chati-dev 4.5.28 → 4.5.29

package/src/upgrade/upgrade.js

@@ -0,0 +1,267 @@
+import { randomUUID } from 'node:crypto';
+import { closeSync, constants, fstatSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
+import { dirname, join, relative } from 'node:path';
+import { lstatAtSync, openAtSync, renameAtSync, renameNoReplaceAtSync, unlinkAtSync } from '@chati/core';
+import { withUpgradeMaintenance, UPGRADE_PENDING_FILE } from './maintenance.js';
+import { managedEntrypoints } from './entrypoints.js';
+import { assertUpgradeParentsUnchanged, createUpgradeParents, openUpgradeDirectory, snapshotUpgradeParents } from './paths.js';
+import {
+  UPGRADE_TARGETS, assertUpgradeBindings, assertUpgradeStatePreserved, authorizeUpgradeProfile, prepareUpgradeGeneration,
+  readUpgradeInstallation, upgradeFailure, upgradeSnapshot, upgradeTestHook, verifyUpgradePackage,
+} from './generation.js';
+
+const same = (left, right) => JSON.stringify(left) === JSON.stringify(right);
+const identity = (stat) => `${stat.dev}:${stat.ino}`;
+const openDirectory = (path) => openSync(path, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+
+function readJsonAt(fd, name) {
+  const file = openAtSync(fd, name, constants.O_RDONLY | constants.O_NONBLOCK);
+  try {
+    const stat = fstatSync(file);
+    if (!stat.isFile() || stat.nlink !== 1 || stat.size > 16 * 1024 * 1024) upgradeFailure('UPGRADE_INTENT_INVALID', 'Upgrade metadata must be a bounded single-link regular file');
+    const content = readFileSync(file, 'utf8');
+    if (content.length > 16 * 1024 * 1024 || identity(lstatAtSync(fd, name)) !== identity(stat)) upgradeFailure('UPGRADE_INTENT_INVALID', 'Upgrade metadata changed during reading');
+    return JSON.parse(content);
+  } finally { closeSync(file); }
+}
+
+function writeJsonAt(fd, name, value, { replace = false } = {}) {
+  const temporary = `.pending-${randomUUID()}`;
+  const file = openAtSync(fd, temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 0o600);
+  try { writeFileSync(file, JSON.stringify(value)); fsyncSync(file); } finally { closeSync(file); }
+  try {
+    if (replace) {
+      const stat = lstatAtSync(fd, name);
+      if (!stat.isFile() || stat.nlink !== 1) upgradeFailure('UPGRADE_INTENT_INVALID', 'Intent destination is not a regular file');
+      renameAtSync(fd, temporary, fd, name);
+    } else renameNoReplaceAtSync(fd, temporary, fd, name);
+    fsyncSync(fd);
+  } catch (error) { unlinkAtSync(fd, temporary, { force: true }); throw error; }
+}
+
+function syncTree(path) {
+  const stat = lstatSync(path);
+  if (stat.isDirectory()) for (const name of readdirSync(path)) syncTree(join(path, name));
+  const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | (stat.isDirectory() ? constants.O_DIRECTORY : constants.O_NONBLOCK));
+  try { fsyncSync(fd); } finally { closeSync(fd); }
+}
+
+function pathsFor(root, directory, target, index) {
+  return { active: join(root, target.path), staged: join(directory, 'stage', target.path), previous: join(directory, `previous-${index}`) };
+}
+
+function operationsFor(root, directory, targets) {
+  return targets.flatMap((target, index) => {
+    const paths = pathsFor(root, directory, target, index);
+    return [
+      ...(target.before ? [{ from: paths.active, to: paths.previous, phase: `after-retire-${index}` }] : []),
+      { from: paths.staged, to: paths.active, phase: `after-publish-${index}` },
+    ];
+  });
+}
+
+function expectedPrefix(root, directory, intent, count) {
+  const expected = new Map();
+  intent.targets.forEach((target, index) => {
+    const paths = pathsFor(root, directory, target, index);
+    expected.set(paths.active, target.before); expected.set(paths.staged, target.after); expected.set(paths.previous, null);
+  });
+  for (const operation of operationsFor(root, directory, intent.targets).slice(0, count)) {
+    expected.set(operation.to, expected.get(operation.from)); expected.set(operation.from, null);
+  }
+  return expected;
+}
+
+function parentPaths(root, directory, targets) {
+  const paths = new Set([root]);
