@cleocode/caamp 2026.10.8 → 2026.10.9-rc.ci.676

package/dist/atomic.d.ts

@@ -0,0 +1,184 @@
+import { HookConfigObject, HookConfigEdit } from '@cleocode/contracts/project-hook-delivery.js';
+import { WriteFileAtomic } from '@cleocode/contracts/tools/atomic';
+
+/**
+ * Atomic file writes and cross-process file locking.
+ *
+ * CAAMP mutates files that are shared by *every* project on the machine — most
+ * critically `~/.agents/AGENTS.md`, which every `cleo init`, `cleo upgrade` and
+ * `cleo doctor` run rewrites regardless of which project it was invoked from.
+ * A plain `writeFile` on such a path is `open(O_TRUNC)` followed by one or more
+ * `write(2)` calls: two processes interleaving there can leave a caller reading
+ * a half-written file, and a reader racing a writer can observe a truncated
+ * one.
+ *
+ * Two primitives remove that class of failure:
+ *
+ * - `writeFileAtomic` — the canonical tmp-then-rename primitive from
+ *   `@cleocode/core/tools/fs.js`. `rename(2)` within a filesystem is atomic, so
+ *   a concurrent reader sees either the whole old file or the whole new one,
+ *   never a mixture. It is re-exported here for callers already importing this
+ *   module; the definition lives in core, per the tools-vs-skills boundary.
+ * - {@link withFileLock} — serialise a whole read-modify-write cycle across
+ *   processes via an `O_EXCL` guard file, so two writers cannot both read the
+ *   pre-state and then clobber each other's result. Generalised from the
+ *   bespoke copy that lived inline in `lock-utils.ts` (now a caller).
+ *
+ * @task T12051
+ */
+
+/** Alias the canonical primitive through its shared contract, preserving runtime identity. */
+declare const writeFileAtomic: WriteFileAtomic;
+/**
+ * Options controlling {@link withFileLock}.
+ *
+ * @public
+ */
+interface FileLockOptions {
+    /**
+     * Number of acquisition attempts before throwing.
+     *
+     * @defaultValue 400
+     */
+    retries?: number;
+    /**
+     * Delay between attempts, in milliseconds.
+     *
+     * @defaultValue 25
+     */
+    delayMs?: number;
+    /**
+     * Age at which an existing guard file is treated as abandoned and removed.
+     *
+     * @defaultValue 30000
+     */
+    staleMs?: number;
+}
+/**
+ * Run `fn` while holding an exclusive cross-process lock on `targetPath`.
+ *
+ * The lock is a `<targetPath>.lock` guard file created with `O_EXCL`, which is
+ * atomic on POSIX and on Windows. A guard left behind by a crashed process is
+ * reclaimed once it exceeds `staleMs`.
+ *
+ * The guard is always released, including when `fn` throws.
+ *
+ * @param targetPath - Path being protected (the guard is a sibling of it)
+ * @param fn - Work to perform while holding the lock
+ * @param options - Retry, delay and staleness tuning
+ * @returns Whatever `fn` returns
+ * @throws Error if the lock cannot be acquired within `retries` attempts
+ *
+ * @example
+ * ```typescript
+ * const action = await withFileLock(agentsMd, async () => {
+ *   const before = await readFile(agentsMd, "utf-8");
+ *   await writeFileAtomic(agentsMd, transform(before));
+ *   return "updated";
+ * });
+ * ```
+ *
+ * @public
+ */
+declare function withFileLock<T>(targetPath: string, fn: () => Promise<T>, options?: FileLockOptions): Promise<T>;
+/**
+ * Throw if a read looks like it landed inside another process's
+ * truncate-then-write window.
+ *
+ * `writeFileAtomic` makes *our* writes indivisible, but callers outside this
+ * package still rewrite instruction files with a plain `writeFile`, which is
+ * `open(O_TRUNC)` followed by `write(2)`. A read landing between those two
+ * returns an empty string for a file that is not empty on disk. Reconciling
+ * from that observation would replace every byte of the user's content with a
+ * lone CAAMP block.
+ *
+ * Failing closed is the right trade: the caller retries or reports, and the
+ * file is left exactly as it was.
