specrails-core 5.6.0 → 6.0.1

package/dist/installer/util/errors.js

@@ -76,4 +76,3 @@ export class PromptAbortError extends InstallerError {
 export function isInstallerError(err) {
     return err instanceof InstallerError;
 }
-//# sourceMappingURL=errors.js.map

package/dist/installer/util/exec.d.ts

@@ -1,4 +1,4 @@
-export interface RunOptions {
+interface RunOptions {
     /** Working directory for the child. Defaults to `process.cwd()`. */
     cwd?: string;
     /** Environment variables, merged on top of `process.env`. */
@@ -8,7 +8,7 @@ export interface RunOptions {
     /** Hard timeout in milliseconds. Child is SIGKILL'd on timeout. Defaults to none. */
     timeoutMs?: number;
 }
-export interface RunResult {
+interface RunResult {
     code: number;
     stdout: string;
     stderr: string;
@@ -39,3 +39,4 @@ export declare function tryRunCommand(cmd: string, args: string[], opts?: RunOpt
  * on Windows and `which` on POSIX.
  */
 export declare function commandExists(cmd: string): Promise<boolean>;
+export {};

package/dist/installer/util/exec.js

@@ -153,4 +153,3 @@ function quoteArgForShell(arg) {
         return arg;
     return `"${arg.replace(/"/g, '\\"')}"`;
 }
-//# sourceMappingURL=exec.js.map

package/dist/installer/util/fs.d.ts

@@ -141,13 +141,3 @@ export declare function snapshotTree(src: string, dest: string): LinkRecord[];
 export declare function restoreTree(saved: string, target: string, links: LinkRecord[], options?: {
     skip?: (rel: string) => boolean;
 }): void;
-/**
- * Recreate a recorded link at `linkPath`. Delegates to {@link symlinkOrCopy} so
- * Windows gets a junction (no privilege required) and an unprivileged machine
- * with no link mechanism at all still ends up with the right CONTENTS.
- *
- * A target that no longer exists cannot be copied, so the pointer is recreated
- * verbatim where the platform allows a dangling link rather than failing the
- * whole rollback.
- */
-export declare function restoreLink(target: string, linkPath: string): void;

package/dist/installer/util/fs.js

@@ -427,7 +427,7 @@ export function restoreTree(saved, target, links, options = {}) {
  * verbatim where the platform allows a dangling link rather than failing the
  * whole rollback.
  */
-export function restoreLink(target, linkPath) {
+function restoreLink(target, linkPath) {
     if (pathExists(target)) {
         symlinkOrCopy(target, linkPath);
         return;
@@ -450,4 +450,3 @@ function listNames(dir) {
         throw new FilesystemError(`failed to read directory: ${err.message}`, dir);
     }
 }
-//# sourceMappingURL=fs.js.map

package/dist/installer/util/git.js

@@ -110,4 +110,3 @@ export async function gitInstalled() {
         return false;
     }
 }
-//# sourceMappingURL=git.js.map

package/dist/installer/util/install-transaction.d.ts

@@ -10,7 +10,7 @@ export declare function withFrameworkLifecycleLock<T>(frameworkDir: string, appl
  * one exactly as it stands — copying it bought no safety and cost a full copy of
  * the framework store on every install.
  */
-export type ProtectedSurface = string | {
+type ProtectedSurface = string | {
     path: string;
     snapshotContents: boolean;
 };
@@ -23,7 +23,7 @@ export type ProtectedSurface = string | {
  * without SeCreateSymbolicLinkPrivilege.
  */
 export declare function withInstallRollback<T>(paths: ProtectedSurface[], apply: () => Promise<T>): Promise<T>;
-export declare function compareCoreVersions(left: string, right: string): number | null;
 /** Refuse an implicit downgrade. Explicit swap-current is the rollback interface. */
 export declare function assertNoCoreDowngrade(current: string | null, target: string): void;
 export declare function currentFrameworkVersion(frameworkDir: string): string | null;
+export {};

