agentera 3.0.0-dev.4 → 3.0.0-dev.41

package/dist/upgrade/runtimeMigration.js

@@ -1,14 +1,22 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { createHash } from "node:crypto";
 import { isFile, pathExists, resolvePath } from "../core/paths.js";
 import { resolveSourceRoot } from "../core/sourceRoot.js";
-import { loadRegistry } from "../registries/runtimeAdapterRegistry.js";
 import { codexCopiedHooksAreAgenteraOnly, codexPluginHooksEnabled, retireCodexCopiedHookTrust, } from "../setup/codex.js";
-import { hasManagedMarker, opencodeCommandTemplate, opencodeConfigDir, } from "../setup/doctor.js";
-import { resolveUpdateChannel } from "./channels.js";
+import { hasManagedMarker, opencodeConfigDir, } from "../setup/opencode.js";
+import { OPENCODE_SKILL_NAMES } from "../setup/opencodeConstants.js";
+import { resolveInvokedUpdateChannel } from "./channels.js";
+import { doctorRoots } from "./appModel.js";
+import { bindMigrationResource, removeBoundMigrationResource, updateBoundMigrationFile, verifyBoundMigrationResource, } from "./migrationPublication.js";
 const PYTHON_MANAGED_PATTERNS = [
     /hooks\/validate_artifact\.py/,
+    /hooks\/cursor_session_start\.py/,
+    /hooks\/cursor_pre_tool_use\.py/,
+    /hooks\/cursor_session_stop\.py/,
+    /hooks\/session_start\.py/,
+    /hooks\/session_stop\.py/,
     /\buv run\b/,
     /\buvx\b/,
     /scripts\/agentera/,
@@ -17,14 +25,6 @@ const PYTHON_MANAGED_PATTERNS = [
     /cursor_pre_tool_use\.py/,
     /cursor_session_stop\.py/,
 ];
-const RUNTIME_MIGRATION_ACTIONS = new Set([
-    "rewire-runtime",
-    "retire-hooks",
-    "copy-plugin",
-    "copy-agent",
-    "copy-command",
-    "link-skill",
-]);
 export function projectHasProjectLevelRuntimeHooks(project) {
     const root = resolvePath(project);
     const candidates = [
@@ -36,13 +36,11 @@ export function projectHasProjectLevelRuntimeHooks(project) {
     return candidates.some((candidate) => isFile(candidate) || pathExists(candidate));
 }
 const OPENCODE_COMMAND_NAMES = ["agentera"];
-const OPENCODE_SKILL_NAMES = ["agentera", "hej"];
-const CURSOR_AGENT_MARKER = "<!-- agentera: managed -->";
-export function resolveNpxHookCommands(ctx) {
+export function resolveNpxHookCommands(ctx, resolvedChannel) {
     const env = ctx.env ?? process.env;
     const home = ctx.home ?? env.HOME ?? os.homedir();
     const sourceRoot = ctx.sourceRoot ?? resolveSourceRoot(env);
-    const channel = resolveUpdateChannel({
+    const channel = resolvedChannel ?? resolveInvokedUpdateChannel({
         channel: ctx.channel ?? null,
         env,
         home,
@@ -63,18 +61,18 @@ export function textUsesPythonManagedEntrypoint(text) {
     }
     return PYTHON_MANAGED_PATTERNS.some((pattern) => pattern.test(text));
 }
+const V3_NPX_ENTRYPOINT = /\bnpx\s+-y\s+agentera\b/;
+export function textUsesV3NpmEntrypoint(text) {
+    return V3_NPX_ENTRYPOINT.test(text);
+}
 export function rewireRuntimeText(text, runtime, commands) {
     let next = text;
     next = next.replace(/uv run\s+\\?"?\$\{AGENTERA_HOME\}\/hooks\/validate_artifact\.py\\?"?/g, commands.validate);
+    next = next.replace(/uv run\s+\\?"?\$\{AGENTERA_HOME\}\/app\/hooks\/validate_artifact\.py\\?"?/g, commands.validate);
