@kontextmind/kxm 0.7.105 → 0.7.107

package/plugins/kxm/dist/mcp-server.js

@@ -17313,7 +17313,7 @@ function sessionTokenFixHint(policy) {
 }
 
 // plugins/kxm/src/mcp-server.ts
-var VERSION = "0.7.105";
+var VERSION = "0.7.107";
 var CONFIGURE_PLUGIN = "/plugin configure kxm@kxm";
 var inbox = /* @__PURE__ */ new Map();
 var notifiedInbox = /* @__PURE__ */ new Set();

package/plugins/kxm/dist/runtime-supervisor.js

@@ -17151,7 +17151,7 @@ function validateModelReferences(models, issues) {
   };
   for (const id of models.keys()) walk(id, []);
 }
-function validateBundle(project, repositories, agents, models, workflows, environments, options, gateRegistry, projectRoot) {
+function validateBundle(project, repositories, agents, models, workflows, environments, options, gateRegistry, projectRoot, writerRole) {
   const issues = [];
   const entries = valuesOf(project.value, "repositories").map((candidate) => objectValue(candidate)).filter((candidate) => Boolean(candidate));
   const repositoryIds = /* @__PURE__ */ new Set();
@@ -17222,9 +17222,9 @@ function validateBundle(project, repositories, agents, models, workflows, enviro
   if (projectRoot) {
     const writerRolePath = join2(projectRoot, ".kxm", "roles", "writer.yaml");
     const implementerAgent = agents.get("implementer") ?? agents.get("writer");
-    if (existsSync3(writerRolePath) && implementerAgent) {
+    if ((writerRole !== void 0 || existsSync3(writerRolePath)) && implementerAgent) {
       try {
-        const rawRole = parseRestrictedYaml2(readFileSync(writerRolePath, "utf8"));
+        const rawRole = parseRestrictedYaml2(writerRole ?? readFileSync(writerRolePath, "utf8"));
         const roleObj = objectValue(rawRole);
         const rosterEntries = valuesOf(roleObj ?? {}, "roster").map((candidate) => objectValue(candidate)).filter((entry) => Boolean(entry));
         const enabledRosterModels = rosterEntries.filter((entry) => entry.enabled !== false).map((entry) => stringValue(entry.model)).filter((m) => Boolean(m));
@@ -17290,7 +17290,9 @@ function assertNoRegisteredGates(options) {
 function loadKxmProject(projectRoot, options = {}) {
   return loadProjectBundle(projectRoot, options);
 }
-function loadProjectBundle(projectRoot, options, workflowCandidate) {
+function loadProjectBundle(projectRoot, options, candidate) {
+  const workflowCandidate = candidate?.kind === "workflow" ? candidate : void 0;
+  const writerRole = candidate?.kind === "role" && candidate.id.toLocaleLowerCase("en-US") === "writer" ? candidate.document : void 0;
   assertNoRegisteredGates(options);
   const root = resolve(projectRoot);
   const legacyPresent = legacyConfigFilesAt(root);
@@ -17313,7 +17315,7 @@ function loadProjectBundle(projectRoot, options, workflowCandidate) {
       earlyIssues.push(issue2("semantic", "template_provenance_project_mismatch", ".kxm/template-provenance.yaml", "template provenance belongs to a different project identity"));
