@enterpriseai/cli 3.19.0 → 3.19.2

package/resources/gofer/node-scripts/workspace-bootstrap-lib.mjs

@@ -1,16 +1,22 @@
 #!/usr/bin/env node
 
 import { promises as fs } from 'fs';
+import { randomUUID } from 'crypto';
 import path from 'path';
 import { fileURLToPath } from 'url';
+import { SUPPORTED_HOSTS } from './gofer-surface-update.mjs';
 import { parseStageCommand } from './parse-stage-command.mjs';
 
 export const GOFER_VERSION_FILE = path.join('.specify', '.gofer-version');
 export const CORE_SENTINELS = [
   GOFER_VERSION_FILE,
   path.join('.specify', 'commands', '0_gofer_start.md'),
+  path.join('.specify', 'config', 'object-type-routing.json'),
+  path.join('.specify', 'config', 'typesafe-semantic-review.json'),
   path.join('.specify', 'templates', 'spec-template.md'),
+  path.join('.specify', 'templates', 'build-map-template.md'),
   path.join('.specify', 'templates', 'loop-contract-template.json'),
+  path.join('.specify', 'templates', 'business-scenarios-template.json'),
   path.join('.specify', 'templates', 'working-backwards-prfaq-template.md'),
   path.join('.specify', 'templates', 'business-owner-summary-template.md'),
   path.join('.specify', 'templates', 'cto-architecture-summary-template.md'),
@@ -21,7 +27,11 @@ export const CORE_SENTINELS = [
   path.join('.specify', 'templates', 'brand', 'marp-theme-template.css'),
   path.join('.specify', 'scripts', 'bash', 'create-new-feature.sh'),
   path.join('.specify', 'scripts', 'node', 'parse-stage-command.mjs'),
+  path.join('.specify', 'scripts', 'node', 'gofer-local-settings-cleanup.mjs'),
   path.join('.specify', 'scripts', 'node', 'gofer-loop-audit.mjs'),
+  path.join('.specify', 'scripts', 'node', 'gofer-typesafe-credentials.mjs'),
+  path.join('.specify', 'scripts', 'node', 'gofer-semantic-drift.mjs'),
+  path.join('.specify', 'scripts', 'node', 'gofer-ui-preview.mjs'),
   path.join('.specify', 'scripts', 'hooks', 'post-tool-use.mjs'),
   path.join('.specify', 'scripts', 'powershell', 'install-optional-tools.ps1'),
   path.join('.specify', 'references', 'platform', 'README.md'),
@@ -42,8 +52,11 @@ const LEGACY_MANAGED_PATHS = [
   path.join('.gemini', 'commands', 'gofer', '0_business_scenario.md'),
   path.join('.gemini', 'commands', 'gofer', '0_business_scenario.toml'),
 ];
+const RETIRED_PUBLIC_ENTRYPOINT_STEMS = ['gofer'];
 const LEGACY_MANAGED_ARCHIVE_ROOT = path.join('.specify', 'logs', 'legacy-command-backups');
 
+export const WORKSPACE_HOSTS = SUPPORTED_HOSTS;
+
 export const HOST_POLICIES = {
   auto: { required: [] },
   claude: {
@@ -55,11 +68,21 @@ export const HOST_POLICIES = {
   copilot: {
     required: [path.join('.github', 'copilot-instructions.md')],
   },
-  gemini: {
-    required: [],
+  antigravity: {
+    required: ['AGENTS.md', 'GEMINI.md'],
+  },
+  grok: {
+    required: ['AGENTS.md'],
+  },
+  vscode: {
+    required: [path.join('.github', 'copilot-instructions.md')],
   },
 };
 
+const LEGACY_HOST_ALIASES = {
+  gemini: 'antigravity',
+};
+
 const WORKSPACE_MARKERS = [
   '.git',
   'package.json',
@@ -77,7 +100,9 @@ const EAI_RUNTIME_CONTRACT_MARKER = 'eai.runtime.json';
 
 const EXTENSION_RESOURCE_PATHS = new Map([
   [path.join('.specify', 'commands'), path.join('resources', 'specify-commands')],
+  [path.join('.specify', 'config'), path.join('resources', 'specify-config')],
   [path.join('.specify', 'references'), path.join('resources', 'references')],
+  [path.join('.specify', 'schemas'), path.join('resources', 'schemas')],
   [path.join('.specify', 'templates'), path.join('resources', 'templates')],
   [path.join('.specify', 'scripts', 'bash'), path.join('resources', 'bash-scripts')],
   [path.join('.specify', 'scripts', 'node'), path.join('resources', 'node-scripts')],
@@ -94,6 +119,7 @@ const EXTENSION_RESOURCE_PATHS = new Map([
   [path.join('.github', 'instructions'), path.join('resources', 'copilot-instructions')],
   [path.join('.github', 'skills'), path.join('resources', 'github-skills')],
   [path.join('.gemini'), path.join('resources', 'gemini')],
+  [path.join('.grok', 'skills'), path.join('resources', 'grok-skills')],
   [path.join('.agents', 'skills'), 'skills'],
   [path.join('.system', 'skills'), 'skills'],
 ]);
@@ -108,6 +134,7 @@ const GOFER_GITIGNORE_ENTRIES = [
   '.specify/memory/context-health-state.json',
   '.specify/memory/observation-cache/',
   '.specify/specs/*/research-index.json',
+  '.specify/secrets/',
 ];
 
 const CLAUDE_HOOKS_CONFIG = {
@@ -160,8 +187,19 @@ function createEmptyProjectInfo(workspaceRoot) {
 }
 
 export function normalizeHost(host = 'auto') {
-  const normalized = String(host || 'auto').trim().toLowerCase();
-  return Object.prototype.hasOwnProperty.call(HOST_POLICIES, normalized) ? normalized : 'auto';
+  const normalized = host == null ? 'auto' : String(host).trim().toLowerCase();
+  if (normalized === '' || normalized === 'auto') {
+    return 'auto';
+  }
+  if (Object.prototype.hasOwnProperty.call(LEGACY_HOST_ALIASES, normalized)) {
+    return LEGACY_HOST_ALIASES[normalized];
+  }
+  if (Object.prototype.hasOwnProperty.call(HOST_POLICIES, normalized)) {
+    return normalized;
+  }
+  throw new Error(
+    `Unsupported Gofer host. Expected auto or one of: ${WORKSPACE_HOSTS.join(', ')}.`
+  );
 }
 
 export function scriptRootFromUrl(scriptUrl) {
@@ -185,46 +223,392 @@ export async function pathExists(targetPath) {
   }
 }
 
