hatch3r 1.3.0 → 1.4.0

package/dist/cli/index.js

@@ -12,7 +12,7 @@ import ora from "ora";
 import boxen from "boxen";
 
 // src/version.ts
-var HATCH3R_VERSION = "1.3.0";
+var HATCH3R_VERSION = "1.4.0";
 
 // src/cli/shared/ui.ts
 var CYAN = chalk.hex("#06b6d4");
@@ -140,9 +140,10 @@ var MANAGED_BLOCK_END = "<!-- HATCH3R:END -->";
 var HATCH3R_PREFIX = "hatch3r-";
 var AGENTS_DIR = ".agents";
 var HatchError = class extends Error {
-  constructor(message, exitCode = 1) {
+  constructor(message, exitCode = 1, errorCode = "UNKNOWN_ERROR") {
     super(message);
     this.exitCode = exitCode;
+    this.errorCode = errorCode;
     this.name = "HatchError";
   }
 };
@@ -538,7 +539,7 @@ async function worktreeSetupCommand(worktreePath, opts = {}) {
       error("Worktree path is required when running from the main repo.");
       console.log(chalk3.dim("  Usage: hatch3r worktree-setup <worktree-path>"));
       console.log(chalk3.dim("  Or run this command from inside a worktree.\n"));
-      throw new HatchError("Missing worktree path", 1);
+      throw new HatchError("Missing worktree path", 1, "VALIDATION_ERROR");
     }
     targetRoot = join3(cwd, worktreePath);
   }
@@ -550,7 +551,7 @@ async function worktreeSetupCommand(worktreePath, opts = {}) {
     if (err.code === "ENOENT") {
       error(`No ${WORKTREE_INCLUDE_FILE} found in ${mainRoot}`);
       console.log(chalk3.dim("  Run `hatch3r init` or `hatch3r sync` to generate it.\n"));
-      throw new HatchError(`Missing ${WORKTREE_INCLUDE_FILE}`, 1);
+      throw new HatchError(`Missing ${WORKTREE_INCLUDE_FILE}`, 1, "FS_ERROR");
     }
     throw err;
   }
@@ -631,7 +632,8 @@ import {
   access,
   rename,
   unlink as unlink2,
-  open
+  open,
+  copyFile as copyFile2
 } from "fs/promises";
 import { dirname as dirname3, basename } from "path";
 import { randomBytes as randomBytes2 } from "crypto";
@@ -778,7 +780,16 @@ var DENY_PATTERNS = [
   /override\s+(all\s+)?security/i,
   /(?:atob|Buffer\.from)\s*\([^)]*(?:eval|exec|require)/i,
   /(?:chmod|chown)\s+[0-7]{3,4}/i,
-  /(?:api[_-]?key|password|token|secret)\s*[:=]\s*.{8,}/i
+  /(?:api[_-]?key|password|token|secret)\s*[:=]\s*.{8,}/i,
+  // Prompt injection indicators
+  /ignore\s+(all\s+)?previous\s+instructions/i,
+  /disregard\s+(all\s+)?(previous|prior|above)/i,
+  /you\s+are\s+now\s+(?:a|an|the)\s/i,
+  /new\s+instructions\s*:/i,
+  /system\s+prompt\s*:/i,
+  /forget\s+(all\s+)?(previous|prior|above)\s+(instructions|rules|context)/i,
+  /act\s+as\s+(?:a|an)\s+(?:unrestricted|unfiltered|jailbroken)/i,
+  /do\s+not\s+follow\s+(?:any|the|your)\s+(?:previous|prior|above|original)\s/i
 ];
 var ZERO_WIDTH_CHARS = /[\u200B\u200C\u200D\uFEFF\u00AD]/g;
 var MAX_CUSTOMIZE_MD_BYTES = 10240;
@@ -1012,11 +1023,13 @@ async function safeWriteFile(filePath, content, options = {}) {
     try {
       merged = insertManagedBlock(existingContent, options.managedContent);
     } catch {
+      const bakPath = filePath + ".bak";
+      await copyFile2(filePath, bakPath);
       await atomicWriteFile(filePath, content);
       return {
         path: filePath,
         action: "updated",
-        warning: `Auto-repaired corrupted managed block in ${filePath}`
+        warning: `Auto-repaired corrupted managed block in ${filePath} (backup saved to ${bakPath})`
       };
     }
     await atomicWriteFile(filePath, merged);
@@ -1322,10 +1335,10 @@ async function ensureEnvMcp(rootDir, servers) {
 }
 
 // src/cli/commands/update.ts
-import { cp as cp2, mkdir as mkdir4, readdir as readdir6, stat } from "fs/promises";
+import { cp as cp3, mkdir as mkdir5, readdir as readdir7, stat as stat2 } from "fs/promises";
 import { execFileSync as execFileSync3 } from "child_process";
 import { fileURLToPath } from "url";
-import { dirname as dirname7, join as join15 } from "path";
+import { dirname as dirname8, join as join16 } from "path";
 import chalk4 from "chalk";
 import inquirer from "inquirer";
 
@@ -1425,7 +1438,7 @@ async function readGlobMd(baseDir, fileType) {
   let entries;
   try {
     const all = await readdir(baseDir, { recursive: true });
-    entries = all.filter((f) => f.endsWith(".md"));
+    entries = all.filter((f) => f.endsWith(".md")).sort();
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
     return [];
@@ -1461,7 +1474,7 @@ async function readGlobMd(baseDir, fileType) {
 async function readSkillSubdirs(baseDir) {
   let dirents;
   try {
-    dirents = await readdir(baseDir, { withFileTypes: true });
+    dirents = (await readdir(baseDir, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name));
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
     return [];
@@ -2159,7 +2172,7 @@ var AmazonQAdapter = class extends BaseAdapter {
     if (mcp && Object.keys(mcp).length > 0) {
       const entries = this.buildStdMcpEntries(mcp);
       if (Object.keys(entries).length > 0) {
-        results.push(output(".amazonq/settings.json", JSON.stringify({ mcpServers: entries }, null, 2)));
+        results.push(output(".amazonq/mcp.json", JSON.stringify({ mcpServers: entries }, null, 2)));
       }
     }
     return results;
@@ -2178,9 +2191,9 @@ var AmpAdapter = class extends BaseAdapter {
         text: `**Recommended model:** \`${m}\`. Use Smart mode for Opus, Rush for Haiku, Deep for Codex.`
       }))
     ].join("\n");
-    results.push(output(".amp/AGENTS.md", wrapInManagedBlock(inner), inner));
+    results.push(output("AGENTS.md", wrapInManagedBlock(inner), inner));
     results.push(
-      ...await this.processSkillsRaw(ctx, (id) => `.amp/skills/${toPrefixedId(id)}/SKILL.md`)
+      ...await this.processSkillsRaw(ctx, (id) => `.agents/skills/${toPrefixedId(id)}/SKILL.md`)
     );
     const mcp = await this.readFilteredMcp(ctx);
     if (mcp && Object.keys(mcp).length > 0) {
@@ -2984,7 +2997,7 @@ var CursorAdapter = class extends BaseAdapter {
         const lines = [`name: ${agent.id}`, `description: ${desc}`];
         if (model) lines.push(`model: ${model}`);
         if (agent.readonly) lines.push("readonly: true");
-        if (agent.background) lines.push("background: true");
+        if (agent.background) lines.push("is_background: true");
         const fm = `---
 ${lines.join("\n")}
 ---`;
@@ -3427,7 +3440,7 @@ function isGlobPattern(scope) {
 function ruleTrigger(scope) {
   if (!scope) return "model_decision";
   if (scope === "always") return "always_on";
-  return "glob_pattern";
+  return "glob";
 }
 var WindsurfAdapter = class extends BaseAdapter {
   name = "windsurf";
@@ -3464,7 +3477,7 @@ var WindsurfAdapter = class extends BaseAdapter {
         if (skip) continue;
         const scope = overrides.scope ?? rule.scope;
         const trigger = ruleTrigger(scope);
-        const globScope = trigger === "glob_pattern" && scope ? isGlobPattern(scope) ? scope : `${scope}/**` : void 0;
+        const globScope = trigger === "glob" && scope ? isGlobPattern(scope) ? scope : `${scope}/**` : void 0;
         const fm = `---
 trigger: ${trigger}${globScope ? `
 globs: "${globScope}"` : ""}
@@ -3649,7 +3662,7 @@ function validateIntegrityManifest(data) {
   for (const val of Object.values(obj.files)) {
     if (typeof val !== "string") return false;
   }
-  if ("checksum" in obj && typeof obj.checksum !== "string") return false;
+  if (typeof obj.checksum !== "string") return false;
   return true;
 }
 async function readIntegrityManifest(agentsDir) {
@@ -3670,12 +3683,10 @@ async function verifyIntegrity(agentsDir) {
     return [];
   }
   const results = [];
-  if (manifest.checksum !== void 0) {
-    const expected = createHash("sha256").update(JSON.stringify(manifest.files)).digest("hex");
-    if (manifest.checksum !== expected) {
-      results.push({ file: INTEGRITY_FILE, status: "tampered" });
-      return results;
-    }
+  const expected = createHash("sha256").update(JSON.stringify(manifest.files)).digest("hex");
+  if (manifest.checksum !== expected) {
+    results.push({ file: INTEGRITY_FILE, status: "tampered" });
+    return results;
   }
