@open-agent-toolkit/cli 0.1.46 → 0.1.48

package/dist/providers/codex/codec/sync-extension.js

@@ -2,19 +2,19 @@ import { createHash } from 'node:crypto';
 import { readdir, readFile, rm, writeFile } from 'node:fs/promises';
 import { basename, dirname, join, relative, resolve } from 'node:path';
 import { parseCanonicalAgentFile } from '../../../agents/canonical/index.js';
-import { isCodexMaterializedRouteTarget, resolveActiveProject, validateDispatchRouteTarget, } from '../../../config/oat-config.js';
+import { isCodexMaterializedRouteTarget, isWorkflowDispatchCandidateLadder, isWorkflowDispatchFallbackRoute, normalizeProjectPath, resolveActiveProject, validateDispatchRouteTarget, } from '../../../config/oat-config.js';
 import { resolveEffectiveConfig } from '../../../config/resolve.js';
+import { CliError } from '../../../errors/index.js';
 import { ensureDir, fileExists } from '../../../fs/io.js';
+import { validateRealPathWithinScope } from '../../../fs/paths.js';
 import TOML from '@iarna/toml';
 import YAML from 'yaml';
+import { SUPPORTED_CODEX_BASE_ROLES, SUPPORTED_CODEX_ROLE_TARGETS, } from './catalog.js';
 import { mergeCodexConfig } from './config-merge.js';
 import { exportCanonicalAgentToCodexRole } from './export-to-codex.js';
 import { materializeCodexRole } from './materialize.js';
-import { isOatManagedCodexRoleFile } from './shared.js';
-const CODEX_MATERIALIZED_BASE_ROLES = new Set([
-    'oat-phase-implementer',
-    'oat-reviewer',
-]);
+import { isOatManagedCodexRoleFile, readOatManagedCodexRoleOwner, withOatManagedCodexRoleOwner, } from './shared.js';
+const CODEX_MATERIALIZED_BASE_ROLES = new Set(SUPPORTED_CODEX_BASE_ROLES);
 function hashContent(content) {
     return createHash('sha256').update(content).digest('hex');
 }
@@ -74,14 +74,22 @@ async function desiredRolesFromCanonical(canonicalEntries, scopeRoot, materializ
                     description: materialized.description,
                     configFile: materialized.configFile,
                     rolePath: join(scopeRoot, '.codex', materialized.configFile),
-                    content: materialized.content,
+                    content: withOatManagedCodexRoleOwner(materialized.content, target.owner),
                 });
             }
         }
     }
+    const roleContents = new Map();
+    for (const role of roles) {
+        const existing = roleContents.get(role.roleName);
+        if (existing !== undefined && existing !== role.content) {
+            throw new CliError(`Distinct Codex targets produced the same role name ${role.roleName}. Refusing ambiguous role writes.`);
+        }
+        roleContents.set(role.roleName, role.content);
+    }
     return roles.sort((left, right) => left.roleName.localeCompare(right.roleName));
 }
-function collectCodexTargetFromEntry(entry, targets) {
+function collectCodexTargetFromEntry(entry, targets, owner) {
     if (typeof entry === 'string') {
         return;
     }
@@ -92,26 +100,42 @@ function collectCodexTargetFromEntry(entry, targets) {
     if (!validation.valid || !entry.model || !entry.effort) {
         return;
     }
-    targets.set(`${entry.model}\0${entry.effort}`, {
-        model: entry.model,
-        effort: entry.effort,
-    });
+    const key = `${entry.model}\0${entry.effort}`;
+    if (!targets.has(key)) {
+        targets.set(key, {
+            model: entry.model,
+            effort: entry.effort,
+            owner,
+        });
+    }
 }
-function collectCodexTargetsFromCell(cell, targets) {
+function collectCodexTargetsFromCell(cell, targets, owner) {
     if (typeof cell === 'string') {
         return;
     }
+    if (isWorkflowDispatchCandidateLadder(cell)) {
+        for (const candidate of cell.candidates) {
+            if (isWorkflowDispatchFallbackRoute(candidate)) {
+                for (const entry of candidate.route) {
+                    collectCodexTargetFromEntry(entry, targets, owner);
+                }
+                continue;
+            }
+            collectCodexTargetFromEntry(candidate, targets, owner);
+        }
+        return;
+    }
     for (const entry of cell) {
-        collectCodexTargetFromEntry(entry, targets);
+        collectCodexTargetFromEntry(entry, targets, owner);
     }
 }
-function collectCodexMaterializationTargetsFromProvider(providerValue, targets) {
+function collectCodexMaterializationTargetsFromProvider(providerValue, targets, owner) {
     if (providerValue === undefined || typeof providerValue === 'string') {
         return;
     }
     for (const cell of Object.values(providerValue)) {
         if (cell !== undefined) {
-            collectCodexTargetsFromCell(cell, targets);
+            collectCodexTargetsFromCell(cell, targets, owner);
         }
     }
 }
@@ -137,26 +161,54 @@ function routeTargetFromUnknown(value) {
     }
     return Object.keys(target).length > 0 ? target : null;
 }
-function collectCodexTargetsFromUnknownCell(value, targets) {
-    if (typeof value === 'string' || !Array.isArray(value)) {
+function collectCodexTargetsFromUnknownCell(value, targets, owner) {
+    const collectCandidate = (candidate) => {
+        if (!candidate ||
+            typeof candidate !== 'object' ||
+            Array.isArray(candidate)) {
+            return;
+        }
+        const route = candidate['route'];
+        if (Array.isArray(route)) {
+            for (const entry of route) {
+                const target = routeTargetFromUnknown(entry);
+                if (target) {
+                    collectCodexTargetFromEntry(target, targets, owner);
+                }
+            }
+            return;
+        }
+        const target = routeTargetFromUnknown(candidate);
+        if (target) {
+            collectCodexTargetFromEntry(target, targets, owner);
+        }
+    };
+    if (Array.isArray(value)) {
+        for (const entry of value) {
+            collectCandidate(entry);
+        }
+        return;
+    }
+    if (!value || typeof value !== 'object') {
+        return;
+    }
+    const candidates = value['candidates'];
+    if (!Array.isArray(candidates)) {
         return;
     }
-    for (const entry of value) {
+    for (const entry of candidates) {
         if (typeof entry === 'string') {
             continue;
         }
-        const target = routeTargetFromUnknown(entry);
-        if (target) {
-            collectCodexTargetFromEntry(target, targets);
-        }
+        collectCandidate(entry);
     }
 }
-function collectCodexTargetsFromUnknownProvider(value, targets) {
+function collectCodexTargetsFromUnknownProvider(value, targets, owner) {
     if (!value || typeof value !== 'object' || Array.isArray(value)) {
         return;
     }
     for (const cell of Object.values(value)) {
-        collectCodexTargetsFromUnknownCell(cell, targets);
+        collectCodexTargetsFromUnknownCell(cell, targets, owner);
     }
 }
 function frontmatterBlock(content) {
@@ -168,13 +220,31 @@ function frontmatterBlock(content) {
     return end > 0 ? normalized.slice(4, end) : null;
