create-agent-rig 0.9.1 → 0.10.0

package/packages/cli/dist/lib/manifest.js

@@ -1,7 +1,8 @@
 import { createHash } from 'node:crypto';
 import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import path from 'node:path';
-import { isSafeSubstitutionValue } from './safe-path.js';
+import { isSafeSegment, isSafeSubstitutionValue, resolveWritableInside } from './safe-path.js';
+import { hasControlCharacter } from './safe-text.js';
 /**
  * The install manifest: what this rig installed, at which version, and the
  * hash each file had when it was written.
@@ -15,6 +16,28 @@ import { isSafeSubstitutionValue } from './safe-path.js';
  * CI or on a colleague's machine is blind and falls back to the hash history.
  */
 export const MANIFEST_REL = '.claude/.rig-manifest.json';
+/** Every layer this release ships. */
+export const ALL_LAYERS = ['process', 'workflow'];
+/** What a fresh `init`/`create` installs when nothing opts into more. */
+export const DEFAULT_LAYERS = ['process'];
+/**
+ * What an OLD manifest — written before this field existed — is read as
+ * having installed.
+ *
+ * Every release before RP-180 shipped exactly one payload, and that payload
+ * is what is now split into `process` + `workflow`. So a manifest with no
+ * `layers` key did not choose "core only" — there was no choice to make yet
+ * — it installed everything the single array named. Reading the absence as
+ * `DEFAULT_LAYERS` (core only) would make the very next `upgrade` treat
+ * every workflow file a pre-RP-180 rig has on disk as `retired` and stop
+ * managing it: exactly the data-loss direction RP-180's acceptance forbids.
+ * Pinned in `packages/cli/test/manifest.test.ts` › "a manifest with no
+ * `layers` key parses as though it recorded every layer" and
+ * `packages/cli/test/upgrade.test.ts` › "a pre-RP-180 manifest with no
+ * `layers` field keeps every workflow file it already has".
+ */
+const LEGACY_LAYERS = ALL_LAYERS;
+const isLayer = (value) => value === 'process' || value === 'workflow';
 export function sha256(data) {
     return createHash('sha256').update(data).digest('hex');
 }
@@ -24,6 +47,17 @@ function isStringRecord(value) {
         !Array.isArray(value) &&
         Object.values(value).every((v) => typeof v === 'string'));
 }
+/**
+ * Manifest keys are both relative paths and user-visible plan text. A path can
+ * be lexically harmless to the filesystem while a newline or ANSI escape in
+ * it forges the plan a maintainer reviews before approving an upgrade.
+ */
+function isSafeManifestPath(value) {
+    return (value !== '' &&
+        !path.isAbsolute(value) &&
+        !hasControlCharacter(value) &&
+        value.split('/').every(isSafeSegment));
+}
 /**
  * A manifest, or `null` when there is nothing trustworthy to read.
  *
@@ -89,17 +123,35 @@ export function parseManifest(raw) {
         return null;
     if (m.stacks.some((s) => !isSafeSubstitutionValue(s)))
         return null;
-    if (!isStringRecord(m.files))
+    // Optional, like `kept` below — absent is every manifest written before this
+    // field existed (resolved to `LEGACY_LAYERS` in the return, not left
+    // undefined). Present in a shape this reader does not accept voids the
+    // manifest, exactly as `stacks` and `kept` do.
+    if (m.layers !== undefined && (!Array.isArray(m.layers) || !m.layers.every(isLayer))) {
         return null;
+    }
+    if (!isStringRecord(m.files) || Object.keys(m.files).some((rel) => !isSafeManifestPath(rel))) {
+        return null;
+    }
     // Present in a shape this reader does not accept voids the manifest, exactly
     // as `files` does; absent is every manifest written before the field existed.
-    if (m.kept !== undefined && !isStringRecord(m.kept))
+    if (m.kept !== undefined &&
+        (!isStringRecord(m.kept) || Object.keys(m.kept).some((rel) => !isSafeManifestPath(rel)))) {
         return null;
+    }
     return {
         version: m.version,
         kind: m.kind,
         project: { name: project.name, scope: project.scope, region: project.region },
         stacks: [...m.stacks],
+        // Deduplicated here, once (RP-180 round 3, security blocker S2): the
+        // closed set has exactly two members, so a valid manifest never needs
+        // more than two entries, but nothing upstream of this reader bounds the
+        // array's length — a committed manifest could otherwise repeat one name
+        // thousands of times and make every downstream reader of `.layers` (this
+        // module's own callers, `upgrade.ts`, `doctor.mjs`) do unbounded work per
+        // entry for no reason.
+        layers: m.layers !== undefined ? [...new Set(m.layers)] : [...LEGACY_LAYERS],
         files: { ...m.files },
         ...(m.kept !== undefined ? { kept: { ...m.kept } } : {}),
     };
@@ -133,7 +185,14 @@ export async function readManifest(repoDir) {
     }
 }
 export async function writeManifest(repoDir, manifest) {
-    const dest = path.join(repoDir, ...MANIFEST_REL.split('/'));
+    const dest = await resolveWritableInside(repoDir, MANIFEST_REL);
+    if (dest === null) {
+        throw new Error(`Refusing to write "${MANIFEST_REL}" through a symlink or outside ${repoDir}.`);
+    }
     await mkdir(path.dirname(dest), { recursive: true });
-    await writeFile(dest, serializeManifest(manifest));
+    const checked = await resolveWritableInside(repoDir, MANIFEST_REL);
+    if (checked === null) {
+        throw new Error(`Refusing to write "${MANIFEST_REL}" through a symlink or outside ${repoDir}.`);
+    }
+    await writeFile(checked, serializeManifest(manifest));
 }

