@openrig/cli 0.6.5 → 0.6.7

package/daemon/dist/routes/bundles.js

@@ -2,26 +2,28 @@ import fs from "node:fs";
 import os from "node:os";
 import nodePath from "node:path";
 import { Hono } from "hono";
+import { bootstrapFailureResponse } from "./bootstrap-failure-response.js";
 import { LegacyBundleAssembler as BundleAssembler } from "../domain/bundle-assembler.js";
 import { PodBundleAssembler } from "../domain/pod-bundle-assembler.js";
 import { computeIntegrity, writeIntegrity, verifyIntegrity } from "../domain/bundle-integrity.js";
-import { pack, unpack, verifyArchiveDigest } from "../domain/bundle-archive.js";
+import { pack, unpack, verifyArchiveDigest, collectUnsafeArchiveEntries, unsafeArchiveEntryReason } from "../domain/bundle-archive.js";
 import { resolvePackage } from "../domain/package-resolve-helper.js";
 import { compareSpecToLive, topologyFromRigSpec, topologyFromLiveLogicalIds, bundleExportWarning, topologyFromLegacyRigSpec, topologyFromLiveNodeIds, } from "../domain/spec-live-conformance.js";
 import { LegacyRigSpecSchema } from "../domain/rigspec-schema.js";
 import { RigSpecCodec } from "../domain/rigspec-codec.js";
 import { RigSpecSchema } from "../domain/rigspec-schema.js";
-import { parseLegacyBundleManifest as parseBundleManifest, normalizeLegacyBundleManifest as normalizeBundleManifest, serializePodBundleManifest, parsePodBundleManifest, validatePodBundleManifest, validateLegacyBundleManifest, normalizeProvenanceBlock, normalizeCompatibilityBlock, isRelativeSafePath } from "../domain/bundle-types.js";
+import { parseLegacyBundleManifest as parseBundleManifest, normalizeLegacyBundleManifest as normalizeBundleManifest, serializePodBundleManifest, parsePodBundleManifest, validatePodBundleManifest, validateLegacyBundleManifest, normalizeProvenanceBlock, normalizeBundleSource, normalizeCompatibilityBlock, isRelativeSafePath } from "../domain/bundle-types.js";
 import { detectBundleConflicts } from "../domain/bundle-conflict-detector.js";
+import { bundleInstallContext, bundleInstallContextLines } from "../domain/bundle-install-context.js";
 import { BundleAuditReader, BundleAuditWriter } from "../domain/bundle-audit.js";
 import { getDefaultOpenRigPath } from "../openrig-compat.js";
-import { routeSkills } from "../domain/bundle-skills-router.js";
-import { routePlugins } from "../domain/bundle-plugins-router.js";
-import { routeWorkflowSpecs } from "../domain/bundle-workflow-specs-router.js";
-import { routeContextPacks } from "../domain/bundle-context-packs-router.js";
-import { routeAgentImages } from "../domain/bundle-agent-images-router.js";
-import { SettingsStore as ContextPackSettingsStore } from "../domain/user-settings/settings-store.js";
+import { routingFailureWarnings } from "../domain/bundle-content-routing.js";
+import { configurationId, packageDigest } from "../domain/bundle-identity.js";
+import { vendorContextPackDir } from "../domain/bundle-carried-context-pack.js";
+import { vendorProjectDir } from "../domain/bundle-carried-project.js";
 import { getDaemonVersion } from "../domain/daemon-version.js";
+import { inspectBundleBehaviour } from "../domain/bundle-behaviour-inspect.js";
+import { normalizePreconditionsBlock } from "../domain/bundle-types.js";
 import { assertShippableSubstance } from "../domain/agent-resolver.js";
 /**
  * Compare two dotted numeric version strings (semver-ish). Returns -1 if
@@ -181,6 +183,9 @@ function provenanceFromRequestBody(raw) {
         return undefined;
     const p = raw;
     const result = {};
+    const source = normalizeBundleSource(p["source"]);
+    if (source)
+        result.source = source;
     if (typeof p["sourceHost"] === "string")
         result.sourceHost = p["sourceHost"];
     if (typeof p["authorSession"] === "string")
@@ -361,314 +366,6 @@ function podAssemblerFsOps() {
         },
     };
 }
-/** Item 6 / slice-05 Checkpoint 7.3d: real PluginsRouterFsOps backed by node:fs. */
-function pluginsRouterFsOps() {
-    return {
-        exists: (p) => fs.existsSync(p),
-        isDirectory: (p) => { try {
-            return fs.statSync(p).isDirectory();
-        }
-        catch {
-            return false;
-        } },
-        mkdirp: (p) => fs.mkdirSync(p, { recursive: true }),
-        copyDir: (s, d) => fs.cpSync(s, d, { recursive: true }),
-    };
-}
-/** Item 6 / slice-05 Checkpoint 7.3e step 3: real WorkflowSpecsRouterFsOps backed by node:fs. */
-function workflowSpecsRouterFsOps() {
-    return {
-        exists: (p) => fs.existsSync(p),
-        copyFile: (s, d) => fs.copyFileSync(s, d),
-        mkdirp: (p) => fs.mkdirSync(p, { recursive: true }),
-    };
-}
-/** Item 6 / slice-05 Checkpoint 7.3f step 3: real ContextPacksRouterFsOps backed by node:fs. */
-function contextPacksRouterFsOps() {
-    return {
-        exists: (p) => fs.existsSync(p),
-        isDirectory: (p) => { try {
-            return fs.statSync(p).isDirectory();
-        }
-        catch {
-            return false;
-        } },
-        readFile: (p) => fs.readFileSync(p, "utf8"),
-        listFiles: (dir) => {
-            const files = [];
-            const walk = (current, prefix) => {
-                for (const entry of fs.readdirSync(current, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-                    const child = nodePath.join(current, entry.name);
-                    const relativePath = prefix ? `${prefix}/${entry.name}` : entry.name;
-                    if (entry.isDirectory())
-                        walk(child, relativePath);
-                    else if (entry.isFile())
-                        files.push(relativePath);
-                }
-            };
-            walk(dir, "");
-            return files;
-        },
-        mkdirp: (p) => fs.mkdirSync(p, { recursive: true }),
-        copyDir: (s, d) => fs.cpSync(s, d, { recursive: true }),
-    };
-}
-/** Item 6 / slice-05 Checkpoint 7.3g step 3: real AgentImagesRouterFsOps backed by node:fs. */
-function agentImagesRouterFsOps() {
-    return {
-        exists: (p) => fs.existsSync(p),
-        isDirectory: (p) => { try {
-            return fs.statSync(p).isDirectory();
-        }
-        catch {
-            return false;
-        } },
-        mkdirp: (p) => fs.mkdirSync(p, { recursive: true }),
-        copyDir: (s, d) => fs.cpSync(s, d, { recursive: true }),
-    };
-}
-/**
- * Item 6 / slice-05 Checkpoint 7.3g step 3: extract the bundle safely
- * (banked unpack trust boundary) and route any declared agent_images to
- * the operator agent-images library. Returns null when bundle has no
- * agent_images[] (no-op).
