agentera 3.0.0-dev.25 → 3.0.0-dev.27

package/dist/upgrade/runtimeMigration.js

@@ -1,16 +1,15 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { createHash } from "node:crypto";
 import { isFile, pathExists, resolvePath } from "../core/paths.js";
 import { resolveSourceRoot } from "../core/sourceRoot.js";
-import { loadRegistry } from "../registries/runtimeAdapterRegistry.js";
 import { codexCopiedHooksAreAgenteraOnly, codexPluginHooksEnabled, retireCodexCopiedHookTrust, } from "../setup/codex.js";
 import { hasManagedMarker, opencodeConfigDir, } from "../setup/opencode.js";
 import { OPENCODE_SKILL_NAMES } from "../setup/opencodeConstants.js";
 import { resolveInvokedUpdateChannel } from "./channels.js";
-import { writeFileAtomic } from "./atomicWriter.js";
-import { applyInstalledHooksRetirementItems, planInstalledHooksRetirementItems, textReferencesV2InstalledHooks, } from "./installedHooksRetirement.js";
-import { projectUsesV3CapabilityInstructionModules } from "./v3CapabilitySurface.js";
+import { doctorRoots } from "./appModel.js";
+import { bindMigrationResource, removeBoundMigrationResource, updateBoundMigrationFile, verifyBoundMigrationResource, } from "./migrationPublication.js";
 const PYTHON_MANAGED_PATTERNS = [
     /hooks\/validate_artifact\.py/,
     /hooks\/cursor_session_start\.py/,
@@ -37,12 +36,11 @@ export function projectHasProjectLevelRuntimeHooks(project) {
     return candidates.some((candidate) => isFile(candidate) || pathExists(candidate));
 }
 const OPENCODE_COMMAND_NAMES = ["agentera"];
-const CURSOR_AGENT_MARKER = "<!-- agentera: managed -->";
-export function resolveNpxHookCommands(ctx) {
+export function resolveNpxHookCommands(ctx, resolvedChannel) {
     const env = ctx.env ?? process.env;
     const home = ctx.home ?? env.HOME ?? os.homedir();
     const sourceRoot = ctx.sourceRoot ?? resolveSourceRoot(env);
-    const channel = resolveInvokedUpdateChannel({
+    const channel = resolvedChannel ?? resolveInvokedUpdateChannel({
         channel: ctx.channel ?? null,
         env,
         home,
@@ -72,15 +70,9 @@ export function rewireRuntimeText(text, runtime, commands) {
     next = next.replace(/uv run\s+\\?"?\$\{AGENTERA_HOME\}\/hooks\/validate_artifact\.py\\?"?/g, commands.validate);
     next = next.replace(/uv run\s+\\?"?\$\{AGENTERA_HOME\}\/app\/hooks\/validate_artifact\.py\\?"?/g, commands.validate);
     next = next.replace(/uv run\s+\\?"?\$\{PLUGIN_ROOT\}\/hooks\/validate_artifact\.py\\?"?/g, commands.validate);
-    next = next.replace(/uv run\s+hooks\/validate_artifact\.py/g, commands.validate);
-    if (next.includes("validate_artifact.py")) {
-        next = next.replace(/["']?[^"'\n]*hooks\/validate_artifact\.py[^"'\n]*["']?/g, `"${commands.validate}"`);
-    }
-    next = next.replace(/["']?[^"'\n]*cursor_session_start\.py[^"'\n]*["']?/g, `"${commands.cursorSessionStart}"`);
-    next = next.replace(/["']?[^"'\n]*cursor_pre_tool_use\.py[^"'\n]*["']?/g, `"${commands.cursorPreTool}"`);
-    next = next.replace(/["']?[^"'\n]*cursor_session_stop\.py[^"'\n]*["']?/g, `"${commands.cursorSessionStop}"`);
-    next = next.replace(/["']?[^"'\n]*\/app\/scripts\/agentera[^"'\n]*["']?/g, `"${commands.cliEntrypoint}"`);
-    next = next.replace(/["']?[^"'\n]*scripts\/agentera[^"'\n]*["']?/g, `"${commands.cliEntrypoint}"`);
+    next = next.replace(/uv run\s+\\?"?\$\{AGENTERA_HOME\}\/(?:app\/scripts|(?:app\/)?hooks)\/cursor_session_start\.py\\?"?/g, `"${commands.cursorSessionStart}"`);
+    next = next.replace(/uv run\s+\\?"?\$\{AGENTERA_HOME\}\/(?:app\/)?hooks\/cursor_pre_tool_use\.py\\?"?/g, `"${commands.cursorPreTool}"`);
+    next = next.replace(/uv run\s+\\?"?\$\{AGENTERA_HOME\}\/(?:app\/)?hooks\/cursor_session_stop\.py\\?"?/g, `"${commands.cursorSessionStop}"`);
     next = next.replace(/npx -y agentera hook /g, `${commands.cliEntrypoint} hook `);
     next = next.replace(/npx -y agentera@latest hook /g, `${commands.cliEntrypoint} hook `);
     if (runtime === "codex") {
@@ -102,10 +94,23 @@ function needsChannelNpxRewire(text, cliEntrypoint) {
     }
     return false;
 }
-function pushRewireItem(items, runtime, filePath, commands) {
+function textHasAuthoritativeV2AgenteraEvidence(text) {
+    const variableReference = /\$\{AGENTERA_HOME\}\/(?:app\/scripts\/(?:agentera|cursor_session_start\.py)|(?:app\/)?hooks\/(?:validate_artifact|cursor_session_start|cursor_pre_tool_use|cursor_session_stop|session_start|session_stop)\.py)/;