package/packages/cli/dist/lib/prompts.js

@@ -19,26 +19,3 @@ export function promptConfirm(question, streams) {
         });
     });
 }
-/**
- * Pick a target interactively: by number, by name, or Enter for the default.
- * Anything unrecognised falls back to the default — generation should never
- * dead-end on a typo.
- */
-export function promptTarget(targets, defaultTarget, streams) {
-    if (!streams.isInteractive) {
-        return Promise.resolve(defaultTarget);
-    }
-    const menu = targets
-        .map((name, index) => `  ${index + 1}. ${name}${name === defaultTarget ? ' (default)' : ''}`)
-        .join('\n');
-    const rl = createInterface({ input: streams.input, output: streams.output });
-    return new Promise((resolve) => {
-        rl.question(`Target:\n${menu}\nChoose [1-${targets.length}]: `, (answer) => {
-            rl.close();
-            const trimmed = answer.trim();
-            const byNumber = targets[Number.parseInt(trimmed, 10) - 1];
-            const byName = targets.find((name) => name === trimmed);
-            resolve(byName ?? byNumber ?? defaultTarget);
-        });
-    });
-}

package/packages/cli/dist/lib/safe-path.js

@@ -1,3 +1,4 @@
+import { lstat, realpath } from 'node:fs/promises';
 import path from 'node:path';
 /**
  * Path safety for values that came from **outside the CLI** — the install
@@ -46,10 +47,58 @@ export function isSafeSegment(value) {
 export function isSafeSubstitutionValue(value) {
     return /^[a-z0-9_][a-z0-9._-]*$/.test(value);
 }
+/**
+ * The most path segments any legitimate `rel` this codebase constructs or
+ * tests ever needs.
+ *
+ * 🔴 No specific number or path is claimed here as evidence for where this is
+ * set — a sentence naming today's deepest shipped path would go stale the day
+ * a rule moves one directory deeper, and nothing would catch it (the norm
+ * `.claude/rules/invariants.md` states under "State the limits — and test
+ * them"). What backs this value instead is
+ * `packages/cli/test/safe-path.test.ts` › "caps a path at more segments than
+ * any path this release's own install set ships, measured not guessed" —
+ * it reads the real install set through `initManifest()`, asserts this
+ * constant leaves it comfortable headroom, and pins the cap's own refusal
+ * behaviour at the boundary. Read that test for the current numbers; this
+ * comment does not repeat them so it cannot drift from what the test finds.
+ *
+ * `rel` is not always this command's own construction, though — a rig
+ * manifest is committed input (`uninstall`'s `files`/`kept` keys reach
+ * {@link resolveInside} through `onDisk`, one key at a time, before ownership
+ * is even checked), so a hostile one can name a key of unbounded segment
+ * count. `path.resolve(base, ...segments)` below is a SPREAD over
+ * `segments`, and past roughly 65,000–130,000 elements (engine-dependent)
+ * that raises an uncaught `RangeError: Maximum call stack size exceeded` —
+ * not caught anywhere on this path, so it would surface as a raw stack trace
+ * instead of the refusal this function exists to return, and under `--json`
+ * as a bare message instead of the promised payload. This is the "no spread
+ * of an array whose length is unbounded by input" case named in
+ * `.claude/rules/invariants.md`'s fail-open rule; the cap below closes it by
+ * refusing before the spread is ever reached.
+ */
+export const MAX_PATH_SEGMENTS = 16;
+/**
+ * `rel` has more path segments than {@link MAX_PATH_SEGMENTS} allows.
+ * Exported so a caller that needs to say WHICH limit a refusal hit — rather
+ * than `resolveInside`'s one undifferentiated `null` — can ask this specific
+ * question before calling `resolveInside` at all, without re-implementing the
+ * threshold: there is exactly one count-the-segments-and-compare here, and
+ * `resolveInside` below calls it rather than repeating it.
+ */
+export function exceedsMaxPathSegments(rel) {
+    return rel.split('/').length > MAX_PATH_SEGMENTS;
+}
 /**
  * `rel` resolved under `root`, or `null` when it would land anywhere else —
