@open-mercato/cli 0.6.7-develop.6677.1.beabb7ca12 → 0.6.7-develop.6686.1.bdda5ed397

package/dist/lib/agentic-setup.js

@@ -1,10 +1,27 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync, copyFileSync, symlinkSync, lstatSync, unlinkSync, readdirSync } from "node:fs";
+import {
+  chmodSync,
+  copyFileSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  realpathSync,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from "node:fs";
+import { createHash } from "node:crypto";
 import { spawnSync } from "node:child_process";
-import { join, dirname, basename } from "node:path";
+import { tmpdir } from "node:os";
+import { join, dirname, basename, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { Project, SyntaxKind } from "ts-morph";
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const AGENTIC_DIR = join(__dirname, "..", "agentic");
+const moduleDir = dirname(fileURLToPath(import.meta.url));
+const bundledAgenticDir = join(moduleDir, "..", "agentic");
+const AGENTIC_DIR = existsSync(bundledAgenticDir) ? bundledAgenticDir : join(moduleDir, "..", "..", "..", "create-app", "agentic");
 const GUIDES_DIR = join(AGENTIC_DIR, "guides");
 function resolvePlaceholders(content, config) {
   return content.replace(/\{\{PROJECT_NAME\}\}/g, config.projectName);
@@ -25,13 +42,13 @@ function copyFile(srcDir, srcRelative, destPath) {
   copyFileSync(srcPath, destPath);
 }
 function readEnabledModuleIds(modulesPath) {
-  if (!existsSync(modulesPath)) return [];
+  if (!existsSync(modulesPath)) return { parsed: false, ids: [] };
   try {
     const project = new Project({ useInMemoryFileSystem: true });
     const sourceFile = project.createSourceFile("modules.ts", readFileSync(modulesPath, "utf-8"));
     const declaration = sourceFile.getVariableDeclaration("enabledModules");
     const arrayLiteral = declaration?.getInitializerIfKind(SyntaxKind.ArrayLiteralExpression);
-    if (!arrayLiteral) return [];
+    if (!arrayLiteral) return { parsed: false, ids: [] };
     const ids = [];
     for (const element of arrayLiteral.getElements()) {
       const objectLiteral = element.asKind(SyntaxKind.ObjectLiteralExpression);
@@ -40,44 +57,31 @@ function readEnabledModuleIds(modulesPath) {
       const idValue = idProperty?.getInitializerIfKind(SyntaxKind.StringLiteral)?.getLiteralValue();
       if (idValue) ids.push(idValue);
     }
-    return ids;
+    return { parsed: true, ids };
   } catch {
-    return [];
+    return { parsed: false, ids: [] };
   }
 }
 function selectModuleFactSheets(targetDir, modulesSubdir) {
   const available = existsSync(modulesSubdir) ? readdirSync(modulesSubdir).filter((file) => file.endsWith(".md")).map((file) => file.replace(/\.md$/, "")) : [];
   if (available.length === 0) return [];
-  const enabled = new Set(readEnabledModuleIds(join(targetDir, "src", "modules.ts")));
+  const parsed = readEnabledModuleIds(join(targetDir, "src", "modules.ts"));
+  if (!parsed.parsed) return available;
+  const enabled = new Set(parsed.ids);
   const selected = available.filter((moduleId) => enabled.has(moduleId));
-  return selected.length > 0 ? selected : available;
+  return selected;
 }
 const MODULE_GUIDES_START = "<!-- om:module-guides:start -->";
 const MODULE_GUIDES_END = "<!-- om:module-guides:end -->";
-function readModuleGuideLabels(guidesDir) {
-  const factsPath = join(guidesDir, "module-facts.json");
-  if (!existsSync(factsPath)) return {};
-  try {
-    const parsed = JSON.parse(readFileSync(factsPath, "utf-8"));
-    const labels = {};
-    for (const [moduleId, entry] of Object.entries(parsed)) {
-      const label = entry && typeof entry.description === "string" && entry.description || entry && typeof entry.title === "string" && entry.title || "";
-      if (label) labels[moduleId] = label;
-    }
-    return labels;
-  } catch {
-    return {};
-  }
-}
-function renderModuleGuidesBlock(selected, labels) {
+function renderModuleGuidesBlock(selected) {
   if (selected.length === 0) return "_No module fact-sheets are bundled for this app._";
-  const rows = selected.map((moduleId) => {
-    const label = labels[moduleId] ?? `Use the ${moduleId} module`;
-    return `| ${label} | \`.ai/guides/modules/${moduleId}.md\` |`;
-  });
-  return ["| Task | Load |", "|---|---|", ...rows].join("\n");
+  return [
+    `Enabled module facts: ${selected.map((moduleId) => `\`${moduleId}\``).join(",")}.`,
+    "",
+    "Load `.ai/guides/modules/<id>.md` only when `<id>` is explicitly named or is the targeted installed module/host; never preload all module facts."
