Bug Description
On a clean greenfield install (empty folder, "Greenfield" project type),
the installer stops during "Configuring environment..." and asks:
Found existing .aiox-core/core-config.yaml. What would you like to do?
Merge (preserve existing customizations)
Backup and overwrite
Overwrite completely
Skip (keep existing)
There should be no "existing" core-config.yaml on a from-scratch install.
Inspecting the file that triggers the prompt shows it is NOT a fresh
greenfield default and NOT a user file — it is the AIOX framework's own
development/contributor config, shipped inside the "core installed
(1179 files)" step and then re-detected by the later environment step.
Evidence — the pre-prompt file (copied aside before choosing Overwrite)
contained contributor/dev values:
type: EXISTING_AIOX
installedAt: '2025-01-14T00:00:00Z'
user_profile: advanced
frameworkProtection: false # "TEMPORARY: TOK-3 contributor mode"
mcp.enabled: true # full docker-gateway preset
ide: [vscode, codex, gemini, cursor, claude-code]
After choosing "Overwrite completely", the correct greenfield file was
written:
type: greenfield
installedAt: '2026-07-15T...'
frameworkProtection: true
mcp.enabled: false
ide: [claude-code, codex] # exactly what I selected
Two problems:
-
PACKAGING/SEQUENCING: the published package ships a final
core-config.yaml (a contributor artifact) among the core files, so a
greenfield install ALWAYS finds a pre-existing config and prompts — a
prompt that should never appear on a clean install.
-
MISLEADING + UNSAFE PROMPT: the options "Merge (preserve existing
customizations)" and "Skip (keep existing)" treat this leaked dev file
as the user's customizations. Choosing anything other than "Overwrite"
would apply contributor-mode settings to a brand-new project,
including frameworkProtection: false — which DISABLES the L1/L2 deny
rules that protect framework core files. That is a silent security
regression, and the prompt wording actively steers users the wrong way.
Steps to Reproduce
- Create an empty folder (e.g. C:\git\aiox.matrix\free\2) and cd into it.
- Run: npx aiox-core@latest install
- Answer the wizard:
- Language: Português
- Assistance mode: Modo Assistido (Recomendado)
- Project type: Greenfield (projeto novo do zero)
- IDEs: Claude Code, Codex CLI
- Tech Preset: None
- Edition: Community (free)
- Let it run through:
"📦 Installing AIOX core framework... AIOX core installed (1179 files)"
then "📝 Configuring environment...".
- Observe: during environment configuration the installer prints
"Found existing .aiox-core/core-config.yaml. What would you like to do?"
with Merge / Backup and overwrite / Overwrite completely / Skip.
- Before answering, inspect/copy .aiox-core/core-config.yaml and note it
is a contributor config (type: EXISTING_AIOX, frameworkProtection: false,
mcp.enabled: true, IDEs you did not select).
Expected Behavior
A greenfield install should never encounter a pre-existing
core-config.yaml, and therefore should never show the Merge/Overwrite/Skip
prompt.
Preferred fix (root cause): do not distribute the final core-config.yaml
inside the core files. Ship a template (e.g. core-config.template.yaml)
and have the environment step render the real core-config.yaml exactly
once from the wizard answers. No collision, no prompt.
Fallback fix (UX/safety): detect greenfield / first install and skip the
prompt, auto-generating the config. Reserve the Merge/Backup/Overwrite/
Skip prompt for RE-installs over an existing AIOX project. In that
reinstall case, never present a shipped dev config as "user
customizations", and never let a non-Overwrite choice silently set
frameworkProtection: false on a project that selected project mode.
WHY THIS APPROACH IS BETTER (evidence-based):
- Correctness: the only safe answer in the current flow is "Overwrite",
yet the wording recommends "preserve". Removing the prompt on greenfield
eliminates a choice where every non-default option produces a broken or
insecure project.
- Security: frameworkProtection is meant to be true for projects (per the
4-layer boundary model). The leaked file sets it to false. Rendering
from a template guarantees the project-mode default instead of
inheriting contributor mode by accident.
- Fidelity: the rendered config reflects the user's actual choices (IDEs,
MCP off, greenfield type). The shipped file contradicts all of them
(extra IDEs, MCP on, type EXISTING_AIOX, a 2025-01-14 timestamp).
- Determinism: a single render point removes the "copied then re-detected"
race that causes the prompt in the first place.
Actual Behavior
The core-install step copies a contributor core-config.yaml (type:
EXISTING_AIOX, frameworkProtection: false, mcp.enabled: true, unselected
IDEs, installedAt 2025-01-14) into .aiox-core/. The later environment step
detects it as "existing" and prompts Merge/Backup/Overwrite/Skip on a
brand-new greenfield project.
Choosing "Overwrite completely" produced a correct greenfield config, but
choosing Merge or Skip would have applied the contributor settings —
including frameworkProtection: false (deny-rule protection OFF) — to the
new project.
