@kuznai/inception-engine 0.7.0 → 0.8.0

package/README.md

@@ -2,7 +2,7 @@
 
 Plant skills directly into the minds of your installed AI coding agents — Claude Code, Codex, Gemini CLI, Antigravity, OpenCode, and GitHub Copilot. One command. They'll think they thought of it themselves.
 
-Today, inception-engine is a skills deployer. The public manifest and CLI planner currently deploy and revert skill directories only. The core executor also has internal support for single-file write and JSON config patch actions, but the manifest format does not expose them yet. MCP configuration and agent-specific config patching remain unimplemented at the manifest level.
+Today, inception-engine deploys skills, single files, and JSON config patches to AI coding agents. MCP configuration and agent rules remain unimplemented at the manifest level.
 
 ## Quick Start
 
@@ -41,8 +41,8 @@ Managed skills overwrite their previous version. If a target exists but was not
 | Feature | Status |
 |---|---|
 | Skills (SKILL.md) | Supported via manifest and CLI |
-| File write | Internal executor support only; not exposed in manifest or CLI planning |
-| Config patch (JSON merge) | Internal executor support only; not exposed in manifest or CLI planning |
+| File write | Supported via manifest and CLI |
+| Config patch (JSON merge) | Supported via manifest and CLI |
 | MCP Servers | Accepted in manifest for forward compatibility, not implemented |
 | Agent Rules | Accepted in manifest for forward compatibility, not implemented |
 
@@ -59,18 +59,50 @@ Create an `inception.json` file at the root of your skills directory:
       "agents": ["claude-code", "codex", "gemini-cli", "antigravity", "opencode", "github-copilot"]
     }
   ],
+  "files": [
+    {
+      "name": "my-settings",
+      "path": "files/settings.json",
+      "target": "{home}/.claude/settings.json",
+      "agents": ["claude-code"]
+    }
+  ],
+  "configs": [
+    {
+      "name": "enable-feature",
+      "target": "{home}/.claude/settings.json",
+      "patch": { "someFeature": true },
+      "agents": ["claude-code"]
+    }
+  ],
   "mcpServers": [],
   "agentRules": []
 }
 ```
 
-Each skill entry has:
+Each **skill** entry has:
 
-- **name** - Unique skill identifier using letters, digits, dots, underscores, or hyphens; it must not start with a dot
+- **name** - Unique identifier using letters, digits, dots, underscores, or hyphens; must not start with a dot
 - **path** - Relative path to the skill directory within the repo
 - **agents** - Array of agent IDs to deploy this skill to. If an agent isn't installed, it's skipped.
 
-`mcpServers` and `agentRules` are currently parsed for forward compatibility, but the deployment engine ignores them today. The manifest-driven planner and revert flow currently derive actions from `skills` entries only.
+Each **file** entry deploys a single file to an agent's configuration location:
+
+- **name** - Unique identifier (same format as skill names)
+- **path** - Relative path to the source file within the repo
+- **target** - Destination path using a placeholder prefix: `{home}`, `{appdata}` (Windows), or `{xdg_config}` (Linux). For example: `{home}/.claude/settings.json`
+- **agents** - Array of agent IDs to deploy this file to
+
+Each **config** entry applies a [JSON merge patch (RFC 7386)](https://datatracker.ietf.org/doc/html/rfc7386) to an existing agent config file:
+
+- **name** - Unique identifier (same format as skill names)
+- **target** - Config file to patch, using the same placeholder prefix as file entries
+- **patch** - JSON object of keys to set. A `null` value removes the key from the target file. Non-null values are set directly (deep merge is not applied).
+- **agents** - Array of agent IDs to apply this patch to
+
+The engine records an undo-patch for each config-patch deployment so that `revert` can restore the original values.
+
+`mcpServers` and `agentRules` are currently parsed for forward compatibility, but the deployment engine ignores them today.