- * including an absolute path, an empty path, and the classic sibling
- * (`/tmp/rig` must not contain `/tmp/rig-evil`).
+ * including an absolute path, an empty path, the classic sibling
+ * (`/tmp/rig` must not contain `/tmp/rig-evil`), or a segment count past
+ * {@link MAX_PATH_SEGMENTS}. The `null` does not say which of these it was;
+ * a caller that needs to (`uninstall`'s per-file plan, so it can report a
+ * too-deep manifest key honestly instead of through the generic "resolves
+ * outside" message) checks {@link exceedsMaxPathSegments} itself, before
+ * ever calling this function, rather than trying to reverse-engineer the
+ * reason from `null`.
  *
  * This is the containment behind every write an upgrade makes. It is deliberate
  * belt-and-braces: the values that build `rel` are validated where they are
@@ -58,6 +107,8 @@ export function isSafeSubstitutionValue(value) {
 export function resolveInside(root, rel) {
     if (rel === '' || path.isAbsolute(rel))
         return null;
+    if (exceedsMaxPathSegments(rel))
+        return null;
     const segments = rel.split('/');
     // Refused, not repaired: joining an absolute or `..`-bearing path onto the
     // root would silently turn hostile input into a plausible-looking write.
@@ -69,3 +120,143 @@ export function resolveInside(root, rel) {
         return null;
     return dest.startsWith(base + path.sep) ? dest : null;
 }
+/**
+ * The one per-segment walk both {@link resolveWritableInside} and
+ * {@link resolveReadableInside} build on (RP-22 round 3 advisory: it used to
+ * exist twice, nearly identically, in this file). It answers three things a
+ * caller can tell apart: every segment existed and was safe (`'complete'`,
+ * carrying the FINAL segment's own `lstat` result, since a read-side caller
+ * still needs to know its kind — file or directory); some segment did not
+ * exist yet, so nothing PAST that point is real (`'stopped-missing'` — a
+ * write-side caller treats this as "safe to create", a read-side caller as
+ * "absent"); or a segment could not be trusted at all (`'refused'`, with
+ * why). It does not itself decide what either outcome MEANS to a caller —
+ * that stays in each function, because a missing component means something
+ * different to a writer than to a reader, and a behaviour decision belongs
+ * at the call site, not in shared plumbing (`.claude/rules/invariants.md`,
+ * "One mechanism, one implementation" — the mechanism here is the WALK, not
+ * the interpretation of it).
+ */
+async function walkSegments(base, rel) {
+    let cursor = base;
+    let finalEntry;
+    for (const segment of rel.split('/')) {
+        cursor = path.join(cursor, segment);
+        let resolved;
+        try {
+            finalEntry = await lstat(cursor);
+            if (finalEntry.isSymbolicLink())
+                return { outcome: 'refused', reason: 'symlink' };
+            // `realpath` stays INSIDE this same try (RP-22 round 4 advisory): the
+            // round-2 extraction of this walk from `resolveWritableInside` had
+            // moved it outside, so an lstat-succeeds/realpath-throws race (the
+            // entry existing for `lstat`, then vanishing or becoming unreadable
+            // before `realpath` runs) surfaced as an uncaught exception instead of
+            // the same `'refused'` outcome master's own try/catch always gave it.
+            // A genuine race is not deterministically testable, so this is
+            // restored on the strength of the diff — master's original
+            // try/catch scope, read directly — being provably narrower than
+            // round 2's, not on a reproduction; the PR body says so.
+            resolved = await realpath(cursor);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return { outcome: 'stopped-missing' };
+            return {
+                outcome: 'refused',
+                reason: 'io-error',
+                code: error.code,
+            };
+        }
+        if (resolved !== base && !resolved.startsWith(base + path.sep)) {
+            return { outcome: 'refused', reason: 'escapes-root' };