+    if (variableReference.test(text))
+        return true;
+    if (/AGENTERA_HOME\s*=/.test(text))
+        return true;
+    if (/\[plugins\."agentera@agentera"\]/.test(text) && /AGENTERA_HOME\s*=/.test(text))
+        return true;
+    return false;
+}
+function pushRewireItem(items, runtime, filePath, commands, allowedRoot) {
     const text = fs.readFileSync(filePath, "utf8");
     const needsBare = needsChannelNpxRewire(text, commands.cliEntrypoint);
-    if (!textUsesPythonManagedEntrypoint(text) && !textReferencesV2InstalledHooks(text) && !needsBare) {
+    const authoritative = hasManagedMarker(text)
+        || textHasAuthoritativeV2AgenteraEvidence(text)
+        || needsBare;
+    if (!authoritative) {
         if (textUsesV3NpmEntrypoint(text)) {
             items.push({
                 status: "noop",
@@ -121,7 +126,7 @@ function pushRewireItem(items, runtime, filePath, commands) {
     }
     const newText = rewireRuntimeText(text, runtime, commands);
     const status = newText === text ? "blocked" : "pending";
-    items.push({
+    const item = {
         status,
         action: "rewire-runtime",
         runtime,
@@ -131,36 +136,19 @@ function pushRewireItem(items, runtime, filePath, commands) {
         message: status === "pending"
             ? "will rewire runtime config from Python managed app-home to npm self-contained entrypoint"
             : "runtime config uses Python managed paths but could not be rewritten safely",
-    });
-}
-function hasCursorManagedAgentMarker(text) {
-    return text.includes(CURSOR_AGENT_MARKER);
-}
-function copyIfChanged(source, target) {
-    if (!isFile(source)) {
-        return false;
-    }
-    if (isFile(target)) {
-        const before = fs.readFileSync(source);
-        const after = fs.readFileSync(target);
-        if (before.equals(after)) {
-            return false;
-        }
+    };
+    const evidenceError = bindMigrationResource(item, "target", filePath, [allowedRoot], "file");
+    if (evidenceError) {
+        item.status = "blocked";
+        item.message = `runtime config preserved: ${evidenceError}; review the unsafe path manually`;
     }
-    fs.mkdirSync(path.dirname(target), { recursive: true });
-    const sourceBytes = fs.readFileSync(source);
-    writeFileAtomic(target, sourceBytes);
-    return true;
+    items.push(item);
 }
-function planCodexItems(items, home, project, commands, force) {
+function planCodexItems(items, home, project, commands) {
     for (const root of [project, home]) {
         const hooksPath = path.join(root, ".codex", "hooks", "codex-hooks.json");
         const configPath = path.join(root, ".codex", "config.toml");
-        if (isFile(hooksPath)) {
-            pushRewireItem(items, "codex", hooksPath, commands);
-        }
         if (isFile(configPath)) {
-            pushRewireItem(items, "codex", configPath, commands);
             const configText = fs.readFileSync(configPath, "utf8");
             const pluginHooks = codexPluginHooksEnabled(configText);
             if (pluginHooks && isFile(hooksPath)) {
@@ -172,292 +160,88 @@ function planCodexItems(items, home, project, commands, force) {
                     hooksText = "";
                 }
                 if (codexCopiedHooksAreAgenteraOnly(hooksText)) {
-                    items.push({
+                    const rewiredConfig = rewireRuntimeText(configText, "codex", commands);
+                    const item = {
                         status: "pending",
                         action: "retire-hooks",
                         runtime: "codex",
                         source: hooksPath,
                         target: configPath,
+                        newText: retireCodexCopiedHookTrust(rewiredConfig, hooksPath),
                         message: "will remove Agentera-owned copied Codex hooks because plugin hooks are enabled",
-                    });
+                    };
+                    const sourceError = bindMigrationResource(item, "source", hooksPath, [root], "file");
+                    const targetError = bindMigrationResource(item, "target", configPath, [root], "file");
+                    if (sourceError || targetError) {
+                        item.status = "blocked";
+                        item.message = `copied Codex hooks preserved: ${sourceError ?? targetError}; review the unsafe path manually`;
