@ainova-systems/intelligence 0.18.0 → 0.18.1

package/engine/ENGINE_SHA

@@ -1 +1 @@
-1bf045d314f2c2f58a70d5a74130b5f5376b56e4
+7dfbb01c2182f3de05bff94f3e5e080cf267f8c6

package/engine/VERSION

@@ -1 +1 @@
-0.18.0
+0.18.1

package/engine/lib/common.sh

@@ -677,12 +677,23 @@ sync_open_skill_dirs() {
 # `agents/openai.yaml` beside SKILL.md. Source skills stay tool-neutral: the
 # policy file is derived here, in the open-standard tree Codex reads, so every
 # adapter sharing that tree writes the same bytes. A skill that ships its own
-# `agents/openai.yaml` keeps it — that is the author configuring Codex directly.
+# `agents/openai.yaml` keeps the rest of it: the output copy gains the policy
+# when the author's file sets none, and a file whose policy says otherwise, or
+# that sync cannot read as saying it, refuses the render — an owner-only skill
+# Codex can still select is the exact failure the field exists to prevent, so
+# it never passes as a success.
 open_skill_invocation_policies() {
-    local output_dir="$1" path flag rows
-    local -a skill_mds=() policy_dirs=() policies=()
+    local output_dir="$1" path dir flag rows refusals
+    local -a skill_mds=() policy_dirs=() policies=() authored=()
     for path in "$output_dir"/*/SKILL.md; do
-        [ -f "$path" ] && [ ! -L "$path" ] && skill_mds+=("$path")
+        dir="${path%/SKILL.md}"
+        # A link is emitted as-is (see _skill_bundle_note): reading through it
+        # or writing beside it would reach outside the output tree.
+        if [ -L "$dir" ] || [ -L "$path" ]; then
+            echo "  WARN: ${dir##*/}/SKILL.md is reached through a symlink — Codex gets no invocation policy derived for it" >&2
+        elif [ -f "$path" ]; then
+            skill_mds+=("$path")
+        fi
     done
     [ "${#skill_mds[@]}" -gt 0 ] || return 0
     # Captured, not streamed: a reader cut short must fail the render rather
@@ -693,13 +704,32 @@ open_skill_invocation_policies() {
     }
     while IFS=$'\x1f' read -r path flag; do
         [ "$flag" = "true" ] || continue
-        path="${path%/SKILL.md}/agents"
-        # A symlinked `agents` would carry the write outside the output tree.
-        [ -L "$path" ] && continue
-        [ -e "$path/openai.yaml" ] || [ -L "$path/openai.yaml" ] && continue
+        dir="${path%/SKILL.md}"
+        path="$dir/agents"
+        if [ -L "$path" ] || [ -L "$path/openai.yaml" ]; then
+            echo "  WARN: ${dir##*/}/agents/openai.yaml is a symlink — left as-is, its invocation policy is not enforced" >&2
+            continue
+        fi
+        if [ -s "$path/openai.yaml" ]; then
+            authored+=("$path/openai.yaml")
+            continue
+        fi
         policy_dirs+=("$path")
         policies+=("$path/openai.yaml")
     done <<< "$rows"
+    if [ "${#authored[@]}" -gt 0 ]; then
+        refusals="$(enforce_authored_invocation_policies "${authored[@]}")" || {
+            echo "ERROR: could not read or rewrite agents/openai.yaml under $output_dir" >&2
+            return 1
+        }
+        if [ -n "$refusals" ]; then
+            while IFS=$'\t' read -r path flag; do
+                path="${path%/agents/openai.yaml}"
+                echo "ERROR: ${path##*/} sets disable-model-invocation: true, but its agents/openai.yaml $flag — make them agree, or Codex can still select the skill" >&2
+            done <<< "$refusals"
+            return 1
+        fi
+    fi
     [ "${#policies[@]}" -gt 0 ] || return 0
     mkdir -p "${policy_dirs[@]}"
     for path in "${policies[@]}"; do
@@ -709,6 +739,94 @@ open_skill_invocation_policies() {
     finalize_output_files "${policies[@]}"
 }
 