+ *
+ * @param filePath - Path that was read, for the error message
+ * @param content - What the read returned
+ * @param sizeOnDisk - `stat().size` for the same path
+ * @throws Error when `content` is empty but `sizeOnDisk` is greater than zero
+ *
+ * @example
+ * ```typescript
+ * const text = await readFile(p, "utf-8");
+ * if (text.length === 0) assertNotTornRead(p, text, (await stat(p)).size);
+ * ```
+ *
+ * @public
+ */
+declare function assertNotTornRead(filePath: string, content: string, sizeOnDisk: number): void;
+/**
+ * A JSON config file could not be parsed, so it was left untouched.
+ *
+ * @remarks
+ * Thrown by {@link updateJsonConfigFile} instead of treating the file as empty.
+ * The pre-T12385 provider adapters caught the parse error and started from
+ * `{}`, so a torn read of `~/.claude/settings.json` (Claude Code rewriting it
+ * at the same moment) replaced the user's permissions, env, model and hooks
+ * with CLEO's entries alone.
+ *
+ * @example
+ * ```typescript
+ * try {
+ *   await updateJsonConfigFile(path, (config) => false);
+ * } catch (err) {
+ *   if (err instanceof JsonConfigParseError) console.error(err.filePath);
+ * }
+ * ```
+ *
+ * @public
+ */
+declare class JsonConfigParseError extends Error {
+    /** Path of the file that failed to parse. */
+    readonly filePath: string;
+    /**
+     * @param filePath - Path of the file that failed to parse
+     * @param reason - Parser message
+     */
+    constructor(filePath: string, reason: string);
+}
+/**
+ * Read-modify-write a JSON object file under the cross-process lock, writing
+ * atomically, and never replacing an unparseable file.
+ *
+ * @remarks
+ * Composes the two existing primitives — {@link withFileLock} and core's
+ * `writeFileAtomic` — for provider config files such as
+ * `~/.claude/settings.json` that the provider itself also rewrites (T12385):
+ *
+ * - The whole read → mutate → write cycle holds the `<file>.lock` guard, so
+ *   two CLEO writers cannot both read the pre-state and clobber each other.
+ * - The write is tmp-then-rename, so a concurrent reader (including the
+ *   provider) sees the whole old file or the whole new one.
+ * - A missing file starts from `{}`. A file that exists but is empty on read
+ *   while non-empty on disk, is not valid JSON, or is not a JSON object throws
+ *   ({@link assertNotTornRead} / {@link JsonConfigParseError}) and the file is
+ *   left byte-identical.
+ *
+ * @param filePath - JSON file to update
+ * @param mutate - Edits the parsed object in place; returns `true` when it
+ *   changed something that must be written
+ * @returns Whether the file was written
+ * @throws {@link JsonConfigParseError} when the existing file cannot be parsed
+ *   as a JSON object; the file is not modified
+ *
+ * @example
+ * ```typescript
+ * const wrote = await updateJsonConfigFile(settingsPath, (settings) => {
+ *   if (settings.enabled === true) return false;
+ *   settings.enabled = true;
+ *   return true;
+ * });
+ * ```
+ *
+ * @public
+ */
+declare function updateJsonConfigFile(filePath: string, mutate: (config: Record<string, unknown>) => boolean): Promise<boolean>;
+/** Apply surgical JSONC edits inside the existing cross-process atomic writer. */
+declare function editJsonConfigFile(filePath: string, edit: (config: HookConfigObject) => HookConfigEdit[]): Promise<boolean>;
+/** Read a bounded JSONC object without mutation, including in dry-run inspections. */
+declare function readManagedJsonConfigFile(filePath: string): Promise<HookConfigObject>;
+
+export { type FileLockOptions, JsonConfigParseError, assertNotTornRead, editJsonConfigFile, readManagedJsonConfigFile, updateJsonConfigFile, withFileLock, writeFileAtomic };

package/dist/atomic.js

@@ -0,0 +1,20 @@
+import {
+  JsonConfigParseError,
+  assertNotTornRead,
