@bonesofspring/ai-rules 0.2.25 → 0.2.27

package/bin/lib/seed-ai-local-team.js

@@ -0,0 +1,440 @@
+/**
+ * Seed consumer `.ai.local/team/` (shared across Cursor, Claude, Mavis, OpenCode).
+ * Living task slugs are never overwritten. `clean` must not own this tree.
+ *
+ * Legacy `.<tool>/team/` migration is non-destructive: every non-`README.md`
+ * entry is migrated and backed up before it is removed, deletion happens only
+ * after the copies are verified, and symlinked paths are refused rather than
+ * followed (they would let `rmSync` escape the resolved `--cwd`).
+ */
+const fs = require('fs');
+const path = require('path');
+const { assertSafeDest } = require('./safe-path');
+
+const LEGACY_TOOLS = ['cursor', 'claude', 'mavis', 'opencode'];
+const POINTER_README = `# Agent team artifacts moved
+
+Runtime artifacts now live at \`.ai.local/team/\` (shared across Cursor, Claude, Mavis, and OpenCode).
+
+This leftover directory is safe to delete.
+`;
+
+function destTeamRoot(cwd) {
+  return path.join(cwd, '.ai.local', 'team');
+}
+
+function warn(message) {
+  console.warn(`Warning: ${message}`);
+}
+
+function hasConsumerTaskSlugs(tasksDir) {
+  if (!fs.existsSync(tasksDir) || !fs.statSync(tasksDir).isDirectory()) {
+    return false;
+  }
+  return fs.readdirSync(tasksDir, { withFileTypes: true }).some(
+    (entry) => entry.isDirectory() && !entry.name.startsWith('.'),
+  );
+}
+
+function copyFile(src, dest) {
+  fs.mkdirSync(path.dirname(dest), { recursive: true });
+  fs.copyFileSync(src, dest);
+}
+
+/**
+ * Copy a file or directory tree without ever following a symlink.
+ *
+ * @returns {{ copied: string[], skippedLinks: string[] }} relative paths, `.` for a plain file source
+ */
+function copyTree(src, dest) {
+  const copied = [];
+  const skippedLinks = [];
+  const visit = (from, to, rel) => {
+    const stat = fs.lstatSync(from);
+    if (stat.isSymbolicLink()) {
+      skippedLinks.push(rel);
+      return;
+    }
+    if (stat.isDirectory()) {
+      fs.mkdirSync(to, { recursive: true });
+      for (const name of fs.readdirSync(from)) {
+        visit(path.join(from, name), path.join(to, name), rel === '.' ? name : `${rel}/${name}`);
+      }
+      return;
+    }
+    if (stat.isFile()) {
+      copyFile(from, to);
+      copied.push(rel);
+      return;
+    }
+    skippedLinks.push(rel);
+  };
+  visit(src, dest, '.');
+  return { copied, skippedLinks };
+}
+
+/** Relative file paths under a file-or-directory path, without following symlinks. */
+function listTree(target) {
+  const out = [];
+  const visit = (from, rel) => {
+    const stat = fs.lstatSync(from);
+    if (stat.isDirectory()) {
+      for (const name of fs.readdirSync(from)) {
+        visit(path.join(from, name), rel === '.' ? name : `${rel}/${name}`);
+      }
+      return;
+    }
+    out.push(rel);
+  };
+  visit(target, '.');
+  return out.sort();
+}
+
+function sameContent(a, b) {
+  const aStat = fs.lstatSync(a);
+  const bStat = fs.lstatSync(b);
+  if (aStat.isDirectory() !== bStat.isDirectory()) {
+    return false;
+  }
+  if (!aStat.isDirectory()) {
+    return fs.readFileSync(a).equals(fs.readFileSync(b));
+  }
+  const aFiles = listTree(a);
+  const bFiles = listTree(b);
+  if (aFiles.length !== bFiles.length || aFiles.some((rel, i) => rel !== bFiles[i])) {
+    return false;
+  }
+  return aFiles.every((rel) =>
+    fs.readFileSync(path.join(a, rel)).equals(fs.readFileSync(path.join(b, rel))),
+  );
+}
+
+/** `notes.md` + `__from-claude` → `notes__from-claude.md`; directories get a plain suffix. */
+function suffixedName(name, tool, isDirectory) {
+  const suffix = `__from-${tool}`;
+  if (isDirectory) {
+    return `${name}${suffix}`;
+  }
+  const ext = path.extname(name);