+# enforce_authored_invocation_policies <openai.yaml>... — one awk pass over
+# author-owned Codex files of skills that set `disable-model-invocation: true`.
+# A file already setting `policy.allow_implicit_invocation: false` is left
+# alone; one without that key gains it, inside an existing `policy:` block or
+# as a new block, every other line kept. Only the plain boolean on a direct
+# child of `policy:` counts — the key Codex reads. A file that sets it
+# otherwise, or whose `policy:` sync cannot read or extend safely, is printed
+# as `<file>\t<reason>` and left untouched for the caller to refuse.
+enforce_authored_invocation_policies() {
+    awk '
+        function reset() {
+            file = ""; n = 0; haspol = 0; inpol = 0; polline = 0
+            inline = ""; child = ""; val = ""; hasval = 0; bad = ""
+        }
+        # A one-line policy counts only as a flat flow mapping of plain
+        # scalars holding the key itself; a quoted or nested value is not read.
+        function inline_ok(s,   body, parts, k, i, p) {
+            if (s !~ /^\{.*\}$/) return 0
+            body = substr(s, 2, length(s) - 2)
+            if (body ~ /[{}"\047]/ || index(body, "[") || index(body, "]")) return 0
+            k = split(body, parts, ",")
+            for (i = 1; i <= k; i++) {
+                p = parts[i]
+                gsub(/^[[:space:]]+|[[:space:]]+$/, "", p)
+                if (p ~ /^allow_implicit_invocation[[:space:]]*:[[:space:]]*false$/) return 1
+            }
+            return 0
+        }
+        function finish(   i, ind) {
+            if (file == "") return
+            if (bad == "" && inline != "" && !inline_ok(inline))
+                bad = "has policy: " inline ", which does not plainly set allow_implicit_invocation: false"
+            if (bad == "" && hasval && val != "false")
+                bad = "sets policy.allow_implicit_invocation: " (val == "" ? "null" : val)
+            if (bad != "") { printf "%s\t%s\n", file, bad; reset(); return }
+            if (inline != "" || hasval) { reset(); return }
+            ind = (child != "") ? child : "  "
+            for (i = 1; i <= n; i++) {
+                print L[i] > file
+                if (haspol && i == polline) print ind "allow_implicit_invocation: false" > file
+            }
+            if (!haspol) {
+                print "policy:" > file
+                print "  allow_implicit_invocation: false" > file
+            }
+            close(file)
+            reset()
+        }
+        BEGIN { reset() }
+        FNR == 1 { finish(); file = FILENAME }
+        { sub(/\r$/, ""); L[++n] = $0 }
+        /^["\047]?policy["\047]?[[:space:]]*:/ {
+            if (haspol) bad = "has more than one policy: key"
+            haspol = 1; polline = n; inpol = 1
+            rest = $0
+            sub(/^[^:]*:[[:space:]]*/, "", rest)
+            sub(/[[:space:]]+#.*$/, "", rest)
+            sub(/^#.*$/, "", rest)
+            sub(/[[:space:]]+$/, "", rest)
+            if (rest != "") { inline = rest; inpol = 0 }
+            next
+        }
+        inpol && /^[^[:space:]#]/ { inpol = 0 }
+        # The first indented line fixes the depth of the direct children of
+        # policy:, and a deeper line belongs to another key, not the one Codex
+        # reads.
+        inpol && /^[[:space:]]+[^[:space:]#]/ {
+            match($0, /^[[:space:]]+/)
+            cur = substr($0, 1, RLENGTH)
+            if (child == "") {
+                child = cur
+                if ($0 ~ /^[[:space:]]+-([[:space:]]|$)/) bad = "has a policy: that is not a mapping"
+            } else if (length(cur) < length(child)) {
+                bad = "has a policy: block indented inconsistently"
+            }
+            if (cur == child && $0 ~ /^[[:space:]]+["\047]?allow_implicit_invocation["\047]?[[:space:]]*:/) {
+                v = $0
+                sub(/^[^:]*:[[:space:]]*/, "", v)
+                sub(/[[:space:]]+#.*$/, "", v)
+                sub(/^#.*$/, "", v)
+                sub(/[[:space:]]+$/, "", v)
+                hasval = 1; val = v
+            }
+        }
+        END { finish() }
+    ' "$@"
+}
+
 # Lint YAML frontmatter for common pitfalls (unquoted colons, leading tabs).
 # Print warnings to stderr; do not fail. Strict consumers (Codex CLI) reject
 # these files with cryptic messages — catching them in sync gives better DX.
@@ -1010,7 +1128,11 @@ load_model_tiers() {
 }
 