package/dist/installer/util/install-transaction.js

@@ -207,7 +207,7 @@ export async function withInstallRollback(paths, apply) {
             rmSync(backup, { recursive: true, force: true });
     }
 }
-export function compareCoreVersions(left, right) {
+function compareCoreVersions(left, right) {
     const parse = (value) => {
         const match = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(value);
         return match ? { core: match.slice(1, 4).map(Number), pre: match[4]?.split('.') ?? [] } : null;
@@ -263,4 +263,3 @@ export function currentFrameworkVersion(frameworkDir) {
         return null;
     }
 }
-//# sourceMappingURL=install-transaction.js.map

package/dist/installer/util/logger.d.ts

@@ -1,7 +1,5 @@
 /**
- * Coloured output helpers for the installer. The emoji prefixes match
- * what the retired bash scripts printed (`✓ ⚠ ✗ →`) so existing user
- * bug reports and screenshots still read the same.
+ * Coloured output helpers for the installer (`✓ ⚠ ✗ →` prefixes).
  *
  * The logger writes to stdout by default; callers may override via
  * {@link setLoggerStreams} (useful in tests that capture output).

package/dist/installer/util/logger.js

@@ -52,4 +52,3 @@ export function rawOut(text) {
 export function rawErr(text) {
     streams.err.write(text);
 }
-//# sourceMappingURL=logger.js.map

package/dist/installer/util/paths.js

@@ -75,4 +75,3 @@ export function repoRelative(repoRoot, absPath) {
     }
     return rel.replace(/\\/g, '/');
 }
-//# sourceMappingURL=paths.js.map

package/dist/installer/util/registry.d.ts

@@ -60,7 +60,7 @@ export interface ProjectEntry {
     desktopProjectId?: string;
 }
 /** On-disk shape of `registry.json`. */
-export interface RegistryFile {
+interface RegistryFile {
     schemaVersion: number;
     generator?: string;
     updatedAt?: string;
@@ -68,7 +68,7 @@ export interface RegistryFile {
     projects: Record<string, ProjectEntry>;
 }
 /** The flattened result both tools consume. */
-export interface Resolution {
+interface Resolution {
     /** Normalized map key. */
     key: string;
     repoPath: string;
@@ -88,7 +88,7 @@ export interface Resolution {
     /** True when there is no registry entry and we fell back to the in-repo layout. */
     isLegacy: boolean;
 }
-export interface ResolveOptions {
+interface ResolveOptions {
     /** When true, allocate + persist an entry if none exists. Readers pass false. */
     allocate?: boolean;
     /** Who is allocating (only consulted when allocate=true). Default 'core-standalone'. */
@@ -107,8 +107,6 @@ export interface ResolveOptions {
  * (`server/desktop-router.ts`). Do not "improve" it; parity is the contract.
  */
 export declare function slugify(name: string): string;
-/** `$HOME` for the registry, overridable for tests. */
-export declare function resolveHome(home?: string): string;
 /** Absolute path to `registry.json`. */
 export declare function registryPath(home?: string): string;
 /**
@@ -122,9 +120,6 @@ export declare function registryPath(home?: string): string;
 export declare function frameworkRoot(home?: string): string;
 /** Absolute path to the advisory lock file. */
 export declare function lockPath(home?: string): string;
-/** `fs.realpathSync` that falls back to the resolved-but-unreal path on error
- *  (the path may not exist yet, or be on a volume that rejects realpath). */
-export declare function realpathSafe(abs: string): string;
 /** Case-fold the key on case-insensitive platforms (macOS, Windows) so two
  *  spellings of the same path map to one entry. The stored `repoPath` keeps
  *  its canonical case; only the index key is folded. */
@@ -172,3 +167,4 @@ export declare function resolveArtifacts(repoPathInput: string, opts?: ResolveOp
  * Desktop-owned entries remain the host's responsibility; never claim ownership.
  */
 export declare function recordSuccessfulInstall(repoPath: string, opts: Pick<ResolveOptions, 'home' | 'providers' | 'coreVersion' | 'now'>): void;
+export {};