- *
- * Target resolution: <openrigHome>/agent-images — per startup.ts:523
- * (the user-file root the live AgentImageLibraryService is constructed
- * against). No SettingsStore complexity; canonical path is OPENRIG_HOME-
- * rooted per agent-image-types.ts:9-10.
- *
- * Per the e7a0b253 PRD-coherent contract: agent_images entries are paths
- * to image DIRECTORIES (not manifest paths — distinct shape from
- * context_packs). The router enforces sourceAbs isDirectory + manifest.yaml
- * inside the dir is a file before copying the whole image dir.
- *
- * Mirror of routeContextPacksAfterBootstrap pattern with the dir-path
- * contract adaptation. bundlePath-only signature per 5f410eee B1 lesson.
- */
-async function routeAgentImagesAfterBootstrap(bundlePath) {
-    const targetAgentImagesDir = getDefaultOpenRigPath("agent-images");
-    const tmpDir = fs.mkdtempSync(nodePath.join(os.tmpdir(), "bundle-agent-images-route-"));
-    try {
-        await unpack(bundlePath, tmpDir);
-        const manifestPath = nodePath.join(tmpDir, "bundle.yaml");
-        if (!fs.existsSync(manifestPath))
-            return null;
-        const manifestYaml = fs.readFileSync(manifestPath, "utf-8");
-        const manifest = parsePodBundleManifest(manifestYaml);
-        const rawAgentImages = manifest["agent_images"];
-        if (!Array.isArray(rawAgentImages) || rawAgentImages.length === 0)
-            return null;
-        const declaredAgentImages = rawAgentImages.filter((s) => typeof s === "string" && s.length > 0);
-        if (declaredAgentImages.length === 0)
-            return null;
-        return routeAgentImages({
-            bundleRoot: tmpDir,
-            declaredAgentImages,
-            targetAgentImagesDir,
-        }, agentImagesRouterFsOps());
-    }
-    finally {
-        fs.rmSync(tmpDir, { recursive: true, force: true });
-    }
-}
-/**
- * Item 6 / slice-05 Checkpoint 7.3f step 3: extract the bundle safely
- * (banked unpack trust boundary) and route any declared context_packs to
- * the operator context-packs library. Returns null when bundle has no
- * context_packs[] (no-op).
- *
- * Target resolution uses context.root, exactly like the live
- * ContextPackLibraryService. A configured root replaces the default; bundle
- * routing must not silently create a second writable library.
- *
- * Mirror of routeSkillsAfterBootstrap / routePluginsAfterBootstrap /
- * routeWorkflowSpecsAfterBootstrap pattern: takes bundlePath only
- * (decoupled from installMeta per the 5f410eee B1 lesson; routing must
- * fire on the dual-override path too).
- */
-async function routeContextPacksAfterBootstrap(bundlePath) {
-    const targetContextPacksDir = new ContextPackSettingsStore().resolveOne("context.root").value;
-    const tmpDir = fs.mkdtempSync(nodePath.join(os.tmpdir(), "bundle-context-packs-route-"));
-    try {
-        await unpack(bundlePath, tmpDir);
-        const manifestPath = nodePath.join(tmpDir, "bundle.yaml");
-        if (!fs.existsSync(manifestPath))
-            return null;
-        const manifestYaml = fs.readFileSync(manifestPath, "utf-8");
-        const manifest = parsePodBundleManifest(manifestYaml);
-        const rawContextPacks = manifest["context_packs"];
-        if (!Array.isArray(rawContextPacks) || rawContextPacks.length === 0)
-            return null;
-        const declaredContextPacks = rawContextPacks.filter((s) => typeof s === "string" && s.length > 0);
-        if (declaredContextPacks.length === 0)
-            return null;
-        return routeContextPacks({
-            bundleRoot: tmpDir,
-            declaredContextPacks,
-            targetContextPacksDir,
-        }, contextPacksRouterFsOps());
-    }
-    finally {
-        fs.rmSync(tmpDir, { recursive: true, force: true });
-    }
-}
-/**
- * Item 6 / slice-05 Checkpoint 7.3e step 3: extract the bundle safely
- * (banked unpack trust boundary) and route any declared workflow_specs to
- * the operator workflow-specs library. Returns null when bundle has no
- * workflow_specs[] (no-op), no manifest, or workspaceSpecsRoot unresolved.
- *
- * Target resolution per the CALLER CONTRACT in
- * bundle-workflow-specs-router.ts: SettingsStore is the sole authority.
- * Resolved as nodePath.join(workspaceSpecsRoot, "workflows") — the path
- * that spec-library-workflow-scanner actually reads (startup.ts:903-916).
- * If SettingsStore cannot resolve workspaceSpecsRoot (settings not yet
- * initialized / config error), we return null and the install lifecycle
- * proceeds without workflow_specs routing — mirror of startup.ts:910-916
- * try/catch posture.
- *
- * Mirror of routeSkillsAfterBootstrap / routePluginsAfterBootstrap pattern:
- * takes bundlePath only (decoupled from installMeta per the 5f410eee B1
- * lesson; routing must fire on the dual-override path too).