+  return ext ? `${path.basename(name, ext)}${suffix}${ext}` : `${name}${suffix}`;
+}
+
+function freeDestination(dir, name, tool, isDirectory) {
+  let candidate = path.join(dir, suffixedName(name, tool, isDirectory));
+  let n = 2;
+  while (fs.existsSync(candidate)) {
+    const base = suffixedName(name, tool, isDirectory);
+    const ext = isDirectory ? '' : path.extname(base);
+    const stem = ext ? path.basename(base, ext) : base;
+    candidate = path.join(dir, `${stem}-${n}${ext}`);
+    n += 1;
+  }
+  return candidate;
+}
+
+/**
+ * Copy `src` to `preferredDest`; on collision keep both by writing the source to a
+ * `__from-<tool>` sibling. Never overwrites an existing destination.
+ *
+ * @returns {{ ok: boolean, copiedSomething: boolean }}
+ */
+function migrateEntry(src, preferredDest, tool, label) {
+  const isDirectory = fs.lstatSync(src).isDirectory();
+  if (fs.existsSync(preferredDest)) {
+    if (sameContent(src, preferredDest)) {
+      return { ok: true, copiedSomething: false };
+    }
+    const alternate = freeDestination(
+      path.dirname(preferredDest),
+      path.basename(preferredDest),
+      tool,
+      isDirectory,
+    );
+    const result = copyTree(src, alternate);
+    if (result.skippedLinks.length > 0) {
+      warn(
+        `${label}: ${result.skippedLinks.length} symlinked path(s) not migrated; left the source in place`,
+      );
+      return { ok: false, copiedSomething: result.copied.length > 0 };
+    }
+    warn(
+      `${label}: destination ${path.basename(preferredDest)} already exists with different content; kept the legacy copy as ${path.basename(alternate)}`,
+    );
+    return { ok: true, copiedSomething: true };
+  }
+  const result = copyTree(src, preferredDest);
+  if (result.skippedLinks.length > 0) {
+    warn(
+      `${label}: ${result.skippedLinks.length} symlinked path(s) not migrated; left the source in place`,
+    );
+    return { ok: false, copiedSomething: result.copied.length > 0 };
+  }
+  return { ok: true, copiedSomething: true };
+}
+
+/** Copy `src` under the timestamped backup root and verify the copy before the caller deletes. */
+function backupEntry(src, backupDest, label) {
+  const result = copyTree(src, backupDest);
+  if (result.skippedLinks.length > 0) {
+    warn(`${label}: symlinked path(s) could not be backed up; left the source in place`);
+    return false;
+  }
+  if (!fs.existsSync(backupDest)) {
+    warn(`${label}: backup copy is missing; left the source in place`);
+    return false;
+  }
+  const expected = listTree(src);
+  const actual = listTree(backupDest);
+  if (expected.length !== actual.length || expected.some((rel, i) => rel !== actual[i])) {
+    warn(`${label}: backup copy is incomplete; left the source in place`);
+    return false;
+  }
+  return true;
+}
+
+/**
+ * Make `.ai.local/.rollback/` self-ignoring so a consumer cannot accidentally
+ * commit migration backups. A `.gitignore` inside the directory is used instead
+ * of appending to the consumer's root `.gitignore`: the CLI never edits that
+ * file, and this works even in a repo that has no `.gitignore` at all.
+ */
+function ensureRollbackIgnored(rollbackRoot) {
+  const ignoreFile = path.join(rollbackRoot, '.gitignore');
+  if (fs.existsSync(ignoreFile)) {
+    return;
+  }
+  fs.mkdirSync(rollbackRoot, { recursive: true });
+  fs.writeFileSync(
+    ignoreFile,
+    [
+      '# Backups written by @bonesofspring/ai-rules when it migrated a legacy',
+      '# `.<tool>/team/` into `.ai.local/team/`. Local safety net — never commit.',
+      '# Safe to delete once you have confirmed the migration.',
+      '*',
+      '',
+    ].join('\n'),
+  );
+}
+
+function copyTemplates(presetTeamSrc, dest) {
+  if (!presetTeamSrc || !fs.existsSync(presetTeamSrc)) {
+    return;
+  }