     next = next.replace(/uv run\s+\\?"?\$\{PLUGIN_ROOT\}\/hooks\/validate_artifact\.py\\?"?/g, commands.validate);
-    if (next.includes("validate_artifact.py")) {
-        next = next.replace(/["']?[^"'\n]*hooks\/validate_artifact\.py[^"'\n]*["']?/g, `"${commands.validate}"`);
-    }
-    next = next.replace(/["']?[^"'\n]*cursor_session_start\.py[^"'\n]*["']?/g, `"${commands.cursorSessionStart}"`);
-    next = next.replace(/["']?[^"'\n]*cursor_pre_tool_use\.py[^"'\n]*["']?/g, `"${commands.cursorPreTool}"`);
-    next = next.replace(/["']?[^"'\n]*cursor_session_stop\.py[^"'\n]*["']?/g, `"${commands.cursorSessionStop}"`);
-    next = next.replace(/["']?[^"'\n]*\/app\/scripts\/agentera[^"'\n]*["']?/g, `"${commands.cliEntrypoint}"`);
-    next = next.replace(/["']?[^"'\n]*scripts\/agentera[^"'\n]*["']?/g, `"${commands.cliEntrypoint}"`);
+    next = next.replace(/uv run\s+\\?"?\$\{AGENTERA_HOME\}\/(?:app\/scripts|(?:app\/)?hooks)\/cursor_session_start\.py\\?"?/g, `"${commands.cursorSessionStart}"`);
+    next = next.replace(/uv run\s+\\?"?\$\{AGENTERA_HOME\}\/(?:app\/)?hooks\/cursor_pre_tool_use\.py\\?"?/g, `"${commands.cursorPreTool}"`);
+    next = next.replace(/uv run\s+\\?"?\$\{AGENTERA_HOME\}\/(?:app\/)?hooks\/cursor_session_stop\.py\\?"?/g, `"${commands.cursorSessionStop}"`);
     next = next.replace(/npx -y agentera hook /g, `${commands.cliEntrypoint} hook `);
     next = next.replace(/npx -y agentera@latest hook /g, `${commands.cliEntrypoint} hook `);
     if (runtime === "codex") {
@@ -96,11 +94,24 @@ function needsChannelNpxRewire(text, cliEntrypoint) {
     }
     return false;
 }
-function pushRewireItem(items, runtime, filePath, commands) {
+function textHasAuthoritativeV2AgenteraEvidence(text) {
+    const variableReference = /\$\{AGENTERA_HOME\}\/(?:app\/scripts\/(?:agentera|cursor_session_start\.py)|(?:app\/)?hooks\/(?:validate_artifact|cursor_session_start|cursor_pre_tool_use|cursor_session_stop|session_start|session_stop)\.py)/;
+    if (variableReference.test(text))
+        return true;
+    if (/AGENTERA_HOME\s*=/.test(text))
+        return true;
+    if (/\[plugins\."agentera@agentera"\]/.test(text) && /AGENTERA_HOME\s*=/.test(text))
+        return true;
+    return false;
+}
+function pushRewireItem(items, runtime, filePath, commands, allowedRoot) {
     const text = fs.readFileSync(filePath, "utf8");
     const needsBare = needsChannelNpxRewire(text, commands.cliEntrypoint);
-    if (!textUsesPythonManagedEntrypoint(text) && !needsBare) {
-        if (text.includes(commands.cliEntrypoint)) {
+    const authoritative = hasManagedMarker(text)
+        || textHasAuthoritativeV2AgenteraEvidence(text)
+        || needsBare;
+    if (!authoritative) {
+        if (textUsesV3NpmEntrypoint(text)) {
             items.push({
                 status: "noop",
                 action: "rewire-runtime",
@@ -109,11 +120,13 @@ function pushRewireItem(items, runtime, filePath, commands) {
                 message: "runtime config already references npm self-contained entrypoint",
             });
         }
+        // If the file has no Agentera content at all (no v2 Python, no v3 npm),
+        // it is not Agentera-managed. Do not push a blocked item — just return.
