@event4u/agent-config 4.1.0 → 4.3.0

package/scripts/install.py

@@ -88,6 +88,43 @@ LEGACY_RENAME_MAP = {
 
 QUIET = False
 
+# Machine-readable progress stream for the wizard `--apply-payload` real-apply
+# bridge (road-to-single-install-source-of-truth § Phase 1). When True,
+# `_emit_progress` writes NDJSON lines to stdout so the GUI can stream install
+# progress; human-readable `info`/`success` output is suppressed via QUIET so
+# the two never interleave (`warn`/`fail` still surface on stderr). Off for
+# every normal CLI install.
+PROGRESS_NDJSON = False
+
+
+def _emit_progress(obj: "dict[str, Any]") -> None:
+    """Write one NDJSON progress line to stdout when PROGRESS_NDJSON is on.
+
+    No-op for normal CLI installs. The line shapes mirror the wizard SSE
+    frames the GUI already consumes: per-unit
+    ``{"type":"file","file":...,"status":...,"written":N,"total":M}`` and the
+    terminal ``{"type":"done"|"error",...}``.
+    """
+    if not PROGRESS_NDJSON:
+        return
+    sys.stdout.write(json.dumps(obj, separators=(",", ":")) + "\n")
+    sys.stdout.flush()
+
+
+def _emit_progress_terminal(rc: int) -> None:
+    """Emit the terminal NDJSON frame for a real-apply run.
+
+    rc == 0 → ``{"type":"done"}``; otherwise ``{"type":"error",...}``. No-op
+    unless PROGRESS_NDJSON is on, so it is safe to call from every install
+    return path.
+    """
+    if not PROGRESS_NDJSON:
+        return
+    if rc == 0:
+        _emit_progress({"type": "done"})
+    else:
+        _emit_progress({"type": "error", "code": "E_INSTALL", "exitCode": rc})
+
 
 def info(msg: str) -> None:
     if not QUIET:
@@ -817,12 +854,42 @@ def _validate_user_type(package_root: Path, value: str) -> str:
     return cleaned
 
 
+def _inject_packs(body: str, packs: "list[str]") -> str:
+    """Insert a top-level ``packs:`` block into a rendered settings body.
+
+    Inserted directly after the ``cost_profile:`` line so the active pack
+    selection sits beside the other install-time knobs. No-op when ``packs``
+    is empty — non-pack installs stay byte-identical to the template render.
+    """
+    if not packs:
+        return body
+    block = "packs:\n" + "".join(f"  - {p}\n" for p in packs)
+    lines = body.splitlines(keepends=True)
+    out: list[str] = []
+    inserted = False
+    for line in lines:
+        out.append(line)
+        if not inserted and line.startswith("cost_profile:"):
+            if not line.endswith("\n"):
+                out[-1] = line + "\n"
+            out.append(block)
+            inserted = True
+    if not inserted:
+        # No cost_profile anchor (unexpected) — append at the end so the
+        # selection is still recorded rather than silently dropped.
+        if out and not out[-1].endswith("\n"):
+            out[-1] = out[-1] + "\n"
+        out.append(block)
+    return "".join(out)
+
+
 def ensure_agent_settings(
     project_root: Path,
     package_root: Path,
     profile: str,
     force: bool,
     user_type: str = "",
+    packs: "list[str] | None" = None,
 ) -> None:
     target = project_root / SETTINGS_FILE
     profile_source = package_root / "config" / "profiles" / f"{profile}.ini"
@@ -847,6 +914,7 @@ def ensure_agent_settings(
     # Inject runtime-only values (not part of the .ini profile presets).
     profile_values["user_type"] = _validate_user_type(package_root, user_type)
     template_body = _render_template(template, profile_values)
+    template_body = _inject_packs(template_body, packs or [])
 
     legacy_target = project_root / LEGACY_SETTINGS_FILE
     if legacy_target.is_file() and target.exists():
@@ -3524,6 +3592,24 @@ def install_global(
     package_root = _resolve_package_root_for_global()
     deploy_results = _deploy_global_content(tools, force, package_root, written)
 