Error Output
No stack trace (not a crash). Relevant installer transcript:
📦 Installing AIOX core framework...
√ AIOX core installed (1179 files)
...
📝 Configuring environment...
✅ Created .env file
✅ Created .env.example file
✅ Updated .gitignore
o Found existing .aiox-core/core-config.yaml. What would you like to do?
| > Merge (preserve existing customizations)
| Backup and overwrite
| Overwrite completely
| Skip (keep existing)
| Overwrite completely
✅ Created .aiox-core/core-config.yaml
Config diff (shipped "existing" file -> generated greenfield file):
type: EXISTING_AIOX -> type: greenfield
installedAt: 2025-01-14... -> installedAt: 2026-07-15...
user_profile: advanced -> user_profile: bob
frameworkProtection: false -> frameworkProtection: true
mcp.enabled: true -> mcp.enabled: false
ide: vscode,codex,gemini, -> ide: claude-code, codex
cursor,claude-codeAffected Area
Installer (packages/installer/)
AIOX Version
5.3.0
Operating System
Windows 10
Node.js Version
v22.18.0
Priority
High - Significant impact on functionality
Checklist
Bug Description
On a clean greenfield install (empty folder, "Greenfield" project type),
the installer stops during "Configuring environment..." and asks:
There should be no "existing" core-config.yaml on a from-scratch install.
Inspecting the file that triggers the prompt shows it is NOT a fresh
greenfield default and NOT a user file — it is the AIOX framework's own
development/contributor config, shipped inside the "core installed
(1179 files)" step and then re-detected by the later environment step.
Evidence — the pre-prompt file (copied aside before choosing Overwrite)
contained contributor/dev values:
After choosing "Overwrite completely", the correct greenfield file was
written:
Two problems:
PACKAGING/SEQUENCING: the published package ships a final
core-config.yaml (a contributor artifact) among the core files, so a
greenfield install ALWAYS finds a pre-existing config and prompts — a
prompt that should never appear on a clean install.
MISLEADING + UNSAFE PROMPT: the options "Merge (preserve existing
customizations)" and "Skip (keep existing)" treat this leaked dev file
as the user's customizations. Choosing anything other than "Overwrite"
would apply contributor-mode settings to a brand-new project,
including frameworkProtection: false — which DISABLES the L1/L2 deny
rules that protect framework core files. That is a silent security
regression, and the prompt wording actively steers users the wrong way.
Steps to Reproduce
"📦 Installing AIOX core framework... AIOX core installed (1179 files)"
then "📝 Configuring environment...".
"Found existing .aiox-core/core-config.yaml. What would you like to do?"
with Merge / Backup and overwrite / Overwrite completely / Skip.
is a contributor config (type: EXISTING_AIOX, frameworkProtection: false,
mcp.enabled: true, IDEs you did not select).
Expected Behavior
A greenfield install should never encounter a pre-existing
core-config.yaml, and therefore should never show the Merge/Overwrite/Skip
prompt.
Preferred fix (root cause): do not distribute the final core-config.yaml
inside the core files. Ship a template (e.g. core-config.template.yaml)
and have the environment step render the real core-config.yaml exactly
once from the wizard answers. No collision, no prompt.
Fallback fix (UX/safety): detect greenfield / first install and skip the
prompt, auto-generating the config. Reserve the Merge/Backup/Overwrite/
Skip prompt for RE-installs over an existing AIOX project. In that
reinstall case, never present a shipped dev config as "user
customizations", and never let a non-Overwrite choice silently set
frameworkProtection: false on a project that selected project mode.
WHY THIS APPROACH IS BETTER (evidence-based):
yet the wording recommends "preserve". Removing the prompt on greenfield
eliminates a choice where every non-default option produces a broken or
insecure project.
4-layer boundary model). The leaked file sets it to false. Rendering
from a template guarantees the project-mode default instead of
inheriting contributor mode by accident.
MCP off, greenfield type). The shipped file contradicts all of them
(extra IDEs, MCP on, type EXISTING_AIOX, a 2025-01-14 timestamp).
race that causes the prompt in the first place.
Actual Behavior
The core-install step copies a contributor core-config.yaml (type:
EXISTING_AIOX, frameworkProtection: false, mcp.enabled: true, unselected
IDEs, installedAt 2025-01-14) into .aiox-core/. The later environment step
detects it as "existing" and prompts Merge/Backup/Overwrite/Skip on a
brand-new greenfield project.
Choosing "Overwrite completely" produced a correct greenfield config, but
choosing Merge or Skip would have applied the contributor settings —
including frameworkProtection: false (deny-rule protection OFF) — to the
new project.
Error Output
Affected Area
Installer (packages/installer/)
AIOX Version
5.3.0
Operating System
Windows 10
Node.js Version
v22.18.0
Priority
High - Significant impact on functionality
Checklist