instead of adding one.
+    if [ -n "$line" ]; then
+        IS_GI_LINES[${#IS_GI_LINES[@]}]="$line"
+        IS_GI_FINAL_NEWLINE=0
+    fi
+    for ((i = 0; i < ${#IS_GI_LINES[@]}; i++)); do
+        if [ "${IS_GI_LINES[i]%"$IS_CR"}" = "$IS_GITIGNORE_HEADER" ]; then
+            IS_GI_HEADER=$i
+            break
+        fi
+    done
+}
+
+# gitignore_managed_has_line <root> <line> — true when the region this policy
+# owns (its header to end of file) lists the line, with or without a CR.
+gitignore_managed_has_line() {
+    local file="$1/.gitignore" want="$2" i
+    [ -f "$file" ] || return 1
+    gitignore_read_var "$file"
+    [ "$IS_GI_HEADER" -ge 0 ] || return 1
+    for ((i = IS_GI_HEADER + 1; i < ${#IS_GI_LINES[@]}; i++)); do
+        if [ "${IS_GI_LINES[i]%"$IS_CR"}" = "$want" ]; then
+            return 0
+        fi
+    done
+    return 1
+}
+
+# gitignore_remove_managed_lines <root> <line…> — take every copy of these lines
+# out of the region this policy owns. A contract names them with `unignore` when
+# the project's configuration keeps tracked what the default policy ignores
+# (targets.copilot.commit_output), so the ignore an earlier alignment wrote is
+# withdrawn by the writer that wrote it, not by a hand edit. Lines above the
+# header predate Intelligence and stay — a hand-written copy of the same
+# pattern included — and every kept line keeps its bytes and its own ending:
+# only the file's last line can lack a newline, and none is added to it.
+gitignore_remove_managed_lines() {
+    local root="$1"; shift
+    local file="$root/.gitignore" tmp key i mi n dropped=0
+    local -a remove=("$@") keep=()
+    [ "$#" -gt 0 ] && [ -f "$file" ] || return 0
+    gitignore_read_var "$file"
+    [ "$IS_GI_HEADER" -ge 0 ] || return 0
+    n=${#IS_GI_LINES[@]}
+    for ((i = 0; i < n; i++)); do
+        keep[i]=1
+        [ "$i" -gt "$IS_GI_HEADER" ] || continue
+        key="${IS_GI_LINES[i]%"$IS_CR"}"
+        for ((mi = 0; mi < ${#remove[@]}; mi++)); do
+            if [ "$key" = "${remove[mi]}" ]; then
+                keep[i]=0
+                dropped=1
+                break
+            fi
+        done
+    done
+    [ "$dropped" -eq 1 ] || return 0
+
+    tmp="$file.cli.tmp"
+    {
+        for ((i = 0; i < n; i++)); do
+            [ "${keep[i]}" -eq 1 ] || continue
+            if [ "$i" -eq $((n - 1)) ] && [ "$IS_GI_FINAL_NEWLINE" -eq 0 ]; then
+                printf '%s' "${IS_GI_LINES[i]}"
+            else
+                printf '%s\n' "${IS_GI_LINES[i]}"
+            fi
+        done
+    } > "$tmp"
+    mv -- "$tmp" "$file"
+}
+
 # Git cannot re-include a child of an excluded directory, so an include needs an
 # explicit negation for every parent. A negation only wins when it comes after
 # the rule excluding the parent, and the only repair an append can make is to
@@ -233,18 +320,25 @@ ensure_base_gitignore() {
 
 ensure_target_gitignore() {
     local root="$1" manifest="$2" target="$3" content_dir output kind value records
+    local -a unignored=()
     ensure_gitignore_header "$root"
     content_dir="$(manifest_intelligence_dir "$manifest")"
     output="$(get_target_output "$manifest" "$target")"
     [ -n "$output" ] || output="$(default_target_output "$target")"
-    records="$(adapter_records_for "$root" "$content_dir" "$target" "$output")" \
+    records="$(adapter_records_for "$root" "$content_dir" "$target" "$output" "$manifest")" \
         || die "adapter '$target' has an invalid ownership contract"
     while IFS=$'\t' read -r kind value; do
         case "$kind" in
-            ignore)  gitignore_add_line "$root" "$value" ;;
-            include) gitignore_add_effective_include "$root" "$value" ;;
+            ignore)   gitignore_add_line "$root" "$value" ;;
+            include)  gitignore_add_effective_include "$root" "$value" ;;
+            unignore) unignored+=("$value") ;;
         esac
     done <<< "$records"
+    # One rewrite for all of them; Bash 3.2 cannot expand an empty array under
+    # `set -u`, hence the count guard.
+    if [ "${#unignored[@]}" -gt 0 ]; then
+        gitignore_remove_managed_lines "$root" "${unignored[@]}"
+    fi
 }
 
 ensure_manifest_gitignore() {
@@ -331,7 +425,7 @@ managed_gitignore_patterns() {
         [ "$(is_target_enabled "$manifest" "$target")" = "1" ] || continue
         output="$(get_target_output "$manifest" "$target")"
         [ -n "$output" ] || output="$(default_target_output "$target")"
-        records="$(adapter_records_for "$root" "$content_dir" "$target" "$output")" \
+        records="$(adapter_records_for "$root" "$content_dir" "$target" "$output" "$manifest")" \
             || return 1
         while IFS=$'\t' read -r kind value; do
             case "$kind" in

package/cli/lib/manifest.sh

@@ -2,9 +2,10 @@
 # The CLI-owned YAML shapes: quoted-key maps (`packages:`, `registries:` in
 # the manifest, `packages:` in the lock and in registry indexes).
 #
-# The engine deliberately never reads these blocks, and its readers cannot
-# hold `@scope/name` keys — so this is the CLI's single, deliberate parser,
-# scoped to exactly one shape:
+# The engine reads none of these blocks beyond the names and aliases in
+# `packages:`, which resolve package references in `sources:`
+# (engine/lib/common.sh), and its list readers cannot hold `@scope/name` keys —
+# so this is the CLI's single, deliberate parser, scoped to exactly one shape:
 #
 #   block:
 #     "@scope/name":            # 2-space indent, key always quoted
@@ -407,12 +408,14 @@ registries_remove() {
 # meaning: a later entry overrides a same-named artifact from an earlier one.
 # Reading goes through the engine's own list parser, so the CLI sees exactly
 # what the engine will render instead of a second reading of the same file.
+# The editors read it raw — a package reference as written, which is what they
+# compare and rewrite — and read_source_entries says what each one renders.
 
-# sources_list_entries <file> <section> — entries of sources.<section>, one per
-# line, in manifest order.
+# sources_list_entries <file> <section> — entries of sources.<section> as
+# written, one per line, in manifest order.
 sources_list_entries() {
     [ -f "$1" ] || return 0
-    read_yaml_list "$1" "$2"
+    read_yaml_list_raw "$1" "$2"
 }
 
 # sources_has_entry <file> <section> <entry> — true (0) when that section lists
@@ -439,7 +442,7 @@ sources_has_entry() {
 sources_add_entry() {
     local file="$1" section="$2" entry="$3" pos="${4:-last}" anchor="${5:-}"
     sources_has_entry "$file" "$section" "$entry" && return 0
-    _qmap_stage "$file" -v section="$section" -v entry="$entry" -v pos="$pos" -v anchor="$anchor" '
+    _qmap_stage "$file" -v section="$section" -v entry="$entry" -v pos="$pos" -v anchor="$anchor" "$IS_YAML_ITEM_AWK"'
         function line() { return "    - \"" entry "\"" }
         function place() { print line(); done = 1 }
         # Blank lines inside sources: are held back so an insert lands next to
@@ -447,13 +450,11 @@ sources_add_entry() {
         # one section from the next.
         function flush_tail(   i) { for (i = 1; i <= ntail; i++) print tail[i]; blanks = ntail; ntail = 0 }
         function open_section() { flush_tail(); print "  " section ":"; place(); if (blanks) print "" }
+        # The entry as the engine reads it (yaml_item, engine/lib/common.sh).
         function value(s,   v) {
             v = s
-            sub(/^[ \t]*-[ \t]*/, "", v)
-            gsub(/["\x27]/, "", v)
-            sub(/[ \t]+#.*$/, "", v)
-            sub(/[ \t]+$/, "", v)
-            return v
+            sub(/^[ \t]*-/, "", v)
+            return yaml_item(v)
         }
         BEGIN { anchored = (pos == "before" || pos == "after") }
         { sub(/\r$/, "") }
@@ -509,24 +510,171 @@ sources_add_entry_first() {
 }
 
 # sources_remove_entry <file> <section> <entry> — remove `- "entry"` from
-# sources.<section>.
+# sources.<section>, matching each item as the engine reads it (yaml_item).
 sources_remove_entry() {
     local file="$1" section="$2" entry="$3"
     [ -f "$file" ] || return 0
-    _qmap_stage "$file" -v section="$section" -v entry="$entry" '
+    _qmap_stage "$file" -v section="$section" -v entry="$entry" "$IS_YAML_ITEM_AWK"'
         { sub(/\r$/, "") }
         /^sources:[ \t]*$/ { ins = 1; print; next }
         ins && /^[^ #]/ { ins = 0; insec = 0 }
         ins && $0 ~ "^  " section ":[ \t]*$" { insec = 1; print; next }
         ins && /^  [A-Za-z_]/ { insec = 0 }
-        insec {
+        insec && /^[ \t]*-/ {
             line = $0
-            sub(/^[ \t]*-[ \t]*/, "", line)
-            gsub(/["\x27]/, "", line)
-            sub(/[ \t]+#.*$/, "", line)
-            sub(/[ \t]+$/, "", line)
-            if (line == entry) next
+            sub(/^[ \t]*-/, "", line)
+            if (yaml_item(line) == entry) next
         }
         { print }
     '
 }
+
+# --- package references and aliases ------------------------------------------
+# `sources:` may name a package's directory by its store path, by the package's
+# full name or by the alias its `packages:` entry declares (decision 0019). The
+# engine's list parser (IS_PKG_REF_AWK in engine/lib/common.sh) is the only
+# definition of those spellings; everything below reads through it, so the CLI
+# never judges an entry differently from the way the engine renders it. The CLI
+# itself only ever writes store paths, and writes an alias only through
+# `package add --alias` and `package alias`.
+
+# assert_valid_alias <alias> — refuse an alias the engine would never resolve.
+assert_valid_alias() {
+    pkg_alias_valid "$1" \
+        || die "invalid alias '$1' — expected $IS_PKG_ALIAS_RULE"
+}
+
+# package_alias_of <file> <@scope/name> — the alias that package declares, when it
+# is well formed; nothing otherwise (an invalid one resolves nothing).
+package_alias_of() {
+    local name alias verdict
+    while IFS=$'\037' read -r name alias verdict; do
+        [ "$name" = "$2" ] || continue
+        [ "$verdict" = invalid ] || printf '%s' "$alias"
+        return 0
+    done < <(read_package_aliases "$1")
+}
+
+# assert_alias_free <file> <@scope/name> <alias> — refuse an alias another package
+# already declares: one alias names exactly one package.
+assert_alias_free() {
+    local file="$1" self="$2" want="$3" name alias verdict
+    while IFS=$'\037' read -r name alias verdict; do
+        [ "$name" != "$self" ] && [ "$alias" = "$want" ] || continue
+        die "alias '$want' already names $name — one alias names one package; choose another"
+    done < <(read_package_aliases "$file")
+}
+
+# sources_alias_users <file> <alias> — every sources entry spelled <alias>:<dir>,
+# one `sources.<section> '<entry>'` line each.
+sources_alias_users() {
+    local file="$1" alias="$2" section entry
+    for section in rules agents skills; do
+        while IFS= read -r entry; do
+            case "$entry" in
+                "$alias":*) printf "sources.%s '%s'\n" "$section" "$entry" ;;
+            esac
+        done < <(sources_list_entries "$file" "$section")
+    done
+}
+
+# assert_alias_unused <file> <@scope/name> <alias> <remove|replace> — refuse to
+# take away an alias `sources:` still spells entries with: they would stop
+# resolving, and the package's content would leave the outputs in silence.
+assert_alias_unused() {
+    local file="$1" name="$2" alias="$3" verb="$4" users
+    users="$(sources_alias_users "$file" "$alias")"
+    [ -n "$users" ] || return 0
+    echo "ERROR: cannot $verb alias '$alias' of $name — sources: still uses it:" >&2
+    printf '%s\n' "$users" | sed 's/^/  /' >&2
+    echo "  Spell those entries $name/<dir> instead, then $verb the alias." >&2
+    exit 1
+}
+
+# sources_classify_entry <file> <entry> — `<state>\037<directory>` for an entry
+# that is not in the manifest (yet): what the engine would render it as against
+# the packages the manifest declares. States are pkr_parse's.
+sources_classify_entry() {
+    local file="$1"
+    [ -f "$file" ] || file=/dev/null
+    IS_PKR_CANDIDATE="$2" awk "$IS_PKG_REF_AWK"'
+        { sub(/\r$/, ""); pkr_collect($0) }
+        END { dir = pkr_expand(ENVIRON["IS_PKR_CANDIDATE"]); print PKR_STATE "\037" dir }
+    ' "$file"
+}
+
+# sources_find_entry <file> <section> <entry> — print the entry of
+# sources.<section>, as written, that names the same directory as <entry> in any
+# spelling; fail when the section names it nowhere. An entry that renders
+# nothing matches only itself.
+sources_find_entry() {
+    local file="$1" section="$2" entry="$3" want _state raw _st dir _rest
+    [ -f "$file" ] || return 1
+    IFS=$'\037' read -r _state want <<< "$(sources_classify_entry "$file" "$entry")"
+    while IFS=$'\037' read -r raw _st dir _rest; do
+        if [ "$raw" = "$entry" ] || { [ -n "$want" ] && [ "$dir" = "$want" ]; }; then
+            printf '%s' "$raw"
+            return 0
+        fi
+    done < <(read_source_entries "$file" "$section")
+    return 1
+}
+
+# package_source_listed <file> <section> <store-dir> — true when sources.<section>
+# already names <store-dir>, in whichever spelling.
+package_source_listed() {
+    local _raw _st dir _rest
+    [ -f "$1" ] || return 1
+    while IFS=$'\037' read -r _raw _st dir _rest; do
+        [ "$dir" = "$3" ] && return 0
+    done < <(read_source_entries "$1" "$2")
+    return 1
+}
+
+# sources_remove_package <file> <@scope/name> [section...] — drop the package's
+# entries from sources:, in every spelling. With sections, only the entry of
+# sources.<section> that names the package's own <section> directory goes;
+# without, every rules/agents/skills entry naming a directory inside the
+# package. The references resolve through `packages:`, so call it while the
+# package and its alias are still declared. Every other line survives byte for
+# byte, and an unchanged file is not rewritten.
+sources_remove_package() {
+    local file="$1" name="$2" tmp rc=0
+    shift 2
+    [ -f "$file" ] || return 0
+    tmp="$file.cli.tmp"
+    awk -v name="$name" -v only=" $* " "$IS_PKG_REF_AWK$IS_YAML_ITEM_AWK"'
+        BEGIN { store = ".intelligence/packages/" name }
+        FNR == 1 { pass++ }
+        pass == 1 { sub(/\r$/, ""); pkr_collect($0); next }
+        { sub(/\r$/, "") }
+        /^sources:[ \t]*$/ { ins = 1; print; next }
+        ins && /^[^ #]/ { ins = 0; sec = "" }
+        ins && /^  [A-Za-z_]/ {
+            sec = $0
+            sub(/^  /, "", sec)
+            sub(/:.*$/, "", sec)
+            if (sec != "rules" && sec != "agents" && sec != "skills") sec = ""
+            print
+            next
+        }
+        ins && sec != "" && /^[ \t]*-/ {
+            v = $0
+            sub(/^[ \t]*-/, "", v)
+            dir = pkr_expand(yaml_item(v))
+            if (only == "  ") drop = dir == store || index(dir, store "/") == 1
+            else drop = index(only, " " sec " ") && dir == store "/" sec
+            if (drop) { changed = 1; next }
+        }
+        { print }
+        END { exit (changed ? 0 : 10) }
+    ' "$file" "$file" > "$tmp" || rc=$?
+    case "$rc" in
+        0)
+            [ -s "$tmp" ] || { rm -f "$tmp"; die "internal: sources edit produced an empty file for $file"; }
+            mv "$tmp" "$file"
+            ;;
+        10) rm -f "$tmp" ;;
+        *) rm -f "$tmp"; die "internal: sources edit refused (awk exit $rc) for $file" ;;
+    esac
+}

package/cli/lib/registry.sh

@@ -200,25 +200,30 @@ fetch_package() {
     printf '%s' "$sha"
 }
 
-# wire_package_sources <manifest> <@scope/name> <store-rel-dir>
+# wire_package_sources <manifest> <@scope/name> <store-rel-dir> <root>
 # The provides convention: whichever of rules/agents/skills the installed
-# package has becomes a sources entry — inserted FIRST in its section, so
-# project-owned entries come later and win on same-named artifacts.
+# package has becomes a sources entry — its store path, inserted FIRST in its
+# section, so project-owned entries come later and win on same-named artifacts.
+# A section that already names that directory, in any spelling, keeps the entry
+# where it stands: the person who wrote `@scope/name/<dir>` or `<alias>:<dir>`
+# chose both the spelling and the position. Call it once `packages:` declares
+# the package and its alias, which is what resolves those spellings.
 wire_package_sources() {
-    local manifest="$1" name="$2" rel="$3" root="$4"
+    local manifest="$1" rel="$3" root="$4"
     local section
     for section in rules agents skills; do
-        if [ -d "$root/$rel/$section" ]; then
-            sources_add_entry_first "$manifest" "$section" "$rel/$section"
-        fi
+        [ -d "$root/$rel/$section" ] || continue
+        package_source_listed "$manifest" "$section" "$rel/$section" && continue
+        sources_add_entry_first "$manifest" "$section" "$rel/$section"
     done
 }
 
-# unwire_package_sources <manifest> <store-rel-dir>
+# unwire_package_sources <manifest> <@scope/name> [section...]
+# Drop the package's sources entries in every spelling (sources_remove_package):
+# every one without sections, as `package remove` does; only the named
+# sections' own directories with them, as `update` does for the directories a
+# new version no longer has. Call it while `packages:` still declares the
+# package and its alias.
 unwire_package_sources() {
-    local manifest="$1" rel="$2"
-    local section
-    for section in rules agents skills; do
-        sources_remove_entry "$manifest" "$section" "$rel/$section"
-    done
+    sources_remove_package "$@"
 }

package/engine/ENGINE_SHA

@@ -1 +1 @@
-7dfbb01c2182f3de05bff94f3e5e080cf267f8c6
+b1113b0658f6fddb23017e845a4ba79401caedbf

package/engine/VERSION

@@ -1 +1 @@
-0.18.1
+0.19.0

package/engine/adapters/_template.sh

@@ -27,9 +27,11 @@
 #   has_paths(file)                     — check if file has paths: field
 #   get_model(config, ide, tier)        — resolve model from config or default
 #   get_model_default(ide, tier)        — hardcoded default for ide:tier
+#   map_effort(tool, effort)            — the tool's level for a neutral effort; "" when none
 #   map_access_to_claude_tools(access)  — full->"" (no tools list; inherits all), readonly->restricted
 #   map_access_to_claude_disallowed(access) — readonly->"Write, Edit", full->""
-#   read_yaml_list(manifest, section)   — read a source list from intelligence.yaml
+#   read_yaml_list(manifest, section)   — read a source list from intelligence.yaml,
+#                                         package references as their store paths
 #   get_target_field(config, target, field) — read a target's config field
 
 # Project adapters are sourced by engine/sync.sh after the shared library is
@@ -40,7 +42,9 @@
 # configured target output passed as $1. `owned` paths are exclusively managed;
 # `managed` paths share a directory with another adapter or hand-authored files.
 # Add `legacy` inputs to the initial backup, `preserve` for settings that must
-# never be replaced, and explicit ignore/include records for Git policy.
+# never be replaced, and explicit ignore/include records for Git policy. $2, when
+# given, is the manifest: read it only to choose Git policy (ignore versus
+# unignore), never ownership — callers that read ownership alone omit it.
 adapter_contract_<name>() {
     local output="${1%/}"
     adapter_contract_version 1

package/engine/adapters/agents.sh

@@ -216,6 +216,9 @@ adapter_contract_agents() {
     adapter_contract_version 1
     adapter_contract_owned "$output"
     adapter_contract_legacy "AGENTS.md"
+    # No ignore record, deliberately: AGENTS.md is the tool-neutral fallback
+    # every tool reads, and a fresh clone has it only if it is committed —
+    # before anyone has run a sync.
 }
 