+                    }
+                    items.push(item);
+                    continue;
                 }
                 else if (hooksText.includes("validate_artifact") || hooksText.includes("hook validate-artifact")) {
                     items.push({
-                        status: force ? "pending" : "blocked",
+                        status: "blocked",
                         action: "retire-hooks",
                         runtime: "codex",
                         source: hooksPath,
                         target: configPath,
                         message: "plugin hooks are enabled, but copied hook target needs manual review before retirement",
                     });
+                    continue;
                 }
             }
+            pushRewireItem(items, "codex", configPath, commands, root);
+        }
+        if (isFile(hooksPath)) {
+            pushRewireItem(items, "codex", hooksPath, commands, root);
         }
     }
 }
-function planCursorItems(items, home, project, sourceRoot, commands) {
-    for (const hooksPath of [
-        path.join(project, ".cursor", "hooks.json"),
-        path.join(home, ".cursor", "hooks.json"),
+function planCursorItems(items, home, project, commands) {
+    for (const [root, hooksPath] of [
+        [project, path.join(project, ".cursor", "hooks.json")],
+        [home, path.join(home, ".cursor", "hooks.json")],
     ]) {
         if (isFile(hooksPath)) {
-            pushRewireItem(items, "cursor", hooksPath, commands);
-        }
-    }
-    const agentsSource = path.join(sourceRoot, ".cursor", "agents");
-    const pluginSource = path.join(sourceRoot, ".cursor-plugin", "plugin.json");
-    for (const root of [project]) {
-        const agentsDir = path.join(root, ".cursor", "agents");
-        if (isFile(pluginSource) && root === project) {
-            const pluginTarget = path.join(root, ".cursor-plugin", "plugin.json");
-            if (!isFile(pluginTarget)) {
-                items.push({
-                    status: "pending",
-                    action: "copy-plugin",
-                    runtime: "cursor",
-                    source: pluginSource,
-                    target: pluginTarget,
-                    message: "will copy managed Cursor plugin manifest",
-                });
-            }
-            else if (!fs.readFileSync(pluginSource).equals(fs.readFileSync(pluginTarget))) {
-                items.push({
-                    status: "pending",
-                    action: "copy-plugin",
-                    runtime: "cursor",
-                    source: pluginSource,
-                    target: pluginTarget,
-                    message: "will refresh managed Cursor plugin manifest",
-                });
-            }
-        }
-        const skipInTreeCursorAgents = root === project && projectUsesV3CapabilityInstructionModules(project);
-        if (skipInTreeCursorAgents) {
-            items.push({
-                status: "noop",
-                action: "copy-agent",
-                runtime: "cursor",
-                target: agentsDir,
-                message: "v3 capability instruction modules present; in-tree .cursor/agents/ uses prime --context and is not overwritten",
-            });
-        }
-        else if (pathExists(agentsSource)) {
-            const CURSOR_MANAGED_AGENT = "agentera.md";
-            const src = path.join(agentsSource, CURSOR_MANAGED_AGENT);
-            if (isFile(src)) {
-                const dst = path.join(agentsDir, CURSOR_MANAGED_AGENT);
-                if (!isFile(dst)) {
-                    items.push({
-                        status: "pending",
-                        action: "copy-agent",
-                        runtime: "cursor",
-                        source: src,
-                        target: dst,
-                        message: "will copy managed Cursor Agentera agent",
-                    });
-                }
-                else {
-                    const dstText = fs.readFileSync(dst, "utf8");
-                    const srcText = fs.readFileSync(src, "utf8");
-                    if (hasCursorManagedAgentMarker(dstText) && dstText !== srcText) {
-                        items.push({
-                            status: "pending",
-                            action: "copy-agent",
-                            runtime: "cursor",