package/dist/installer/util/registry.js

@@ -191,7 +191,7 @@ export function slugify(name) {
     return name.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '');
 }
 /** `$HOME` for the registry, overridable for tests. */
-export function resolveHome(home) {
+function resolveHome(home) {
     return home ?? process.env.SPECRAILS_REGISTRY_HOME ?? os.homedir();
 }
 /** Absolute path to `registry.json`. */
@@ -215,7 +215,7 @@ export function lockPath(home) {
 }
 /** `fs.realpathSync` that falls back to the resolved-but-unreal path on error
  *  (the path may not exist yet, or be on a volume that rejects realpath). */
-export function realpathSafe(abs) {
+function realpathSafe(abs) {
     try {
         return realpathSync(abs);
     }
@@ -576,4 +576,3 @@ export function recordSuccessfulInstall(repoPath, opts) {
         atomicWrite(registryPath(opts.home), JSON.stringify(registry, null, 2) + '\n');
     });
 }
-//# sourceMappingURL=registry.js.map

package/dist/{installer/runtime → pipeline}/pipeline-state.d.ts

@@ -7,11 +7,18 @@ export interface PipelineSpec {
     repositoryIds?: string[];
     acceptanceCriteria?: string[];
 }
+/**
+ * `scope`: checkout-relative directories the repository is confined to — a
+ * package registered inside a larger checkout (a monorepo app). Edits outside
+ * them are not part of the change, and a command without `cwd` runs in the
+ * first one. Absent: the whole checkout is the repository.
+ */
 export interface PipelineRepository {
     id: string;
     name: string;
     path: string;
     baseSha?: string;
+    scope?: string[];
 }
 export interface PipelineContext {
     schemaVersion: 1;
@@ -194,6 +201,10 @@ export interface PreviewFile {
     contentHash?: string;
 }
 export declare function verificationEnvironment(env: NodeJS.ProcessEnv, overrides?: Record<string, string>, platform?: NodeJS.Platform): NodeJS.ProcessEnv;
+/** True when a checkout-relative POSIX path belongs to the repository's scope (always, without a scope). */
+export declare function withinRepositoryScope(repository: Pick<PipelineRepository, 'scope'>, relative: string): boolean;
+/** Where a command without `cwd` runs: the first scope directory, else the checkout root. */
+export declare function repositoryWorkingDirectory(repository: Pick<PipelineRepository, 'path' | 'scope'>): string;
 export declare function validatePipelineContext(input: unknown): PipelineContext;
 export declare function pipelineStateDirectory(context: PipelineContext): string;
 export interface CandidateManifest {