     }
   }
-  const declaredRepositoryIds = new Set(valuesOf(project.value, "repositories").map((candidate) => stringValue(objectValue(candidate)?.id)).filter((candidate) => candidate !== void 0));
+  const declaredRepositoryIds = new Set(valuesOf(project.value, "repositories").map((candidate2) => stringValue(objectValue(candidate2)?.id)).filter((candidate2) => candidate2 !== void 0));
   for (const repositoryId of Object.keys(options.repositoryBindings ?? {}).sort(compareCodeUnits3)) {
     if (!resourceIdentifier(repositoryId)) {
       earlyIssues.push(issue2("path", "repository_binding_id_invalid", ".kxm/project.yaml", `host-local binding identity ${repositoryId} is invalid`));
@@ -17329,7 +17331,7 @@ function loadProjectBundle(projectRoot, options, workflowCandidate) {
     const { id, document } = workflowCandidate;
     const logicalPath = `.kxm/workflows/${id}.yaml`;
     if (!resourceIdentifier(id)) fail2("path", "resource_id_invalid", logicalPath, `filename-derived identity ${id} is invalid or platform-reserved`);
-    const collision = [...workflows.keys()].find((candidate) => candidate.toLocaleLowerCase("en-US") === id.toLocaleLowerCase("en-US"));
+    const collision = [...workflows.keys()].find((candidate2) => candidate2.toLocaleLowerCase("en-US") === id.toLocaleLowerCase("en-US"));
     if (collision) fail2("path", "resource_id_collision", logicalPath, `${id} case-folds to existing ${collision}`);
     workflows.set(id, { kind: "workflow", id, file: join2(root, logicalPath), logicalPath, value: resourceValue(registry, document, logicalPath, "workflow") });
   }
@@ -17348,8 +17350,8 @@ function loadProjectBundle(projectRoot, options, workflowCandidate) {
     }
   }
   const seenBindings = /* @__PURE__ */ new Map();
-  for (const candidate of valuesOf(project.value, "repositories")) {
-    const entry = objectValue(candidate);
+  for (const candidate2 of valuesOf(project.value, "repositories")) {
+    const entry = objectValue(candidate2);
     const repositoryId = entry && stringValue(entry.id);
     const pathHint = entry && stringValue(entry.pathHint);
     const role = entry && stringValue(entry.role);
@@ -17446,7 +17448,7 @@ function loadProjectBundle(projectRoot, options, workflowCandidate) {
     }
   }
   if (loadIssues.length > 0) throw new KxmConfigError(loadIssues);
-  const issues = validateBundle(project, repositories, agents, models, workflows, environments, options, gateRegistry, root);
+  const issues = validateBundle(project, repositories, agents, models, workflows, environments, options, gateRegistry, root, writerRole);
   if (issues.length > 0) throw new KxmConfigError(issues);
   const resources = [project, ...repositories.values(), ...agents.values(), ...models.values(), ...workflows.values(), ...environments, ...gateRegistry ? [gateRegistry] : []].sort((left, right) => compareCodeUnits3(left.logicalPath, right.logicalPath));
   return {

