@open-agent-toolkit/cli 0.0.58 → 0.0.59

package/assets/docs/cli-utilities/config-and-local-state.md

@@ -60,7 +60,7 @@ Archive lifecycle settings live here as shared repo config:
 - `archive.awsProfile`
 - `archive.awsRegion`
 
-`archive.awsProfile` and `archive.awsRegion` are forwarded as `AWS_PROFILE` / `AWS_REGION` env vars into every `aws` spawn that runs during `oat-project-complete` and `oat project archive sync`. The per-invocation `oat project archive sync --profile <profile>` and `--region <region>` flags override the config for a single run; an `AWS_PROFILE` / `AWS_REGION` already set in the parent shell sits between the flag and the config in precedence (flag > shell env > config). Raw access keys (`AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY`) remain a shell-environment concern — there is no config plumbing for them.
+`archive.awsProfile` and `archive.awsRegion` are forwarded as `AWS_PROFILE` / `AWS_REGION` env vars into every `aws` spawn that runs during `oat-project-complete` and `oat project archive sync`, and they override any values already set in the parent shell — the repo's archive-scoped declaration wins so users don't have to remember to unset `AWS_PROFILE` per shell. The per-invocation `oat project archive sync --profile <profile>` and `--region <region>` flags then override the config for a single run, giving precedence `flag > config > shell env`. When neither flag nor config is set, the parent shell's `AWS_PROFILE` / `AWS_REGION` pass through unchanged. Raw access keys (`AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY`) remain a shell-environment concern — there is no config plumbing for them.
 
 Tool-pack installation state also lives here as shared repo config:
 

package/assets/docs/cli-utilities/configuration.md

@@ -114,18 +114,20 @@ With those values configured:
 - completion also copies `summary.md` into `<archive.summaryExportPath>/20260401-my-project.md`
 - `oat project archive sync` can later pull archive data back down from S3 and materialize the latest snapshot into the local bare archive path `.oat/projects/archived/<project>/`
 - `oat-wrap-up` can write tracked reports into `<archive.wrapUpExportPath>/YYYY-MM-DD-wrap-up-<label>.md`; if the key is unset, the skill uses `.oat/repo/reference/wrap-ups/`
-- every `aws` spawn (preflight `aws sts get-caller-identity`, `aws s3 ls`, `aws s3 sync`) inherits `AWS_PROFILE` / `AWS_REGION` from `archive.awsProfile` / `archive.awsRegion` when the parent shell does not already set them
+- every `aws` spawn (preflight `aws sts get-caller-identity`, `aws s3 ls`, `aws s3 sync`) runs with `AWS_PROFILE` / `AWS_REGION` set from `archive.awsProfile` / `archive.awsRegion` when configured, overriding any value already in the parent shell
 
 ### Credential resolution
 
 Profile and region resolve with the following precedence per `aws` invocation, highest first:
 
 1. CLI flag passed to `oat project archive sync` (`--profile <profile>`, `--region <region>`)
-2. The parent shell's existing `AWS_PROFILE` / `AWS_REGION` env vars
-3. The repo's shared `archive.awsProfile` / `archive.awsRegion` config
+2. The repo's shared `archive.awsProfile` / `archive.awsRegion` config
+3. The parent shell's existing `AWS_PROFILE` / `AWS_REGION` env vars
 
 If none of the three are present for a given var, OAT does not inject it — the AWS CLI's own resolution chain takes over.
 