-function buildArchiveStamp() {
-  return `${new Date().toISOString().replace(/[:.]/g, '-')}-${process.pid}`;
+async function lstatIfExists(targetPath) {
+  try {
+    return await fs.lstat(targetPath);
+  } catch (error) {
+    if (error?.code === 'ENOENT') {
+      return null;
+    }
+    throw error;
+  }
+}
+
+function resolveConfinedWorkspacePath(workspaceRoot, relativePath) {
+  const resolvedRoot = path.resolve(workspaceRoot);
+  if (path.isAbsolute(relativePath)) {
+    throw new Error('Unsafe Gofer workspace path: absolute managed paths are not allowed.');
+  }
+
+  const targetPath = path.resolve(resolvedRoot, relativePath);
+  const relativeTarget = path.relative(resolvedRoot, targetPath);
+  if (
+    relativeTarget === '..' ||
+    relativeTarget.startsWith(`..${path.sep}`) ||
+    path.isAbsolute(relativeTarget)
+  ) {
+    throw new Error('Unsafe Gofer workspace path: managed paths must stay inside the workspace.');
+  }
+
+  return { resolvedRoot, targetPath, relativeTarget };
+}
+
+async function assertSafeWorkspaceRoot(workspaceRoot) {
+  const resolvedRoot = path.resolve(workspaceRoot);
+  const rootStat = await lstatIfExists(resolvedRoot);
+  if (!rootStat) {
+    throw new Error('Unsafe Gofer workspace path: the workspace root does not exist.');
+  }
+  if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) {
+    throw new Error(
+      'Unsafe Gofer workspace path: the workspace root must be a real directory, not a symbolic link.'
+    );
+  }
+  return resolvedRoot;
+}
+
+async function inspectWorkspacePath(
+  workspaceRoot,
+  relativePath,
+  { leafType = 'any', allowMissing = true } = {}
+) {
+  const { resolvedRoot, targetPath, relativeTarget } = resolveConfinedWorkspacePath(
+    workspaceRoot,
+    relativePath
+  );
+  await assertSafeWorkspaceRoot(resolvedRoot);
+
+  if (relativeTarget === '') {
+    return {
+      exists: true,
+      path: resolvedRoot,
+      stat: await fs.lstat(resolvedRoot),
+      relativeTarget,
+    };
+  }
+
+  const components = relativeTarget.split(path.sep).filter(Boolean);
+  let currentPath = resolvedRoot;
+  let leafStat = null;
+  for (let index = 0; index < components.length; index += 1) {
+    currentPath = path.join(currentPath, components[index]);
+    const currentStat = await lstatIfExists(currentPath);
+    if (!currentStat) {
+      if (!allowMissing) {
+        throw new Error('Unsafe Gofer workspace path: a required managed path is missing.');
+      }
+      return { exists: false, path: targetPath, stat: null, relativeTarget };
+    }
+    if (currentStat.isSymbolicLink()) {
+      throw new Error(
+        'Unsafe Gofer workspace path: symbolic links are not allowed in managed paths.'
+      );
+    }
+
+    const isLeaf = index === components.length - 1;
+    if (isLeaf) {
+      leafStat = currentStat;
+    }
+    if (!isLeaf && !currentStat.isDirectory()) {
+      throw new Error(
+        'Unsafe Gofer workspace path: every managed parent component must be a directory.'
+      );
+    }
+    if (isLeaf && leafType === 'directory' && !currentStat.isDirectory()) {
+      throw new Error('Unsafe Gofer workspace path: the managed path must be a directory.');
+    }
+    if (isLeaf && leafType === 'file' && !currentStat.isFile()) {
+      throw new Error('Unsafe Gofer workspace path: the managed path must be a regular file.');
+    }
+    if (
+      isLeaf &&
+      leafType === 'any' &&
+      !currentStat.isDirectory() &&
+      !currentStat.isFile()
+    ) {
+      throw new Error(
+        'Unsafe Gofer workspace path: managed paths must be regular files or directories.'
+      );
+    }
+  }
+
+  return {
+    exists: true,
+    path: targetPath,
+    stat: leafStat,
+    relativeTarget,
+  };
+}
+
+async function ensureSafeWorkspaceDirectory(workspaceRoot, relativePath, dryRun) {
+  const { resolvedRoot, targetPath, relativeTarget } = resolveConfinedWorkspacePath(
+    workspaceRoot,
+    relativePath
+  );
+  await assertSafeWorkspaceRoot(resolvedRoot);
+  if (relativeTarget === '') {
+    return targetPath;
+  }
+
+  const components = relativeTarget.split(path.sep).filter(Boolean);
+  let currentPath = resolvedRoot;
+  for (const component of components) {
+    currentPath = path.join(currentPath, component);
+    let currentStat = await lstatIfExists(currentPath);
+    if (!currentStat) {
+      if (dryRun) {
+        return targetPath;
+      }
+      try {
+        await fs.mkdir(currentPath);
+      } catch (error) {
+        if (error?.code !== 'EEXIST') {
+          throw error;
+        }
+      }
+      currentStat = await lstatIfExists(currentPath);
+    }
+    if (!currentStat || currentStat.isSymbolicLink() || !currentStat.isDirectory()) {
+      throw new Error(
+        'Unsafe Gofer workspace path: every managed directory component must be a real directory; symbolic links are not allowed.'
+      );
+    }
+  }
+
+  return targetPath;
+}
+
+function directoryIdentityMatches(left, right) {
+  return (
+    left.dev === right.dev &&
+    left.ino === right.ino &&
+    left.isDirectory() &&
+    right.isDirectory()
+  );
 }
 
-async function movePathPreservingAcrossDevices(sourcePath, targetPath) {
-  await fs.mkdir(path.dirname(targetPath), { recursive: true });
+async function openValidatedDirectory(directoryPath) {
+  const initialStat = await fs.lstat(directoryPath);
+  let handle = null;
   try {
-    await fs.rename(sourcePath, targetPath);
+    handle = await fs.open(directoryPath, 'r');
   } catch (error) {
-    if (error?.code !== 'EXDEV') {
+    if (
+      process.platform !== 'win32' ||
+      !['EACCES', 'EISDIR', 'EPERM'].includes(String(error?.code))
+    ) {
       throw error;
     }
+  }
+  const validation = { handle, initialStat };
+  await assertDirectoryMatchesPath(validation, directoryPath);
+  return validation;
+}
 