package/dist/{installer/runtime → pipeline}/pipeline-state.js

@@ -83,6 +83,58 @@ function safeChild(root, relative) {
     }
     return target;
 }
+/** Case-insensitive filesystems: compare checkout paths the way the OS resolves them. */
+const foldedPaths = process.platform === 'win32' || process.platform === 'darwin';
+function samePathPrefix(file, directory) {
+    const [a, b] = foldedPaths ? [file.toLowerCase(), directory.toLowerCase()] : [file, directory];
+    return a === b || a.startsWith(b + '/');
+}
+/** Normalized scope: existing, symlink-free directories spelled as on disk. Undefined = whole checkout. */
+function repositoryScope(root, raw) {
+    if (!Array.isArray(raw) || raw.length === 0 || raw.length > 32)
+        fail('Invalid repository scope: expected 1–32 directories');
+    const scope = [];
+    for (const value of raw) {
+        if (typeof value !== 'string' || !value.trim() || value.includes('\0') || value.length > 1024)
+            fail('Invalid repository scope directory');
+        const relative = value.replace(/\\/g, '/').replace(/^(?:\.\/)+/, '').replace(/\/+$/, '');
+        // The checkout root is the whole repository: no narrower scope applies.
+        if (!relative || relative === '.')
+            return undefined;
+        if (/^[a-z]:/i.test(relative) || relative.startsWith('/') || relative.split('/').some(part => !part || part === '.' || part === '..'))
+            fail('Invalid repository scope directory: ' + value);
+        // Spell every component as the directory listing does, so git paths match it.
+        let current = root;
+        const parts = [];
+        for (const part of relative.split('/')) {
+            let name = part;
+            try {
+                const names = readdirSync(current);
+                if (!names.includes(part))
+                    name = names.find(entry => entry.toLowerCase() === part.toLowerCase()) ?? part;
+            }
+            catch { /* the lstat below reports the missing directory */ }
+            current = path.join(current, name);
+            const stat = lstatSync(current, { throwIfNoEntry: false });
+            if (!stat)
+                fail('Repository scope directory does not exist: ' + value);
+            if (stat.isSymbolicLink() || !stat.isDirectory())
+                fail('Repository scope must be a real directory: ' + value);
+            parts.push(name);
+        }
+        scope.push(parts.join('/'));
+    }
+    const unique = [...new Set(scope)];
+    return unique.filter(item => !unique.some(other => other !== item && samePathPrefix(item, other)));
+}
+/** True when a checkout-relative POSIX path belongs to the repository's scope (always, without a scope). */
+export function withinRepositoryScope(repository, relative) {
+    return !repository.scope?.length || repository.scope.some(directory => samePathPrefix(relative, directory));
+}
+/** Where a command without `cwd` runs: the first scope directory, else the checkout root. */
+export function repositoryWorkingDirectory(repository) {
+    return repository.scope?.length ? path.join(repository.path, ...repository.scope[0].split('/')) : repository.path;
+}
 function atomicJson(file, value) {
     mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
     const temp = file + '.' + randomUUID() + '.tmp';
@@ -106,7 +158,9 @@ export function validatePipelineContext(input) {
             fail('Invalid repository identity');
         if (repo.baseSha !== undefined && (typeof repo.baseSha !== 'string' || !/^[a-f0-9]{40,64}$/.test(repo.baseSha)))
             fail('Invalid repository base SHA');
-        return { id: repo.id, name: repo.name, path: directory(repo.path), ...(repo.baseSha ? { baseSha: repo.baseSha } : {}) };
+        const root = directory(repo.path);
+        const scope = repo.scope === undefined ? undefined : repositoryScope(root, repo.scope);
+        return { id: repo.id, name: repo.name, path: root, ...(repo.baseSha ? { baseSha: repo.baseSha } : {}), ...(scope ? { scope } : {}) };
     });
     if (new Set(repositories.map((repo) => repo.id)).size !== repositories.length || new Set(repositories.map((repo) => repo.path)).size !== repositories.length)
         fail('Duplicate repository identity or path');
@@ -223,8 +277,6 @@ function excluded(state, repo, relative) {
     const absolute = path.join(repo.path, relative);
     if (within(pipelineStateDirectory(state.context), absolute))
         return true;
-    if (['.specrails/kimi-role-wave.json', '.specrails/kimi-role-request.json', '.specrails/kimi-role-merge.json', '.specrails/kimi-role-worktrees/' + state.runId + '.json'].includes(relative))
-        return true;
     if (relative === '.specrails/runtime' || relative.startsWith('.specrails/runtime/'))
         return true;
     if (repo.id !== state.context.artifactRepositoryId)
@@ -713,7 +765,7 @@ function validateCommand(context, raw) {
     const repo = context.repositories.find((item) => item.id === command.repositoryId);
     if (!repo || typeof command.command !== 'string' || !command.command || command.command.includes('\0') || !Array.isArray(command.args) || !command.args.every((arg) => typeof arg === 'string' && !arg.includes('\0')))
         fail('Invalid verification command');
-    const cwd = command.cwd === undefined ? repo.path : directory(path.resolve(repo.path, String(command.cwd)));
+    const cwd = command.cwd === undefined ? directory(repositoryWorkingDirectory(repo)) : directory(path.resolve(repo.path, String(command.cwd)));
     if (!within(repo.path, cwd))
         fail('Verification cwd escapes selected repository');
     const env = command.env === undefined ? undefined : object(command.env);
@@ -1478,4 +1530,3 @@ export function readVerificationEvidence(context, query = {}) {
     const next = offset + text.length;
     return { schemaVersion: 1, available: true, text, byteCount: bytes, totalBytes: Buffer.byteLength(content), truncated: next < content.length || document.outputTruncated, ...(next < content.length ? { nextCursor: cursor(next) } : {}) };
 }
-//# sourceMappingURL=pipeline-state.js.map

