fix(cli): correct the delete recipe's engine claim, and test the command wiring

Three review findings, all real.

The delete recipe still told agents the opposite of what the command does.
The Errors table was corrected in the previous commit while the Goal and
Preconditions eight lines above it still read "rule delete resolves ast-grep
rules only ... A Vale or runtime rule is deleted by removing its directory by
hand", and Step 1 told the reader to list `.taskless/rules/sg/`. That is the
pre-fix assumption this whole change exists to remove, in agent-facing text
embedded in the bundle.

It is worse than stale. An agent following it would delete a rule directory by
hand, which skips the `.taskless/rule-metadata/<id>.yml` cleanup the CLI
performs and bypasses the ambiguity check added here. The recipe now describes
cross-engine resolution, says why deleting by hand is not equivalent, and
states that an id is not unique across engines. Topic bumped v3 to v4, which
the previous commit should have done when it changed the same file.

The ambiguous branch had no test through the command. The unit test covers
what `deleteRuleFiles` returns; it cannot catch the command wiring that
outcome to the wrong code, a malformed message, or a missing
`process.exitCode`. Added a `runCli` test beside the existing RULE_NOT_FOUND
one that seeds two engine directories, asserts `RULE_ID_AMBIGUOUS`, asserts
both paths appear in the message, and asserts both directories still exist.

The scan and the `rm` are not atomic, and that is now recorded as accepted
rather than left to look like an oversight. Closing the window needs a lock
over `.taskless/rules/`, which is a large mechanism for a local single-user
operation that no command runs concurrently with itself.

1297 tests pass, typecheck and lint clean.

Author: theCodeDrift

packages/cli/src/agent/delete-rule.txt

@@ -1,33 +1,38 @@
-# Topic: delete-rule     (CLI v%(CLI_VERSION)s / topic v3)
+# Topic: delete-rule     (CLI v%(CLI_VERSION)s / topic v4)
 
 ## Goal
-Remove an ast-grep rule and its associated test files from
-`.taskless/`. Does not contact the Taskless API; purely a local
-filesystem operation.
+Remove a rule and its associated test files from `.taskless/`. Does not
+contact the Taskless API; purely a local filesystem operation.
 
-`rule delete` resolves ast-grep rules only. It takes a bare id, not a
-path, and looks for it under `.taskless/rules/sg/`. A Vale or runtime
-rule is deleted by removing its directory by hand.
+`rule delete` takes a bare id, not a path, and resolves which engine
+holds it: it searches `.taskless/rules/sg/`, `vale/` and `runtime/`.
+Deleting the directory by hand instead skips the metadata sidecar the
+CLI also removes, and skips the ambiguity check below.
+
+An id is not unique across engines. Nothing enforces uniqueness, so two
+engines can hold the same id, and the CLI refuses that case rather than
+picking one.
 
 ## Preconditions
 - `.taskless/` directory exists.
-- The target rule directory exists at `.taskless/rules/sg/<id>/`.
+- The target rule directory exists under `.taskless/rules/<engine>/<id>/`
+  for exactly one engine.
 - No auth required.
 
 ## Steps
 
 1. **Identify the rule.** If the user named one, use it. Otherwise,
-   list `.taskless/rules/sg/` and ask which one. Confirm the user's
-   intent, deletion is destructive.
+   list the engine directories under `.taskless/rules/` and ask which
+   rule. Confirm the user's intent, deletion is destructive.
 
 2. **Invoke the CLI.** Run:
    ```
    %(TASKLESS_CLI)s rule delete <id>
    ```
 
    The CLI removes:
-   - `.taskless/rules/sg/<id>/`: the whole directory, which holds the
-     rule, its `.tests/`, and any per-rule config
+   - `.taskless/rules/<engine>/<id>/`: the whole directory, which holds
+     the rule, its `.tests/`, and any per-rule config
    - `.taskless/rule-metadata/<id>.yml`, a sidecar the CLI never
      writes. The removal is there for a directory a person created by
      hand; expect it to be absent.

packages/cli/src/rules/files.ts

@@ -285,6 +285,14 @@ export async function deleteRuleFiles(
   // invisible while ast-grep was the only engine a rule could be delivered
   // for: a vale or runtime rule could be written and then not removed, and
   // `delete` reported "not found" for a rule plainly on disk.
+  // The scan and the `rm` below are not atomic, and that is accepted rather
+  // than overlooked. A second engine's directory for this id could appear
+  // between them, and the delete would then proceed on a resolution that has
+  // just gone stale. Closing it would need a lock over `.taskless/rules/`,
+  // which is a large mechanism for a local single-user filesystem operation
+  // that no CLI command runs concurrently with itself. The window is narrow
+  // and the cost of the fix is not.
+  //
   // Destructured rather than indexed so `engine` narrows to a single engine
   // for the rest of the function: `engines[0]` is `EngineName | undefined`
   // under `noUncheckedIndexedAccess`, and asserting it away here would be

packages/cli/test/error-envelope.test.ts

@@ -1,5 +1,6 @@
 import { execFile } from "node:child_process";
 import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { existsSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { promisify } from "node:util";
@@ -220,6 +221,38 @@ describe("standardized error envelope (--json)", () => {
       expect(result.exitCode).toBe(0);
       expect(result.stdout.trim()).toBe("");
     });
+
+    it("emits RULE_ID_AMBIGUOUS, and deletes nothing, when two engines hold the id", async () => {
+      // Through the command, not through `deleteRuleFiles`. The unit test
+      // covers the outcome the function returns; this covers whether the
+      // command wires that outcome to the right code, message and exit status,
+      // which a correct return value does not guarantee.
+      const directories = ["sg", "vale"].map((engine) =>
+        join(cwd, ".taskless", "rules", engine, "shared-id")
+      );
+      for (const directory of directories) {
+        await mkdir(directory, { recursive: true });
+        await writeFile(join(directory, "marker.txt"), "x");
+      }
+
+      const result = await runCli([
+        "rule",
+        "delete",
+        "shared-id",
+        "--json",
+        "-d",
+        cwd,
+      ]);
+
+      expect(result.exitCode).not.toBe(0);
+      const env = parseEnvelope(result.stdout);
+      expect(env.code).toBe("RULE_ID_AMBIGUOUS");
+      expect(env.message).toContain("shared-id");
+      for (const directory of directories) {
+        expect(env.message).toContain(directory);
+        expect(existsSync(directory)).toBe(true);
+      }
+    });
   });
 
   describe("auth login", () => {