- */
-async function routeWorkflowSpecsAfterBootstrap(bundlePath) {
-    let workspaceSpecsRoot;
-    try {
-        const settingsStore = new ContextPackSettingsStore();
-        workspaceSpecsRoot = settingsStore.resolveConfig().workspaceSpecsRoot;
-    }
-    catch {
-        return null; // settings unresolvable; no-op routing
-    }
-    if (!workspaceSpecsRoot)
-        return null;
-    const targetWorkflowSpecsDir = nodePath.join(workspaceSpecsRoot, "workflows");
-    const tmpDir = fs.mkdtempSync(nodePath.join(os.tmpdir(), "bundle-workflow-specs-route-"));
-    try {
-        await unpack(bundlePath, tmpDir);
-        const manifestPath = nodePath.join(tmpDir, "bundle.yaml");
-        if (!fs.existsSync(manifestPath))
-            return null;
-        const manifestYaml = fs.readFileSync(manifestPath, "utf-8");
-        const manifest = parsePodBundleManifest(manifestYaml);
-        const rawWorkflowSpecs = manifest["workflow_specs"];
-        if (!Array.isArray(rawWorkflowSpecs) || rawWorkflowSpecs.length === 0)
-            return null;
-        const declaredWorkflowSpecs = rawWorkflowSpecs.filter((s) => typeof s === "string" && s.length > 0);
-        if (declaredWorkflowSpecs.length === 0)
-            return null;
-        return routeWorkflowSpecs({
-            bundleRoot: tmpDir,
-            declaredWorkflowSpecs,
-            targetWorkflowSpecsDir,
-        }, workflowSpecsRouterFsOps());
-    }
-    finally {
-        fs.rmSync(tmpDir, { recursive: true, force: true });
-    }
-}
-/**
- * Item 6 / slice-05 Checkpoint 7.3d: extract the bundle safely (banked unpack
- * trust boundary) and route any declared plugin references to the operator
- * plugins library (<OPENRIG_HOME>/plugins/<id>/). Returns null when bundle
- * has no plugins[] (no-op). Mirror of routeSkillsAfterBootstrap pattern —
- * takes bundlePath only (decoupled from installMeta per the 5f410eee B1
- * lesson; routing must fire on the dual-override path too).
- */
-async function routePluginsAfterBootstrap(bundlePath) {
-    const tmpDir = fs.mkdtempSync(nodePath.join(os.tmpdir(), "bundle-plugins-route-"));
-    try {
-        await unpack(bundlePath, tmpDir);
-        const manifestPath = nodePath.join(tmpDir, "bundle.yaml");
-        if (!fs.existsSync(manifestPath))
-            return null;
-        const manifestYaml = fs.readFileSync(manifestPath, "utf-8");
-        const manifest = parsePodBundleManifest(manifestYaml);
-        const rawPlugins = manifest["plugins"];
-        if (!Array.isArray(rawPlugins) || rawPlugins.length === 0)
-            return null;
-        const declaredPlugins = [];
-        for (const entry of rawPlugins) {
-            if (!entry || typeof entry !== "object" || Array.isArray(entry))
-                continue;
-            const p = entry;
-            const s = p["source"];
-            if (typeof p["id"] !== "string" || !p["id"])
-                continue;
-            if (!s || typeof s !== "object" || Array.isArray(s))
-                continue;
-            const src = s;
-            if (src["kind"] !== "local" || typeof src["path"] !== "string" || !src["path"])
-                continue;
-            declaredPlugins.push({ id: p["id"], source: { kind: "local", path: src["path"] } });
-        }
-        if (declaredPlugins.length === 0)
-            return null;
-        return routePlugins({
-            bundleRoot: tmpDir,
-            declaredPlugins,
-            targetPluginsDir: getDefaultOpenRigPath("plugins"),
-        }, pluginsRouterFsOps());
-    }
-    finally {
-        fs.rmSync(tmpDir, { recursive: true, force: true });
-    }
-}
-/** Item 6 / slice-05 Checkpoint 7.3: real SkillsRouterFsOps backed by node:fs. */
-function skillsRouterFsOps() {
-    return {
-        exists: (p) => fs.existsSync(p),
-        copyFile: (s, d) => fs.copyFileSync(s, d),
-        mkdirp: (p) => fs.mkdirSync(p, { recursive: true }),
-    };
-}
-/**
- * Item 6 / slice-05 Checkpoint 7.3: extract the bundle safely (banked unpack
- * trust boundary) and route legacy declared skill files to the package cache.
- * S04 keeps this package-shaped payload out of the managed skill catalog;
- * importing a complete harness skill into the catalog is a separate action.
- * Returns null when bundle has no skills[] (no-op).
- *
- * B1 repair (qitem-20260518220247-22f5257a): takes bundlePath only and does
- * its own safe unpack + parse. Previously coupled to installMeta from the
- * pre-check extraction, which is null when operator passes --skip-version-
- * check AND --force together; that incorrectly suppressed post-install
- * skills routing on the dual-override path. Skills routing is independent
- * of the pre-check decisions and should fire whenever an install completes
- * successfully with a bundle that declares skills.
- *
- * Best-effort: returns null on any extract/parse failure (caller has the
- * outer try/catch). Single unpack call per invocation; the manifest re-parse
- * is cheap vs. the unpack cost which is required either way to access the
- * skill source files for routing.