   const manifestFiles = new Set(Object.keys(manifest.files));
   for (const [filePath, expectedHash] of Object.entries(manifest.files)) {
@@ -3723,17 +3734,209 @@ async function verifyIntegrity(agentsDir) {
   return results;
 }
 
+// src/archive/index.ts
+import { access as access3, cp, mkdir as mkdir3, readFile as readFile12, readdir as readdir5, rm, stat, writeFile as writeFile3 } from "fs/promises";
+import { dirname as dirname6, join as join14, sep } from "path";
+function toPosixPath(p) {
+  return sep === "\\" ? p.replaceAll("\\", "/") : p;
+}
+var ARCHIVE_DIR = ".hatch3r-archive";
+var TOOL_PATH_PREFIXES = {
+  cursor: [".cursor/"],
+  claude: [".claude/", "CLAUDE.md", ".mcp.json"],
+  copilot: [".github/copilot-instructions.md", ".github/workflows/copilot-setup-steps.yml", ".vscode/mcp.json"],
+  windsurf: [".windsurf/", ".windsurfrules"],
+  amp: [".amp/"],
+  codex: [".codex/"],
+  gemini: [".gemini/", "GEMINI.md"],
+  cline: [".roo/", ".roomodes"],
+  aider: ["CONVENTIONS.md", ".aider.conf.yml"],
+  kiro: [".kiro/"],
+  opencode: ["opencode.json"],
+  goose: [".goosehints"],
+  zed: [".rules"],
+  "amazon-q": [".amazonq/"],
+  antigravity: [".antigravity/"]
+};
+var PATH_PATTERNS = [
+  { pattern: /\/rules\/([^/]+)\.(mdc|md)$/, type: "rules" },
+  { pattern: /\/agents\/([^/]+)\.md$/, type: "agents" },
+  { pattern: /\/skills\/([^/]+)\/SKILL\.md$/, type: "skills" },
+  { pattern: /\/commands\/([^/]+)\.md$/, type: "commands" }
+];
+function parseOutputPath(filePath) {
+  for (const { pattern, type } of PATH_PATTERNS) {
+    const match = filePath.match(pattern);
+    if (match) {
+      let id = match[1];
+      if (id.startsWith(HATCH3R_PREFIX)) {
+        id = id.slice(HATCH3R_PREFIX.length);
+      }
+      id = sanitizeId(id);
+      if (id.length > 0) return { type, id };
+    }
+  }
+  return null;
+}
+function stripFrontmatter(content) {
+  const trimmed = content.trimStart();
+  if (trimmed.startsWith("---")) {
+    const endIdx = trimmed.indexOf("\n---", 3);
+    if (endIdx !== -1) {
+      return trimmed.slice(endIdx + 4).trim();
+    }
+  }
+  return content.trim();
+}
+async function fileExists2(path) {
+  try {
+    await access3(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function collectToolFiles(rootDir, tool) {
+  const prefixes = TOOL_PATH_PREFIXES[tool];
+  if (!prefixes) return [];
+  const files = [];
+  for (const prefix of prefixes) {
+    const absPath = join14(rootDir, prefix);
+    if (prefix.endsWith("/")) {
+      try {
+        const entries = await readdir5(absPath, { recursive: true, withFileTypes: true });
+        for (const entry of entries) {
+          if (entry.isFile()) {
+            const parent = entry.parentPath ?? entry.path ?? absPath;
+            const relPath = toPosixPath(join14(prefix, parent.slice(absPath.length), entry.name));
+            files.push(relPath);
+          }
+        }
+      } catch {
+      }
+    } else if (await fileExists2(absPath)) {
+      files.push(prefix);
+    }
+  }
+  return files;
+}
+async function archiveToolOutputs(rootDir, tool) {
+  const filesToArchive = await collectToolFiles(rootDir, tool);
+  if (filesToArchive.length === 0) {
+    return { archivedFiles: [], migrations: [] };
+  }
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  const archiveBase = join14(rootDir, ARCHIVE_DIR, tool, timestamp);
+  const archivedFiles = [];
+  const migrations = [];
+  for (const relPath of filesToArchive) {
+    const absPath = join14(rootDir, relPath);
+    if (!await fileExists2(absPath)) continue;
+    let content;
+    try {
+      content = await readFile12(absPath, "utf-8");
+    } catch {
+      continue;
+    }
+    if (hasManagedBlock(content)) {
+      const customContent = stripFrontmatter(extractCustomContent(content));
+      if (customContent.length > 0) {
+        const parsed = parseOutputPath(relPath);
+        if (parsed) {
+          const customizePath = join14(rootDir, ".hatch3r", parsed.type, `${parsed.id}.customize.md`);
+          if (!await fileExists2(customizePath)) {
+            await mkdir3(dirname6(customizePath), { recursive: true });
+            await writeFile3(customizePath, customContent + "\n", "utf-8");
+            migrations.push({
+              from: relPath,
+              to: `.hatch3r/${parsed.type}/${parsed.id}.customize.md`,
+              type: parsed.type,
+              id: parsed.id
+            });
+          }
+        }
+      }
+    }
+    const archiveDest = join14(archiveBase, relPath);
+    await mkdir3(dirname6(archiveDest), { recursive: true });
+    await cp(absPath, archiveDest);
+    const srcStat = await stat(absPath);
+    const destStat = await stat(archiveDest);
+    if (destStat.size !== srcStat.size) {
+      throw new Error(`Archive copy size mismatch for ${relPath}: source=${srcStat.size}, dest=${destStat.size}`);
+    }
+    await rm(absPath);
+    archivedFiles.push(relPath);
+  }
+  await cleanEmptyDirs(rootDir, filesToArchive);
+  return { archivedFiles, migrations };
+}
+async function cleanEmptyDirs(rootDir, paths) {
+  const dirs = /* @__PURE__ */ new Set();
+  for (const p of paths) {
+    let dir = dirname6(join14(rootDir, p));
+    while (dir !== rootDir && dir.length > rootDir.length) {
+      dirs.add(dir);
+      dir = dirname6(dir);
+    }
+  }
+  const sorted = [...dirs].sort((a, b) => b.length - a.length);
+  for (const dir of sorted) {
+    try {
+      const entries = await readdir5(dir);
+      if (entries.length === 0) {
+        await rm(dir, { recursive: true });
+      }
+    } catch {
+    }
+  }
+}
+function removeManagedFilesForPaths(manifest, paths) {
+  const pathSet = new Set(paths);
+  manifest.managedFiles = manifest.managedFiles.filter((f) => !pathSet.has(f));
+}
+var MAX_ARCHIVE_ENTRIES = 5;
+async function pruneArchives(rootDir) {
+  const archiveRoot = join14(rootDir, ARCHIVE_DIR);
+  const pruned = [];
+  let toolDirs;
+  try {
+    toolDirs = await readdir5(archiveRoot);
+  } catch (err) {
+    if (err.code === "ENOENT") return [];
+    throw err;
+  }
+  for (const toolDir of toolDirs) {
+    const toolPath = join14(archiveRoot, toolDir);
+    let entries;
+    try {
+      const s = await stat(toolPath);
+      if (!s.isDirectory()) continue;
+      entries = await readdir5(toolPath);
+    } catch {
+      continue;
+    }
+    entries.sort((a, b) => b.localeCompare(a));
+    for (const entry of entries.slice(MAX_ARCHIVE_ENTRIES)) {
+      const entryPath = join14(toolPath, entry);
+      await rm(entryPath, { recursive: true, force: true });
+      pruned.push(`${toolDir}/${entry}`);
+    }
+  }
+  return pruned;
+}
+
 // src/content/index.ts
-import { readFile as readFile12, readdir as readdir5, cp, mkdir as mkdir3, rm } from "fs/promises";
-import { join as join14, dirname as dirname6, normalize, isAbsolute } from "path";
+import { readFile as readFile13, readdir as readdir6, writeFile as writeFile4, cp as cp2, mkdir as mkdir4, rm as rm2 } from "fs/promises";
+import { join as join15, dirname as dirname7, normalize, isAbsolute } from "path";
 function assertSafePath(relativePath, label2) {
   const sanitized = relativePath.replace(/\0/g, "");
   const normalized = normalize(sanitized);
   if (normalized.startsWith("..") || isAbsolute(normalized)) {
-    throw new HatchError(`Unsafe path detected in ${label2}: ${relativePath}`, 1);
+    throw new HatchError(`Unsafe path detected in ${label2}: ${relativePath}`, 1, "FS_ERROR");
   }
   if (sanitized !== relativePath) {
-    throw new HatchError(`Unsafe path detected in ${label2}: ${relativePath}`, 1);
+    throw new HatchError(`Unsafe path detected in ${label2}: ${relativePath}`, 1, "FS_ERROR");
   }
 }
 function extractContentReferences(content) {
@@ -3751,8 +3954,8 @@ async function validateCrossReferences(contentRoot, index) {
   for (const item of index.items) {
     let content;
     try {
-      const filePath = item.type === "skill" ? join14(contentRoot, item.relativePath, "SKILL.md") : join14(contentRoot, `${item.relativePath}`);