 
 ## Creating Skills
 

package/dist/config/agents.js

@@ -106,6 +106,7 @@ export const AGENT_REGISTRY = [
             detectPaths: "documented",
             detectBinary: "documented",
         },
+        policyNote: "Organization policies may override locally deployed skills. Verify with your GitHub org admin if deployed skills are not active.",
     },
 ];
 export const AGENT_REGISTRY_BY_ID = Object.fromEntries(AGENT_REGISTRY.map((a) => [a.id, a]));

package/dist/config/manifest.js

@@ -38,9 +38,12 @@ function validateManifest(data, filePath) {
         if (issuePath.length === 1 && issuePath[0] === "skills") {
             throw new UserError("MANIFEST_INVALID", `${filePath}: "skills" must be an array`);
         }
-        // Top-level "mcpServers" or "agentRules": wrong type → uniform message
+        // Top-level array fields with wrong type → uniform message
         if (issuePath.length === 1 &&
-            (issuePath[0] === "mcpServers" || issuePath[0] === "agentRules")) {
+            (issuePath[0] === "mcpServers" ||
+                issuePath[0] === "agentRules" ||
+                issuePath[0] === "files" ||
+                issuePath[0] === "configs")) {
             throw new UserError("MANIFEST_INVALID", `${filePath}: "${issuePath[0]}" must be an array`);
         }
         throw new UserError("MANIFEST_INVALID", `${filePath}: ${formatZodPath(issuePath)}${issue.message}`);

package/dist/core/deploy.js

@@ -1,3 +1,4 @@
+import { constants } from "node:fs";
 import { access, copyFile, cp, lstat, mkdir, readFile, realpath, rename, rm, symlink, unlink, writeFile, } from "node:fs/promises";
 import path from "node:path";
 import { AGENT_REGISTRY_BY_ID } from "../config/agents.js";
@@ -59,6 +60,27 @@ function sourceAccessError(err, sourcePath) {
     const detail = err instanceof Error ? err.message : String(err);
     return `Failed to access source ${sourcePath}: ${detail}`;
 }
+function resolveTargetTemplate(template, home) {
+    const appdata = process.env.APPDATA ?? path.join(home, "AppData", "Roaming");
+    const xdgRaw = process.env.XDG_CONFIG_HOME;
+    const xdgConfig = xdgRaw && path.isAbsolute(xdgRaw) ? xdgRaw : path.join(home, ".config");
+    return template
+        .replace("{home}", home)
+        .replace("{appdata}", appdata)
+        .replace("{xdg_config}", xdgConfig);
+}
+async function validateSourceFile(sourcePath, manifestPath) {
+    let stat;
+    try {
+        stat = await lstat(sourcePath);
+    }
+    catch (err) {
+        throw new UserError("DEPLOY_FAILED", sourceAccessError(err, manifestPath));
+    }
+    if (!stat.isFile()) {
+        throw new UserError("DEPLOY_FAILED", `Source is not a file: ${manifestPath}`);
+    }
+}
 function detectCollisions(actions) {
     const seen = new Map();
     const warnings = [];
@@ -87,17 +109,9 @@ function detectAmbiguities(detectedAgents) {
     }
     return warnings;
 }
-export async function planDeploy(manifest, sourceDir, detectedAgents, home) {
+async function planSkillDirActions(manifest, sourceDir, resolvedSourceDir, realRoot, detectedAgents, home) {
     const method = getDeployMethod();
     const actions = [];
-    const resolvedSourceDir = path.resolve(sourceDir);
-    let realRoot;
-    try {
-        realRoot = await realpath(resolvedSourceDir);
-    }
-    catch {
-        realRoot = resolvedSourceDir;
-    }
     for (const skill of manifest.skills) {
         const source = path.resolve(sourceDir, skill.path);
         await validateSourcePath(source, skill.path, resolvedSourceDir, realRoot);
@@ -108,18 +122,78 @@ export async function planDeploy(manifest, sourceDir, detectedAgents, home) {
             const agent = AGENT_REGISTRY_BY_ID[agentId];
             if (!agent)
                 continue;
-            const target = resolveAgentSkillPath(agent, skill.name, home);
             actions.push({
                 kind: "skill-dir",
                 skill: skill.name,
                 agent: agentId,
                 source,
-                target,
+                target: resolveAgentSkillPath(agent, skill.name, home),
                 method,
                 confidence: agent.provenance.skills,
             });
         }
     }
+    return actions;
+}
+async function planFileWriteActions(manifest, sourceDir, resolvedSourceDir, realRoot, detectedAgents, home) {
+    const actions = [];
+    for (const fileEntry of manifest.files ?? []) {
+        const source = path.resolve(sourceDir, fileEntry.path);
+        await validateSourcePath(source, fileEntry.path, resolvedSourceDir, realRoot);
+        await validateSourceFile(source, fileEntry.path);
+        for (const agentId of fileEntry.agents) {
+            if (!detectedAgents.includes(agentId))
+                continue;
+            const agent = AGENT_REGISTRY_BY_ID[agentId];
+            if (!agent)
+                continue;
+            actions.push({
+                kind: "file-write",