-                            source: src,
-                            target: dst,
-                            message: "will refresh stale managed Cursor Agentera agent",
-                        });
-                    }
-                }
-            }
+            pushRewireItem(items, "cursor", hooksPath, commands, root);
         }
     }
 }
-function planOpencodeItems(items, home, sourceRoot, env, commands) {
+function planOpencodeItems(items, home, env, commands) {
     const configDir = opencodeConfigDir(home, env);
-    const pluginSource = path.join(sourceRoot, ".opencode", "plugins", "agentera.js");
-    const pluginTarget = path.join(configDir, "plugins", "agentera.js");
-    if (isFile(pluginSource)) {
-        const targetContent = isFile(pluginTarget) ? fs.readFileSync(pluginTarget, "utf8") : "";
-        const sourceContent = fs.readFileSync(pluginSource, "utf8");
-        const needsCopy = !isFile(pluginTarget) ||
-            (targetContent !== sourceContent &&
-                (textUsesPythonManagedEntrypoint(targetContent) ||
-                    needsChannelNpxRewire(targetContent, commands.cliEntrypoint)));
-        items.push({
-            status: needsCopy ? "pending" : "noop",
-            action: "copy-plugin",
-            runtime: "opencode",
-            source: pluginSource,
-            target: pluginTarget,
-            message: needsCopy
-                ? "will copy current Agentera OpenCode plugin to native plugin path"
-                : "OpenCode plugin already current at native plugin path",
-        });
-    }
-    const commandsSourceDir = path.join(sourceRoot, ".opencode", "commands");
-    const commandsTargetDir = path.join(configDir, "commands");
-    for (const name of OPENCODE_COMMAND_NAMES) {
-        const src = path.join(commandsSourceDir, `${name}.md`);
-        const dst = path.join(commandsTargetDir, `${name}.md`);
-        if (isFile(src)) {
-            const needsCopy = !isFile(dst) || (hasManagedMarker(fs.readFileSync(dst, "utf8")) && !fs.readFileSync(src).equals(fs.readFileSync(dst)));
-            items.push({
-                status: needsCopy ? "pending" : "noop",
-                action: "copy-command",
-                runtime: "opencode",
-                source: src,
-                target: dst,
-                message: needsCopy ? "will sync managed OpenCode command" : "OpenCode managed command already current",
-            });
-        }
+    const existingResources = [
+        path.join(configDir, "plugins", "agentera.js"),
+        ...OPENCODE_COMMAND_NAMES.map((name) => path.join(configDir, "commands", `${name}.md`)),
+        path.join(configDir, "agents", "agentera.md"),
+    ];
+    for (const resource of existingResources) {
+        if (isFile(resource))
+            pushRewireItem(items, "opencode", resource, commands, configDir);
     }
-    const agentsSourceDir = path.join(sourceRoot, ".opencode", "agents");
-    const agentsTargetDir = path.join(configDir, "agents");
-    const OPENCODE_MANAGED_AGENT = "agentera.md";
-    if (pathExists(agentsSourceDir)) {
-        const src = path.join(agentsSourceDir, OPENCODE_MANAGED_AGENT);
-        if (isFile(src)) {
-            const dst = path.join(agentsTargetDir, OPENCODE_MANAGED_AGENT);
-            const needsCopy = !isFile(dst) || !fs.readFileSync(src).equals(fs.readFileSync(dst));
-            items.push({
-                status: needsCopy ? "pending" : "noop",
-                action: "copy-agent",
-                runtime: "opencode",
-                source: src,
-                target: dst,
-                message: needsCopy ? "will copy managed OpenCode Agentera agent" : "OpenCode Agentera agent already current",
-            });
-        }
+}
+function symlinkOwnership(linkPath, managedSkillsRoot) {
+    let stat;
+    let target;
+    try {
+        stat = fs.lstatSync(linkPath);
+        if (!stat.isSymbolicLink())
+            return null;
+        target = fs.readlinkSync(linkPath);
     }
-    const skillsSourceRoot = path.join(sourceRoot, "skills");
-    // D78: ~/.agents/skills is the canonical agent-compatible root (opencode loads
-    // from both ~/.config/opencode/skills and ~/.agents/skills and requires skill
-    // names unique across locations — opencode.ai/docs/skills). Maintain the link
-    // here; the legacy ~/.config/opencode/skills entry is retired below.
