agent-trellis 0.1.0 → 0.2.0

package/dist/lib/installAgent.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Install-then-manage (trellis-managed-agents design.md D5): selecting a
+ * not-yet-present agent into the managed set is itself the authorization
+ * to install it, but never silently — one confirmation, then a real
+ * `npm install -g <package>` child process. Kiro has no npm package (a
+ * desktop download) and is refused before this module is ever reached.
+ */
+import type { AgentId } from "../core/types.js";
+/** Only agents with a real `npm install -g <pkg>` command — Kiro's own
+ * `INSTALL_HINTS` entry is a download URL, not a package, and is never
+ * looked up here. */
+export declare const NPM_INSTALLABLE: Record<Exclude<AgentId, "kiro">, string>;
+export interface ConfirmAndInstallOptions {
+    /** Test/real seam, same pattern as onboard's `promptForAgent` — a real
+     * terminal confirmation by default. */
+    confirm?: (agent: AgentId, pkg: string) => Promise<boolean>;
+    /** Test/real seam — never a real `npm install` in a unit test. */
+    runInstall?: (pkg: string) => void;
+}
+export interface ConfirmAndInstallResult {
+    installed: boolean;
+    /** False only when the agent has no npm package at all (Kiro) — the
+     * caller refuses this agent with its download URL instead of prompting. */
+    installable: boolean;
+}
+export declare function confirmAndInstall(agent: AgentId, opts?: ConfirmAndInstallOptions): Promise<ConfirmAndInstallResult>;

package/dist/lib/installAgent.js

@@ -0,0 +1,46 @@
+/**
+ * Install-then-manage (trellis-managed-agents design.md D5): selecting a
+ * not-yet-present agent into the managed set is itself the authorization
+ * to install it, but never silently — one confirmation, then a real
+ * `npm install -g <package>` child process. Kiro has no npm package (a
+ * desktop download) and is refused before this module is ever reached.
+ */
+import { execFileSync } from "node:child_process";
+import { createInterface } from "node:readline/promises";
+/** Only agents with a real `npm install -g <pkg>` command — Kiro's own
+ * `INSTALL_HINTS` entry is a download URL, not a package, and is never
+ * looked up here. */
+export const NPM_INSTALLABLE = {
+    "claude-code": "@anthropic-ai/claude-code",
+    codex: "@openai/codex",
+    pi: "@earendil-works/pi-coding-agent",
+};
+async function confirmReal(agent, pkg) {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        const answer = (await rl.question(`${agent} is not installed. Install it now (npm install -g ${pkg})? [y/N] `)).trim().toLowerCase();
+        return answer === "y" || answer === "yes";
+    }
+    finally {
+        rl.close();
+    }
+}
+function runInstallReal(pkg) {
+    // argv array, never a shell string — the package name is never
+    // interpolated into anything a shell parses.
+    execFileSync("npm", ["install", "-g", pkg], { stdio: "inherit" });
+}
+export async function confirmAndInstall(agent, opts = {}) {
+    if (agent === "kiro") {
+        return { installed: false, installable: false };
+    }
+    const pkg = NPM_INSTALLABLE[agent];
+    const confirm = opts.confirm ?? confirmReal;
+    const runInstall = opts.runInstall ?? runInstallReal;
+    const agreed = await confirm(agent, pkg);
+    if (!agreed) {
+        return { installed: false, installable: true };
+    }
+    runInstall(pkg);
+    return { installed: true, installable: true };
+}

package/dist/pi-bridge/bundle.js

@@ -27254,8 +27254,9 @@ var ALL_AGENTS = [
   "kiro",
   "pi"
 ];
-function resolveScope(scope) {
-  return scope ?? ALL_AGENTS;
+function resolveScope(scope, managedAgents) {
+  const candidates = scope ?? managedAgents;
+  return candidates.filter((id) => managedAgents.includes(id));
 }
 