+                skill: fileEntry.name,
+                agent: agentId,
+                source,
+                target: resolveTargetTemplate(fileEntry.target, home),
+                confidence: agent.provenance.skills,
+            });
+        }
+    }
+    return actions;
+}
+function planConfigPatchActions(manifest, detectedAgents, home) {
+    const actions = [];
+    for (const configEntry of manifest.configs ?? []) {
+        for (const agentId of configEntry.agents) {
+            if (!detectedAgents.includes(agentId))
+                continue;
+            const agent = AGENT_REGISTRY_BY_ID[agentId];
+            if (!agent)
+                continue;
+            actions.push({
+                kind: "config-patch",
+                skill: configEntry.name,
+                agent: agentId,
+                target: resolveTargetTemplate(configEntry.target, home),
+                patch: configEntry.patch,
+                confidence: agent.provenance.skills,
+            });
+        }
+    }
+    return actions;
+}
+export async function planDeploy(manifest, sourceDir, detectedAgents, home) {
+    const resolvedSourceDir = path.resolve(sourceDir);
+    let realRoot;
+    try {
+        realRoot = await realpath(resolvedSourceDir);
+    }
+    catch {
+        realRoot = resolvedSourceDir;
+    }
+    const actions = [
+        ...(await planSkillDirActions(manifest, sourceDir, resolvedSourceDir, realRoot, detectedAgents, home)),
+        ...(await planFileWriteActions(manifest, sourceDir, resolvedSourceDir, realRoot, detectedAgents, home)),
+        ...planConfigPatchActions(manifest, detectedAgents, home),
+    ];
     const warnings = [
         ...detectAmbiguities(detectedAgents),
         ...detectCollisions(actions),
@@ -180,8 +254,6 @@ async function deploySkillDir(action, dryRun, verbose, home, planned) {
         return { error: msg };
     }
     if (dryRun) {
-        logger.plan(label);
-        logger.detail(`${action.method}: ${action.source} -> ${action.target}`);
         planned.push({
             verb: action.method === "symlink" ? "create-symlink" : "copy-dir",
             kind: "skill-dir",
@@ -215,8 +287,6 @@ async function deployFileWrite(action, dryRun, verbose, home, planned) {
         return { error: msg };
     }
     if (dryRun) {
-        logger.plan(label);
-        logger.detail(`write-file: ${action.source} -> ${action.target}`);
         planned.push({
             verb: "write-file",
             kind: "file-write",
@@ -275,8 +345,6 @@ async function deployConfigPatch(action, dryRun, verbose, home, planned) {
     }
     const patch = action.patch;
     if (dryRun) {
-        logger.plan(label);
-        logger.detail(`patch-config: ${JSON.stringify(patch)} -> ${action.target}`);
         planned.push({
             verb: "patch-config",
             kind: "config-patch",
@@ -354,9 +422,23 @@ async function validateSkillContract(source, skillPath) {
         throw new UserError("DEPLOY_FAILED", `Skill "${skillPath}" source is not a directory: ${source}`);
     }
     try {
-        await access(path.join(source, "SKILL.md"));
+        await access(source, constants.R_OK);
     }
-    catch {
+    catch (err) {
+        const code = err.code;
+        if (code === "EACCES" || code === "EPERM") {
+            throw new UserError("DEPLOY_FAILED", `Permission denied reading skill directory "${skillPath}": ${source}`);
+        }
+        throw new UserError("DEPLOY_FAILED", `Cannot read skill directory "${skillPath}": ${source}`);
+    }
+    try {
+        await access(path.join(source, "SKILL.md"), constants.R_OK);
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "EACCES" || code === "EPERM") {
+            throw new UserError("DEPLOY_FAILED", `Permission denied reading SKILL.md in skill "${skillPath}": ${source}`);
+        }
         throw new UserError("DEPLOY_FAILED", `Skill "${skillPath}" source is missing SKILL.md: ${source}`);
     }
 }
@@ -437,17 +519,15 @@ async function backupExisting(targetPath, verbose, home, expected) {
         throw new Error(`Target "${targetPath}" exists but is not managed by inception-engine — refusing to overwrite`);
     }
     const backupPath = `${targetPath}.inception-backup`;
-    // Clean up any stale backup from a previous failed attempt
-    try {
-        await lstat(backupPath);
-        await removeTarget(backupPath);
-    }
-    catch {
-        // No stale backup — expected
-    }
     if (verbose) {
         logger.detail(`backing up existing target: ${targetPath}`);
     }
+    // Remove any stale backup from a previous failed attempt. Using rm with
+    // { force: true } avoids a separate lstat existence check and handles
+    // the case where the stale backup is a directory (which rename cannot
+    // atomically replace on POSIX). This reduces the window between the
+    // stale-backup removal and the rename to a single step.