+`archive.awsProfile` is treated as deliberate, OAT-archive-scoped intent: if the repo declares the identity it wants to archive under, that value wins over whatever profile happens to be in the calling shell. Use `--profile` for one-off overrides; clear `archive.awsProfile` (set it to an empty string) to fall back to shell `AWS_PROFILE`.
+
 The `oat project archive sync` flags only override for that single invocation:
 
 ```bash

package/assets/public-package-versions.json

@@ -1,6 +1,6 @@
 {
-  "cli": "0.0.58",
-  "docs-config": "0.0.58",
-  "docs-theme": "0.0.58",
-  "docs-transforms": "0.0.58"
+  "cli": "0.0.59",
+  "docs-config": "0.0.59",
+  "docs-theme": "0.0.59",
+  "docs-transforms": "0.0.59"
 }

package/dist/commands/project/archive/archive-utils.d.ts

@@ -12,20 +12,17 @@ export interface EnsureS3ArchiveAccessOptions {
     s3Uri?: string | null;
     syncOnComplete: boolean;
     /**
-     * Config-only fallback AWS profile (e.g., `archive.awsProfile`). This helper
-     * applies the value only when the parent env does not already provide
-     * `AWS_PROFILE`, matching discovery decision #3 ("config does not clobber an
-     * explicit shell env"). Callers that override via flags must layer the
-     * override into `dependencies.env` (the helper's second argument) —
-     * `buildAwsEnv` is non-clobbering and will not overwrite a value already
-     * present in the parent env. Passing a flag value through this option alone
-     * is not sufficient.
+     * AWS profile to apply for this archive op (typically resolved from
+     * `archive.awsProfile` config or a `--profile` flag). When non-empty, this
+     * value clobbers any `AWS_PROFILE` already present in the parent env: an
+     * explicit OAT-archive-scoped profile is treated as deliberate intent and
+     * wins over ambient shell state. An empty/unset value leaves the parent env
+     * untouched.
      */
     awsProfile?: string | null;
     /**
-     * Config-only fallback AWS region. Same non-clobbering semantics as
-     * `awsProfile`: flag-style overrides must be layered into
-     * `dependencies.env`, not passed through this option.
+     * AWS region to apply for this archive op. Same clobber-on-explicit-value
+     * semantics as `awsProfile`.
      */
     awsRegion?: string | null;
 }
@@ -47,13 +44,14 @@ export interface ArchiveProjectOnCompletionOptions {
     summaryExportPath?: string | null;
     /**
      * Config-only AWS profile (`archive.awsProfile`). The completion path has no
-     * flag override; this value is forwarded as-is into the env merge, where the
-     * parent env wins if it already supplies `AWS_PROFILE`. Discovery decision #3.
+     * flag override. When non-empty, this value clobbers any parent-env
+     * `AWS_PROFILE` — repo-scoped archive config is treated as deliberate intent
+     * and wins over ambient shell state.
      */
     awsProfile?: string | null;
     /**
-     * Config-only AWS region (`archive.awsRegion`). Same non-clobbering semantics
-     * as `awsProfile`.
+     * Config-only AWS region (`archive.awsRegion`). Same clobber-on-explicit-value
+     * semantics as `awsProfile`.
      */
     awsRegion?: string | null;
 }
@@ -94,23 +92,19 @@ export interface ArchiveSnapshotMetadata {
 /**
  * Build the env passed to every `aws` spawn in this module.
  *
- * Non-clobbering merge: a non-empty value in `opts` is applied only when
- * `parentEnv` does not already provide that key (treating empty/whitespace
- * parent values as unset). If parent env has a non-empty value, it is left
- * untouched even when `opts` supplies a non-empty value. Callers that need
- * flag-style overrides must set the env entry themselves before calling this
- * helper. This matches discovery decision #3 — config does not clobber an
- * explicit shell env.
- *