+    # NDJSON progress for the wizard --apply-payload real-apply bridge. One
+    # `file` frame per deployed tool unit (coarse, per AI-council 2026-05-27);
+    # the GUI maps these to its SSE progress frames. No-op under normal CLI
+    # installs (PROGRESS_NDJSON off). Emitted independent of QUIET because the
+    # real-apply path sets QUIET=True to silence the human stream.
+    if PROGRESS_NDJSON:
+        ordered = sorted(deploy_results)
+        total = len(ordered)
+        for idx, tool_id in enumerate(ordered, start=1):
+            w, _s, status, _ = deploy_results[tool_id]
+            _emit_progress({
+                "type": "file",
+                "file": tool_id,
+                "status": status,
+                "written": idx,
+                "total": total,
+            })
+
     if not QUIET:
         print()
         info("Deployed per-tool content:")
@@ -3697,6 +3783,17 @@ def parse_options(argv: list[str]) -> argparse.Namespace:
             "the comma-separated values are unioned. Default: all."
         ),
     )
+    parser.add_argument(
+        "--packs",
+        default=None,
+        help=(
+            "comma-separated pack IDs to record as the active selection in "
+            ".agent-settings.yml (project scope). Packs are a "
+            "frontmatter/condense-time concept — recording the selection "
+            "lets downstream condense/runtime honor it; install.py does not "
+            "materialize packs. Default: none (base package only)."
+        ),
+    )
     parser.add_argument(
         "--no-smoke",
         action="store_true",
@@ -3805,6 +3902,13 @@ def parse_options(argv: list[str]) -> argparse.Namespace:
     )
     opts = parser.parse_args(argv)
     opts.tools = _merge_tools_aliases(opts.tools, opts.ai)
+    # Normalize --packs (comma-separated string | None) to a list so the CLI
+    # and the --apply-payload bridge agree on opts.packs being list[str].
+    opts.packs = (
+        [p.strip() for p in opts.packs.split(",") if p.strip()]
+        if isinstance(opts.packs, str)
+        else []
+    )
     if opts.scope == "global" and opts.custom_path:
         fail("--custom-path is incompatible with --scope=global")
     if opts.global_install and opts.custom_path:
@@ -4167,16 +4271,17 @@ def run_interactive_init(project_root: Path, force: bool) -> int:
 # --- Wizard auto-launch (Phase 6 follow-up) ---
 #
 # Auto-launches the browser configuration wizard at the tail of a
-# successful install. The TS side ships a `gui` subcommand on the
-# installer CLI; this Python parent acts as a supervisor that:
+# successful install. The unified CLI ships an `install` subcommand
+# (`dist/cli/agent-config.js`); this Python parent acts as a supervisor that:
 #
 #   1. evaluates gate conditions (TTY, CI, --no-ui, env override),
 #   2. validates the dist exists,
-#   3. spawns `node <cli> gui --project-root <root>` via subprocess.Popen,
+#   3. spawns `node <cli> install --no-open --project-root <root>` via subprocess.Popen,
 #   4. captures stderr on a background thread (for failure surfacing),
 #   5. reads stdout line-by-line with a progressive timeout
 #      (10s → 20s → 40s → 80s) and matches the strict readiness regex
-#      `^WIZARD_READY url=(http://(?:127.0.0.1|localhost):\d+/)\r?$`,
+#      `^WIZARD_READY (http://(?:127.0.0.1|localhost):\d+/\S*)\r?$`
+#      (the CLI prints `WIZARD_READY <url>` where url carries `?token=…`),
 #   6. on success: prints the URL banner and waits for the child to
 #      exit (Ctrl-C in the parent terminal propagates to the child),
 #   7. on timeout: kills the child, prints captured stderr tail, falls
@@ -4186,7 +4291,7 @@ def run_interactive_init(project_root: Path, force: bool) -> int:
 # Roadmap: agents/roadmaps/wizard-install-py-wiring.md Step 3.
 
 _WIZARD_READY_RE = re.compile(
-    r"^WIZARD_READY url=(http://(?:127\.0\.0\.1|localhost):\d+/)\r?$"
+    r"^WIZARD_READY (http://(?:127\.0\.0\.1|localhost):\d+/\S*)\r?$"
 )
 _WIZARD_TIMEOUTS = (10.0, 20.0, 40.0, 80.0)  # cumulative budget 150s.
 
@@ -4195,8 +4300,8 @@ def _wizard_should_launch(opts: argparse.Namespace) -> tuple[bool, str]:
     """Evaluate gate conditions for the post-install wizard auto-launch.
 
     Returns (decision, reason). When decision is False the reason
-    string explains why (CI / no-tty / --no-ui / env override) and is
-    suitable for the pre-install banner Council Tier 2 § 8.
+    string explains why (CI / no-tty / --no-ui / env override / explicit
+    --tools) and is suitable for the pre-install banner Council Tier 2 § 8.
     """
     if getattr(opts, "no_ui", False):
         return (False, "--no-ui flag set")
@@ -4207,18 +4312,26 @@ def _wizard_should_launch(opts: argparse.Namespace) -> tuple[bool, str]:
         return (False, "CI environment detected")
     if not sys.stdout.isatty():
         return (False, "stdout is not a TTY")
+    # Explicit `--tools=<list>` means the caller already knows what to
+    # install — run the non-interactive CLI install, don't open the GUI
+    # (road-to-single-install-source-of-truth § Phase 4). The implicit/
+    # explicit `all` default does NOT suppress the wizard.
+    tools_raw = getattr(opts, "tools", None)
+    if tools_raw and not _tools_was_all(tools_raw):
+        return (False, "explicit --tools= selection (headless install)")
     return (True, "")
 
 
 def _wizard_cli_dist(project_root: Path) -> Path | None:
-    """Resolve the installer dist path. Returns None if not built.
+    """Resolve the unified CLI dist path. Returns None if not built.
 
-    Walks up from this file (scripts/install.py is at <pkg>/scripts/)
-    to <pkg>/packages/core/installer/dist/cli.js. That's the layout
-    the monorepo ships; consumer installs run `node <pkg>/.../cli.js`.
+    Walks up from this file (scripts/install.py is at <pkg>/scripts/) to
+    <pkg>/dist/cli/agent-config.js — the published bin entry (package.json
+    `bin`). The dead `packages/core/installer/dist/cli.js` layout was
+    retired in road-to-single-install-source-of-truth § Phase 4.
     """
     package_root = Path(__file__).resolve().parent.parent
-    cli = package_root / "packages" / "core" / "installer" / "dist" / "cli.js"
+    cli = package_root / "dist" / "cli" / "agent-config.js"
     return cli if cli.exists() else None
 
 
@@ -4233,17 +4346,18 @@ def _wizard_spawn(project_root: Path) -> int:
     cli = _wizard_cli_dist(project_root)
     if cli is None:
         print(
-            "(Wizard not available — installer package not built. "
-            "Run 'npm run build' inside packages/core/installer/.)"
+            "(Wizard not available — CLI bundle not built. "
+            "Run 'npm run build' at the package root to produce dist/cli/.)"
         )
         return 0
 
-    cmd = ["node", str(cli), "gui", "--project-root", str(project_root)]
+    # Spawn the unified CLI's `install` subcommand (boots the UI server,
+    # lands on Step 1 / AI tools). `--no-open` keeps the Python parent in
+    # charge of the user-facing URL print (Tier 2 § 8 ordering) — the dead
+    # `gui` subcommand + AGENT_CONFIG_GUI_NO_OPEN env were retired in
+    # road-to-single-install-source-of-truth § Phase 4.
+    cmd = ["node", str(cli), "install", "--no-open", "--project-root", str(project_root)]
     env = os.environ.copy()
-    # The Node child writes its own readiness banner; suppress the
-    # browser-open inside the child so the Python parent stays in
-    # charge of the user-facing URL print (Tier 2 § 8 ordering).
-    env.setdefault("AGENT_CONFIG_GUI_NO_OPEN", "1")
 
     try:
         child = subprocess.Popen(  # noqa: S603 - cmd is locally-built, not user input
@@ -4255,7 +4369,7 @@ def _wizard_spawn(project_root: Path) -> int:
             bufsize=1,  # line-buffered
         )
     except OSError as exc:
-        print(f"(Wizard failed to start: {exc}; run 'node {cli} gui' manually.)")
+        print(f"(Wizard failed to start: {exc}; run 'node {cli} install --no-open' manually.)")
         return 0
 
     # Drain stderr on a background thread so a chatty child can't
@@ -4327,7 +4441,7 @@ def _wizard_await_ready(
         tail = "\n  ".join(stderr_tail[-20:]) if stderr_tail else "(no stderr captured)"
         print(
             f"(Wizard server boot timed out after {int(sum(_WIZARD_TIMEOUTS))}s; "
-            f"run 'node {cli} gui' manually.)\n"
+            f"run 'node {cli} install --no-open' manually.)\n"
             f"  Last stderr:\n  {tail}"
         )
         return 0
@@ -4445,10 +4559,9 @@ def main(argv: list[str]) -> int:
                 f"--apply-payload schema_version must be 'wizard-v2' or "
                 f"'installer-v1', got {schema_version!r}"
             )
-        # Translate payload → opts so the dry-run / real-install path
-        # downstream sees the same shape it would from CLI flags. Only
-        # dry-run preview is wired in Phase 1.5; real apply lands in a
-        # follow-up minor (kill-switch via package version per D7).
+        # Translate payload → opts so the SAME canonical install path
+        # downstream sees the shape it would from CLI flags — no second
+        # code path (road-to-single-install-source-of-truth § Phase 1).
         if schema_version == "wizard-v2":
             tools = payload.get("tools") or []
             if isinstance(tools, list) and tools:
@@ -4457,6 +4570,36 @@ def main(argv: list[str]) -> int:
                 opts.scope = "project"
             else:
                 opts.scope = "global"
+            # settings{} → --profile / --user-type. `settings` is the
+            # merged .agent-settings.yml body; pull the two install-time
+            # knobs the canonical installer consumes. Everything else in
+            # the settings body is written by the wizard `/finish` 2PC
+            # commit, not by install.py.
+            settings = payload.get("settings") or {}
+            if isinstance(settings, dict):
+                cost_profile = settings.get("cost_profile")
+                if isinstance(cost_profile, str) and cost_profile:
+                    opts.profile = cost_profile
+                personal = settings.get("personal")
+                if isinstance(personal, dict):
+                    user_type = personal.get("user_type")
+                    if isinstance(user_type, str) and user_type:
+                        opts.user_type = user_type
+            # packs[] → declarative selection persisted into
+            # .agent-settings.yml on the project path (ensure_agent_settings).
+            # Packs are a frontmatter/condense-time concept; there is no
+            # install-time materialization — the selection is recorded so
+            # downstream condense/runtime honors it (AI-council 2026-05-27).
+            packs = payload.get("packs") or []
+            if isinstance(packs, list):
+                opts.packs = [p for p in packs if isinstance(p, str)]
+            # Per-tool user-hook opts → ensure_*_hook flags: deliberately
+            # NOT wired. The wizard-v2 payload carries no hook fields, and
+            # auto-enabling user-scope hooks (which write to the global
+            # user config) on tool selection would silently widen install
+            # scope — a non-destructive-by-default violation. Maps only
+            # once the schema grows an explicit hooks field (AI-council
+            # 2026-05-27, Gemini + Codex converged).
         elif schema_version == "installer-v1":
             ai_tools = payload.get("ai_tools") or []
             if isinstance(ai_tools, list) and ai_tools:
@@ -4466,13 +4609,13 @@ def main(argv: list[str]) -> int:
             opts.dry_run = True
         if opts.dry_run:
             return _apply_payload_preview(payload, opts)
-        # Real-apply path through the payload bridge is gated by the
-        # follow-up minor (Phase 1.9). Until then, fail loudly so the
-        # caller knows they need --dry-run.
-        fail(
-            "--apply-payload without --dry-run is not yet wired "
-            "(road-to-global-only-install § Phase 1.5 ships dry-run only)."
-        )
+        # Real apply: stream machine-readable NDJSON progress on stdout and
+        # silence human output so the GUI gets a clean stream. Then fall
+        # through to the canonical install path below — no separate apply
+        # implementation.
+        global PROGRESS_NDJSON
+        PROGRESS_NDJSON = True
+        QUIET = True
 