+    await rm(backupPath, { recursive: true, force: true });
     await rename(targetPath, backupPath);
     return backupPath;
 }

package/dist/core/preflight.js

@@ -17,6 +17,12 @@ export async function runPreflight(_options, _manifest, _home, detectedAgents) {
                 message: `Agent "${agentId}" skill support is provisional: behavior has not been independently verified.`,
             });
         }
+        if (agent.policyNote) {
+            warnings.push({
+                kind: "policy",
+                message: `Agent "${agentId}": ${agent.policyNote}`,
+            });
+        }
     }
     return warnings;
 }

package/dist/core/revert.js

@@ -1,46 +1,89 @@
 import { lstat, readFile, rm, unlink, writeFile } from "node:fs/promises";
+import path from "node:path";
 import { AGENT_REGISTRY_BY_ID } from "../config/agents.js";
 import { logger } from "../logger.js";
 import { lookupDeployment, unregisterDeployment } from "./ownership.js";
 import { resolveAgentSkillPath } from "./resolve.js";
-export function planRevert(manifest, detectedAgents, home) {
+function resolveTargetTemplate(template, home) {
+    const appdata = process.env.APPDATA ?? path.join(home, "AppData", "Roaming");
+    const xdgRaw = process.env.XDG_CONFIG_HOME;
+    const xdgConfig = xdgRaw && path.isAbsolute(xdgRaw) ? xdgRaw : path.join(home, ".config");
+    return template
+        .replace("{home}", home)
+        .replace("{appdata}", appdata)
+        .replace("{xdg_config}", xdgConfig);
+}
+function buildSkillDirReverts(manifest, home, agentFilter) {
     const actions = [];
     for (const skill of manifest.skills) {
         for (const agentId of skill.agents) {
-            if (!detectedAgents.includes(agentId))
+            if (agentFilter && !agentFilter.includes(agentId))
                 continue;
             const agent = AGENT_REGISTRY_BY_ID[agentId];
             if (!agent)
                 continue;
-            const target = resolveAgentSkillPath(agent, skill.name, home);
             actions.push({
                 kind: "skill-dir",
                 skill: skill.name,
                 agent: agentId,
-                target,
+                target: resolveAgentSkillPath(agent, skill.name, home),
             });
         }
     }
     return actions;
 }
-export function planRevertAll(manifest, home) {
+function buildFileWriteReverts(manifest, home, agentFilter) {
     const actions = [];
-    for (const skill of manifest.skills) {
-        for (const agentId of skill.agents) {
+    for (const fileEntry of manifest.files ?? []) {
+        for (const agentId of fileEntry.agents) {
+            if (agentFilter && !agentFilter.includes(agentId))
+                continue;
             const agent = AGENT_REGISTRY_BY_ID[agentId];
             if (!agent)
                 continue;
-            const target = resolveAgentSkillPath(agent, skill.name, home);
             actions.push({
-                kind: "skill-dir",
-                skill: skill.name,
+                kind: "file-write",
+                skill: fileEntry.name,
+                agent: agentId,
+                target: resolveTargetTemplate(fileEntry.target, home),
+            });
+        }
+    }
+    return actions;
+}
+function buildConfigPatchReverts(manifest, home, agentFilter) {
+    const actions = [];
+    for (const configEntry of manifest.configs ?? []) {
+        for (const agentId of configEntry.agents) {
+            if (agentFilter && !agentFilter.includes(agentId))
+                continue;
+            const agent = AGENT_REGISTRY_BY_ID[agentId];
+            if (!agent)
+                continue;
+            actions.push({
+                kind: "config-patch",
+                skill: configEntry.name,
                 agent: agentId,
-                target,
+                target: resolveTargetTemplate(configEntry.target, home),
             });
         }
     }
     return actions;
 }
+export function planRevert(manifest, detectedAgents, home) {
+    return [
+        ...buildSkillDirReverts(manifest, home, detectedAgents),
+        ...buildFileWriteReverts(manifest, home, detectedAgents),
+        ...buildConfigPatchReverts(manifest, home, detectedAgents),
+    ];
+}
+export function planRevertAll(manifest, home) {
+    return [
+        ...buildSkillDirReverts(manifest, home, null),
+        ...buildFileWriteReverts(manifest, home, null),
+        ...buildConfigPatchReverts(manifest, home, null),
+    ];
+}
 function recordOutcome(result, action, counts, failed) {
     if (result.outcome === "fail") {
         failed.push({ action, error: result.error });
@@ -114,9 +157,8 @@ export async function executeRevert(actions, dryRun, verbose, home) {
 }
 async function executeRevertAction(action, dryRun, verbose, home, planned) {
     const label = `${action.skill} -> ${action.agent}`;
-    let stat;
     try {
-        stat = await lstat(action.target);
+        await lstat(action.target);
     }
     catch (err) {
         const result = lstatOutcome(err);
@@ -133,8 +175,6 @@ async function executeRevertAction(action, dryRun, verbose, home, planned) {
         return { outcome: "skip" };
     }
     if (dryRun) {
-        logger.plan(label);
-        logger.detail(`would remove: ${action.target}`);
         planned.push({
             verb: "remove",
             kind: "skill-dir",
@@ -145,7 +185,10 @@ async function executeRevertAction(action, dryRun, verbose, home, planned) {
         return { outcome: "ok" };
     }
     try {
-        if (stat.isSymbolicLink()) {
+        // Re-stat immediately before deletion to minimise the window between the
+        // type-check and the removal syscall.
