@open-agent-toolkit/cli 0.1.46 → 0.1.50

package/dist/config/oat-config.js

@@ -1,9 +1,11 @@
 import { execSync } from 'node:child_process';
-import { readFile } from 'node:fs/promises';
+import { lstat, readFile } from 'node:fs/promises';
 import { basename, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { atomicWriteJson, dirExists, fileExists } from '../fs/io.js';
-import { normalizeToPosixPath } from '../fs/paths.js';
+import { normalizeToPosixPath, validateRealPathWithinScope } from '../fs/paths.js';
+import { normalizeDispatchMatrix, } from './dispatch-matrix.js';
 import { parseJsonConfig } from './json.js';
+export { VALID_DISPATCH_MATRIX_TIERS, isCodexMaterializedRouteTarget, isWorkflowDispatchCandidateLadder, isWorkflowDispatchFallbackRoute, toWorkflowDispatchCandidateLadder, validateDispatchRouteTarget, } from './dispatch-matrix.js';
 const VALID_HILL_CHECKPOINT_DEFAULTS = ['every', 'final'];
 const VALID_POST_IMPLEMENT_SEQUENCES = ['wait', 'summary', 'pr', 'docs-pr'];
 const VALID_REVIEW_EXECUTION_MODELS = [
@@ -16,12 +18,11 @@ const VALID_DESIGN_MODES = [
     'selective',
     'draft',
 ];
-export const VALID_CODEX_DISPATCH_CEILINGS = ['low', 'medium', 'high', 'xhigh'];
+export const VALID_CODEX_DISPATCH_CEILINGS = ['low', 'medium', 'high', 'xhigh', 'max'];
 export const VALID_CLAUDE_DISPATCH_CEILINGS = ['haiku', 'sonnet', 'opus', 'fable'];
 export const VALID_DISPATCH_CEILING_PRESETS = ['balanced', 'maximum', 'cost-conscious'];
 export const VALID_DISPATCH_POLICY_MODES = ['managed', 'inherit'];
 export const VALID_MANAGED_DISPATCH_POLICIES = ['economy', 'balanced', 'high', 'frontier', 'uncapped'];
-export const VALID_DISPATCH_MATRIX_TIERS = ['economy', 'balanced', 'high', 'frontier'];
 const VALID_GATE_ON_FAILURES = [
     'block',
     'prompt',
@@ -31,6 +32,10 @@ export const BUILTIN_EXEC_TARGETS = {
     'codex-default': {
         runtime: 'codex',
         baseCommand: ['codex', 'exec'],
+        invocation: {
+            model: 'provider-default',
+            reasoningEffort: 'provider-default',
+        },
         hostDetectionCommand: [
             'sh',
             '-c',
@@ -42,6 +47,10 @@ export const BUILTIN_EXEC_TARGETS = {
     'claude-default': {
         runtime: 'claude',
         baseCommand: ['claude', '-p'],
+        invocation: {
+            model: 'provider-default',
+            reasoningEffort: 'provider-default',
+        },
         hostDetectionCommand: ['sh', '-c', 'test -n "$CLAUDECODE"'],
         availabilityCommand: ['claude', '--version'],
         priority: 100,
@@ -49,6 +58,10 @@ export const BUILTIN_EXEC_TARGETS = {
     'cursor-default': {
         runtime: 'cursor',
         baseCommand: ['cursor-agent', '-p'],
+        invocation: {
+            model: 'provider-default',
+            reasoningEffort: 'provider-default',
+        },
         hostDetectionCommand: ['sh', '-c', 'test -n "$CURSOR_AGENT"'],
         availabilityCommand: [
             'sh',
@@ -58,21 +71,6 @@ export const BUILTIN_EXEC_TARGETS = {
         priority: 70,
     },
 };
-export function isCodexMaterializedRouteTarget(provider, target) {
-    return (target.harness ?? provider) === 'codex';
-}
-export function validateDispatchRouteTarget(provider, target) {
-    if (!isCodexMaterializedRouteTarget(provider, target)) {
-        return { valid: true };
-    }
-    if (!target.model || !target.effort) {
-        return {
-            valid: false,
-            reason: 'Codex materialized dispatch targets must provide both model and effort.',
-        };
-    }
-    return { valid: true };
-}
 function normalizeMaxAttempts(value) {
     if (typeof value !== 'number' || !Number.isFinite(value)) {
         return 2;
@@ -124,82 +122,6 @@ function normalizeGateConfig(value) {
     }
     return gate;
 }
-function normalizeProviderBareValue(providerKey, value) {
-    const trimmed = trimNonEmptyString(value);
-    if (trimmed === undefined) {
-        return undefined;
-    }
-    if (providerKey === 'codex' &&
-        !VALID_CODEX_DISPATCH_CEILINGS.includes(trimmed)) {
-        return undefined;
-    }
-    if (providerKey === 'claude' &&
-        !VALID_CLAUDE_DISPATCH_CEILINGS.includes(trimmed)) {
-        return undefined;
-    }
-    return trimmed;
-}
-function normalizeDispatchRouteTarget(value) {
-    if (!isRecord(value)) {
-        return undefined;
-    }
-    const target = {};
-    const harness = trimNonEmptyString(value.harness);
-    if (harness !== undefined) {
-        target.harness = harness;
-    }
-    const model = trimNonEmptyString(value.model);