+  editJsonConfigFile,
+  readManagedJsonConfigFile,
+  updateJsonConfigFile,
+  withFileLock,
+  writeFileAtomic
+} from "./chunk-D6CWC4BX.js";
+import "./chunk-PZ5AY32C.js";
+export {
+  JsonConfigParseError,
+  assertNotTornRead,
+  editJsonConfigFile,
+  readManagedJsonConfigFile,
+  updateJsonConfigFile,
+  withFileLock,
+  writeFileAtomic
+};
+//# sourceMappingURL=atomic.js.map

package/dist/{chunk-2FQWBKEG.js → chunk-2RZGY4XT.js}

@@ -1,132 +1,24 @@
+import {
+  assertNotTornRead,
+  withFileLock
+} from "./chunk-D6CWC4BX.js";
 import {
   getAgentsHome,
   resolveProviderSkillsDir,
   resolveProvidersRegistryPath,
   resolveRegistryTemplatePath
-} from "./chunk-HDZYZTR2.js";
+} from "./chunk-5INWYMO4.js";
 
 // src/core/instructions/injector.ts
-import { existsSync as existsSync2 } from "fs";
-import { readFile as readFile3, stat as stat3 } from "fs/promises";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname4, isAbsolute, join as join2 } from "path";
-import { writeFileAtomic as writeFileAtomic2 } from "@cleocode/core/tools/fs.js";
-
-// src/core/fs/atomic.ts
 import { existsSync } from "fs";
-import { mkdir, open, readFile, rm, stat, writeFile } from "fs/promises";
-import { dirname } from "path";
+import { readFile as readFile2, stat as stat2 } from "fs/promises";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname3, isAbsolute, join as join2 } from "path";
 import { writeFileAtomic } from "@cleocode/core/tools/fs.js";
-var DEFAULT_STALE_LOCK_MS = 3e4;
-var DEFAULT_LOCK_RETRIES = 400;
-var DEFAULT_LOCK_DELAY_MS = 25;
-function sleep(ms) {
-  return new Promise((resolve3) => setTimeout(resolve3, ms));
-}
-async function removeStaleGuard(guardPath, staleMs, expectedToken) {
-  try {
-    const info = await stat(guardPath);
-    if (Date.now() - info.mtimeMs <= staleMs) return false;
-    const current = await readFile(guardPath, "utf-8").catch(() => null);
-    if (expectedToken !== null && current !== null && current !== expectedToken) return false;
-    await rm(guardPath, { force: true });
-    return true;
-  } catch {
-  }
-  return false;
-}
-async function withFileLock(targetPath, fn, options = {}) {
-  const retries = options.retries ?? DEFAULT_LOCK_RETRIES;
-  const delayMs = options.delayMs ?? DEFAULT_LOCK_DELAY_MS;
-  const staleMs = options.staleMs ?? DEFAULT_STALE_LOCK_MS;
-  const guardPath = `${targetPath}.lock`;
-  const token = `${process.pid}:${Date.now()}:${Math.random().toString(36).slice(2, 12)}`;
-  await mkdir(dirname(targetPath), { recursive: true });
-  let acquired = false;
-  for (let attempt = 0; attempt < retries && !acquired; attempt += 1) {
-    try {
-      const handle = await open(guardPath, "wx");
-      await handle.close();
-      await writeFile(guardPath, token, "utf-8");
-      acquired = true;
-    } catch (error) {
-      const code = error.code;
-      if (code !== "EEXIST") throw error;
-      const observed = await readFile(guardPath, "utf-8").catch(() => null);
-      if (await removeStaleGuard(guardPath, staleMs, observed)) continue;
-      await sleep(delayMs);
-    }
-  }
-  if (!acquired) {
-    throw new Error(
-      `Timed out acquiring lock for ${targetPath} after ${retries} attempts (~${Math.round(retries * delayMs / 1e3)}s)`
-    );
-  }
-  try {
-    return await fn();
-  } finally {
-    const current = await readFile(guardPath, "utf-8").catch(() => null);
-    if (current === null || current === token) {
-      await rm(guardPath, { force: true }).catch(() => {
-      });
-    }
-  }
-}
-function assertNotTornRead(filePath, content, sizeOnDisk) {
-  if (content.length === 0 && sizeOnDisk > 0) {
-    throw new Error(
-      `Refusing to rewrite ${filePath}: read 0 bytes but the file is ${sizeOnDisk} bytes on disk (torn read from a concurrent non-atomic writer).`
-    );
-  }
-}