+        const currentStat = await lstat(action.target);
+        if (currentStat.isSymbolicLink()) {
             await unlink(action.target);
         }
         else {
@@ -159,6 +202,11 @@ async function executeRevertAction(action, dryRun, verbose, home, planned) {
         return { outcome: "ok" };
     }
     catch (err) {
+        if (err.code === "ENOENT") {
+            // Target disappeared between ownership check and removal — treat as skip.
+            logger.skip(label, "(disappeared before removal, skipping)");
+            return { outcome: "skip" };
+        }
         const msg = err instanceof Error ? err.message : String(err);
         logger.fail(label, msg);
         return { outcome: "fail", error: msg };
@@ -184,8 +232,6 @@ async function revertFileWrite(action, dryRun, verbose, home, planned) {
         return { outcome: "skip" };
     }
     if (dryRun) {
-        logger.plan(label);
-        logger.detail(`would remove: ${action.target}`);
         planned.push({
             verb: "remove",
             kind: "file-write",
@@ -196,6 +242,9 @@ async function revertFileWrite(action, dryRun, verbose, home, planned) {
         return { outcome: "ok" };
     }
     try {
+        // Re-stat immediately before deletion to minimise the type-check to
+        // removal window; handle the case where the file has since disappeared.
+        await lstat(action.target);
         await unlink(action.target);
         await unregisterDeployment(home, action.target);
         logger.ok(label);
@@ -205,6 +254,10 @@ async function revertFileWrite(action, dryRun, verbose, home, planned) {
         return { outcome: "ok" };
     }
     catch (err) {
+        if (err.code === "ENOENT") {
+            logger.skip(label, "(disappeared before removal, skipping)");
+            return { outcome: "skip" };
+        }
         const msg = err instanceof Error ? err.message : String(err);
         logger.fail(label, msg);
         return { outcome: "fail", error: msg };
@@ -234,8 +287,6 @@ async function revertConfigPatch(action, dryRun, verbose, home, planned) {
     }
     const configPatchEntry = entry;
     if (dryRun) {
-        logger.plan(label);
-        logger.detail(`would unapply patch: ${JSON.stringify(configPatchEntry.undoPatch)} -> ${action.target}`);
         planned.push({
             verb: "unapply-patch",
             kind: "config-patch",

package/dist/index.js

@@ -111,6 +111,21 @@ async function main() {
     }
     return runRevert(options, manifest, home);
 }
+function renderDryRunPlan(planned) {
+    for (const change of planned) {
+        logger.plan(`[${change.agent}] ${change.verb}  ${change.skill}`);
+        if (change.source !== undefined) {
+            logger.detail(`source: ${change.source}`);
+        }
+        logger.detail(`target: ${change.target}`);
+        if (change.verb === "patch-config" && change.patch !== undefined) {
+            logger.detail(`patch:  ${JSON.stringify(change.patch)}`);
+        }
+        else if (change.verb === "unapply-patch" && change.patch !== undefined) {
+            logger.detail(`undo:   ${JSON.stringify(change.patch)}`);
+        }
+    }
+}
 async function runDeploy(options, manifest, home) {
     let detectedAgents;
     if (options.agents) {
@@ -132,7 +147,8 @@ async function runDeploy(options, manifest, home) {
     }
     const preflightWarnings = await runPreflight(options, manifest, home, detectedAgents);
     for (const w of preflightWarnings) {
-        logger.warn("preflight", w.message);
+        const label = w.kind === "policy" ? "policy" : "preflight";
+        logger.warn(label, w.message);
     }
     const { actions, warnings: planWarnings } = await planDeploy(manifest, options.directory, detectedAgents, home);
     for (const w of planWarnings) {
@@ -142,14 +158,21 @@ async function runDeploy(options, manifest, home) {
         logger.info("No skills to deploy for detected agents.");
         return 0;
     }
-    logger.info(`${dryRunPrefix(options.dryRun)}Deploying ${actions.length} skill(s):`);
-    const { succeeded, failed } = await executeDeploy(actions, options.dryRun, options.verbose, home);
+    logger.info(`${dryRunPrefix(options.dryRun)}Deploying ${actions.length} action(s):`);
+    const { succeeded, failed, planned } = await executeDeploy(actions, options.dryRun, options.verbose, home);
+    if (options.dryRun) {
+        logger.info("");
+        renderDryRunPlan(planned);
+        logger.info("");
+        logger.info(`${planned.length} action(s) would be applied (dry-run)`);
+        return 0;
+    }
     logger.info("");
     if (failed.length > 0) {
         logger.info(`${succeeded} succeeded, ${failed.length} failed`);
         return 1;
     }
-    logger.info(`${succeeded} skill(s) deployed${options.dryRun ? " (dry-run)" : ""}`);
+    logger.info(`${succeeded} action(s) deployed`);
     return 0;
 }
 async function runRevert(options, manifest, home) {
@@ -160,21 +183,28 @@ async function runRevert(options, manifest, home) {
         logger.info("No skills to revert.");
         return 0;
     }
-    logger.info(`${dryRunPrefix(options.dryRun)}Reverting ${actions.length} skill(s):`);
-    const { succeeded, skipped, failed } = await executeRevert(actions, options.dryRun, options.verbose, home);
+    logger.info(`${dryRunPrefix(options.dryRun)}Reverting ${actions.length} action(s):`);
+    const { succeeded, skipped, failed, planned } = await executeRevert(actions, options.dryRun, options.verbose, home);
+    if (options.dryRun) {
+        logger.info("");
+        renderDryRunPlan(planned);
+        logger.info("");
+        logger.info(`${planned.length} action(s) would be removed (dry-run)`);
+        return 0;
+    }
     logger.info("");
     if (failed.length > 0) {
         const parts = [`${succeeded} removed`];
         if (skipped > 0)
             parts.push(`${skipped} skipped`);
         parts.push(`${failed.length} failed`);
-        logger.info(`${parts.join(", ")}${options.dryRun ? " (dry-run)" : ""}`);
+        logger.info(parts.join(", "));
         return 1;
     }
     const parts = [`${succeeded} removed`];
     if (skipped > 0)
         parts.push(`${skipped} skipped`);
-    logger.info(`${parts.join(", ")}${options.dryRun ? " (dry-run)" : ""}`);
+    logger.info(parts.join(", "));
     return 0;
 }
 const USER_ERROR_EXIT = {

package/dist/schemas/manifest.d.ts

@@ -22,6 +22,38 @@ export declare const SkillEntrySchema: z.ZodObject<{
         "github-copilot": "github-copilot";
     }>>>, z.ZodTransform<("claude-code" | "codex" | "gemini-cli" | "antigravity" | "opencode" | "github-copilot")[], ("claude-code" | "codex" | "gemini-cli" | "antigravity" | "opencode" | "github-copilot")[]>>;
 }, z.core.$strip>;
+export declare const FileEntrySchema: z.ZodObject<{
+    name: z.ZodString;
+    path: z.ZodString;
+    target: z.ZodString;
+    agents: z.ZodPipe<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodEnum<{
+        "claude-code": "claude-code";
+        codex: "codex";
+        "gemini-cli": "gemini-cli";
+        antigravity: "antigravity";
+        opencode: "opencode";
+        "github-copilot": "github-copilot";
+    }>>>, z.ZodTransform<("claude-code" | "codex" | "gemini-cli" | "antigravity" | "opencode" | "github-copilot")[], ("claude-code" | "codex" | "gemini-cli" | "antigravity" | "opencode" | "github-copilot")[]>>;
+}, z.core.$strip>;
+export declare const ConfigEntrySchema: z.ZodObject<{
+    name: z.ZodString;
+    target: z.ZodString;
+    patch: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    agents: z.ZodPipe<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodEnum<{