+  ].join("\n");
 }
-function injectModuleGuides(agentsMdPath, selected, labels = {}) {
+function injectModuleGuides(agentsMdPath, selected) {
   if (!existsSync(agentsMdPath)) return;
   const content = readFileSync(agentsMdPath, "utf-8");
   const startIndex = content.indexOf(MODULE_GUIDES_START);
@@ -91,154 +95,333 @@ function injectModuleGuides(agentsMdPath, selected, labels = {}) {
   const before = content.slice(0, startIndex + MODULE_GUIDES_START.length);
   const after = content.slice(endIndex);
   const next = `${before}
-${renderModuleGuidesBlock(selected, labels)}
+${renderModuleGuidesBlock(selected)}
 ${after}`;
   if (next !== content) writeFileSync(agentsMdPath, next);
 }
-function generateShared(config) {
+const TEXT_EXTENSIONS = /* @__PURE__ */ new Set([".cjs", ".json", ".md", ".mdc", ".mjs", ".sh", ".ts", ".txt"]);
+function isTextAsset(path) {
+  const dot = path.lastIndexOf(".");
+  return dot === -1 || TEXT_EXTENSIONS.has(path.slice(dot));
+}
+function listFiles(root) {
+  if (!existsSync(root)) return [];
+  const files = [];
+  for (const entry of readdirSync(root, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+    const absolute = join(root, entry.name);
+    if (entry.isDirectory()) files.push(...listFiles(absolute));
+    else if (entry.isFile()) files.push(absolute);
+  }
+  return files;
+}
+function copyTree(sourceRoot, destinationRoot, config) {
+  for (const sourcePath of listFiles(sourceRoot)) {
+    const destinationPath = join(destinationRoot, relative(sourceRoot, sourcePath));
+    ensureDir(destinationPath);
+    if (isTextAsset(sourcePath)) {
+      writeFileSync(destinationPath, resolvePlaceholders(readFileSync(sourcePath, "utf8"), config));
+    } else {
+      copyFileSync(sourcePath, destinationPath);
+    }
+    if (process.platform !== "win32") chmodSync(destinationPath, statSync(sourcePath).mode & 511);
+  }
+}
+function hashFile(path) {
+  return createHash("sha256").update(readFileSync(path)).digest("hex");
+}
+function canonicalHarnessRoot(root) {
+  const resolved = resolve(root);
+  if (!existsSync(resolved)) {
+    throw new Error(`Harness root must be an existing directory: ${resolved}`);
+  }
+  const canonical = realpathSync(resolved);
+  const entry = lstatSync(canonical, { throwIfNoEntry: false });
+  if (!entry || !entry.isDirectory()) {
+    throw new Error(`Harness root must be an existing directory: ${resolved}`);
+  }
+  return canonical;
+}
+function assertManagedPath(root, path, options = {}) {
+  const absolutePath = resolve(path);
+  const normalizedRelative = relative(root, absolutePath);
+  if (normalizedRelative === ".." || normalizedRelative.startsWith(`..${sep}`)) {
+    throw new Error(`Harness-managed path escapes its root: ${absolutePath}`);
+  }
+  if (normalizedRelative === "") return;
+  const components = normalizedRelative.split(sep).filter(Boolean);
+  let current = root;
+  for (let index = 0; index < components.length; index += 1) {
+    current = join(current, components[index]);
+    const entry = lstatSync(current, { throwIfNoEntry: false });
+    if (!entry) return;
+    if (entry.isSymbolicLink()) {
+      throw new Error(`Harness-managed path contains a symbolic-link component: ${current}`);
+    }
+    const isLeaf = index === components.length - 1;
+    if (!isLeaf && !entry.isDirectory()) {
+      throw new Error(`Harness-managed path component is not a directory: ${current}`);
+    }
+    if (isLeaf && options.leaf === "file" && !entry.isFile()) {
+      throw new Error(`Harness-managed file is not a regular file: ${current}`);
+    }
+  }
+}
+function ensureManagedParent(root, filePath) {
+  const parent = dirname(filePath);
+  const normalizedRelative = relative(root, parent);
+  if (normalizedRelative === ".." || normalizedRelative.startsWith(`..${sep}`)) {
+    throw new Error(`Harness-managed path escapes its root: ${filePath}`);
+  }
+  let current = root;
+  for (const component of normalizedRelative.split(sep).filter(Boolean)) {
+    assertManagedPath(root, current);
+    current = join(current, component);
