fix(install): keep skill backups undiscoverable

scripts/lib/manifest.ps1

@@ -3,6 +3,14 @@ function Get-ManagedManifestPath {
     return (Join-Path $Destination '.ai-config-manifest.tsv')
 }
 
+function Get-ManagedBackupRoot {
+    param([Parameter(Mandatory=$true)][string]$Destination)
+    if ((Split-Path $Destination -Leaf) -eq 'skills' -and (Split-Path (Split-Path $Destination -Parent) -Leaf) -eq '.agents') {
+        return (Resolve-ManagedPath -Destination (Split-Path $Destination -Parent) -Relative '.ai-config-skill-backups')
+    }
+    return (Resolve-ManagedPath -Destination $Destination -Relative 'backups')
+}
+
 function Resolve-ManagedPath {
     param([Parameter(Mandatory=$true)][string]$Destination, [Parameter(Mandatory=$true)][string]$Relative)
     $parts = $Relative -split '/', 0, 'SimpleMatch'
@@ -35,6 +43,23 @@ function Get-Sha256HashOfBytes {
     finally { $sha256.Dispose() }
 }
 
+function Write-ManagedSkillFile {
+    param([Parameter(Mandatory=$true)][string]$Path,[Parameter(Mandatory=$true)][byte[]]$Bytes)
+    $temporary = Join-Path (Split-Path $Path -Parent) ('.ai-config-skill-' + [Guid]::NewGuid().ToString('N') + '.tmp')
+    $backup = "$temporary.bak"
+    try {
+        [System.IO.File]::WriteAllBytes($temporary, $Bytes)
+        if ([System.IO.File]::Exists($Path)) {
+            [System.IO.File]::Replace($temporary, $Path, $backup)
+        } else {
+            [System.IO.File]::Move($temporary, $Path)
+        }
+    } finally {
+        if ([System.IO.File]::Exists($temporary)) { [System.IO.File]::Delete($temporary) }
+        if ([System.IO.File]::Exists($backup)) { [System.IO.File]::Delete($backup) }
+    }
+}
+
 function Read-ManagedManifest {
     param([Parameter(Mandatory=$true)][string]$ManifestPath)
     $entries = @{}
@@ -88,7 +113,16 @@ function Sync-ManagedDestination {
     $null = Resolve-ManagedPath -Destination $Destination -Relative '.ai-config-manifest.tsv'
     $oldManifest = Read-ManagedManifest $manifestPath
     $newManifest = @{}
-    $backupRoot = Join-Path $Destination "backups/$Stamp"
+    $backupRoot = Get-ManagedBackupRoot $Destination
+    $oldBackupRoot = Resolve-ManagedPath -Destination $Destination -Relative 'backups'
+    if ($backupRoot -ne $oldBackupRoot -and (Test-Path -LiteralPath $oldBackupRoot)) {
+        if ($DryRun) {
+            if (-not $Summary) { Write-Output "DRYRUN MOVE $oldBackupRoot -> $backupRoot" }
+        } else {
+            New-Item -ItemType Directory -Path $backupRoot -Force | Out-Null
+            Move-Item -LiteralPath $oldBackupRoot -Destination (Join-Path $backupRoot ('legacy-' + [Guid]::NewGuid().ToString('N')))
+        }
+    }
     $tally = @{ Created = 0; Updated = 0; Unchanged = 0; Removed = 0; Warned = 0 }
 
     Get-ChildItem $Source -File -Recurse | ForEach-Object {
@@ -132,14 +166,18 @@ function Sync-ManagedDestination {
         if ($DryRun) { if (-not $Summary) { Write-Output "DRYRUN $action $target" }; if ($action -eq 'CREATE') { $tally.Created++ } else { $tally.Updated++ }; return }
         if ($exists) {
             $wasManaged = $oldManifest.ContainsKey($relative)
-            $backup = Resolve-ManagedPath -Destination $Destination -Relative "backups/$Stamp/$relative"
+            $backup = Resolve-ManagedPath -Destination $backupRoot -Relative "$Stamp/$relative"
             New-Item (Split-Path $backup -Parent) -ItemType Directory -Force | Out-Null
             Copy-Item -LiteralPath $target $backup -Force
             if (-not $Summary) { Write-Output "BACKUP $target -> $backup" }
             if (-not $wasManaged) { Write-Output "WARN $target existed before this installation but was not tracked by a previous run; it was backed up before being overwritten."; $tally.Warned++ }
         }
         New-Item (Split-Path $target -Parent) -ItemType Directory -Force | Out-Null
-        [System.IO.File]::WriteAllBytes($target, $newBytes)
+        if ($relative -eq 'SKILL.md' -or $relative.EndsWith('/SKILL.md', [StringComparison]::Ordinal)) {
+            Write-ManagedSkillFile -Path $target -Bytes $newBytes
+        } else {
+            [System.IO.File]::WriteAllBytes($target, $newBytes)
+        }
         if (-not $Summary) { Write-Output "$action $target" }
         if ($action -eq 'CREATE') { $tally.Created++ } else { $tally.Updated++ }
     }
@@ -148,7 +186,7 @@ function Sync-ManagedDestination {
         $target = Resolve-ManagedPath -Destination $Destination -Relative $relative
         if (-not (Test-Path -LiteralPath $target)) { continue }
         if ($DryRun) { if (-not $Summary) { Write-Output "DRYRUN REMOVE $target" }; $tally.Removed++; continue }
-        $backup = Resolve-ManagedPath -Destination $Destination -Relative "backups/$Stamp/$relative"
+        $backup = Resolve-ManagedPath -Destination $backupRoot -Relative "$Stamp/$relative"
         New-Item (Split-Path $backup -Parent) -ItemType Directory -Force | Out-Null
         Copy-Item -LiteralPath $target $backup -Force
         if (-not $Summary) { Write-Output "BACKUP $target -> $backup" }