+  for (const operation of operationsFor(root, directory, targets)) {
+    for (const location of [operation.from, operation.to]) {
+      let path = dirname(location);
+      while (path !== root) { paths.add(path); path = dirname(path); }
+    }
+  }
+  return [...paths].sort();
+}
+
+function assertParents(root, directory, intent) {
+  for (const path of parentPaths(root, directory, intent.targets)) {
+    const stat = lstatSync(path);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || identity(stat) !== intent.parents[relative(root, path)]) {
+      upgradeFailure('UPGRADE_STORAGE_CHANGED', 'An upgrade parent directory was replaced');
+    }
+  }
+}
+
+function matchesPrefix(root, directory, intent, count) {
+  return [...expectedPrefix(root, directory, intent, count)].every(([path, snapshot]) => same(upgradeSnapshot(path), snapshot));
+}
+
+function observedProgress(root, directory, intent) {
+  assertParents(root, directory, intent);
+  const limit = operationsFor(root, directory, intent.targets).length;
+  const next = intent.phase === 'rolling_back' ? intent.progress - 1 : intent.progress + 1;
+  for (const count of [intent.progress, next]) {
+    if (count >= 0 && count <= limit && matchesPrefix(root, directory, intent, count)) return count;
+  }
+  return upgradeFailure('UPGRADE_STORAGE_CHANGED', 'Installation does not match the recorded upgrade prefix or its immediately following rename. Backups were retained.');
+}
+
+function move(operation, context, directory, intent) {
+  context.assertCurrent(); assertParents(context.root, directory, intent);
+  const from = openUpgradeDirectory(context.root, relative(context.root, dirname(operation.from)), { expected: intent.parents });
+  let to;
+  try {
+    to = openUpgradeDirectory(context.root, relative(context.root, dirname(operation.to)), { expected: intent.parents });
+    if (from === undefined || to === undefined) upgradeFailure('UPGRADE_STORAGE_CHANGED', 'Upgrade parent disappeared');
+    context.assertCurrent(); assertParents(context.root, directory, intent);
+    if (fstatSync(from).dev !== fstatSync(to).dev) upgradeFailure('UPGRADE_FILESYSTEM_MISMATCH', 'Upgrade requires one filesystem for staged and active data');
+    renameNoReplaceAtSync(from, relative(dirname(operation.from), operation.from), to, relative(dirname(operation.to), operation.to));
+    fsyncSync(from); fsyncSync(to);
+  } finally { if (from !== undefined) closeSync(from); if (to !== undefined) closeSync(to); }
+}
+
+function validateIntent(intent, context, directory, packageIdentity, id) {
+  if (intent?.schema_version !== 1 || intent.id !== id || intent.root !== context.root
+    || !same(intent.package, packageIdentity) || !['promoting', 'rolling_back', 'complete', 'rolled_back'].includes(intent.phase)
+    || !Array.isArray(intent.targets) || intent.targets.length < 2 || intent.targets.length > UPGRADE_TARGETS.length
+    || !same(intent.targets.map(target => target.path), UPGRADE_TARGETS.filter(path => intent.targets.some(target => target.path === path)))
+    || intent.targets[0].path !== '.chati.dev' || intent.targets.at(-1).path !== '.chati/manifest.json'
+    || !intent.targets[0].before || !Number.isInteger(intent.progress)
+    || intent.progress < 0 || intent.progress > operationsFor(context.root, directory, intent.targets).length
+    || (intent.phase === 'complete' && intent.progress !== operationsFor(context.root, directory, intent.targets).length)
+    || (intent.phase === 'rolled_back' && intent.progress !== 0)
+    || !intent.parents || !intent.protected_state || typeof intent.from_version !== 'string') {
+    upgradeFailure('UPGRADE_INTENT_INVALID', 'Interrupted upgrade metadata does not match this project and verified package');
+  }
+  for (const target of intent.targets) {
+    for (const snapshot of [target.before, target.after]) {
+      if (snapshot === null && snapshot === target.before) continue;
+      if (!snapshot || !/^\d+:\d+$/.test(snapshot.identity) || !/^[a-f0-9]{64}$/.test(snapshot.digest)