+  const readme = path.join(presetTeamSrc, 'README.md');
+  if (fs.existsSync(readme)) {
+    copyFile(readme, path.join(dest, 'README.md'));
+  }
+  const fixturesSrc = path.join(presetTeamSrc, 'fixtures');
+  if (fs.existsSync(fixturesSrc)) {
+    copyTree(fixturesSrc, path.join(dest, 'fixtures'));
+  }
+  const gitkeepSrc = path.join(presetTeamSrc, 'tasks', '.gitkeep');
+  if (fs.existsSync(gitkeepSrc) && !hasConsumerTaskSlugs(path.join(dest, 'tasks'))) {
+    copyFile(gitkeepSrc, path.join(dest, 'tasks', '.gitkeep'));
+  }
+}
+
+/**
+ * Seed `.ai.local/conventions.md` (the living-conventions file the overlay probes)
+ * from the preset template. Never overwrites an existing consumer file.
+ */
+function seedConventions(presetTeamSrc, cwd) {
+  if (!presetTeamSrc) {
+    return false;
+  }
+  const template = path.join(path.dirname(presetTeamSrc), 'ai-local', 'conventions.md');
+  if (!fs.existsSync(template)) {
+    return false;
+  }
+  const dest = path.join(cwd, '.ai.local', 'conventions.md');
+  if (fs.existsSync(dest)) {
+    return false;
+  }
+  copyFile(template, dest);
+  console.log('Seeded .ai.local/conventions.md');
+  return true;
+}
+
+/**
+ * Resolve a legacy `.<tool>/team` directory, refusing symlinks and anything whose
+ * real path escapes the resolved `cwd`. `rmSync` through a link would delete the
+ * target, which lives outside the install scope.
+ */
+function resolveLegacyTeamDir(cwd, tool) {
+  const teamDir = path.join(cwd, `.${tool}`, 'team');
+  let stat;
+  try {
+    stat = fs.lstatSync(teamDir);
+  } catch {
+    return null;
+  }
+  if (stat.isSymbolicLink()) {
+    warn(`.${tool}/team is a symlink; refused to migrate or delete through it`);
+    return null;
+  }
+  if (!stat.isDirectory()) {
+    return null;
+  }
+  const cwdReal = fs.realpathSync(path.resolve(cwd));
+  const teamReal = fs.realpathSync(teamDir);
+  if (teamReal !== cwdReal && !teamReal.startsWith(cwdReal + path.sep)) {
+    warn(`.${tool}/team resolves outside ${cwdReal}; refused to migrate or delete it`);
+    return null;
+  }
+  return teamDir;
+}
+
+function migrateLegacyTool(tool, teamDir, cwd, dest, backupRoot) {
+  let copiedSomething = false;
+  const deletable = [];
+  let refused = 0;
+
+  for (const dirent of fs.readdirSync(teamDir, { withFileTypes: true })) {
+    const name = dirent.name;
+    if (name === 'README.md') {
+      continue;
+    }
+    const src = path.join(teamDir, name);
+    if (fs.lstatSync(src).isSymbolicLink()) {
+      warn(`.${tool}/team/${name} is a symlink; left it in place`);
+      refused += 1;
+      continue;
+    }
+
+    // `tasks/` is migrated child-by-child so slugs merge across tools. Dot-prefixed
+    // slugs and loose files under `tasks/` are entries like any other.
+    if (name === 'tasks' && fs.lstatSync(src).isDirectory()) {
+      let allOk = true;
+      fs.mkdirSync(path.join(dest, 'tasks'), { recursive: true });
+      for (const child of fs.readdirSync(src)) {
+        const childSrc = path.join(src, child);
+        if (fs.lstatSync(childSrc).isSymbolicLink()) {
+          warn(`.${tool}/team/tasks/${child} is a symlink; left it in place`);
+          allOk = false;
+          continue;
+        }
+        const outcome = migrateEntry(
+          childSrc,
+          path.join(dest, 'tasks', child),
+          tool,
+          `.${tool}/team/tasks/${child}`,
+        );
+        copiedSomething = copiedSomething || outcome.copiedSomething;
+        allOk = allOk && outcome.ok;
+      }
+      if (allOk) {
+        deletable.push(name);
+      } else {
+        refused += 1;
+      }
+      continue;
+    }
+
+    const preferredDest =
+      name === 'conventions.md'
+        ? path.join(cwd, '.ai.local', 'conventions.md')
+        : path.join(dest, name);
