@pathbit/agentdevkit 0.0.17 → 0.0.19

package/.pbai4devs/scripts/sincronizar-agentes/tests/LOCAL_IGNORE.mjs

@@ -42,7 +42,7 @@ test('sem Git preserva ignore e informa pendência; após git init protege outpu
   git(root, ['add', '--all']);
   const tracked = git(root, ['ls-files', '-z']).split('\0').filter(Boolean);
   for (const path of outputs) assert.equal(tracked.includes(path), false, path);
-  for (const path of ['.github/workflows/ci.yml', '.github/ISSUE_TEMPLATE/bug.yml', '.vscode/settings.json', '.github/skills/human/SKILL.md']) assert.ok(tracked.includes(path), path);
+  for (const path of ['.github/workflows/ci.yml', '.github/ISSUE_TEMPLATE/bug.yml', '.vscode/settings.json', '.github/skills/human/SKILL.md']) assert.equal(tracked.includes(path), false, path);
 });
 
 test('prefixos e projetos distintos preservam blocos locais independentes', t => {
@@ -58,13 +58,49 @@ test('prefixos e projetos distintos preservam blocos locais independentes', t =>
   assert.match(content, /first\\ space/); assert.match(content, /second/);
 });
 
-test('check identifica negação humana e outputs rastreados sem alterar o índice', t => {
+test('projeto aninhado sob ancestral ignorado falha antes de alterar índices ou excludes', t => {
+  const root = fixture(t); git(root, ['init', '-q']);
+  put(root, '.gitignore', '/.github/\n');
+  const child = join(root, '.github/project');
+  put(child, '.gitignore', '!/.claude/\n');
+  put(child, '.claude/custom.md', 'instruções próprias\n');
+  const exclude = readFileSync(join(root, '.git/info/exclude'));
+  const index = git(root, ['ls-files', '--stage', '-z']);
+  const plan = planLocalIgnore(child, { outputs: ['.claude/custom.md'] });
+  assert.ok(checkLocalIgnore(plan).missing.some(value => value.includes('Ancestral Git ignorado: .github/')));
+  assert.throws(() => applyLocalIgnore(plan), /Ancestral Git ignorado/);
+  assert.deepEqual(readFileSync(join(root, '.git/info/exclude')), exclude);
+  assert.equal(git(root, ['ls-files', '--stage', '-z']), index);
+  assert.equal(readFileSync(join(child, '.claude/custom.md'), 'utf8'), 'instruções próprias\n');
+  put(root, '.gitignore', '/.github/\n!/.github/\n');
+  const opened = planLocalIgnore(child, { outputs: ['.claude/custom.md'] });
+  applyLocalIgnore(opened);
+  assert.equal(checkLocalIgnore(planLocalIgnore(child, { outputs: ['.claude/custom.md'] })).ok, true);
+  assert.equal(spawnSync('git', ['-C', root, 'check-ignore', '--no-index', '-q', '.github/project/.claude/custom.md']).status, 1);
+});
+
+test('opt-in aninhado respeita também excludesFile configurado pelo usuário', t => {
+  const root = fixture(t); git(root, ['init', '-q']);
+  put(root, 'global-ignore', '/.private/\n');
+  git(root, ['config', '--local', 'core.excludesFile', join(root, 'global-ignore')]);
+  const child = join(root, '.private/project');
+  put(child, '.gitignore', '!/.claude/\n');
+  put(child, '.claude/custom.md', 'instruções próprias\n');
+  const before = readFileSync(join(root, '.git/info/exclude'));
+  const plan = planLocalIgnore(child);
+  assert.ok(checkLocalIgnore(plan).missing.some(value => value.includes('Ancestral Git ignorado: .private/')));
+  assert.throws(() => applyLocalIgnore(plan), /Ancestral Git ignorado/);
+  assert.deepEqual(readFileSync(join(root, '.git/info/exclude')), before);
+  assert.equal(readFileSync(join(child, '.claude/custom.md'), 'utf8'), 'instruções próprias\n');
+});
+
+test('check identifica negação humana sem alterar nem diagnosticar conteúdo rastreado legítimo', t => {
   const root = fixture(t), outputs = ['generated.md']; git(root, ['init', '-q']);
   put(root, 'generated.md', 'gerado'); git(root, ['add', 'generated.md']);
   applyLocalIgnore(planLocalIgnore(root, { outputs }));
   put(root, '.gitignore', '!/generated.md\n');
   const result = checkLocalIgnore(planLocalIgnore(root, { outputs }));
-  assert.equal(result.ok, false); assert.deepEqual(result.missing, outputs); assert.deepEqual(result.trackedOutputs, outputs);
+  assert.equal(result.ok, false); assert.deepEqual(result.missing, outputs); assert.deepEqual(result.trackedOutputs, []);
   assert.equal(git(root, ['ls-files', 'generated.md']).trim(), 'generated.md');
 });
 
@@ -89,7 +125,7 @@ test('exceções de templates preservam o ignore raiz e protegem dados privados'
   assert.ok(git(root, ['check-ignore', '--no-index', '.cursor/.CACHE/private.json']).includes('.cursor/.CACHE/private.json'));
   assert.ok(git(root, ['check-ignore', '--no-index', '.cursor/.cache/private.json']).includes('.cursor/.cache/private.json'));
   const visible = spawnSync('git', ['-C', root, 'check-ignore', '--no-index', '-q', '.cursor/human.md']);
-  assert.equal(visible.status, 1);
+  assert.equal(visible.status, 0);
   applyLocalIgnore(planLocalIgnore(root));
   assert.equal(readFileSync(join(root, '.gitignore'), 'utf8'), updated);
   put(root, '.gitignore', updated + '# edição humana posterior\n');
@@ -134,12 +170,12 @@ test('negação humana posterior é informada sem reescrever a raiz', t => {
   const root = fixture(t); git(root, ['init', '-q']);
   put(root, '.gitignore', '# humano\n'); applyLocalIgnore(planLocalIgnore(root));
   const path = join(root, '.gitignore');
-  writeFileSync(path, readFileSync(path, 'utf8') + '!/.cursor/.env.production\n');
+  writeFileSync(path, readFileSync(path, 'utf8') + '!/.cursor/\n!/.cursor/.env.production\n');
   put(root, '.cursor/.env.production', 'privado');
   const plan = planLocalIgnore(root);
   assert.ok(checkLocalIgnore(plan).missing.includes('.cursor/.env.production'));
   assert.throws(() => applyLocalIgnore(plan), /Regras humanas/);
-  assert.equal(readFileSync(path, 'utf8'), '# humano\n!/.cursor/.env.production\n');
+  assert.equal(readFileSync(path, 'utf8'), '# humano\n!/.cursor/\n!/.cursor/.env.production\n');
 });
 
 test('planejamento sem Git não modifica ignore nem edição humana posterior', t => {
@@ -193,11 +229,13 @@ test('desindexação não descarta edição humana staged com workingtree restau
   assert.equal(readFileSync(join(root, 'generated.md'), 'utf8'), 'gerado\n');
 });
 
-test('configurações humanas dos clientes continuam versionáveis', t => {
+test('configurações humanas podem ser versionadas após exceção explícita', t => {
   const root = fixture(t); git(root, ['init', '-q']);
   applyLocalIgnore(planLocalIgnore(root));
   put(root, '.codex/config.toml', 'local'); put(root, '.claude/settings.json', 'local');
   put(root, '.github/settings.json', 'fonte'); put(root, '.vscode/settings.json', 'fonte');
+  put(root, '.gitignore', '!/.codex/\n!/.claude/\n!/.github/\n!/.vscode/\n');
+  assert.equal(checkLocalIgnore(planLocalIgnore(root)).ok, true);
   git(root, ['add', '--all']);
   const tracked = git(root, ['ls-files', '-z']).split('\0');
   assert.equal(tracked.includes('.codex/config.toml'), true);
@@ -205,6 +243,53 @@ test('configurações humanas dos clientes continuam versionáveis', t => {
   assert.ok(tracked.includes('.github/settings.json')); assert.ok(tracked.includes('.vscode/settings.json'));
 });
 
+test('exceções de raiz usam precedência real e mantêm credenciais ignoradas', t => {
+  const root = fixture(t); git(root, ['init', '-q']);
+  put(root, '.gitignore', '!/.claude/\n!/.github/\n');
+  put(root, '.claude/skills/team/SKILL.md', 'skill humana\n');
+  put(root, '.claude/auth.json', 'segredo');
+  put(root, '.github/workflows/ci.yml', 'workflow humano\n');
+  put(root, '.vscode/settings.json', 'configuração humana\n');
+  const original = readFileSync(join(root, '.gitignore'));
+  const plan = planLocalIgnore(root, { outputs: ['.claude/skills/team/SKILL.md', '.github/workflows/ci.yml'] });
+  assert.ok(plan.optedRoots.includes('.claude'));
+  assert.ok(plan.optedRoots.includes('.github'));
+  applyLocalIgnore(plan);
+  assert.equal(checkLocalIgnore(planLocalIgnore(root)).ok, true);
+  for (const path of ['.claude/skills/team/SKILL.md', '.github/workflows/ci.yml']) {
+    assert.equal(spawnSync('git', ['-C', root, 'check-ignore', '--no-index', '-q', path]).status, 1, path);
+  }
+  for (const path of ['.claude/auth.json', '.vscode/settings.json']) {
+    assert.equal(spawnSync('git', ['-C', root, 'check-ignore', '--no-index', '-q', path]).status, 0, path);
+  }
+  assert.deepEqual(readFileSync(join(root, '.gitignore')), original);
+  put(root, '.gitignore', '!/.claude/\n/.claude/\n');
+  const overridden = planLocalIgnore(root);
+  assert.equal(overridden.optedRoots.includes('.claude'), false);
+  assert.equal(spawnSync('git', ['-C', root, 'check-ignore', '--no-index', '-q', '.claude/skills/team/SKILL.md']).status, 0);
+  put(root, '.gitignore', '!/.claude/\n!/.claude/**\n');
+  assert.throws(() => applyLocalIgnore(planLocalIgnore(root)), /Regras humanas/);
+});
+
+test('derivados e entradas legítimas já rastreados permanecem no índice com ou sem opt-in', t => {
+  const root = fixture(t); git(root, ['init', '-q']);
+  put(root, '.claude/skills/team/SKILL.md', 'skill rastreada\n');
+  put(root, '.github/workflows/ci.yml', 'workflow rastreado\n');
+  put(root, 'AGENTS.md', 'instruções rastreadas\n');
+  git(root, ['add', '--all']);
+  const before = git(root, ['ls-files', '--stage', '-z']);
+  const outputs = ['.claude/skills/team/SKILL.md', '.github/workflows/ci.yml', 'AGENTS.md'];
+  applyLocalIgnore(planLocalIgnore(root, { outputs }));
+  assert.equal(checkLocalIgnore(planLocalIgnore(root, { outputs })).ok, true);
+  assert.equal(git(root, ['ls-files', '--stage', '-z']), before);
+  put(root, '.gitignore', '!/.claude/\n');
+  const opted = planLocalIgnore(root, { outputs });
+  assert.ok(opted.optedRoots.includes('.claude'));
+  applyLocalIgnore(opted);
+  assert.equal(checkLocalIgnore(planLocalIgnore(root, { outputs })).ok, true);
+  assert.equal(git(root, ['ls-files', '--stage', '-z']), before);
+});
+
 test('artefatos vêm da política compartilhada e rastreados são informados', t => {
   const root = fixture(t); git(root, ['init', '-q']);
   put(root, '.agent-tests/human.txt', 'evidência humana'); git(root, ['add', '-f', '.agent-tests/human.txt']);
@@ -271,12 +356,13 @@ test('probes reconhecem exceções humanas para nomes reais de Playwright', asyn
   });
 });
 