-    const skillsTargetDir = path.join(home, ".agents", "skills");
-    for (const name of OPENCODE_SKILL_NAMES) {
-        const src = path.join(skillsSourceRoot, name);
-        const dst = path.join(skillsTargetDir, name);
-        if (!isFile(path.join(src, "SKILL.md"))) {
-            continue;
-        }
-        if (!pathExists(dst)) {
-            items.push({
-                status: "pending",
-                action: "link-skill",
-                runtime: "opencode",
-                source: src,
-                target: dst,
-                message: "will create OpenCode skill link",
-            });
-            continue;
-        }
-        try {
-            const linkTarget = fs.readlinkSync(dst);
-            if (!linkTarget.includes("agentera") && path.basename(linkTarget) !== name) {
-                items.push({
-                    status: "blocked",
-                    action: "link-skill",
-                    runtime: "opencode",
-                    source: src,
-                    target: dst,
-                    message: "OpenCode skill path is user-owned; manual review required",
-                });
-            }
-            else if (path.resolve(path.dirname(dst), linkTarget) !== path.resolve(src)) {
-                items.push({
-                    status: "pending",
-                    action: "link-skill",
-                    runtime: "opencode",
-                    source: src,
-                    target: dst,
-                    message: "will update stale Agentera-managed OpenCode skill link",
-                });
-            }
-        }
-        catch {
-            items.push({
-                status: "pending",
-                action: "link-skill",
-                runtime: "opencode",
-                source: src,
-                target: dst,
-                message: "will replace non-symlink OpenCode skill path with managed link",
-            });
-        }
-    }
-    // D78: retire the legacy opencode-specific skill symlinks now that
-    // ~/.agents/skills is canonical. The opencode doc requires skill names
-    // unique across its discovery locations; a skill present in both
-    // ~/.config/opencode/skills and ~/.agents/skills is the duplicate-name error
-    // that let a stale copy load.
-    const legacySkillsDir = path.join(configDir, "skills");
-    if (pathExists(legacySkillsDir) && fs.statSync(legacySkillsDir).isDirectory()) {
-        for (const name of OPENCODE_SKILL_NAMES) {
-            const legacy = path.join(legacySkillsDir, name);
-            let linkTarget = null;
-            try {
-                linkTarget = fs.readlinkSync(legacy);
-            }
-            catch {
-                linkTarget = null;
-            }
-            if (linkTarget !== null) {
-                if (linkTarget.toLowerCase().includes("agentera") || path.basename(linkTarget) === name) {
-                    items.push({
-                        status: "pending",
-                        action: "remove-stale-skill",
-                        runtime: "opencode",
-                        source: legacy,
-                        message: `will retire duplicate OpenCode skill symlink ${name} (agent-compatible root ~/.agents/skills is canonical; D78)`,
-                    });
-                }
-                else {
-                    items.push({
-                        status: "blocked",
-                        action: "remove-stale-skill",
-                        runtime: "opencode",
-                        source: legacy,
-                        message: `legacy OpenCode skill symlink ${name} targets a non-agentera path; manual review required`,
-                    });
-                }
-            }
-            else if (pathExists(legacy)) {
-                try {
-                    const dirEntries = fs.readdirSync(legacy);
-                    if (dirEntries.length === 0) {
-                        items.push({
-                            status: "pending",
-                            action: "remove-stale-skill",
-                            runtime: "opencode",
-                            source: legacy,
-                            message: `will retire empty legacy OpenCode skill directory ${name} (agent-compatible root ~/.agents/skills is canonical; D78)`,
-                        });
-                    }
-                    else {
-                        items.push({
-                            status: "blocked",
-                            action: "remove-stale-skill",
-                            runtime: "opencode",
-                            source: legacy,
-                            message: `legacy OpenCode skill path ${name} is a non-empty real directory (entries: ${dirEntries.length}); manual review required (D78 retires agentera-managed symlinks and empty dirs only)`,
-                        });
-                    }
-                }
-                catch {
-                    items.push({
