@cairnkeep/cli 2.8.0 → 2.11.0

package/scripts/test-uninstall.sh

@@ -303,6 +303,77 @@ check "memory store restored"     "$(cat "$SB/home/.cairnkeep/db" 2>/dev/null)"
 check "note store restored exactly" "$(sha256sum "$SB/home/.cairnkeep/notes/projects/example/hindsight/failure.md" | cut -d' ' -f1)" "$purge_note_before"
 check "typed and journal state restored exactly" "$(tree_hash "$SB/home/.cairnkeep")" "$purge_store_before"
 
+# --- context-pack data requires its own explicit purge consent ---------------
+PACK_HOME="$SB/pack-home"
+PACK_STORE="$PACK_HOME/.cairnkeep/packs"
+mkdir -p "$PACK_STORE/objects/example" "$PACK_HOME/.cairnkeep/memory"
+printf 'immutable pack\n' >"$PACK_STORE/objects/example/marker"
+printf 'memory\n' >"$PACK_HOME/.cairnkeep/memory/marker"
+pack_output=$(HOME="$PACK_HOME" XDG_CONFIG_HOME="$PACK_HOME/.config" \
+  CAIRN_AGENTFS_BASE_DIR="$PACK_HOME/.cairnkeep" CAIRN_PACK_BASE_DIR="$PACK_STORE" \
+  "$ROOT_DIR/scripts/uninstall.sh" --yes --live-root "$SB/pack-live" --pi-live-root "$SB/pack-pi" --kimi-live-root "$SB/pack-kimi" 2>&1)
+check "ordinary uninstall reports retained context packs" "$(grep -q 'kept context packs' <<<"$pack_output" && echo yes || echo no)" "yes"
+check "ordinary uninstall retains context packs" "$([[ -f "$PACK_STORE/objects/example/marker" ]] && echo yes || echo no)" "yes"
+HOME="$PACK_HOME" XDG_CONFIG_HOME="$PACK_HOME/.config" \
+  CAIRN_AGENTFS_BASE_DIR="$PACK_HOME/.cairnkeep" CAIRN_PACK_BASE_DIR="$PACK_STORE" \
+  "$ROOT_DIR/scripts/uninstall.sh" --yes --purge-memory --live-root "$SB/pack-live" --pi-live-root "$SB/pack-pi" --kimi-live-root "$SB/pack-kimi" >/dev/null 2>&1
+check "memory purge retains context packs" "$([[ -f "$PACK_STORE/objects/example/marker" ]] && echo yes || echo no)" "yes"
+check "memory purge removes non-pack memory" "$([[ -e "$PACK_HOME/.cairnkeep/memory" ]] && echo no || echo yes)" "yes"
+HOME="$PACK_HOME" XDG_CONFIG_HOME="$PACK_HOME/.config" \
+  CAIRN_AGENTFS_BASE_DIR="$PACK_HOME/.cairnkeep" CAIRN_PACK_BASE_DIR="$PACK_STORE" \
+  "$ROOT_DIR/scripts/uninstall.sh" --yes --purge-packs --live-root "$SB/pack-live" --pi-live-root "$SB/pack-pi" --kimi-live-root "$SB/pack-kimi" >/dev/null 2>&1
+check "explicit pack purge removes context packs" "$([[ -e "$PACK_STORE" ]] && echo no || echo yes)" "yes"
+
 echo
 if [[ "$fails" -gt 0 ]]; then echo "test-uninstall: $fails check(s) failed."; exit 1; fi
 echo "test-uninstall: OK"
+
+phase26_uninstall_complete=true
+[[ -f "$ROOT_DIR/pi/extensions/cairnkeep-memory.ts" ]] || phase26_uninstall_complete=false
+grep -qF 'extensions/cairnkeep-memory.ts' "$ROOT_DIR/scripts/sync-pi-assets.sh" || phase26_uninstall_complete=false
+grep -qF 'extensions/cairnkeep-memory.ts' "$ROOT_DIR/scripts/uninstall.sh" || phase26_uninstall_complete=false
+
+if [[ "$phase26_uninstall_complete" != true ]]; then
+  if [[ "${CAIRN_PHASE26_RED:-0}" == 1 ]]; then