         return;
     }
     const newText = rewireRuntimeText(text, runtime, commands);
     const status = newText === text ? "blocked" : "pending";
-    items.push({
+    const item = {
         status,
         action: "rewire-runtime",
         runtime,
@@ -123,247 +136,230 @@ function pushRewireItem(items, runtime, filePath, commands) {
         message: status === "pending"
             ? "will rewire runtime config from Python managed app-home to npm self-contained entrypoint"
             : "runtime config uses Python managed paths but could not be rewritten safely",
-    });
-}
-function hasCursorManagedAgentMarker(text) {
-    return text.includes(CURSOR_AGENT_MARKER);
-}
-function copyIfChanged(source, target) {
-    if (!isFile(source)) {
-        return false;
-    }
-    if (isFile(target)) {
-        const before = fs.readFileSync(source);
-        const after = fs.readFileSync(target);
-        if (before.equals(after)) {
-            return false;
-        }
+    };
+    const evidenceError = bindMigrationResource(item, "target", filePath, [allowedRoot], "file");
+    if (evidenceError) {
+        item.status = "blocked";
+        item.message = `runtime config preserved: ${evidenceError}; review the unsafe path manually`;
     }
-    fs.mkdirSync(path.dirname(target), { recursive: true });
-    fs.copyFileSync(source, target);
-    return true;
+    items.push(item);
 }
-function planCodexItems(items, home, commands, force) {
-    const hooksPath = path.join(home, ".codex", "hooks", "codex-hooks.json");
-    const configPath = path.join(home, ".codex", "config.toml");
-    if (isFile(hooksPath)) {
-        pushRewireItem(items, "codex", hooksPath, commands);
-    }
-    if (isFile(configPath)) {
-        pushRewireItem(items, "codex", configPath, commands);
-        let configText = fs.readFileSync(configPath, "utf8");
-        if (isFile(hooksPath)) {
-            configText = fs.readFileSync(configPath, "utf8");
-        }
-        const pluginHooks = codexPluginHooksEnabled(configText);
-        if (pluginHooks && isFile(hooksPath)) {
-            let hooksText;
-            try {
-                hooksText = fs.readFileSync(hooksPath, "utf8");
-            }
-            catch {
-                hooksText = "";
-            }
-            if (codexCopiedHooksAreAgenteraOnly(hooksText)) {
-                items.push({
-                    status: "pending",
-                    action: "retire-hooks",
-                    runtime: "codex",
-                    source: hooksPath,
-                    target: configPath,
-                    message: "will remove Agentera-owned copied Codex hooks because plugin hooks are enabled",
-                });
-            }
-            else if (hooksText.includes("validate_artifact") || hooksText.includes("hook validate-artifact")) {
-                items.push({
-                    status: force ? "pending" : "blocked",
-                    action: "retire-hooks",
-                    runtime: "codex",
-                    source: hooksPath,
-                    target: configPath,
-                    message: "plugin hooks are enabled, but copied hook target needs manual review before retirement",
-                });
+function planCodexItems(items, home, project, commands) {
+    for (const root of [project, home]) {
+        const hooksPath = path.join(root, ".codex", "hooks", "codex-hooks.json");
+        const configPath = path.join(root, ".codex", "config.toml");
+        if (isFile(configPath)) {
+            const configText = fs.readFileSync(configPath, "utf8");
+            const pluginHooks = codexPluginHooksEnabled(configText);
+            if (pluginHooks && isFile(hooksPath)) {
+                let hooksText;
+                try {
+                    hooksText = fs.readFileSync(hooksPath, "utf8");
+                }
+                catch {
+                    hooksText = "";
+                }
+                if (codexCopiedHooksAreAgenteraOnly(hooksText)) {
+                    const rewiredConfig = rewireRuntimeText(configText, "codex", commands);
+                    const item = {
+                        status: "pending",
+                        action: "retire-hooks",
+                        runtime: "codex",
+                        source: hooksPath,
+                        target: configPath,
+                        newText: retireCodexCopiedHookTrust(rewiredConfig, hooksPath),
+                        message: "will remove Agentera-owned copied Codex hooks because plugin hooks are enabled",
+                    };
+                    const sourceError = bindMigrationResource(item, "source", hooksPath, [root], "file");
+                    const targetError = bindMigrationResource(item, "target", configPath, [root], "file");
+                    if (sourceError || targetError) {
+                        item.status = "blocked";
+                        item.message = `copied Codex hooks preserved: ${sourceError ?? targetError}; review the unsafe path manually`;