-      content = await readFile12(filePath, "utf-8");
+      const filePath = item.type === "skill" ? join15(contentRoot, item.relativePath, "SKILL.md") : join15(contentRoot, `${item.relativePath}`);
+      content = await readFile13(filePath, "utf-8");
     } catch {
       continue;
     }
@@ -3789,6 +3992,12 @@ function validateOrchestrationDependencies(selection) {
   }
   return warnings;
 }
+function typeIdKey(type, id) {
+  return `${type}:${id}`;
+}
+function getAllItemsById(index, id) {
+  return index.items.filter((item) => item.id === id);
+}
 var CONTENT_TYPE_CONFIGS = [
   { dir: "agents", type: "agent", strategy: "glob" },
   { dir: "commands", type: "command", strategy: "glob" },
@@ -3801,20 +4010,20 @@ var CONTENT_TYPE_CONFIGS = [
 async function buildContentIndex(contentRoot) {
   const items = [];
   for (const config of CONTENT_TYPE_CONFIGS) {
-    const dirPath = join14(contentRoot, config.dir);
+    const dirPath = join15(contentRoot, config.dir);
     if (config.strategy === "subdirectory") {
       let dirents;
       try {
-        dirents = await readdir5(dirPath, { withFileTypes: true });
+        dirents = (await readdir6(dirPath, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name));
       } catch (err) {
         if (err.code === "ENOENT") continue;
         throw err;
       }
       for (const dirent of dirents) {
         if (!dirent.isDirectory()) continue;
-        const skillPath = join14(dirPath, dirent.name, "SKILL.md");
+        const skillPath = join15(dirPath, dirent.name, "SKILL.md");
         try {
-          const raw = await readFile12(skillPath, "utf-8");
+          const raw = await readFile13(skillPath, "utf-8");
           const { metadata } = parseFrontmatter(raw);
           const id = metadata.id || metadata.name || dirent.name;
           items.push({
@@ -3823,7 +4032,7 @@ async function buildContentIndex(contentRoot) {
             description: metadata.description ?? "",
             tags: metadata.tags ?? [],
             protected: metadata.protected,
-            relativePath: join14(config.dir, dirent.name)
+            relativePath: join15(config.dir, dirent.name)
           });
         } catch (err) {
           if (err.code !== "ENOENT") throw err;
@@ -3832,15 +4041,15 @@ async function buildContentIndex(contentRoot) {
     } else {
       let entries;
       try {
-        const all = await readdir5(dirPath);
-        entries = all.filter((f) => f.endsWith(".md"));
+        const all = await readdir6(dirPath);
+        entries = all.filter((f) => f.endsWith(".md")).sort();
       } catch (err) {
         if (err.code === "ENOENT") continue;
         throw err;
       }
       for (const file of entries) {
-        const filePath = join14(dirPath, file);
-        const raw = await readFile12(filePath, "utf-8");
+        const filePath = join15(dirPath, file);
+        const raw = await readFile13(filePath, "utf-8");
         const { metadata } = parseFrontmatter(raw);
         const id = metadata.id || metadata.name || file.replace(/\.md$/, "");
         const item = {
@@ -3849,13 +4058,13 @@ async function buildContentIndex(contentRoot) {
           description: metadata.description ?? "",
           tags: metadata.tags ?? [],
           protected: metadata.protected,
-          relativePath: join14(config.dir, file)
+          relativePath: join15(config.dir, file)
         };
         if (config.type === "rule") {
           const mdcFile = file.replace(/\.md$/, ".mdc");
           try {
-            await readFile12(join14(dirPath, mdcFile), "utf-8");
-            item.companionPath = join14(config.dir, mdcFile);
+            await readFile13(join15(dirPath, mdcFile), "utf-8");
+            item.companionPath = join15(config.dir, mdcFile);
           } catch {
           }
         }
@@ -3865,10 +4074,12 @@ async function buildContentIndex(contentRoot) {
   }
   const byType = {};
   const byId = /* @__PURE__ */ new Map();
+  const byTypeAndId = /* @__PURE__ */ new Map();
   const collisions = [];
   for (const item of items) {
     if (!byType[item.type]) byType[item.type] = [];
     byType[item.type].push(item);
+    byTypeAndId.set(typeIdKey(item.type, item.id), item);
     const existing = byId.get(item.id);
     if (existing) {
       const kind = existing.type !== item.type ? "cross-type" : "same-type";
@@ -3882,7 +4093,7 @@ async function buildContentIndex(contentRoot) {
       });
       if (kind === "cross-type") {
         console.warn(
-          `[hatch3r] Content ID collision: "${item.id}" exists as both ${existing.type} (${existing.relativePath}) and ${item.type} (${item.relativePath}). The ${item.type} entry will shadow the ${existing.type} entry in ID lookups.`
+          `[hatch3r] Content ID collision: "${item.id}" exists as both ${existing.type} (${existing.relativePath}) and ${item.type} (${item.relativePath}). Use index.byTypeAndId for collision-safe lookup.`
         );
       } else {
         console.warn(
@@ -3892,7 +4103,7 @@ async function buildContentIndex(contentRoot) {
     }
     byId.set(item.id, item);
   }
-  return { items, byType, byId, collisions };
+  return { items, byType, byId, byTypeAndId, collisions };
 }
 var TYPE_TO_SELECTION_KEY = {
   agent: "agents",
@@ -4022,21 +4233,21 @@ async function copySelectedContent(contentRoot, agentsDir, selection, index) {
     if (item.companionPath) {
       assertSafePath(item.companionPath, "copySelectedContent companion");
     }
-    const srcPath = join14(contentRoot, item.relativePath);
-    const destPath = join14(agentsDir, item.relativePath);
+    const srcPath = join15(contentRoot, item.relativePath);
+    const destPath = join15(agentsDir, item.relativePath);
     if (item.type === "skill") {
-      await mkdir3(destPath, { recursive: true });
-      await cp(srcPath, destPath, { recursive: true, force: true });
+      await mkdir4(destPath, { recursive: true });
+      await cp2(srcPath, destPath, { recursive: true, force: true });
       copied.push(item.relativePath);
     } else {
-      await mkdir3(dirname6(destPath), { recursive: true });
-      await cp(srcPath, destPath, { force: true });
+      await mkdir4(dirname7(destPath), { recursive: true });
+      await cp2(srcPath, destPath, { force: true });
       copied.push(item.relativePath);
       if (item.companionPath) {
-        const mdcSrc = join14(contentRoot, item.companionPath);
-        const mdcDest = join14(agentsDir, item.companionPath);
+        const mdcSrc = join15(contentRoot, item.companionPath);
+        const mdcDest = join15(agentsDir, item.companionPath);
         try {
-          await cp(mdcSrc, mdcDest, { force: true });
+          await cp2(mdcSrc, mdcDest, { force: true });
           copied.push(item.companionPath);
         } catch (err) {
           if (err.code !== "ENOENT") throw err;
@@ -4047,31 +4258,31 @@ async function copySelectedContent(contentRoot, agentsDir, selection, index) {
   for (const config of CONTENT_TYPE_CONFIGS) {
     if (config.strategy !== "glob") continue;
     try {
-      const dirEntries = await readdir5(join14(contentRoot, config.dir), { withFileTypes: true });
+      const dirEntries = await readdir6(join15(contentRoot, config.dir), { withFileTypes: true });
       for (const entry of dirEntries) {
         if (!entry.isDirectory() || entry.name.startsWith("hatch3r-")) continue;
-        const subSrc = join14(contentRoot, config.dir, entry.name);
-        const subDest = join14(agentsDir, config.dir, entry.name);
-        await mkdir3(subDest, { recursive: true });
-        await cp(subSrc, subDest, { recursive: true, force: true });
+        const subSrc = join15(contentRoot, config.dir, entry.name);
+        const subDest = join15(agentsDir, config.dir, entry.name);
+        await mkdir4(subDest, { recursive: true });
+        await cp2(subSrc, subDest, { recursive: true, force: true });
       }
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
   }
   try {
-    const checksSrc = join14(contentRoot, "checks");