- */
-async function routeSkillsAfterBootstrap(bundlePath) {
-    const tmpDir = fs.mkdtempSync(nodePath.join(os.tmpdir(), "bundle-skills-route-"));
-    try {
-        await unpack(bundlePath, tmpDir);
-        const manifestPath = nodePath.join(tmpDir, "bundle.yaml");
-        if (!fs.existsSync(manifestPath))
-            return null;
-        const manifestYaml = fs.readFileSync(manifestPath, "utf-8");
-        const manifest = parsePodBundleManifest(manifestYaml);
-        const rawSkills = manifest["skills"];
-        if (!Array.isArray(rawSkills) || rawSkills.length === 0)
-            return null;
-        const declaredSkills = rawSkills.filter((s) => typeof s === "string" && s.length > 0);
-        if (declaredSkills.length === 0)
-            return null;
-        return routeSkills({
-            bundleRoot: tmpDir,
-            declaredSkills,
-            targetSkillsDir: getDefaultOpenRigPath("packages"),
-            targetPrefixToStrip: "packages/",
-        }, skillsRouterFsOps());
-    }
-    finally {
-        fs.rmSync(tmpDir, { recursive: true, force: true });
-    }
-}
 /** Item 4 / slice-05 Checkpoint 5.2: real BundleAuditFsOps backed by node:fs. */
 function auditFsOps() {
     return {
@@ -714,6 +411,8 @@ function writeInstallAudit(opts) {
         record.daemonVersion = getDaemonVersion();
         if (provenance?.sourceHost)
             record.sourceHost = provenance.sourceHost;
+        if (opts.routingFailures?.length)
+            record.routingFailures = opts.routingFailures;
         writer.append(record);
     }
     catch {
@@ -797,6 +496,14 @@ function consumeAuthorBundleYaml(sourceRoot, staging) {
     const authorYaml = fs.readFileSync(authorBundlePath, "utf-8");
     const authorParsed = parsePodBundleManifest(authorYaml);
     const result = {};
+    result.preconditions = normalizePreconditionsBlock(authorParsed["preconditions"], reason => {
+        (result.warnings ??= []).push(`Ignored author bundle preconditions: ${reason}; the whole block was omitted.`);
+    });
+    for (const [index, precondition] of (result.preconditions ?? []).entries()) {
+        if (precondition.commands?.some(command => /[;|`<>]|&&|\$\(/.test(command))) {
+            (result.warnings ??= []).push(`preconditions[${index}].commands contains shell operators; retained as data, but a site may omit setup commands that fail its plain-command rule.`);
+        }
+    }
     const vendorFile = (declared, kindLabel) => {
         if (!isRelativeSafePath(declared))
             throw new Error(`author bundle ${kindLabel} path '${declared}' is not safe`);
@@ -859,12 +566,16 @@ function consumeAuthorBundleYaml(sourceRoot, staging) {
         // written as regular files for tar safety
         fs.cpSync(sourceAbs, targetAbs, { recursive: true, dereference: true });
     };
-    // skills[] — file paths
+    // A portable skill includes its helpers/references. Retain the legacy
+    // single-file payload contract outside the discovered skills/<name> tree.
     const rawSkills = authorParsed["skills"];
     if (Array.isArray(rawSkills) && rawSkills.length > 0) {
         const skills = rawSkills.filter((s) => typeof s === "string" && s.length > 0);
-        for (const declared of skills)
+        for (const declared of skills) {
             vendorFile(declared, "skill");
+            if (/^skills\/[^/]+\/SKILL\.md$/.test(declared))
+                vendorDir(nodePath.dirname(declared), "skill");
+        }
         if (skills.length > 0)
             result.skills = skills;
     }
@@ -946,6 +657,16 @@ function assertShippableStagingTree(staging) {
     walk(staging);
     assertShippableSubstance(sources);
 }
+/** Describe this artifact; inspecting an older archive never substitutes the current daemon's version. */
+function bundleBuildIdentity(manifest, archiveHash) {
+    return {
+        source: manifest.provenance?.source ?? null,
+        configurationId: manifest.configuration?.id ?? null,
+        packageDigest: manifest.integrity ? packageDigest(manifest.integrity.files) : null,
+        archiveHash,
+        assembler: manifest.assembler ?? null,
+    };
+}
 // POST /api/bundles/create
 bundleRoutes.post("/create", async (c) => {
     const { eventBus } = getDeps(c);
@@ -956,9 +677,23 @@ bundleRoutes.post("/create", async (c) => {
     const outputPath = typeof body["outputPath"] === "string" ? body["outputPath"] : "";
     const rigRoot = typeof body["rigRoot"] === "string" ? body["rigRoot"] : undefined;
     const includePackages = Array.isArray(body["includePackages"]) ? body["includePackages"] : undefined;
+    // `rig bundle create --context-pack <dir>`: packs to carry from anywhere the author names, by manifest name
+    const contextPackDirs = Array.isArray(body["contextPackDirs"])
+        ? body["contextPackDirs"].filter((d) => typeof d === "string" && d.length > 0)
+        : [];
+    // `rig bundle create --project-dir <dir>`: the project this rig works in (project.yaml and its files)
+    const projectDir = typeof body["projectDir"] === "string" && body["projectDir"] ? body["projectDir"] : undefined;
+    // `rig bundle create --preset/--seat`: the configuration the CLI staged, recorded in the manifest (outside the package digest)
+    const rawConfiguration = body["configuration"];
+    const configuration = rawConfiguration && typeof rawConfiguration.id === "string"
+        ? { id: rawConfiguration.id, ...(typeof rawConfiguration.preset === "string" ? { preset: rawConfiguration.preset } : {}) }
+        : undefined;
     const allowDrift = body["allowDrift"] === true;
     // Item 1 / slice-05: build provenance from request body + inject daemonVersion server-side
-    const clientProvenance = provenanceFromRequestBody(body["provenance"]);
+    const rawProvenance = body["provenance"];
+    if (rawProvenance?.source !== undefined && !normalizeBundleSource(rawProvenance.source))
+        return c.json({ error: "Invalid GitHub bundle source identity" }, 400);
+    const clientProvenance = provenanceFromRequestBody(rawProvenance);
     let provenance = clientProvenance
         ? { ...clientProvenance, daemonVersion: getDaemonVersion() }
         : undefined;
@@ -1025,6 +760,8 @@ bundleRoutes.post("/create", async (c) => {
                 // cross-primitive content into staging + carry the fields onto
                 // the manifest. computeIntegrity below covers the vendored content.