+        || snapshot.type !== (target.path === '.chati.dev' ? 'directory' : 'file')) upgradeFailure('UPGRADE_INTENT_INVALID', 'Invalid upgrade inventory');
+    }
+  }
+  if (!same(Object.keys(intent.protected_state).sort(), ['.chati/session.yaml', '.chati/v2/installation.json', 'CLAUDE.md'].sort())) upgradeFailure('UPGRADE_INTENT_INVALID', 'Invalid protected-state write boundary');
+}
+
+function clearPending(context, id) {
+  context.assertCurrent();
+  if (!same(readJsonAt(context.stateFd, UPGRADE_PENDING_FILE), { schema_version: 1, id })) upgradeFailure('UPGRADE_INTENT_INVALID', 'Pending upgrade marker was replaced');
+  unlinkAtSync(context.stateFd, UPGRADE_PENDING_FILE); fsyncSync(context.stateFd);
+}
+
+async function finishUpgrade(context, directory, intent, transactionFd) {
+  const save = () => writeJsonAt(transactionFd, 'intent.json', intent, { replace: true });
+  const operations = operationsFor(context.root, directory, intent.targets);
+  intent.progress = observedProgress(context.root, directory, intent);
+  const result = () => ({ version: intent.package.version, previousVersion: intent.from_version, backupDir: directory, validation: intent.validation });
+  if (intent.phase === 'complete') {
+    // Promotion and authorization already committed durably. Requiring the old
+    // executable binding here could deadlock the reconfiguration needed after
+    // CLI drift. Still require the exact committed generation and user state.
+    assertUpgradeStatePreserved(context.root, intent.protected_state);
+    clearPending(context, intent.id);
+    return result();
+  }
+  const rollback = () => {
+    intent.phase = 'rolling_back'; save();
+    while (intent.progress > 0) {
+      const operation = operations[intent.progress - 1];
+      move({ from: operation.to, to: operation.from }, context, directory, intent);
+      upgradeTestHook(`rollback-${operation.phase}`, { directory });
+      intent.progress -= 1; save();
+    }
+    if (!matchesPrefix(context.root, directory, intent, 0)) upgradeFailure('UPGRADE_ROLLBACK_INCOMPLETE', 'Rollback inventory did not match the previous installation');
+    intent.phase = 'rolled_back'; save(); clearPending(context, intent.id);
+  };
+  if (['rolling_back', 'rolled_back'].includes(intent.phase)) {
+    rollback();
+    upgradeFailure('UPGRADE_ROLLBACK_RECOVERED', `Previous installation restored at v${intent.from_version}. Repeat upgrade to start a fresh transaction. Backup: ${directory}`);
+  }
+  let committed = false;
+  try {
+    assertUpgradeStatePreserved(context.root, intent.protected_state);
+    await authorizeUpgradeProfile(assertUpgradeBindings(context.root));
+    while (intent.progress < operations.length) {
+      const operation = operations[intent.progress];
+      move(operation, context, directory, intent);
+      upgradeTestHook(operation.phase, { directory });
+      intent.progress += 1; save();
+    }
+    if (!matchesPrefix(context.root, directory, intent, operations.length)) upgradeFailure('UPGRADE_STORAGE_CHANGED', 'Published generation did not match the validated inventory');
+    assertUpgradeStatePreserved(context.root, intent.protected_state);
+    assertUpgradeBindings(context.root);
+    intent.phase = 'complete'; save(); committed = true;
+    upgradeTestHook('after-commit', { directory });
+    clearPending(context, intent.id);
+    return result();
+  } catch (error) {
+    if (committed) upgradeFailure('UPGRADE_COMMITTED_RECOVERY_REQUIRED', `${error.message}. Upgrade committed; repeat upgrade to finish marker cleanup. Backup: ${directory}`);
+    try {
+      intent.progress = observedProgress(context.root, directory, intent);
+      rollback();
+    } catch (rollbackError) {
+      upgradeFailure('UPGRADE_RECOVERY_REQUIRED', `${error.message}; rollback incomplete: ${rollbackError.message}. Repeat upgrade after resolving the cause. Backup: ${directory}`);
+    }
+    return upgradeFailure('UPGRADE_FAILED_ROLLED_BACK', `${error.code || 'UPGRADE_FAILED'}: ${error.message}. Previous installation restored; backup: ${directory}`);
+  }
+}