 // src/core/canonical.ts
@@ -27319,6 +27320,22 @@ function loadSecretsPolicyYaml(path, homeDir) {
     envFile: parsed.env_file ? parsed.env_file.replace(/^~(?=$|\/)/, homeDir) : void 0
   };
 }
+function loadManagedYaml(path, diagnostics) {
+  if (!existsSync(path)) {
+    return [];
+  }
+  const parsed = (0, import_yaml.parse)(readFileSync(path, "utf-8")) ?? {};
+  const raw = parsed.agents ?? [];
+  const valid = [];
+  for (const id of raw) {
+    if (ALL_AGENTS.includes(id)) {
+      valid.push(id);
+    } else {
+      diagnostics.push(`managed.yaml: "${id}" is not a recognized agent id \u2014 ignored`);
+    }
+  }
+  return valid;
+}
 function scopeFor(map, name) {
   return map?.[name];
 }
@@ -27334,6 +27351,7 @@ function loadCanonicalSource(homeDir = homedir()) {
     );
   }
   const diagnostics = [];
+  const managedAgents = loadManagedYaml(join(root, "managed.yaml"), diagnostics);
   const scopeYaml = loadScopeYaml(join(root, "scope.yaml"));
   const skillDirs = listSkillDirs(join(root, "skills"));
   const knownSkillNames = new Set(skillDirs.map((s) => s.name));
@@ -27368,6 +27386,7 @@ function loadCanonicalSource(homeDir = homedir()) {
   }
   return {
     instructionsFile: join(root, "agents.md"),
+    managedAgents,
     skills,
     agents,
     memories,
@@ -27381,8 +27400,8 @@ function loadCanonicalSource(homeDir = homedir()) {
 }
 
 // src/core/adapter.ts
-function isInScope(id, scope) {
-  return resolveScope(scope).includes(id);
+function isInScope(id, scope, managedAgents) {
+  return resolveScope(scope, managedAgents).includes(id);
 }
 
 // src/lib/tomlSection.ts
@@ -27420,7 +27439,7 @@ function findLiteralSecret(def) {
   }
   return void 0;
 }
-function resolveMcpPlan(agentId, mcp) {
+function resolveMcpPlan(agentId, mcp, managedAgents) {
   if (mcp.hub) {
     if (mcp.knownHostInjected.includes(HUB_ENTRY_NAME)) {
       return { desired: [], conflicts: [{ name: HUB_ENTRY_NAME, message: collisionMessage(HUB_ENTRY_NAME, agentId) }] };
@@ -27430,7 +27449,7 @@ function resolveMcpPlan(agentId, mcp) {
   const desired = [];
   const conflicts = [];
   for (const [name, def] of Object.entries(mcp.servers)) {
-    if (!isInScope(agentId, def.agents)) {
+    if (!isInScope(agentId, def.agents, managedAgents)) {
       continue;
     }
     if (mcp.knownHostInjected.includes(name)) {
@@ -32010,7 +32029,7 @@ function registerServerTools(pi, serverName, client, timeoutMs) {
 }
 async function trellisMcpBridge(pi, homeDir = homedir2(), connectTimeoutMs = DEFAULT_CONNECT_TIMEOUT_MS) {
   const canonical = loadCanonicalSource(homeDir);
-  const { desired } = resolveMcpPlan("pi", canonical.mcp);
+  const { desired } = resolveMcpPlan("pi", canonical.mcp, ALL_AGENTS);
   const clients = /* @__PURE__ */ new Set();
   const closeClient = async (client) => {
     if (!clients.delete(client)) return;

package/dist/pi-bridge/index.js

@@ -20,6 +20,7 @@ import { loadCanonicalSource } from "../core/canonical.js";
 import { resolveMcpPlan } from "../adapters/mcpPlan.js";
 import { resolveSecretEnv } from "../lib/secretEnv.js";
 import { extractTemplateVarNames } from "../lib/envVarNames.js";
+import { ALL_AGENTS } from "../core/types.js";
 import { bridgedToolName, toParametersSchema, toPiContent } from "./schemaTranslate.js";
 const CLIENT_INFO = { name: "trellis-mcp-bridge", version: "0.0.0" };
 const DEFAULT_CONNECT_TIMEOUT_MS = 10_000;
@@ -128,7 +129,13 @@ function registerServerTools(pi, serverName, client, timeoutMs) {
  */
 export default async function trellisMcpBridge(pi, homeDir = homedir(), connectTimeoutMs = DEFAULT_CONNECT_TIMEOUT_MS) {
     const canonical = loadCanonicalSource(homeDir);
-    const { desired } = resolveMcpPlan("pi", canonical.mcp);
+    // Deliberately ALL_AGENTS, not canonical.managedAgents: this bridge only
+    // ever runs because pi itself loaded the extension — that's already the
+    // strongest possible consent signal (trellis-managed-agents design.md),
+    // independent of whether `trellis onboard` was ever run to add pi to
+    // managed.yaml. managedAgents governs static config-file writes; this
+    // is pi reading canonical directly at its own runtime, P4's own concern.
+    const { desired } = resolveMcpPlan("pi", canonical.mcp, ALL_AGENTS);
     const clients = new Set();
     const closeClient = async (client) => {
         if (!clients.delete(client))