package/dist/shared/args.d.ts

@@ -0,0 +1,18 @@
+/** Parsed command line shared by the installer and runtime CLIs. */
+interface ParsedArgs {
+    subcommand: string | null;
+    flags: Record<string, string | boolean>;
+    positionals: string[];
+}
+/**
+ * Minimal arg parser, no external dep. Handles:
+ *   subcommand                (first bare positional)
+ *   --flag                    (boolean true)
+ *   --flag=value              (string)
+ *   --flag value              (string, consumes next token)
+ *   -h / --help               (help alias)
+ *   -v / --version            (version alias)
+ *   positionals               (everything else)
+ */
+export declare function parseArgs(argv: string[]): ParsedArgs;
+export {};

package/dist/shared/args.js

@@ -0,0 +1,53 @@
+/**
+ * Minimal arg parser, no external dep. Handles:
+ *   subcommand                (first bare positional)
+ *   --flag                    (boolean true)
+ *   --flag=value              (string)
+ *   --flag value              (string, consumes next token)
+ *   -h / --help               (help alias)
+ *   -v / --version            (version alias)
+ *   positionals               (everything else)
+ */
+export function parseArgs(argv) {
+    const flags = {};
+    const positionals = [];
+    let subcommand = null;
+    for (let i = 0; i < argv.length; i++) {
+        const token = argv[i];
+        if (token.startsWith('--')) {
+            const rest = token.slice(2);
+            const eq = rest.indexOf('=');
+            if (eq >= 0) {
+                flags[rest.slice(0, eq)] = rest.slice(eq + 1);
+            }
+            else {
+                const peek = argv[i + 1];
+                if (peek !== undefined && !peek.startsWith('-')) {
+                    flags[rest] = peek;
+                    i++;
+                }
+                else {
+                    flags[rest] = true;
+                }
+            }
+        }
+        else if (token === '-h') {
+            flags.help = true;
+        }
+        else if (token === '-v') {
+            flags.version = true;
+        }
+        else if (token.startsWith('-') && token.length > 1) {
+            flags[token.slice(1)] = true;
+        }
+        else {
+            if (subcommand === null) {
+                subcommand = token;
+            }
+            else {
+                positionals.push(token);
+            }
+        }
+    }
+    return { subcommand, flags, positionals };
+}

package/integration-contract.json

@@ -1,19 +1,13 @@
 {
-  "schemaVersion": "4.0",
+  "schemaVersion": "5.0",
   "providers": {
     "claude": {
-      "updateCommand": "update",
       "cli": {
         "initArgs": [
           "init",
           "--yes",
           "--provider",
           "claude"
-        ],
-        "updateArgs": [
-          "update",
-          "--provider",
-          "claude"
         ]
       },
       "initCommand": "init",
@@ -24,18 +18,12 @@
       }
     },
     "codex": {
-      "updateCommand": "update",
       "cli": {
         "initArgs": [
           "init",
           "--yes",
           "--provider",
           "codex"
-        ],
-        "updateArgs": [
-          "update",
-          "--provider",
-          "codex"
         ]
       },
       "initCommand": "init",
@@ -46,18 +34,12 @@
       }
     },
     "gemini": {
-      "updateCommand": "update",
       "cli": {
         "initArgs": [
           "init",
           "--yes",
           "--provider",
           "gemini"
-        ],
-        "updateArgs": [
-          "update",
-          "--provider",
-          "gemini"
         ]
       },
       "initCommand": "init",
@@ -68,7 +50,6 @@
       }
     },
     "kimi": {
-      "updateCommand": "update",
       "cli": {
         "binary": "node",
         "providerBinary": "kimi",
@@ -77,19 +58,6 @@
         "nestedSkillInvocation": "Kimi built-in Skill tool with { skill, args }; never literal /skill text",
         "modelIdPattern": "^[A-Za-z0-9][A-Za-z0-9._/:-]{0,127}$",
         "sessionIdPattern": "^(?!\\.{1,2}$)[A-Za-z0-9._-]{1,128}$",
-        "roleWave": {
-          "path": ".specrails/kimi-role-wave.json",
-          "schema": "{ run: safe-id, roles: Array<{ key: safe-id, skill: direct-child-id, model: safe-model-id, profile: \"inherit\" | safe-id, args: string, workspace: \"current\" | \"worktree:<safe-id>\" }> } with no extra keys",
-          "maxBytes": 1048576,
-          "maxRoles": 32,
-          "transport": "structured WriteFile followed by one static foreground --role-wave-file command; the one-shot file is deleted before setup and every role is awaited. Inspection, merge, and cleanup use the separate static --role-wave-status, --role-merge-file, and --role-wave-cleanup modes",
-          "workspaces": "current roles receive unique execution directories with SPECRAILS_REPO_DIR set to the target repository; isolated roles create/reuse detached git worktrees from a synthetic baseline that includes the starting tracked/untracked overlay but excludes provider/runtime control files, with SPECRAILS_REPO_DIR set to that worktree",
-          "manifest": ".specrails/kimi-role-worktrees/<run>.json records the immutable synthetic base commit, source head, worktree ids, and role key to execution/repository paths",
-          "status": "--role-wave-status <run> validates the persisted manifest/ref/worktrees and emits one specrails.merge.inventory frame before any downstream merge",
-          "merge": ".specrails/kimi-role-merge.json is the only accepted merge request path; { run, actions: Array<{ worktree: safe-id, path: safe-relative-path, operation: \"copy\" | \"delete\" }> } applies an explicit A/M/D inventory through --role-merge-file without attributing the starting overlay or provider control files",
-          "cleanup": "--role-wave-cleanup <run> removes owned worktrees, temporary execution roots, persisted manifest, and synthetic baseline ref, then emits specrails.role.cleanup",
-          "output": "newline-delimited attributed specrails.role.workspace, specrails.role.event/output, specrails.role.completed, specrails.merge.inventory, specrails.merge.applied, and specrails.role.cleanup frames; aggregate role-wave exit is nonzero when any role fails"
-        },
         "stableEngineEnv": {
           "KIMI_CODE_EXPERIMENTAL_FLAG": null,
           "KIMI_DISABLE_CRON": "1",
@@ -98,7 +66,7 @@
         },
         "windowsPromptTransport": "For the standard npm kimi.cmd/bat shim, prompt bytes travel over stdin to a fixed Node bootstrap which restores process.argv before importing Kimi; native executables fail above a 30000 UTF-16 command-line budget.",
         "initialActivationTelemetry": "Visible prompt parity only; the external materializer cannot emit Kimi-private skill.activated/origin telemetry.",
-        "cancellation": "Single-skill mode forwards SIGINT/SIGTERM/SIGHUP to its direct Kimi child. Role-wave mode forwards each termination signal to every live Kimi child and waits for aggregate completion; the embedding host remains responsible for platform process-tree teardown.",
+        "cancellation": "The runner forwards SIGINT/SIGTERM/SIGHUP to its direct Kimi child; the embedding host remains responsible for platform process-tree teardown.",
         "initArgs": [
           "init",
           "--yes",
@@ -108,12 +76,7 @@
         "resumeArgs": [
           "--session=<session-id>"
         ],