                 const authorPrimitives = consumeAuthorBundleYaml(effectiveRigRoot, tmpStaging);
+                if (authorPrimitives.preconditions)
+                    result.manifest.preconditions = authorPrimitives.preconditions;
                 if (authorPrimitives.skills)
                     result.manifest.skills = authorPrimitives.skills;
                 if (authorPrimitives.plugins)
@@ -1035,14 +772,29 @@ bundleRoutes.post("/create", async (c) => {
                     result.manifest.contextPacks = authorPrimitives.contextPacks;
                 if (authorPrimitives.agentImages)
                     result.manifest.agentImages = authorPrimitives.agentImages;
+                const actualMapping = {};
+                for (const pod of RigSpecSchema.normalize(rawParsed).pods) {
+                    for (const member of pod.members)
+                        actualMapping[`${pod.id}.${member.id}`] = member.runtime;
+                }
+                const actualConfigurationId = configurationId(actualMapping);
+                if (configuration && configuration.id !== actualConfigurationId)
+                    return c.json({ error: "Configuration ID does not match the packaged rig spec" }, 400);
+                result.manifest.configuration = { id: actualConfigurationId, ...(configuration?.preset ? { preset: configuration.preset } : {}) };
+                result.manifest.assembler = { openrigVersion: getDaemonVersion() };
+                const carriedPacks = contextPackDirs.map((dir) => vendorContextPackDir(nodePath.resolve(dir), tmpStaging));
+                if (carriedPacks.length > 0)
+                    result.manifest.contextPacks = [...(result.manifest.contextPacks ?? []), ...carriedPacks];
+                if (projectDir)
+                    result.manifest.project = vendorProjectDir(nodePath.resolve(projectDir), tmpStaging);
                 const integrity = computeIntegrity(tmpStaging, integrityFsOps());
                 result.manifest.integrity = integrity;
                 fs.writeFileSync(nodePath.join(tmpStaging, "bundle.yaml"), serializePodBundleManifest(result.manifest), "utf-8");
                 assertShippableStagingTree(tmpStaging);
                 const archiveHash = await pack(tmpStaging, nodePath.resolve(outputPath));
                 eventBus.emit({ type: "bundle.created", bundleName, bundleVersion, archiveHash });
-                const warning = [driftWarning, ...(result.warnings ?? [])].filter(Boolean).join("; ");
-                return c.json({ bundleName, bundleVersion, archiveHash, schemaVersion: 2, agents: result.manifest.agents.length, ...(warning ? { warning } : {}) }, 201);
+                const warning = [driftWarning, ...(result.warnings ?? []), ...(authorPrimitives.warnings ?? [])].filter(Boolean).join("; ");
+                return c.json({ ...bundleBuildIdentity(result.manifest, archiveHash), bundleName, bundleVersion, archiveHash, schemaVersion: 2, agents: result.manifest.agents.length, ...(warning ? { warning } : {}) }, 201);
             }
             finally {
                 fs.rmSync(tmpStaging, { recursive: true, force: true });
@@ -1050,6 +802,12 @@ bundleRoutes.post("/create", async (c) => {
         }
         // Legacy bundle creation
         // Validated above, before the drift guard ran.
+        if (contextPackDirs.length > 0) {
+            return c.json({ error: "--context-pack needs a pod-aware rig spec (one with pods:)" }, 400);
+        }
+        if (projectDir) {
+            return c.json({ error: "--project-dir needs a pod-aware rig spec (one with pods:)" }, 400);
+        }
         const spec = LegacyRigSpecSchema.normalize(rawParsed);
         const specDir = nodePath.dirname(nodePath.resolve(specPath));
         const allRefs = new Set();
@@ -1089,14 +847,17 @@ bundleRoutes.post("/create", async (c) => {
             const manifest = assembler.assemble({
                 specPath: nodePath.resolve(specPath), packages, outputDir: tmpStaging, bundleName, bundleVersion, provenance, compatibility,
             });
+            manifest.assembler = { openrigVersion: getDaemonVersion() };
             // Item 6 / Checkpoint 7.5 (QA-20260601 A2 repair, legacy path mirror):
             // auto-detect author bundle.yaml in source dir; vendor + carry
             // cross-primitive fields before integrity. Re-serialize bundle.yaml
             // since the assembler already wrote one without these fields.
             const legacyAuthorPrimitives = consumeAuthorBundleYaml(specDir, tmpStaging);
             const hasLegacyPrimitives = legacyAuthorPrimitives.skills || legacyAuthorPrimitives.plugins ||
-                legacyAuthorPrimitives.workflowSpecs || legacyAuthorPrimitives.contextPacks || legacyAuthorPrimitives.agentImages;
-            if (hasLegacyPrimitives) {
+                legacyAuthorPrimitives.workflowSpecs || legacyAuthorPrimitives.contextPacks || legacyAuthorPrimitives.agentImages || legacyAuthorPrimitives.preconditions;
+            if (hasLegacyPrimitives || manifest.assembler) {
+                if (legacyAuthorPrimitives.preconditions)
+                    manifest.preconditions = legacyAuthorPrimitives.preconditions;
                 if (legacyAuthorPrimitives.skills)
                     manifest.skills = legacyAuthorPrimitives.skills;
                 if (legacyAuthorPrimitives.plugins)
@@ -1112,10 +873,12 @@ bundleRoutes.post("/create", async (c) => {
             }
             const integrity = computeIntegrity(tmpStaging, integrityFsOps());
             writeIntegrity(tmpStaging, integrity, integrityFsOps());
+            manifest.integrity = integrity;
             assertShippableStagingTree(tmpStaging);
             const archiveHash = await pack(tmpStaging, nodePath.resolve(outputPath));
             eventBus.emit({ type: "bundle.created", bundleName, bundleVersion, archiveHash });
-            return c.json({ bundleName, bundleVersion, archiveHash, packages: manifest.packages.length, ...(driftWarning ? { warning: driftWarning } : {}) }, 201);
+            const warning = [driftWarning, ...(legacyAuthorPrimitives.warnings ?? [])].filter(Boolean).join("; ");
+            return c.json({ ...bundleBuildIdentity(manifest, archiveHash), bundleName, bundleVersion, archiveHash, packages: manifest.packages.length, ...(warning ? { warning } : {}) }, 201);
         }
         finally {
             fs.rmSync(tmpStaging, { recursive: true, force: true });
@@ -1132,39 +895,59 @@ bundleRoutes.post("/inspect", async (c) => {
     if (!bundlePath)
         return c.json({ error: "bundlePath is required" }, 400);
     let digestValid = false;
+    let archiveHash = null;
     try {
         const dr = verifyArchiveDigest(bundlePath);
         digestValid = dr.valid;
+        archiveHash = dr.actual;
     }
     catch { /* missing digest = invalid */ }
     const tmpDir = fs.mkdtempSync(nodePath.join(os.tmpdir(), "bundle-inspect-"));
     try {
-        // Extract with safety pre-scan (same as unpack) but without content integrity verification
+        // Extract with the SAME shared safety pre-scan that unpack() uses, but without
+        // content integrity verification (inspect must be able to REPORT a broken
+        // bundle rather than refuse it). One source of truth: collectUnsafeArchiveEntries
+        // rejects symlinks/hardlinks, POSIX-absolute and Windows drive-absolute paths,
+        // and dot-dot traversal (POSIX or backslash). Previously this route hand-rolled a
+        // weaker scan that missed drive-letter and backslash-traversal entries, so an
+        // archive unpack() refuses could be reported safe by inspect.