package/docs/getting-started.md

@@ -16,39 +16,59 @@ $ trellis onboard
 ```
 
 Runs `init`, detects which of Claude Code/Codex/Kiro/pi are on this machine,
-picks one as the migration base, then runs `migrate` and `sync` against it.
-
-- **No agent detected**: prints each agent's real install command/URL and
-  stops. Never installs anything itself — that's your call.
-- **Exactly one agent detected**: auto-selected as the base, no prompt.
-- **Two or more detected**: prompts you to pick one (if you're at a real
-  terminal), or pass `--agent <id>` to skip the prompt — useful in scripts,
-  CI, or when running with `--json`, which never prompts.
+then resolves two independent choices before running `migrate`, `sync`,
+`mcp sync`, and `secrets audit` — the whole onboarding path, no follow-up
+commands to type by hand:
+
+1. **Migration source** — read from, at most one, never written back to.
+   - **No agent has real content**: skipped — canonical starts from `init`'s
+     placeholder.
+   - **Exactly one agent has real content**: auto-selected, no prompt.
+   - **Two or more**: prompts you with a numbered choice (if you're at a real
+     terminal), or pass `--agent <id>` to skip the prompt.
+2. **Managed set** — zero or more agents to actually write to. Always an
+   explicit choice: pass `--manage <ids>` (comma-separated, e.g. `--manage
+   pi,codex`) or `--manage none`, or answer the numbered multi-select prompt.
+   **The source is not included by default** — migrating from Claude Code
+   doesn't mean Trellis starts managing Claude Code too, unless you say so.
+   Selecting an agent that isn't installed yet is itself the authorization to
+   install it (one confirmation, then a real `npm install -g <package>`);
+   Kiro has no CLI package and is refused with its download URL instead.
 
 ```
-$ trellis onboard --agent claude-code
-Using claude-code as the migration base (--agent).
+$ trellis onboard --agent claude-code --manage pi
+Using claude-code as the migration source (--agent).
+Managed agents: pi
 
 migrate --from claude-code
   [create] skill "my-skill" — will copy from /Users/you/.claude/skills/my-skill
   ...
 
 sync
-  ✅ codex — 1 created, 0 removed, 0 conflict(s)
+  ✅ pi — 1 created, 0 removed, 0 conflict(s)
   ...
 
-Next: `trellis mcp sync` to distribute MCP servers, `trellis secrets audit` to check for leaked credentials.
+mcp sync
+  ✅ pi — already in sync
+
+secrets audit
+  ✅ no findings — every present agent's real config and every declared env var passed all checks
 ```
 
-Add `--dry-run` to preview the entire chain — init/migrate/sync — with zero
-writes anywhere.
+No agent named `claude-code` appears in the `sync`/`mcp sync` output above —
+it's present and was the migration source, but it isn't managed, so it's
+never even probed as a sync target, not just left with zero items.
+
+Add `--dry-run` to preview the entire chain — init/migrate/sync/mcp
+sync, including what would be written to `~/.trellis/managed.yaml` — with
+zero writes anywhere (secrets audit is always read-only, with or without
+the flag).
 
-**Picking a base agent only picks one.** If you use two or more agents with
-genuinely different real content, onboard migrates from the one you (or it)
-chose; the others' own differing content is untouched, exactly as `migrate`
-would report it if run against them directly (see the conflict table
-below). Merging differing content across multiple agents into one result
-isn't built yet — see [README's Status](../README.md#status).
+**A managed agent's own real content still isn't overwritten.** If you
+explicitly include the source in `--manage`, sync still never overwrites
+its real files — see the conflict table below. Merging differing content
+across multiple agents into one canonical result isn't built yet — see
+[README's Status](../README.md#status).
 
 The rest of this page is the same flow broken into its individual steps —
 useful if you want more control over any one part, or just want to
@@ -138,8 +158,10 @@ before moving on to `sync`.
 
 ## `trellis sync`
 
-Distributes canonical skills and instructions to every agent present on this
-machine:
+Distributes canonical skills and instructions to every **managed** agent
+(`~/.trellis/managed.yaml` — empty by default; `trellis onboard` writes it,
+or edit it yourself). A present-but-unmanaged agent gets no report line at
+all, not just zero items:
 
 ```
 $ trellis sync
@@ -162,12 +184,18 @@ canonical, that's what `migrate` is for.
 Run `trellis sync skills` or `trellis sync instructions` to distribute just
 one half. Add `--dry-run` (in any position — `trellis sync --dry-run` and
 `trellis sync skills --dry-run` both work) to preview the plan with zero
-writes.
+writes (and, per the same rule, records nothing to back up — see
+`trellis rollback` below).
+
+Every create/repair/remove this actually performs is recorded first,
+automatically, so `trellis rollback` can undo the whole run later — see
+[`trellis rollback`](#trellis-rollback--undoing-a-syncmcp-synconboard-run)
+below.
 
 ## `trellis mcp sync`
 
-Distributes `~/.trellis/mcp/servers.yaml` to every present agent's native
-MCP config. See [`schema/servers.example.yaml`](../schema/servers.example.yaml)
+Distributes `~/.trellis/mcp/servers.yaml` to every **managed** agent's
+native MCP config — same restriction as `sync`, see above. See [`schema/servers.example.yaml`](../schema/servers.example.yaml)
 for the full documented shape — server definitions, per-agent scoping,
 known-host-injected collision avoidance, and hub mode.
 
@@ -180,6 +208,11 @@ does not remove it from any agent's native config yet (see
 [README's Known limitations](../README.md#status)). Remove it by hand on
 each agent in the meantime.
 
+Every native-config file this rewrites in place is snapshotted first,
+automatically — see
+[`trellis rollback`](#trellis-rollback--undoing-a-syncmcp-synconboard-run)
+below to undo a run that turned out to be wrong.
+
 `env:` in `servers.yaml` lists variable **names** only, never literal
 values — the real values come from wherever your shell/secret manager
 already populates them. See
@@ -193,7 +226,8 @@ narrow exception (pi's bridge has to read a value into its own process).
 $ trellis secrets audit
 ```
 
-Scans every present agent's **real, on-disk** config (never canonical) for:
+Scans every **managed** agent's **real, on-disk** config (never canonical)
+for — same restriction as `sync`, see above:
 
 1. A literal value matching one of `secrets.policy.yaml`'s
    `reject_patterns` (a credential-shaped string that should have been a
@@ -220,6 +254,50 @@ Safe to run any time; nothing here writes anything.
 stdio MCP server (some reaching real external services) — not something a
 "just check my config" command should do by default.
 
+## `trellis rollback` — undoing a `sync`/`mcp sync`/`onboard` run
+
+Every real write those three commands perform is recorded, before it
+happens, to a structured run directory under `~/.trellis/backups/` — no
+flag needed, this is always on for any run that actually writes
+something. `--dry-run` never creates one, since nothing was written.
+
+```
+$ trellis rollback
+```
+
+Omitting a run id targets the most recent run. Pass one explicitly to
+undo an older run — see `trellis rollback --list` for what's available:
+
+```
+$ trellis rollback --list
+2026-09-13T04-52-18-727Z-mcp-sync — mcp-sync, 3 operation(s), 2026-09-13T04:52:18.727Z
+2026-09-13T04-44-56-967Z-sync — sync, 1 operation(s), 2026-09-13T04:44:56.967Z
+```
+
+For each recorded operation, rollback checks whether that path's
+**current** state still matches what the run itself left behind:
+
+| Current state vs. recorded | Result |
+|---|---|
+| Unchanged since the run | `restore` — the file's exact prior bytes, or the symlink's exact prior target, or removed if the run created it |
+| Something else touched it since | `conflict` — reported, left untouched, never force-restored over |
+
+One path's `conflict` never blocks any other path in the same rollback
+from restoring. Exit code is non-zero if any `conflict` occurred. Add
+`--dry-run` to preview the restore/conflict plan with zero writes, or
+`--json` for machine-readable output.
+
+`onboard` shares one backup run across its whole chained `sync`/`mcp
+sync` stages — one `trellis rollback` undoes an entire `onboard`
+invocation, not just its last stage. `migrate` is not covered: it only
+ever creates a new canonical entry or refuses on conflict, never
+overwrites existing canonical content, so there's nothing a snapshot
+would add — undoing a migrate mistake is just deleting the newly
+created file under `~/.trellis/skills/`.
+
+`~/.trellis/backups/` has no automatic pruning — delete old run
+directories by hand once you're done with them.
+
 ## Troubleshooting
 
 - **A `conflict` I don't understand**: `migrate` and `sync` both name the

package/docs/roadmap.md

@@ -467,6 +467,139 @@ symlink-safe — the reminder here: a real installed-package check is
 not a redundant formality alongside the unit suite, it's the only
 thing in this project that exercises the actual `bin` symlink at all.
 
+**`trellis-managed-agents`, done and archived**
+(`openspec/changes/archive/2026-09-13-trellis-managed-agents/`; adds
+`agent-management-scope`, modifies `onboarding-flow`,
+`skill-instructions-sync`, `mcp-server-sync`, `secrets-audit`). Fixes a
+real gap found using `onboard` for its first real migration (Claude Code
+→ pi, on this project's own developer machine): `sync`/`mcp sync`/
+`secrets audit` acted on **every present agent** unconditionally, with no
+way to say "only manage these ones." New persisted state,
+`~/.trellis/managed.yaml` — absent or `agents: []` both mean zero managed
+agents, never "everyone" (a deliberate pre-1.0 default reversal, no
+back-compat shim). `resolveScope`'s no-scope fallback changed from
+`ALL_AGENTS` to the managed set, and an item's own explicit scope is now
+intersected with it, never used verbatim — the managed set is the hard
+outer boundary every other scoping decision lives inside.
+
+`onboard` splits what used to be one "pick a base agent" choice into two
+independent ones: a **migration source** (read-only, at most one, same
+resolution rules as before) and a **managed set** (zero or more, written
+to). The source is offered in the managed-set prompt but starts
+unchecked by default — importing from Claude Code no longer implies
+Trellis should also manage Claude Code. Selecting an agent that isn't
+installed yet (e.g. pi) is itself the authorization to install it — one
+confirmation, then a real `npm install -g <package>` (`src/lib/
+installAgent.ts`), never silent even under `--manage`; Kiro has no CLI
+package and is refused with its download URL instead. Re-running
+`onboard`'s managed-set selection is a union with whatever was already
+in `managed.yaml`, never a replacement — otherwise a later run adding
+codex, forgetting to reselect pi out of habit, would silently unmanage
+it. `~/.agents` (Codex's own `~/.ai-config`-sourced skill convention) is
+now a directly tested non-goal rather than an incidental consequence of
+the ownership-conflict fix below.
+
+Found and fixed a second real bug in the same investigation, upstream of
+this change's own scope but caught while diagnosing "did the first real
+`onboard` run corrupt anything": `src/adapters/symlinkPlan.ts` treated
+*any* existing symlink at a target path as safe to repair, without
+checking whether its stored target was actually inside Trellis's own
+canonical source. A real `onboard` run silently repointed
+`~/.codex/instructions.md` and `~/.kiro/steering/CLAUDE.md` — both
+previously symlinks into a separate, user-owned `~/.ai-config` setup —
+at `~/.trellis/agents.md` instead, with zero warning. Fixed by checking
+the existing symlink's raw `readlink` target against `canonicalRoot`
+before treating it as repairable; anything pointing elsewhere is now a
+`"conflict"`, left untouched, same as a real non-symlink file always
+was. Verified against the real machine: the two symlinks were restored
+by hand, the fix confirmed via `sync instructions --dry-run` reporting
+conflicts instead of creates, and 194→197 tests passing throughout.
+
+Verified in the real Docker sandbox: baseline `sync` with all four
+fixture agents listed in `managed.yaml` reproduces the exact same output
+this project's earlier sandbox runs documented (no regression), then a
+narrowed `managed.yaml` (`agents: [pi]`) reproduces zero writes and zero
+report lines for the other three, and a full `onboard --agent
+claude-code --manage pi` run reproduces this session's own real
+use case end to end — migrate from claude-code, manage only pi, source
+left completely untouched.
+
+Then run for real, once, on this project's own developer machine (not a
+sandbox): `onboard --agent claude-code --manage pi` genuinely installed
+pi (`npm install -g @earendil-works/pi-coding-agent`, real confirmation
+prompt, real 132-package install), wrote `managed.yaml` as `agents:
+[pi]`, re-ran `migrate --from claude-code` idempotently against already-
+migrated canonical, and left claude-code, codex, and kiro completely
+untouched — including confirming codex's and kiro's instructions files
+are still real symlinks into the developer's own `~/.ai-config`, not
+touched by this run. Surfaced one genuine, undocumented boundary in the
+process: `sync`/`mcp sync` still reported pi as "not installed"
+immediately after the install, because pi's own presence probe
+(`src/probes/pi.ts`) checks for `~/.pi/agent/settings.json` or `~/.pi/
+agent/skills` on disk — neither of which `npm install` creates. pi only
+writes those itself on its own first real invocation (confirmed by
+reading its installed source: `pi list` bootstraps `~/.pi/auth.json` and
+`~/.pi/models-store.json`, but not the `agent/` subdirectory — that
+appears to need pi's own first-time-setup flow, which is interactive and
+out of scope for Trellis to force). This isn't a bug to patch around —
+faking presence would violate this project's own "verify, don't assume"
+principle — but it is a real onboarding-order gap worth documenting: run
+the newly-installed agent once yourself before `trellis sync` can do
+anything for it.
+
+**`trellis-backup-rollback`, done and archived**
+(`openspec/changes/archive/2026-09-13-trellis-backup-rollback/`; adds
+`backup-and-rollback`, modifies `skill-instructions-sync`,
+`mcp-server-sync`, `onboarding-flow`). Direct follow-up to
+`trellis-managed-agents`' own real regression (a foreign symlink silently
+repointed with zero warning): that fix made the *known* unsafe case a
+`conflict` instead, but `mcp sync`'s native-config writes were never
+provably safe the same way — `~/.claude.json`, `~/.codex/config.toml`,
+and Kiro's two settings files are read, merged or TOML-section-patched,
+and rewritten in place, and a bug in that merge/patch logic produces a
+clean write with silently wrong output, not a `conflict` any existing
+check would catch. Two earlier archived changes (`trellis-sync-p1`,
+`trellis-mcp-sync-p2`) each waved at "rollback" by pointing at their own
+create/remove mechanics; `mcp-sync-p2`'s story didn't actually hold —
+automatic MCP server removal still isn't built, so there was no real
+undo path for an `mcp sync` mistake besides hand-editing the file.
+
+Every real write `sync`/`mcp sync` perform is now recorded, before it
+happens, into a structured, timestamped run under `~/.trellis/backups/`
+(new `src/lib/backup.ts`) — enough per operation to invert it exactly:
+a file's prior bytes for an overwrite, a symlink's prior target for a
+repair or removal, or just "this didn't exist before" for a create. The
+write itself moved *into* the backup session (`session.writeFile`/
+`createSymlink`/`repairSymlink`/`removeSymlink`) rather than the session
+being an optional thing call sites remember to also invoke — the same
+lesson `trellis-managed-agents`' symlinkPlan bug taught: a safety check
+that's opt-in gets skipped eventually. `TrellisAdapter.apply()` gained a
+mandatory `BackupSession` parameter across all four adapters; there is no
+code path left that writes one of these files without going through it.
+
+New `trellis rollback [<run-id>] [--list] [--dry-run] [--json]`: restores
+one recorded run, but only where the current on-disk state still matches
+what that run itself left behind — a path touched again since (another
+sync, a hand edit) is a `conflict`, reported and left untouched, same
+"verify, never guess" posture every other conflict in this project
+already holds itself to. One path's conflict never blocks any other path
+in the same rollback. `onboard` opens one session and shares it across
+its whole chained `sync`+`mcp sync` run rather than one per stage, so a
+single `trellis rollback` undoes an entire `onboard` invocation.
+`migrate` is explicitly out of scope — it only ever creates a new
+canonical entry or refuses on conflict, never overwrites existing
+canonical content, so there's nothing real to lose there.
+
+Verified in the real Docker sandbox against `test/fixtures/home`: a real
+`mcp sync` run rewrote `.claude.json`/`.codex/config.toml`/
+`.kiro/settings/mcp.json` with several new servers, `trellis rollback`
+restored all three to their exact original bytes, confirmed byte-for-
+byte; then a second run, followed by a hand-edit simulating something
+else touching `.claude.json` after the fact, confirmed rollback reports
+exactly that one path as a `conflict` (exit 1) while still correctly
+restoring the other two, untouched, unaffected paths in the same
+invocation.
+
 | Phase | Deliverable | Depends on |
 |---|---|---|
 | P0 | ✅ `trellis doctor` — read-only, opt-in-for-handshakes scan of all four agents' current skills/MCP/instructions state, reports drift and duplicates | nothing |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-trellis",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "A single source of capability for every coding agent — skills, MCP, subagents, memory, and secret policy, adapted natively into Claude Code, Codex, Kiro, and pi.",
   "license": "MIT",
   "author": "Paul Leo",