-                        status: "blocked",
-                        action: "remove-stale-skill",
-                        runtime: "opencode",
-                        source: legacy,
-                        message: `legacy OpenCode skill path ${name} could not be inspected; manual review required`,
-                    });
-                }
-            }
-        }
+    catch {
+        return null;
     }
+    const resolvedTarget = path.resolve(path.dirname(linkPath), target);
+    const relative = path.relative(managedSkillsRoot, resolvedTarget);
+    if (relative === "" || relative.startsWith("..") || path.isAbsolute(relative))
+        return null;
+    return {
+        kind: "managed-app-symlink",
+        identity: `${stat.dev}:${stat.ino}`,
+        fingerprint: `sha256:${createHash("sha256").update(target).digest("hex")}`,
+        root: managedSkillsRoot,
+    };
 }
 export function planStaleCommandCleanupItems(ctx, items) {
     const env = ctx.env ?? process.env;
@@ -483,48 +267,99 @@ export function planStaleCommandCleanupItems(ctx, items) {
         if (currentNames.has(name)) {
             continue;
         }
-        items.push({
+        const item = {
             status: "pending",
             action: "remove-stale-command",
             runtime: "opencode",
             source: filePath,
             message: `will remove stale managed command ${path.basename(filePath)}`,
-        });
+        };
+        const evidenceError = bindMigrationResource(item, "source", filePath, [home], "file");
+        if (evidenceError) {
+            item.status = "blocked";
+            item.message = `stale command preserved: ${evidenceError}; review the unsafe path manually`;
+        }
+        items.push(item);
     }
 }
 export function planStaleSkillCleanupItems(ctx, items) {
     const env = ctx.env ?? process.env;
     const home = resolvePath(ctx.home);
     const skillsDir = path.join(opencodeConfigDir(home, env), "skills");
-    if (!pathExists(skillsDir) || !fs.statSync(skillsDir).isDirectory()) {
+    let skillsDirectory;
+    try {
+        skillsDirectory = fs.lstatSync(skillsDir);
+    }
+    catch {
+        return;
+    }
+    if (!skillsDirectory.isDirectory()) {
+        items.push({
+            status: "blocked",
+            action: "remove-stale-skill",
+            runtime: "opencode",
+            source: skillsDir,
+            message: `preserved ${skillsDir}: the legacy skills path is not a real directory; replace the unsafe path or review it manually`,
+        });
         return;
     }
     const requiredNames = new Set(OPENCODE_SKILL_NAMES);
+    const managedSkillsRoot = path.join(doctorRoots(resolvePath(ctx.appHome)).activeBundleRoot, "skills");
     for (const entry of fs.readdirSync(skillsDir, { withFileTypes: true })) {
+        const linkPath = path.join(skillsDir, entry.name);
         if (!entry.isSymbolicLink()) {
+            if (requiredNames.has(entry.name)) {
+                items.push({
+                    status: "blocked",
+                    action: "remove-stale-skill",
+                    runtime: "opencode",
+                    source: linkPath,
+                    message: `preserved ${linkPath}: name and directory shape do not prove Agentera ownership; review and remove it manually if appropriate`,
+                });
+            }
             continue;
         }
-        const linkPath = path.join(skillsDir, entry.name);
         let linkTarget;
         try {
             linkTarget = fs.readlinkSync(linkPath);
         }
         catch {
+            items.push({
+                status: "blocked",
+                action: "remove-stale-skill",
+                runtime: "opencode",
+                source: linkPath,
+                message: `preserved ${linkPath}: the symlink target could not be inspected; review the unsafe resource manually`,
+            });
             continue;
         }
-        if (!linkTarget.toLowerCase().includes("agentera")) {
-            continue;
-        }
-        if (requiredNames.has(entry.name)) {
+        const ownership = symlinkOwnership(linkPath, managedSkillsRoot);
+        if (!ownership) {
+            if (requiredNames.has(entry.name) || linkTarget.toLowerCase().includes("agentera")) {
+                items.push({
+                    status: "blocked",
+                    action: "remove-stale-skill",
+                    runtime: "opencode",
+                    source: linkPath,
+                    message: `preserved ${linkPath}: skill name or target text does not prove Agentera ownership; confirm ownership and remove it manually if appropriate`,
+                });
+            }
             continue;
         }
-        items.push({
+        const item = {
             status: "pending",
             action: "remove-stale-skill",
             runtime: "opencode",
             source: linkPath,
-            message: `will remove stale Agentera skill symlink ${entry.name}`,