-    const checksDest = join14(agentsDir, "checks");
-    await mkdir3(checksDest, { recursive: true });
-    await cp(checksSrc, checksDest, { recursive: true, force: true });
+    const checksSrc = join15(contentRoot, "checks");
+    const checksDest = join15(agentsDir, "checks");
+    await mkdir4(checksDest, { recursive: true });
+    await cp2(checksSrc, checksDest, { recursive: true, force: true });
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
   }
   try {
-    const mcpSrc = join14(contentRoot, "mcp");
-    const mcpDest = join14(agentsDir, "mcp");
-    await mkdir3(mcpDest, { recursive: true });
-    await cp(mcpSrc, mcpDest, { recursive: true, force: true });
+    const mcpSrc = join15(contentRoot, "mcp");
+    const mcpDest = join15(agentsDir, "mcp");
+    await mkdir4(mcpDest, { recursive: true });
+    await cp2(mcpSrc, mcpDest, { recursive: true, force: true });
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
   }
@@ -4088,16 +4299,16 @@ async function buildSelectionsFromDisk(agentsDir) {
     githubAgents: []
   };
   for (const config of CONTENT_TYPE_CONFIGS) {
-    const dirPath = join14(agentsDir, config.dir);
+    const dirPath = join15(agentsDir, config.dir);
     const key = TYPE_TO_SELECTION_KEY[config.type];
     if (!key) continue;
     if (config.strategy === "subdirectory") {
       try {
-        const dirents = await readdir5(dirPath, { withFileTypes: true });
+        const dirents = await readdir6(dirPath, { withFileTypes: true });
         for (const d of dirents) {
           if (!d.isDirectory()) continue;
           try {
-            const raw = await readFile12(join14(dirPath, d.name, "SKILL.md"), "utf-8");
+            const raw = await readFile13(join15(dirPath, d.name, "SKILL.md"), "utf-8");
             const { metadata } = parseFrontmatter(raw);
             items[key].push(metadata.id || metadata.name || d.name);
           } catch {
@@ -4107,9 +4318,9 @@ async function buildSelectionsFromDisk(agentsDir) {
       }
     } else {
       try {
-        const files = await readdir5(dirPath);
+        const files = await readdir6(dirPath);
         for (const f of files.filter((f2) => f2.endsWith(".md"))) {
-          const raw = await readFile12(join14(dirPath, f), "utf-8");
+          const raw = await readFile13(join15(dirPath, f), "utf-8");
           const { metadata } = parseFrontmatter(raw);
           items[key].push(metadata.id || metadata.name || f.replace(/\.md$/, ""));
         }
@@ -4129,20 +4340,20 @@ async function addContentItem(contentRoot, agentsDir, item) {
   if (item.companionPath) {
     assertSafePath(item.companionPath, "addContentItem companion");
   }
-  const srcPath = join14(contentRoot, item.relativePath);
-  const destPath = join14(agentsDir, item.relativePath);
+  const srcPath = join15(contentRoot, item.relativePath);
+  const destPath = join15(agentsDir, item.relativePath);
   try {
     if (item.type === "skill") {
-      await mkdir3(destPath, { recursive: true });
-      await cp(srcPath, destPath, { recursive: true, force: true });
+      await mkdir4(destPath, { recursive: true });
+      await cp2(srcPath, destPath, { recursive: true, force: true });
     } else {
-      await mkdir3(dirname6(destPath), { recursive: true });
-      await cp(srcPath, destPath, { force: true });
+      await mkdir4(dirname7(destPath), { recursive: true });
+      await cp2(srcPath, destPath, { force: true });
       if (item.companionPath) {
         try {
-          await cp(
-            join14(contentRoot, item.companionPath),
-            join14(agentsDir, item.companionPath),
+          await cp2(
+            join15(contentRoot, item.companionPath),
+            join15(agentsDir, item.companionPath),
             { force: true }
           );
         } catch (err) {
@@ -4154,7 +4365,8 @@ async function addContentItem(contentRoot, agentsDir, item) {
     if (err.code === "ENOENT") {
       throw new HatchError(
         `Content "${item.id}" (${item.type}) not found in package at ${item.relativePath}. It may have been renamed or removed in this hatch3r version.`,
-        1
+        1,
+        "FS_ERROR"
       );
     }
     throw err;
@@ -4165,13 +4377,13 @@ async function removeContentItem(agentsDir, item, options) {
   if (item.companionPath) {
     assertSafePath(item.companionPath, "removeContentItem companion");
   }
-  const destPath = join14(agentsDir, item.relativePath);
+  const destPath = join15(agentsDir, item.relativePath);
   if (item.type === "skill") {
-    await rm(destPath, { recursive: true, force: true });
+    await rm2(destPath, { recursive: true, force: true });
   } else {
-    await rm(destPath, { force: true });
+    await rm2(destPath, { force: true });
     if (item.companionPath) {
-      await rm(join14(agentsDir, item.companionPath), { force: true });
+      await rm2(join15(agentsDir, item.companionPath), { force: true });
     }
   }
   if (options?.rootDir) {
@@ -4183,10 +4395,10 @@ async function removeContentItem(agentsDir, item, options) {
     };
     const customDir = typeToDir[item.type];
     if (customDir) {
-      const yamlPath = join14(options.rootDir, ".hatch3r", customDir, `${item.id}.customize.yaml`);
-      const mdPath = join14(options.rootDir, ".hatch3r", customDir, `${item.id}.customize.md`);
-      await rm(yamlPath, { force: true });
-      await rm(mdPath, { force: true });
+      const yamlPath = join15(options.rootDir, ".hatch3r", customDir, `${item.id}.customize.yaml`);
+      const mdPath = join15(options.rootDir, ".hatch3r", customDir, `${item.id}.customize.md`);
+      await rm2(yamlPath, { force: true });
+      await rm2(mdPath, { force: true });
     }
   }
 }
@@ -4218,40 +4430,40 @@ function selectionSummary(selection) {
 }
 
 // src/cli/commands/update.ts
-var __dirname = dirname7(fileURLToPath(import.meta.url));
+var __dirname = dirname8(fileURLToPath(import.meta.url));
 var CONTENT_DIRS = ["agents", "commands", "rules", "skills", "prompts", "github-agents", "mcp", "hooks"];
 var ALWAYS_COPY_FILES = /* @__PURE__ */ new Set(["mcp.json"]);
 async function copyHatch3rFiles(srcDir, destDir, insideHatch3rDir = false, selectedIds) {
   const copied = [];
   let entries;
   try {
-    entries = await readdir6(srcDir, { withFileTypes: true });
+    entries = await readdir7(srcDir, { withFileTypes: true });
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw err;
   }
   for (const entry of entries) {
-    const srcPath = join15(srcDir, entry.name);
-    const destPath = join15(destDir, entry.name);
+    const srcPath = join16(srcDir, entry.name);
+    const destPath = join16(destDir, entry.name);
     if (entry.isDirectory()) {
       if (selectedIds && entry.name.startsWith(HATCH3R_PREFIX)) {
         if (!selectedIds.has(entry.name)) continue;
       }
-      await mkdir4(destPath, { recursive: true });
+      await mkdir5(destPath, { recursive: true });
       const subCopied = await copyHatch3rFiles(
         srcPath,
         destPath,
         insideHatch3rDir || !entry.name.startsWith(HATCH3R_PREFIX),
         selectedIds
       );
-      copied.push(...subCopied.map((p) => join15(entry.name, p)));
+      copied.push(...subCopied.map((p) => join16(entry.name, p)));
     } else if (entry.name.startsWith(HATCH3R_PREFIX) || insideHatch3rDir || ALWAYS_COPY_FILES.has(entry.name)) {
       if (selectedIds && entry.name.startsWith(HATCH3R_PREFIX)) {
         const baseId = entry.name.replace(/\.(md|mdc)$/, "");
         if (!selectedIds.has(baseId)) continue;
       }
-      await mkdir4(dirname7(destPath), { recursive: true });
-      await cp2(srcPath, destPath, { force: true });
+      await mkdir5(dirname8(destPath), { recursive: true });
+      await cp3(srcPath, destPath, { force: true });
       copied.push(entry.name);
     }
   }
@@ -4260,7 +4472,7 @@ async function copyHatch3rFiles(srcDir, destDir, insideHatch3rDir = false, selec
 async function runUpdate(rootDir, manifest, options = {}) {
   const offset = options.stepOffset ?? 0;
   const total = options.totalSteps ?? 4;