+
+/** Managed runtime and exact entrypoint upgrade, not a general project installer. */
+export async function upgradeProject(projectDir, { targetVersion, offline = false } = {}) {
+  return withUpgradeMaintenance(projectDir, async (context) => {
+    const packageIdentity = verifyUpgradePackage(targetVersion);
+    let pending;
+    try { pending = readJsonAt(context.stateFd, UPGRADE_PENDING_FILE); }
+    catch (error) { if (error.code !== 'ENOENT') throw error; }
+    if (pending) {
+      if (pending.schema_version !== 1 || !/^[a-f0-9-]{36}$/.test(pending.id) || Object.keys(pending).length !== 2) upgradeFailure('UPGRADE_INTENT_INVALID', 'Invalid pending upgrade pointer');
+      const directory = join(context.storageDir, `txn-${pending.id}`);
+      const fd = openDirectory(directory);
+      try {
+        const intent = readJsonAt(fd, 'intent.json');
+        validateIntent(intent, context, directory, packageIdentity, pending.id);
+        return await finishUpgrade(context, directory, intent, fd);
+      } finally { closeSync(fd); }
+    }
+
+    // Capture the exact active generation and optional-file absence before any
+    // staging. No CLAUDE/session/installation/authority path is in the write set.
+    const runtimeTargets = ['.chati.dev', '.claude/settings.json', '.chati/manifest.json'];
+    const runtimeParents = snapshotUpgradeParents(context.root, runtimeTargets);
+    const before = Object.fromEntries(runtimeTargets.map(path => [path, upgradeSnapshot(join(context.root, path))]));
+    const installation = await readUpgradeInstallation(context.root, { ...packageIdentity, offline });
+    assertUpgradeParentsUnchanged(context.root, runtimeParents);
+    const entrypointTargets = managedEntrypoints(installation.providers).map(entry => entry.path);
+    const initialParents = snapshotUpgradeParents(context.root, [...runtimeTargets, ...entrypointTargets]);
+    for (const path of entrypointTargets) before[path] = upgradeSnapshot(join(context.root, path));
+    const id = randomUUID();
+    const directory = join(context.storageDir, `txn-${id}`);
+    mkdirSync(directory, { mode: 0o700 }); fsyncSync(context.stateFd);
+    const stagingDir = join(directory, 'stage');
+    mkdirSync(stagingDir, { mode: 0o700 });
+    const prepared = await prepareUpgradeGeneration(context.root, stagingDir, installation, packageIdentity);
+    const targets = prepared.targets.map(path => ({ path, before: before[path], after: upgradeSnapshot(join(stagingDir, path)) }));
+    assertUpgradeParentsUnchanged(context.root, initialParents);
+    for (const target of targets) {
+      if (!same(upgradeSnapshot(join(context.root, target.path)), target.before)) upgradeFailure('UPGRADE_STATE_CHANGED', 'Active installation changed during preparation');
+    }
+    const activeParents = createUpgradeParents(context.root, prepared.targets, initialParents);
+    const parents = Object.fromEntries(parentPaths(context.root, directory, targets).map(path => {
+      const stat = lstatSync(path);
+      if (!stat.isDirectory() || stat.isSymbolicLink() || stat.dev !== lstatSync(directory).dev) upgradeFailure('UNSAFE_UPGRADE_PATH', 'Upgrade parents must be real directories on the same filesystem');
+      return [relative(context.root, path), identity(stat)];
+    }));
+    syncTree(stagingDir);
+    assertUpgradeParentsUnchanged(context.root, activeParents);
+    const intent = { schema_version: 1, id, root: context.root, package: packageIdentity, from_version: installation.config.version,
+      phase: 'promoting', progress: 0, targets, parents, protected_state: installation.protectedState, validation: prepared.validation };
+    const fd = openDirectory(directory);
+    try {
+      writeJsonAt(fd, 'intent.json', intent);
+      context.assertCurrent();
+      writeJsonAt(context.stateFd, UPGRADE_PENDING_FILE, { schema_version: 1, id });
+      upgradeTestHook('after-intent', { directory });
+      return await finishUpgrade(context, directory, intent, fd);
+    } finally { closeSync(fd); }
+  }, { exclusive: true });
+}