+    const outcome = migrateEntry(src, preferredDest, tool, `.${tool}/team/${name}`);
+    copiedSomething = copiedSomething || outcome.copiedSomething;
+    if (outcome.ok) {
+      deletable.push(name);
+    } else {
+      refused += 1;
+    }
+  }
+
+  // Back up first, verify, then delete — never the other way round.
+  let removed = 0;
+  for (const name of deletable) {
+    const src = path.join(teamDir, name);
+    if (!backupEntry(src, path.join(backupRoot, tool, name), `.${tool}/team/${name}`)) {
+      refused += 1;
+      continue;
+    }
+    fs.rmSync(src, { recursive: true, force: true });
+    removed += 1;
+  }
+
+  if (refused > 0) {
+    warn(
+      `.${tool}/team still holds ${refused} entr${refused === 1 ? 'y' : 'ies'} the migration could not account for; left the directory in place`,
+    );
+  } else {
+    fs.writeFileSync(path.join(teamDir, 'README.md'), POINTER_README);
+  }
+  return { copiedSomething, removed };
+}
+
+function migrateLegacyTeams(cwd, dest) {
+  const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+  const backupRoot = path.join(cwd, '.ai.local', '.rollback', `legacy-team-${stamp}`);
+  let migrated = false;
+  let backedUp = 0;
+
+  for (const tool of LEGACY_TOOLS) {
+    const teamDir = resolveLegacyTeamDir(cwd, tool);
+    if (!teamDir) {
+      continue;
+    }
+    const result = migrateLegacyTool(tool, teamDir, cwd, dest, backupRoot);
+    migrated = migrated || result.copiedSomething;
+    backedUp += result.removed;
+  }
+
+  if (backedUp > 0) {
+    ensureRollbackIgnored(path.dirname(backupRoot));
+    console.log(
+      `Backed up ${backedUp} legacy team entr${backedUp === 1 ? 'y' : 'ies'} → ${path.relative(cwd, backupRoot)} (git-ignored; safe to delete once the migration looks right)`,
+    );
+  }
+  return migrated;
+}
+
+/**
+ * @param {{ cwd: string, presetTeamSrc?: string }} options
+ * @returns {{ created: boolean, migrated: boolean, refreshed: boolean, conventionsSeeded: boolean }}
+ */
+function seedAiLocalTeam({ cwd, presetTeamSrc }) {
+  const dest = destTeamRoot(cwd);
+  // `.ai.local` / `.ai.local/team` must be real paths under cwd: seeding through a
+  // symlink would write the shared runtime tree outside the install scope.
+  assertSafeDest(cwd, dest, '.ai.local/team');
+  assertSafeDest(cwd, path.join(cwd, '.ai.local', 'conventions.md'), '.ai.local/conventions.md');
+  const destExisted = fs.existsSync(dest);
+  const destHasSlugs = hasConsumerTaskSlugs(path.join(dest, 'tasks'));
+  const hadLegacy = LEGACY_TOOLS.some((tool) =>
+    fs.existsSync(path.join(cwd, `.${tool}`, 'team')),
+  );
+
+  if (!destExisted && !hadLegacy && (!presetTeamSrc || !fs.existsSync(presetTeamSrc))) {
+    console.log('Skipped .ai.local/team seed (preset team/ missing)');
+    return { created: false, migrated: false, refreshed: false, conventionsSeeded: false };
+  }
+
+  fs.mkdirSync(dest, { recursive: true });
+  const migrated = migrateLegacyTeams(cwd, dest);
+  copyTemplates(presetTeamSrc, dest);
+  const conventionsSeeded = seedConventions(presetTeamSrc, cwd);
+
+  if (migrated) {
+    console.log('Migrated legacy .{tool}/team → .ai.local/team');
+  }
+
+  if (!destExisted && !hadLegacy) {
+    console.log('Seeded .ai.local/team/');
+    return { created: true, migrated: false, refreshed: false, conventionsSeeded };
+  }
+
+  if (destHasSlugs || destExisted) {
+    console.log(
+      destHasSlugs
+        ? 'Refreshed .ai.local/team templates (tasks preserved)'
+        : 'Refreshed .ai.local/team (no consumer task slugs)',
+    );
+    return { created: false, migrated, refreshed: true, conventionsSeeded };
+  }
+
+  return { created: false, migrated, refreshed: false, conventionsSeeded };
+}
+
+module.exports = { seedAiLocalTeam, destTeamRoot };

package/bin/mavis-install.js

@@ -4,6 +4,7 @@
 const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
+const { assertSafeDest, resolveManagedPath } = require('./lib/safe-path');
 
 const MANIFEST_REL = path.join('.mavis', '.ai-rules-install.json');
 const CONTRACT_REL = path.join('presets', 'mavis', 'platform-contract.json');
@@ -202,7 +203,7 @@ function restoreRollback(overwritten, created, rollbackRoot, mavisRoot, mavisExi
 }
 
 function cmdInitMavis({ preset, cwdOption, helpers }) {
-  const { resolveTargetCwd, seedDocsSpecsIfAbsent, installMcpJson, getPackageRoot } = helpers;
+  const { resolveTargetCwd, seedDocsSpecsIfAbsent, seedAiLocalTeam, installMcpJson, getPackageRoot } = helpers;
   const packageRoot = getPackageRoot();
   const cwd = resolveTargetCwd(cwdOption);
   const contract = loadContract(packageRoot);
@@ -211,7 +212,6 @@ function cmdInitMavis({ preset, cwdOption, helpers }) {
   if (releasedStacks.length > 0 && !releasedStacks.includes(stack)) {
     console.error(`Preset "${stack}" for mavis is not released yet.`);
     console.error(`Released stacks: ${releasedStacks.join(', ')}`);
-    console.error('Additional stacks ship after the pilot human gate (WP-F).');
     process.exit(1);
   }
   const sourceBase = path.join(packageRoot, contract.sourceRoot, stack);
@@ -222,6 +222,14 @@ function cmdInitMavis({ preset, cwdOption, helpers }) {
   }
 
   const mavisRoot = path.join(cwd, contract.managedRoot);
+  // Refuse to install through a symlinked `.mavis` (or any symlinked ancestor):
+  // writes would land outside the resolved --cwd.
+  try {
+    assertSafeDest(cwd, mavisRoot, contract.managedRoot);
+  } catch (err) {
+    console.error(`init failed: ${err instanceof Error ? err.message : String(err)}`);
+    process.exit(1);
+  }
   const mavisExisted = fs.existsSync(mavisRoot);
   const docsSpecsDir = path.join(cwd, 'docs', 'specs');
   const docsSpecsExisted = fs.existsSync(docsSpecsDir);
@@ -290,6 +298,15 @@ function cmdInitMavis({ preset, cwdOption, helpers }) {
     if (seeded && !docsSpecsExisted) {
       created.add(docsSpecsDir);
     }
+    const teamDest = path.join(cwd, '.ai.local', 'team');
+    const teamExisted = fs.existsSync(teamDest);
+    const teamResult = seedAiLocalTeam({
+      cwd,
+      presetTeamSrc: path.join(sourceBase, 'team'),
+    });
+    if (teamResult.created && !teamExisted) {
+      created.add(teamDest);
+    }
 
     throwIfPhase('manifest');
     const managedFiles = {};
@@ -376,8 +393,8 @@ function removeEmptyDirs(dir) {
 function cmdCleanMavis({ cwdOption, helpers }) {
   const { resolveTargetCwd, otherToolInstallPresent } = helpers;
   const cwd = resolveTargetCwd(cwdOption);
-  const manifestPath = path.join(cwd, MANIFEST_REL);
-  if (!fs.existsSync(manifestPath)) {
+  const manifestPath = resolveManagedPath(cwd, MANIFEST_REL);
+  if (!manifestPath || !fs.existsSync(manifestPath)) {
     console.error(
       'clean mavis: missing .mavis/.ai-rules-install.json; nothing removed (fail-safe).',
     );
@@ -404,10 +421,19 @@ function cmdCleanMavis({ cwdOption, helpers }) {
     if (rel === MANIFEST_REL) {
       continue;
     }
-    const abs = path.join(cwd, rel);
+    // Reject entries that escape cwd or traverse a symlink before touching disk.
+    const abs = resolveManagedPath(cwd, rel);
+    if (!abs) {
+      console.warn(`Ignored unsafe manifest entry ${rel} (outside target or symlinked)`);
+      continue;
+    }
     if (!fs.existsSync(abs)) {
       continue;
     }
+    if (!fs.lstatSync(abs).isFile()) {
+      console.warn(`Ignored non-file manifest entry ${rel}`);
+      continue;
+    }
     const current = sha256File(abs);
     if (rel === 'AGENTS.md' && otherToolInstallPresent && otherToolInstallPresent(cwd, '.mavis')) {
       console.log('Kept shared AGENTS.md (another tool install is still present)');
@@ -422,17 +448,26 @@ function cmdCleanMavis({ cwdOption, helpers }) {
   }
 
   if (preserved.includes('.mavis/mcp.json') && Array.isArray(manifest.shippedMcpServerIds)) {
-    stripShippedMcp(path.join(cwd, '.mavis', 'mcp.json'), manifest.shippedMcpServerIds);
+    const mcpAbs = resolveManagedPath(cwd, '.mavis/mcp.json');
+    if (mcpAbs) {
+      stripShippedMcp(mcpAbs, manifest.shippedMcpServerIds);
+    }
   }
 
   for (const dirRel of [...(manifest.managedDirectories || [])].sort((a, b) => b.length - a.length)) {
-    removeEmptyDirs(path.join(cwd, dirRel));
+    const dirAbs = resolveManagedPath(cwd, dirRel);
+    if (dirAbs) {
+      removeEmptyDirs(dirAbs);
+    }
   }
 
   fs.unlinkSync(manifestPath);
-  removeEmptyDirs(path.join(cwd, '.mavis'));
-  if (fs.existsSync(path.join(cwd, '.mavis')) && fs.readdirSync(path.join(cwd, '.mavis')).length === 0) {
-    fs.rmdirSync(path.join(cwd, '.mavis'));
+  const managedRoot = resolveManagedPath(cwd, '.mavis');
+  if (managedRoot) {
+    removeEmptyDirs(managedRoot);
+    if (fs.existsSync(managedRoot) && fs.readdirSync(managedRoot).length === 0) {
+      fs.rmdirSync(managedRoot);
+    }
   }
 
   console.log(

package/bin/opencode-install.js

@@ -4,6 +4,7 @@
 const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
+const { assertSafeDest, resolveManagedPath } = require('./lib/safe-path');
 
 const MANIFEST_REL = path.join('.opencode', '.ai-rules-install.json');
 const CONTRACT_REL = path.join('presets', 'opencode', 'platform-contract.json');
@@ -297,7 +298,7 @@ function restoreRollback(overwritten, created, rollbackRoot, managedRoot, rootEx
 }
 
 function cmdInitOpencode({ preset, cwdOption, helpers }) {
-  const { resolveTargetCwd, seedDocsSpecsIfAbsent, getPackageRoot } = helpers;
+  const { resolveTargetCwd, seedDocsSpecsIfAbsent, seedAiLocalTeam, getPackageRoot } = helpers;
   const packageRoot = getPackageRoot();
   const cwd = resolveTargetCwd(cwdOption);
   const contract = loadContract(packageRoot);
@@ -316,6 +317,13 @@ function cmdInitOpencode({ preset, cwdOption, helpers }) {
   }
 