-    if (model !== undefined) {
-        target.model = model;
-    }
-    const effort = trimNonEmptyString(value.effort);
-    if (effort !== undefined) {
-        target.effort = effort;
-    }
-    return Object.keys(target).length > 0 ? target : undefined;
-}
-function normalizeDispatchMatrixCell(providerKey, value) {
-    const bareValue = normalizeProviderBareValue(providerKey, value);
-    if (bareValue !== undefined) {
-        return bareValue;
-    }
-    if (!Array.isArray(value) || value.length === 0) {
-        return undefined;
-    }
-    const route = [];
-    for (const entry of value) {
-        const bareEntry = normalizeProviderBareValue(providerKey, entry);
-        if (bareEntry !== undefined) {
-            route.push(bareEntry);
-            continue;
-        }
-        const target = normalizeDispatchRouteTarget(entry);
-        if (target !== undefined) {
-            route.push(target);
-        }
-    }
-    return route.length > 0 ? route : undefined;
-}
-function normalizeDispatchProviderValue(providerKey, value) {
-    const bareValue = normalizeProviderBareValue(providerKey, value);
-    if (bareValue !== undefined) {
-        return bareValue;
-    }
-    if (!isRecord(value)) {
-        return undefined;
-    }
-    const tierMap = {};
-    for (const [tier, rawCell] of Object.entries(value)) {
-        if (!VALID_DISPATCH_MATRIX_TIERS.includes(tier)) {
-            continue;
-        }
-        const normalized = normalizeDispatchMatrixCell(providerKey, rawCell);
-        if (normalized !== undefined) {
-            tierMap[tier] = normalized;
-        }
-    }
-    return Object.keys(tierMap).length > 0 ? tierMap : undefined;
-}
 function normalizeExecTarget(value) {
     if (value === null) {
         return null;
@@ -216,6 +138,16 @@ function normalizeExecTarget(value) {
     if (baseCommand !== undefined) {
         target.baseCommand = baseCommand;
     }
+    if (isRecord(value.invocation)) {
+        const model = trimNonEmptyString(value.invocation.model);
+        const reasoningEffort = trimNonEmptyString(value.invocation.reasoningEffort);
+        if (model !== undefined || reasoningEffort !== undefined) {
+            target.invocation = {
+                ...(model !== undefined ? { model } : {}),
+                ...(reasoningEffort !== undefined ? { reasoningEffort } : {}),
+            };
+        }
+    }
     const models = normalizeStringList(value.models);
     if (models !== undefined) {
         target.models = models;
@@ -328,15 +260,12 @@ function normalizeWorkflowConfig(parsed) {
             dispatchCeiling.recommendationVersion = recommendationVersion;
         }
         if (isRecord(parsed.dispatchCeiling.providers)) {
-            const providers = {};
-            for (const [providerKey, rawProviderValue] of Object.entries(parsed.dispatchCeiling.providers)) {
-                const normalized = normalizeDispatchProviderValue(providerKey, rawProviderValue);
-                if (normalized !== undefined) {
-                    providers[providerKey] = normalized;
-                }
-            }
-            if (Object.keys(providers).length > 0) {
-                dispatchCeiling.providers = providers;
+            const normalized = normalizeDispatchMatrix(parsed.dispatchCeiling.providers, {
+                pathPrefix: 'workflow.dispatchCeiling.providers',
+                compatibilityMode: 'layered-config',
+            });
+            if (Object.keys(normalized.providers).length > 0) {
+                dispatchCeiling.providers = normalized.providers;
             }
         }
         if (Object.keys(dispatchCeiling).length > 0) {
@@ -405,7 +334,7 @@ function normalizeKnownStrays(value) {
         .filter((pathValue) => pathValue !== undefined);
     return normalized.length > 0 ? [...new Set(normalized)].sort() : undefined;
 }
-function normalizeProjectPath(repoRoot, pathValue) {
+export function normalizeProjectPath(repoRoot, pathValue) {
     if (pathValue == null) {
         return null;
     }
@@ -413,25 +342,42 @@ function normalizeProjectPath(repoRoot, pathValue) {
     if (!trimmed) {
         return null;
     }
-    if (!isAbsolute(trimmed)) {
-        const normalizedRelative = trimPathValue(normalizeToPosixPath(trimmed));
-        return normalizedRelative && normalizedRelative !== '.'
-            ? normalizedRelative
-            : null;
-    }
     const repoRootResolved = resolve(repoRoot);
-    const absoluteResolved = resolve(trimmed);
-    const isInsideRepo = absoluteResolved === repoRootResolved ||