+    echo "PHASE26_RED:PI_UNINSTALL_MISSING"
+    exit 86
+  fi
+  echo "SKIP: Pi memory-extension uninstall ownership is not complete"
+  exit 0
+fi
+
+# Exercise the new Pi owner separately so the long-standing uninstall oracle
+# above remains byte-for-byte focused on its established asset set.
+PHASE26_HOME="$SB/phase26-home"
+PHASE26_PI="$SB/phase26-pi"
+PHASE26_LIVE="$SB/phase26-live"
+PHASE26_STORE="$PHASE26_HOME/.cairnkeep"
+PHASE26_PACKS="$PHASE26_STORE/packs"
+mkdir -p "$PHASE26_HOME" "$PHASE26_PI/extensions" "$PHASE26_STORE/memory" "$PHASE26_PACKS/objects/fixture"
+printf 'neighbor bytes\n' >"$PHASE26_PI/extensions/operator-extension.ts"
+printf 'memory bytes\n' >"$PHASE26_STORE/memory/record"
+printf 'pack bytes\n' >"$PHASE26_PACKS/objects/fixture/record"
+
+HOME="$PHASE26_HOME" PI_CODING_AGENT_DIR="$PHASE26_PI" \
+  "$ROOT_DIR/scripts/sync-pi-assets.sh" --apply --live-root "$PHASE26_PI" >/dev/null 2>&1
+check "Pi memory extension installed" "$([[ -f "$PHASE26_PI/extensions/cairnkeep-memory.ts" ]] && echo yes || echo no)" "yes"
+printf '\n// operator-modified fixture\n' >>"$PHASE26_PI/extensions/cairnkeep-memory.ts"
+cp "$PHASE26_PI/extensions/cairnkeep-memory.ts" "$SB/pi-memory-modified.before.ts"
+
+HOME="$PHASE26_HOME" XDG_CONFIG_HOME="$PHASE26_HOME/.config" \
+  CAIRN_AGENTFS_BASE_DIR="$PHASE26_STORE" CAIRN_PACK_BASE_DIR="$PHASE26_PACKS" \
+  "$ROOT_DIR/scripts/uninstall.sh" --yes --live-root "$PHASE26_LIVE" --pi-live-root "$PHASE26_PI" >/dev/null 2>&1
+check "modified Pi memory extension removed after backup" "$([[ -e "$PHASE26_PI/extensions/cairnkeep-memory.ts" ]] && echo no || echo yes)" "yes"
+check "neighboring Pi extension preserved" "$(cat "$PHASE26_PI/extensions/operator-extension.ts")" "neighbor bytes"
+check "default Pi uninstall preserves memory" "$(cat "$PHASE26_STORE/memory/record")" "memory bytes"
+check "default Pi uninstall preserves context packs" "$(cat "$PHASE26_PACKS/objects/fixture/record")" "pack bytes"
+
+PHASE26_BACKUP=$(ls -dt "$PHASE26_HOME/.cairnkeep-uninstall-"* 2>/dev/null | head -1)
+check "Pi memory extension backup exists" "$([[ -f "$PHASE26_BACKUP/files/${PHASE26_PI#/}/extensions/cairnkeep-memory.ts" ]] && echo yes || echo no)" "yes"
+check "Pi memory extension manifest entry exists" "$(grep -cF "$PHASE26_PI/extensions/cairnkeep-memory.ts" "$PHASE26_BACKUP/manifest.tsv" 2>/dev/null || true)" "1"
+HOME="$PHASE26_HOME" bash "$PHASE26_BACKUP/revert.sh" >/dev/null 2>&1
+check "modified Pi memory extension restored exactly" "$(cmp -s "$SB/pi-memory-modified.before.ts" "$PHASE26_PI/extensions/cairnkeep-memory.ts" && echo yes || echo no)" "yes"
+check "neighbor remains exact after revert" "$(cat "$PHASE26_PI/extensions/operator-extension.ts")" "neighbor bytes"
+
+if [[ "$fails" -gt 0 ]]; then echo "test-uninstall: $fails Phase 26 check(s) failed."; exit 1; fi
+echo "PASS: Pi memory-extension backup-first uninstall and revert contract"