-function isJsonObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-var JsonConfigParseError = class extends Error {
-  /** Path of the file that failed to parse. */
-  filePath;
-  /**
-   * @param filePath - Path of the file that failed to parse
-   * @param reason - Parser message
-   */
-  constructor(filePath, reason) {
-    super(`Refusing to rewrite ${filePath}: it is not a valid JSON object (${reason}).`);
-    this.name = "JsonConfigParseError";
-    this.filePath = filePath;
-  }
-};
-async function updateJsonConfigFile(filePath, mutate) {
-  return withFileLock(filePath, async () => {
-    let config = {};
-    if (existsSync(filePath)) {
-      const raw = await readFile(filePath, "utf-8");
-      if (raw.length === 0) assertNotTornRead(filePath, raw, (await stat(filePath)).size);
-      if (raw.trim().length > 0) {
-        let parsed;
-        try {
-          parsed = JSON.parse(raw);
-        } catch (err) {
-          throw new JsonConfigParseError(
-            filePath,
-            err instanceof Error ? err.message : String(err)
-          );
-        }
-        if (!isJsonObject(parsed)) {
-          throw new JsonConfigParseError(filePath, "top-level value is not an object");
-        }
-        config = parsed;
-      }
-    }
-    if (!mutate(config)) return false;
-    await writeFileAtomic({ path: filePath, content: `${JSON.stringify(config, null, 2)}
-` });
-    return true;
-  });
-}
 
 // src/core/registry/providers.ts
 import { readFileSync } from "fs";
-import { dirname as dirname2, join } from "path";
+import { dirname, join } from "path";
 import { fileURLToPath } from "url";
 var DEFAULT_SKILLS_CAPABILITY = {
   agentsGlobalPath: null,
@@ -205,7 +97,7 @@ function resolveCapabilities(raw) {
   return { mcp, harness, skills, hooks, spawn };
 }
 function findRegistryPath() {
-  const thisDir = dirname2(fileURLToPath(import.meta.url));
+  const thisDir = dirname(fileURLToPath(import.meta.url));
   return resolveProvidersRegistryPath(thisDir);
 }
 var _registry = null;
@@ -635,18 +527,18 @@ ${content}
 ${CAAMP_MARKER_END}`;
 }
 function assertBalancedMarkers(content) {
-  let open2 = false;
+  let open = false;
   const markers = new RegExp(`${CAAMP_MARKER_START}|${CAAMP_MARKER_END}`, "g");
   for (const match of content.matchAll(markers)) {
     const opening = match[0] === CAAMP_MARKER_START;
-    if (opening === open2) {
+    if (opening === open) {
       throw new Error(
         "Ambiguous CAAMP markers: nested or unmatched delimiter; original content preserved."
       );
     }
-    open2 = opening;
+    open = opening;
   }
-  if (open2)
+  if (open)
     throw new Error(
       "Ambiguous CAAMP markers: opening delimiter has no end; original content preserved."
     );
@@ -711,9 +603,9 @@ function repairContent(existing) {
 
 // src/core/instructions/templates.ts
 import { createHash } from "crypto";
-import { readFile as readFile2, realpath, stat as stat2 } from "fs/promises";
+import { readFile, realpath, stat } from "fs/promises";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname3, resolve as resolve2 } from "path";
+import { dirname as dirname2, resolve as resolve2 } from "path";
 function buildInjectionContent(template) {
   const lines = [];
   for (const ref of template.references) {
@@ -806,7 +698,7 @@ async function resolveInstructionDelivery(content, baseDir) {
         let sourcePath = stamp[1];
         try {
           sourcePath = decodeURIComponent(sourcePath);
-          const sourceSize = (await stat2(sourcePath)).size;
+          const sourceSize = (await stat(sourcePath)).size;
           bytes += sourceSize;
           if (bytes > 524288) {
             result.findings.push({
@@ -815,7 +707,7 @@ async function resolveInstructionDelivery(content, baseDir) {
               reason: "Instruction byte budget exceeded."