package/src/utils/execution-role.js

@@ -0,0 +1,15 @@
+// Instruction scope only. Never use this text as runtime authorization.
+export const DELEGATED_EXECUTION_BOUNDARY = `## Delegated execution boundary
+
+If the parent runtime already launched this process with a concrete agent/task assignment,
+you are its delegated worker, not the user-facing coordinator. Execute only that assignment.
+Do not invoke the Chati entry skill, router, advance, recovery, or dispatch another pipeline agent.
+Use the supplied canonical context, write only the assigned outputs, and return the required
+result envelope to the parent. Return missing information or errors in that envelope;
+do not create interactions, change session state, or authorize transitions yourself.
+An absent or ambiguous delegated assignment is a structured error, not a reason to reactivate.
+Ordinary task commands or specialist delegation remain subject to the assigned scope and binding.
+This role description is not permission to skip any runtime check or expand tool permissions.
+
+For a normal user entry or continuation, the user-facing coordinator must still run the
+deterministic router first and preserve its license, integrity, claim and gate checks.`;

package/src/utils/handoff-paths.js

@@ -0,0 +1,59 @@
+import { lstatSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { resolveFrameworkDir } from './framework-dir.js';
+
+const AGENT_NAME = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+
+function validateAgent(agent) {
+  if (typeof agent !== 'string' || !AGENT_NAME.test(agent)) {
+    throw new Error('Invalid handoff agent name');
+  }
+}
+
+// Each producer owns a directory, not a mounted file inode. Native CLI editors
+// can therefore create a temporary file and atomically rename it into place.
+export function agentHandoffDirectory(agent) {
+  validateAgent(agent);
+  return `artifacts/handoffs/${agent}/`;
+}
+
+export function agentHandoffPath(projectDir, agent) {
+  return join(projectDir, agentHandoffDirectory(agent), `${agent}-handoff.md`);
+}
+
+function handoffRoots(projectDir) {
+  return [
+    join(projectDir, 'artifacts', 'handoffs'),
+    join(projectDir, resolveFrameworkDir(projectDir), 'artifacts', 'handoffs'),
+  ];
+}
+
+// Select by presence, NEVER by successful parsing. An empty, corrupt or dangling
+// new output must not silently resurrect a stale legacy handoff.
+export function findAgentHandoffPath(projectDir, agent) {
+  validateAgent(agent);
+  const candidates = [agentHandoffPath(projectDir, agent),
+    ...handoffRoots(projectDir).map(root => join(root, `${agent}-handoff.md`))];
+  for (const candidate of candidates) {
+    const stat = lstatSync(candidate, { throwIfNoEntry: false });
+    if (!stat) continue;
+    if (!stat.isFile() || stat.isSymbolicLink()) throw new Error('Handoff must be a regular file');
+    return candidate;
+  }
+  return null;
+}
+
+export function listHandoffAgents(projectDir) {
+  const agents = new Set();
+  for (const [index, root] of handoffRoots(projectDir).entries()) {
+    let entries;
+    try { entries = readdirSync(root, { withFileTypes: true }); }
+    catch (error) { if (error.code === 'ENOENT') continue; throw error; }
+    for (const entry of entries) {
+      if (index === 0 && entry.isDirectory() && AGENT_NAME.test(entry.name)) agents.add(entry.name);
+      const match = entry.name.match(/^([a-z][a-z0-9]*(?:-[a-z0-9]+)*)-handoff\.md$/);
+      if (match) agents.add(match[1]);
+    }
+  }
+  return [...agents].sort();
+}