- * An empty/whitespace value in `opts` is also treated as unset, and we never
- * inject a key when neither source supplies one — so the spawned process sees
- * the same "unset" signal it would have seen without this plumbing.
+ * Clobber-on-explicit-value merge: a non-empty value in `opts` overwrites the
+ * parent env entry. The merge treats an explicitly supplied profile/region as
+ * deliberate OAT-archive-scoped intent that wins over ambient shell state —
+ * setting `archive.awsProfile` (or passing `--profile`) means "use this for
+ * archive ops, regardless of what AWS_PROFILE is in the shell." Empty or
+ * whitespace-only values in `opts` are treated as unset and leave the parent
+ * env entry alone, so the AWS CLI's own resolution chain (incl. shell
+ * AWS_PROFILE) takes over when neither config nor flag has spoken.
  *
  * Exported as a package-internal helper so the archive sync command (which
- * also spawns `aws`) can layer flag/env/config precedence and produce the same
- * env shape without duplicating this logic. This symbol is **not** part of the
- * public package surface — keep usage limited to files inside
- * `commands/project/archive/`.
+ * also spawns `aws`) can produce the same env shape without duplicating this
+ * logic. This symbol is **not** part of the public package surface — keep
+ * usage limited to files inside `commands/project/archive/`.
  */
 export declare function buildAwsEnv(parentEnv: NodeJS.ProcessEnv, opts: {
     awsProfile?: string | null;

package/dist/commands/project/archive/archive-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"archive-utils.d.ts","sourceRoot":"","sources":["../../../../src/commands/project/archive/archive-utils.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,aAAa,EACb,cAAc,EACd,SAAS,EACT,SAAS,EACT,UAAU,EACX,MAAM,QAAQ,CAAC;AAIhB,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,CACzB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,KAChD,OAAO,CAAC,cAAc,CAAC,CAAC;AAE7B,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,YAAY,GAAG,MAAM,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,UAAU,iCAAiC;IACzC,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,kCAAkC;IACjD,WAAW,CAAC,EAAE,YAAY,CAAC;IAC3B,SAAS,CAAC,EAAE,OAAO,SAAS,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED,UAAU,sCACR,SACE,iCAAiC,EACjC,kCAAkC;IACpC,qBAAqB,CAAC,EAAE,OAAO,qBAAqB,CAAC;IACrD,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,SAAS,CAAC,EAAE,OAAO,SAAS,CAAC;IAC7B,aAAa,CAAC,EAAE,OAAO,aAAa,CAAC;IACrC,UAAU,CAAC,EAAE,CACX,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;QAAE,SAAS,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,IAAI,CAAA;KAAE,KACtC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,cAAc,CAAC,EAAE,OAAO,cAAc,CAAC;IACvC,UAAU,CAAC,EAAE,OAAO,UAAU,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,gCAAgC;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,eAAO,MAAM,kCAAkC,6BAA6B,CAAC;AAE7E;;;GAGG;AACH,eAAO,MAAM,wBAAwB,UAAwB,CAAC;AAE9D,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAMD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,CAAC,UAAU,EAC5B,IAAI,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC9D,MAAM,CAAC,UAAU,CAqBnB;AA0BD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,MAAM,CAER;AAmBD,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAChB,MAAM,CAER;AAED,wBAAgB,wBAAwB,CAAC,YAAY,EAAE,MAAM,GAAG;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CA4BA;AAED,wBAAgB,8BAA8B,CAC5C,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,MAAM,CAIR;AA6DD,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,MAAM,EAChB,YAAY,GAAE,kCAAuC,GACpD,OAAO,CAAC,MAAM,CAAC,CAgCjB;AAmED,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,iCAAiC,EAC1C,YAAY,GAAE,sCAA2C,GACxD,OAAO,CAAC,gCAAgC,CAAC,CAgH3C;AAED,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,4BAA4B,EACrC,YAAY,GAAE,iCAAsC,GACnD,OAAO,CAAC,2BAA2B,CAAC,CA+CtC"}
+{"version":3,"file":"archive-utils.d.ts","sourceRoot":"","sources":["../../../../src/commands/project/archive/archive-utils.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,aAAa,EACb,cAAc,EACd,SAAS,EACT,SAAS,EACT,UAAU,EACX,MAAM,QAAQ,CAAC;AAIhB,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,CACzB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,KAChD,OAAO,CAAC,cAAc,CAAC,CAAC;AAE7B,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,YAAY,GAAG,MAAM,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,UAAU,iCAAiC;IACzC,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,kCAAkC;IACjD,WAAW,CAAC,EAAE,YAAY,CAAC;IAC3B,SAAS,CAAC,EAAE,OAAO,SAAS,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED,UAAU,sCACR,SACE,iCAAiC,EACjC,kCAAkC;IACpC,qBAAqB,CAAC,EAAE,OAAO,qBAAqB,CAAC;IACrD,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,SAAS,CAAC,EAAE,OAAO,SAAS,CAAC;IAC7B,aAAa,CAAC,EAAE,OAAO,aAAa,CAAC;IACrC,UAAU,CAAC,EAAE,CACX,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;QAAE,SAAS,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,IAAI,CAAA;KAAE,KACtC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,cAAc,CAAC,EAAE,OAAO,cAAc,CAAC;IACvC,UAAU,CAAC,EAAE,OAAO,UAAU,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,gCAAgC;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,eAAO,MAAM,kCAAkC,6BAA6B,CAAC;AAE7E;;;GAGG;AACH,eAAO,MAAM,wBAAwB,UAAwB,CAAC;AAE9D,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,CAAC,UAAU,EAC5B,IAAI,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC9D,MAAM,CAAC,UAAU,CAgBnB;AA0BD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE7E;AAED,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,MAAM,CAER;AAmBD,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,GAChB,MAAM,CAER;AAED,wBAAgB,wBAAwB,CAAC,YAAY,EAAE,MAAM,GAAG;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CA4BA;AAED,wBAAgB,8BAA8B,CAC5C,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,GAClB,MAAM,CAIR;AA6DD,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,MAAM,EAChB,YAAY,GAAE,kCAAuC,GACpD,OAAO,CAAC,MAAM,CAAC,CAgCjB;AAmED,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,iCAAiC,EAC1C,YAAY,GAAE,sCAA2C,GACxD,OAAO,CAAC,gCAAgC,CAAC,CAgH3C;AAED,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,4BAA4B,EACrC,YAAY,GAAE,iCAAsC,GACnD,OAAO,CAAC,2BAA2B,CAAC,CA+CtC"}

package/dist/commands/project/archive/archive-utils.js

@@ -17,36 +17,28 @@ function normalizeS3Uri(s3Uri) {
 /**
  * Build the env passed to every `aws` spawn in this module.
  *
- * Non-clobbering merge: a non-empty value in `opts` is applied only when
- * `parentEnv` does not already provide that key (treating empty/whitespace
- * parent values as unset). If parent env has a non-empty value, it is left
- * untouched even when `opts` supplies a non-empty value. Callers that need
- * flag-style overrides must set the env entry themselves before calling this
- * helper. This matches discovery decision #3 — config does not clobber an
- * explicit shell env.
- *
- * An empty/whitespace value in `opts` is also treated as unset, and we never
- * inject a key when neither source supplies one — so the spawned process sees
- * the same "unset" signal it would have seen without this plumbing.
+ * Clobber-on-explicit-value merge: a non-empty value in `opts` overwrites the
+ * parent env entry. The merge treats an explicitly supplied profile/region as
+ * deliberate OAT-archive-scoped intent that wins over ambient shell state —
+ * setting `archive.awsProfile` (or passing `--profile`) means "use this for
+ * archive ops, regardless of what AWS_PROFILE is in the shell." Empty or
+ * whitespace-only values in `opts` are treated as unset and leave the parent
+ * env entry alone, so the AWS CLI's own resolution chain (incl. shell
+ * AWS_PROFILE) takes over when neither config nor flag has spoken.