             });
           } else {
-            const digest = createHash("sha256").update(await readFile2(sourcePath)).digest("hex");
+            const digest = createHash("sha256").update(await readFile(sourcePath)).digest("hex");
             if (digest !== stamp[2])
               result.findings.push({
                 kind: "stale",
@@ -862,7 +754,7 @@ async function resolveInstructionDelivery(content, baseDir) {
         continue;
       }
       try {
-        bytes += (await stat2(path)).size;
+        bytes += (await stat(path)).size;
         if (bytes > 524288) {
           result.findings.push({
             kind: "limit",
@@ -871,13 +763,13 @@ async function resolveInstructionDelivery(content, baseDir) {
           });
           continue;
         }
-        const source = await readFile2(path, "utf8");
+        const source = await readFile(path, "utf8");
         visited.add(path);
         result.sources.push(path);
         lines.push(
           `<!-- CAAMP:SOURCE ${encodeURIComponent(path)} ${createHash("sha256").update(source).digest("hex")} -->`
         );
-        lines.push(await expand(source, dirname3(path), [...ancestors, path]));
+        lines.push(await expand(source, dirname2(path), [...ancestors, path]));
       } catch (error) {
         result.findings.push({ kind: "missing-reference", path, reason: String(error) });
       }
@@ -893,17 +785,17 @@ function parseCaampBlocks(fileContent) {
   return parseBlocks(fileContent);
 }
 async function dedupeFile(filePath) {
-  if (!existsSync2(filePath)) {
+  if (!existsSync(filePath)) {
     return { filePath, removed: 0, kept: 0, modified: false, repaired: 0 };
   }
   return withFileLock(filePath, async () => {
-    const original = await readFile3(filePath, "utf-8");
+    const original = await readFile2(filePath, "utf-8");
     const { content: healed, repaired } = normalizeMarkers(original);
     assertBalancedMarkers(healed);
     const blocks = parseBlocks(healed);
     if (blocks.length === 0) {
       if (repaired > 0 && healed !== original) {
-        await writeFileAtomic2({ path: filePath, content: healed });
+        await writeFileAtomic({ path: filePath, content: healed });
         return { filePath, removed: 0, kept: 0, modified: true, repaired };
       }
       return { filePath, removed: 0, kept: 0, modified: false, repaired };
@@ -930,7 +822,7 @@ async function dedupeFile(filePath) {
     if (result === original) {
       return { filePath, removed: 0, kept: blocks.length, modified: false, repaired };
     }
-    await writeFileAtomic2({ path: filePath, content: result });
+    await writeFileAtomic({ path: filePath, content: result });
     return { filePath, removed, kept: keepSet.size, modified: true, repaired };
   });
 }
@@ -962,12 +854,12 @@ function scopedInstructionPath(provider, projectDir, scope) {
   return scope === "global" ? resolveGlobalInstructionPath(provider) : join2(projectDir, provider.instructFile);
 }
 async function repairInstructionFiles(projectDir, providers) {
-  const paths = instructionFileCascade(projectDir, providers).filter((p) => existsSync2(p));
+  const paths = instructionFileCascade(projectDir, providers).filter((p) => existsSync(p));
   const files = [];
   for (const filePath of paths) {
     files.push(
       await withFileLock(filePath, async () => {
-        const original = await readFile3(filePath, "utf-8");
+        const original = await readFile2(filePath, "utf-8");
         const { content, blocksBefore, repaired } = repairContent(original);
         const removed = Math.max(0, blocksBefore - 1);
         if (removed === 0 && repaired === 0) {