 # resolve_model_var <tier> — set IS_MODEL from the tiers load_model_tiers
-# resolved. An empty tier resolves to heavy, like get_model's default.
+# resolved. An empty tier resolves to heavy, like get_model's default. A tier
+# the tool has no default for and the manifest overrides nowhere — a typo, as a
+# rule — still renders an empty model, but never silently: the run warns once
+# per tool and tier, unindented on purpose because `sync --compact` keeps only
+# `WARNING:` lines.
 # shellcheck disable=SC2034  # IS_MODEL is the return channel read by adapters
 resolve_model_var() {
     case "$1" in
@@ -1018,7 +1140,17 @@ resolve_model_var() {
         heavy|"") IS_MODEL="$IS_MODEL_HEAVY" ;;
         standard) IS_MODEL="$IS_MODEL_STANDARD" ;;
         light)    IS_MODEL="$IS_MODEL_LIGHT" ;;
-        *)        IS_MODEL="$(get_model "$IS_MODEL_CFG" "$IS_MODEL_IDE" "$1")" ;;
+        *)
+            IS_MODEL="$(get_model "$IS_MODEL_CFG" "$IS_MODEL_IDE" "$1")"
+            [ -n "$IS_MODEL" ] && return 0
+            case "${IS_MODEL_WARNED:-|}" in
+                *"|$IS_MODEL_IDE:$1|"*) ;;
+                *)
+                    IS_MODEL_WARNED="${IS_MODEL_WARNED:-|}$IS_MODEL_IDE:$1|"
+                    echo "WARNING: no $IS_MODEL_IDE model for tier '$1' — agents with it get an empty model; use frontier, heavy, standard or light, or set models.$IS_MODEL_IDE.$1" >&2
+                    ;;
+            esac
+            ;;
     esac
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ainova-systems/intelligence",
-  "version": "0.18.0",
+  "version": "0.18.1",
   "description": "Build, version and distribute AI agent intelligence across your organization — one CLI, versioned Intelligence Packages, and a sync engine for Claude Code, Cursor, Copilot, Codex, Pi and OpenCode.",
   "bin": {
     "intelligence": "bin/intelligence.js"

package/packages/sync/references/conventions.md

@@ -194,7 +194,7 @@ Do not instruct an agent to read rules or restate their content. Claude loads it
 
 Codex also receives a reasoning effort per tier — `xhigh`, `high`, `medium`, `low` — which is what separates `frontier` from `heavy` in Codex. Copilot has no effort field, so its `frontier` and `heavy` agents are identical. Claude's Haiku 4.5 is retiring with no successor announced, so `light` shares `standard`'s Sonnet in Claude and OpenCode; Cursor and Antigravity have fewer native levels than there are tiers, so several tiers share one value there too.
 
-The vocabulary is tool-neutral. Adapters resolve it through `get_model()`. Override a default under `models.<tool>.<tier>` in `intelligence.yaml` only when the project needs a pin; sync reports drift when that override differs from the current default.
+The vocabulary is tool-neutral. Adapters resolve it through `get_model()`. Override a default under `models.<tool>.<tier>` in `intelligence.yaml` only when the project needs a pin; sync reports drift when that override differs from the current default. Another tier name works only where `models.<tool>.<tier>` defines it; elsewhere — a typo, as a rule — the agent renders with an empty `model` and sync warns once per tool and tier.
 
 ### Access mappings
 
@@ -254,7 +254,7 @@ argument-hint: "<route-name>"
 
 Standard optional fields (`license`, `compatibility`, `metadata`, `allowed-tools`) and tool extensions pass through unchanged. A tool ignores fields it does not understand.
 
-`disable-model-invocation: true` makes a skill one only the owner starts, as a slash command: use it for a procedure that changes versions, the lock or generated outputs, where an agent selecting it unasked is the failure. Claude Code, Cursor and Copilot read the field itself; Codex does not, so sync writes `agents/openai.yaml` with `allow_implicit_invocation: false` beside the skill in `.agents/skills/`. Keep the source to the field — a skill that ships its own `agents/openai.yaml` keeps it unchanged.
+`disable-model-invocation: true` makes a skill one only the owner starts, as a slash command: use it for a procedure that changes versions, the lock or generated outputs, where an agent selecting it unasked is the failure. Claude Code, Cursor and Copilot read the field itself; Codex does not, so sync writes `agents/openai.yaml` with `allow_implicit_invocation: false` beside the skill in `.agents/skills/`. Keep the source to the field. A skill that ships its own `agents/openai.yaml` keeps everything else in it: sync adds the policy when the file sets none, and refuses one that sets it otherwise or not as a plain `allow_implicit_invocation: false` directly under `policy:`.
 
 These limits reject a skill instead of degrading it: