@hybridlabor-api/aos 4.4.2-beta.0 → 4.4.2-beta.2

package/CLAUDE.md

@@ -616,6 +616,58 @@ must not do.
 
 ## Headless timeouts
 
+A trivial headless `agy` prompt was measured at **605s** in 2026-09.
+`agy-delegate` defaults to `--print-timeout 5m`, so it aborts at 300s and
+reports an empty body while the answer is still arriving. Pass `--timeout 15m`
+for anything non-trivial. A short timeout does not read as "slow", it reads as
+"broken".
+
+# AOS — Antigravity / Gemini
+
+**Read [AGENTS.md](AGENTS.md) first.** It holds every rule that applies to all
+harnesses: the non-negotiables, the release gate, Conventional Commits, the
+skill contract and category routing, the pipeline variants, and the delegation
+policy. Nothing from it is repeated here — a rule that lives in two files is a
+rule that will eventually disagree with itself.
+
+This file covers only what is specific to running AOS under Antigravity.
+
+## Nothing enforces the gate here — you are the enforcement
+
+`.claude/hooks/go-gate.mjs` is a Claude Code hook and does not run on this
+harness. Not one of the four release commands is mechanically blocked for you,
+and neither is anything else.
+
+So the full rule in AGENTS.md applies here in its entirety, not just its
+hook-enforced subset: when the user asks for a plan, review, audit or
+multi-step action, you are read-only until they answer with the literal **GO**
+— including file writes and `git commit`. On Claude Code a hook would catch the
+four worst cases if discipline failed. Here there is no backstop, which makes
+this the harness where the rule matters most, not least.
+
+## Model routing
+
+The tier names in `agy-delegate` map to models that go stale — the built-in
+`flash` still points at Gemini 3.7 while 3.8 ships. Re-check against
+`agy models` after every upgrade; the id carries both the version and the
+effort suffix.
+
+| Work | Model |
+|---|---|
+| Media, fast or mechanical coding, boilerplate | `Gemini 3.8 Flash (Medium)` |
+| Trivial one-liners | `Gemini 3.8 Flash (Low)` |
+| Review, architecture, hard reasoning | `Claude Sonnet 4.6 (Thinking)` |
+
+Set these once via `CLAUDE_PLUGIN_OPTION_TIER_{FLASH,FLASH_LO,PRO}` in
+`~/.zshenv` — **not** `~/.zshrc`, which non-interactive tool shells never
+source.
+
+Adversarial review is the case that most repays the stronger model: a Flash
+tier tends to agree with what it is shown, which is the one thing a reviewer
+must not do.
+
+## Headless timeouts
+
 A trivial headless `agy` prompt was measured at **605s** in 2026-09.
 `agy-delegate` defaults to `--print-timeout 5m`, so it aborts at 300s and
 reports an empty body while the answer is still arriving. Pass `--timeout 15m`

package/installer.js

@@ -608,6 +608,88 @@ function initSessionManifest(existingManifest, sourceDirs) {
     _sessionHashes = buildKnownSourceHashes(sourceDirs);
 }
 
+// Skills that left the package in 4.4.2 (Plan 02: migrated to the private
+// aos-internal repo, per ~/dev/_plans/aos-2026-09-14/), by their flattened
+// directory name at a sync destination.
+//
+// This is deliberately a fixed list, not a diff against what the current
+// payload ships. A generic "anything on disk that is not in skills/ right
+// now" pass was tried first and swept up two unrelated things: skill folders
+// that MCP servers bundle inside their own package tree (e.g.
+// mcps/tdmcp/.agents/skills/...), which happen to share the literal path
+// segment "skills" but belong to a different install entirely; and skills
+// under skills/workspace_agents/, which syncSkillsToGlobalHarnesses already
+// deliberately excludes from the six global destinations, so a stray global
+// copy of one says nothing about whether it is safe to delete. Both are real
+// cleanup opportunities, but they are a separate investigation, not a side
+// effect of this migration's beta test.
+const SKILLS_REMOVED_IN_4_4_2 = new Set([
+    'bdbsaastraining', 'bdb-dev-os-skill', 'bdbsaashost', 'bdb-ecosystem-health', 'bdbsaas-ops',
+]);
+
+// The exact roots syncSkillsToGlobalHarnesses and the Gemini/Antigravity
+// config-skills path write into. Pruning only touches a manifest entry whose
+// path starts under one of these -- never one that merely contains a
+// "skills" segment somewhere deeper, which is what let the MCP-bundle and
+// workspace_agents cases above leak in during testing.
+function globalSkillDestRoots() {
+    return [
+        path.join(homeDir, '.agents', 'skills'),
+        path.join(homeDir, '.claude', 'skills'),
+        path.join(homeDir, '.codex', 'skills'),
+        path.join(homeDir, '.cursor', 'skills'),
+        path.join(homeDir, '.roo', 'skills'),
+        path.join(geminiDir, 'config', 'skills'),
+    ];
+}
+
+// syncSkillsToGlobalHarnesses (and its sibling copy loops) only ever add or
+// update -- nothing in that path ever deletes a skill that the current
+// payload no longer ships. That is fine for new skills and updated ones, but
+// it means a skill removed from a release stays on every user's disk
+// forever, through every future update, because nothing after the removal
+// ever looks at what is on disk that no longer has a source. This walks the
+// install manifest -- which already has one entry per file this installer
+// has ever placed -- for the specific skills 4.4.2 removed, under the six
+// known global skill roots, and deletes them. A user-modified file is backed
+// up first, the same way resolveFileConflict backs up a user edit it is
+// about to overwrite, rather than silently deleting local changes.
+function pruneRemovedSkills(manifest) {
+    if (!manifest) return;
+    const roots = globalSkillDestRoots();
+
+    const staleDirs = new Set();
+    let removedFiles = 0;
+    for (const targetPath of Object.keys(manifest)) {
+        const root = roots.find((r) => targetPath.startsWith(r + path.sep));
+        if (!root) continue;
+        const skillDirName = targetPath.slice(root.length + 1).split(path.sep)[0];
+        if (!SKILLS_REMOVED_IN_4_4_2.has(skillDirName)) continue;
+
+        if (fs.existsSync(targetPath)) {
+            const diskHash = computeFileHash(targetPath);
+            const manifestEntry = manifest[targetPath];
+            if (diskHash !== null && manifestEntry && diskHash !== manifestEntry.sha256) {
+                const bakPath = `${targetPath}.${timestamp}.bak`;
+                try { fs.copyFileSync(targetPath, bakPath); } catch (e) { logDebug(e, 'prune-removed-skill backup'); }
+                log.warn(`[manifest] Retired skill left a user-edited file, backed up to ${bakPath} instead of deleting it.`);
+            } else {
+                try { fs.unlinkSync(targetPath); removedFiles++; } catch (e) { logDebug(e, 'prune-removed-skill unlink'); }
+            }
+            staleDirs.add(path.join(root, skillDirName));
+        }
+        delete manifest[targetPath];
+    }
+
+    for (const dir of staleDirs) {
+        try { fs.rmSync(dir, { recursive: true, force: true }); } catch (e) { logDebug(e, 'prune-removed-skill rmdir'); }
+    }
+
+    if (staleDirs.size > 0) {
+        log.step(`Removed ${removedFiles} file(s) from ${staleDirs.size} retired skill install(s) no longer shipped.`);
+    }
+}
+
 function flushSessionManifest() {
     if (_sessionManifest) saveInstallManifest(_sessionManifest);
 }
@@ -3464,6 +3546,7 @@ async function runQuickUpdate(installState) {
         }
     }
     syncSkillsToGlobalHarnesses(excludeSkills);
+    pruneRemovedSkills(_sessionManifest);
     s.stop('Skills refreshed');
 
     // Everything injectHarnessRules() delivers -- GEMINI.md, the dispatcher
@@ -3579,12 +3662,14 @@ async function main() {
                 { value: 'quick', label: `⚡ Quick Update (v${installState.localVersion} ➔ v${installState.currentVersion})`, hint: 'refresh skills, templates & daemons' },
                 { value: 'project', label: '📁 Drop Local Project Harness', hint: 'copy dispatcher contract to cwd' },
                 { value: 'reconfigure', label: '🛠️ Reconfigure System', hint: 'change targets, tier or options' },
+                { value: 'uninstall', label: '🗑️ Uninstall AOS', hint: 'remove what this installer placed; your data stays' },
                 { value: 'cancel', label: '❌ Exit' }
               ]
             : [
                 { value: 'project', label: '📁 Drop Local Project Harness', hint: 'copy dispatcher contract to cwd' },
                 { value: 'quick', label: '🔄 Verify & Refresh All Skills', hint: 're-sync and health check' },
                 { value: 'reconfigure', label: '🛠️ Reconfigure System', hint: 'switch tier or targets' },
+                { value: 'uninstall', label: '🗑️ Uninstall AOS', hint: 'remove what this installer placed; your data stays' },
                 { value: 'cancel', label: '❌ Exit' }
               ];
 
@@ -3608,6 +3693,19 @@ async function main() {
             outro('Quick Update complete.');
             return;
         }
+        if (action === 'uninstall') {
+            // aos-uninstall.mjs is its own script, not a function of this file --
+            // it is ESM (installer.js is CommonJS) and drives its own readline
+            // confirmation prompt, so it runs as a real child process with
+            // inherited stdio rather than being imported in-process.
+            const uninstallScript = path.join(srcDir, 'bin', 'aos-uninstall.mjs');
+            if (!fs.existsSync(uninstallScript)) {
+                log.error(`Uninstaller not found at ${uninstallScript} -- run it directly: npx @hybridlabor-api/aos-uninstall`);
+                return;
+            }
+            spawnSync('node', [uninstallScript], { stdio: 'inherit' });
+            return;
+        }
     }
 
     const detectedNames = detections.map(d => d.name).join(', ');
@@ -3868,6 +3966,7 @@ async function main() {
     }
 
     syncSkillsToGlobalHarnesses(excludeSkills);
+    pruneRemovedSkills(_sessionManifest);
     s.stop('Skills installed.');
 
     injectHarnessRules();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hybridlabor-api/aos",
-  "version": "4.4.2-beta.0",
+  "version": "4.4.2-beta.2",
   "description": "AOS — A Curated AI AGENT OS. Optimized agent skills and add-ons like memB, OpenWiki, Heimdall Token Saver, and Godmode architectures.",
   "main": "installer.js",
   "bin": {