+        }
+    }
+    // `rel` is never `''` here — `resolveInside` above already refused that —
+    // so `rel.split('/')` has at least one element and the loop always runs at
+    // least once: `finalEntry` is always assigned on this path.
+    return { outcome: 'complete', finalEntry: finalEntry };
+}
+/**
+ * The read-side counterpart of {@link resolveWritableInside}: walk `rel`
+ * under `root` one segment at a time, exactly the same way, but for a
+ * caller that only intends to READ what is there — never write, never
+ * create. A symlink anywhere in the path is refused, never followed, in
+ * EITHER direction: a write-refused symlink that is nonetheless silently
+ * READ (a committed `.rig/integrations.json` pointing outside the
+ * repository, honoured as if it were the real declaration) is exactly as
+ * dangerous as one silently written through, because from S5 on this file's
+ * content decides what gets installed (RP-22 round 2 gate finding).
+ *
+ * Unlike {@link resolveWritableInside}, a missing component is `'absent'`,
+ * not a green light — there is nothing to read, and a caller building a
+ * fresh declaration from scratch is a different case from one whose read
+ * was refused. The final component is additionally required to be the
+ * `kind` the caller names, so a directory sitting where a file is expected
+ * (or the reverse) is `'unsafe'` rather than surfacing as a raw `EISDIR`/
+ * `ENOTDIR` from a subsequent `readFile`/`readdir` call.
+ */
+export async function resolveReadableInside(root, rel, kind) {
+    let base;
+    try {
+        base = await realpath(root);
+        if (!(await lstat(base)).isDirectory())
+            return { status: 'absent' };
+    }
+    catch {
+        return { status: 'absent' };
+    }
+    const dest = resolveInside(base, rel);
+    if (dest === null)
+        return { status: 'unsafe', reason: 'escapes-root' };
+    const walk = await walkSegments(base, rel);
+    if (walk.outcome === 'stopped-missing')
+        return { status: 'absent' };
+    if (walk.outcome === 'refused') {
+        if (walk.reason === 'symlink')
+            return { status: 'unsafe', reason: 'symlink' };
+        if (walk.reason === 'io-error')
+            return { status: 'unsafe', reason: 'io-error', code: walk.code };
+        return { status: 'unsafe', reason: 'escapes-root' };
+    }
+    const isRightKind = kind === 'file' ? walk.finalEntry.isFile() : walk.finalEntry.isDirectory();
+    if (!isRightKind)
+        return { status: 'unsafe', reason: 'wrong-kind' };
+    return { status: 'ok', path: dest };
+}
+/**
+ * Resolve a prospective write through the repository's real path and refuse
+ * every symlink in the relative path that already exists.
+ *
+ * Lexical containment is not enough for a writer: `root/.claude` can be a
+ * link to another directory, and a link at the final path can be dangling
+ * until `writeFile` creates its target. Missing components are allowed because
+ * callers create them, then call this function again immediately before the
+ * write. The second check makes the newly-created chain evidence too.
+ *
+ * Observable behaviour is unchanged from before the shared `walkSegments`
+ * extraction (RP-22 round 3): a missing component at ANY point in the walk
+ * (`'stopped-missing'`) and a fully-walked, fully-safe path (`'complete'`)
+ * both still mean "return `dest`" here — only `walkSegments` itself is new,
+ * this function's own outward answer for every input is identical to what it
+ * was, and `packages/cli/test/safe-path.test.ts`'s existing tests for it are
+ * unmodified.
+ */
+export async function resolveWritableInside(root, rel) {
+    let base;
+    try {
+        base = await realpath(root);
+        if (!(await lstat(base)).isDirectory())
+            return null;
+    }
+    catch {
+        return null;
+    }
+    const dest = resolveInside(base, rel);
+    if (dest === null)
+        return null;
+    const walk = await walkSegments(base, rel);
+    if (walk.outcome === 'refused')
+        return null;
+    return dest;
+}