package/src/wizard/i18n.js

@@ -29,6 +29,7 @@ const FALLBACK_EN = {
     llm_provider_label: 'AI Provider',
     ide_selection_title: 'Select your IDEs / CLIs (multiple allowed):',
     provider_selection_title: 'Which AI providers will you use?',
+    council_providers_required: 'Select at least two distinct providers capable of review for the required quality council.',
     editor_selection_title: 'Which editor IDEs should get rules files? (optional)',
     provider_claude_hint: 'Anthropic official CLI',
     provider_gemini_hint: 'Google AI terminal agent',

package/src/wizard/index.js

@@ -3,10 +3,11 @@ import { existsSync, readFileSync } from 'fs';
 import { join, dirname, basename } from 'path';
 import { fileURLToPath } from 'url';
 import { logBanner } from '../utils/logger.js';
-import { WIZARD_BACK, stepLanguage, stepProjectType, stepProviderSelection, stepInstallationMode, stepConfirmation, stepTermsOfUse } from './questions.js';
+import { WIZARD_BACK, stepLanguage, stepProjectType, stepProviderSelection, validateCouncilProviderSelection, stepInstallationMode, stepConfirmation, stepTermsOfUse } from './questions.js';
 import { createSpinner, withSpinner, showStep, showValidation, showQuickStart } from './feedback.js';
 import { installFramework } from '../installer/core.js';
-import { INSTALLATION_ARTIFACT_PATH, dryRunV2, installV2, reconfigureV2 } from '../installer-v2/index.js';
+import { assertInstallerPlatformSupported } from '../installer/preflight.js';
+import { INSTALLATION_ARTIFACT_PATH, assertExecutableV2Installation, dryRunV2, installV2, reconfigureV2 } from '../installer-v2/index.js';
 import { bindProviderExecutables } from '../installer-v2/provider-executable.js';
 import { buildWizardV2InstallationInput } from '../installer-v2/wizard-installation.js';
 import { resolveCapabilityCatalog, verifySignedCapabilityCatalog } from '../installer-v2/catalog-client.js';
@@ -27,6 +28,7 @@ const VERSION = JSON.parse(readFileSync(join(__dirname, '..', '..', 'package.jso
  * Run the 4-step installer wizard
  */
 export async function runWizard(targetDir, options = {}) {
+  assertInstallerPlatformSupported();
   // Load ASCII logo
   let logoText;
   try {
@@ -128,6 +130,8 @@ export async function runWizard(targetDir, options = {}) {
         stage = previousInteractiveStage('providers');
         continue;
       }
+      const providerError = validateCouncilProviderSelection(value);
+      if (providerError) throw Object.assign(new Error(providerError), { code: 'COUNCIL_PROVIDERS_REQUIRED' });
       selectedProviders = value;
       if (!catalogResolution) {
         catalogResolution = await withSpinner(t('installer.catalog_resolving'), async () => (
@@ -202,7 +206,15 @@ export async function runWizard(targetDir, options = {}) {
       capabilityCatalog: catalogResolution.catalog,
       installationMode,
     }));
-    dryRunV2(v2InstallationInput, { projectDir: targetDir });
+    const preview = dryRunV2(v2InstallationInput, { projectDir: targetDir });
+    try {
+      assertExecutableV2Installation(preview.artifact);
+    } catch (error) {
+      if (options.providers !== undefined || options.modelSelections !== undefined) throw error;
+      p.log.error(`${t('installer.council_providers_required')} ${error.message}`);
+      stage = 'providers';
+      continue;
+    }
     if (existsSync(join(targetDir, INSTALLATION_ARTIFACT_PATH)) && options.reconfigure !== true) {
       throw Object.assign(new Error('a v2 installation already exists; use --reconfigure to replace it safely'), { code: 'INSTALLATION_ALREADY_EXISTS' });
     }
@@ -230,8 +242,8 @@ export async function runWizard(targetDir, options = {}) {
 