package/scripts/test-windows-native.mjs

@@ -0,0 +1,136 @@
+#!/usr/bin/env node
+
+import assert from "node:assert/strict";
+import { existsSync, mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { gzipSync } from "node:zlib";
+import { join, resolve } from "node:path";
+import { tmpdir } from "node:os";
+import { fileURLToPath } from "node:url";
+import {
+  bootstrapWindows,
+  createTar,
+  extractTar,
+  launcherModule,
+  launcherPowerShell,
+  powershellCompletion,
+  runWindowsCommand,
+} from "./windows-platform.mjs";
+import { runNativeContainer } from "./cairn-container-cli.mjs";
+
+const root = resolve(fileURLToPath(new URL("..", import.meta.url)));
+const sandbox = mkdtempSync(join(tmpdir(), "cairn-windows-native-"));
+const originalBase = process.env.CAIRN_AGENTFS_BASE_DIR;
+const originalHome = process.env.HOME;
+const originalProfile = process.env.USERPROFILE;
+try {
+  process.env.HOME = sandbox;
+  process.env.USERPROFILE = sandbox;
+  const project = join(sandbox, "Project with spaces – Unicode");
+  mkdirSync(project, { recursive: true });
+  bootstrapWindows(root, [project]);
+  for (const harness of ["claude", "opencode", "pi", "kimi", "qwen"]) {
+    assert.ok(existsSync(join(project, ".ai", `start-${harness}.cmd`)), `${harness} cmd launcher`);
+  }
+  assert.match(readFileSync(join(project, ".ai", "start-claude.cmd"), "utf8"), /start-harness\.ps1/);
+  assert.match(launcherModule(), /spawnSync\(command/);
+  assert.match(launcherPowerShell(), /pre-launch\.ps1/);
+  assert.match(launcherPowerShell(), /post-exit\.ps1/);
+
+  const claudeRoot = join(sandbox, "Claude Config");
+  await runWindowsCommand({ command: "sync", args: ["--apply", "--live-root", claudeRoot], root });
+  assert.ok(existsSync(join(claudeRoot, "commands", "remember.md")));
+  assert.ok(existsSync(join(claudeRoot, "hooks", "memory-wakeup.cmd")));
+  const settings = JSON.parse(readFileSync(join(claudeRoot, "settings.json"), "utf8"));
+  assert.ok(settings.hooks.SessionStart.some((entry) => entry.hooks.some((hook) => /memory-wakeup/.test(hook.command))));
+  await runWindowsCommand({ command: "sync", args: ["--check", "--live-root", claudeRoot], root });
+
+  const payloads = [["project.db", Buffer.from("sqlite-a")], ["team.db", Buffer.from("sqlite-b")]];
+  const tar = createTar(payloads);
+  assert.deepEqual(extractTar(tar), payloads);
+  assert.throws(() => extractTar(Buffer.from(tar).fill(0x2e, 0, 12)), /checksum|unsafe|unsupported/);
+  const archive = join(sandbox, "memory.tgz");
+  writeFileSync(archive, gzipSync(tar));
+  const memory = join(sandbox, "Memory Store");
+  process.env.CAIRN_AGENTFS_BASE_DIR = memory;
+  await runWindowsCommand({ command: "memory", args: ["import", archive], root });
+  assert.equal(readFileSync(join(memory, "project.db"), "utf8"), "sqlite-a");
+  assert.match(powershellCompletion(), /Register-ArgumentCompleter/);
+
+  let containerArgs = [];
+  runNativeContainer(["stdio", "--image", "example/windows:1", "--volume", "windows-data"], root, (_engine, args) => { containerArgs = args; });
+  assert.ok(containerArgs.includes("--read-only"));
+  assert.ok(containerArgs.includes("windows-data:/data:Z,U"));
+  assert.ok(containerArgs.includes("example/windows:1"));
+
+  await runWindowsCommand({ command: "uninstall", args: ["--yes", "--live-root", claudeRoot, project], root });
+  assert.ok(!existsSync(join(project, ".ai", "start-claude.cmd")));
+  assert.ok(!existsSync(join(claudeRoot, "commands", "remember.md")));
+  const cleanedSettings = JSON.parse(readFileSync(join(claudeRoot, "settings.json"), "utf8"));
+  assert.ok(!JSON.stringify(cleanedSettings).includes("memory-wakeup"));
+
+  const setupSurfaceComplete = [
+    join(root, "scripts", "setup.mjs"),
+    join(root, "scripts", "setup-core.mjs"),
+    join(root, "scripts", "setup-reconcile.mjs"),
+    join(root, "schemas", "cairnkeep-setup.schema.json"),
+    join(root, "schemas", "cairnkeep-setup-policy.schema.json"),
+  ].every((candidate) => existsSync(candidate))
+    && /case\s+["']setup["']/.test(readFileSync(join(root, "scripts", "windows-platform.mjs"), "utf8"))
+    && /["']setup["']/.test(powershellCompletion());
+
+  if (!setupSurfaceComplete) {
+    if (process.env.CAIRN_PHASE26_RED === "1") {
+      console.log("PHASE26_RED:WINDOWS_SETUP_MISSING");
+      process.exitCode = 86;
+    } else {
+      console.log("SKIP: simulated Windows guided setup surface is not complete");
+      console.log("PASS: native Windows CLI lifecycle, paths, archive safety, hooks, and PowerShell completion");
+    }
+  } else {
+    const setupProject = join(sandbox, "Guided Project with spaces – Unicode");
+    let output = "";
+    const originalWrite = process.stdout.write.bind(process.stdout);
+    process.stdout.write = ((chunk, ...args) => {
+      output += String(chunk);
+      return true;
+    });
+    try {
+      const handled = await runWindowsCommand({
+        command: "setup",
+        args: [setupProject, "--git", "none", "--harness", "claude,pi", "--memory", "local", "--yes", "--json"],
+        root,
+      });
+      assert.equal(handled, true);
+    } finally {
+      process.stdout.write = originalWrite;
+    }
+    const setupResult = JSON.parse(output);
+    assert.equal(setupResult.schema_version, 1);
+    assert.equal(setupResult.status, "limited");
+    assert.equal(setupResult.git, "none");
+    assert.equal(setupResult.memory, "local");
+    assert.deepEqual(setupResult.harnesses, ["claude", "pi"]);
+    assert.equal(Array.isArray(setupResult.recovery), true);
+    assert.equal(setupResult.recovery.some((line) => /cairn (?:setup|sync)/.test(line)), true);
+
+    const setupStatePath = join(setupProject, ".ai", "cairnkeep.json");
+    assert.ok(existsSync(setupStatePath));
+    const setupState = JSON.parse(readFileSync(setupStatePath, "utf8"));
+    const serializedState = JSON.stringify(setupState);
+    assert.equal(serializedState.includes(setupProject), false);
+    assert.doesNotMatch(serializedState, /(?:token|secret|credential|endpoint|username|environment|https?:)/i);
+    assert.match(powershellCompletion(), /--git/);
+    assert.match(powershellCompletion(), /--harness/);
+    assert.match(powershellCompletion(), /--memory/);
+    assert.match(powershellCompletion(), /--policy/);
+    assert.match(powershellCompletion(), /--yes/);
+    assert.match(powershellCompletion(), /--json/);
+    console.log("PASS: simulated Windows setup parity, private state, recovery, and completion contract");
+  }
+} finally {
+  if (originalBase === undefined) delete process.env.CAIRN_AGENTFS_BASE_DIR;
+  else process.env.CAIRN_AGENTFS_BASE_DIR = originalBase;
+  if (originalHome === undefined) delete process.env.HOME; else process.env.HOME = originalHome;
+  if (originalProfile === undefined) delete process.env.USERPROFILE; else process.env.USERPROFILE = originalProfile;
+  rmSync(sandbox, { recursive: true, force: true });
+}

package/scripts/uninstall.sh

@@ -25,9 +25,12 @@ PI_LIVE_ROOT="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}"
 KIMI_LIVE_ROOT="${KIMI_CODE_HOME:-$HOME/.kimi-code}"
 STORE_DIR="${CAIRN_AGENTFS_BASE_DIR:-$HOME/.cairnkeep}"
 STORE_DIR="${STORE_DIR/#\~/$HOME}"
+PACK_DIR="${CAIRN_PACK_BASE_DIR:-$HOME/.cairnkeep/packs}"
+PACK_DIR="${PACK_DIR/#\~/$HOME}"
 DRY_RUN=0
 ASSUME_YES=0
 PURGE_MEMORY=0
+PURGE_PACKS=0
 PROJECTS=()
 
 # The hooks cairnkeep registers (basename is the settings.json match token).
@@ -49,7 +52,7 @@ PROJECT_AI_FILES=(
 
 usage() {
   cat <<'EOF'
-Usage: uninstall.sh [--dry-run] [--yes] [--purge-memory] [--live-root PATH]
+Usage: uninstall.sh [--dry-run] [--yes] [--purge-memory] [--purge-packs] [--live-root PATH]
                     [--pi-live-root PATH] [--kimi-live-root PATH] [PROJECT ...]
 