-    await fs.cp(sourcePath, targetPath, {
-      recursive: true,
-      force: true,
-      dereference: false,
+async function assertDirectoryMatchesPath(validation, directoryPath) {
+  const [openedStat, pathStat] = await Promise.all([
+    validation.handle ? validation.handle.stat() : validation.initialStat,
+    fs.lstat(directoryPath),
+  ]);
+  if (pathStat.isSymbolicLink() || !directoryIdentityMatches(openedStat, pathStat)) {
+    throw new Error(
+      'Unsafe Gofer workspace path: a managed parent directory changed during validation.'
+    );
+  }
+}
+
+async function writeWorkspaceFile(workspaceRoot, relativePath, content, dryRun, mode = null) {
+  const target = await inspectWorkspacePath(workspaceRoot, relativePath, {
+    leafType: 'file',
+    allowMissing: true,
+  });
+  if (dryRun) {
+    return;
+  }
+
+  const parentRelativePath = path.dirname(target.relativeTarget);
+  const normalizedParent = parentRelativePath === '.' ? '' : parentRelativePath;
+  const parentPath = await ensureSafeWorkspaceDirectory(
+    workspaceRoot,
+    normalizedParent,
+    false
+  );
+  const existingMode = target.exists ? target.stat.mode & 0o777 : 0o666;
+  const temporaryName = `.gofer-write-${process.pid}-${randomUUID()}.tmp`;
+  const temporaryRelativePath = path.join(normalizedParent, temporaryName);
+  const temporaryPath = path.join(parentPath, temporaryName);
+  let temporaryHandle;
+  let parentValidation;
+
+  try {
+    parentValidation = await openValidatedDirectory(parentPath);
+    await inspectWorkspacePath(workspaceRoot, temporaryRelativePath, {
+      leafType: 'file',
+      allowMissing: true,
     });
-    await fs.rm(sourcePath, { recursive: true, force: true });
+    temporaryHandle = await fs.open(temporaryPath, 'wx', mode ?? existingMode);
+    await temporaryHandle.writeFile(content);
+    await temporaryHandle.sync();
+    await temporaryHandle.close();
+    temporaryHandle = null;
+
+    await inspectWorkspacePath(workspaceRoot, normalizedParent, {
+      leafType: 'directory',
+      allowMissing: false,
+    });
+    await assertDirectoryMatchesPath(parentValidation, parentPath);
+    await inspectWorkspacePath(workspaceRoot, relativePath, {
+      leafType: 'file',
+      allowMissing: true,
+    });
+    await fs.rename(temporaryPath, target.path);
+    await assertDirectoryMatchesPath(parentValidation, parentPath);
+    await inspectWorkspacePath(workspaceRoot, relativePath, {
+      leafType: 'file',
+      allowMissing: false,
+    });
+  } finally {
+    if (temporaryHandle) {
+      await temporaryHandle.close().catch(() => {});
+    }
+    if (parentValidation) {
+      try {
+        await assertDirectoryMatchesPath(parentValidation, parentPath);
+        await fs.rm(temporaryPath, { force: true });
+      } catch {
+        // If the parent identity changed, do not risk deleting through its replacement.
+      }
+    }
+    if (parentValidation?.handle) {
+      await parentValidation.handle.close().catch(() => {});
+    }
   }
 }
 
+function buildArchiveStamp() {
+  return `${new Date().toISOString().replace(/[:.]/g, '-')}-${process.pid}`;
+}
+
 async function archiveLegacyManagedPath(workspaceRoot, relativePath, archiveStamp, dryRun) {
   const archiveRelativePath = path.join(LEGACY_MANAGED_ARCHIVE_ROOT, archiveStamp, relativePath);
+  const source = await inspectWorkspacePath(workspaceRoot, relativePath, {
+    leafType: 'any',
+    allowMissing: false,
+  });
+  const archiveTarget = await inspectWorkspacePath(workspaceRoot, archiveRelativePath, {
+    leafType: 'any',
+    allowMissing: true,
+  });
+  if (archiveTarget.exists) {
+    throw new Error('Unsafe Gofer archive path: the managed archive target already exists.');
+  }
+
   if (!dryRun) {
-    await movePathPreservingAcrossDevices(
-      path.join(workspaceRoot, relativePath),
-      path.join(workspaceRoot, archiveRelativePath)
+    const archiveParent = path.dirname(archiveRelativePath);
+    const archiveParentPath = await ensureSafeWorkspaceDirectory(
+      workspaceRoot,
+      archiveParent,
+      false
     );
+    const sourceParentPath = resolveConfinedWorkspacePath(
+      workspaceRoot,
+      path.dirname(relativePath)
+    ).targetPath;
+    const sourceParentValidation = await openValidatedDirectory(sourceParentPath);
+    const archiveParentValidation = await openValidatedDirectory(archiveParentPath);
+    try {
+      await assertDirectoryMatchesPath(sourceParentValidation, sourceParentPath);
+      await assertDirectoryMatchesPath(archiveParentValidation, archiveParentPath);
+      const currentSource = await inspectWorkspacePath(workspaceRoot, relativePath, {
+        leafType: 'any',
+        allowMissing: false,
+      });
+      if (
+        currentSource.stat.dev !== source.stat.dev ||
+        currentSource.stat.ino !== source.stat.ino ||
+        currentSource.stat.isDirectory() !== source.stat.isDirectory() ||
+        currentSource.stat.isFile() !== source.stat.isFile()
+      ) {
+        throw new Error(
+          'Unsafe Gofer archive path: the legacy path changed during validation.'
+        );
+      }
+      const currentArchiveTarget = await inspectWorkspacePath(
+        workspaceRoot,
+        archiveRelativePath,
+        { leafType: 'any', allowMissing: true }
+      );
+      if (currentArchiveTarget.exists) {
+        throw new Error('Unsafe Gofer archive path: the managed archive target already exists.');
+      }
+      await fs.rename(source.path, archiveTarget.path);
+      await assertDirectoryMatchesPath(sourceParentValidation, sourceParentPath);
+      await assertDirectoryMatchesPath(archiveParentValidation, archiveParentPath);
+    } catch (error) {
+      if (error?.code === 'EXDEV') {
+        throw new Error(
+          'Unsafe Gofer archive path: cross-device legacy archives are not supported.'
+        );
+      }
+      throw error;
+    } finally {
+      if (sourceParentValidation.handle) {
+        await sourceParentValidation.handle.close().catch(() => {});
+      }
+      if (archiveParentValidation.handle) {
+        await archiveParentValidation.handle.close().catch(() => {});
+      }
+    }
+    const archived = await inspectWorkspacePath(workspaceRoot, archiveRelativePath, {
+      leafType: 'any',
+      allowMissing: false,
+    });
+    if (
+      archived.stat.dev !== source.stat.dev ||
+      archived.stat.ino !== source.stat.ino ||
+      archived.stat.isDirectory() !== source.stat.isDirectory() ||
+      archived.stat.isFile() !== source.stat.isFile()
+    ) {
+      throw new Error('Unsafe Gofer archive path: the archived path failed identity validation.');
+    }
   }
 