+                    }
+                    items.push(item);
+                    continue;
+                }
+                else if (hooksText.includes("validate_artifact") || hooksText.includes("hook validate-artifact")) {
+                    items.push({
+                        status: "blocked",
+                        action: "retire-hooks",
+                        runtime: "codex",
+                        source: hooksPath,
+                        target: configPath,
+                        message: "plugin hooks are enabled, but copied hook target needs manual review before retirement",
+                    });
+                    continue;
+                }
             }
+            pushRewireItem(items, "codex", configPath, commands, root);
+        }
+        if (isFile(hooksPath)) {
+            pushRewireItem(items, "codex", hooksPath, commands, root);
         }
     }
 }
-function planCursorItems(items, home, project, sourceRoot, commands) {
-    for (const hooksPath of [
-        path.join(project, ".cursor", "hooks.json"),
-        path.join(home, ".cursor", "hooks.json"),
+function planCursorItems(items, home, project, commands) {
+    for (const [root, hooksPath] of [
+        [project, path.join(project, ".cursor", "hooks.json")],
+        [home, path.join(home, ".cursor", "hooks.json")],
     ]) {
         if (isFile(hooksPath)) {
-            pushRewireItem(items, "cursor", hooksPath, commands);
+            pushRewireItem(items, "cursor", hooksPath, commands, root);
         }
     }
-    const agentsSource = path.join(sourceRoot, ".cursor", "agents");
-    const pluginSource = path.join(sourceRoot, ".cursor-plugin", "plugin.json");
-    for (const root of [project]) {
-        const agentsDir = path.join(root, ".cursor", "agents");
-        if (isFile(pluginSource) && root === project) {
-            const pluginTarget = path.join(root, ".cursor-plugin", "plugin.json");
-            if (!isFile(pluginTarget)) {
-                items.push({
-                    status: "pending",
-                    action: "copy-plugin",
-                    runtime: "cursor",
-                    source: pluginSource,
-                    target: pluginTarget,
-                    message: "will copy managed Cursor plugin manifest",
-                });
-            }
-            else if (!fs.readFileSync(pluginSource).equals(fs.readFileSync(pluginTarget))) {
-                items.push({
-                    status: "pending",
-                    action: "copy-plugin",
-                    runtime: "cursor",
-                    source: pluginSource,
-                    target: pluginTarget,
-                    message: "will refresh managed Cursor plugin manifest",
-                });
-            }
+}
+function planOpencodeItems(items, home, env, commands) {
+    const configDir = opencodeConfigDir(home, env);
+    const existingResources = [
+        path.join(configDir, "plugins", "agentera.js"),
+        ...OPENCODE_COMMAND_NAMES.map((name) => path.join(configDir, "commands", `${name}.md`)),
+        path.join(configDir, "agents", "agentera.md"),
+    ];
+    for (const resource of existingResources) {
+        if (isFile(resource))
+            pushRewireItem(items, "opencode", resource, commands, configDir);
+    }
+}
+function symlinkOwnership(linkPath, managedSkillsRoot) {
+    let stat;
+    let target;
+    try {
+        stat = fs.lstatSync(linkPath);
+        if (!stat.isSymbolicLink())
+            return null;
+        target = fs.readlinkSync(linkPath);
+    }
+    catch {
+        return null;
+    }
+    const resolvedTarget = path.resolve(path.dirname(linkPath), target);
+    const relative = path.relative(managedSkillsRoot, resolvedTarget);
+    if (relative === "" || relative.startsWith("..") || path.isAbsolute(relative))
+        return null;
+    return {
+        kind: "managed-app-symlink",
+        identity: `${stat.dev}:${stat.ino}`,
+        fingerprint: `sha256:${createHash("sha256").update(target).digest("hex")}`,
+        root: managedSkillsRoot,
+    };
+}
+export function planStaleCommandCleanupItems(ctx, items) {
+    const env = ctx.env ?? process.env;
+    const home = resolvePath(ctx.home);
+    const commandsDir = path.join(opencodeConfigDir(home, env), "commands");
+    if (!pathExists(commandsDir) || !fs.statSync(commandsDir).isDirectory()) {
+        return;
+    }
+    const currentNames = new Set(OPENCODE_COMMAND_NAMES);
+    for (const entry of fs.readdirSync(commandsDir)) {
+        if (!entry.endsWith(".md")) {
+            continue;
         }
-        if (pathExists(agentsSource)) {
-            for (const entry of fs.readdirSync(agentsSource)) {
-                if (!entry.endsWith(".md"))
-                    continue;
-                const src = path.join(agentsSource, entry);
-                const dst = path.join(agentsDir, entry);
-                if (!isFile(dst)) {
-                    items.push({
-                        status: "pending",
-                        action: "copy-agent",
-                        runtime: "cursor",
-                        source: src,
-                        target: dst,
-                        message: "will copy managed Cursor capability agent",
-                    });
-                    continue;
-                }
-                const dstText = fs.readFileSync(dst, "utf8");
-                const srcText = fs.readFileSync(src, "utf8");
-                if (hasCursorManagedAgentMarker(dstText) && dstText !== srcText) {
-                    items.push({
-                        status: "pending",
-                        action: "copy-agent",
-                        runtime: "cursor",
-                        source: src,
-                        target: dst,
-                        message: "will refresh stale managed Cursor capability agent",
-                    });
-                }
-            }
+        const filePath = path.join(commandsDir, entry);
+        if (!isFile(filePath)) {
+            continue;
+        }
+        const body = fs.readFileSync(filePath, "utf8");
+        if (!hasManagedMarker(body)) {
+            continue;
+        }
+        const name = entry.slice(0, -3);
+        if (currentNames.has(name)) {
+            continue;
         }
+        const item = {
+            status: "pending",
+            action: "remove-stale-command",
+            runtime: "opencode",
+            source: filePath,
+            message: `will remove stale managed command ${path.basename(filePath)}`,
+        };
+        const evidenceError = bindMigrationResource(item, "source", filePath, [home], "file");
+        if (evidenceError) {
+            item.status = "blocked";
+            item.message = `stale command preserved: ${evidenceError}; review the unsafe path manually`;
+        }
+        items.push(item);
     }
 }
-function planOpencodeItems(items, home, sourceRoot, env, commands) {
-    const configDir = opencodeConfigDir(home, env);
-    const pluginSource = path.join(sourceRoot, ".opencode", "plugins", "agentera.js");
-    const pluginTarget = path.join(configDir, "plugins", "agentera.js");
-    if (isFile(pluginSource)) {
-        const needsCopy = !isFile(pluginTarget) ||
-            textUsesPythonManagedEntrypoint(fs.readFileSync(pluginTarget, "utf8")) ||
-            needsChannelNpxRewire(fs.readFileSync(pluginTarget, "utf8"), commands.cliEntrypoint);
+export function planStaleSkillCleanupItems(ctx, items) {
+    const env = ctx.env ?? process.env;
+    const home = resolvePath(ctx.home);
+    const skillsDir = path.join(opencodeConfigDir(home, env), "skills");
+    let skillsDirectory;
+    try {
+        skillsDirectory = fs.lstatSync(skillsDir);
+    }
+    catch {
+        return;
+    }
+    if (!skillsDirectory.isDirectory()) {
         items.push({
-            status: needsCopy ? "pending" : "noop",
-            action: "copy-plugin",
+            status: "blocked",
+            action: "remove-stale-skill",
             runtime: "opencode",
-            source: pluginSource,
-            target: pluginTarget,
-            message: needsCopy
-                ? "will copy current Agentera OpenCode plugin to native plugin path"
-                : "OpenCode plugin already current at native plugin path",
+            source: skillsDir,
+            message: `preserved ${skillsDir}: the legacy skills path is not a real directory; replace the unsafe path or review it manually`,
         });
+        return;
     }
-    const commandsSourceDir = path.join(sourceRoot, ".opencode", "commands");
-    const commandsTargetDir = path.join(configDir, "commands");
-    for (const name of OPENCODE_COMMAND_NAMES) {
-        const src = path.join(commandsSourceDir, `${name}.md`);
-        const expected = opencodeCommandTemplate(name);
-        const dst = path.join(commandsTargetDir, `${name}.md`);
-        if (isFile(src)) {
-            const needsCopy = !isFile(dst) || (hasManagedMarker(fs.readFileSync(dst, "utf8")) && fs.readFileSync(dst, "utf8") !== expected);
-            items.push({
-                status: needsCopy ? "pending" : "noop",
-                action: "copy-command",
-                runtime: "opencode",
-                source: src,
-                target: dst,
-                message: needsCopy ? "will sync managed OpenCode command" : "OpenCode managed command already current",
-            });
-        }
-    }
-    const agentsSourceDir = path.join(sourceRoot, ".opencode", "agents");
-    const agentsTargetDir = path.join(configDir, "agents");
-    if (pathExists(agentsSourceDir)) {
-        for (const entry of fs.readdirSync(agentsSourceDir)) {
-            if (!entry.endsWith(".md"))
-                continue;
-            const src = path.join(agentsSourceDir, entry);
-            const dst = path.join(agentsTargetDir, entry);
-            const needsCopy = !isFile(dst) || !fs.readFileSync(src).equals(fs.readFileSync(dst));
-            items.push({
-                status: needsCopy ? "pending" : "noop",
-                action: "copy-agent",
-                runtime: "opencode",
-                source: src,
-                target: dst,
-                message: needsCopy ? "will copy managed OpenCode capability agent" : "OpenCode agent already current",
-            });
-        }
-    }
-    const skillsSourceRoot = path.join(sourceRoot, "skills");
-    const skillsTargetDir = path.join(configDir, "skills");
-    for (const name of OPENCODE_SKILL_NAMES) {
-        const src = path.join(skillsSourceRoot, name);
-        const dst = path.join(skillsTargetDir, name);
-        if (!isFile(path.join(src, "SKILL.md"))) {
+    const requiredNames = new Set(OPENCODE_SKILL_NAMES);
+    const managedSkillsRoot = path.join(doctorRoots(resolvePath(ctx.appHome)).activeBundleRoot, "skills");
+    for (const entry of fs.readdirSync(skillsDir, { withFileTypes: true })) {
+        const linkPath = path.join(skillsDir, entry.name);
+        if (!entry.isSymbolicLink()) {
+            if (requiredNames.has(entry.name)) {
+                items.push({
+                    status: "blocked",
+                    action: "remove-stale-skill",
+                    runtime: "opencode",
+                    source: linkPath,
+                    message: `preserved ${linkPath}: name and directory shape do not prove Agentera ownership; review and remove it manually if appropriate`,
+                });
+            }
             continue;
         }
-        if (!pathExists(dst)) {
+        let linkTarget;
+        try {
+            linkTarget = fs.readlinkSync(linkPath);
+        }
+        catch {
             items.push({
-                status: "pending",
-                action: "link-skill",
+                status: "blocked",
+                action: "remove-stale-skill",
                 runtime: "opencode",
-                source: src,
-                target: dst,
-                message: "will create OpenCode skill link",
+                source: linkPath,
+                message: `preserved ${linkPath}: the symlink target could not be inspected; review the unsafe resource manually`,
             });
             continue;
         }
-        try {
-            const linkTarget = fs.readlinkSync(dst);
-            if (!linkTarget.includes("agentera") && path.basename(linkTarget) !== name) {
+        const ownership = symlinkOwnership(linkPath, managedSkillsRoot);
+        if (!ownership) {
+            if (requiredNames.has(entry.name) || linkTarget.toLowerCase().includes("agentera")) {
                 items.push({
                     status: "blocked",
-                    action: "link-skill",
+                    action: "remove-stale-skill",
                     runtime: "opencode",
-                    source: src,
-                    target: dst,
-                    message: "OpenCode skill path is user-owned; manual review required",
-                });
-            }
-            else if (path.resolve(path.dirname(dst), linkTarget) !== path.resolve(src)) {
-                items.push({
-                    status: "pending",
-                    action: "link-skill",
-                    runtime: "opencode",
-                    source: src,
-                    target: dst,
-                    message: "will update stale Agentera-managed OpenCode skill link",
+                    source: linkPath,
+                    message: `preserved ${linkPath}: skill name or target text does not prove Agentera ownership; confirm ownership and remove it manually if appropriate`,
                 });
             }
+            continue;
         }
-        catch {
-            items.push({
-                status: "pending",
-                action: "link-skill",
-                runtime: "opencode",
-                source: src,
-                target: dst,
-                message: "will replace non-symlink OpenCode skill path with managed link",
-            });
+        const item = {
+            status: "pending",
+            action: "remove-stale-skill",
+            runtime: "opencode",
+            source: linkPath,
+            ownership,
+            message: `will remove v2 app-owned OpenCode skill symlink ${entry.name}`,
+        };
+        const evidenceError = bindMigrationResource(item, "source", linkPath, [home], "symlink");
+        if (evidenceError) {
+            item.status = "blocked";
+            item.message = `legacy skill preserved: ${evidenceError}; review the unsafe path manually`;
         }
+        items.push(item);
     }
 }
 function walkJsonHookFiles(dir) {
@@ -389,7 +385,7 @@ function walkJsonHookFiles(dir) {
 function planCopilotItems(items, project, commands) {
     const hooksDir = path.join(project, ".github", "hooks");
     for (const hookFile of walkJsonHookFiles(hooksDir)) {
-        pushRewireItem(items, "copilot", hookFile, commands);