package/packages/cli/dist/lib/safe-text.js

@@ -0,0 +1,78 @@
+/**
+ * A control or Unicode-format character (RTL override, zero-width joiner, an
+ * ESC sequence, a bare CR/LF) inside a string that later reaches a screen a
+ * maintainer reads before approving a write — a plan line, a manifest key, a
+ * declared integration id. Extracted from `manifest.ts` (RP-22 S1) so a second
+ * caller does not duplicate the predicate; the manifest's own behaviour and
+ * tests are unchanged by the move (`.claude/rules/invariants.md`, "One
+ * mechanism, one implementation").
+ */
+const FORMAT_CHARACTER_PATTERN = /\p{Cf}/u;
+/**
+ * Whether one code point (as yielded by spreading a string, so a surrogate
+ * pair arrives as a single two-code-unit element) is a Unicode format
+ * character (a bidi override, a zero-width joiner, …) or one of the two
+ * Unicode line separators (U+2028, U+2029), used by `hasControlCharacter`.
+ */
+export function isFormatOrLineSeparatorCharacter(character) {
+    const code = character.charCodeAt(0);
+    return code === 0x2028 || code === 0x2029 || FORMAT_CHARACTER_PATTERN.test(character);
+}
+export function hasControlCharacter(value) {
+    return [...value].some((character) => {
+        const code = character.charCodeAt(0);
+        return (code <= 0x1f || (code >= 0x7f && code <= 0x9f) || isFormatOrLineSeparatorCharacter(character));
+    });
+}
+/**
+ * A type predicate, not a cast: narrows `unknown` to an indexable object
+ * without asserting anything. Shared by the integration JSON parsers.
+ */
+export function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * One iterative, explicit-worklist pass over a parsed JSON value that answers
+ * two questions at once: does anything here carry a control or Unicode-format
+ * character, and does the value nest deeper than `maxDepth` below its root.
+ *
+ * Iterative on purpose. A naive recursive walk over attacker-controlled JSON
+ * stack-overflows well inside any reasonable byte cap — `JSON.parse` itself
+ * tolerates a depth of 30 000+ — so recursion here would be the one way a
+ * caller's "TOTAL, never throws" promise could break
+ * (`.claude/rules/invariants.md`, "no recursion over input"). Total work is
+ * bounded by the number of JSON tokens in `root`, which the caller's own byte
+ * cap must be checked BEFORE this ever runs.
+ *
+ * The caller selects the depth bound for its accepted schema.
+ */
+export function scanForDepthAndControlChars(root, maxDepth) {
+    const stack = [{ value: root, depth: 0 }];
+    let hasControlChar = false;
+    while (stack.length > 0) {
+        const next = stack.pop();
+        if (next === undefined)
+            break; // guarded by the loop condition; stated for the type checker
+        const { value, depth } = next;
+        if (depth > maxDepth)
+            return { tooDeep: true, hasControlChar };
+        if (typeof value === 'string') {
+            if (hasControlCharacter(value))
+                hasControlChar = true;
+            continue;
+        }
+        if (Array.isArray(value)) {
+            for (const item of value)
+                stack.push({ value: item, depth: depth + 1 });
+            continue;
+        }
+        if (typeof value === 'object' && value !== null) {
+            for (const [key, child] of Object.entries(value)) {
+                if (hasControlCharacter(key))
+                    hasControlChar = true;
+                stack.push({ value: child, depth: depth + 1 });
+            }
+        }
+    }
+    return { tooDeep: false, hasControlChar };
+}