-        absoluteResolved.startsWith(`${repoRootResolved}${sep}`);
+    const absoluteResolved = resolve(repoRootResolved, trimmed);
+    const relativePath = relative(repoRootResolved, absoluteResolved);
+    const isInsideRepo = !isAbsolute(relativePath) &&
+        relativePath !== '..' &&
+        !relativePath.startsWith(`..${sep}`);
     if (!isInsideRepo) {
         return null;
     }
-    const relativePath = normalizeToPosixPath(relative(repoRootResolved, absoluteResolved));
-    const normalizedRelative = trimPathValue(relativePath);
+    const normalizedRelative = trimPathValue(normalizeToPosixPath(relativePath));
     return normalizedRelative && normalizedRelative !== '.'
         ? normalizedRelative
         : null;
 }
+async function normalizeReadableProjectPath(repoRoot, pathValue) {
+    const normalizedPath = normalizeProjectPath(repoRoot, pathValue);
+    if (!normalizedPath) {
+        return null;
+    }
+    const absolutePath = join(repoRoot, normalizedPath);
+    try {
+        await lstat(absolutePath);
+    }
+    catch (error) {
+        return isMissingFileError(error) ? normalizedPath : null;
+    }
+    try {
+        const validated = await validateRealPathWithinScope(absolutePath, repoRoot);
+        return (await dirExists(validated.realPath))
+            ? normalizeProjectPath(validated.realScopeRoot, validated.realPath)
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
 function normalizeOatConfig(parsed) {
     const next = { ...DEFAULT_OAT_CONFIG };
     if (!isRecord(parsed)) {
@@ -598,7 +544,11 @@ export async function readOatLocalConfig(repoRoot) {
     const configPath = getLocalConfigPath(repoRoot);
     try {
         const raw = await readFile(configPath, 'utf8');
-        return normalizeOatLocalConfig(repoRoot, parseJsonConfig(raw, configPath));
+        const normalized = normalizeOatLocalConfig(repoRoot, parseJsonConfig(raw, configPath));
+        if (normalized.activeProject !== undefined) {
+            normalized.activeProject = await normalizeReadableProjectPath(repoRoot, normalized.activeProject);
+        }
+        return normalized;
     }
     catch (error) {
         if (isMissingFileError(error)) {
@@ -623,12 +573,29 @@ export async function resolveActiveProject(repoRoot) {
     if (!projectPath) {
         return { name: null, path: null, status: 'unset' };
     }
-    const absoluteProjectPath = join(repoRoot, projectPath);
+    let resolvedProjectPath = projectPath;
+    let absoluteProjectPath = join(repoRoot, projectPath);
+    try {
+        const validated = await validateRealPathWithinScope(absoluteProjectPath, repoRoot);
+        const canonicalProjectPath = normalizeProjectPath(validated.realScopeRoot, validated.realPath);
+        if (!canonicalProjectPath) {
+            throw new Error('Project path resolves to the repository root.');
+        }
+        resolvedProjectPath = canonicalProjectPath;
+        absoluteProjectPath = validated.realPath;
+    }
+    catch {
+        return {
+            name: basename(absoluteProjectPath),
+            path: projectPath,
+            status: 'missing',
+        };
+    }
     const statePath = join(absoluteProjectPath, 'state.md');
     const isValid = (await dirExists(absoluteProjectPath)) && (await fileExists(statePath));
     return {
         name: basename(absoluteProjectPath),
-        path: projectPath,
+        path: resolvedProjectPath,
         status: isValid ? 'active' : 'missing',
     };
 }
@@ -637,10 +604,22 @@ export async function setActiveProject(repoRoot, projectRelativePath) {
     if (!normalizedPath) {
         throw new Error(`Active project path must be repo-relative or inside repo root: ${projectRelativePath}`);
     }
+    let canonicalPath;
+    try {
+        const validated = await validateRealPathWithinScope(join(repoRoot, normalizedPath), repoRoot);
+        const canonicalProjectPath = normalizeProjectPath(validated.realScopeRoot, validated.realPath);
+        if (!canonicalProjectPath || !(await dirExists(validated.realPath))) {
+            throw new Error('Project directory is missing.');
+        }
+        canonicalPath = canonicalProjectPath;
+    }
+    catch {
+        throw new Error(`Active project path must be repo-relative or inside repo root: ${projectRelativePath}`);
+    }
     const localConfig = await readOatLocalConfig(repoRoot);
     await writeOatLocalConfig(repoRoot, {
         ...localConfig,
-        activeProject: normalizedPath,
+        activeProject: canonicalPath,
     });
 }
 export async function clearActiveProject(repoRoot, options) {