-test('milhares de caminhos usam stdin e não ampliam metadata de área já ignorada', t => {
+test('milhares de caminhos usam stdin sem ampliar metadata de área já ignorada', t => {
   const root = fixture(t); git(root, ['init', '-q']); put(root, '.gitignore', '/ignored/\n');
   const before = readFileSync(join(root, '.git/info/exclude'), 'utf8');
   const target = join(root, 'ignored'); mkdirSync(target);
-  const outputs = Array.from({ length: 1500 }, (_, index) => `.github/skills/generated-${index}-${'x'.repeat(45)}/SKILL.md`);
+  const outputs = Array.from({ length: 1500 }, (_, index) => `generated-${index}-${'x'.repeat(45)}.md`);
   const plan = planLocalIgnore(target, { outputs });
+  assert.ok(plan.paths.length >= 1500);
   assert.deepEqual(plan.edits, []); assert.equal(checkLocalIgnore(plan).ok, true);
   applyLocalIgnore(plan); assert.equal(readFileSync(join(root, '.git/info/exclude'), 'utf8'), before);
   assert.deepEqual(planUntrack(target, Object.fromEntries(outputs.map(path => [path, 'a'.repeat(64)]))).paths, []);
@@ -341,16 +427,17 @@ test('cliente não selecionado com symlink próprio não é atravessado pelo pro
   assert.deepEqual(readdirSync(outside), before);
 });
 
-test('preflight dispensa somente regras de bloco substituído com hash válido', t => {
+test('preflight valida hash do bloco substituído sem impor exclusão sobre cliente optado', t => {
   const root = fixture(t); git(root, ['init', '-q']);
   const block = '# BEGIN AGENT IGNORE\r\n!/generated.md\r\n# END AGENT IGNORE';
+  put(root, '.gitignore', '!/.github/\n');
   put(root, '.github/.gitignore', `# Humano\r\n${block}\r\n!/human.md\r\n`);
   const plan = planLocalIgnore(root, { outputs: ['.github/generated.md', '.github/human.md'] });
   const replacement = { path: join(root, '.github/.gitignore'), firstLine: 2, lastLine: 4, sha256: createHash('sha256').update(block).digest('hex') };
-  assert.deepEqual(checkLocalIgnore(plan).missing, ['.github/generated.md', '.github/human.md']);
-  assert.deepEqual(checkLocalIgnore(plan, { replacedBlocks: [replacement] }).missing, ['.github/human.md']);
+  assert.deepEqual(checkLocalIgnore(plan).missing, []);
+  assert.deepEqual(checkLocalIgnore(plan, { replacedBlocks: [replacement] }).missing, []);
   assert.throws(() => checkLocalIgnore(plan, { replacedBlocks: [{ ...replacement, sha256: '0'.repeat(64) }] }), /Bloco de ignore mudou/);
-  assert.throws(() => applyLocalIgnore(plan), /Regras humanas/);
+  assert.doesNotThrow(() => applyLocalIgnore(plan));
   assert.equal(readFileSync(join(root, '.github/.gitignore'), 'utf8'), `# Humano\r\n${block}\r\n!/human.md\r\n`);
 });
 
@@ -490,14 +577,14 @@ test('dependências já ignoradas não causam conflito, mas ignores visíveis s
   assert.ok(checkLocalIgnore(planLocalIgnore(root)).missing.some(value => value.includes('!.playwright-*/')));
 });
 
-test('bloco antigo de outro caminho não oculta arquivos humanos silenciosamente', t => {
+test('bloco de outra worktree não bloqueia a política local de clientes', t => {
   const root = fixture(t); git(root, ['init', '-q']);
   const old = '# BEGIN AGENTDEVKIT LOCAL 0123456789abcdef\n/.claude/\n# END AGENTDEVKIT LOCAL 0123456789abcdef\n';
   put(root, '.git/info/exclude', old);
   const plan = planLocalIgnore(root);
-  assert.ok(checkLocalIgnore(plan).missing.includes('.claude/.agentdevkit-human-probe.md'));
-  assert.throws(() => applyLocalIgnore(plan), /Regras humanas/);
-  assert.equal(readFileSync(join(root, '.git/info/exclude'), 'utf8'), old);
+  assert.equal(checkLocalIgnore(plan).missing.length, 0);
+  assert.doesNotThrow(() => applyLocalIgnore(plan));
+  assert.ok(readFileSync(join(root, '.git/info/exclude'), 'utf8').startsWith(old));
 });
 
 test('artefatos já versionados são informados sem alterar o índice', t => {
@@ -555,6 +642,57 @@ test('escrita de exclusões preserva permissões e detecta alteração concorren
   assert.equal(statSync(exclude).mode & 0o777, 0o640);
 });
 