-  const agentsDir = join15(rootDir, AGENTS_DIR);
+  const agentsDir = join16(rootDir, AGENTS_DIR);
   let contentRoot = findPackageRoot(__dirname);
   const pm = await detectPackageManager(rootDir);
   const s0 = createSpinner(step(offset + 1, total, "Updating package..."));
@@ -4274,7 +4486,7 @@ async function runUpdate(rootDir, manifest, options = {}) {
     const msg = isTimeout ? "Package update timed out after 30s. Check network connectivity and retry." : err instanceof Error ? err.message : String(err);
     s0.fail(step(offset + 1, total, "Failed to update package"));
     error(msg);
-    throw new HatchError(msg, 1);
+    throw new HatchError(msg, 1, isTimeout ? "NETWORK_ERROR" : "UNKNOWN_ERROR");
   }
   s0.succeed(step(offset + 1, total, "Package updated"));
   const s1 = createSpinner(step(offset + 2, total, "Updating canonical files..."));
@@ -4288,16 +4500,16 @@ async function runUpdate(rootDir, manifest, options = {}) {
   }
   const copied = [];
   for (const dir of CONTENT_DIRS) {
-    const srcDir = join15(contentRoot, dir);
+    const srcDir = join16(contentRoot, dir);
     try {
-      const dirCopied = await copyHatch3rFiles(srcDir, join15(agentsDir, dir), false, selectedIds);
-      copied.push(...dirCopied.map((p) => join15(dir, p)));
+      const dirCopied = await copyHatch3rFiles(srcDir, join16(agentsDir, dir), false, selectedIds);
+      copied.push(...dirCopied.map((p) => join16(dir, p)));
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
   }
   const canonicalAgentsMd = await generateCanonicalAgentsMd(agentsDir);
-  await safeWriteFile(join15(agentsDir, "AGENTS.md"), canonicalAgentsMd);
+  await safeWriteFile(join16(agentsDir, "AGENTS.md"), canonicalAgentsMd);
   s1.succeed(step(offset + 2, total, `Updated ${copied.length} canonical files`));
   const s2 = createSpinner(step(offset + 3, total, "Re-syncing adapter output..."));
   s2.start();
@@ -4310,7 +4522,7 @@ async function runUpdate(rootDir, manifest, options = {}) {
         warn(w);
       }
       for (const out of outputs) {
-        const fullPath = join15(rootDir, out.path);
+        const fullPath = join16(rootDir, out.path);
         if (out.managedContent) {
           await safeWriteFile(fullPath, out.content, {
             managedContent: out.managedContent
@@ -4332,7 +4544,7 @@ async function runUpdate(rootDir, manifest, options = {}) {
     }
     if (adapterFailures.length === manifest.tools.length) {
       s2.fail(step(offset + 3, total, "All adapters failed"));
-      throw new HatchError("All adapters failed", 1);
+      throw new HatchError("All adapters failed", 1, "ADAPTER_ERROR");
     }
   }
   s2.succeed(step(offset + 3, total, adapterFailures.length > 0 ? `Re-synced ${manifest.tools.length - adapterFailures.length}/${manifest.tools.length} tool(s)` : `Re-synced ${manifest.tools.length} tool(s)`));
@@ -4342,6 +4554,7 @@ async function runUpdate(rootDir, manifest, options = {}) {
   await writeManifest(rootDir, manifest);
   const integrityManifest = await generateIntegrityManifest(agentsDir, HATCH3R_VERSION);
   await writeIntegrityManifest(agentsDir, integrityManifest);
+  await pruneArchives(rootDir);
   s3.succeed(step(offset + 4, total, "Manifest updated"));
   return {
     copiedFiles: copied.length,
@@ -4354,35 +4567,40 @@ var MIGRATION_CHECKPOINTS = [
   {
     id: "content-selections-init",
     condition: async (manifest) => manifest.content === void 0,
-    execute: async (manifest, rootDir) => {
-      const agentsDir = join15(rootDir, AGENTS_DIR);
+    execute: async (manifest, rootDir, headless) => {
+      const agentsDir = join16(rootDir, AGENTS_DIR);
       const content = await buildSelectionsFromDisk(agentsDir);
-      const { projectType } = await inquirer.prompt([
-        {
-          type: "list",
-          name: "projectType",
-          message: "For content tracking \u2014 is this a greenfield or brownfield project?",
-          choices: [
-            { name: "Greenfield \u2014 new project", value: "greenfield" },
-            { name: "Brownfield \u2014 existing codebase", value: "brownfield" }
-          ],
-          default: "brownfield"
-        }
-      ]);
-      const { teamSize } = await inquirer.prompt([
-        {
-          type: "list",
-          name: "teamSize",
-          message: "Solo developer or team?",
-          choices: [
-            { name: "Solo", value: "solo" },
-            { name: "Team", value: "team" }
-          ],
-          default: "team"
-        }
-      ]);
-      content.projectType = projectType;
-      content.teamSize = teamSize;
+      if (headless) {
+        content.projectType = "brownfield";
+        content.teamSize = "team";
+      } else {
+        const { projectType } = await inquirer.prompt([
+          {
+            type: "list",
+            name: "projectType",
+            message: "For content tracking \u2014 is this a greenfield or brownfield project?",
+            choices: [
+              { name: "Greenfield \u2014 new project", value: "greenfield" },
+              { name: "Brownfield \u2014 existing codebase", value: "brownfield" }
+            ],
+            default: "brownfield"
+          }
+        ]);
+        const { teamSize } = await inquirer.prompt([
+          {
+            type: "list",
+            name: "teamSize",
+            message: "Solo developer or team?",
+            choices: [
+              { name: "Solo", value: "solo" },
+              { name: "Team", value: "team" }
+            ],
+            default: "team"
+          }
+        ]);
+        content.projectType = projectType;
+        content.teamSize = teamSize;
+      }
       return {
         manifest: { ...manifest, content },
         notices: ["Migrated to explicit content tracking (all existing items preserved)"]
@@ -4392,20 +4610,26 @@ var MIGRATION_CHECKPOINTS = [
   {
     id: "platform-selection",
     condition: async (manifest) => !manifest.platform,
-    execute: async (manifest) => {
-      const { platform } = await inquirer.prompt([
-        {
-          type: "list",
-          name: "platform",
-          message: "hatch3r now supports multiple platforms. Select your platform:",
-          choices: [
-            { name: "GitHub", value: "github" },
-            { name: "Azure DevOps", value: "azure-devops" },
-            { name: "GitLab", value: "gitlab" }
-          ],
-          default: "github"
-        }
-      ]);
+    execute: async (manifest, _rootDir, headless) => {
+      let platform;
+      if (headless) {
+        platform = "github";
+      } else {
+        const answer = await inquirer.prompt([
+          {
+            type: "list",
+            name: "platform",
+            message: "hatch3r now supports multiple platforms. Select your platform:",
+            choices: [
+              { name: "GitHub", value: "github" },
+              { name: "Azure DevOps", value: "azure-devops" },
+              { name: "GitLab", value: "gitlab" }
+            ],
+            default: "github"
+          }
+        ]);
+        platform = answer.platform;
+      }
       const updated = { ...manifest, platform };
       const notices = [];
       if (platform === "github") {
@@ -4433,12 +4657,12 @@ var MIGRATION_CHECKPOINTS = [
   {
     id: "customize-yaml-size",
     condition: async (_manifest, rootDir) => {
-      const agentsDir = join15(rootDir, AGENTS_DIR);
+      const agentsDir = join16(rootDir, AGENTS_DIR);
       try {
-        const entries = await readdir6(agentsDir, { recursive: true });
+        const entries = await readdir7(agentsDir, { recursive: true });
         for (const entry of entries) {
           if (typeof entry === "string" && entry.endsWith(".customize.yaml")) {
-            const s = await stat(join15(agentsDir, entry));
+            const s = await stat2(join16(agentsDir, entry));
             if (s.size > 10240) return true;
           }
         }
@@ -4447,14 +4671,14 @@ var MIGRATION_CHECKPOINTS = [
       }
       return false;