+    const entry = lstatSync(current, { throwIfNoEntry: false });
+    if (!entry) mkdirSync(current);
+    const created = lstatSync(current, { throwIfNoEntry: false });
+    if (!created || created.isSymbolicLink() || !created.isDirectory()) {
+      throw new Error(`Harness-managed path component is not a real directory: ${current}`);
+    }
+  }
+}
+function harnessGeneratorId() {
+  try {
+    const upstream = JSON.parse(readFileSync(join(GUIDES_DIR, "upstream", "manifest.json"), "utf8"));
+    const generator = typeof upstream.generator === "string" ? upstream.generator : "";
+    const version = generator.slice(generator.lastIndexOf("@") + 1);
+    if (version && version !== generator) return `open-mercato-agentic@${version}`;
+  } catch {
+  }
+  return "open-mercato-agentic@unknown";
+}
+function externalSkillNames(targetDir) {
+  try {
+    const tiers = JSON.parse(readFileSync(join(targetDir, ".ai", "skills", "tiers.json"), "utf8"));
+    return new Set(Array.isArray(tiers.external?.skills) ? tiers.external.skills.filter((name) => typeof name === "string") : []);
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
+}
+function atomicCopyFile(sourcePath, destinationPath, managedRoot) {
+  if (managedRoot) {
+    assertManagedPath(managedRoot, destinationPath, { leaf: "file" });
+    ensureManagedParent(managedRoot, destinationPath);
+  } else {
+    ensureDir(destinationPath);
+  }
+  const temporaryPath = `${destinationPath}.tmp-${process.pid}-${Date.now()}`;
+  try {
+    if (managedRoot) assertManagedPath(managedRoot, temporaryPath, { leaf: "file" });
+    copyFileSync(sourcePath, temporaryPath);
+    if (process.platform !== "win32") chmodSync(temporaryPath, statSync(sourcePath).mode & 511);
+    if (managedRoot) {
+      assertManagedPath(managedRoot, dirname(destinationPath));
+      assertManagedPath(managedRoot, destinationPath, { leaf: "file" });
+      assertManagedPath(managedRoot, temporaryPath, { leaf: "file" });
+    }
+    renameSync(temporaryPath, destinationPath);
+  } finally {
+    if (!managedRoot || !lstatSync(temporaryPath, { throwIfNoEntry: false })?.isSymbolicLink()) {
+      rmSync(temporaryPath, { force: true });
+    }
+  }
+}
+function atomicWriteFile(destinationPath, content, managedRoot) {
+  if (managedRoot) {
+    assertManagedPath(managedRoot, destinationPath, { leaf: "file" });
+    ensureManagedParent(managedRoot, destinationPath);
+  } else {
+    ensureDir(destinationPath);
+  }
+  const temporaryPath = `${destinationPath}.tmp-${process.pid}-${Date.now()}`;
+  try {
+    if (managedRoot) assertManagedPath(managedRoot, temporaryPath, { leaf: "file" });
+    writeFileSync(temporaryPath, content);
+    if (managedRoot) {
+      assertManagedPath(managedRoot, dirname(destinationPath));
+      assertManagedPath(managedRoot, destinationPath, { leaf: "file" });
+      assertManagedPath(managedRoot, temporaryPath, { leaf: "file" });
+    }
+    renameSync(temporaryPath, destinationPath);
+  } finally {
+    if (!managedRoot || !lstatSync(temporaryPath, { throwIfNoEntry: false })?.isSymbolicLink()) {
+      rmSync(temporaryPath, { force: true });
+    }
+  }
+}
+function resolveManifestPath(root, relativePath) {
+  if (!relativePath || relativePath.includes("\0")) return null;
+  const absolutePath = resolve(root, relativePath);
+  const normalizedRelative = relative(root, absolutePath);
+  if (normalizedRelative === "" || normalizedRelative === ".." || normalizedRelative.startsWith(`..${sep}`)) {
+    return null;
+  }
+  return absolutePath;
+}
+function normalizeManifestRelativePath(path) {
+  return path.replace(/\\/g, "/");
+}
+function readHarnessManifest(manifestPath) {
+  if (!existsSync(manifestPath)) return null;
+  try {
+    const parsed = JSON.parse(readFileSync(manifestPath, "utf8"));
+    if (typeof parsed.version !== "number" || typeof parsed.generator !== "string" || !Array.isArray(parsed.files)) {
+      return null;
+    }
+    const files = [];
+    for (const entry of parsed.files) {