scripts/lib/manifest.sh

@@ -16,6 +16,15 @@ manifest_path() {
   printf '%s/.ai-config-manifest.tsv' "$1"
 }
 
+managed_backup_root() {
+  local destination=$1
+  if [ "${destination##*/}" = skills ] && [ "$(basename -- "$(dirname -- "$destination")")" = .agents ]; then
+    managed_target "$(dirname -- "$destination")" '.ai-config-skill-backups'
+  else
+    managed_target "$destination" backups
+  fi
+}
+
 managed_target() {
   local destination=$1 relative=$2 component target probe
   target=$destination
@@ -82,6 +91,20 @@ sync_managed_destination() {
   read_managed_manifest "$manifest" old_manifest || return 1
   declare -A new_manifest
   local created=0 updated=0 unchanged=0 removed=0 warned=0
+  local backup_root old_backup_root
+  backup_root=$(managed_backup_root "$destination") || return 1
+  old_backup_root=$(managed_target "$destination" backups) || return 1
+  if [ "$backup_root" != "$old_backup_root" ] && [ -e "$old_backup_root" ]; then
+    if [ "$dry_run" = true ]; then
+      [ "$summary" = true ] || printf 'DRYRUN MOVE %s -> %s\n' "$old_backup_root" "$backup_root"
+    else
+      mkdir -p -- "$backup_root"
+      local legacy_target
+      legacy_target="$backup_root/legacy-$RANDOM-$RANDOM"
+      while [ -e "$legacy_target" ]; do legacy_target="$backup_root/legacy-$RANDOM-$RANDOM"; done
+      mv -- "$old_backup_root" "$legacy_target" || return 1
+    fi
+  fi
 
   while IFS= read -r -d '' source_file; do
     local relative target content needs_sub new_hash exists current_hash action backup
@@ -143,7 +166,7 @@ sync_managed_destination() {
     fi
 
     if [ "$exists" = true ]; then
-      backup=$(managed_target "$destination" "backups/$stamp/$relative") || return 1
+      backup=$(managed_target "$backup_root" "$stamp/$relative") || return 1
       mkdir -p "$(dirname -- "$backup")"
       cp -- "$target" "$backup"
       [ "$summary" = true ] || printf 'BACKUP %s -> %s\n' "$target" "$backup"
@@ -153,7 +176,16 @@ sync_managed_destination() {
       fi
     fi
     mkdir -p "$(dirname -- "$target")"
-    if [ "$needs_sub" = true ]; then
+    if [[ "$relative" = SKILL.md || "$relative" = */SKILL.md ]]; then
+      local temporary
+      temporary=$(mktemp "$(dirname -- "$target")/.ai-config-skill.XXXXXX") || return 1
+      if [ "$needs_sub" = true ]; then
+        printf '%s' "$content" > "$temporary" || { rm -f -- "$temporary"; return 1; }
+      else
+        cp -- "$source_file" "$temporary" || { rm -f -- "$temporary"; return 1; }
+      fi
+      mv -f -- "$temporary" "$target" || { rm -f -- "$temporary"; return 1; }
+    elif [ "$needs_sub" = true ]; then
       printf '%s' "$content" > "$target"
     else
       cp -- "$source_file" "$target"
@@ -172,7 +204,7 @@ sync_managed_destination() {
       removed=$((removed + 1))
       continue
     fi
-    backup=$(managed_target "$destination" "backups/$stamp/$relative") || return 1
+    backup=$(managed_target "$backup_root" "$stamp/$relative") || return 1
     mkdir -p "$(dirname -- "$backup")"
     cp -- "$target" "$backup"
     [ "$summary" = true ] || printf 'BACKUP %s -> %s\n' "$target" "$backup"