     },
-    execute: async (manifest, rootDir) => {
+    execute: async (manifest, rootDir, _headless) => {
       const notices = [];
-      const agentsDir = join15(rootDir, AGENTS_DIR);
+      const agentsDir = join16(rootDir, AGENTS_DIR);
       try {
-        const entries = await readdir6(agentsDir, { recursive: true });
+        const entries = await readdir7(agentsDir, { recursive: true });
         for (const entry of entries) {
           if (typeof entry === "string" && entry.endsWith(".customize.yaml")) {
-            const s = await stat(join15(agentsDir, entry));
+            const s = await stat2(join16(agentsDir, entry));
             if (s.size > 10240) {
               notices.push(`Large customize file detected: ${entry} (${Math.round(s.size / 1024)}KB) \u2014 consider splitting`);
             }
@@ -4473,18 +4697,24 @@ var MIGRATION_CHECKPOINTS = [
       const worktreeCapableTools = /* @__PURE__ */ new Set(["claude"]);
       return manifest.tools.some((t) => worktreeCapableTools.has(t));
     },
-    execute: async (manifest, rootDir) => {
-      const { enabled } = await inquirer.prompt([{
-        type: "confirm",
-        name: "enabled",
-        message: "hatch3r now supports worktree file isolation for parallel agent sessions. Enable it?",
-        default: true
-      }]);
+    execute: async (manifest, rootDir, headless) => {
+      let enabled;
+      if (headless) {
+        enabled = true;
+      } else {
+        const answer = await inquirer.prompt([{
+          type: "confirm",
+          name: "enabled",
+          message: "hatch3r now supports worktree file isolation for parallel agent sessions. Enable it?",
+          default: true
+        }]);
+        enabled = answer.enabled;
+      }
       const updated = { ...manifest, worktree: { enabled } };
       const notices = [];
       if (enabled) {
         const wtContent = await generateWorktreeInclude(updated, rootDir);
-        await safeWriteFile(join15(rootDir, WORKTREE_INCLUDE_FILE), wtContent, {
+        await safeWriteFile(join16(rootDir, WORKTREE_INCLUDE_FILE), wtContent, {
           appendIfNoBlock: true
         });
         notices.push("Worktree isolation enabled \u2014 .worktreeinclude generated");
@@ -4495,12 +4725,12 @@ var MIGRATION_CHECKPOINTS = [
     }
   }
 ];
-async function runMigrationCheckpoints(manifest, rootDir) {
+async function runMigrationCheckpoints(manifest, rootDir, headless = false) {
   let current = manifest;
   const allNotices = [];
   for (const checkpoint of MIGRATION_CHECKPOINTS) {
     if (await checkpoint.condition(current, rootDir)) {
-      const { manifest: updated, notices } = await checkpoint.execute(current, rootDir);
+      const { manifest: updated, notices } = await checkpoint.execute(current, rootDir, headless);
       current = updated;
       allNotices.push(...notices);
     }
@@ -4514,9 +4744,10 @@ async function updateCommand(_opts) {
   if (!manifest) {
     error("No .agents/hatch.json found.");
     console.log(chalk4.dim("  Run `npx hatch3r init` to set up your project first.\n"));
-    throw new HatchError("No .agents/hatch.json found.", 1);
+    throw new HatchError("No .agents/hatch.json found.", 1, "CONFIG_ERROR");
   }
-  const { manifest: migrated, allNotices } = await runMigrationCheckpoints(manifest, rootDir);
+  const headless = !!_opts?.yes;
+  const { manifest: migrated, allNotices } = await runMigrationCheckpoints(manifest, rootDir, headless);
   const m = migrated;
   for (const notice of allNotices) {
     warn(notice);
@@ -4537,177 +4768,22 @@ async function updateCommand(_opts) {
   ], "success");
 }
 
-// src/archive/index.ts
-import { access as access3, cp as cp3, mkdir as mkdir5, readFile as readFile13, readdir as readdir7, rm as rm2, stat as stat2, writeFile as writeFile3 } from "fs/promises";
-import { dirname as dirname8, join as join16, sep } from "path";
-function toPosixPath(p) {
-  return sep === "\\" ? p.replaceAll("\\", "/") : p;
-}
-var ARCHIVE_DIR = ".hatch3r-archive";
-var TOOL_PATH_PREFIXES = {
-  cursor: [".cursor/"],
-  claude: [".claude/", "CLAUDE.md", ".mcp.json"],
-  copilot: [".github/copilot-instructions.md", ".github/workflows/copilot-setup-steps.yml", ".vscode/mcp.json"],
-  windsurf: [".windsurf/", ".windsurfrules"],
-  amp: [".amp/"],
-  codex: [".codex/"],
-  gemini: [".gemini/", "GEMINI.md"],
-  cline: [".roo/", ".roomodes"],
-  aider: ["CONVENTIONS.md", ".aider.conf.yml"],
-  kiro: [".kiro/"],
-  opencode: ["opencode.json"],
-  goose: [".goosehints"],
-  zed: [".rules"],
-  "amazon-q": [".amazonq/"],
-  antigravity: [".antigravity/"]
-};
-var PATH_PATTERNS = [
-  { pattern: /\/rules\/([^/]+)\.(mdc|md)$/, type: "rules" },
-  { pattern: /\/agents\/([^/]+)\.md$/, type: "agents" },
-  { pattern: /\/skills\/([^/]+)\/SKILL\.md$/, type: "skills" },
-  { pattern: /\/commands\/([^/]+)\.md$/, type: "commands" }
-];
-function parseOutputPath(filePath) {
-  for (const { pattern, type } of PATH_PATTERNS) {
-    const match = filePath.match(pattern);
-    if (match) {
-      let id = match[1];
-      if (id.startsWith(HATCH3R_PREFIX)) {
-        id = id.slice(HATCH3R_PREFIX.length);
-      }
-      id = sanitizeId(id);
-      if (id.length > 0) return { type, id };
-    }
-  }
-  return null;
-}
-function stripFrontmatter(content) {
-  const trimmed = content.trimStart();
-  if (trimmed.startsWith("---")) {
-    const endIdx = trimmed.indexOf("\n---", 3);
-    if (endIdx !== -1) {
-      return trimmed.slice(endIdx + 4).trim();
-    }
-  }
-  return content.trim();
-}
-async function fileExists2(path) {
-  try {
-    await access3(path);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function collectToolFiles(rootDir, tool) {
-  const prefixes = TOOL_PATH_PREFIXES[tool];
-  if (!prefixes) return [];
-  const files = [];
-  for (const prefix of prefixes) {
-    const absPath = join16(rootDir, prefix);
-    if (prefix.endsWith("/")) {
-      try {
-        const entries = await readdir7(absPath, { recursive: true, withFileTypes: true });
-        for (const entry of entries) {
-          if (entry.isFile()) {
-            const parent = entry.parentPath ?? entry.path ?? absPath;
-            const relPath = toPosixPath(join16(prefix, parent.slice(absPath.length), entry.name));
-            files.push(relPath);
-          }
-        }
-      } catch {
-      }
-    } else if (await fileExists2(absPath)) {
-      files.push(prefix);
-    }
-  }
-  return files;
-}
-async function archiveToolOutputs(rootDir, tool) {
-  const filesToArchive = await collectToolFiles(rootDir, tool);
-  if (filesToArchive.length === 0) {
-    return { archivedFiles: [], migrations: [] };
-  }
-  const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  const archiveBase = join16(rootDir, ARCHIVE_DIR, tool, timestamp);
-  const archivedFiles = [];
-  const migrations = [];
-  for (const relPath of filesToArchive) {
-    const absPath = join16(rootDir, relPath);
-    if (!await fileExists2(absPath)) continue;
-    let content;
-    try {
-      content = await readFile13(absPath, "utf-8");
-    } catch {
-      continue;
-    }
-    if (hasManagedBlock(content)) {
-      const customContent = stripFrontmatter(extractCustomContent(content));
-      if (customContent.length > 0) {
-        const parsed = parseOutputPath(relPath);
-        if (parsed) {
-          const customizePath = join16(rootDir, ".hatch3r", parsed.type, `${parsed.id}.customize.md`);
-          if (!await fileExists2(customizePath)) {
-            await mkdir5(dirname8(customizePath), { recursive: true });
-            await writeFile3(customizePath, customContent + "\n", "utf-8");
-            migrations.push({
-              from: relPath,
-              to: `.hatch3r/${parsed.type}/${parsed.id}.customize.md`,
-              type: parsed.type,
-              id: parsed.id
-            });
-          }
-        }
-      }
-    }
-    const archiveDest = join16(archiveBase, relPath);
-    await mkdir5(dirname8(archiveDest), { recursive: true });