 Reverse cairnkeep's install. Everything removed/edited is backed up into
@@ -59,6 +62,8 @@ $HOME/.cairnkeep-uninstall-<ts>/ with a revert.sh before any change.
   --yes            Do not prompt for confirmation.
   --purge-memory   Also remove the global memory store and .agentfs/ memory and
                    trajectories in each PROJECT. Backed up first; off by default.
+  --purge-packs    Also remove immutable context-pack objects and project
+                   pointers. Backed up first; off by default.
   --live-root PATH Claude root to clean (default: $CLAUDE_CONFIG_DIR or ~/.claude).
   --pi-live-root PATH Pi agent root to clean (default: $PI_CODING_AGENT_DIR or ~/.pi/agent).
   --kimi-live-root PATH Kimi Code root to clean (default: $KIMI_CODE_HOME or ~/.kimi-code).
@@ -73,6 +78,7 @@ while [[ $# -gt 0 ]]; do
     --dry-run) DRY_RUN=1; shift ;;
     --yes) ASSUME_YES=1; shift ;;
     --purge-memory) PURGE_MEMORY=1; shift ;;
+    --purge-packs) PURGE_PACKS=1; shift ;;
     --live-root) LIVE_ROOT="$2"; shift 2 ;;
     --pi-live-root) PI_LIVE_ROOT="$2"; shift 2 ;;
     --kimi-live-root) KIMI_LIVE_ROOT="$2"; shift 2 ;;
@@ -119,6 +125,48 @@ remove_path() {
   echo "  removed: $abs"
 }
 
+# Print only package-known relative paths from a valid guided-setup ownership
+# record. The record identifies candidates, but never grants authority to an
+# arbitrary path. Modified candidates are still backed up before removal.
+setup_owned_paths() {
+  node --input-type=module - "$1" <<'NODE'
+import { lstatSync, readFileSync } from "node:fs";
+const path = process.argv[2];
+const info = lstatSync(path);
+if (!info.isFile() || info.isSymbolicLink() || info.size > 1024 * 1024) process.exit(1);
+if (process.platform !== "win32" && (info.mode & 0o777) !== 0o600) process.exit(1);
+const state = JSON.parse(readFileSync(path, "utf8"));
+const exact = (value, keys) => value && typeof value === "object" && !Array.isArray(value)
+  && Object.keys(value).sort().join(",") === [...keys].sort().join(",");
+if (!exact(state, ["schema_version", "cairnkeep_version", "git", "memory", "harnesses", "assets"])
+    || state.schema_version !== 1
+    || !["init", "existing", "none"].includes(state.git)
+    || !["local", "none"].includes(state.memory)
+    || !Array.isArray(state.harnesses)
+    || !state.assets
+    || typeof state.assets !== "object"
+    || Array.isArray(state.assets)) process.exit(1);
+const allowed = new Set([
+  ".ai/env.example", ".ai/trajectory-redaction.json", ".ai/capabilities.json",
+  ".agentfs/.gitignore", ".planning/config.json", ".planning/PROJECT-BRIEF.md",
+  ".planning/wiki/index.md", ".planning/wiki/policy.md", ".planning/wiki/CONTRADICTIONS.md",
+  ".planning/wiki/LOG.md", ".planning/alignment/policy.md", ".planning/alignment/gap-register.yaml",
+  ".planning/graphs/policy.md", ".planning/graphs/.gitignore", ".planning/security/policy.md",
+  ".ai/start-harness.mjs", ".ai/start-harness.ps1",
+  ...["claude", "opencode", "pi", "kimi", "qwen"].flatMap((name) => [`.ai/start-${name}.sh`, `.ai/start-${name}.cmd`]),
+]);
+for (const [asset, record] of Object.entries(state.assets)) {
+  if (!allowed.has(asset)
+      || !exact(record, ["digest", "mode", "template"])
+      || !/^[a-f0-9]{64}$/.test(record.digest)
+      || !Number.isInteger(record.mode)
+      || record.mode < 0 || record.mode > 0o777
+      || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(record.template)) process.exit(1);
+}
+process.stdout.write(`${Object.keys(state.assets).sort().join("\n")}\n`);
+NODE
+}
+
 note() { [[ $DRY_RUN -eq 1 ]] || { ensure_bundle; printf '%s\n' "$1" >>"$NOTES"; }; }
 