   return archiveRelativePath;
 }
 
-async function removeLegacyManagedPaths(workspaceRoot, dryRun) {
+function buildVisibleSurfacePathsForStem(stem) {
+  return [
+    path.join('.claude', 'commands', `${stem}.md`),
+    path.join('.github', 'prompts', `${stem}.prompt.md`),
+    path.join('.agents', 'skills', stem),
+    path.join('.system', 'skills', stem),
+    path.join('.gemini', 'commands', 'gofer', `${stem}.md`),
+    path.join('.gemini', 'commands', 'gofer', `${stem}.toml`),
+  ];
+}
+
+function buildStaleVisibleManagedPaths(stages) {
+  const staleStems = new Set(RETIRED_PUBLIC_ENTRYPOINT_STEMS);
+  for (const stage of stages) {
+    staleStems.add(String(stage.stem));
+  }
+
+  return Array.from(staleStems).flatMap((stem) => buildVisibleSurfacePathsForStem(stem));
+}
+
+async function removeLegacyManagedPaths(workspaceRoot, dryRun, stages = []) {
   const archived = [];
   const archiveStamp = buildArchiveStamp();
-  for (const relativePath of LEGACY_MANAGED_PATHS) {
-    const targetPath = path.join(workspaceRoot, relativePath);
-    if (!(await pathExists(targetPath))) {
+  const legacyPaths = Array.from(
+    new Set([...LEGACY_MANAGED_PATHS, ...buildStaleVisibleManagedPaths(stages)])
+  );
+
+  for (const relativePath of legacyPaths) {
+    const target = await inspectWorkspacePath(workspaceRoot, relativePath, {
+      leafType: 'any',
+      allowMissing: true,
+    });
+    if (!target.exists) {
       continue;
     }
 
@@ -244,9 +628,13 @@ async function resolveSourcePath(sourceRoot, relativePath) {
 
   const resourceRelativePath = EXTENSION_RESOURCE_PATHS.get(path.normalize(relativePath));
   if (resourceRelativePath) {
-    const resourcePath = path.join(sourceRoot, resourceRelativePath);
-    if (await pathExists(resourcePath)) {
-      return resourcePath;
+    for (const resourcePath of [
+      path.join(sourceRoot, resourceRelativePath),
+      path.join(sourceRoot, 'extension', resourceRelativePath),
+    ]) {
+      if (await pathExists(resourcePath)) {
+        return resourcePath;
+      }
     }
   }
 
@@ -546,25 +934,56 @@ function buildEaiRepoContractSection(projectInfo) {
   if (!projectInfo.eaiInitialized) {
     return `## EAI Platform Readiness
 
-- This repo is not confirmed as EAI-initialized yet. Before any Gofer pipeline work, run \`eai whoami\`.
-- If \`eai\` is missing, login fails, the token is expired, or no active workspace is visible, run \`/gofer:eai-first-run\` before building.
-- Build on EAI Platform first and Azure second. Treat non-EAI runtimes as explicit exceptions only.
+- Classify the request before EAI readiness. If it is EAI app delivery or ambiguous, continue directly to EAI readiness. If it is clearly non-app work, confirm once before skipping EAI workspace/app setup.
+- This repo is not confirmed as EAI-initialized yet. Run \`eai whoami\` only for EAI app delivery work or explicit EAI CLI recovery.
+- If \`eai\` is missing, login fails, the token is expired, or no active workspace is visible during app delivery, use the public \`eai\` entrypoint and the internal \`.specify/commands/gofer_eai_first_run.md\` setup contract before building.
+- Do not invent, guess, or complete EAI CLI commands from memory. Verify exact \`eai ...\` syntax and flags with \`eai --describe\` and command-specific \`--help\` before suggesting or running them.
+- Build on EAI Platform first and Azure second for app delivery. Treat non-EAI runtimes as explicit exceptions only.
 - Do not write tokens, secrets, private workspace IDs, Entra/CIAM authority tenant IDs, or local \`.env\` values into Gofer artifacts.`;
   }
 
   return `## EAI Repo Contract
 
 - This repo appears to be initialized from the EAI app template. Before app-delivery work, read \`.specify/references/platform/eai-repo-contract.md\` and \`.specify/references/platform/eai-error-catalog.yaml\`.
-- Before any Gofer pipeline work, run \`eai whoami\`. If \`eai\` is missing, login fails, the token is expired, or no active workspace is visible, run \`/gofer:eai-first-run\` before building.
-- If CLI, login, workspace, template, or Gofer readiness is missing or stale, run \`/gofer:eai-first-run\` before building.
+- Classify the request before EAI readiness. If it is EAI app delivery or ambiguous, continue directly to EAI readiness. If it is clearly non-app work, confirm once before skipping EAI workspace/app setup.
+- Run \`eai whoami\` only for EAI app delivery work or explicit EAI CLI recovery. If \`eai\` is missing, login fails, the token is expired, or no active workspace is visible during app delivery, use the public \`eai\` entrypoint and the internal \`.specify/commands/gofer_eai_first_run.md\` setup contract before building.
+- If CLI, login, workspace, template, or Gofer readiness is missing or stale during app delivery, use the public \`eai\` entrypoint and the internal first-run setup contract before building.
 - Use \`eai update --check\`, \`eai --describe\`, \`eai agent guide --format json\`, \`eai template check --format json\`, \`eai gofer refresh --check --format json\`, and \`eai workflow readiness --format json\` when the CLI advertises them before assuming the repo is current.
+- Do not invent, guess, or complete EAI CLI commands from memory. Verify exact \`eai ...\` syntax and flags with \`eai --describe\` and command-specific \`--help\` before suggesting or running them. If the installed CLI does not list a command, do not run it.
 - After any \`eai\` command error, use \`eai errors explain <code-or-reason> --format json\` before guessing remediation.
 - If \`eai errors explain\` is unavailable, match \`.specify/references/platform/eai-error-catalog.yaml\`, run read-only diagnostics before mutating fixes, and stop at the retry or escalation condition.
-- For \`eai user invite\` 5xx or \`EXTERNAL_SERVICE_ERROR\`, check existing members with \`eai user list --workspace <workspace-id> --search <email> --format json\`; use \`eai user role set --workspace <workspace-id> --member-id <member-id> --role tenant-admin --format json\` only after verification and user approval, then tell the app user to sign out and sign back in.
+- For \`eai user invite\` 5xx or \`EXTERNAL_SERVICE_ERROR\`, check existing members with \`eai user list --workspace <workspace-id> --search <email> --format json\`; use \`eai user role set --workspace <workspace-id> --member-id <member-id> --role tenant-admin --format json\` only after verification and user approval. The platform role ID \`tenant-admin\` means workspace admin access. Then tell the app user to sign out and sign back in.
+- For \`MISSING_TENANT\`, \`app_token_tenant_context_required\`, or "Tenant context required for app tokens" on platform user lookup or membership prerequisites, run \`eai errors explain app_token_tenant_context_required --format json\`, confirm workspace context, and retry \`/v4/platform/tenants/<tenant-id>/...\` routes before changing workspace members, Entra, role definitions, databases, or cloud portals.
 - Build on EAI Platform first and Azure second. Treat non-EAI runtimes as explicit exceptions only.
 - Keep provisioning, types seed, schema/storage health, workflow readiness, and preview as separate gates.`;
 }
 
+function buildUserFacingResponseGateSection() {
+  return `## User-Facing Response Gate
+
+Before each user-facing reply, check the draft against these rules:
+
+1. Lead with the business outcome, effect, risk, or decision.
+2. Use concise, simple language.
+3. Include technical detail only when it supports a decision or the user asks for it.
+4. If any check fails, rewrite the reply before sending it.`;
+}
+
+function buildAlwaysOnEaiSection() {
+  return `## Always-On EAI Contract
+<!-- gofer:always-on-eai:start -->
+
+Apply this contract to every request after Gofer is installed for this repo or AI coding app. The user does not need to type \`/eai\` or \`$eai\`.
+
+1. Preserve the user's request. Do not rewrite it or add a visible command prefix.
+2. Treat an explicit \`/eai\` in Claude, Copilot, Antigravity, Grok, or VS Code, and \`$eai\` in Codex, as an idempotent request for the same contract.
+3. Apply Gofer's Controlled English and business-first response rules.
+4. Select the internal pipeline stage. Do not make the user select a stage.
+5. Check workspace health before meaningful repo work, tool use, or a pipeline stage. Do not repeat setup on every message.
+6. When the user explicitly asks to update Gofer, use its maintenance contract only.
+<!-- gofer:always-on-eai:end -->`;
+}
+
 export function buildAgentsMd(projectInfo, stages) {
   const corePipelineOrder = [
     '0_gofer_start',
@@ -612,6 +1031,10 @@ export function buildAgentsMd(projectInfo, stages) {
 
 **Project**: ${projectInfo.name} | **Language**: ${formatLanguage(projectInfo.language)}${frameworkLine} | **Package Manager**: ${projectInfo.packageManager || 'Not detected'}
 
+${buildUserFacingResponseGateSection()}
+
+${buildAlwaysOnEaiSection()}
+
 ## Core Pipeline Stages
 
 ${pipelineSections}
@@ -642,7 +1065,7 @@ ${buildCodeStyleSection(projectInfo)}
 
 ## Gofer Pipeline
 
-This project uses Gofer for spec-driven development. Run \`/0_gofer_start\` to start the core pipeline (Gofer Start -> research -> specify -> plan -> tasks -> implement -> validate). \`/6_gofer_validate\` is the terminal quality gate and includes the final engineering review loop. Artifacts in \`.specify/specs/{feature}/\`.
+This project uses Gofer for spec-driven development. Run \`/eai\` in Claude, Copilot, Antigravity, Grok, or VS Code, and \`$eai\` in Codex, to start or continue the core pipeline (Gofer Start -> research -> specify -> plan -> tasks -> implement -> validate). Gofer routes internally through \`.specify/commands/*.md\` contracts; validation is the terminal quality gate and includes the final engineering review loop. Before EAI readiness, classify the request: app delivery continues directly, while clear non-app work asks once before skipping EAI workspace/app setup. Artifacts in \`.specify/specs/{feature}/\`.
 
 Each feature should carry a bounded loop contract:
 
@@ -673,6 +1096,8 @@ export function buildClaudeMd(projectInfo) {
 
 See @AGENTS.md for project conventions, commands, and code style.
 
+${buildAlwaysOnEaiSection()}
+
 ## Workflow Orchestration
 
 ### 1. Plan Node Default
@@ -704,7 +1129,7 @@ See @AGENTS.md for project conventions, commands, and code style.
 
 ## Gofer Pipeline
 
-Run \`/0_gofer_start\` to start the core pipeline: Gofer Start -> research -> specify -> plan -> tasks -> implement -> validate. \`/6_gofer_validate\` is the terminal quality gate and includes the final engineering review loop. Use \`/7_gofer_save\` for checkpoints and \`/8_gofer_branding\` to apply company, client, or consulting-firm presentation style. Artifacts go to \`.specify/specs/{feature}/\`.
+Run \`/eai\` in Claude, Copilot, Antigravity, Grok, or VS Code, and \`$eai\` in Codex, to start or continue the core pipeline: Gofer Start -> research -> specify -> plan -> tasks -> implement -> validate. Gofer routes internally through \`.specify/commands/*.md\` contracts; validation is the terminal quality gate and includes the final engineering review loop. Before EAI readiness, classify the request: app delivery continues directly, while clear non-app work asks once before skipping EAI workspace/app setup. Artifacts go to \`.specify/specs/{feature}/\`.
 
 For each active feature, keep \`loop-contract.json\`, \`loop-ledger.jsonl\`, and
 \`loop-audit-report.md\` in the feature directory. The loop contract bounds
@@ -725,11 +1150,13 @@ export function buildCopilotInstructions(projectInfo) {
 
 **${projectInfo.name}** is a ${formatLanguage(projectInfo.language)} project${frameworkBit}.
 
+${buildAlwaysOnEaiSection()}
+
 ## Gofer Pipeline
 
-This project uses Gofer for spec-driven development. Run \`/0_gofer_start\` to start the core pipeline: Gofer Start -> research -> specify -> plan -> tasks -> implement -> validate.
+This project uses Gofer for spec-driven development. Run \`/eai\` to start or continue the core pipeline: Gofer Start -> research -> specify -> plan -> tasks -> implement -> validate.
 
-Key commands: \`/1_gofer_research\`, \`/2_gofer_specify\`, \`/3_gofer_plan\`, \`/4_gofer_tasks\`, \`/5_gofer_implement\`, \`/6_gofer_validate\`. \`/6_gofer_validate\` is the terminal quality gate and includes the final engineering review loop. Use \`/7_gofer_save\` for checkpoints and \`/8_gofer_branding\` for branded document/deck templates. Artifacts in \`.specify/specs/{feature}/\`.
+Gofer routes internally through \`.specify/commands/*.md\` contracts; validation is the terminal quality gate and includes the final engineering review loop. Before EAI readiness, classify the request: app delivery continues directly, while clear non-app work asks once before skipping EAI workspace/app setup. Artifacts in \`.specify/specs/{feature}/\`.
 
 ${eaiSection}
 
@@ -753,21 +1180,25 @@ ${buildCodeStyleSection(projectInfo)}
 }
 
 export async function readManagedVersion(workspaceRoot) {
-  try {
-    const content = await fs.readFile(path.join(workspaceRoot, GOFER_VERSION_FILE), 'utf8');
-    return content.split('\n')[0]?.trim() || null;
-  } catch (error) {
-    if (error?.code === 'ENOENT') {
-      return null;
-    }
-    throw error;
+  const target = await inspectWorkspacePath(workspaceRoot, GOFER_VERSION_FILE, {
+    leafType: 'file',
+    allowMissing: true,
+  });
+  if (!target.exists) {
+    return null;
   }
+  const content = await fs.readFile(target.path, 'utf8');
+  return content.split('\n')[0]?.trim() || null;
 }
 
 async function collectMissingPaths(workspaceRoot, relativePaths) {
   const missing = [];
   for (const relativePath of relativePaths) {
-    if (!(await pathExists(path.join(workspaceRoot, relativePath)))) {
+    const target = await inspectWorkspacePath(workspaceRoot, relativePath, {
+      leafType: 'any',
+      allowMissing: true,
+    });
+    if (!target.exists) {
       missing.push(relativePath);
     }
   }
@@ -780,6 +1211,7 @@ export async function checkWorkspaceState({
   sourceRoot,
 }) {
   const normalizedHost = normalizeHost(host);
+  await assertSafeWorkspaceRoot(workspaceRoot);
   const expectedVersion = await detectGoferVersion(sourceRoot);
   const actualVersion = await readManagedVersion(workspaceRoot);
   const missingCore = await collectMissingPaths(workspaceRoot, CORE_SENTINELS);
@@ -822,44 +1254,139 @@ export async function checkWorkspaceState({
   };
 }
 
-async function ensureDir(targetPath, dryRun) {
-  if (!dryRun) {
-    await fs.mkdir(targetPath, { recursive: true });
+async function ensureDir(workspaceRoot, relativePath, dryRun) {
+  await ensureSafeWorkspaceDirectory(workspaceRoot, relativePath, dryRun);
+}
+
+function sourceIdentityMatches(left, right) {
+  return (
+    left.dev === right.dev &&
+    left.ino === right.ino &&
+    left.size === right.size &&
+    left.mtimeMs === right.mtimeMs &&
+    left.isFile() === right.isFile()
+  );
+}
+
+async function readStableSourceFile(sourcePath) {
+  const before = await fs.lstat(sourcePath);
+  if (before.isSymbolicLink() || !before.isFile()) {
+    throw new Error('Unsafe Gofer source path: copied entries must be regular files.');
+  }
+
+  const handle = await fs.open(sourcePath, 'r');
+  try {
+    const opened = await handle.stat();
+    if (!sourceIdentityMatches(before, opened)) {
+      throw new Error('Unsafe Gofer source path: a copied file changed during validation.');
+    }
+    const content = await handle.readFile();
+    const after = await fs.lstat(sourcePath);
+    if (!sourceIdentityMatches(opened, after)) {
+      throw new Error('Unsafe Gofer source path: a copied file changed during validation.');
+    }
+    return { content, mode: opened.mode & 0o777 };
+  } finally {
+    await handle.close();
   }
 }
 
-async function copyDirectory(sourcePath, targetPath, dryRun) {
-  if (!(await pathExists(sourcePath))) {
+async function copyDirectory(sourcePath, workspaceRoot, targetRelativePath, dryRun) {
+  const sourceStat = await lstatIfExists(sourcePath);
+  if (!sourceStat) {
     return false;
   }
-  if (dryRun) {
-    return true;
+  if (sourceStat.isSymbolicLink() || !sourceStat.isDirectory()) {
+    throw new Error('Unsafe Gofer source path: copied roots must be real directories.');
+  }
+
+  await ensureSafeWorkspaceDirectory(workspaceRoot, targetRelativePath, dryRun);
+  const entries = await fs.readdir(sourcePath, { withFileTypes: true });
+  for (const entry of entries) {
+    const sourceEntryPath = path.join(sourcePath, entry.name);
+    const targetEntryRelativePath = path.join(targetRelativePath, entry.name);
+    const entryStat = await fs.lstat(sourceEntryPath);
+    if (entryStat.isSymbolicLink()) {
+      throw new Error('Unsafe Gofer source path: symbolic links are not copied.');
+    }
+    if (entryStat.isDirectory()) {
+      await copyDirectory(sourceEntryPath, workspaceRoot, targetEntryRelativePath, dryRun);
+    } else if (entryStat.isFile()) {
+      const sourceFile = await readStableSourceFile(sourceEntryPath);
+      await writeWorkspaceFile(
+        workspaceRoot,
+        targetEntryRelativePath,
+        sourceFile.content,
+        dryRun,
+        sourceFile.mode
+      );
+    } else {
+      throw new Error(
+        'Unsafe Gofer source path: only regular files and directories may be copied.'
+      );
+    }
   }
-  await fs.mkdir(path.dirname(targetPath), { recursive: true });
-  await fs.cp(sourcePath, targetPath, { recursive: true, force: true, dereference: false });
   return true;
 }
 
-async function writeFileIfMissing(filePath, content, dryRun) {
-  if (await pathExists(filePath)) {
+async function writeFileIfMissing(workspaceRoot, relativePath, content, dryRun) {
+  const target = await inspectWorkspacePath(workspaceRoot, relativePath, {
+    leafType: 'file',
+    allowMissing: true,
+  });
+  if (target.exists) {
     return false;
   }
-  if (!dryRun) {
-    await fs.mkdir(path.dirname(filePath), { recursive: true });
-    await fs.writeFile(filePath, content, 'utf8');
-  }
+  await writeWorkspaceFile(workspaceRoot, relativePath, content, dryRun);
   return true;
 }
 
-async function writeTextFile(filePath, content, dryRun) {
-  if (!dryRun) {
-    await fs.mkdir(path.dirname(filePath), { recursive: true });
-    await fs.writeFile(filePath, content, 'utf8');
+async function ensureAlwaysOnEaiSection(workspaceRoot, relativePath, fallbackContent, dryRun) {
+  let existing = '';
+  const target = await inspectWorkspacePath(workspaceRoot, relativePath, {
+    leafType: 'file',
+    allowMissing: true,
+  });
+  if (target.exists) {
+    existing = await fs.readFile(target.path, 'utf8');
   }
+
+  const section = buildAlwaysOnEaiSection();
+  const markerPattern = /## Always-On EAI Contract\r?\n<!-- gofer:always-on-eai:start -->[\s\S]*?<!-- gofer:always-on-eai:end -->/;
+  const legacySectionPattern = /## Always-On EAI Contract\r?\n[\s\S]*?(?=^##\s|(?![\s\S]))/m;
+  const updated = existing
+    ? markerPattern.test(existing)
+      ? existing.replace(markerPattern, section)
+      : legacySectionPattern.test(existing)
+        ? existing.replace(legacySectionPattern, `${section}\n`)
+        : `${existing.trimEnd()}\n\n${section}\n`
+    : fallbackContent;
+
+  if (updated === existing) {
+    return false;
+  }
+
+  await writeTextFile(workspaceRoot, relativePath, updated, dryRun);
+  return true;
+}
+
+function buildGeminiMd(projectInfo) {
+  return `# GEMINI.md
+
+See @AGENTS.md for project conventions, commands, and code style.
+
+${buildAlwaysOnEaiSection()}
+
+Use the internal Gofer pipeline to select the next stage. Keep the user-facing
+conversation in business language.\n`;
+}
+
+async function writeTextFile(workspaceRoot, relativePath, content, dryRun) {
+  await writeWorkspaceFile(workspaceRoot, relativePath, content, dryRun);
 }
 
 async function writeModelPolicyIfMissing(workspaceRoot, sourceRoot, dryRun) {
-  const targetPath = path.join(workspaceRoot, '.specify', 'memory', 'gofer-model-policy.yaml');
+  const targetRelativePath = path.join('.specify', 'memory', 'gofer-model-policy.yaml');
 
   let template = '';
   try {
@@ -874,18 +1401,18 @@ async function writeModelPolicyIfMissing(workspaceRoot, sourceRoot, dryRun) {
     throw error;
   }
 
-  return writeFileIfMissing(targetPath, template, dryRun);
+  return writeFileIfMissing(workspaceRoot, targetRelativePath, template, dryRun);
 }
 
 async function mergeGitignore(workspaceRoot, dryRun) {
-  const gitignorePath = path.join(workspaceRoot, '.gitignore');
+  const gitignoreRelativePath = '.gitignore';
   let existing = '';
-  try {
-    existing = await fs.readFile(gitignorePath, 'utf8');
-  } catch (error) {
-    if (error?.code !== 'ENOENT') {
-      throw error;
-    }
+  const gitignoreTarget = await inspectWorkspacePath(workspaceRoot, gitignoreRelativePath, {
+    leafType: 'file',
+    allowMissing: true,
+  });
+  if (gitignoreTarget.exists) {
+    existing = await fs.readFile(gitignoreTarget.path, 'utf8');
   }
 
   const missingEntries = GOFER_GITIGNORE_ENTRIES.filter((entry) => !existing.includes(entry));
@@ -904,7 +1431,7 @@ async function mergeGitignore(workspaceRoot, dryRun) {
     updated += `${entry}\n`;
   }
 
-  await writeTextFile(gitignorePath, updated, dryRun);
+  await writeTextFile(workspaceRoot, gitignoreRelativePath, updated, dryRun);
   return true;
 }
 
@@ -924,12 +1451,14 @@ This folder contains all project specifications for AI-driven feature developmen
 
 ## Quick Start
 
-Run the unified Gofer pipeline with:
+Run the unified Gofer pipeline with one public command:
 
 \`\`\`
-/0_gofer_start Add user authentication with OAuth2 and JWT
+/eai Add user authentication with OAuth2 and JWT
 \`\`\`
 
+Use \`/eai\` in Claude, Copilot, Antigravity, Grok, or VS Code, and \`$eai\` in Codex. Gofer routes internally through \`.specify/commands/*.md\` contracts.
+
 Artifacts are stored in \`.specify/specs/{feature}/\`.
 
 Each feature should include a bounded loop contract:
@@ -957,8 +1486,9 @@ Each feature should also keep a running stakeholder review pack:
 
 ## Model Policy
 
-Edit \`.specify/memory/gofer-model-policy.yaml\` to tune simple, medium, hard,
-and arbiter model routes for Claude, Codex/OpenAI, Gemini, and Copilot. The
+Edit \`.specify/memory/gofer-model-policy.yaml\` to set advisory simple, medium, hard,
+and arbiter capability constraints for Claude, Codex/OpenAI, Google Antigravity,
+Copilot, Grok, and VS Code. Fresh signed capability receipts select models. The
 file is copied from \`.specify/templates/gofer-model-policy.yaml\` when missing
 and is not overwritten by bootstrap.
 `;
@@ -989,19 +1519,26 @@ function getMirrorCopyCandidates() {
       target: path.join('.github', 'skills'),
     },
     { sourceRelativePath: '.gemini', target: '.gemini' },
+    { sourceRelativePath: path.join('.grok', 'skills'), target: path.join('.grok', 'skills') },
     { sourceRelativePath: path.join('.agents', 'skills'), target: path.join('.agents', 'skills') },
     { sourceRelativePath: path.join('.system', 'skills'), target: path.join('.system', 'skills') },
   ];
 }
 
 async function installClaudeHooksSettings(workspaceRoot, dryRun) {
-  const settingsPath = path.join(workspaceRoot, '.claude', 'settings.json');
+  const settingsRelativePath = path.join('.claude', 'settings.json');
   let settings = {};
-  try {
-    settings = JSON.parse(await fs.readFile(settingsPath, 'utf8'));
-  } catch (error) {
-    if (error?.code !== 'ENOENT' && !(error instanceof SyntaxError)) {
-      throw error;
+  const settingsTarget = await inspectWorkspacePath(workspaceRoot, settingsRelativePath, {
+    leafType: 'file',
+    allowMissing: true,
+  });
+  if (settingsTarget.exists) {
+    try {
+      settings = JSON.parse(await fs.readFile(settingsTarget.path, 'utf8'));
+    } catch (error) {
+      if (!(error instanceof SyntaxError)) {
+        throw error;
+      }
     }
   }
 