package/dist/config/resolve.d.ts

@@ -18,4 +18,12 @@ export interface ResolveEffectiveConfigDependencies {
 export declare function resolveEffectiveConfig(repoRoot: string, userConfigDir: string, env?: NodeJS.ProcessEnv, overrides?: Partial<ResolveEffectiveConfigDependencies>): Promise<ResolvedConfig>;
 export declare function resolveGate(effective: ResolvedConfig, skillName: string): GateConfig | null;
 export declare function resolveExecTargets(effective: ResolvedConfig): Record<string, ExecTarget>;
+export type ExecTargetOrigin = 'builtin' | 'user' | 'shared' | 'local';
+export interface ResolvedExecTargetView {
+    target: ExecTarget;
+    origin: ExecTargetOrigin;
+    explicitlyConfigured: boolean;
+    enabled: boolean;
+}
+export declare function resolveExecTargetViews(effective: ResolvedConfig): Record<string, ResolvedExecTargetView>;
 //# sourceMappingURL=resolve.d.ts.map

package/dist/config/resolve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/config/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,KAAK,UAAU,EAChB,MAAM,cAAc,CAAC;AAEtB,MAAM,MAAM,oBAAoB,GAC5B,QAAQ,GACR,OAAO,GACP,MAAM,GACN,KAAK,GACL,SAAS,CAAC;AAEd,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,oBAAoB,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,SAAS,CAAC;IAClB,KAAK,EAAE,cAAc,CAAC;IACtB,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,kCAAkC;IACjD,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,kBAAkB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAClE,cAAc,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;CAChE;AAmFD,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,SAAS,GAAE,OAAO,CAAC,kCAAkC,CAAM,GAC1D,OAAO,CAAC,cAAc,CAAC,CAgFzB;AAED,wBAAgB,WAAW,CACzB,SAAS,EAAE,cAAc,EACzB,SAAS,EAAE,MAAM,GAChB,UAAU,GAAG,IAAI,CAcnB;AAED,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,cAAc,GACxB,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAY5B"}
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/config/resolve.ts"],"names":[],"mappings":"AACA,OAAO,EAKL,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,KAAK,UAAU,EAChB,MAAM,cAAc,CAAC;AAEtB,MAAM,MAAM,oBAAoB,GAC5B,QAAQ,GACR,OAAO,GACP,MAAM,GACN,KAAK,GACL,SAAS,CAAC;AAEd,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,oBAAoB,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,SAAS,CAAC;IAClB,KAAK,EAAE,cAAc,CAAC;IACtB,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,kCAAkC;IACjD,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,kBAAkB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAClE,cAAc,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;CAChE;AAmFD,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,SAAS,GAAE,OAAO,CAAC,kCAAkC,CAAM,GAC1D,OAAO,CAAC,cAAc,CAAC,CAgFzB;AAED,wBAAgB,WAAW,CACzB,SAAS,EAAE,cAAc,EACzB,SAAS,EAAE,MAAM,GAChB,UAAU,GAAG,IAAI,CAcnB;AAED,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,cAAc,GACxB,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAY5B;AAED,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEvE,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,gBAAgB,CAAC;IACzB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,cAAc,GACxB,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAoDxC"}