@@ -976,7 +868,7 @@ async function repairInstructionFiles(projectDir, providers) {
         if (content === original) {
           return { filePath, removed: 0, kept: blocksBefore, modified: false, repaired };
         }
-        await writeFileAtomic2({ path: filePath, content });
+        await writeFileAtomic({ path: filePath, content });
         return {
           filePath,
           removed,
@@ -995,8 +887,8 @@ async function repairInstructionFiles(projectDir, providers) {
   };
 }
 async function checkInjection(filePath, expectedContent) {
-  if (!existsSync2(filePath)) return "missing";
-  const raw = await readFile3(filePath, "utf-8");
+  if (!existsSync(filePath)) return "missing";
+  const raw = await readFile2(filePath, "utf-8");
   const { content, repaired } = normalizeMarkers(raw);
   const blocks = parseBlocks(content);
   if (blocks.length === 0) return "none";
@@ -1010,18 +902,18 @@ async function inject(filePath, content) {
   const body = content.trim();
   assertBalancedMarkers(buildBlock(body));
   return withFileLock(filePath, async () => {
-    if (!existsSync2(filePath)) {
-      await writeFileAtomic2({ path: filePath, content: `${buildBlock(body)}
+    if (!existsSync(filePath)) {
+      await writeFileAtomic({ path: filePath, content: `${buildBlock(body)}
 ` });
       return "created";
     }
-    const existing = await readFile3(filePath, "utf-8");
+    const existing = await readFile2(filePath, "utf-8");
     if (existing.length === 0) {
-      assertNotTornRead(filePath, existing, (await stat3(filePath)).size);
+      assertNotTornRead(filePath, existing, (await stat2(filePath)).size);
     }
     const { content: next, blocksBefore, repaired } = reconcile(existing, body);
     if (next === existing) return "intact";
-    await writeFileAtomic2({ path: filePath, content: next });
+    await writeFileAtomic({ path: filePath, content: next });
     if (blocksBefore === 0) return "added";
     if (repaired > 0) return "repaired";
     if (blocksBefore > 1) return "consolidated";
@@ -1029,18 +921,18 @@ async function inject(filePath, content) {
   });
 }
 async function removeInjection(filePath) {
-  if (!existsSync2(filePath)) return false;
+  if (!existsSync(filePath)) return false;
   return withFileLock(filePath, async () => {
-    const original = await readFile3(filePath, "utf-8");
+    const original = await readFile2(filePath, "utf-8");
     const { content } = normalizeMarkers(original);
     assertBalancedMarkers(content);
     if (parseBlocks(content).length === 0) return false;
     const cleaned = content.replace(blockPattern(), "");
     if (!cleaned) {
-      const { rm: rm2 } = await import("fs/promises");
-      await rm2(filePath);
+      const { rm } = await import("fs/promises");
+      await rm(filePath);
     } else {
-      await writeFileAtomic2({ path: filePath, content: cleaned });
+      await writeFileAtomic({ path: filePath, content: cleaned });
     }
     return true;
   });
@@ -1054,7 +946,7 @@ async function checkAllInjections(providers, projectDir, scope, expectedContent)
     if (checked.has(filePath)) continue;
     checked.add(filePath);
     let status = await checkInjection(filePath, expectedContent);
-    const delivery = await resolveInstructionDelivery(`@${filePath}`, dirname4(filePath));
+    const delivery = await resolveInstructionDelivery(`@${filePath}`, dirname3(filePath));
     if (expectedContent !== void 0 && status === "outdated") {
       delivery.findings.push({
         kind: "stale",
@@ -1062,7 +954,7 @@ async function checkAllInjections(providers, projectDir, scope, expectedContent)
         reason: "Managed content differs from the expected version."