+        "claude-code": "claude-code";
+        codex: "codex";
+        "gemini-cli": "gemini-cli";
+        antigravity: "antigravity";
+        opencode: "opencode";
+        "github-copilot": "github-copilot";
+    }>>>, z.ZodTransform<("claude-code" | "codex" | "gemini-cli" | "antigravity" | "opencode" | "github-copilot")[], ("claude-code" | "codex" | "gemini-cli" | "antigravity" | "opencode" | "github-copilot")[]>>;
+}, z.core.$strip>;
+export declare const McpServerEntrySchema: z.ZodObject<{
+    name: z.ZodString;
+}, z.core.$loose>;
+export declare const AgentRuleEntrySchema: z.ZodObject<{
+    name: z.ZodString;
+}, z.core.$loose>;
 export declare const ManifestSchema: z.ZodObject<{
     skills: z.ZodArray<z.ZodObject<{
         name: z.ZodString;
@@ -35,10 +67,44 @@ export declare const ManifestSchema: z.ZodObject<{
             "github-copilot": "github-copilot";
         }>>>, z.ZodTransform<("claude-code" | "codex" | "gemini-cli" | "antigravity" | "opencode" | "github-copilot")[], ("claude-code" | "codex" | "gemini-cli" | "antigravity" | "opencode" | "github-copilot")[]>>;
     }, z.core.$strip>>;
-    mcpServers: z.ZodDefault<z.ZodArray<z.ZodUnknown>>;
-    agentRules: z.ZodDefault<z.ZodArray<z.ZodUnknown>>;
+    files: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        path: z.ZodString;
+        target: z.ZodString;
+        agents: z.ZodPipe<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodEnum<{
+            "claude-code": "claude-code";
+            codex: "codex";
+            "gemini-cli": "gemini-cli";
+            antigravity: "antigravity";
+            opencode: "opencode";
+            "github-copilot": "github-copilot";
+        }>>>, z.ZodTransform<("claude-code" | "codex" | "gemini-cli" | "antigravity" | "opencode" | "github-copilot")[], ("claude-code" | "codex" | "gemini-cli" | "antigravity" | "opencode" | "github-copilot")[]>>;
+    }, z.core.$strip>>>;
+    configs: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        target: z.ZodString;
+        patch: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        agents: z.ZodPipe<z.ZodArray<z.ZodPipe<z.ZodString, z.ZodEnum<{
+            "claude-code": "claude-code";
+            codex: "codex";
+            "gemini-cli": "gemini-cli";
+            antigravity: "antigravity";
+            opencode: "opencode";
+            "github-copilot": "github-copilot";
+        }>>>, z.ZodTransform<("claude-code" | "codex" | "gemini-cli" | "antigravity" | "opencode" | "github-copilot")[], ("claude-code" | "codex" | "gemini-cli" | "antigravity" | "opencode" | "github-copilot")[]>>;
+    }, z.core.$strip>>>;
+    mcpServers: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+    }, z.core.$loose>>>;
+    agentRules: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+    }, z.core.$loose>>>;
 }, z.core.$strip>;
 export type SkillEntry = z.infer<typeof SkillEntrySchema>;
+export type FileEntry = z.infer<typeof FileEntrySchema>;
+export type ConfigEntry = z.infer<typeof ConfigEntrySchema>;
+export type McpServerEntry = z.infer<typeof McpServerEntrySchema>;
+export type AgentRuleEntry = z.infer<typeof AgentRuleEntrySchema>;
 export type Manifest = z.infer<typeof ManifestSchema>;
 export declare const AgentListSchema: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string[], string>>, z.ZodArray<z.ZodPipe<z.ZodString, z.ZodEnum<{
     "claude-code": "claude-code";

package/dist/schemas/manifest.js

@@ -10,6 +10,9 @@ const AGENT_IDS = [
 ];
 export { AGENT_IDS };
 const SAFE_NAME_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
+// Target templates must start with a known placeholder to prevent raw absolute
+// paths or directory traversal. e.g. "{home}/.claude/settings.json" is valid.