package/dist/config/resolve.js

@@ -1,3 +1,4 @@
+import { isWorkflowDispatchCandidateLadder } from './dispatch-matrix.js';
 import { BUILTIN_EXEC_TARGETS, readOatConfig, readOatLocalConfig, readUserConfig, } from './oat-config.js';
 const DEFAULT_DEPENDENCIES = {
     readOatConfig,
@@ -167,6 +168,53 @@ export function resolveExecTargets(effective) {
     }
     return targets;
 }
+export function resolveExecTargetViews(effective) {
+    const targets = cloneExecTargetRegistry(BUILTIN_EXEC_TARGETS);
+    const views = Object.fromEntries(Object.entries(targets).map(([id, target]) => [
+        id,
+        {
+            target: cloneExecTarget(target),
+            origin: 'builtin',
+            explicitlyConfigured: false,
+            enabled: true,
+        },
+    ]));
+    for (const [origin, layer] of [
+        ['user', effective.user.workflow?.gates?.execTargets],
+        ['shared', effective.shared.workflow?.gates?.execTargets],
+        ['local', effective.local.workflow?.gates?.execTargets],
+    ]) {
+        if (!layer) {
+            continue;
+        }
+        for (const [id, override] of Object.entries(layer)) {
+            if (override === null) {
+                const target = targets[id] ?? views[id]?.target;
+                delete targets[id];
+                if (target) {
+                    views[id] = {
+                        target: cloneExecTarget(target),
+                        origin,
+                        explicitlyConfigured: true,
+                        enabled: false,
+                    };
+                }
+                continue;
+            }
+            mergeExecTargetLayer(targets, { [id]: override });
+            const target = targets[id];
+            if (target) {
+                views[id] = {
+                    target: cloneExecTarget(target),
+                    origin,
+                    explicitlyConfigured: true,
+                    enabled: true,
+                };
+            }
+        }
+    }
+    return views;
+}
 function mergeExecTargetLayer(targets, layer) {
     if (!layer) {
         return;
@@ -181,6 +229,7 @@ function mergeExecTargetLayer(targets, layer) {
             targets[id] = cloneExecTarget({
                 runtime: override.runtime ?? existing.runtime,
                 baseCommand: override.baseCommand ?? existing.baseCommand,
+                invocation: mergeExecTargetInvocation(existing.invocation, override.invocation),
                 models: override.models ?? existing.models,
                 hostDetectionCommand: override.hostDetectionCommand ?? existing.hostDetectionCommand,
                 availabilityCommand: override.availabilityCommand ?? existing.availabilityCommand,
@@ -209,6 +258,9 @@ function cloneExecTarget(target) {
     if (target.hostDetectionCommand) {
         next.hostDetectionCommand = [...target.hostDetectionCommand];
     }
+    if (target.invocation) {
+        next.invocation = { ...target.invocation };
+    }
     if (target.availabilityCommand) {
         next.availabilityCommand = [...target.availabilityCommand];
     }
@@ -229,6 +281,9 @@ function toCompleteExecTarget(target) {
             ? target.priority
             : 0,
     };
+    if (target.invocation) {
+        completeTarget.invocation = { ...target.invocation };
+    }
     if (isValidArgv(target.hostDetectionCommand)) {
         completeTarget.hostDetectionCommand = [...target.hostDetectionCommand];
     }
@@ -240,6 +295,15 @@ function toCompleteExecTarget(target) {
     }
     return completeTarget;
 }
+function mergeExecTargetInvocation(existing, override) {
+    if (!existing && !override) {
+        return undefined;
+    }
+    return {
+        ...existing,
+        ...override,
+    };
+}
 function isValidStringList(value) {
     return (Array.isArray(value) &&
         value.length > 0 &&
@@ -264,7 +328,8 @@ function flattenConfig(value, prefix = '') {
             continue;
         }
         const nextKey = prefix ? `${prefix}.${key}` : key;
-        if (isRecord(nestedValue)) {
+        if (isRecord(nestedValue) &&
+            !isWorkflowDispatchCandidateLadder(nestedValue)) {
             Object.assign(flattened, flattenConfig(nestedValue, nextKey));
             continue;
         }