       });
     }
-    if (existsSync2(filePath) && parseBlocks(await readFile3(filePath, "utf8")).length > 1) {
+    if (existsSync(filePath) && parseBlocks(await readFile2(filePath, "utf8")).length > 1) {
       delivery.findings.push({
         kind: "duplicate",
         path: filePath,
@@ -1076,7 +968,7 @@ async function checkAllInjections(providers, projectDir, scope, expectedContent)
       file: filePath,
       provider: provider.id,
       status,
-      fileExists: existsSync2(filePath)
+      fileExists: existsSync(filePath)
     });
   }
   return results;
@@ -1124,7 +1016,7 @@ async function ensureProviderInstructionFile(providerId, projectDir, options) {
     throw new HomeInstructionFileError(filePath);
   let references = options.references ?? getProviderInstructionReferences(providerId);
   let content = options.content;
-  if (options.delivery !== "verified-references" && references.includes("@.cleo/memory-bridge.md") && !existsSync2(join2(dirname4(filePath), ".cleo", "memory-bridge.md"))) {
+  if (options.delivery !== "verified-references" && references.includes("@.cleo/memory-bridge.md") && !existsSync(join2(dirname3(filePath), ".cleo", "memory-bridge.md"))) {
     references = references.filter((reference) => reference !== "@.cleo/memory-bridge.md");
     content = [
       ...content ?? [],
@@ -1137,7 +1029,7 @@ async function ensureProviderInstructionFile(providerId, projectDir, options) {
   };
   let injectionContent = buildInjectionContent(template);
   if (options.delivery !== "verified-references") {
-    const delivery = await resolveInstructionDelivery(injectionContent, dirname4(filePath));
+    const delivery = await resolveInstructionDelivery(injectionContent, dirname3(filePath));
     const failures = delivery.findings.filter((finding) => finding.kind !== "duplicate");
     if (failures.length > 0) {
       throw new Error(
@@ -1165,7 +1057,7 @@ async function ensureProviderRuleFile(providerId, projectDir, options) {
     throw new Error(`Unknown provider: "${providerId}". Check CAAMP provider registry.`);
   }
   const filePath = join2(projectDir, options.relativePath);
-  if (options.onlyIfExists === true && !existsSync2(filePath)) return null;
+  if (options.onlyIfExists === true && !existsSync(filePath)) return null;
   const references = options.references ?? getProviderInstructionReferences(providerId);
   const body = buildInjectionContent({ references }).trim();
   const block = buildBlock(body);
@@ -1179,26 +1071,26 @@ ${block}
       action,
       providerId: provider.id
     });
-    if (!existsSync2(filePath)) {
+    if (!existsSync(filePath)) {
       if (options.onlyIfExists === true) return null;
-      await writeFileAtomic2({ path: filePath, content: owned ?? `${block}
+      await writeFileAtomic({ path: filePath, content: owned ?? `${block}
 ` });
       return result("created");
     }
-    const existing = await readFile3(filePath, "utf-8");
+    const existing = await readFile2(filePath, "utf-8");
     if (existing.length === 0) {
-      assertNotTornRead(filePath, existing, (await stat3(filePath)).size);
+      assertNotTornRead(filePath, existing, (await stat2(filePath)).size);
     }
     if (owned !== null) {
       if (existing === owned) return result("intact");
-      await writeFileAtomic2({ path: filePath, content: owned });
+      await writeFileAtomic({ path: filePath, content: owned });
       return result("updated");
     }
     const hasBlock = parseBlocks(normalizeMarkers(existing).content).length > 0;
     const base = hasBlock ? existing : stripBareReferenceLines(existing, references).trimEnd();
     const { content: next, blocksBefore, repaired } = reconcile(base, body, "append");
     if (next === existing) return result("intact");
-    await writeFileAtomic2({ path: filePath, content: next });
+    await writeFileAtomic({ path: filePath, content: next });
     if (blocksBefore === 0) return result("added");
     if (repaired > 0) return result("repaired");
     if (blocksBefore > 1) return result("consolidated");
@@ -1277,7 +1169,7 @@ async function writeAgentFileToAllProviders(providerIds, options) {
       continue;
     }
     processed.add(filePath);
-    if (options.skipMissingFolders === true && !existsSync2(folder)) {
+    if (options.skipMissingFolders === true && !existsSync(folder)) {
       continue;
     }
     const action = await inject(filePath, options.content);
@@ -1287,10 +1179,6 @@ async function writeAgentFileToAllProviders(providerIds, options) {
 }
 
 export {
-  withFileLock,
-  assertNotTornRead,
-  JsonConfigParseError,
-  updateJsonConfigFile,
   getAllProviders,
   getProvider,
   resolveAlias,
@@ -1350,4 +1238,4 @@ export {
   getProviderAgentFolder,
   writeAgentFileToAllProviders
 };
-//# sourceMappingURL=chunk-2FQWBKEG.js.map
+//# sourceMappingURL=chunk-2RZGY4XT.js.map