package/plugins/kxm/dist/runtime.js

@@ -17321,7 +17321,7 @@ function validateModelReferences(models, issues) {
   };
   for (const id of models.keys()) walk(id, []);
 }
-function validateBundle(project, repositories, agents, models, workflows, environments, options, gateRegistry, projectRoot) {
+function validateBundle(project, repositories, agents, models, workflows, environments, options, gateRegistry, projectRoot, writerRole) {
   const issues = [];
   const entries = valuesOf(project.value, "repositories").map((candidate) => objectValue(candidate)).filter((candidate) => Boolean(candidate));
   const repositoryIds = /* @__PURE__ */ new Set();
@@ -17392,9 +17392,9 @@ function validateBundle(project, repositories, agents, models, workflows, enviro
   if (projectRoot) {
     const writerRolePath = join2(projectRoot, ".kxm", "roles", "writer.yaml");
     const implementerAgent = agents.get("implementer") ?? agents.get("writer");
-    if (existsSync3(writerRolePath) && implementerAgent) {
+    if ((writerRole !== void 0 || existsSync3(writerRolePath)) && implementerAgent) {
       try {
-        const rawRole = parseRestrictedYaml2(readFileSync(writerRolePath, "utf8"));
+        const rawRole = parseRestrictedYaml2(writerRole ?? readFileSync(writerRolePath, "utf8"));
         const roleObj = objectValue(rawRole);
         const rosterEntries = valuesOf(roleObj ?? {}, "roster").map((candidate) => objectValue(candidate)).filter((entry) => Boolean(entry));
         const enabledRosterModels = rosterEntries.filter((entry) => entry.enabled !== false).map((entry) => stringValue(entry.model)).filter((m) => Boolean(m));
@@ -17460,7 +17460,9 @@ function assertNoRegisteredGates(options) {
 function loadKxmProject(projectRoot, options = {}) {
   return loadProjectBundle(projectRoot, options);
 }
-function loadProjectBundle(projectRoot, options, workflowCandidate) {
+function loadProjectBundle(projectRoot, options, candidate) {
+  const workflowCandidate = candidate?.kind === "workflow" ? candidate : void 0;
+  const writerRole = candidate?.kind === "role" && candidate.id.toLocaleLowerCase("en-US") === "writer" ? candidate.document : void 0;
   assertNoRegisteredGates(options);
   const root = resolve(projectRoot);
   const legacyPresent = legacyConfigFilesAt(root);
@@ -17483,7 +17485,7 @@ function loadProjectBundle(projectRoot, options, workflowCandidate) {
       earlyIssues.push(issue2("semantic", "template_provenance_project_mismatch", ".kxm/template-provenance.yaml", "template provenance belongs to a different project identity"));
     }
   }
-  const declaredRepositoryIds = new Set(valuesOf(project.value, "repositories").map((candidate) => stringValue(objectValue(candidate)?.id)).filter((candidate) => candidate !== void 0));
+  const declaredRepositoryIds = new Set(valuesOf(project.value, "repositories").map((candidate2) => stringValue(objectValue(candidate2)?.id)).filter((candidate2) => candidate2 !== void 0));
   for (const repositoryId of Object.keys(options.repositoryBindings ?? {}).sort(compareCodeUnits3)) {
     if (!resourceIdentifier(repositoryId)) {
       earlyIssues.push(issue2("path", "repository_binding_id_invalid", ".kxm/project.yaml", `host-local binding identity ${repositoryId} is invalid`));
@@ -17499,7 +17501,7 @@ function loadProjectBundle(projectRoot, options, workflowCandidate) {
     const { id, document } = workflowCandidate;
     const logicalPath = `.kxm/workflows/${id}.yaml`;
     if (!resourceIdentifier(id)) fail2("path", "resource_id_invalid", logicalPath, `filename-derived identity ${id} is invalid or platform-reserved`);
-    const collision = [...workflows.keys()].find((candidate) => candidate.toLocaleLowerCase("en-US") === id.toLocaleLowerCase("en-US"));
+    const collision = [...workflows.keys()].find((candidate2) => candidate2.toLocaleLowerCase("en-US") === id.toLocaleLowerCase("en-US"));
     if (collision) fail2("path", "resource_id_collision", logicalPath, `${id} case-folds to existing ${collision}`);
     workflows.set(id, { kind: "workflow", id, file: join2(root, logicalPath), logicalPath, value: resourceValue(registry, document, logicalPath, "workflow") });
   }
@@ -17518,8 +17520,8 @@ function loadProjectBundle(projectRoot, options, workflowCandidate) {
     }
   }
   const seenBindings = /* @__PURE__ */ new Map();
-  for (const candidate of valuesOf(project.value, "repositories")) {
-    const entry = objectValue(candidate);
+  for (const candidate2 of valuesOf(project.value, "repositories")) {
+    const entry = objectValue(candidate2);
     const repositoryId = entry && stringValue(entry.id);
     const pathHint = entry && stringValue(entry.pathHint);
     const role = entry && stringValue(entry.role);
@@ -17616,7 +17618,7 @@ function loadProjectBundle(projectRoot, options, workflowCandidate) {
     }
   }
   if (loadIssues.length > 0) throw new KxmConfigError(loadIssues);
-  const issues = validateBundle(project, repositories, agents, models, workflows, environments, options, gateRegistry, root);
+  const issues = validateBundle(project, repositories, agents, models, workflows, environments, options, gateRegistry, root, writerRole);
   if (issues.length > 0) throw new KxmConfigError(issues);
   const resources = [project, ...repositories.values(), ...agents.values(), ...models.values(), ...workflows.values(), ...environments, ...gateRegistry ? [gateRegistry] : []].sort((left, right) => compareCodeUnits3(left.logicalPath, right.logicalPath));
   return {

package/plugins/kxm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-plugin",
-  "version": "0.7.105",
+  "version": "0.7.107",
   "private": true,
   "type": "module",
   "engines": {