+        const unsafeEntries = await collectUnsafeArchiveEntries(bundlePath);
+        if (unsafeEntries.length > 0) {
+            return c.json({ error: `Unsafe archive entries: ${unsafeEntries.join("; ")}`, digestValid }, 200);
+        }
         const tar = await import("tar");
-        const unsafeEntries = [];
-        await tar.list({
+        await tar.extract({
             file: bundlePath,
-            onReadEntry: (entry) => {
-                const p = entry.path;
-                const t = entry.type;
-                if (t === "SymbolicLink" || t === "Link")
-                    unsafeEntries.push(`${t}: ${p}`);
-                if (p.startsWith("/"))
-                    unsafeEntries.push(`absolute: ${p}`);
-                if (p.split("/").some((s) => s === ".."))
-                    unsafeEntries.push(`traversal: ${p}`);
+            cwd: tmpDir,
+            // Same defensive filter unpack() applies: even if the pre-scan above were
+            // bypassed, no unsafe entry is written.
+            filter: (p, entry) => {
+                if ("isSymbolicLink" in entry && typeof entry.isSymbolicLink === "function" && entry.isSymbolicLink())
+                    return false;
+                const type = "type" in entry ? entry.type : undefined;
+                return unsafeArchiveEntryReason(p, type) === null;
             },
         });
-        if (unsafeEntries.length > 0) {
-            return c.json({ error: `Unsafe archive entries: ${unsafeEntries.join("; ")}`, digestValid }, 200);
-        }
-        await tar.extract({ file: bundlePath, cwd: tmpDir });
         const manifestPath = nodePath.join(tmpDir, "bundle.yaml");
         if (!fs.existsSync(manifestPath)) {
             return c.json({ error: "Bundle missing bundle.yaml", digestValid }, 200);
         }
         const manifestYaml = fs.readFileSync(manifestPath, "utf-8");
         const rawParsed = parsePodBundleManifest(manifestYaml);
+        const describeBehaviour = (identity, filesVerified) => {
+            const generator = { openrigVersion: getDaemonVersion() };
+            const source = identity.source ? { ...identity.source } : null;
+            try {
+                return inspectBundleBehaviour(tmpDir, { manifest: rawParsed, ...identity, source, generator, digestValid, filesVerified });
+            }
+            catch {
+                return {
+                    schema: "openrig.bundle-behaviour/v1", state: "not_generated",
+                    identity: { source, configurationId: identity.configurationId, packageDigest: identity.packageDigest, assembler: identity.assembler, generator, integrity: { digestValid, filesVerified } },
+                    reason: "The archive's behaviour could not be described.", localInspectCommand: "rig bundle inspect <archive> --json",
+                };
+            }
+        };
         // Detect v2 (pod-aware) vs v1 (legacy)
         if (rawParsed && rawParsed["schema_version"] === 2) {
             const validation = validatePodBundleManifest(rawParsed);
@@ -1194,10 +977,15 @@ bundleRoutes.post("/inspect", async (c) => {
                 // (v1 path normalizes through normalizeLegacyBundleManifest below).
                 // Field is optional; undefined when bundle has no provenance.
                 provenance: normalizeProvenanceBlock(rawParsed["provenance"]),
+                configuration: typeof rawParsed["configuration"]?.id === "string"
+                    ? rawParsed["configuration"] : undefined,
+                assembler: typeof rawParsed["assembler"]?.openrigVersion === "string"
+                    ? rawParsed["assembler"] : undefined,
                 // Item 2 / slice-05: surface compatibility normalized to camelCase
                 // (same single-contract reason as provenance above). v1 already
                 // surfaces via the normalizer at the end of this handler.
                 compatibility: normalizeCompatibilityBlock(rawParsed["compatibility"]),
+                preconditions: normalizePreconditionsBlock(rawParsed["preconditions"]),
                 // Item 6 / Checkpoint 7.5 / QA-20260601 C1 repair: surface the 5
                 // cross-primitive blocks normalized to camelCase so /inspect's
                 // contract carries the same shape v1's normalizer already
@@ -1218,6 +1006,9 @@ bundleRoutes.post("/inspect", async (c) => {
                 agentImages: Array.isArray(rawParsed["agent_images"])
                     ? rawParsed["agent_images"].filter((s) => typeof s === "string")
                     : undefined,
+                project: rawParsed["project"] && typeof rawParsed["project"] === "object" && !Array.isArray(rawParsed["project"])
+                    ? rawParsed["project"]
+                    : undefined,
             };
             const integrityCompat = integritySection ? {
                 schemaVersion: 2,
@@ -1231,13 +1022,17 @@ bundleRoutes.post("/inspect", async (c) => {
             const integrityResult = integrityCompat
                 ? verifyIntegrity(tmpDir, integrityCompat, integrityFsOps())
                 : { passed: false, mismatches: [], missing: [], extra: [], errors: ["no integrity section"] };
-            return c.json({ manifest: podManifest, digestValid, integrityResult }, 200);
+            const identity = bundleBuildIdentity(podManifest, archiveHash);
+            const behaviour = describeBehaviour(identity, integrityResult.passed);
+            return c.json({ ...identity, manifest: podManifest, digestValid, integrityResult, behaviour }, 200);
         }
         const manifest = normalizeBundleManifest(parseBundleManifest(manifestYaml));
         const integrityResult = manifest.integrity
             ? verifyIntegrity(tmpDir, manifest, integrityFsOps())
             : { passed: false, mismatches: [], missing: [], extra: [], errors: ["no integrity section"] };
-        return c.json({ manifest, digestValid, integrityResult }, 200);
+        const identity = bundleBuildIdentity(manifest, archiveHash);
+        const behaviour = describeBehaviour(identity, integrityResult.passed);
+        return c.json({ ...identity, manifest, digestValid, integrityResult, behaviour }, 200);
     }
     catch (err) {
         return c.json({ error: err.message }, 500);
@@ -1271,7 +1066,9 @@ bundleRoutes.post("/install", async (c) => {
     const bundlePath = typeof body["bundlePath"] === "string" ? body["bundlePath"] : "";
     const plan = body["plan"] === true;
     const autoApprove = body["autoApprove"] === true;
+    const nonInterruptive = typeof body["nonInterruptive"] === "boolean" ? body["nonInterruptive"] : undefined;
     const targetRoot = typeof body["targetRoot"] === "string" ? body["targetRoot"] : undefined;
+    const cwdOverride = typeof body["cwdOverride"] === "string" ? body["cwdOverride"] : undefined;
     // Item 2 / slice-05 Checkpoint 3.3: install-time compatibility check inputs
     const skipVersionCheck = body["skipVersionCheck"] === true;
     const clientCliVersion = typeof body["cliVersion"] === "string" ? body["cliVersion"] : undefined;
@@ -1287,30 +1084,26 @@ bundleRoutes.post("/install", async (c) => {
         return c.json({ error: "Bundle install already in progress", code: "conflict" }, 409);
     }
     try {
-        // Item 2 / slice-05 Checkpoint 3.3: install-time compatibility check
-        // Runs AFTER the lock + BEFORE bootstrap delegation. Mismatch returns a
-        // 3-part error and exits the lifecycle (lock releases via the outer
-        // finally). Operator override via --skip-version-check (request body
-        // skipVersionCheck=true).
         // Item 2 + Item 3 / slice-05: single safe extract pass yields both the
         // bundle manifest (for compat check) and the rig name (for conflict check).
-        // Caller can skip the compat check via skipVersionCheck; the conflict check
-        // also runs from this same extract pass unless --force bypasses it.
-        let installMeta = null;
-        if (!skipVersionCheck || !force) {
-            try {
-                installMeta = await extractInstallTimeMetadata(bundlePath);
-            }
-            catch (err) {
-                return c.json({
-                    error: "Bundle install pre-check could not run (extraction failed)",
-                    detail: err.message,
-                    resolutions: [
-                        "confirm the bundle path is correct and the archive is readable",
-                        "pass --skip-version-check and --force to bypass both pre-checks (NOT recommended unless intentional)",
-                    ],
-                }, 400);
-            }
+        // This pass also runs the manifest SAFETY validation — the first place
+        // rig_spec/project fields are validated on the install path; the bundle
+        // source resolver validates them again later — so it runs unconditionally:
+        // --skip-version-check and --force override the Item-2 compat check and
+        // the Item-3 conflict check, not the safety validation.
+        let installMeta;
+        try {
+            installMeta = await extractInstallTimeMetadata(bundlePath);
+        }
+        catch (err) {
+            return c.json({
+                error: "Bundle install pre-check could not run (extraction failed)",
+                detail: err.message,
+                resolutions: [
+                    "confirm the bundle path is correct and the archive is readable",
+                    "--skip-version-check and --force skip the compatibility and conflict checks; the manifest safety check always runs",
+                ],
+            }, 400);
         }
         if (!skipVersionCheck && installMeta) {
             const compatibility = normalizeCompatibilityBlock(installMeta.bundleManifest["compatibility"]);
@@ -1334,7 +1127,12 @@ bundleRoutes.post("/install", async (c) => {
         // The check fails CLOSED on extraction failure (handled above) and
         // fail-OPEN on missing rig name in the bundle (no rig name to compare).
         if (!force && installMeta && rigRepo) {
-            const runningRigs = rigRepo.listRigs().map((r) => ({ rigId: r.id, name: r.name }));
+            const context = bundleInstallContext(rigRepo.db, installMeta.rigName ?? "", {
+                name: String(installMeta.bundleManifest.name ?? installMeta.rigName ?? ""),
+                version: typeof installMeta.bundleManifest.version === "string" ? installMeta.bundleManifest.version : null,
+                source: bundlePath,
+            });
+            const runningRigs = context.existing.filter(rig => rig.state === "running");
             const report = detectBundleConflicts({
                 bundleRigName: installMeta.rigName ?? "",
                 runningRigs,
@@ -1342,11 +1140,11 @@ bundleRoutes.post("/install", async (c) => {
             if (report.hasConflicts) {
                 return c.json({
                     error: "Bundle install conflict check failed",
+                    status: "not_attempted",
+                    detail: bundleInstallContextLines(context).slice(0, context.existing.length + 1).join("\n"),
+                    bundleInstall: context,
                     conflicts: report.conflicts,
-                    resolutions: [
-                        "stop the conflicting running rig and re-attempt install",
-                        "use --force to bypass for an operator-explicit override (NOT recommended for routine use; conflicts may produce partial install state)",
-                    ],
+                    resolutions: context.resolutions,
                 }, 400);
             }
         }
@@ -1354,7 +1152,7 @@ bundleRoutes.post("/install", async (c) => {
             // Plan mode: no run lifecycle
             try {
                 const result = await bootstrapOrchestrator.bootstrap({
-                    mode: "plan", sourceRef: bundlePath, sourceKind: "rig_bundle",
+                    mode: "plan", sourceRef: bundlePath, sourceKind: "rig_bundle", cwdOverride,
                 });
                 if (result.status === "planned") {
                     eventBus.emit({ type: "bootstrap.planned", runId: result.runId, sourceRef: bundlePath, stages: result.stages.length });
@@ -1362,18 +1160,8 @@ bundleRoutes.post("/install", async (c) => {
                 }
                 // Plan failed — structured mapping (same as bootstrap plan route)
                 eventBus.emit({ type: "bootstrap.failed", runId: result.runId, sourceRef: bundlePath, error: result.errors[0] ?? "plan failed" });
-                const failedStage = result.stages.find((s) => s.status === "failed" || s.status === "blocked");
-                let httpStatus = 500;
-                if (failedStage) {
-                    if (failedStage.status === "blocked")
-                        httpStatus = 409;
-                    else if (failedStage.stage === "resolve_spec") {
-                        const detail = failedStage.detail;
-                        if (detail?.code === "file_not_found" || detail?.code === "parse_error" || detail?.code === "validation_failed" || detail?.code === "bundle_error")
-                            httpStatus = 400;
-                    }
-                }
-                return c.json(result, httpStatus);
+                const failure = bootstrapFailureResponse(result, "plan");
+                return c.json(failure.body, failure.status);
             }
             catch (err) {
                 return c.json({ error: err.message }, 500);
@@ -1386,87 +1174,47 @@ bundleRoutes.post("/install", async (c) => {
         try {
             const result = await bootstrapOrchestrator.bootstrap({
                 mode: "apply", sourceRef: bundlePath, sourceKind: "rig_bundle",
-                autoApprove, targetRoot, runId: run.id,
+                autoApprove, nonInterruptive, targetRoot, cwdOverride, runId: run.id,
             });
-            if (result.status === "completed") {
-                eventBus.emit({ type: "bootstrap.completed", runId: result.runId, rigId: result.rigId, sourceRef: bundlePath });
-                writeInstallAudit({
-                    bundlePath, outcome: "success", targetRigId: result.rigId,
-                    targetRigName: installMeta?.rigName, cliVersion: clientCliVersion,
-                    bundleManifest: installMeta?.bundleManifest,
-                });
-                // Item 6 / Checkpoint 7.3: route any declared skills after successful
-                // install. Best-effort: a routing failure does NOT fail the install
-                // response (the install already succeeded; skills routing is a side-
-                // channel post-install step). Routing result included in response body
-                // so operators see what landed.