package/dist/engine/index.d.ts

@@ -5,5 +5,5 @@ export { configureLocalHooksPath, getHookInstallInfo, HOOK_DRIFT_WARNING, HOOK_M
 export type { HookInstallInfo, HookStatus } from './hook.js';
 export { hasMarker, insertMarker, OAT_DIRECTORY_SENTINEL, OAT_MARKER_PREFIX, writeDirectorySentinel, } from './markers.js';
 export type { CanonicalEntry } from './scanner.js';
-export { scanCanonical } from './scanner.js';
+export { scanBundledManagedCodexAgents, scanCanonical } from './scanner.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/engine/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/engine/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,UAAU,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,YAAY,EACZ,aAAa,GACd,MAAM,QAAQ,CAAC;AAChB,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EACL,SAAS,EACT,YAAY,EACZ,sBAAsB,EACtB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/engine/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,UAAU,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,YAAY,EACZ,aAAa,GACd,MAAM,QAAQ,CAAC;AAChB,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EACL,SAAS,EACT,YAAY,EACZ,sBAAsB,EACtB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,6BAA6B,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC"}

package/dist/engine/index.js

@@ -3,4 +3,4 @@ export { SYNC_OPERATION_TYPES, } from './engine.types.js';
 export { executeSyncPlan } from './execute-plan.js';
 export { configureLocalHooksPath, getHookInstallInfo, HOOK_DRIFT_WARNING, HOOK_MARKER_END, HOOK_MARKER_START, HOOK_STRAY_INFO, installHook, isHookInstalled, REPO_GITHOOKS_PATH, runHookCheck, uninstallHook, } from './hook.js';
 export { hasMarker, insertMarker, OAT_DIRECTORY_SENTINEL, OAT_MARKER_PREFIX, writeDirectorySentinel, } from './markers.js';
-export { scanCanonical } from './scanner.js';
+export { scanBundledManagedCodexAgents, scanCanonical } from './scanner.js';

package/dist/engine/scanner.d.ts

@@ -6,6 +6,7 @@ export interface CanonicalEntry {
     canonicalPath: string;
     isFile: boolean;
 }
+export declare function scanBundledManagedCodexAgents(): Promise<CanonicalEntry[]>;
 export declare function scanCanonical(basePath: string, scope: ConcreteScope): Promise<CanonicalEntry[]>;
 export {};
 //# sourceMappingURL=scanner.d.ts.map

package/dist/engine/scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../src/engine/scanner.ts"],"names":[],"mappings":"AAIA,OAAO,EAAuB,KAAK,KAAK,EAAE,MAAM,eAAe,CAAC;AAEhE,KAAK,aAAa,GAAG,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAE3C,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,CAAC;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;CACjB;AA0DD,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,cAAc,EAAE,CAAC,CA2B3B"}
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../src/engine/scanner.ts"],"names":[],"mappings":"AAKA,OAAO,EAGL,KAAK,KAAK,EACX,MAAM,eAAe,CAAC;AAEvB,KAAK,aAAa,GAAG,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAE3C,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,CAAC;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;CACjB;AA0DD,wBAAsB,6BAA6B,IAAI,OAAO,CAC5D,cAAc,EAAE,CACjB,CAsBA;AAED,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,cAAc,EAAE,CAAC,CA2B3B"}