+test('alteração no exclude durante escrita temporária é preservada antes da promoção', t => {
+  const root = fixture(t); git(root, ['init', '-q']);
+  const file = join(root, '.git/info/exclude'), before = readFileSync(file, 'utf8');
+  const plan = planLocalIgnore(root), index = git(root, ['ls-files', '--stage', '-z']);
+  const write = fs.writeFileSync; let injected = false;
+  try {
+    fs.writeFileSync = (path, content, options) => {
+      const value = write(path, content, options);
+      if (!injected && String(path).startsWith(`${file}.agentdevkit-`)) {
+        injected = true;
+        write(file, `${before}\n# regra humana concorrente\n`);
+      }
+      return value;
+    };
+    syncBuiltinESMExports();
+    assert.throws(() => applyLocalIgnore(plan), /Exclusao alterada antes de publicar/);
+  } finally { fs.writeFileSync = write; syncBuiltinESMExports(); }
+  assert.equal(injected, true);
+  assert.equal(readFileSync(file, 'utf8'), `${before}\n# regra humana concorrente\n`);
+  assert.equal(git(root, ['ls-files', '--stage', '-z']), index);
+});
+
+test('alteração no exclude durante rollback não é substituída', t => {
+  const root = fixture(t); git(root, ['init', '-q']);
+  const file = join(root, '.git/info/exclude'), plan = planLocalIgnore(root);
+  const index = git(root, ['ls-files', '--stage', '-z']);
+  const write = fs.writeFileSync, remove = fs.rmSync;
+  let failed = false, injected = false;
+  try {
+    fs.rmSync = (path, options) => {
+      if (!failed && String(path).startsWith(`${file}.agentdevkit-`) && !existsSync(path)) {
+        failed = true; throw new Error('falha após promoção');
+      }
+      return remove(path, options);
+    };
+    fs.writeFileSync = (path, content, options) => {
+      const value = write(path, content, options);
+      if (failed && !injected && String(path).startsWith(`${file}.agentdevkit-`)) {
+        injected = true;
+        write(file, `${readFileSync(file, 'utf8')}\n# regra humana no rollback\n`);
+      }
+      return value;
+    };
+    syncBuiltinESMExports();
+    assert.throws(() => applyLocalIgnore(plan), /rollback incompleto.*conteudo preservado/s);
+  } finally { fs.rmSync = remove; fs.writeFileSync = write; syncBuiltinESMExports(); }
+  assert.equal(injected, true);
+  assert.match(readFileSync(file, 'utf8'), /# regra humana no rollback/);
+  assert.equal(git(root, ['ls-files', '--stage', '-z']), index);
+});
+
 test('ignore raiz mantém modo e bytes antes e depois de git init', { skip: process.platform === 'win32' }, t => {
   const root = fixture(t), ignore = join(root, '.gitignore');
   put(root, '.gitignore', '# humano\n'); chmodSync(ignore, 0o600);