 sync_to_agents() {

package/engine/adapters/claude.sh

@@ -3,8 +3,9 @@
 # Transforms source prompts to .claude/ format
 #
 # Rules: copy as-is (paths: frontmatter preserved)
-# Skills: copy skill directories in full (SKILL.md + bundled resources)
-# Agents: tier -> model, access -> tools/disallowedTools
+# Skills: copy skill directories in full (SKILL.md + bundled resources),
+#   effort -> Claude's effort level
+# Agents: tier -> model, effort -> effort, access -> tools/disallowedTools
 #
 # Every per-file loop batches its work into one awk process (see the batched
 # helpers in lib/common.sh): process spawns dominate sync time on Windows.
@@ -73,7 +74,7 @@ sync_claude_skills() {
         done
     done <<< "$list"
     [ "${#skill_dirs[@]}" -gt 0 ] || return 0
-    copy_skill_bundle_dirs "$output_dir/skills" "${skill_dirs[@]}"
+    copy_skill_bundle_dirs_for claude "$output_dir/skills" "${skill_dirs[@]}"
     for d in "${skill_dirs[@]}"; do
         skill_name="${d%/}"
         echo "  skill: ${skill_name##*/}"
@@ -81,7 +82,7 @@ sync_claude_skills() {
 }
 
 # Sync all agents to Claude format: one frontmatter pass resolves
-# tier/access for every file, one transform pass writes every output.
+# tier/effort/access for every file, one transform pass writes every output.
 sync_claude_agents() {
     local repo_root="$1"
     local config_file="$2"
@@ -104,19 +105,22 @@ sync_claude_agents() {
 
     load_model_tiers "$config_file" "claude"
 
-    local path tier access spec="" report=""
-    while IFS=$'\x1f' read -r path tier access; do
+    local path tier access effort spec="" report=""
+    while IFS=$'\x1f' read -r path tier access effort; do
         [ -n "$path" ] || continue
         resolve_model_var "$tier"
+        map_effort_var claude "$effort"
         map_access_to_claude_tools_var "$access"
         map_access_to_claude_disallowed_var "$access"
-        spec+="$path"$'\x1f'"$IS_MODEL"$'\x1f'"$IS_CLAUDE_TOOLS"$'\x1f'"$IS_CLAUDE_DISALLOWED"$'\n'
+        spec+="$path"$'\x1f'"$IS_MODEL"$'\x1f'"$IS_CLAUDE_TOOLS"$'\x1f'"$IS_CLAUDE_DISALLOWED"$'\x1f'"$IS_EFFORT"$'\n'
         report+="  agent: ${path##*/} (tier=$tier -> model=$IS_MODEL, access=$access)"$'\n'
-    done < <(frontmatter_index "tier,access" "${files[@]}")
+    done < <(frontmatter_index "tier,access,effort" "${files[@]}")
 
     # The transform used to run per file with the values injected via -v;
     # the batched form carries them per file through the environment (awk -v
-    # would reprocess backslash escapes).
+    # would reprocess backslash escapes). The first frontmatter `effort:` line
+    # becomes Claude's level in place, or goes when there is none; a later
+    # one goes too, since frontmatter_index read only the first.
     is_fin_awk_vars
     IS_MAP_SPEC="$spec" awk "${IS_FIN_V[@]}" -v dst="$output_dir/agents" "$IS_AWK_LIB"'
         BEGIN {
@@ -125,18 +129,25 @@ sync_claude_agents() {
             for (i = 1; i <= n; i++) {
                 if (recs[i] == "") continue
                 split(recs[i], f, US)
-                MODEL[f[1]] = f[2]; TOOLS[f[1]] = f[3]; EXTRA[f[1]] = f[4]
+                MODEL[f[1]] = f[2]; TOOLS[f[1]] = f[3]; EXTRA[f[1]] = f[4]; EFFORT[f[1]] = f[5]
             }
         }
         FNR == 1 {
             if (out != "") close(out)
             out = dst "/" base_name(FILENAME)
             count = 0
+            fm = 0
+            effort_seen = 0
         }
         /^tier:/  { next }
         /^access:/ { next }
         { sub(/\r$/, "") }
+        FNR == 1 && $0 == "---" { fm = 1 }
         /^---$/ { count++ }
+        fm && count == 1 && substr($0, 1, 7) == "effort:" {
+            if (!effort_seen++ && EFFORT[FILENAME] != "") print fin_line("effort: " EFFORT[FILENAME]) > out
+            next
+        }
         count == 2 && /^---$/ {
             if (TOOLS[FILENAME] != "") print fin_line("tools: " TOOLS[FILENAME]) > out
             if (EXTRA[FILENAME] != "") print fin_line("disallowedTools: " EXTRA[FILENAME]) > out