   const managedRoot = path.join(cwd, contract.managedRoot);
+  // Refuse to install through a symlinked `.opencode` (or any symlinked ancestor).
+  try {
+    assertSafeDest(cwd, managedRoot, contract.managedRoot);
+  } catch (err) {
+    console.error(`init failed: ${err instanceof Error ? err.message : String(err)}`);
+    process.exit(1);
+  }
   const rootExisted = fs.existsSync(managedRoot);
   const docsSpecsDir = path.join(cwd, 'docs', 'specs');
   const docsSpecsExisted = fs.existsSync(docsSpecsDir);
@@ -381,6 +389,15 @@ function cmdInitOpencode({ preset, cwdOption, helpers }) {
     if (seeded && !docsSpecsExisted) {
       created.add(docsSpecsDir);
     }
+    const teamDest = path.join(cwd, '.ai.local', 'team');
+    const teamExisted = fs.existsSync(teamDest);
+    const teamResult = seedAiLocalTeam({
+      cwd,
+      presetTeamSrc: path.join(sourceBase, 'team'),
+    });
+    if (teamResult.created && !teamExisted) {
+      created.add(teamDest);
+    }
 
     throwIfPhase('manifest');
     const managedFiles = {};
@@ -463,8 +480,8 @@ function removeEmptyDirs(dir) {
 function cmdCleanOpencode({ cwdOption, helpers }) {
   const { resolveTargetCwd, otherToolInstallPresent } = helpers;
   const cwd = resolveTargetCwd(cwdOption);
-  const manifestPath = path.join(cwd, MANIFEST_REL);
-  if (!fs.existsSync(manifestPath)) {
+  const manifestPath = resolveManagedPath(cwd, MANIFEST_REL);
+  if (!manifestPath || !fs.existsSync(manifestPath)) {
     console.error(
       'clean opencode: missing .opencode/.ai-rules-install.json; nothing removed (fail-safe).',
     );
@@ -491,10 +508,19 @@ function cmdCleanOpencode({ cwdOption, helpers }) {
     if (rel === MANIFEST_REL) {
       continue;
     }
-    const abs = path.join(cwd, rel);
+    // Reject entries that escape cwd or traverse a symlink before touching disk.
+    const abs = resolveManagedPath(cwd, rel);
+    if (!abs) {
+      console.warn(`Ignored unsafe manifest entry ${rel} (outside target or symlinked)`);
+      continue;
+    }
     if (!fs.existsSync(abs)) {
       continue;
     }
+    if (!fs.lstatSync(abs).isFile()) {
+      console.warn(`Ignored non-file manifest entry ${rel}`);
+      continue;
+    }
     const current = sha256File(abs);
     if (rel === 'AGENTS.md' && otherToolInstallPresent && otherToolInstallPresent(cwd, '.opencode')) {
       console.log('Kept shared AGENTS.md (another tool install is still present)');
@@ -509,20 +535,26 @@ function cmdCleanOpencode({ cwdOption, helpers }) {
   }
 
   if (preserved.includes('opencode.json') && Array.isArray(manifest.shippedMcpServerIds)) {
-    stripShippedMcp(path.join(cwd, 'opencode.json'), manifest.shippedMcpServerIds);
+    const mcpAbs = resolveManagedPath(cwd, 'opencode.json');
+    if (mcpAbs) {
+      stripShippedMcp(mcpAbs, manifest.shippedMcpServerIds);
+    }
   }
 
   for (const dirRel of [...(manifest.managedDirectories || [])].sort((a, b) => b.length - a.length)) {
-    removeEmptyDirs(path.join(cwd, dirRel));
+    const dirAbs = resolveManagedPath(cwd, dirRel);
+    if (dirAbs) {
+      removeEmptyDirs(dirAbs);
+    }
   }
 
   fs.unlinkSync(manifestPath);
-  removeEmptyDirs(path.join(cwd, '.opencode'));
-  if (
-    fs.existsSync(path.join(cwd, '.opencode')) &&
-    fs.readdirSync(path.join(cwd, '.opencode')).length === 0
-  ) {
-    fs.rmdirSync(path.join(cwd, '.opencode'));
+  const managedRoot = resolveManagedPath(cwd, '.opencode');
+  if (managedRoot) {
+    removeEmptyDirs(managedRoot);
+    if (fs.existsSync(managedRoot) && fs.readdirSync(managedRoot).length === 0) {
+      fs.rmdirSync(managedRoot);
+    }
   }
 
   console.log(