package/.pbai4devs/scripts/sincronizar-agentes/tests/PRESERVATION.mjs

@@ -0,0 +1,306 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawnSync } from 'node:child_process';
+import { tmpdir } from 'node:os';
+import { synchronize } from '../SCRIPT.mjs';
+import { indexContentMatches } from '../../lib/gitignore.mjs';
+
+const repository = resolve(dirname(fileURLToPath(import.meta.url)), '../../../..');
+const original = '.pbai4devs/skills/projeto/criar-skill/SKILL.md';
+const pointer = '.claude/skills/criar-skill/SKILL.md';
+const file = (root, relative) => join(root, relative);
+const put = (root, relative, content) => { mkdirSync(dirname(file(root, relative)), { recursive: true }); writeFileSync(file(root, relative), content); };
+function git(root, ...args) {
+  const result = spawnSync('git', ['-C', root, ...args], { encoding: 'utf8' });
+  assert.equal(result.status, 0, `${args.join(' ')}: ${result.stderr}`);
+  return result.stdout;
+}
+function fixture(t, withGit = true) {
+  mkdirSync(join(repository, '.agent-tests'), { recursive: true });
+  const root = mkdtempSync(join(withGit ? join(repository, '.agent-tests') : tmpdir(), 'sync-preservation-'));
+  t.after(() => rmSync(root, { recursive: true, force: true }));
+  if (withGit) git(root, 'init', '--quiet');
+  populate(root);
+  return root;
+}
+function populate(root) {
+  put(root, '.gitignore', '# Human ignore\nnode_modules/\n');
+  put(root, '.pbai4devs/templates/gitignore/agents.ignore', '# Cache\n/*\n!/.gitignore\n{{ALLOWLIST}}\n/cache/\n*.log\n');
+  put(root, '.pbai4devs/templates/gitignore/clients.json', '{}\n');
+  put(root, '.pbai4devs/templates/gitignore/shared.ignore', '# Shared\n/tools/*/.local/\n');
+  put(root, '.pbai4devs/espelhos.conf', 'agente|.claude|plano\n');
+  put(root, original, '---\nname: criar-skill\ndescription: Criar recurso.\n---\n\n# Criar skill\n');
+  assert.equal(run(root).exitCode, 0);
+  assert.ok(existsSync(file(root, pointer)));
+}
+function run(root, options = {}) {
+  return synchronize({ root, localIgnores: false, generateEntrypoints: false, output() {}, ...options });
+}
+function withoutGit(t, callback) {
+  const emptyPath = mkdtempSync(join(tmpdir(), 'sync-empty-path-'));
+  t.after(() => rmSync(emptyPath, { recursive: true, force: true }));
+  const keys = Object.keys(process.env).filter(key => key.toLowerCase() === 'path');
+  const previous = new Map(keys.map(key => [key, process.env[key]]));
+  if (!keys.length) keys.push('PATH');
+  try {
+    for (const key of keys) process.env[key] = emptyPath;
+    return callback();
+  } finally {
+    for (const key of keys) {
+      if (previous.has(key)) process.env[key] = previous.get(key);
+      else delete process.env[key];
+    }
+  }
+}
+
+for (const [withGit, force] of [[true, false], [true, true], [false, false], [false, true]]) {
+  test(`remoção obsoleta preserva pasta vazia humana (git=${withGit}, force=${force})`, t => {
+    const root = fixture(t, withGit), human = '.claude/skills/criar-skill/Equipe-Vazia';
+    mkdirSync(file(root, human));
+    const state = readFileSync(file(root, '.pbai4devs/state/derived.json'));
+    const index = withGit ? git(root, 'ls-files', '--stage', '-z') : null;
+    const ignore = readFileSync(file(root, '.gitignore'));
+    rmSync(dirname(file(root, original)), { recursive: true });
+    const check = run(root, { check: true, force });
+    assert.notEqual(check.exitCode, 0);
+    assert.ok(existsSync(file(root, pointer)));
+    assert.ok(existsSync(file(root, human)));
+    assert.deepEqual(readFileSync(file(root, '.pbai4devs/state/derived.json')), state);
+    run(root, { force });
+    assert.equal(existsSync(file(root, pointer)), false, 'apontamento obsoleto comprovado é removido');
+    assert.ok(existsSync(file(root, human)), 'pasta vazia própria permanece');
+    assert.deepEqual(readFileSync(file(root, '.gitignore')), ignore);
+    if (withGit) assert.equal(git(root, 'ls-files', '--stage', '-z'), index);
+  });
+}
+
+for (const force of [false, true]) {
+  test(`índice com conteúdo humano divergente bloqueia remoção (force=${force})`, t => {
+    const root = fixture(t), generated = readFileSync(file(root, pointer));
+    put(root, pointer, Buffer.concat([generated, Buffer.from('\nConteúdo humano staged.\n')]));
+    git(root, 'add', '-f', '--', pointer);
+    const index = git(root, 'ls-files', '--stage', '-z');
+    put(root, pointer, generated);
+    rmSync(dirname(file(root, original)), { recursive: true });
+    const state = readFileSync(file(root, '.pbai4devs/state/derived.json'));
+    const check = run(root, { check: true, force });
+    assert.notEqual(check.exitCode, 0);
+    assert.deepEqual(readFileSync(file(root, pointer)), generated);
+    assert.deepEqual(readFileSync(file(root, '.pbai4devs/state/derived.json')), state);
+    assert.throws(() => run(root, { force }), /conflitos|indice|índice/i);
+    assert.deepEqual(readFileSync(file(root, pointer)), generated);
+    assert.equal(git(root, 'ls-files', '--stage', '-z'), index);
+  });
+}
+
+for (const force of [false, true]) {
+  test(`índice divergente impede atualização de apontamento ativo (force=${force})`, t => {
+    const root = fixture(t), generated = readFileSync(file(root, pointer));
+    put(root, pointer, Buffer.concat([generated, Buffer.from('\nAlteração humana staged.\n')]));
+    git(root, 'add', '-f', '--', pointer);
+    const index = git(root, 'ls-files', '--stage', '-z');
+    put(root, pointer, generated);
+    put(root, original, '---\nname: criar-skill\ndescription: Mudança real.\n---\n\n# Criar skill\n');
+    const state = readFileSync(file(root, '.pbai4devs/state/derived.json'));