     # --offline: propagate via env so child subprocesses (versions /
     # update / check_update_banner) honor the air-gap guarantee
@@ -4561,7 +4704,9 @@ def main(argv: list[str]) -> int:
                     return rc
             # Pass detect_root so the manifest refresh runs when --global is
             # invoked from within a project tree (ADR-008 Phase 3.2).
-            return install_global(parsed_tools, opts.force, project_root=detect_root)
+            rc = install_global(parsed_tools, opts.force, project_root=detect_root)
+            _emit_progress_terminal(rc)
+            return rc
 
         project_root = custom_path or Path(opts.project or os.environ.get("PROJECT_ROOT") or os.getcwd()).resolve()
         is_first_run = not (project_root / SETTINGS_FILE).exists()
@@ -4571,9 +4716,11 @@ def main(argv: list[str]) -> int:
         # never ships ahead of the bridge files it parameterizes.
         if rc == 0 and getattr(opts, "interactive", False):
             run_interactive_init(project_root, opts.force)
+        _emit_progress_terminal(rc)
         return rc
     except ConflictAbort as exc:
         warn(exc.message)
+        _emit_progress({"type": "error", "code": "E_CONFLICT_UNRESOLVED", "message": exc.message})
         return 1
     finally:
         _set_conflict_policy(None)
@@ -4670,7 +4817,8 @@ def _main_project_install(
         print()
 
     ensure_agent_settings(
-        project_root, package_root, opts.profile, opts.force, opts.user_type
+        project_root, package_root, opts.profile, opts.force, opts.user_type,
+        packs=getattr(opts, "packs", None),
     )
 
     # Install-mode marker (Step 8 A5) — full path flips any prior
@@ -4745,6 +4893,21 @@ def _main_project_install(
             ensure_gemini_user_hooks(package_root, opts.force),
         )
 
+    # NDJSON progress for the wizard --apply-payload real-apply bridge on the
+    # project scope (scope_to_project_only=true). One `file` frame per enabled
+    # tool unit, coarse per AI-council 2026-05-27. No-op under normal CLI.
+    if PROGRESS_NDJSON and not opts.skip_bridges:
+        ordered = sorted(tools)
+        total = len(ordered)
+        for idx, tool_id in enumerate(ordered, start=1):
+            _emit_progress({
+                "type": "file",
+                "file": tool_id,
+                "status": "deployed",
+                "written": idx,
+                "total": total,
+            })
+
     if not opts.skip_bridges and not opts.no_smoke:
         if not QUIET:
             print()

package/scripts/lint_framework_leakage_allowlist.json

@@ -2,6 +2,14 @@
   "version": 1,
   "_doc": "Each entry: { file: relative path from repo root, lines: [int,...] | \"*\" for whole file, reason: short justification }. Use sparingly — first ask whether the file should be neutralized instead.",
   "entries": [
+    {
+      "file": ".agent-src.uncondensed/skills/module-detect-on-the-fly/SKILL.md",
+      "lines": [
+        42,
+        104
+      ],
+      "reason": "Cross-stack noise-segment enumeration (vendor + node_modules + dist/Modules) documenting the module-detection path filter"
+    },
     {
       "file": ".agent-src.uncondensed/skills/using-git-worktrees/SKILL.md",
       "lines": [