package/packages/cli/dist/lib/substitute.js

@@ -1,54 +1,3 @@
 export function substituteContent(content, ctx) {
-    return content
-        .replaceAll('__PROJECT_NAME__', ctx.projectName)
-        .replaceAll('__PROJECT_SCOPE__', ctx.projectScope)
-        .replaceAll('__REGION__', ctx.region)
-        .replaceAll('@app/', `@${ctx.projectScope}/`);
-}
-/**
- * The inverse of {@link substituteContent}, used **only to recognise** an
- * installed file as a released version of its template: the released bytes
- * carry tokens, the installed bytes carry the project's own name, and without
- * this every token-carrying file (the kill switch, the loop skill, `CLAUDE.md`)
- * would be a permanent conflict on every rig.
- *
- * 🔴 Limits, and both of them fail in the safe direction — an unrecognised file
- * is reported and left alone, never overwritten:
- *
- * - `__PROJECT_SCOPE__` is not reversed. It substitutes to the same string as
- *   `__PROJECT_NAME__`, so the two are indistinguishable after the fact; the
- *   agent-os layer (the only layer an upgrade touches) uses neither the scope
- *   token nor `@app/` in prose, which a template test pins.
- * - A template that contains the project's name as a *literal* reverses into a
- *   token that was never there. That costs nothing on its own — recognition
- *   offers the untouched bytes as a candidate too, and those still match. It
- *   bites only on a file carrying **both** a token and the literal, which then
- *   reads as a conflict for that one project.
- */
-export function detokenizeContent(content, ctx) {
-    let out = content;
-    // scope first: reversing the name first would rewrite `@name/` into
-    // `@__PROJECT_NAME__/` and the scope form could never match afterwards
-    if (ctx.projectScope !== '')
-        out = out.replaceAll(`@${ctx.projectScope}/`, '@app/');
-    if (ctx.region !== '')
-        out = out.replaceAll(ctx.region, '__REGION__');
-    if (ctx.projectName !== '')
-        out = out.replaceAll(ctx.projectName, '__PROJECT_NAME__');
-    return out;
-}
-/**
- * Files that must exist in the generated project under a dotted name, but are
- * stored un-dotted in the template because `npm publish` strips the dotted
- * original from tarballs (the create-react-app `gitignore` trick).
- */
-const UNDOTTED_NAMES = {
-    gitignore: '.gitignore',
-};
-export function substituteFileName(name, ctx) {
-    const substituted = name
-        .replaceAll('__PROJECT_NAME__', ctx.projectName)
-        .replaceAll('__PROJECT_SCOPE__', ctx.projectScope)
-        .replaceAll('__REGION__', ctx.region);
-    return UNDOTTED_NAMES[substituted] ?? substituted;
+    return content.replaceAll('__PROJECT_NAME__', ctx.projectName);
 }

package/packages/cli/dist/lib/summary.js

@@ -28,18 +28,18 @@ export async function collectGovernance(projectDir) {
         // directory, and counting a config file as an enforced hook would make the
         // screen overstate the one thing this tool actually sells.
         hooks: (await names(path.join(claude, 'hooks'), /\.mjs$/, /\.mjs$/)).map(
-        // guard-core-purity → "core purity": the mechanism, not the filename
+        // guard-secret-file → "secret file": the mechanism, not the filename
         (hook) => HOOK_LABELS[hook] ?? hook.replace(/^(guard|block)-/, '').replaceAll('-', ' ')),
         skills: await names(path.join(claude, 'skills'), /$^/),
     };
 }
-export function renderSummary(projectName, target, dirArg, summary, p) {
+export function renderSummary(projectName, dirArg, summary, p) {
     const row = (label, count, detail, note = '') => {
         const tag = note ? `  ${note}` : '';
         return `  ${label.padEnd(8)}${String(count).padEnd(3)}${tag.padEnd(note ? 11 : 0)}  ${p.dim(detail)}`;
     };
     return [
-        `Created  ${p.accent(projectName)}  ${p.dim('·')}  ${target}`,
+        `Created  ${p.accent(projectName)}`,
         '',
         row('Rules', summary.rules.length, '.claude/rules/'),
         row('Agents', summary.agents.length, summary.agents.join(', ')),
@@ -48,8 +48,8 @@ export function renderSummary(projectName, target, dirArg, summary, p) {
         '',
         'Next',
         p.dim(`  cd ${dirArg}`),
-        p.dim('  pnpm install'),
-        p.dim('  pnpm check'),
+        p.dim('  codex'),
+        p.dim('  claude'),
         '',
     ].join('\n');
 }

package/packages/cli/dist/templates.js

@@ -10,20 +10,10 @@ import { fileURLToPath } from 'node:url';
 export function templatesRoot() {
     return path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..', '..', 'templates');
 }
-export function skeletonDir(skeleton) {
-    return path.join(templatesRoot(), 'skeleton', skeleton);
-}
-export function agentOsUniversalDir() {
-    return path.join(templatesRoot(), 'agent-os', 'universal');
-}
-export function agentOsStackDir(stack) {
-    return path.join(templatesRoot(), 'agent-os', 'stack', stack);
-}
 /**
- * Overrides `init` applies on top of the universal layer. A file here replaces
- * its universal namesake when the rig is installed into an existing repo whose
- * shape the generator knows nothing about. `create` never reads this directory.
+ * The one payload this package ships (RP-177 retired the per-target skeleton
+ * and the per-stack overlays that used to sit alongside it).
  */
-export function agentOsInitDir() {
-    return path.join(templatesRoot(), 'agent-os', 'init');
+export function agentOsUniversalDir() {
+    return path.join(templatesRoot(), 'agent-os', 'universal');
 }

package/scripts/prepare.mjs

@@ -2,7 +2,7 @@
 // (`npx github:<user>/create-agent-rig`). It must therefore work with only
 // the root devDependencies present and no pnpm available.
 import { spawnSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
+import { existsSync, rmSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
@@ -34,17 +34,15 @@ export const gitConfigEnv = (env = process.env) => {
   return sanitised;
 };
 
-function main() {
-  // 1. Wire up the pre-commit hook when working inside the git checkout.
-  if (!process.env.CI && existsSync(path.join(root, '.git'))) {
-    spawnSync('git', ['config', 'core.hooksPath', '.husky'], {
-      cwd: root,
-      env: gitConfigEnv(),
-      stdio: 'inherit',
-    });
-  }
+/**
+ * Build from a clean output directory. TypeScript overwrites emitted files,
+ * but it does not remove JavaScript whose source disappeared; without this
+ * boundary `npm pack` can publish retired commands from an older checkout.
+ */
+export function buildCli() {
+  const dist = path.join(root, 'packages/cli/dist');
+  rmSync(dist, { recursive: true, force: true });
 
-  // 2. Build the CLI so the `bin` entry exists (required for git/tarball installs).
   const require = createRequire(import.meta.url);
   const tscPath = path.join(
     path.dirname(require.resolve('typescript/package.json')),
@@ -56,7 +54,25 @@ function main() {
     [tscPath, '-p', path.join(root, 'packages/cli/tsconfig.build.json')],
     { cwd: root, stdio: 'inherit' },
   );
-  process.exit(result.status ?? 1);
+  return result.status ?? 1;
+}
+
+function main() {
+  // 1. Wire up the pre-commit hook when working inside the git checkout.
+  if (
+    !process.argv.includes('--build-only') &&
+    !process.env.CI &&
+    existsSync(path.join(root, '.git'))
+  ) {
+    spawnSync('git', ['config', 'core.hooksPath', '.husky'], {
+      cwd: root,
+      env: gitConfigEnv(),
+      stdio: 'inherit',
+    });
+  }
+
+  // 2. Build the CLI so the `bin` entry exists (required for git/tarball installs).
+  process.exit(buildCli());
 }
 
 // Run only when executed, never when imported: a test that imports this module

package/templates/agent-os/subagent-routing.json

@@ -12,6 +12,10 @@
       "claude": { "model": "claude-sonnet-5", "effort": "high" },
       "codex": { "model": "gpt-5.6-terra", "effort": "high" }
     },
+    "implementation-agent": {
+      "claude": { "model": "claude-sonnet-5", "effort": "high" },
+      "codex": { "model": "gpt-5.6-terra", "effort": "high" }
+    },
     "prose-reviewer": {
       "claude": { "model": "claude-sonnet-5", "effort": "high" },
       "codex": { "model": "gpt-5.6-terra", "effort": "high" }
@@ -23,10 +27,6 @@
     "security-scanner": {
       "claude": { "model": "claude-opus-5", "effort": "high" },
       "codex": { "model": "gpt-5.6-sol", "effort": "high" }
-    },
-    "cdk-diff-reviewer": {
-      "claude": { "model": "claude-opus-5", "effort": "high" },
-      "codex": { "model": "gpt-5.6-sol", "effort": "high" }
     }
   }
 }