+    assert.notEqual(run(root, { check: true, force }).exitCode, 0);
+    assert.throws(() => run(root, { force }), /indice/i);
+    assert.deepEqual(readFileSync(file(root, pointer)), generated);
+    assert.deepEqual(readFileSync(file(root, '.pbai4devs/state/derived.json')), state);
+    assert.equal(git(root, 'ls-files', '--stage', '-z'), index);
+  });
+}
+
+for (const flag of ['--assume-unchanged', '--skip-worktree']) {
+  test(`índice divergente continua protegido com ${flag}`, t => {
+    const root = fixture(t), generated = readFileSync(file(root, pointer));
+    put(root, pointer, Buffer.concat([generated, Buffer.from('\nAlteração humana staged.\n')]));
+    git(root, 'add', '-f', '--', pointer);
+    put(root, pointer, generated);
+    git(root, 'update-index', flag, '--', pointer);
+    const index = git(root, 'ls-files', '--stage', '-z');
+    const flags = git(root, 'ls-files', '-v', '--', pointer);
+    put(root, original, '---\nname: criar-skill\ndescription: Mudança real.\n---\n\n# Criar skill\n');
+    assert.notEqual(run(root, { check: true, force: true }).exitCode, 0);
+    assert.throws(() => run(root, { force: true }), /indice/i);
+    assert.deepEqual(readFileSync(file(root, pointer)), generated);
+    assert.equal(git(root, 'ls-files', '--stage', '-z'), index);
+    assert.equal(git(root, 'ls-files', '-v', '--', pointer), flags);
+  });
+}
+
+test('índice com alias de caixa bloqueia alteração conservadoramente em qualquer sistema', t => {
+  const root = fixture(t), generated = readFileSync(file(root, pointer));
+  const alias = pointer.replace('/skills/', '/SKILLS/');
+  put(root, alias, Buffer.concat([generated, Buffer.from('\nAlteração humana staged.\n')]));
+  git(root, 'add', '-f', '--', alias);
+  const index = git(root, 'ls-files', '--stage', '-z');
+  put(root, pointer, generated);
+  put(root, original, '---\nname: criar-skill\ndescription: Mudança real.\n---\n\n# Criar skill\n');
+  const aliasBytes = readFileSync(file(root, alias));
+  const state = readFileSync(file(root, '.pbai4devs/state/derived.json'));
+  const ignore = readFileSync(file(root, '.gitignore'));
+  const preserved = () => {
+    assert.deepEqual(readFileSync(file(root, pointer)), generated);
+    assert.deepEqual(readFileSync(file(root, alias)), aliasBytes);
+    assert.deepEqual(readFileSync(file(root, '.pbai4devs/state/derived.json')), state);
+    assert.deepEqual(readFileSync(file(root, '.gitignore')), ignore);
+    assert.equal(git(root, 'ls-files', '--stage', '-z'), index);
+  };
+  let check, error;
+  try { check = run(root, { check: true, force: true }); } catch (failure) { error = failure; }
+  if (error) assert.match(error.message, /maiusculas\/minusculas/i);
+  else assert.notEqual(check.exitCode, 0);
+  preserved();
+  assert.throws(() => run(root, { force: true }), /indice|maiusculas\/minusculas/i);
+  preserved();
+});
+
+test('comparação de índice entende CRLF autorizado e recusa filtros, binários e divergência', t => {
+  const root = fixture(t), path = 'arquivo.txt';
+  const crlf = Buffer.from('texto\r\noutra linha\r\n'), lf = Buffer.from('texto\noutra linha\n');
+  git(root, 'config', 'core.autocrlf', 'false');
+  git(root, 'config', 'core.attributesfile', file(root, 'atributos-ausentes'));
+  assert.equal(indexContentMatches(root, path, crlf, lf), false);
+  git(root, 'config', 'core.autocrlf', 'true');
+  assert.equal(indexContentMatches(root, path, crlf, lf), true);
+  assert.equal(indexContentMatches(root, path, crlf, Buffer.from('texto humano\noutra linha\n')), false);
+  assert.equal(indexContentMatches(root, path, Buffer.from([0, 13, 10]), Buffer.from([0, 10])), false);
+  assert.equal(indexContentMatches(root, path, Buffer.from('um\r\ndois\r'), Buffer.from('um\ndois\r')), false);
+  assert.equal(indexContentMatches(root, path, Buffer.from('\ufefftexto\r\n'), Buffer.from('texto\n')), false);
+  assert.equal(indexContentMatches(root, path, Buffer.from('\ufefftexto\r\n'), Buffer.from('\ufefftexto\n')), true);
+  put(root, '.gitattributes', '*.txt -text\n');
+  assert.equal(indexContentMatches(root, path, crlf, lf), false);
+  put(root, '.gitattributes', '*.txt text filter=nao-executar\n');
+  git(root, 'config', 'filter.nao-executar.clean', 'exit 1');
+  assert.equal(indexContentMatches(root, path, crlf, lf), false);
+  put(root, '.gitattributes', '*.txt text working-tree-encoding=UTF-16\n');
+  assert.equal(indexContentMatches(root, path, crlf, lf), false);
+  put(root, '.gitattributes', '*.txt text ident\n');
+  assert.equal(indexContentMatches(root, path, crlf, lf), false);
+  put(root, '.gitattributes', '*.txt text eol=crlf\n');
+  git(root, 'config', 'core.autocrlf', 'false');
+  assert.equal(indexContentMatches(root, path, crlf, lf), true);
+});
+
+test('sync atualiza apontamento staged equivalente em repositório com autocrlf', t => {
+  const root = fixture(t), generated = readFileSync(file(root, pointer), 'utf8').replaceAll('\n', '\r\n');
+  git(root, 'config', 'core.autocrlf', 'true');
+  put(root, pointer, generated);
+  git(root, 'add', '-f', '--', pointer);
+  const index = git(root, 'ls-files', '--stage', '-z');
+  put(root, original, '---\nname: criar-skill\ndescription: Mudança real.\n---\n\n# Criar skill\n');
+  assert.equal(run(root, { force: true }).exitCode, 0);
+  assert.equal(git(root, 'ls-files', '--stage', '-z'), index);
+});
+
+for (const target of ['.pbai4devs/state/derived.json', '.claude/.gitignore']) {
+  test(`índice divergente impede atualização de ${target}`, t => {
+    const root = fixture(t), generated = readFileSync(file(root, target));
+    put(root, target, Buffer.concat([generated, Buffer.from('\nAlteração humana staged.\n')]));