   try {
     await installFramework(config);
-    if (options.reconfigure === true) reconfigureV2(v2InstallationInput, { projectDir: targetDir });
-    else installV2(v2InstallationInput, { projectDir: targetDir });
+    if (options.reconfigure === true) await reconfigureV2(v2InstallationInput, { projectDir: targetDir, licenseValidator: options.licenseValidator });
+    else await installV2(v2InstallationInput, { projectDir: targetDir, licenseValidator: options.licenseValidator });
     installSpinner.stop();
 
     showStep(t('installer.created_chati'));

package/src/wizard/questions.js

@@ -83,9 +83,15 @@ const PROVIDER_DISPLAY_NAMES = {
 /**
  * Step 3a: Provider Selection (multi-select)
  *
- * Asks the user which AI providers they want to use (Claude, Gemini, Codex).
- * Returns an array of provider names (e.g. ['claude', 'gemini']).
+ * Asks for at least two providers for the required cross-provider council.
+ * Never adds an unselected provider or defines a primary provider.
  */
+export function validateCouncilProviderSelection(selected) {
+  if (!Array.isArray(selected) || selected.some((provider) => !supportedV2WizardProviders.includes(provider))
+    || new Set(selected).size < 2) return t('installer.council_providers_required');
+  return undefined;
+}
+
 export async function stepProviderSelection({ allowBack = false } = {}) {
   const cliIDEs = Object.entries(IDE_CONFIGS).filter(([key, c]) => c.group === 'cli' && supportedV2WizardProviders.includes(IDE_TO_PROVIDER[key]));
   const options = [];
@@ -108,17 +114,23 @@ export async function stepProviderSelection({ allowBack = false } = {}) {
     });
   }
 
-  const selected = await p.multiselect({
-    message: `${t('installer.provider_selection_title')} ${dim(t('installer.multiselect_hint'))}`,
-    options: allowBack ? [...options, backOption()] : options,
-    required: true,
-  });
-
-  if (p.isCancel(selected)) {
-    cancelInstallation();
+  let initialValues = [];
+  // The bundled Clack multiselect does not forward a custom validate callback.
+  // Validate the returned values ourselves, preserving selection on retry.
+  while (true) {
+    const selected = await p.multiselect({
+      message: `${t('installer.provider_selection_title')} ${t('installer.council_providers_required')} ${dim(t('installer.multiselect_hint'))}`,
+      options: allowBack ? [...options, backOption()] : options,
+      required: false,
+      initialValues,
+    });
+    if (p.isCancel(selected)) cancelInstallation();
+    if (allowBack && selected.includes(WIZARD_BACK)) return WIZARD_BACK;
+    const error = validateCouncilProviderSelection(selected);
+    if (!error) return selected;
+    p.log.error(error);
+    initialValues = selected.filter((provider) => supportedV2WizardProviders.includes(provider));
   }
-
-  return selected.includes(WIZARD_BACK) ? WIZARD_BACK : selected;
 }
 
 /**