+const TARGET_TEMPLATE_RE = /^\{(home|appdata|xdg_config)\}/;
 // Standalone schema used for type derivation and single-ID validation (e.g. index.ts).
 export const AgentIdSchema = z.enum(AGENT_IDS);
 // Used inside SkillEntrySchema.agents so that enum failures embed the received
@@ -26,27 +29,62 @@ const agentIdElement = z
     }
 })
     .pipe(AgentIdSchema);
+const nameField = z
+    .string({ message: "name must be a non-empty string" })
+    .min(1, { message: "name must be a non-empty string" })
+    .regex(SAFE_NAME_RE, {
+    message: "name must contain only letters, digits, hyphens, underscores, and dots, and must not start with a dot",
+});
+const agentsField = z
+    .array(agentIdElement, { message: "agents must be a non-empty array" })
+    .min(1, { message: "agents must be a non-empty array" })
+    .transform((arr) => [...new Set(arr)]);
+const sourcePathField = z
+    .string({ message: "path must be a non-empty string" })
+    .min(1, { message: "path must be a non-empty string" })
+    .refine((p) => !nodePath.isAbsolute(p), {
+    message: "path must be a relative path",
+})
+    .refine((p) => !nodePath.normalize(p).startsWith(".."), {
+    message: "path must not escape the repository root",
+});
+const targetTemplateField = z
+    .string({ message: "target must be a non-empty string" })
+    .min(1, { message: "target must be a non-empty string" })
+    .refine((t) => TARGET_TEMPLATE_RE.test(t), {
+    message: "target must start with a known placeholder: {home}, {appdata}, or {xdg_config}",
+});
 export const SkillEntrySchema = z.object({
-    name: z
-        .string({ message: "name must be a non-empty string" })
-        .min(1, { message: "name must be a non-empty string" })
-        .regex(SAFE_NAME_RE, {
-        message: "name must contain only letters, digits, hyphens, underscores, and dots, and must not start with a dot",
-    }),
-    path: z
-        .string({ message: "path must be a non-empty string" })
-        .min(1, { message: "path must be a non-empty string" })
-        .refine((p) => !nodePath.isAbsolute(p), {
-        message: "path must be a relative path",
-    })
-        .refine((p) => !nodePath.normalize(p).startsWith(".."), {
-        message: "path must not escape the repository root",
-    }),
-    agents: z
-        .array(agentIdElement, { message: "agents must be a non-empty array" })
-        .min(1, { message: "agents must be a non-empty array" })
-        .transform((arr) => [...new Set(arr)]),
+    name: nameField,
+    path: sourcePathField,
+    agents: agentsField,
 });
+export const FileEntrySchema = z.object({
+    name: nameField,
+    path: sourcePathField,
+    target: targetTemplateField,
+    agents: agentsField,
+});
+export const ConfigEntrySchema = z.object({
+    name: nameField,
+    target: targetTemplateField,
+    patch: z.record(z.string(), z.unknown()),
+    agents: agentsField,
+});
+export const McpServerEntrySchema = z
+    .object({
+    name: z
+        .string({ message: "mcpServers entry name must be a non-empty string" })
+        .min(1, { message: "mcpServers entry name must be a non-empty string" }),
+})
+    .passthrough();
+export const AgentRuleEntrySchema = z
+    .object({
+    name: z
+        .string({ message: "agentRules entry name must be a non-empty string" })
+        .min(1, { message: "agentRules entry name must be a non-empty string" }),
+})
+    .passthrough();
 export const ManifestSchema = z.object({
     skills: z.array(SkillEntrySchema).superRefine((skills, ctx) => {
         const seen = new Set();
@@ -61,8 +99,10 @@ export const ManifestSchema = z.object({
             seen.add(skill.name);
         }
     }),
-    mcpServers: z.array(z.unknown()).default([]),
-    agentRules: z.array(z.unknown()).default([]),
+    files: z.array(FileEntrySchema).default([]),
+    configs: z.array(ConfigEntrySchema).default([]),
+    mcpServers: z.array(McpServerEntrySchema).default([]),
+    agentRules: z.array(AgentRuleEntrySchema).default([]),
 });
 // Parses the --agents CLI flag: comma-separated agent IDs → AgentId[]
 export const AgentListSchema = z

package/dist/types.d.ts

@@ -1,5 +1,5 @@
 import type { AgentId } from "./schemas/manifest.ts";
-export type { AgentId, Manifest, SkillEntry } from "./schemas/manifest.ts";
+export type { AgentId, ConfigEntry, FileEntry, Manifest, SkillEntry, } from "./schemas/manifest.ts";
 export interface AgentPaths {
     posix: string[];
     windows: string[];
@@ -17,6 +17,7 @@ export interface AgentConfig {
     detectPaths: AgentPaths;
     detectBinary: string | null;
     provenance: AgentProvenance;
+    policyNote?: string;
 }
 export interface PlanWarning {
     kind: "confidence" | "collision" | "ambiguity";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kuznai/inception-engine",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Deploy AI agent skills from a git repo to user home directories",
   "license": "MIT",
   "author": "Damian Piątkowski",