+    git(root, 'add', '-f', '--', target);
+    const index = git(root, 'ls-files', '--stage', '-z');
+    put(root, target, generated);
+    if (target.endsWith('derived.json')) {
+      put(root, original, '---\nname: criar-skill\ndescription: Mudança real.\n---\n\n# Criar skill\n');
+    } else {
+      put(root, '.pbai4devs/templates/gitignore/agents.ignore', '# Cache atualizado\n/*\n!/.gitignore\n{{ALLOWLIST}}\n/cache/\n*.log\n');
+    }
+    assert.notEqual(run(root, { check: true, force: true }).exitCode, 0);
+    assert.throws(() => run(root, { force: true }), /indice/i);
+    assert.deepEqual(readFileSync(file(root, target)), generated);
+    assert.equal(git(root, 'ls-files', '--stage', '-z'), index);
+  });
+}
+
+for (const options of [{ check: true }, { force: true }]) {
+  test(`Git indisponível bloqueia limpeza em repositório (check=${Boolean(options.check)}, force=${Boolean(options.force)})`, t => {
+    const root = fixture(t), generated = readFileSync(file(root, pointer));
+    put(root, pointer, Buffer.concat([generated, Buffer.from('\nConteúdo humano staged.\n')]));
+    git(root, 'add', '-f', '--', pointer);
+    const index = git(root, 'ls-files', '--stage', '-z');
+    put(root, pointer, generated);
+    rmSync(dirname(file(root, original)), { recursive: true });
+    const state = readFileSync(file(root, '.pbai4devs/state/derived.json'));
+    withoutGit(t, () => assert.throws(() => run(root, options), /consultar o Git.*preservar/i));
+    assert.deepEqual(readFileSync(file(root, pointer)), generated);
+    assert.deepEqual(readFileSync(file(root, '.pbai4devs/state/derived.json')), state);
+    assert.equal(git(root, 'ls-files', '--stage', '-z'), index);
+  });
+}
+
+test('projeto realmente sem Git pode limpar apontamento próprio sem executável Git', t => {
+  const root = fixture(t, false), human = '.claude/skills/criar-skill/equipe-vazia';
+  mkdirSync(file(root, human));
+  rmSync(dirname(file(root, original)), { recursive: true });
+  withoutGit(t, () => assert.equal(run(root, { force: true }).exitCode, 0));
+  assert.equal(existsSync(file(root, pointer)), false);
+  assert.ok(existsSync(file(root, human)));
+});
+
+test('preserva diretório preexistente sem prova de propriedade após remover único apontamento', t => {
+  const root = fixture(t), directory = dirname(file(root, pointer));
+  rmSync(dirname(file(root, original)), { recursive: true });
+  assert.equal(run(root, { force: true }).exitCode, 0);
+  assert.equal(existsSync(file(root, pointer)), false);
+  assert.ok(existsSync(directory));
+});
+
+test('alteração concorrente no índice bloqueia limpeza antes de qualquer exclusão', t => {
+  const root = fixture(t), generated = readFileSync(file(root, pointer));
+  rmSync(dirname(file(root, original)), { recursive: true });
+  let staged;
+  assert.throws(() => synchronize({ root, localIgnores: false, generateEntrypoints: false, force: true,
+    output() {
+      if (staged !== undefined) return;
+      put(root, pointer, Buffer.concat([generated, Buffer.from('\nStaged pela equipe.\n')]));
+      git(root, 'add', '-f', '--', pointer);
+      staged = git(root, 'ls-files', '--stage', '-z');
+      put(root, pointer, generated);
+    },
+  }), /indice git mudou/i);
+  assert.notEqual(staged, undefined);
+  assert.deepEqual(readFileSync(file(root, pointer)), generated);
+  assert.equal(git(root, 'ls-files', '--stage', '-z'), staged);
+});
+
+test('índice divergente é protegido quando o projeto fica em subpasta do repositório Git', t => {
+  const outer = mkdtempSync(join(tmpdir(), 'sync-parent-git-'));
+  t.after(() => rmSync(outer, { recursive: true, force: true }));
+  git(outer, 'init', '--quiet');
+  const root = join(outer, 'projeto'); mkdirSync(root);
+  populate(root);
+  const generated = readFileSync(file(root, pointer));
+  put(root, pointer, Buffer.concat([generated, Buffer.from('\nStaged pela equipe.\n')]));
+  git(root, 'add', '-f', '--', pointer);
+  const index = git(outer, 'ls-files', '--stage', '-z');
+  put(root, pointer, generated);
+  rmSync(dirname(file(root, original)), { recursive: true });
+  assert.throws(() => run(root, { force: true }), /indice/i);
+  assert.deepEqual(readFileSync(file(root, pointer)), generated);
+  assert.equal(git(outer, 'ls-files', '--stage', '-z'), index);
+});
+
+test('conteúdo humano na pasta e apontamento gerenciado editado sobrevivem à limpeza forçada', t => {
+  const root = fixture(t), human = '.claude/skills/criar-skill/notas-da-equipe.md';
+  const notes = '# Referência própria\n', edited = Buffer.concat([readFileSync(file(root, pointer)), Buffer.from('\nNota própria.\n')]);
+  put(root, human, notes);
+  put(root, pointer, edited);
+  rmSync(dirname(file(root, original)), { recursive: true });
+  run(root, { force: true });
+  assert.equal(readFileSync(file(root, human), 'utf8'), notes);
+  assert.deepEqual(readFileSync(file(root, pointer)), edited);
+});
+
+test('colisão com arquivo humano ancestral não é removida por --force', t => {
+  const root = fixture(t), ancestor = '.claude/skills/equipe-custom';
+  const human = 'Arquivo da equipe; não substituir.\n';
+  put(root, ancestor, human);
+  put(root, '.pbai4devs/skills/projeto/equipe-custom/SKILL.md', '---\nname: equipe-custom\ndescription: Exemplo.\n---\n\n# Equipe\n');
+  const index = git(root, 'ls-files', '--stage', '-z');
+  try { run(root, { force: true }); } catch (error) { assert.match(error.message, /conflito|gerenciado|arquivo|diretor/i); }
+  assert.equal(readFileSync(file(root, ancestor), 'utf8'), human);
+  assert.equal(git(root, 'ls-files', '--stage', '-z'), index);
+});