-    await cp3(absPath, archiveDest);
-    const srcStat = await stat2(absPath);
-    const destStat = await stat2(archiveDest);
-    if (destStat.size !== srcStat.size) {
-      throw new Error(`Archive copy size mismatch for ${relPath}: source=${srcStat.size}, dest=${destStat.size}`);
-    }
-    await rm2(absPath);
-    archivedFiles.push(relPath);
-  }
-  await cleanEmptyDirs(rootDir, filesToArchive);
-  return { archivedFiles, migrations };
-}
-async function cleanEmptyDirs(rootDir, paths) {
-  const dirs = /* @__PURE__ */ new Set();
-  for (const p of paths) {
-    let dir = dirname8(join16(rootDir, p));
-    while (dir !== rootDir && dir.length > rootDir.length) {
-      dirs.add(dir);
-      dir = dirname8(dir);
-    }
-  }
-  const sorted = [...dirs].sort((a, b) => b.length - a.length);
-  for (const dir of sorted) {
-    try {
-      const entries = await readdir7(dir);
-      if (entries.length === 0) {
-        await rm2(dir, { recursive: true });
-      }
-    } catch {
-    }
-  }
-}
-function removeManagedFilesForPaths(manifest, paths) {
-  const pathSet = new Set(paths);
-  manifest.managedFiles = manifest.managedFiles.filter((f) => !pathSet.has(f));
-}
-
 // src/workspace/manifest.ts
 import { readFile as readFile14 } from "fs/promises";
-import { join as join17 } from "path";
+import { join as join17, normalize as normalize2, isAbsolute as isAbsolute2 } from "path";
 
 // src/workspace/types.ts
 var WORKSPACE_MANIFEST_FILE = "workspace.json";
 var WORKSPACE_MANIFEST_VERSION = "1.0.0";
 
 // src/workspace/manifest.ts
+function isUnsafeRepoPath(repoPath) {
+  if (repoPath.includes("\0")) return true;
+  if (isAbsolute2(repoPath)) return true;
+  const normalized = normalize2(repoPath);
+  if (normalized.startsWith("..")) return true;
+  return false;
+}
 function validateWorkspaceManifest(data) {
   if (!data || typeof data !== "object") return false;
   const obj = data;
@@ -4736,6 +4812,7 @@ function validateWorkspaceManifest(data) {
     if (!repo || typeof repo !== "object") return false;
     const r = repo;
     if (typeof r.path !== "string") return false;
+    if (isUnsafeRepoPath(r.path)) return false;
     if (typeof r.sync !== "boolean") return false;
     if (r.owner !== void 0 && typeof r.owner !== "string") return false;
     if (r.repo !== void 0 && typeof r.repo !== "string") return false;
@@ -4761,13 +4838,15 @@ async function readWorkspaceManifest(rootDir) {
   } catch (err) {
     throw new HatchError(
       `Malformed JSON in ${manifestPath}: ${err instanceof Error ? err.message : String(err)}`,
-      1
+      1,
+      "CONFIG_ERROR"
     );
   }
   if (!validateWorkspaceManifest(parsed)) {
     throw new HatchError(
       `Invalid workspace manifest in ${manifestPath}: required fields missing or malformed.`,
-      1
+      1,
+      "VALIDATION_ERROR"
     );
   }
   return parsed;
@@ -4849,17 +4928,19 @@ import { dirname as dirname10 } from "path";
 import { access as access5, readFile as readFile15, readdir as readdir9 } from "fs/promises";
 import { join as join19 } from "path";
 async function analyzeRepo(rootDir) {
-  const [languages, pm, isMonorepo, hasExistingAgents, existingTools] = await Promise.all([
+  const [languages, pm, isMonorepo, hasExistingAgents, existingTools, frameworks] = await Promise.all([
     detectLanguages(rootDir),
     detectPackageManager(rootDir),
     detectMonorepo(rootDir),
     detectExistingAgents(rootDir),
-    detectExistingTools(rootDir)
+    detectExistingTools(rootDir),
+    detectFrameworks(rootDir)
   ]);
   const packageManager = pm.name;
   return {
     languages,
     packageManager,
+    frameworks,
     isMonorepo,
     hasExistingAgents,
     existingTools,
@@ -4951,6 +5032,71 @@ async function detectExistingTools(rootDir) {
     (r) => r.status === "fulfilled" && r.value !== null
   ).map((r) => r.value);
 }
+var FRAMEWORK_CONFIG_INDICATORS = [
+  { framework: "next", configs: ["next.config.js", "next.config.mjs", "next.config.ts"] },
+  { framework: "angular", configs: ["angular.json"] },
+  { framework: "svelte", configs: ["svelte.config.js", "svelte.config.ts"] },
+  { framework: "nuxt", configs: ["nuxt.config.js", "nuxt.config.ts"] },
+  { framework: "astro", configs: ["astro.config.mjs", "astro.config.ts"] }
+];
+var FRAMEWORK_DEP_INDICATORS = [
+  { framework: "next", deps: ["next"] },
+  { framework: "angular", deps: ["@angular/core"] },
+  { framework: "sveltekit", deps: ["@sveltejs/kit"] },
+  { framework: "svelte", deps: ["svelte"] },
+  { framework: "nuxt", deps: ["nuxt"] },
+  { framework: "remix", deps: ["@remix-run/react"] },
+  { framework: "astro", deps: ["astro"] },
+  { framework: "vue", deps: ["vue"] },
+  { framework: "react", deps: ["react"] },
+  { framework: "express", deps: ["express"] },
+  { framework: "fastify", deps: ["fastify"] },
+  { framework: "hono", deps: ["hono"] }
+];
+var FRAMEWORK_SUPPRESSION = {
+  next: "react",
+  remix: "react",
+  nuxt: "vue",
+  sveltekit: "svelte"
+};
+async function detectFrameworks(rootDir) {
+  const detected = /* @__PURE__ */ new Set();
+  const configResults = await Promise.allSettled(
+    FRAMEWORK_CONFIG_INDICATORS.map(async ({ framework, configs }) => {
+      for (const cfg of configs) {
+        if (await pathExists(join19(rootDir, cfg))) return framework;
+      }
+      return null;
+    })
+  );
+  for (const r of configResults) {
+    if (r.status === "fulfilled" && r.value !== null) {
+      detected.add(r.value);
+    }
+  }
+  try {
+    const raw = await readFile15(join19(rootDir, "package.json"), "utf-8");
+    const pkg = JSON.parse(raw);
+    const allDeps = {
+      ...pkg.dependencies,
+      ...pkg.devDependencies
+    };
+    for (const { framework, deps } of FRAMEWORK_DEP_INDICATORS) {
+      if (deps.some((d) => d in allDeps)) {
+        detected.add(framework);
+      }
+    }
+  } catch (err) {
+    const isExpected = err.code === "ENOENT" || err instanceof SyntaxError;
+    if (!isExpected) throw err;
+  }
+  for (const [meta, base] of Object.entries(FRAMEWORK_SUPPRESSION)) {
+    if (detected.has(meta)) {
+      detected.delete(base);
+    }
+  }
+  return [...detected];
+}
 async function pathExists(path) {
   try {
     await access5(path);
@@ -5082,19 +5228,20 @@ var CHARS_PER_TOKEN = 4;
 async function estimateTokensForContent(contentIds, index) {
   let totalChars = 0;
   for (const id of contentIds) {
-    const item = index.byId.get(id);
-    if (!item) continue;
-    try {
-      if (item.type === "skill") {
-        const skillPath = join20(CONTENT_ROOT, item.relativePath, "SKILL.md");
-        const content = await readFile16(skillPath, "utf-8");
-        totalChars += content.length;
-      } else {
-        const filePath = join20(CONTENT_ROOT, item.relativePath);
-        const content = await readFile16(filePath, "utf-8");
-        totalChars += content.length;
+    const items = getAllItemsById(index, id);
+    for (const item of items) {
+      try {
+        if (item.type === "skill") {
+          const skillPath = join20(CONTENT_ROOT, item.relativePath, "SKILL.md");
+          const content = await readFile16(skillPath, "utf-8");
+          totalChars += content.length;
+        } else {
+          const filePath = join20(CONTENT_ROOT, item.relativePath);
+          const content = await readFile16(filePath, "utf-8");
+          totalChars += content.length;
+        }
+      } catch {
       }
-    } catch {
     }
   }
   return Math.ceil(totalChars / CHARS_PER_TOKEN);
@@ -5184,8 +5331,8 @@ async function syncSingleRepo(workspaceRoot, wsManifest, wsChecksum, repoEntry,
   await mkdir6(repoAgentsDir, { recursive: true });
   await copySelectedContent(CONTENT_ROOT, repoAgentsDir, effectiveSelection, index);
   for (const id of toRemove) {
-    const item = index.byId.get(id);
-    if (item) {
+    const items = getAllItemsById(index, id);
+    for (const item of items) {
       await removeContentItem(repoAgentsDir, item, { rootDir: repoDir });
     }
   }
@@ -5425,7 +5572,7 @@ async function configCommand() {