+      if (!entry || typeof entry.path !== "string" || typeof entry.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(entry.sha256) || typeof entry.source !== "string" || typeof entry.userEditable !== "boolean") {
+        return null;
+      }
+      files.push({ ...entry, path: normalizeManifestRelativePath(entry.path) });
+    }
+    return { version: parsed.version, generator: parsed.generator, files };
+  } catch {
+    return null;
+  }
+}
+function targetPathsForTree(sourceRoot, destinationRoot) {
+  return listFiles(sourceRoot).map((sourcePath) => join(destinationRoot, relative(sourceRoot, sourcePath)));
+}
+function finalizeHarnessManifest(config, selectedTools) {
   const { targetDir } = config;
   const srcDir = join(AGENTIC_DIR, "shared");
   const selectedModules = selectModuleFactSheets(targetDir, join(GUIDES_DIR, "modules"));
-  const moduleGuideLabels = readModuleGuideLabels(GUIDES_DIR);
-  writeTemplate(srcDir, "AGENTS.md.template", join(targetDir, "AGENTS.md"), config);
-  injectModuleGuides(join(targetDir, "AGENTS.md"), selectedModules, moduleGuideLabels);
-  writeTemplate(srcDir, "ai/specs/README.md", join(targetDir, ".ai", "specs", "README.md"), config);
-  copyFile(srcDir, "ai/specs/SPEC-000-template.md", join(targetDir, ".ai", "specs", "SPEC-000-template.md"));
-  copyFile(srcDir, "ai/lessons.md", join(targetDir, ".ai", "lessons.md"));
-  copyFile(srcDir, "ai/skills/tiers.json", join(targetDir, ".ai", "skills", "tiers.json"));
-  copyFile(srcDir, "ai/skills/tiers.schema.json", join(targetDir, ".ai", "skills", "tiers.schema.json"));
-  copyFile(srcDir, "ai/agentic.config.json", join(targetDir, ".ai", "agentic.config.json"));
-  copyFile(srcDir, "ai/trackers/github.md", join(targetDir, ".ai", "trackers", "github.md"));
-  copyFile(srcDir, "scripts/install-skills.sh", join(targetDir, "scripts", "install-skills.sh"));
-  copyFile(
-    srcDir,
-    "ai/skills/om-backend-ui-design/SKILL.md",
-    join(targetDir, ".ai", "skills", "om-backend-ui-design", "SKILL.md")
-  );
-  copyFile(
-    srcDir,
-    "ai/skills/om-backend-ui-design/references/ui-components.md",
-    join(targetDir, ".ai", "skills", "om-backend-ui-design", "references", "ui-components.md")
-  );
-  copyFile(srcDir, "ai/skills/om-integration-builder/SKILL.md", join(targetDir, ".ai", "skills", "om-integration-builder", "SKILL.md"));
-  if (existsSync(join(srcDir, "ai", "skills", "om-integration-builder", "STANDALONE.md"))) {
-    copyFile(
-      srcDir,
-      "ai/skills/om-integration-builder/STANDALONE.md",
-      join(targetDir, ".ai", "skills", "om-integration-builder", "STANDALONE.md")
-    );
+  const paths = /* @__PURE__ */ new Set([
+    join(targetDir, "AGENTS.md"),
+    ...targetPathsForTree(join(srcDir, "ai"), join(targetDir, ".ai")),
+    ...targetPathsForTree(join(srcDir, "scripts"), join(targetDir, "scripts"))
+  ]);
+  for (const file of readdirSync(GUIDES_DIR)) {
+    if (file.endsWith(".md") || file === "module-facts.json") paths.add(join(targetDir, ".ai", "guides", file));
   }
-  copyFile(
-    srcDir,
-    "ai/skills/om-integration-builder/references/adapter-contracts.md",
-    join(targetDir, ".ai", "skills", "om-integration-builder", "references", "adapter-contracts.md")
-  );
-  if (existsSync(join(srcDir, "ai", "skills", "om-integration-builder", "STANDALONE.md"))) {
-    copyFile(
-      srcDir,
-      "ai/skills/om-integration-builder/STANDALONE.md",
-      join(targetDir, ".ai", "skills", "om-integration-builder", "STANDALONE.md")
-    );
+  for (const file of listFiles(join(GUIDES_DIR, "upstream"))) {
+    paths.add(join(targetDir, ".ai", "guides", "upstream", relative(join(GUIDES_DIR, "upstream"), file)));
   }
-  copyFile(
-    srcDir,
-    "ai/skills/om-system-extension/SKILL.md",
-    join(targetDir, ".ai", "skills", "om-system-extension", "SKILL.md")
-  );
-  copyFile(
-    srcDir,
-    "ai/skills/om-system-extension/references/extension-contracts.md",
-    join(targetDir, ".ai", "skills", "om-system-extension", "references", "extension-contracts.md")
-  );
-  copyFile(
-    srcDir,
-    "ai/skills/om-module-scaffold/SKILL.md",
-    join(targetDir, ".ai", "skills", "om-module-scaffold", "SKILL.md")
-  );
-  copyFile(
-    srcDir,
-    "ai/skills/om-module-scaffold/references/naming-conventions.md",
-    join(targetDir, ".ai", "skills", "om-module-scaffold", "references", "naming-conventions.md")
-  );
-  copyFile(
-    srcDir,
-    "ai/skills/om-module-scaffold/references/navigation-patterns.md",
-    join(targetDir, ".ai", "skills", "om-module-scaffold", "references", "navigation-patterns.md")
-  );
-  copyFile(
-    srcDir,
-    "ai/skills/om-troubleshooter/SKILL.md",
-    join(targetDir, ".ai", "skills", "om-troubleshooter", "SKILL.md")
-  );
-  copyFile(
-    srcDir,
-    "ai/skills/om-troubleshooter/references/diagnostic-commands.md",
-    join(targetDir, ".ai", "skills", "om-troubleshooter", "references", "diagnostic-commands.md")
-  );
-  copyFile(
-    srcDir,
-    "ai/skills/om-eject-and-customize/SKILL.md",
-    join(targetDir, ".ai", "skills", "om-eject-and-customize", "SKILL.md")
-  );
-  copyFile(
-    srcDir,
-    "ai/skills/om-data-model-design/SKILL.md",
-    join(targetDir, ".ai", "skills", "om-data-model-design", "SKILL.md")
-  );
-  copyFile(
-    srcDir,
-    "ai/skills/om-data-model-design/references/mikro-orm-cheatsheet.md",
-    join(targetDir, ".ai", "skills", "om-data-model-design", "references", "mikro-orm-cheatsheet.md")
-  );
-  copyFile(
-    srcDir,
-    "ai/skills/om-implement-spec/SKILL.md",
-    join(targetDir, ".ai", "skills", "om-implement-spec", "SKILL.md")
-  );
-  copyFile(
-    srcDir,
-    "ai/skills/om-help/SKILL.md",
-    join(targetDir, ".ai", "skills", "om-help", "SKILL.md")
-  );
-  copyFile(
-    srcDir,
-    "ai/skills/om-help/references/skills-catalog.md",
-    join(targetDir, ".ai", "skills", "om-help", "references", "skills-catalog.md")
-  );
-  copyFile(
-    srcDir,
-    "ai/skills/om-help/references/workflow-sequences.md",
-    join(targetDir, ".ai", "skills", "om-help", "references", "workflow-sequences.md")
-  );
-  copyFile(
-    srcDir,
-    "ai/skills/om-auto-upgrade-0.4.10-to-0.5.0/SKILL.md",
-    join(targetDir, ".ai", "skills", "om-auto-upgrade-0.4.10-to-0.5.0", "SKILL.md")
+  for (const moduleId of selectedModules) paths.add(join(targetDir, ".ai", "guides", "modules", `${moduleId}.md`));
+  if (selectedTools.includes("claude-code")) {
+    paths.add(join(targetDir, "CLAUDE.md"));
+    paths.add(join(targetDir, ".claude", "settings.json"));
+    paths.add(join(targetDir, ".claude", "hooks", "entity-migration-check.ts"));
+    paths.add(join(targetDir, ".mcp.json.example"));
+  }
+  if (selectedTools.includes("codex")) paths.add(join(targetDir, ".codex", "mcp.json.example"));
+  if (selectedTools.includes("cursor")) {
+    for (const file of listFiles(join(AGENTIC_DIR, "cursor"))) {
+      const rel = relative(join(AGENTIC_DIR, "cursor"), file);
+      paths.add(join(targetDir, ".cursor", rel));
+    }
+  }
+  const manifestPath = join(targetDir, ".ai", "harness", "manifest.json");
+  const externalSkills = externalSkillNames(targetDir);
+  paths.delete(manifestPath);
+  const files = [...paths].filter((path) => existsSync(path)).sort((left, right) => left.localeCompare(right)).map((path) => {
+    const relativePath = normalizeManifestRelativePath(relative(targetDir, path));
+    const skillName = relativePath.match(/^\.ai\/skills\/([^/]+)\//)?.[1];
+    return {
+      path: relativePath,
+      sha256: hashFile(path),
+      source: skillName ? externalSkills.has(skillName) ? "external-override" : "local-skill" : "generated",
+      userEditable: relativePath === "AGENTS.md" || relativePath === ".ai/agentic.config.json" || relativePath === ".ai/lessons.md"
+    };
+  });
+  atomicWriteFile(
+    manifestPath,
+    `${JSON.stringify({ version: 1, generator: harnessGeneratorId(), files }, null, 2)}
+`
   );
-  for (const autoSkill of [
-    "om-auto-create-pr",
-    "om-auto-continue-pr",
-    "om-auto-create-pr-loop",
-    "om-auto-continue-pr-loop",
-    "om-auto-review-pr",
-    "om-auto-fix-issue",
-    "om-prepare-test-env"
-  ]) {
-    if (!existsSync(join(srcDir, "ai", "skills", autoSkill, "SKILL.md"))) {
+}
+function preserveIncomingCandidate(targetRoot, destinationPath, sourcePath, relativePath) {
+  for (let suffix = 1; ; suffix += 1) {
+    const label = suffix === 1 ? ".incoming" : `.incoming.${suffix}`;
+    const candidatePath = `${destinationPath}${label}`;
+    assertManagedPath(targetRoot, candidatePath, { leaf: "file" });
+    if (!existsSync(candidatePath)) {
+      atomicCopyFile(sourcePath, candidatePath, targetRoot);
+      return `${relativePath}${label}`;
+    }
+    if (hashFile(candidatePath) === hashFile(sourcePath)) return `${relativePath}${label}`;
+  }
+}
+function applyHarnessUpdate(targetDir, stagingDir, options = {}) {
+  const targetRoot = canonicalHarnessRoot(targetDir);
+  const stagingRoot = canonicalHarnessRoot(stagingDir);
+  const targetManifestPath = join(targetRoot, ".ai", "harness", "manifest.json");
+  const stagingManifestPath = join(stagingRoot, ".ai", "harness", "manifest.json");
+  assertManagedPath(targetRoot, targetManifestPath, { leaf: "file" });
+  assertManagedPath(stagingRoot, stagingManifestPath, { leaf: "file" });
+  const candidateManifest = readHarnessManifest(stagingManifestPath);
+  if (!candidateManifest) {
+    throw new Error("Generated harness candidate has a missing or invalid ownership manifest.");
+  }
+  const previousManifest = readHarnessManifest(targetManifestPath);
+  const previousFiles = new Map(previousManifest?.files.map((entry) => [entry.path, entry]) ?? []);
+  const candidatePaths = new Set(candidateManifest.files.map((entry) => entry.path));
+  const candidates = [];
+  for (const entry of candidateManifest.files) {
+    const sourcePath = resolveManifestPath(stagingRoot, entry.path);
+    const destinationPath = resolveManifestPath(targetRoot, entry.path);
+    if (sourcePath) assertManagedPath(stagingRoot, sourcePath, { leaf: "file" });
+    if (destinationPath) assertManagedPath(targetRoot, destinationPath, { leaf: "file" });
+    if (!sourcePath || !destinationPath || !existsSync(sourcePath) || hashFile(sourcePath) !== entry.sha256) {
+      throw new Error(`Generated harness candidate is invalid for ${JSON.stringify(entry.path)}.`);
+    }
+    candidates.push({ entry, sourcePath, destinationPath });
+  }
+  const conflicts = [];
+  for (const { entry, sourcePath, destinationPath } of candidates) {
+    if (options.force) {
+      atomicCopyFile(sourcePath, destinationPath, targetRoot);
       continue;
     }
-    copyFile(
-      srcDir,
-      `ai/skills/${autoSkill}/SKILL.md`,
-      join(targetDir, ".ai", "skills", autoSkill, "SKILL.md")
-    );
+    if (!existsSync(destinationPath)) {
+      atomicCopyFile(sourcePath, destinationPath, targetRoot);
+      continue;
+    }
+    const currentHash = hashFile(destinationPath);
+    const previousEntry = previousFiles.get(entry.path);
+    if (currentHash === entry.sha256 || previousEntry && currentHash === previousEntry.sha256) {
+      atomicCopyFile(sourcePath, destinationPath, targetRoot);
+      continue;
+    }
+    const candidate = preserveIncomingCandidate(targetRoot, destinationPath, sourcePath, entry.path);
+    conflicts.push({ path: entry.path, candidate });
   }
-  copyFile(
-    srcDir,
-    "ai/skills/om-trim-unused-modules/SKILL.md",
-    join(targetDir, ".ai", "skills", "om-trim-unused-modules", "SKILL.md")
-  );
-  copyFile(srcDir, "ai/qa/tests/playwright.config.ts", join(targetDir, ".ai", "qa", "tests", "playwright.config.ts"));
+  const retainedRetiredEntries = [];
+  for (const previousEntry of previousManifest?.files ?? []) {
+    if (candidatePaths.has(previousEntry.path)) continue;
+    const destinationPath = resolveManifestPath(targetRoot, previousEntry.path);
+    if (!destinationPath || !existsSync(destinationPath)) continue;
+    assertManagedPath(targetRoot, destinationPath, { leaf: "file" });
+    let unchanged = false;
+    try {
+      unchanged = hashFile(destinationPath) === previousEntry.sha256;
+    } catch {
+    }
+    if (unchanged) {
+      assertManagedPath(targetRoot, dirname(destinationPath));
+      assertManagedPath(targetRoot, destinationPath, { leaf: "file" });
+      rmSync(destinationPath, { force: true });
+    } else {
+      retainedRetiredEntries.push(previousEntry);
+      conflicts.push({ path: previousEntry.path, candidate: null });
+    }
+  }
+  const finalManifest = {
+    ...candidateManifest,
+    files: [...candidateManifest.files, ...retainedRetiredEntries]
+  };
+  atomicWriteFile(targetManifestPath, `${JSON.stringify(finalManifest, null, 2)}
+`, targetRoot);
+  return conflicts;
+}
+function generateShared(config) {
+  const { targetDir } = config;
+  const srcDir = join(AGENTIC_DIR, "shared");
+  const selectedModules = selectModuleFactSheets(targetDir, join(GUIDES_DIR, "modules"));
+  writeTemplate(srcDir, "AGENTS.md.template", join(targetDir, "AGENTS.md"), config);
+  copyTree(join(srcDir, "ai"), join(targetDir, ".ai"), config);
+  copyTree(join(srcDir, "scripts"), join(targetDir, "scripts"), config);
   if (existsSync(GUIDES_DIR)) {
     const guidesDestDir = join(targetDir, ".ai", "guides");
     for (const file of readdirSync(GUIDES_DIR)) {
@@ -254,6 +437,7 @@ function generateShared(config) {
       ensureDir(destPath);
       copyFileSync(moduleFactsPath, destPath);
     }
+    copyTree(join(GUIDES_DIR, "upstream"), join(guidesDestDir, "upstream"), config);
     const modulesSubdir = join(GUIDES_DIR, "modules");
     for (const moduleId of selectedModules) {
       const destPath = join(guidesDestDir, "modules", `${moduleId}.md`);
@@ -261,6 +445,7 @@ function generateShared(config) {
       copyFileSync(join(modulesSubdir, `${moduleId}.md`), destPath);
     }
   }
+  injectModuleGuides(join(targetDir, "AGENTS.md"), selectedModules);
 }
 function generateClaudeCode(config) {
   const { targetDir } = config;
@@ -269,7 +454,6 @@ function generateClaudeCode(config) {
   copyFile(srcDir, "settings.json", join(targetDir, ".claude", "settings.json"));
   copyFile(srcDir, "hooks/entity-migration-check.ts", join(targetDir, ".claude", "hooks", "entity-migration-check.ts"));
   copyFile(srcDir, "mcp.json.example", join(targetDir, ".mcp.json.example"));
-  ensureSkillsLink(join(targetDir, ".claude", "skills"), join("..", ".ai", "skills"));
 }
 function generateCodex(config) {
   const { targetDir } = config;
@@ -308,16 +492,6 @@ function generateCursor(config) {
   copyFile(srcDir, "hooks/entity-migration-check.mjs", join(targetDir, ".cursor", "hooks", "entity-migration-check.mjs"));
   copyFile(srcDir, "mcp.json.example", join(targetDir, ".cursor", "mcp.json.example"));
 }
-function ensureSkillsLink(linkPath, target) {
-  ensureDir(linkPath);
-  if (existsSync(linkPath) && !lstatSync(linkPath).isSymbolicLink()) {
-    return;
-  }
-  if (lstatSync(linkPath, { throwIfNoEntry: false })?.isSymbolicLink()) {
-    unlinkSync(linkPath);
-  }
-  symlinkSync(target, linkPath);
-}
 const TOOLS = [
   { key: "1", label: "Claude Code     (Anthropic)", id: "claude-code" },
   { key: "2", label: "Codex           (OpenAI)", id: "codex" },
@@ -326,6 +500,30 @@ const TOOLS = [
   { key: "5", label: "Skip \u2014 set up manually later", id: "skip" }
 ];
 const SELECTABLE = TOOLS.filter((t) => t.id !== "multiple" && t.id !== "skip");
+function persistedAgentSelection(targetDir) {
+  const selectableIds = SELECTABLE.map((tool) => tool.id);
+  const tiersPath = join(targetDir, ".ai", "skills", "tiers.json");
+  try {
+    const tiers = JSON.parse(readFileSync(tiersPath, "utf8"));
+    if (Array.isArray(tiers.agents?.ignore) && tiers.agents.ignore.every((id) => typeof id === "string")) {
+      const ignored = new Set(tiers.agents.ignore);
+      return selectableIds.filter((id) => !ignored.has(id));
+    }
+  } catch {
+  }
+  const manifest = readHarnessManifest(join(targetDir, ".ai", "harness", "manifest.json"));
+  const owned = new Set(manifest?.files.map((entry) => entry.path) ?? []);
+  const selected = SELECTABLE.filter((tool) => {
+    if (tool.id === "claude-code") {
+      return owned.has("CLAUDE.md") || owned.has(".claude/settings.json") || existsSync(join(targetDir, "CLAUDE.md")) || existsSync(join(targetDir, ".claude", "settings.json"));
+    }