package/.pbai4devs/scripts/sincronizar-agentes/tests/TEST.mjs

@@ -13,6 +13,7 @@ import './LOCAL_IGNORE.mjs';
 import './HUMAN_OWNERSHIP.mjs';
 import './COEXISTENCE.mjs';
 import './MANAGED_CONTENT.mjs';
+import './PRESERVATION.mjs';
 import { validateCatalog as validateExternalCatalog } from '../../gerenciar-skills-externas/SCRIPT.mjs';
 import { stateDirectory } from '../../lib/state-path.mjs';
 
@@ -140,7 +141,12 @@ test('sincroniza somente principais, preserva metadados e usa referências UTF-8
   assert.match(read(root, '.kimi-code/agents/revisor.md'), /tools: \[Read, Grep, Glob\]/);
   assert.ok(existsSync(join(root, '.claude/skills/projeto/demo/SKILL.md')));
   for (const client of ['.claude', '.opencode', '.github', '.codex', '.cursor', '.kimi-code', '.vscode', '.agents', '.agent', '.gemini']) {
-  for (const kind of ['templates', 'scripts', 'tools', 'external-skills', 'state', 'estado', 'tests', 'docs', 'adapters', 'extra', 'README.md', 'INSTRUCTIONS.md']) assert.equal(existsSync(join(root, client, kind)), false, `${client}/${kind}`);
+    for (const kind of ['templates', 'scripts', 'tools', 'external-skills', 'state', 'estado', 'tests', 'docs', 'adapters', 'extra', 'README.md', 'INSTRUCTIONS.md']) {
+      if (client === '.claude' && ['templates', 'scripts', 'tools', 'external-skills', 'state', 'tests', 'docs', 'adapters'].includes(kind)) {
+        assert.equal(existsSync(join(root, client, kind, 'demo/REFERENCE.md')), false);
+        assert.ok(existsSync(join(root, client, kind)), 'diretório sem prova de propriedade permanece');
+      } else assert.equal(existsSync(join(root, client, kind)), false, `${client}/${kind}`);
+    }
   }
   assert.deepEqual(JSON.parse(read(root, '.pbai4devs/agents.json')).entries, [{ path: '.pbai4devs/agents/revisor/AGENT.md' }]);
   assert.ok(JSON.parse(read(root, '.pbai4devs/skills.json')).entries.some(entry => entry.path === '.pbai4devs/skills/grupo com espaço/outro'));
@@ -441,7 +447,8 @@ test('atualiza fontes, adiciona clientes, remove recursos e migra agrupado para
   rmSync(join(root, '.pbai4devs/rules/example/RULE.md'));
   write(root, '.pbai4devs/espelhos.conf', read(root, '.pbai4devs/espelhos.conf').replace('agente|.claude\n', 'agente|.claude|plano\n'));
   run(root);
-  assert.equal(existsSync(join(root, '.claude/skills/projeto')), false);
+  assert.equal(existsSync(join(root, '.claude/skills/projeto/demo/SKILL.md')), false);
+  assert.ok(existsSync(join(root, '.claude/skills/projeto')));
   assert.ok(existsSync(join(root, '.claude/skills/demo/SKILL.md')));
   assert.equal(existsSync(join(root, '.codex/rules/example.md')), false);
   assert.deepEqual(JSON.parse(read(root, '.pbai4devs/rules.json')).entries, []);
@@ -882,7 +889,8 @@ test('manifestos Antigravity acompanham skills, regras e agentes agrupados', t =
   rmSync(join(root, '.pbai4devs/skills/projeto/demo'), { recursive: true });
   run(root, { generateEntrypoints: true });
   assert.deepEqual(JSON.parse(read(root, '.agents/skills.json')).entries, [{ path: '.agents/skills/projeto/new-skill' }]);
-  assert.equal(existsSync(join(root, '.agents/skills/projeto/demo')), false);
+  assert.equal(existsSync(join(root, '.agents/skills/projeto/demo/SKILL.md')), false);
+  assert.ok(existsSync(join(root, '.agents/skills/projeto/demo')));
   assertCheckReadonly(root, { generateEntrypoints: true }, 0);
 });