+        pushRewireItem(items, "copilot", hookFile, commands, project);
     }
     if (!items.some((item) => item.runtime === "copilot")) {
         items.push({
@@ -400,28 +396,34 @@ function planCopilotItems(items, project, commands) {
         });
     }
 }
-function planEnvRuntimeNoops(items, runtime, message) {
-    if (!items.some((item) => item.runtime === runtime)) {
-        items.push({ status: "noop", action: "configure", runtime, message });
+export function planRuntimeMigrationItems(ctx, resolvedChannel) {
+    if (!ctx.env) {
+        throw new Error("MigrationContext.env is required for runtime migration planning; pass sandboxMigrationEnv(home, sourceRoot) in tests or an explicit env in callers.");
     }
-}
-export function planRuntimeMigrationItems(ctx) {
     const home = resolvePath(ctx.home);
     const project = resolvePath(ctx.project);
-    const env = ctx.env ?? { ...process.env, HOME: home };
+    const env = ctx.env;
     const sourceRoot = resolvePath(ctx.sourceRoot ?? resolveSourceRoot(env));
-    const commands = resolveNpxHookCommands({ ...ctx, home, env, sourceRoot });
+    const commands = resolveNpxHookCommands({ ...ctx, home, env, sourceRoot }, resolvedChannel);
     const items = [];
-    planCodexItems(items, home, commands, ctx.force);
-    planCursorItems(items, home, project, sourceRoot, commands);
-    planOpencodeItems(items, home, sourceRoot, env, commands);
+    planCodexItems(items, home, project, commands);
+    planCursorItems(items, home, project, commands);
+    planOpencodeItems(items, home, env, commands);
+    planStaleCommandCleanupItems(ctx, items);
+    planStaleSkillCleanupItems(ctx, items);
     planCopilotItems(items, project, commands);
-    planEnvRuntimeNoops(items, "claude", "Claude Code plugin installs expose the app home without local config writes; use --update-packages to refresh marketplace surfaces");
-    planEnvRuntimeNoops(items, "cursor-agent", "Cursor Agent CLI inherits workspace Cursor hooks; no separate managed install surface");
-    void loadRegistry();
     return items;
 }
-export function applyRuntimeMigrationItem(item, commands) {
+const RUNTIME_MIGRATION_ACTIONS = new Set([
+    "rewire-runtime",
+    "retire-hooks",
+    "remove-stale-command",
+    "remove-stale-skill",
+]);
+function isRuntimeMigrationAction(action) {
+    return RUNTIME_MIGRATION_ACTIONS.has(action);
+}
+export function applyRuntimeMigrationItem(item, _commands) {
     if (item.status !== "pending") {
         return;
     }
@@ -433,70 +435,123 @@ export function applyRuntimeMigrationItem(item, commands) {
                     item.message = "rewire-runtime missing target or newText";
                     return;
                 }
-                fs.writeFileSync(item.target, item.newText, "utf8");
+                updateBoundMigrationFile(item, "target", item.newText);
                 item.status = "applied";
                 item.message = "runtime config rewired to npm self-contained entrypoint";
                 break;
             }
-            case "copy-plugin":
-            case "copy-agent":
-            case "copy-command": {
-                if (!item.source || !item.target) {
+            case "retire-hooks": {
+                if (!item.source) {
                     item.status = "failed";
-                    item.message = `${item.action} missing source or target`;
+                    item.message = "retire-hooks missing source";
                     return;
                 }
-                copyIfChanged(item.source, item.target);
+                if (!item.target) {
+                    item.status = "failed";
+                    item.message = "retire-hooks missing target";
+                    return;
+                }
+                verifyBoundMigrationResource(item, "source");
+                verifyBoundMigrationResource(item, "target");
+                if (item.newText === undefined) {
+                    item.status = "failed";
+                    item.message = "retire-hooks missing newText";
+                    return;
+                }
+                updateBoundMigrationFile(item, "target", item.newText);
+                removeBoundMigrationResource(item, "source");
                 item.status = "applied";
-                item.message = `applied ${item.action}`;
+                item.message = "retired Agentera-owned copied Codex hooks";
                 break;
             }
-            case "link-skill": {
-                if (!item.source || !item.target) {
+            case "remove-stale-command": {
+                if (!item.source) {
                     item.status = "failed";
-                    item.message = "link-skill missing source or target";
+                    item.message = "remove-stale-command missing source";
                     return;
                 }
-                fs.mkdirSync(path.dirname(item.target), { recursive: true });
-                if (pathExists(item.target)) {