+    if (tool.id === "codex") {
+      return owned.has(".codex/mcp.json.example") || existsSync(join(targetDir, ".codex", "mcp.json.example"));
+    }
+    return owned.has(".cursor/hooks.json") || existsSync(join(targetDir, ".cursor", "hooks.json"));
+  }).map((tool) => tool.id);
+  return selected.length > 0 ? selected : null;
+}
 async function promptSelection(ask) {
   console.log("");
   console.log("\u{1F916}  Agentic workflow setup");
@@ -362,6 +560,8 @@ async function runAgenticSetup(targetDir, ask, options) {
   let selectedIds;
   if (options?.tool) {
     selectedIds = options.tool.split(",").map((t) => t.trim());
+  } else if (options?.updateHarness) {
+    selectedIds = persistedAgentSelection(targetDir) ?? await promptSelection(ask);
   } else {
     selectedIds = await promptSelection(ask);
   }
@@ -375,11 +575,33 @@ async function runAgenticSetup(targetDir, ask, options) {
     projectName: basename(targetDir),
     targetDir
   };
-  generateShared(config);
-  if (selectedIds.includes("claude-code")) generateClaudeCode(config);
-  if (selectedIds.includes("codex")) generateCodex(config);
-  if (selectedIds.includes("cursor")) generateCursor(config);
-  persistAgentSelection(targetDir, selectedIds);
+  const stagingDir = mkdtempSync(join(tmpdir(), "open-mercato-harness-"));
+  try {
+    const modulesSourcePath = join(targetDir, "src", "modules.ts");
+    const modulesCandidatePath = join(stagingDir, "src", "modules.ts");
+    if (existsSync(modulesSourcePath)) {
+      ensureDir(modulesCandidatePath);
+      copyFileSync(modulesSourcePath, modulesCandidatePath);
+    }
+    const stagingConfig = {
+      projectName: config.projectName,
+      targetDir: stagingDir
+    };
+    generateHarness(stagingConfig, selectedIds);
+    const conflicts = applyHarnessUpdate(targetDir, stagingDir, {
+      force: options?.force
+    });
+    if (conflicts.length > 0) {
+      console.warn("");
+      console.warn("   \u26A0 Preserved locally modified harness files:");
+      for (const conflict of conflicts) {
+        const detail = conflict.candidate ? `candidate: ${conflict.candidate}` : "retired asset kept because it has local changes";
+        console.warn(`   \u2022 ${conflict.path} (${detail})`);
+      }
+    }
+  } finally {
+    rmSync(stagingDir, { recursive: true, force: true });
+  }
   installSkills(targetDir);
   console.log("");
   console.log("   Agentic setup complete:");
@@ -399,6 +621,14 @@ async function runAgenticSetup(targetDir, ask, options) {
   console.log("   refresh the external open-mercato/skills subset.");
   console.log("");
 }
+function generateHarness(config, selectedIds) {
+  generateShared(config);
+  if (selectedIds.includes("claude-code")) generateClaudeCode(config);
+  if (selectedIds.includes("codex")) generateCodex(config);
+  if (selectedIds.includes("cursor")) generateCursor(config);
+  persistAgentSelection(config.targetDir, selectedIds);
+  finalizeHarnessManifest(config, selectedIds);
+}
 function persistAgentSelection(targetDir, selectedIds) {
   const manifestPath = join(targetDir, ".ai", "skills", "tiers.json");
   if (!existsSync(manifestPath)) return;
@@ -413,16 +643,18 @@ function persistAgentSelection(targetDir, selectedIds) {
 `);
 }
 function installSkills(targetDir) {
-  const installScript = join(targetDir, "scripts", "install-skills.sh");
+  const installScript = join(targetDir, "scripts", "install-skills.mjs");
   if (!existsSync(installScript)) return;
   console.log("");
   console.log("   Installing agent skills (local tiers + external open-mercato/skills subset)...");
-  const result = spawnSync("sh", [installScript], { cwd: targetDir, stdio: "inherit" });
+  const result = spawnSync(process.execPath, [installScript], { cwd: targetDir, stdio: "inherit" });
   if (result.error || result.status !== 0) {
     console.log("   \u26A0 Skill installation did not complete; run `yarn install-skills` inside the app when online.");
   }
 }
 export {
+  applyHarnessUpdate,
+  renderModuleGuidesBlock,
   runAgenticSetup
 };
 //# sourceMappingURL=agentic-setup.js.map