package/plugins/kxm/src/cli/roles.ts

@@ -15,9 +15,10 @@ import {
   loadRoleHostsConfig,
   setRoleSeatHost,
   resolveRoleSeat,
+  parseRoleFile,
   type KxmRoleDefinition,
 } from "../role.ts";
-import { discoverKxmProjectRoot } from "../project-config.ts";
+import { discoverKxmProjectRoot, kxmRoleWriteIssues } from "../project-config.ts";
 import { ensureKxmSupervisor, kxmRuntimeRequest } from "../runtime-supervisor.ts";
 import { projectRuntimeOwnsRun } from "../runtime-store.ts";
 import { resumeWorkflowFromRuling, type WorkflowRun } from "../workflow.ts";
@@ -156,6 +157,7 @@ export async function cmdRoleAdd(
   },
 ): Promise<number> {
   const scope = options.scope ?? "local";
+  let base: KxmRoleDefinition | undefined;
   if (!roleId || options.pick) {
     const candidates: PickCandidate[] = Object.values(DEFAULT_ROLES).map((r) => ({
       id: r.id,
@@ -166,8 +168,10 @@ export async function cmdRoleAdd(
     if (scope === "local") {
       const globalRoles = listRoles({ scope: "global", userConfigDir: runtime.env.KXM_USER_CONFIG_DIR });
       for (const gr of globalRoles) {
-        if (!candidates.some((c) => c.id === gr.id)) {
-          candidates.push({ id: gr.id, description: gr.description, label: "global", payload: gr });
+        // The listing is a summary; the copy needs the definition, read from the listed file (it may be `.yml`).
+        const definition = parseRoleFile(gr.filePath);
+        if (definition && !candidates.some((c) => c.id === gr.id)) {
+          candidates.push({ id: gr.id, description: gr.description, label: "global", payload: definition });
         }
       }
     }
@@ -179,63 +183,66 @@ export async function cmdRoleAdd(
       }
     } else {
       roleId = picked.id;
-      if (!options.file && picked.payload && DEFAULT_ROLES[picked.id]) {
-        const base = DEFAULT_ROLES[picked.id]!;
-        const roleDef: KxmRoleDefinition = {
-          ...base,
-          description: options.description || base.description,
-          skills: options.skills ? options.skills.split(",").map((s) => s.trim()).filter(Boolean) : base.skills,
-          roster: options.model ? [{ harness: options.harness ?? "pi", model: options.model }] : base.roster,
-        };
-        try {
-          const res = addRole(roleDef, {
-            scope,
-            repoRoot: runtime.cwd,
-            userConfigDir: runtime.env.KXM_USER_CONFIG_DIR,
-            overwrite: options.overwrite,
-            dryRun: runtime.dryRun,
-          });
-          if (runtime.dryRun) {
-            printPlan(runtime, { command: "role add", roleId, ...res }, [{ action: "write", target: res.filePath }], `add role '${roleId}' to ${res.scope}`);
-            return 0;
-          }
-          print(
-            runtime.io,
-            runtime.json,
-            { ok: true, command: "role add", roleId, ...res },
-            `Added role '${roleId}' to ${res.scope} (${res.filePath})\n`,
-          );
-          return 0;
-        } catch (err: unknown) {
-          runtime.io.stderr(`role add failed: ${(err as Error).message}\n`);
-          return 1;
-        }
-      }
+      base = picked.payload as KxmRoleDefinition;
     }
   }
 
+  const skills = options.skills ? options.skills.split(",").map((s) => s.trim()).filter(Boolean) : undefined;
+  const roster = options.model ? [{ harness: options.harness ?? "pi", model: options.model }] : undefined;
   let roleDef: KxmRoleDefinition;
   if (options.file) {
     const filePath = resolve(runtime.cwd, options.file);
     const content = readFileSync(filePath, "utf8");
     roleDef = parseYaml(content) as KxmRoleDefinition;
     roleDef.id = roleId!;
+  } else if (base) {
+    roleDef = {
+      ...base,
+      description: options.description || base.description,
+      skills: skills ?? base.skills,
+      roster: roster ?? base.roster,
+    };
   } else {
-    const skills = options.skills ? options.skills.split(",").map((s) => s.trim()).filter(Boolean) : [];
-    const roster = options.model ? [{ harness: options.harness ?? "pi", model: options.model }] : [];
     roleDef = {
       schema: "kxm.role.v1",
       id: roleId!,
       description: options.description || `Role ${roleId}`,
-      skills,
-      roster,
+      skills: skills ?? [],
+      roster: roster ?? [],
     };
   }
 
+  // A local role file sits in the project the loader reads, and the loader refuses the
+  // whole project over a writer roster it rejects, so the role is checked before it lands.
+  let repoRoot = runtime.cwd;
+  if (scope === "local") {
+    const projectRoot = discoverKxmProjectRoot(runtime.cwd);
+    if (!projectRoot) {
+      print(
+        runtime.io,
+        runtime.json,
+        { ok: false, command: "role add", error: "project_not_found" },
+        "role add failed: local roles belong to a KXM project; run kxm init at the repository root, or pass --scope global",
+      );
+      return 2;
+    }
+    const issues = kxmRoleWriteIssues(projectRoot, roleDef.id, stringifyYaml(roleDef));
+    if (issues.length > 0) {
+      print(
+        runtime.io,
+        runtime.json,
+        { ok: false, command: "role add", error: "role_invalid", issues },
+        `role add failed: with this role the project would not load, so nothing was written\n${issues.map((entry) => `  ${entry.file}: ${entry.code}: ${entry.message}`).join("\n")}`,
+      );
+      return 2;
+    }
+    repoRoot = projectRoot;
+  }
+
   try {
     const res = addRole(roleDef, {
       scope,
-      repoRoot: runtime.cwd,
+      repoRoot,
       userConfigDir: runtime.env.KXM_USER_CONFIG_DIR,
       overwrite: options.overwrite,
       dryRun: runtime.dryRun,

package/plugins/kxm/src/mcp-server.ts

@@ -11,7 +11,7 @@ import { deliverInboxNotification } from "./inbox.ts";
 import type { HubEvent, MessageRecord } from "./protocol.ts";
 import { sessionTokenFixHint } from "./session-token-hint.ts";
 