-        });
+            ownership,
+            message: `will remove v2 app-owned OpenCode skill symlink ${entry.name}`,
+        };
+        const evidenceError = bindMigrationResource(item, "source", linkPath, [home], "symlink");
+        if (evidenceError) {
+            item.status = "blocked";
+            item.message = `legacy skill preserved: ${evidenceError}; review the unsafe path manually`;
+        }
+        items.push(item);
     }
 }
 function walkJsonHookFiles(dir) {
@@ -550,7 +385,7 @@ function walkJsonHookFiles(dir) {
 function planCopilotItems(items, project, commands) {
     const hooksDir = path.join(project, ".github", "hooks");
     for (const hookFile of walkJsonHookFiles(hooksDir)) {
-        pushRewireItem(items, "copilot", hookFile, commands);
+        pushRewireItem(items, "copilot", hookFile, commands, project);
     }
     if (!items.some((item) => item.runtime === "copilot")) {
         items.push({
@@ -561,7 +396,7 @@ function planCopilotItems(items, project, commands) {
         });
     }
 }
-export function planRuntimeMigrationItems(ctx) {
+export function planRuntimeMigrationItems(ctx, resolvedChannel) {
     if (!ctx.env) {
         throw new Error("MigrationContext.env is required for runtime migration planning; pass sandboxMigrationEnv(home, sourceRoot) in tests or an explicit env in callers.");
     }
@@ -569,21 +404,25 @@ export function planRuntimeMigrationItems(ctx) {
     const project = resolvePath(ctx.project);
     const env = ctx.env;
     const sourceRoot = resolvePath(ctx.sourceRoot ?? resolveSourceRoot(env));
-    const commands = resolveNpxHookCommands({ ...ctx, home, env, sourceRoot });
+    const commands = resolveNpxHookCommands({ ...ctx, home, env, sourceRoot }, resolvedChannel);
     const items = [];
-    planCodexItems(items, home, project, commands, ctx.force);
-    planCursorItems(items, home, project, sourceRoot, commands);
-    planOpencodeItems(items, home, sourceRoot, env, commands);
+    planCodexItems(items, home, project, commands);
+    planCursorItems(items, home, project, commands);
+    planOpencodeItems(items, home, env, commands);
     planStaleCommandCleanupItems(ctx, items);
     planStaleSkillCleanupItems(ctx, items);
     planCopilotItems(items, project, commands);
-    const hookRetirement = planInstalledHooksRetirementItems(ctx).filter((item) => item.status === "pending");
-    if (hookRetirement.length > 0 && items.some((item) => item.action === "rewire-runtime" && item.status === "pending")) {
-        items.push(...hookRetirement);
-    }
-    void loadRegistry();
     return items;
 }
+const RUNTIME_MIGRATION_ACTIONS = new Set([
+    "rewire-runtime",
+    "retire-hooks",
+    "remove-stale-command",
+    "remove-stale-skill",
+]);
+function isRuntimeMigrationAction(action) {
+    return RUNTIME_MIGRATION_ACTIONS.has(action);
+}
 export function applyRuntimeMigrationItem(item, _commands) {
     if (item.status !== "pending") {
         return;
@@ -596,71 +435,31 @@ export function applyRuntimeMigrationItem(item, _commands) {
                     item.message = "rewire-runtime missing target or newText";
                     return;
                 }
-                writeFileAtomic(item.target, item.newText, "utf8");
+                updateBoundMigrationFile(item, "target", item.newText);
                 item.status = "applied";
                 item.message = "runtime config rewired to npm self-contained entrypoint";
                 break;
             }
-            case "copy-plugin":
-            case "copy-agent":
-            case "copy-command": {
-                if (!item.source || !item.target) {
-                    item.status = "failed";
-                    item.message = `${item.action} missing source or target`;
-                    return;
-                }
-                copyIfChanged(item.source, item.target);
-                item.status = "applied";
-                item.message = `applied ${item.action}`;
-                break;
-            }
-            case "link-skill": {
-                if (!item.source || !item.target) {
+            case "retire-hooks": {
+                if (!item.source) {
                     item.status = "failed";
-                    item.message = "link-skill missing source or target";
+                    item.message = "retire-hooks missing source";
                     return;
                 }
-                if (!pathExists(item.source)) {
+                if (!item.target) {
                     item.status = "failed";
-                    item.message = `link-skill source disappeared between plan and apply: ${item.source}`;
+                    item.message = "retire-hooks missing target";
                     return;
                 }
-                fs.mkdirSync(path.dirname(item.target), { recursive: true });
-                // lstat (not stat): stat follows symlinks and ENOENTs on dangling links; rmSync then fails.