 }
 async function collectProjectStateCodexTargets(scopeRoot, options, targets) {
-    const projectPath = options.projectPath === undefined
+    const projectPathCandidate = options.projectPath === undefined
         ? (await resolveActiveProject(scopeRoot)).path
         : options.projectPath;
+    if (!projectPathCandidate) {
+        return;
+    }
+    const projectPath = normalizeProjectPath(scopeRoot, projectPathCandidate);
     if (!projectPath) {
+        if (options.projectPath !== undefined) {
+            throw new CliError(`Project-scoped Codex materialization path must be repo-relative or inside repo root: ${projectPathCandidate}`);
+        }
+        return;
+    }
+    let realProjectPath;
+    try {
+        const validated = await validateRealPathWithinScope(join(scopeRoot, projectPath), scopeRoot);
+        realProjectPath = validated.realPath;
+    }
+    catch {
+        if (options.projectPath !== undefined) {
+            throw new CliError(`Project-scoped Codex materialization path must be repo-relative or inside repo root: ${projectPathCandidate}`);
+        }
         return;
     }
-    const statePath = join(resolve(scopeRoot, projectPath), 'state.md');
+    const statePath = join(realProjectPath, 'state.md');
     const stateContent = await readOptionalFile(statePath);
     if (!stateContent) {
         return;
@@ -195,17 +265,32 @@ async function collectProjectStateCodexTargets(scopeRoot, options, targets) {
     if (!matrix || typeof matrix !== 'object' || Array.isArray(matrix)) {
         return;
     }
-    collectCodexTargetsFromUnknownProvider(matrix['codex'], targets);
+    collectCodexTargetsFromUnknownProvider(matrix['codex'], targets, 'project-config');
+}
+function isUserCodexScope(scopeRoot, options) {
+    if (!options.userConfigDir) {
+        return false;
+    }
+    return resolve(scopeRoot) === resolve(options.userConfigDir, '..');
 }
 async function readCodexMaterializationTargets(scopeRoot, options = {}) {
     const targets = new Map();
     const effectiveConfig = await resolveEffectiveConfig(scopeRoot, options.userConfigDir ?? join(scopeRoot, '.oat', '__no-user-config__'), options.env);
+    if (isUserCodexScope(scopeRoot, options)) {
+        collectCodexMaterializationTargetsFromProvider(effectiveConfig.user.workflow?.dispatchCeiling?.providers?.codex, targets, 'user-config');
+        return sortCodexMaterializationTargets(targets);
+    }
+    for (const target of SUPPORTED_CODEX_ROLE_TARGETS) {
+        targets.set(`${target.model}\0${target.effort}`, {
+            ...target,
+            owner: 'supported-catalogue',
+        });
+    }
     for (const providerValue of [
-        effectiveConfig.user.workflow?.dispatchCeiling?.providers?.codex,
         effectiveConfig.shared.workflow?.dispatchCeiling?.providers?.codex,
         effectiveConfig.local.workflow?.dispatchCeiling?.providers?.codex,
     ]) {
-        collectCodexMaterializationTargetsFromProvider(providerValue, targets);
+        collectCodexMaterializationTargetsFromProvider(providerValue, targets, 'project-config');
     }
     await collectProjectStateCodexTargets(scopeRoot, options, targets);
     return sortCodexMaterializationTargets(targets);
@@ -235,7 +320,7 @@ function parseConfigAgentTable(content) {
         return {};
     }
 }
-async function collectStaleManagedRoles(scopeRoot, existingConfigContent, desiredRoleNames) {
+async function collectStaleManagedRoles(scopeRoot, existingConfigContent, desiredRoleNames, cleanupOwner, removeLegacyProjectRoles) {
     const agents = parseConfigAgentTable(existingConfigContent);
     const stale = new Set();
     for (const [roleName, roleConfig] of Object.entries(agents)) {
@@ -251,6 +336,13 @@ async function collectStaleManagedRoles(scopeRoot, existingConfigContent, desire
         if (!roleContent || !isOatManagedCodexRoleFile(roleContent, roleName)) {
             continue;
         }
+        const owner = readOatManagedCodexRoleOwner(roleContent);
+        const legacyProjectRole = removeLegacyProjectRoles &&
+            owner === null &&
+            SUPPORTED_CODEX_BASE_ROLES.some((baseRole) => roleName.startsWith(`${baseRole}-`));
+        if (owner !== cleanupOwner && !legacyProjectRole) {
+            continue;
+        }
         stale.add(roleName);
     }
     const agentsDir = join(scopeRoot, '.codex', 'agents');
@@ -274,6 +366,13 @@ async function collectStaleManagedRoles(scopeRoot, existingConfigContent, desire
         if (!roleContent || !isOatManagedCodexRoleFile(roleContent, roleName)) {
             continue;
         }
+        const owner = readOatManagedCodexRoleOwner(roleContent);
+        const legacyProjectRole = removeLegacyProjectRoles &&
+            owner === null &&
+            SUPPORTED_CODEX_BASE_ROLES.some((baseRole) => roleName.startsWith(`${baseRole}-`));
+        if (owner !== cleanupOwner && !legacyProjectRole) {
+            continue;
+        }
         stale.add(roleName);
     }
     return [...stale].sort((left, right) => left.localeCompare(right));
@@ -281,13 +380,24 @@ async function collectStaleManagedRoles(scopeRoot, existingConfigContent, desire
 export async function computeCodexProjectExtensionPlan(scopeRoot, canonicalEntries, allowedCanonicalPaths, options = {}) {
     const isPartialSync = allowedCanonicalPaths !== undefined && allowedCanonicalPaths.length > 0;
     const materializationTargets = await readCodexMaterializationTargets(scopeRoot, options);
+    if (!isPartialSync &&
+        isUserCodexScope(scopeRoot, options) &&
+        materializationTargets.length > 0) {
+        const canonicalBaseRoles = new Set(canonicalEntries
+            .filter((entry) => entry.type === 'agent' && entry.isFile)
+            .map((entry) => entry.name.replace(/\.md$/i, '')));
+        const missingBaseRoles = SUPPORTED_CODEX_BASE_ROLES.filter((role) => !canonicalBaseRoles.has(role));
+        if (missingBaseRoles.length > 0) {
+            throw new CliError(`Bundled managed Codex role definitions are unavailable for user sync: ${missingBaseRoles.join(', ')}. Refusing stale user-role cleanup.`);
+        }
+    }
     const desiredRoles = await desiredRolesFromCanonical(canonicalEntries.filter((entry) => canonicalPathAllowed(scopeRoot, entry, allowedCanonicalPaths)), scopeRoot, materializationTargets);
     const desiredRoleNames = new Set(desiredRoles.map((role) => role.roleName));
     const existingConfigPath = configPath(scopeRoot);
     const existingConfigContent = await readOptionalFile(existingConfigPath);
     const staleRoles = isPartialSync
         ? []
-        : await collectStaleManagedRoles(scopeRoot, existingConfigContent, desiredRoleNames);
+        : await collectStaleManagedRoles(scopeRoot, existingConfigContent, desiredRoleNames, isUserCodexScope(scopeRoot, options) ? 'user-config' : 'project-config', !isUserCodexScope(scopeRoot, options));
     if (isPartialSync && desiredRoles.length === 0) {
         return {
             operations: [],