-                let skillsRouting = null;
-                let pluginsRouting = null;
-                let workflowSpecsRouting = null;
-                let contextPacksRouting = null;
-                let agentImagesRouting = null;
-                try {
-                    skillsRouting = await routeSkillsAfterBootstrap(bundlePath);
-                }
-                catch {
-                    // Side-channel failure; install already succeeded
-                }
-                try {
-                    pluginsRouting = await routePluginsAfterBootstrap(bundlePath);
-                }
-                catch {
-                    // Side-channel failure; install already succeeded
-                }
-                try {
-                    workflowSpecsRouting = await routeWorkflowSpecsAfterBootstrap(bundlePath);
-                }
-                catch {
-                    // Side-channel failure; install already succeeded
+            if (result.status === "completed" || result.status === "partial") {
+                // A pod-aware (v2) bundle routes its declared skills, plugins, workflow
+                // specs, context packs and agent images in bootstrap's pre-launch hook,
+                // before any seat launches, and reports the outcome on the result. A
+                // legacy v1 bundle has no hook, so it keeps routing after a completed
+                // install. Routing never fails the install; failures are reported in
+                // routingFailures and the audit.
+                const { bundleRouting, ...bootstrapResult } = result;
+                const routing = bundleRouting
+                    ?? (result.status === "completed" ? await bootstrapOrchestrator.routeBundleContents(bundlePath) : undefined);
+                // The hook already put its failures in warnings; the legacy fallback adds its own here.
+                const warnings = bundleRouting ? (result.warnings ?? []) : [...(result.warnings ?? []), ...routingFailureWarnings(routing)];
+                const responseBody = routing ? { ...bootstrapResult, ...routing, warnings } : { ...bootstrapResult, warnings };
+                if (result.status === "completed") {
+                    eventBus.emit({ type: "bootstrap.completed", runId: result.runId, rigId: result.rigId, sourceRef: bundlePath });
                 }
-                try {
-                    contextPacksRouting = await routeContextPacksAfterBootstrap(bundlePath);
+                else {
+                    const ok = result.stages.filter((s) => s.status === "ok").length;
+                    const fail = result.stages.filter((s) => s.status === "failed" || s.status === "blocked").length;
+                    eventBus.emit({ type: "bootstrap.partial", runId: result.runId, sourceRef: bundlePath, rigId: result.rigId, completed: ok, failed: fail });
                 }
-                catch {
-                    // Side-channel failure; install already succeeded
-                }
-                try {
-                    agentImagesRouting = await routeAgentImagesAfterBootstrap(bundlePath);
-                }
-                catch {
-                    // Side-channel failure; install already succeeded
-                }
-                const extras = {};
-                if (skillsRouting)
-                    extras.skillsRouting = skillsRouting;
-                if (pluginsRouting)
-                    extras.pluginsRouting = pluginsRouting;
-                if (workflowSpecsRouting)
-                    extras.workflowSpecsRouting = workflowSpecsRouting;
-                if (contextPacksRouting)
-                    extras.contextPacksRouting = contextPacksRouting;
-                if (agentImagesRouting)
-                    extras.agentImagesRouting = agentImagesRouting;
-                return c.json(Object.keys(extras).length > 0 ? { ...result, ...extras } : result, 201);
-            }
-            if (result.status === "partial") {
-                const ok = result.stages.filter((s) => s.status === "ok").length;
-                const fail = result.stages.filter((s) => s.status === "failed" || s.status === "blocked").length;
-                eventBus.emit({ type: "bootstrap.partial", runId: result.runId, sourceRef: bundlePath, rigId: result.rigId, completed: ok, failed: fail });
                 writeInstallAudit({
-                    bundlePath, outcome: "partial", targetRigId: result.rigId,
+                    bundlePath, outcome: result.status === "completed" ? "success" : "partial", targetRigId: result.rigId,
                     targetRigName: installMeta?.rigName, cliVersion: clientCliVersion,
                     bundleManifest: installMeta?.bundleManifest,
+                    routingFailures: routing?.routingFailures,
                 });
-                return c.json(result, 200);
+                return c.json(responseBody, result.status === "completed" ? 201 : 200);
             }
             eventBus.emit({ type: "bootstrap.failed", runId: result.runId, sourceRef: bundlePath, error: result.errors[0] ?? "failed" });
+            // The pre-launch hook may have routed contents before a later failure; the result carries what it did.
             writeInstallAudit({
                 bundlePath, outcome: "failed",
                 targetRigName: installMeta?.rigName, cliVersion: clientCliVersion,
                 bundleManifest: installMeta?.bundleManifest,
+                routingFailures: result.bundleRouting?.routingFailures,
             });
-            const hasBlocked = result.stages.some((s) => s.status === "blocked");
-            return c.json(result, hasBlocked ? 409 : 500);
+            const failure = bootstrapFailureResponse(result, "apply");
+            return c.json(failure.body, failure.status);
         }
         catch (err) {
             bootstrapRepo.updateRunStatus(run.id, "failed");