 # ---- what will be removed ----------------------------------------------------
@@ -142,6 +190,7 @@ echo "  live root:    $LIVE_ROOT"
 echo "  Pi live root: $PI_LIVE_ROOT"
 echo "  Kimi root:    $KIMI_LIVE_ROOT"
 echo "  memory store: $STORE_DIR ($([[ $PURGE_MEMORY -eq 1 ]] && echo 'WILL be purged' || echo 'kept'))"
+echo "  context packs: $PACK_DIR ($([[ $PURGE_PACKS -eq 1 ]] && echo 'WILL be purged' || echo 'kept'))"
 [[ ${#PROJECTS[@]} -gt 0 ]] && echo "  projects:     ${PROJECTS[*]}"
 
 if [[ $DRY_RUN -eq 0 && $ASSUME_YES -eq 0 ]]; then
@@ -157,6 +206,7 @@ while IFS= read -r dst; do remove_path "$dst"; done < <(asset_dests)
 # These are precisely owned adapter paths; do not touch neighboring harness
 # configuration in either user root.
 echo "Pi adapters:"
+remove_path "$PI_LIVE_ROOT/extensions/cairnkeep-memory.ts"
 remove_path "$PI_LIVE_ROOT/extensions/cairnkeep-trajectory.ts"
 remove_path "$PI_LIVE_ROOT/prompts/graphify.md"
 echo "Kimi adapter:"
@@ -231,6 +281,24 @@ fi
 if [[ $PURGE_MEMORY -eq 1 ]]; then
   echo "Memory store:"
   remove_path "$STORE_DIR"
+  if [[ $PURGE_PACKS -eq 0 && "$PACK_DIR" == "$STORE_DIR"/* && $DRY_RUN -eq 0 ]]; then
+    pack_backup="$BACKUP_DIR/files/${PACK_DIR#/}"
+    if [[ -d "$pack_backup" ]]; then
+      mkdir -p "$(dirname "$PACK_DIR")"
+      cp -a "$pack_backup" "$PACK_DIR"
+      echo "  retained context packs: $PACK_DIR"
+    fi
+  fi
+fi
+
+if [[ $PURGE_MEMORY -eq 0 && $PURGE_PACKS -eq 0 && -d "$PACK_DIR" ]]; then
+  echo "Context packs:"
+  echo "  kept context packs: $PACK_DIR (use --purge-packs to remove)"
+fi
+
+if [[ $PURGE_PACKS -eq 1 && ! ( $PURGE_MEMORY -eq 1 && "$PACK_DIR" == "$STORE_DIR"/* ) ]]; then
+  echo "Context packs:"
+  remove_path "$PACK_DIR"
 fi
 
 # 6. Per-project bootstrap scaffold.
@@ -243,13 +311,33 @@ for proj in "${PROJECTS[@]:-}"; do
   # hook registrations and OpenCode plugin bytes restore together exactly.
   # Normal and master-off installations never create it, so absence is inert.
   remove_path "$proj/.ai/capability-contract"
-  for rel in "${PROJECT_AI_FILES[@]}"; do
-    remove_path "$proj/.ai/$rel"
-  done
-  if [[ $DRY_RUN -eq 0 && -d "$proj/.ai" ]]; then
-    rmdir "$proj/.ai" 2>/dev/null || true
+  setup_state="$proj/.ai/cairnkeep.json"
+  if [[ -e "$setup_state" ]]; then
+    if owned_paths=$(setup_owned_paths "$setup_state" 2>/dev/null); then
+      while IFS= read -r rel; do
+        [[ -n "$rel" ]] && remove_path "$proj/$rel"
+      done <<< "$owned_paths"
+      remove_path "$setup_state"
+      if [[ $DRY_RUN -eq 0 ]]; then
+        for managed_dir in \
+          "$proj/.planning/wiki" "$proj/.planning/alignment" "$proj/.planning/graphs" \
+          "$proj/.planning/security" "$proj/.planning" "$proj/.ai" "$proj/.agentfs"; do
+          rmdir "$managed_dir" 2>/dev/null || true
+        done
+      fi
+    else
+      echo "  kept guided setup scaffold: ownership state is invalid or unsafe"
+    fi
+  else
+    # Compatibility path for projects created by the legacy bootstrap command.
+    for rel in "${PROJECT_AI_FILES[@]}"; do
+      remove_path "$proj/.ai/$rel"
+    done
+    if [[ $DRY_RUN -eq 0 && -d "$proj/.ai" ]]; then
+      rmdir "$proj/.ai" 2>/dev/null || true
+    fi
+    remove_path "$proj/.planning"
   fi
-  remove_path "$proj/.planning"
   if [[ $PURGE_MEMORY -eq 1 ]]; then
     remove_path "$proj/.agentfs"
   elif [[ -d "$proj/.agentfs" ]]; then