-                    fs.rmSync(item.target, { recursive: true, force: true });
+                if (!pathExists(item.source)) {
+                    item.status = "noop";
+                    item.message = `stale command already absent at ${item.source}`;
+                }
+                else {
+                    removeBoundMigrationResource(item, "source");
+                    item.status = "applied";
+                    item.message = `removed stale managed command ${path.basename(item.source)}`;
                 }
-                fs.symlinkSync(item.source, item.target);
-                item.status = "applied";
-                item.message = "OpenCode skill link created";
                 break;
             }
-            case "retire-hooks": {
+            case "remove-stale-skill": {
                 if (!item.source) {
                     item.status = "failed";
-                    item.message = "retire-hooks missing source";
+                    item.message = "remove-stale-skill missing source";
                     return;
                 }
-                if (isFile(item.source)) {
-                    fs.rmSync(item.source, { force: true });
+                try {
+                    const stat = fs.lstatSync(item.source);
+                    if (stat.isSymbolicLink()) {
+                        const target = fs.readlinkSync(item.source);
+                        const identity = `${stat.dev}:${stat.ino}`;
+                        const fingerprint = `sha256:${createHash("sha256").update(target).digest("hex")}`;
+                        const resolvedTarget = path.resolve(path.dirname(item.source), target);
+                        const relative = item.ownership?.root
+                            ? path.relative(item.ownership.root, resolvedTarget)
+                            : "..";
+                        if (item.ownership?.kind !== "managed-app-symlink"
+                            || item.ownership.identity !== identity
+                            || item.ownership.fingerprint !== fingerprint
+                            || relative === ""
+                            || relative.startsWith("..")
+                            || path.isAbsolute(relative)) {
+                            item.status = "blocked";
+                            item.message = `preserved ${item.source}: authoritative symlink ownership changed or is missing; rerun migration and review the resource`;
+                            break;
+                        }
+                        removeBoundMigrationResource(item, "source");
+                        item.status = "applied";
+                        item.message = `removed stale skill symlink ${path.basename(item.source)}`;
+                    }
+                    else {
+                        item.status = "blocked";
+                        item.message = `preserved ${item.source}: only a fingerprinted v2 app-owned symlink is eligible; review it manually`;
+                    }
                 }
-                if (item.target && isFile(item.target)) {
-                    const configText = fs.readFileSync(item.target, "utf8");
-                    const next = retireCodexCopiedHookTrust(configText, item.source);
-                    fs.writeFileSync(item.target, next, "utf8");
+                catch (error) {
+                    if (error.code === "ENOENT") {
+                        item.status = "noop";
+                        item.message = "stale skill already absent";
+                    }
+                    else {
+                        item.status = "failed";
+                        item.message = `remove-stale-skill failed: ${error.message}`;
+                    }
                 }
-                item.status = "applied";
-                item.message = "retired Agentera-owned copied Codex hooks";
                 break;
             }
             default:
+                item.status = "failed";
+                item.message = `unsupported runtime migration action: ${item.action}`;
                 break;
         }
     }
     catch (exc) {
-        item.status = "failed";
-        item.message = `${item.action} failed: ${exc.message}`;
+        item.status = "blocked";
+        item.message = `${item.action} preserved the resource: ${exc.message}; rerun migration and review it manually`;
     }
 }
 export function applyRuntimeMigrationItems(items, ctx) {
     const commands = resolveNpxHookCommands(ctx);
     for (const item of items) {
-        applyRuntimeMigrationItem(item, commands);
+        if (item.status !== "pending") {
+            continue;
+        }
+        if (isRuntimeMigrationAction(item.action)) {
+            applyRuntimeMigrationItem(item, commands);
+        }
+        else {
+            item.status = "failed";
+            item.message = `unsupported runtime migration action: ${item.action}`;
+        }
     }
 }
 //# sourceMappingURL=runtimeMigration.js.map