   if (!manifest) {
     error("No .agents/hatch.json found.");
     console.log(chalk5.dim("  Run `npx hatch3r init` to set up your project first.\n"));
-    throw new HatchError("No .agents/hatch.json found.", 1);
+    throw new HatchError("No .agents/hatch.json found.", 1, "CONFIG_ERROR");
   }
   if (manifest.workspace) {
     warn(
@@ -5505,7 +5652,7 @@ async function configCommand() {
   const tools = toolAnswers.tools;
   if (tools.length === 0) {
     error("At least one tool must be selected.");
-    throw new HatchError("At least one tool must be selected.", 1);
+    throw new HatchError("At least one tool must be selected.", 1, "VALIDATION_ERROR");
   }
   const currentFeatureKeys = Object.keys(DEFAULT_FEATURES).filter((k) => manifest.features[k]);
   const featureAnswers = await inquirer2.prompt([
@@ -6129,7 +6276,7 @@ async function runInit(options) {
     }
     if (adapterFailures.length === tools.length) {
       s3.fail(step(3, totalSteps, "All adapters failed"));
-      throw new HatchError("All adapters failed", 1);
+      throw new HatchError("All adapters failed", 1, "ADAPTER_ERROR");
     }
   }
   s3.succeed(step(3, totalSteps, adapterFailures.length > 0 ? `Adapter output generated (${adapterFailures.length} failed)` : "Adapter output generated"));
@@ -6249,7 +6396,7 @@ function validateFlag(value, valid, fallback, name) {
   if (!value) return fallback;
   if (!valid.includes(value)) {
     error(`Invalid --${name}: "${value}". Valid: ${valid.join(", ")}`);
-    throw new HatchError(`Invalid --${name}: "${value}"`, 1);
+    throw new HatchError(`Invalid --${name}: "${value}"`, 1, "VALIDATION_ERROR");
   }
   return value;
 }
@@ -6313,7 +6460,7 @@ async function initCommand(opts = {}) {
       if (invalid.length > 0) {
         error(`Invalid tool(s): ${invalid.join(", ")}`);
         console.log(chalk6.dim(`  Valid tools: ${[...VALID_TOOLS].join(", ")}`));
-        throw new HatchError(`Invalid tool(s): ${invalid.join(", ")}`, 1);
+        throw new HatchError(`Invalid tool(s): ${invalid.join(", ")}`, 1, "VALIDATION_ERROR");
       }
       tools2 = rawTools;
     } else if (repoInfo.existingTools.length > 0) {
@@ -6958,7 +7105,7 @@ async function syncCommand(opts = {}) {
   if (!manifest) {
     error("No .agents/hatch.json found.");
     console.log(chalk7.dim("  Run `npx hatch3r init` to set up your project first.\n"));
-    throw new HatchError("No .agents/hatch.json found.", 1);
+    throw new HatchError("No .agents/hatch.json found.", 1, "CONFIG_ERROR");
   }
   const m = manifest;
   const integrityResults = await verifyIntegrity(agentsDir);
@@ -7032,7 +7179,7 @@ async function syncCommand(opts = {}) {
       error(`Failed to generate ${f.tool}: ${f.error}`);
     }
     if (adapterFailures.length === m.tools.length) {
-      throw new HatchError("All adapters failed", 1);
+      throw new HatchError("All adapters failed", 1, "ADAPTER_ERROR");
     }
   }
   for (const tool of m.tools) {
@@ -7065,6 +7212,9 @@ async function syncCommand(opts = {}) {
       info(`Run this, then start or restart your editor: ${getSourceEnvMcpCommand()}`);
     }
   }
+  const integrityManifest = await generateIntegrityManifest(agentsDir, HATCH3R_VERSION);
+  await writeIntegrityManifest(agentsDir, integrityManifest);
+  await pruneArchives(rootDir);
   await checkSpecFreshness(rootDir);
   console.log();
   const icons = {
@@ -7503,7 +7653,7 @@ async function validateCommand() {
     spinner.fail("Validation failed");
     error(".agents/ directory not found. Run `hatch3r init` first.");
     console.log();
-    throw new HatchError(".agents/ directory not found.", 1);
+    throw new HatchError(".agents/ directory not found.", 1, "CONFIG_ERROR");
   }
   const manifest = await readManifest(rootDir);
   await validateManifest2(rootDir, manifest, result);
@@ -7525,6 +7675,18 @@ async function validateCommand() {
           result.warnings.push(w);
         }
       }
+      const EXPECTED_CROSS_TYPE_PAIRS = /* @__PURE__ */ new Set(["command", "skill"]);
+      for (const collision of index.collisions) {
+        if (collision.kind === "cross-type") {
+          const types = /* @__PURE__ */ new Set([collision.existingType, collision.duplicateType]);
+          if (types.size === 2 && [...types].every((t) => EXPECTED_CROSS_TYPE_PAIRS.has(t))) {
+            continue;
+          }
+        }
+        result.warnings.push(
+          `Content ID collision: "${collision.id}" exists as ${collision.existingType} (${collision.existingPath}) and ${collision.duplicateType} (${collision.duplicatePath})`
+        );
+      }
     } catch {
     }
     if (manifest.content) {
@@ -7572,7 +7734,7 @@ async function validateCommand() {
       `${chalk8.yellow("\u26A0")} ${result.warnings.length} warning(s)`
     ];
     printBox("Validation failed", summaryLines, "error");
-    throw new HatchError("Validation failed", 1);
+    throw new HatchError("Validation failed", 1, "VALIDATION_ERROR");
   } else {
     const summaryLines = [
       `${chalk8.green("\u2714")} 0 errors`,
@@ -7610,7 +7772,7 @@ async function verifyCommand() {
     spinner.fail("No integrity manifest found");
     error("Missing .agents/.integrity.json \u2014 run `hatch3r init` or `hatch3r update` to generate it.");
     console.log();
-    throw new HatchError("Missing .agents/.integrity.json", 1);
+    throw new HatchError("Missing .agents/.integrity.json", 1, "INTEGRITY_ERROR");
   }
   const results = await verifyIntegrity(agentsDir);
   spinner.stop();
@@ -7659,7 +7821,7 @@ async function verifyCommand() {
       info(`Modified files may have been tampered with. Run ${chalk9.bold("hatch3r update")} to restore originals.`);
     }
     console.log();
-    throw new HatchError("Integrity check failed", 1);
+    throw new HatchError("Integrity check failed", 1, "INTEGRITY_ERROR");
   } else {
     printBox("Integrity check passed", summaryLines, "success");
   }
@@ -7696,7 +7858,7 @@ async function statusCommand() {
   if (!manifest) {
     error("No .agents/hatch.json found.");
     console.log(chalk10.dim("  Run `npx hatch3r init` to set up your project first.\n"));
-    throw new HatchError("No .agents/hatch.json found.", 1);
+    throw new HatchError("No .agents/hatch.json found.", 1, "CONFIG_ERROR");
   }
   const spinner = createSpinner("Checking sync status...");
   spinner.start();
@@ -7794,7 +7956,7 @@ program.command("init").description("Install a complete agent setup into the cur
 ).option("--yes", "Skip interactive prompts, use defaults").option("--preset <preset>", "Content preset: minimal, standard, full").option("--project-type <type>", "Project type: greenfield, brownfield").option("--team-size <size>", "Team size: solo, team").option("--workspace", "Initialize as a multi-repo workspace").action(initCommand);
 program.command("sync").description("Re-generate tool outputs from canonical .agents/ state").option("--repos [paths...]", "Sync workspace content to sub-repos (all opted-in if no paths given)").option("--dry-run", "Show what would change without modifying files").option("--force", "Overwrite locally modified files in sub-repos").option("--minimal", "Generate stripped-down output (no comments, minimal formatting) to reduce token usage").action(syncCommand);
 program.command("status").description("Check sync status between canonical .agents/ and generated files").action(statusCommand);
-program.command("update").description("Pull latest hatch3r templates with safe merge").action(updateCommand);
+program.command("update").description("Pull latest hatch3r templates with safe merge").option("--yes", "Skip interactive prompts, use defaults").action(updateCommand);
 program.command("validate").description("Validate the canonical .agents/ structure").action(validateCommand);
 program.command("verify").description("Verify integrity of canonical agent files").action(verifyCommand);
 program.command("config").description("Reconfigure tools, MCP servers, features, and platform").action(configCommand);