package/dist/providers/identity/stamp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stamp.d.ts","sourceRoot":"","sources":["../../../src/providers/identity/stamp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,KAAK,GAAG,QAAQ,CAAC;AACjE,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,KAAK,GAAG,UAAU,CAAC;AAE9D,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,cAAc,CAAC;IACvB,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAc,SAAQ,mBAAmB;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,cAAc,CAAC;IACvB,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,0BAA0B;IACzC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC;AAyDD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,CAiBvE;AAqGD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,0BAA+B,GACvC,aAAa,EAAE,CAqBjB;AAED,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,0BAA+B,GACvC,MAAM,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAepC"}
+{"version":3,"file":"stamp.d.ts","sourceRoot":"","sources":["../../../src/providers/identity/stamp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAEvD,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,KAAK,GAAG,QAAQ,CAAC;AACjE,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,KAAK,GAAG,UAAU,CAAC;AAE9D,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,cAAc,CAAC;IACvB,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAc,SAAQ,mBAAmB;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,cAAc,CAAC;IACvB,IAAI,EAAE,YAAY,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,0BAA0B;IACzC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC;AAyDD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,CAiBvE;AA6GD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,0BAA+B,GACvC,aAAa,EAAE,CAqBjB;AAED,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,0BAA+B,GACvC,MAAM,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAepC"}