package/dist/install/apply.js

@@ -1,238 +0,0 @@
-/**
- * Apply orchestrator \u2014 Phase A4 (atomic writes + transaction log).
- *
- * Consumes an {@link InstallPlan} produced by `plan.ts:buildInstallPlan`
- * and walks every {@link FileEntry}, copying source bytes into the
- * declared target with {@link atomicWriteFile}. Each successful write
- * appends one {@link TxLogEntry} (kind=`write`) to the transaction log
- * so a recovery pass on next boot can reverse-apply on crash.
- *
- * Pure orchestration:
- *   - No path recomputation (the plan is the source of truth).
- *   - No re-walking of the source tree.
- *   - SHA-256 idempotency: skip an entry whose target already exists
- *     with matching bytes, unless `force=true` flips the policy.
- *
- * Progress is surfaced via the optional `onProgress` callback so the
- * Fastify SSE adapter (Phase B1) can stream per-file events to the
- * Preact wizard.
- */
-import { existsSync, readFileSync } from 'node:fs';
-import { atomicWriteFile } from './atomic.js';
-import { isJsonTarget, mergeJsonContent, parseJsonLenient, resolveFileConflict, } from './conflict.js';
-import { sha256File } from './plan.js';
-import { appendTxLog } from './txlog.js';
-/**
- * Execute an {@link InstallPlan}.
- *
- * One pass through every entry. Writes are atomic (write-to-temp +
- * rename); the txlog records each success so recovery can reverse-apply.
- *
- * Returns {@link ApplyResult} aggregating per-file outcomes. Never
- * throws on individual file errors \u2014 errors land in
- * {@link ApplyResult.errors} so the wizard can render a partial-success
- * screen rather than crashing the install.
- */
-export function applyPlan(inputs) {
-    const { plan, sourceByTarget, logPath, onProgress, resolutions } = inputs;
-    const all = flattenEntries(plan);
-    const acc = newAccumulator();
-    let index = 0;
-    for (const entry of all) {
-        index += 1;
-        processEntry(entry, plan, sourceByTarget, logPath, acc, index, all.length, onProgress, resolutions);
-    }
-    return { target: plan.target, ...acc };
-}
-/**
- * Async streaming variant — yields the event loop between entries so an
- * {@link AbortSignal} fired by a disconnecting SSE client can stop the
- * loop. Each entry still executes synchronously (atomic write + txlog
- * append) so a mid-write abort is impossible; aborts land between
- * entries and append a single `abort` marker before resolving.
- *
- * Council Finding #24: SSE handlers must wire `req.on("close")` to an
- * `AbortController` and pass the signal here so half-applied installs
- * surface a clean partial result instead of a zombie loop.
- */
-export async function applyPlanStreaming(inputs) {
-    const { plan, sourceByTarget, logPath, onProgress, signal, resolutions } = inputs;
-    const all = flattenEntries(plan);
-    const acc = newAccumulator();
-    let index = 0;
-    for (const entry of all) {
-        if (signal?.aborted === true) {
-            appendTxLog(logPath, {
-                ts: new Date().toISOString(),
-                kind: 'abort',
-                path: entry.path,
-                sha256: null,
-                note: 'client disconnect',
-            });
-            break;
-        }
-        index += 1;
-        processEntry(entry, plan, sourceByTarget, logPath, acc, index, all.length, onProgress, resolutions);
-        // Yield to the event loop so the abort signal can fire and any
-        // SSE write buffers can drain before the next entry.
-        await new Promise((resolve) => setImmediate(resolve));
-    }
-    return { target: plan.target, ...acc };
-}
-function newAccumulator() {
-    return { written: [], skipped: [], conflicts: [], errors: [] };
-}
-function flattenEntries(plan) {
-    const all = [];
-    for (const entries of Object.values(plan.filesByTool)) {
-        for (const e of entries)
-            all.push(e);
-    }
-    return all;
-}
-/**
- * Process one {@link FileEntry} — resolve conflict, write or skip, append
- * txlog, push to accumulator, emit progress.
- *
- * Shared by sync {@link applyPlan} and async {@link applyPlanStreaming}
- * so the conflict matrix lives in one place.
- */
-function processEntry(entry, plan, sourceByTarget, logPath, acc, index, total, onProgress, resolutions) {
-    try {
-        if (entry.kind === 'bridge') {
-            // Bridges are pointers we don't own bytes-for-bytes — skip
-            // them at the apply layer; bridge generators (A6) produce
-            // them via their own writer pass.
-            acc.skipped.push(entry);
-            onProgress?.({ file: entry, written: index, total, status: 'skipped' });
-            return;
-        }
-        const source = sourceByTarget.get(entry.path);
-        if (source === undefined) {
-            acc.errors.push({
-                path: entry.path,
-                code: 'E_PLAN_MISSING_SOURCE',
-                message: 'no source mapping for target path',
-            });
-            onProgress?.({
-                file: entry,
-                written: index,
-                total,
-                status: 'error',
-                error: { code: 'E_PLAN_MISSING_SOURCE', message: 'no source mapping' },
-            });
-            return;
-        }
-        const idempotent = isIdempotent(entry, plan);
-        const exists = existsSync(entry.path);
-        const outcome = resolveFileConflict({
-            targetPath: entry.path,
-            idempotent,
-            exists,
-            policy: plan.policy,
-        });
-        if (outcome === 'skip') {
-            acc.skipped.push(entry);
-            onProgress?.({ file: entry, written: index, total, status: 'skipped' });
-            return;
-        }
-        if (outcome === 'surface') {
-            // Phase B3 — the wizard may have pre-resolved this conflict
-            // before the apply call. The `resolutions` map is keyed by
-            // absolute target path. Missing keys → unresolved conflict
-            // (acc.conflicts) so the wizard surfaces them again. An
-            // explicit `skip` resolution → acc.skipped: the user decided
-            // to leave the file alone, that is a settled outcome.
-            const resolution = resolutions?.get(entry.path);
-            if (resolution === undefined) {
-                acc.conflicts.push(entry);
-                onProgress?.({ file: entry, written: index, total, status: 'conflict' });
-                return;
-            }
-            if (resolution === 'skip') {
-                acc.skipped.push(entry);
-                onProgress?.({ file: entry, written: index, total, status: 'skipped' });
-                return;
-            }
-            const data = readFileSync(source);
-            const payload = resolution === 'merge' && isJsonTarget(entry) && exists
-                ? mergeJsonPayload(entry.path, data)
-                : data;
-            atomicWriteFile(entry.path, payload);
-            appendTxLog(logPath, {
-                ts: new Date().toISOString(),
-                kind: 'write',
-                path: entry.path,
-                sha256: entry.sha256,
-            });
-            acc.written.push(entry);
-            onProgress?.({ file: entry, written: index, total, status: 'written' });
-            return;
-        }
-        const data = readFileSync(source);
-        const payload = isJsonTarget(entry) && exists ? mergeJsonPayload(entry.path, data) : data;
-        atomicWriteFile(entry.path, payload);
-        appendTxLog(logPath, {
-            ts: new Date().toISOString(),
-            kind: 'write',
-            path: entry.path,
-            sha256: entry.sha256,
-        });
-        acc.written.push(entry);
-        onProgress?.({ file: entry, written: index, total, status: 'written' });
-    }
-    catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        const code = errorCode(err);
-        acc.errors.push({ path: entry.path, code, message });
-        onProgress?.({
-            file: entry,
-            written: index,
-            total,
-            status: 'error',
-            error: { code, message },
-        });
-    }
-}
-/**
- * True when the target already matches the planned bytes (no write needed).
- *
- * `policy.force` flips this off \u2014 `--force-overwrite` writes regardless.
- */
-function isIdempotent(entry, plan) {
-    if (plan.policy.force)
-        return false;
-    if (entry.sha256 === null)
-        return false;
-    if (!existsSync(entry.path))
-        return false;
-    return sha256File(entry.path) === entry.sha256;
-}
-/**
- * Read the existing JSON target, deep-merge with the planned payload,
- * and return the canonical 4-space-indented bytes.
- *
- * Falls back to the raw planned payload when the existing file is
- * corrupt or non-object — matches the Python `read_json_file` lenient
- * contract so a truncated upstream config does not abort the install.
- */
-function mergeJsonPayload(targetPath, planned) {
-    const existingText = readFileSync(targetPath, 'utf8');
-    const existing = parseJsonLenient(existingText);
-    const overlay = parseJsonLenient(planned.toString('utf8'));
-    const merged = mergeJsonContent(existing, overlay);
-    return Buffer.from(merged, 'utf8');
-}
-function errorCode(err) {
-    if (err !== null && typeof err === 'object' && 'code' in err) {
-        const c = err.code;
-        if (typeof c === 'string') {
-            if (c === 'ENOSPC')
-                return 'E_DISK_FULL';
-            if (c === 'EACCES' || c === 'EPERM')
-                return 'E_PERM';
-        }
-    }
-    return 'E_WRITE';
-}
-//# sourceMappingURL=apply.js.map

package/dist/install/apply.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"apply.js","sourceRoot":"","sources":["../../src/install/apply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACH,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAyDzC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,SAAS,CAAC,MAAmB;IACzC,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IAC1E,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAE7B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACtB,KAAK,IAAI,CAAC,CAAC;QACX,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;IACxG,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAA4B;IACjE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IAClF,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAE7B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACtB,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YAC3B,WAAW,CAAC,OAAO,EAAE;gBACjB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5B,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,mBAAmB;aAC5B,CAAC,CAAC;YACH,MAAM;QACV,CAAC;QACD,KAAK,IAAI,CAAC,CAAC;QACX,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;QACpG,+DAA+D;QAC/D,qDAAqD;QACrD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;AAC3C,CAAC;AAUD,SAAS,cAAc;IACnB,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACnE,CAAC;AAED,SAAS,cAAc,CAAC,IAAiB;IACrC,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACpD,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CACjB,KAAgB,EAChB,IAAiB,EACjB,cAA2C,EAC3C,OAAe,EACf,GAAqB,EACrB,KAAa,EACb,KAAa,EACb,UAA2D,EAC3D,WAAgE;IAEhE,IAAI,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1B,2DAA2D;YAC3D,0DAA0D;YAC1D,kCAAkC;YAClC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxB,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YACxE,OAAO;QACX,CAAC;QAED,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACvB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,uBAAuB;gBAC7B,OAAO,EAAE,mCAAmC;aAC/C,CAAC,CAAC;YACH,UAAU,EAAE,CAAC;gBACT,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,KAAK;gBACd,KAAK;gBACL,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,mBAAmB,EAAE;aACzE,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,mBAAmB,CAAC;YAChC,UAAU,EAAE,KAAK,CAAC,IAAI;YACtB,UAAU;YACV,MAAM;YACN,MAAM,EAAE,IAAI,CAAC,MAAM;SACtB,CAAC,CAAC;QAEH,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACrB,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxB,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YACxE,OAAO;QACX,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACxB,4DAA4D;YAC5D,2DAA2D;YAC3D,2DAA2D;YAC3D,wDAAwD;YACxD,6DAA6D;YAC7D,sDAAsD;YACtD,MAAM,UAAU,GAAG,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC3B,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC1B,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;gBACzE,OAAO;YACX,CAAC;YACD,IAAI,UAAU,KAAK,MAAM,EAAE,CAAC;gBACxB,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACxB,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;gBACxE,OAAO;YACX,CAAC;YACD,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YAClC,MAAM,OAAO,GAAG,UAAU,KAAK,OAAO,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,MAAM;gBACnE,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC;gBACpC,CAAC,CAAC,IAAI,CAAC;YACX,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACrC,WAAW,CAAC,OAAO,EAAE;gBACjB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5B,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;aACvB,CAAC,CAAC;YACH,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxB,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YACxE,OAAO;QACX,CAAC;QAED,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1F,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACrC,WAAW,CAAC,OAAO,EAAE;YACjB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;SACvB,CAAC,CAAC;QACH,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACrD,UAAU,EAAE,CAAC;YACT,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,KAAK;YACd,KAAK;YACL,MAAM,EAAE,OAAO;YACf,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;SAC3B,CAAC,CAAC;IACP,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAgB,EAAE,IAAiB;IACrD,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,UAAkB,EAAE,OAAe;IACzD,MAAM,YAAY,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC3B,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;QAC3D,MAAM,CAAC,GAAI,GAAyB,CAAC,IAAI,CAAC;QAC1C,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YACxB,IAAI,CAAC,KAAK,QAAQ;gBAAE,OAAO,aAAa,CAAC;YACzC,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,OAAO;gBAAE,OAAO,QAAQ,CAAC;QACzD,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC"}