  *
  * Exported as a package-internal helper so the archive sync command (which
- * also spawns `aws`) can layer flag/env/config precedence and produce the same
- * env shape without duplicating this logic. This symbol is **not** part of the
- * public package surface — keep usage limited to files inside
- * `commands/project/archive/`.
+ * also spawns `aws`) can produce the same env shape without duplicating this
+ * logic. This symbol is **not** part of the public package surface — keep
+ * usage limited to files inside `commands/project/archive/`.
  */
 export function buildAwsEnv(parentEnv, opts) {
     const env = { ...parentEnv };
-    const parentHas = (key) => {
-        const value = parentEnv[key];
-        return typeof value === 'string' && value.trim().length > 0;
-    };
     const profile = typeof opts.awsProfile === 'string' ? opts.awsProfile.trim() : '';
-    if (profile.length > 0 && !parentHas('AWS_PROFILE')) {
+    if (profile.length > 0) {
         env.AWS_PROFILE = profile;
     }
     const region = typeof opts.awsRegion === 'string' ? opts.awsRegion.trim() : '';
-    if (region.length > 0 && !parentHas('AWS_REGION')) {
+    if (region.length > 0) {
         env.AWS_REGION = region;
     }
     return env;

package/dist/commands/project/archive/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/project/archive/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAIhD,OAAO,EAAE,mBAAmB,EAAE,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGhF,OAAO,EAAE,KAAK,SAAS,EAAiB,MAAM,oBAAoB,CAAC;AAGnE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAIL,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,KAAK,YAAY,EAEjB,8BAA8B,EAC9B,sBAAsB,EACvB,MAAM,iBAAiB,CAAC;AAsEzB,MAAM,WAAW,iCAAiC;IAChD,mBAAmB,EAAE,CACnB,OAAO,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,CAAC,KAC/C,cAAc,CAAC;IACpB,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,mBAAmB,EAAE,CACnB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,CAAC,UAAU,KACnB,OAAO,CAAC,MAAM,CAAC,CAAC;IACrB,qBAAqB,EAAE,OAAO,qBAAqB,CAAC;IACpD,qBAAqB,EAAE,OAAO,qBAAqB,CAAC;IACpD,wBAAwB,EAAE,OAAO,wBAAwB,CAAC;IAC1D,8BAA8B,EAAE,OAAO,8BAA8B,CAAC;IACtE,sBAAsB,EAAE,OAAO,sBAAsB,CAAC;IACtD,QAAQ,EAAE,YAAY,CAAC;IACvB,eAAe,EAAE,OAAO,EAAE,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;CAC/B;AAoMD,wBAAgB,2BAA2B,CACzC,SAAS,GAAE,OAAO,CAAC,iCAAiC,CAAM,GACzD,OAAO,CA4LT"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/project/archive/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAIhD,OAAO,EAAE,mBAAmB,EAAE,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGhF,OAAO,EAAE,KAAK,SAAS,EAAiB,MAAM,oBAAoB,CAAC;AAGnE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAIL,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,KAAK,YAAY,EAEjB,8BAA8B,EAC9B,sBAAsB,EACvB,MAAM,iBAAiB,CAAC;AA8DzB,MAAM,WAAW,iCAAiC;IAChD,mBAAmB,EAAE,CACnB,OAAO,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,CAAC,KAC/C,cAAc,CAAC;IACpB,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,mBAAmB,EAAE,CACnB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,CAAC,UAAU,KACnB,OAAO,CAAC,MAAM,CAAC,CAAC;IACrB,qBAAqB,EAAE,OAAO,qBAAqB,CAAC;IACpD,qBAAqB,EAAE,OAAO,qBAAqB,CAAC;IACpD,wBAAwB,EAAE,OAAO,wBAAwB,CAAC;IAC1D,8BAA8B,EAAE,OAAO,8BAA8B,CAAC;IACtE,sBAAsB,EAAE,OAAO,sBAAsB,CAAC;IACtD,QAAQ,EAAE,YAAY,CAAC;IACvB,eAAe,EAAE,OAAO,EAAE,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;CAC/B;AAoMD,wBAAgB,2BAA2B,CACzC,SAAS,GAAE,OAAO,CAAC,iCAAiC,CAAM,GACzD,OAAO,CA4LT"}

package/dist/commands/project/archive/index.js

@@ -12,14 +12,19 @@ import { Command } from 'commander';
 import { ARCHIVE_SNAPSHOT_METADATA_FILENAME, S3_ARCHIVE_SYNC_EXCLUDES, buildAwsEnv, buildProjectArchiveS3Uri, buildRepoArchiveS3Uri, ensureS3ArchiveAccess, parseArchiveSnapshotName, resolveLocalArchiveProjectPath, resolvePrimaryRepoRoot, } from './archive-utils.js';
 const execFileAsync = promisify(execFileCallback);
 /**
- * Resolve effective AWS profile/region for an archive sync invocation, honoring
- * the discovery decision #3 precedence: flag > parent shell env > config.
+ * Resolve effective AWS profile/region for an archive sync invocation.
+ *
+ * Precedence (highest first): `--profile`/`--region` flag > `archive.awsProfile`/`archive.awsRegion`
+ * config > parent shell `AWS_PROFILE`/`AWS_REGION` env. Repo config is treated
+ * as deliberate, OAT-archive-scoped intent and wins over ambient shell state —
+ * users who explicitly set `archive.awsProfile` for the repo don't have to
+ * remember to unset `AWS_PROFILE` in every shell. Flag still beats config for
+ * one-off overrides.
  *
  * The returned `env` is suitable for passing into every `aws` spawn in this
- * command. The returned `awsProfile`/`awsRegion` are forwarded to
- * `ensureS3ArchiveAccess` so its non-clobbering merge sees the same source of
- * truth (parent env wins inside the helper, so injecting the flag value into
- * the env up-front is what makes "flag > parent env" hold end-to-end).
+ * command. The returned `awsProfile`/`awsRegion` are also forwarded to
+ * `ensureS3ArchiveAccess` so its preflight `aws sts get-caller-identity` runs
+ * against the same identity.
  */
 function resolveSyncAwsEnv(processEnv, options, config) {
     const flagProfile = typeof options.profile === 'string' && options.profile.trim().length > 0
@@ -28,27 +33,15 @@ function resolveSyncAwsEnv(processEnv, options, config) {
     const flagRegion = typeof options.region === 'string' && options.region.trim().length > 0
         ? options.region.trim()
         : undefined;
-    // Layer the flag onto the parent env BEFORE delegating to buildAwsEnv. The
-    // helper's non-clobbering rule treats parent env as authoritative, so this
-    // is how the flag wins over both parent env and config.
-    const effectiveParent = { ...processEnv };
-    if (flagProfile !== undefined) {
-        effectiveParent.AWS_PROFILE = flagProfile;
-    }
-    if (flagRegion !== undefined) {
-        effectiveParent.AWS_REGION = flagRegion;
-    }
     const configProfile = config.archive?.awsProfile;
     const configRegion = config.archive?.awsRegion;
-    // Forward the same precedence into `awsProfile`/`awsRegion` for downstream
-    // helpers: prefer flag, fall back to config. Parent env is *not* substituted
-    // here because callers will pass the returned `env` (which already has the
-    // flag layered onto a clone of the parent env) as `dependencies.env` to the
-    // helper, so `buildAwsEnv`'s non-clobbering rule preserves "flag > parent
-    // env > config" against `effectiveParent` rather than the raw `process.env`.
+    // Flag beats config; either is forwarded to buildAwsEnv, which clobbers the
+    // parent env entry with the resolved value. When neither flag nor config is
+    // set, awsProfile/awsRegion stay undefined and the parent env passes through
+    // untouched — letting the AWS CLI's own resolution chain take over.
     const awsProfile = flagProfile ?? configProfile ?? undefined;
     const awsRegion = flagRegion ?? configRegion ?? undefined;
-    const env = buildAwsEnv(effectiveParent, {
+    const env = buildAwsEnv(processEnv, {
         awsProfile,
         awsRegion,
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-agent-toolkit/cli",
-  "version": "0.0.58",
+  "version": "0.0.59",
   "private": false,
   "description": "Open Agent Toolkit CLI",
   "homepage": "https://github.com/voxmedia/open-agent-toolkit/tree/main/packages/cli",
@@ -33,7 +33,7 @@
     "ora": "^9.0.0",
     "yaml": "2.8.2",
     "zod": "^3.25.76",
-    "@open-agent-toolkit/control-plane": "0.0.58"
+    "@open-agent-toolkit/control-plane": "0.0.59"
   },
   "devDependencies": {
     "@types/node": "^22.10.0",