-                let targetStat = null;
-                try {
-                    targetStat = fs.lstatSync(item.target);
-                }
-                catch {
-                    /* target absent */
-                }
-                if (targetStat) {
-                    if (targetStat.isSymbolicLink()) {
-                        fs.unlinkSync(item.target);
-                    }
-                    else {
-                        fs.rmSync(item.target, { recursive: true, force: true });
-                    }
-                }
-                fs.symlinkSync(item.source, item.target);
-                item.status = "applied";
-                item.message = "OpenCode skill link created";
-                break;
-            }
-            case "retire-hooks": {
-                if (!item.source) {
+                verifyBoundMigrationResource(item, "source");
+                verifyBoundMigrationResource(item, "target");
+                if (item.newText === undefined) {
                     item.status = "failed";
-                    item.message = "retire-hooks missing source";
+                    item.message = "retire-hooks missing newText";
                     return;
                 }
-                if (isFile(item.source)) {
-                    fs.rmSync(item.source, { force: true });
-                }
-                if (item.target && isFile(item.target)) {
-                    const configText = fs.readFileSync(item.target, "utf8");
-                    const next = retireCodexCopiedHookTrust(configText, item.source);
-                    writeFileAtomic(item.target, next, "utf8");
-                }
+                updateBoundMigrationFile(item, "target", item.newText);
+                removeBoundMigrationResource(item, "source");
                 item.status = "applied";
                 item.message = "retired Agentera-owned copied Codex hooks";
                 break;
@@ -671,15 +470,15 @@ export function applyRuntimeMigrationItem(item, _commands) {
                     item.message = "remove-stale-command missing source";
                     return;
                 }
-                if (isFile(item.source)) {
-                    fs.rmSync(item.source, { force: true });
-                    item.status = "applied";
-                    item.message = `removed stale managed command ${path.basename(item.source)}`;
-                }
-                else {
+                if (!pathExists(item.source)) {
                     item.status = "noop";
                     item.message = `stale command already absent at ${item.source}`;
                 }
+                else {
+                    removeBoundMigrationResource(item, "source");
+                    item.status = "applied";
+                    item.message = `removed stale managed command ${path.basename(item.source)}`;
+                }
                 break;
             }
             case "remove-stale-skill": {
@@ -691,47 +490,68 @@ export function applyRuntimeMigrationItem(item, _commands) {
                 try {
                     const stat = fs.lstatSync(item.source);
                     if (stat.isSymbolicLink()) {
-                        fs.unlinkSync(item.source);
-                        item.status = "applied";
-                        item.message = `removed stale skill symlink ${path.basename(item.source)}`;
-                    }
-                    else if (stat.isDirectory()) {
-                        const entries = fs.readdirSync(item.source);
-                        if (entries.length === 0) {
-                            fs.rmdirSync(item.source);
-                            item.status = "applied";
-                            item.message = `removed empty skill directory ${path.basename(item.source)}`;
-                        }
-                        else {
+                        const target = fs.readlinkSync(item.source);
+                        const identity = `${stat.dev}:${stat.ino}`;
+                        const fingerprint = `sha256:${createHash("sha256").update(target).digest("hex")}`;
+                        const resolvedTarget = path.resolve(path.dirname(item.source), target);
+                        const relative = item.ownership?.root
+                            ? path.relative(item.ownership.root, resolvedTarget)
+                            : "..";
+                        if (item.ownership?.kind !== "managed-app-symlink"
+                            || item.ownership.identity !== identity
+                            || item.ownership.fingerprint !== fingerprint
+                            || relative === ""
+                            || relative.startsWith("..")
+                            || path.isAbsolute(relative)) {
                             item.status = "blocked";
-                            item.message = `skill directory ${path.basename(item.source)} is non-empty (entries: ${entries.length}); manual review required`;
+                            item.message = `preserved ${item.source}: authoritative symlink ownership changed or is missing; rerun migration and review the resource`;
+                            break;
                         }
+                        removeBoundMigrationResource(item, "source");
+                        item.status = "applied";
+                        item.message = `removed stale skill symlink ${path.basename(item.source)}`;
                     }
                     else {
-                        item.status = "noop";
-                        item.message = "skill path is not a symlink or directory; skipped";
+                        item.status = "blocked";
+                        item.message = `preserved ${item.source}: only a fingerprinted v2 app-owned symlink is eligible; review it manually`;
                     }
                 }
-                catch {
-                    item.status = "noop";
-                    item.message = "stale skill already absent";
+                catch (error) {
+                    if (error.code === "ENOENT") {
+                        item.status = "noop";
+                        item.message = "stale skill already absent";
+                    }
+                    else {
+                        item.status = "failed";
+                        item.message = `remove-stale-skill failed: ${error.message}`;
+                    }
                 }
                 break;
             }
             default:
+                item.status = "failed";
+                item.message = `unsupported runtime migration action: ${item.action}`;
                 break;
         }
     }
     catch (exc) {
-        item.status = "failed";
-        item.message = `${item.action} failed: ${exc.message}`;
+        item.status = "blocked";
+        item.message = `${item.action} preserved the resource: ${exc.message}; rerun migration and review it manually`;
     }
 }
 export function applyRuntimeMigrationItems(items, ctx) {
     const commands = resolveNpxHookCommands(ctx);
     for (const item of items) {
-        applyRuntimeMigrationItem(item, commands);
+        if (item.status !== "pending") {
+            continue;
+        }
+        if (isRuntimeMigrationAction(item.action)) {
+            applyRuntimeMigrationItem(item, commands);
+        }
+        else {
+            item.status = "failed";
+            item.message = `unsupported runtime migration action: ${item.action}`;
+        }
     }
-    applyInstalledHooksRetirementItems(items, ctx);
 }
 //# sourceMappingURL=runtimeMigration.js.map