-        "notes": "CLI-only provider execution. Installation/update uses the deterministic Core CLI above. Headless workflows use the managed Node skill runner, never literal /skill text in kimi -p. Role waves await every child and preserve frozen Core execution context. Authenticate once with kimi login.",
-        "updateArgs": [
-          "update",
-          "--provider",
-          "kimi"
-        ],
+        "notes": "CLI-only provider execution. Installation uses the deterministic Core CLI above. Headless workflows use the managed Node skill runner, never literal /skill text in kimi -p. Authenticate once with kimi login.",
         "workflowArgs": [
           ".kimi-code/specrails/run-skill.mjs",
           "--skill",
@@ -186,8 +149,7 @@
         "model": "sonnet"
       },
       "overrides": {
-        "sr-architect": "opus",
-        "sr-product-manager": "opus"
+        "sr-architect": "opus"
       }
     }
   },
@@ -227,22 +189,24 @@
           "max"
         ]
       },
-      "note": "Install config and profiles retain exact ids or safe custom aliases. Preset names do not imply Claude aliases for Kimi. Process launch prefixes only the three documented official short ids with kimi-code/; every custom alias that matches the published model grammar passes through unchanged."
+      "note": "Install config retains exact ids or safe custom aliases. Preset names do not imply Claude aliases for Kimi. Process launch prefixes only the three documented official short ids with kimi-code/; every custom alias that matches the published model grammar passes through unchanged."
     }
   },
   "legacyCompat": {
     "setupCommandAlias": false,
     "enrichCommand": false,
-    "note": "Core 5 installs directly. Legacy config tier is tolerated; enrich, --quick and --lite are removed. Hosts must negotiate schema 4 deterministic lifecycle."
+    "note": "Core installs directly and is driven by Desktop through init and the offline framework lifecycle (install-framework, swap-current, assemble). enrich, update, doctor, profile, --quick and --lite are removed."
   },
   "lifecycle": {
     "mode": "deterministic",
     "requiresEnrich": false,
     "initCommand": "init",
-    "updateCommand": "update",
     "minimumCoreMajor": 5,
     "removedCommands": [
-      "enrich"
+      "enrich",
+      "update",
+      "doctor",
+      "profile"
     ],
     "removedFlags": [
       "--quick",
@@ -325,7 +289,7 @@
   "execution": {
     "schemaVersion": 1,
     "contextEnv": "SPECRAILS_EXECUTION_CONTEXT",
-    "context": "Absolute JSON file: runId, backlogRoot, backlogPath?, artifactRoot, artifactRepositoryId, repositories[{id,name,path,baseSha?}], ownership{git,backlog,worktrees:host|core}, specs[{id,title,description,repositoryIds?,acceptanceCriteria?}]",
+    "context": "Absolute JSON file: runId, backlogRoot, backlogPath?, artifactRoot, artifactRepositoryId, repositories[{id,name,path,baseSha?,scope?}], ownership{git,backlog,worktrees:host|core}, specs[{id,title,description,repositoryIds?,acceptanceCriteria?}]. scope (runtime capability repositoryScope) lists the checkout-relative directories a repository is confined to — a package registered inside a larger checkout: commands without cwd run in the first one, model-proposed checks stay inside it, edits outside it are undone after each developer/fixer turn and reviews judge the git change set against the run base.",
     "runtime": ".specrails/runtime/pipeline.mjs",
     "operations": [
       "init",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "specrails-core",
-  "version": "5.6.0",
-  "description": "Provider-independent AI agent workflow system for Claude Code, Codex, Gemini CLI, and Kimi Code",
+  "version": "6.0.1",
+  "description": "Agent workflow engine for specrails-desktop: provider-independent installer and programmatic agent runtime for Claude Code, Codex, Gemini CLI and Kimi Code",
   "type": "module",
   "exports": {
     "./agent-runtime": {
@@ -20,8 +20,6 @@
     "bin/",
     "dist/",
     "templates/",
-    "commands/",
-    "docs/",
     "schemas/",
     "integration-contract.json",
     "pinned-versions.json"
@@ -47,12 +45,8 @@
     "llm",
     "ai",
     "automation",
-    "productivity",
     "specrails",
     "openspec",
-    "code-generation",
-    "product-management",
-    "vibe-coding",
     "agents",
     "multi-agent",
     "software-engineering",
@@ -78,12 +72,10 @@
   },
   "dependencies": {
     "@fission-ai/openspec": "1.4.1",
-    "@inquirer/prompts": "^7.0.0",
     "@langchain/core": "1.2.10",
     "@langchain/langgraph": "1.4.14",
     "@langchain/langgraph-checkpoint": "1.1.5",
     "@modelcontextprotocol/sdk": "1.29.0",
-    "ajv": "^8.18.0",
     "cross-spawn": "7.0.6",
     "js-yaml": "^4.1.0",
     "picocolors": "^1.1.1",
@@ -94,6 +86,7 @@
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.10.2",
     "@vitest/coverage-v8": "^4.1.5",
+    "ajv": "^8.20.0",
     "typescript": "^5.7.2",
     "vitest": "^4.1.5"
   },