package/dist/providers/identity/stamp.js

@@ -90,6 +90,10 @@ function parseModernStamp(line, lineNumber, fields, options) {
         warn(options, lineNumber, 'missing or invalid role');
         return undefined;
     }
+    if (role !== inferRole(action)) {
+        warn(options, lineNumber, `incompatible action/role pair ${action}/${role}`);
+        return undefined;
+    }
     const scope = singleToken(fields.get('scope'), '');
     if (!scope) {
         warn(options, lineNumber, 'missing scope');

package/dist/shared/types.d.ts

@@ -7,4 +7,5 @@ export declare const ScopeSchema: z.ZodEnum<["project", "user", "all"]>;
 export type Scope = z.infer<typeof ScopeSchema>;
 export type ConcreteScope = Exclude<Scope, 'all'>;
 export declare const SCOPE_CONTENT_TYPES: Record<Scope, ContentType[]>;
+export declare const USER_SCOPE_MANAGED_AGENT_FILES: readonly ["oat-phase-implementer.md", "oat-reviewer.md"];
 //# sourceMappingURL=types.d.ts.map

package/dist/shared/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/shared/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,iBAAiB,uCAAqC,CAAC;AACpE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,kBAAkB,wCAAsC,CAAC;AACtE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,WAAW,uCAAqC,CAAC;AAC9D,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAChD,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAQlD,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,CAI5D,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/shared/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,iBAAiB,uCAAqC,CAAC;AACpE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,kBAAkB,wCAAsC,CAAC;AACtE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,WAAW,uCAAqC,CAAC;AAC9D,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAChD,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAQlD,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,CAI5D,CAAC;AAEF,eAAO,MAAM,8BAA8B,0DAGjC,CAAC"}

package/dist/shared/types.js

@@ -12,3 +12,7 @@ export const SCOPE_CONTENT_TYPES = {
     user: USER_SCOPE_CONTENT_TYPES,
     all: ALL_SCOPE_CONTENT_TYPES,
 };
+export const USER_SCOPE_MANAGED_AGENT_FILES = [
+    'oat-phase-implementer.md',
+    'oat-reviewer.md',
+];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-agent-toolkit/cli",
-  "version": "0.1.46",
+  "version": "0.1.48",
   "private": false,
   "description": "Open Agent Toolkit CLI",
   "homepage": "https://github.com/voxmedia/open-agent-toolkit/tree/main/packages/cli",
@@ -34,7 +34,7 @@
     "ora": "^9.0.0",
     "yaml": "2.8.2",
     "zod": "^3.25.76",
-    "@open-agent-toolkit/control-plane": "0.1.46"
+    "@open-agent-toolkit/control-plane": "0.1.48"
   },
   "devDependencies": {
     "@types/node": "^22.10.0",