-const VERSION = "0.7.105";
+const VERSION = "0.7.107";
 const CONFIGURE_PLUGIN = "/plugin configure kxm@kxm";
 const inbox = new Map<string, MessageRecord>();
 const notifiedInbox = new Set<string>();

package/plugins/kxm/src/project-config.ts

@@ -1124,6 +1124,7 @@ function validateBundle(
   options: KxmConfigOptions,
   gateRegistry?: KxmResource,
   projectRoot?: string,
+  writerRole?: string,
 ): KxmConfigIssue[] {
   const issues: KxmConfigIssue[] = [];
   const entries = valuesOf(project.value, "repositories").map((candidate) => objectValue(candidate)).filter((candidate): candidate is JsonObject => Boolean(candidate));
@@ -1200,9 +1201,9 @@ function validateBundle(
   if (projectRoot) {
     const writerRolePath = join(projectRoot, ".kxm", "roles", "writer.yaml");
     const implementerAgent = agents.get("implementer") ?? agents.get("writer");
-    if (existsSync(writerRolePath) && implementerAgent) {
+    if ((writerRole !== undefined || existsSync(writerRolePath)) && implementerAgent) {
       try {
-        const rawRole = parseRestrictedYaml(readFileSync(writerRolePath, "utf8"));
+        const rawRole = parseRestrictedYaml(writerRole ?? readFileSync(writerRolePath, "utf8"));
         const roleObj = objectValue(rawRole);
         const rosterEntries = valuesOf(roleObj ?? {}, "roster")
           .map((candidate) => objectValue(candidate))
@@ -1304,8 +1305,32 @@ export function kxmWorkflowWriteIssues(
   document: string,
   options: KxmConfigOptions = {},
 ): readonly KxmConfigIssue[] {
+  return candidateIssues(projectRoot, options, { kind: "workflow", id: workflowId, document });
+}
+
+/**
+ * What `loadKxmProject` would refuse once `.kxm/roles/<roleId>.yaml` held `document`,
+ * found without writing it. The loader reads only the writer role, so for any other
+ * id this is the project's load as it stands.
+ */
+export function kxmRoleWriteIssues(
+  projectRoot: string,
+  roleId: string,
+  document: string,
+  options: KxmConfigOptions = {},
+): readonly KxmConfigIssue[] {
+  return candidateIssues(projectRoot, options, { kind: "role", id: roleId, document });
+}
+
+interface WriteCandidate {
+  kind: "workflow" | "role";
+  id: string;
+  document: string;
+}
+
+function candidateIssues(projectRoot: string, options: KxmConfigOptions, candidate: WriteCandidate): readonly KxmConfigIssue[] {
   try {
-    loadProjectBundle(projectRoot, options, { id: workflowId, document });
+    loadProjectBundle(projectRoot, options, candidate);
     return [];
   } catch (error) {
     if (error instanceof KxmConfigError) return error.issues;
@@ -1316,8 +1341,11 @@ export function kxmWorkflowWriteIssues(
 function loadProjectBundle(
   projectRoot: string,
   options: KxmConfigOptions,
-  workflowCandidate?: { id: string; document: string },
+  candidate?: WriteCandidate,
 ): KxmProjectBundle {
+  const workflowCandidate = candidate?.kind === "workflow" ? candidate : undefined;
+  // A case-insensitive filesystem serves `Writer.yaml` to the loader's `writer.yaml` lookup.
+  const writerRole = candidate?.kind === "role" && candidate.id.toLocaleLowerCase("en-US") === "writer" ? candidate.document : undefined;
   assertNoRegisteredGates(options);
   const root = resolve(projectRoot);
   const legacyPresent = legacyConfigFilesAt(root);
@@ -1484,7 +1512,7 @@ function loadProjectBundle(
   }
   if (loadIssues.length > 0) throw new KxmConfigError(loadIssues);
 
-  const issues = validateBundle(project, repositories, agents, models, workflows, environments, options, gateRegistry, root);
+  const issues = validateBundle(project, repositories, agents, models, workflows, environments, options, gateRegistry, root, writerRole);
   if (issues.length > 0) throw new KxmConfigError(issues);
   const resources = [project, ...repositories.values(), ...agents.values(), ...models.values(), ...workflows.values(), ...environments, ...(gateRegistry ? [gateRegistry] : [])]
     .sort((left, right) => compareCodeUnits(left.logicalPath, right.logicalPath));