@@ -1010,7 +1547,12 @@ async function installClaudeHooksSettings(workspaceRoot, dryRun) {
     ...CLAUDE_HOOKS_CONFIG,
   };
 
-  await writeTextFile(settingsPath, `${JSON.stringify(settings, null, 2)}\n`, dryRun);
+  await writeTextFile(
+    workspaceRoot,
+    settingsRelativePath,
+    `${JSON.stringify(settings, null, 2)}\n`,
+    dryRun
+  );
 }
 
 export async function bootstrapWorkspace({
@@ -1021,6 +1563,7 @@ export async function bootstrapWorkspace({
   includeMirrors = false,
 }) {
   const normalizedHost = normalizeHost(host);
+  await assertSafeWorkspaceRoot(workspaceRoot);
   const projectInfo = await detectProjectInfo(workspaceRoot);
   const stages = await loadStageMetadata(sourceRoot);
   const version = await detectGoferVersion(sourceRoot);
@@ -1032,13 +1575,15 @@ export async function bootstrapWorkspace({
     path.join('.specify', 'logs'),
   ];
   for (const relativeDir of coreDirs) {
-    await ensureDir(path.join(workspaceRoot, relativeDir), dryRun);
+    await ensureDir(workspaceRoot, relativeDir, dryRun);
     changed.push(relativeDir);
   }
 
   const coreCopies = [
     path.join('.specify', 'commands'),
+    path.join('.specify', 'config'),
     path.join('.specify', 'references'),
+    path.join('.specify', 'schemas'),
     path.join('.specify', 'templates'),
     path.join('.specify', 'scripts', 'bash'),
     path.join('.specify', 'scripts', 'node'),
@@ -1048,7 +1593,8 @@ export async function bootstrapWorkspace({
   for (const relativePath of coreCopies) {
     const copied = await copyDirectory(
       await resolveSourcePath(sourceRoot, relativePath),
-      path.join(workspaceRoot, relativePath),
+      workspaceRoot,
+      relativePath,
       dryRun
     );
     if (copied) {
@@ -1060,52 +1606,75 @@ export async function bootstrapWorkspace({
     changed.push(path.join('.specify', 'memory', 'gofer-model-policy.yaml'));
   }
 
-  await writeTextFile(
-    path.join(workspaceRoot, GOFER_VERSION_FILE),
-    `${version}\n`,
-    dryRun
-  );
+  await writeTextFile(workspaceRoot, GOFER_VERSION_FILE, `${version}\n`, dryRun);
   changed.push(GOFER_VERSION_FILE);
 
-  if (await writeFileIfMissing(path.join(workspaceRoot, '.specify', 'README.md'), buildSpecifyReadme(), dryRun)) {
+  if (
+    await writeFileIfMissing(
+      workspaceRoot,
+      path.join('.specify', 'README.md'),
+      buildSpecifyReadme(),
+      dryRun
+    )
+  ) {
     changed.push(path.join('.specify', 'README.md'));
   }
 
-  if (await writeFileIfMissing(path.join(workspaceRoot, 'AGENTS.md'), buildAgentsMd(projectInfo, stages), dryRun)) {
+  if (
+    await ensureAlwaysOnEaiSection(
+      workspaceRoot,
+      'AGENTS.md',
+      buildAgentsMd(projectInfo, stages),
+      dryRun
+    )
+  ) {
     changed.push('AGENTS.md');
   }
 
+  if (
+    await ensureAlwaysOnEaiSection(
+      workspaceRoot,
+      'CLAUDE.md',
+      buildClaudeMd(projectInfo),
+      dryRun
+    )
+  ) {
+    changed.push('CLAUDE.md');
+  }
+
+  if (
+    await ensureAlwaysOnEaiSection(
+      workspaceRoot,
+      path.join('.github', 'copilot-instructions.md'),
+      buildCopilotInstructions(projectInfo),
+      dryRun
+    )
+  ) {
+    changed.push(path.join('.github', 'copilot-instructions.md'));
+  }
+
+  if (
+    await ensureAlwaysOnEaiSection(
+      workspaceRoot,
+      'GEMINI.md',
+      buildGeminiMd(projectInfo),
+      dryRun
+    )
+  ) {
+    changed.push('GEMINI.md');
+  }
+
   if (normalizedHost === 'claude') {
-    if (
-      await writeFileIfMissing(
-        path.join(workspaceRoot, 'CLAUDE.md'),
-        buildClaudeMd(projectInfo),
-        dryRun
-      )
-    ) {
-      changed.push('CLAUDE.md');
-    }
     await installClaudeHooksSettings(workspaceRoot, dryRun);
     changed.push(path.join('.claude', 'settings.json'));
   }
 
-  if (normalizedHost === 'copilot') {
-    if (
-      await writeFileIfMissing(
-        path.join(workspaceRoot, '.github', 'copilot-instructions.md'),
-        buildCopilotInstructions(projectInfo),
-        dryRun
-      )
-    ) {
-      changed.push(path.join('.github', 'copilot-instructions.md'));
-    }
-  }
-
   if (includeMirrors) {
     for (const candidate of getMirrorCopyCandidates(sourceRoot)) {
       const copied = await copyDirectory(
         await resolveSourcePath(sourceRoot, candidate.sourceRelativePath),
-        path.join(workspaceRoot, candidate.target),
+        workspaceRoot,
+        candidate.target,
         dryRun
       );
       if (copied) {
@@ -1114,7 +1683,7 @@ export async function bootstrapWorkspace({
     }
   }
 
-  const archivedLegacyPaths = await removeLegacyManagedPaths(workspaceRoot, dryRun);
+  const archivedLegacyPaths = await removeLegacyManagedPaths(workspaceRoot, dryRun, stages);
   changed.push(
     ...archivedLegacyPaths.map(
       ({ relativePath, archivePath }) => `${relativePath} (archived legacy to ${archivePath})`