package/dist/engine/scanner.js

@@ -1,7 +1,8 @@
 import { readdir } from 'node:fs/promises';
 import { join, resolve } from 'node:path';
 import { CliError } from '../errors/index.js';
-import { SCOPE_CONTENT_TYPES } from '../shared/types.js';
+import { resolveAssetsRoot } from '../fs/assets.js';
+import { SCOPE_CONTENT_TYPES, USER_SCOPE_MANAGED_AGENT_FILES, } from '../shared/types.js';
 function canonicalDirectoryName(contentType) {
     if (contentType === 'skill') {
         return 'skills';
@@ -42,6 +43,21 @@ async function readEntries(dirPath) {
         throw error;
     }
 }
+export async function scanBundledManagedCodexAgents() {
+    const agentsDir = join(await resolveAssetsRoot(), 'agents');
+    const entries = await readEntries(agentsDir);
+    const available = new Set(entries.filter((entry) => entry.isFile).map((entry) => entry.name));
+    const missing = USER_SCOPE_MANAGED_AGENT_FILES.filter((name) => !available.has(name));
+    if (missing.length > 0) {
+        throw new CliError(`Bundled managed Codex role definitions are unavailable: ${missing.join(', ')}. Reinstall or rebuild OAT before running user sync.`);
+    }
+    return USER_SCOPE_MANAGED_AGENT_FILES.map((name) => ({
+        name,
+        type: 'agent',
+        canonicalPath: join(agentsDir, name),
+        isFile: true,
+    }));
+}
 export async function scanCanonical(basePath, scope) {
     const scopeRoot = resolve(basePath);
     const entries = [];

package/dist/fs/paths.d.ts

@@ -5,5 +5,9 @@ export declare function resolveScopeRoot(scope: ConcreteScope, cwd: string, home
 export declare function toPosixPath(pathValue: string): string;
 export declare function normalizeToPosixPath(pathValue: string): string;
 export declare function validatePathWithinScope(candidatePath: string, scopeRoot: string): string;
+export declare function validateRealPathWithinScope(candidatePath: string, scopeRoot: string): Promise<{
+    realScopeRoot: string;
+    realPath: string;
+}>;
 export {};
 //# sourceMappingURL=paths.d.ts.map

package/dist/fs/paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/fs/paths.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAE3C,KAAK,aAAa,GAAG,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAE3C,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBrE;AAED,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,aAAa,EACpB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,GACX,MAAM,CAMR;AAED,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,wBAAgB,uBAAuB,CACrC,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,GAChB,MAAM,CAcR"}
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/fs/paths.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAE3C,KAAK,aAAa,GAAG,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAE3C,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBrE;AAED,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,aAAa,EACpB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,GACX,MAAM,CAMR;AAED,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,wBAAgB,uBAAuB,CACrC,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,GAChB,MAAM,CAcR;AAED,wBAAsB,2BAA2B,CAC/C,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAsBtD"}

package/dist/fs/paths.js

@@ -1,4 +1,4 @@
-import { access } from 'node:fs/promises';
+import { access, realpath } from 'node:fs/promises';
 import { dirname, posix, resolve, sep } from 'node:path';
 import { CliError } from '../errors/index.js';
 export async function resolveProjectRoot(cwd) {
@@ -40,3 +40,20 @@ export function validatePathWithinScope(candidatePath, scopeRoot) {
     }
     return resolvedCandidatePath;
 }
+export async function validateRealPathWithinScope(candidatePath, scopeRoot) {
+    const resolvedCandidatePath = validatePathWithinScope(candidatePath, scopeRoot);
+    let realScopeRoot;
+    let realCandidatePath;
+    try {
+        [realScopeRoot, realCandidatePath] = await Promise.all([
+            realpath(resolve(scopeRoot)),
+            realpath(resolvedCandidatePath),
+        ]);
+    }
+    catch (error) {
+        const detail = error instanceof Error ? `: ${error.message}` : '';
+        throw new CliError(`Unable to resolve real path for ${candidatePath} within scope root ${scopeRoot}${detail}`);
+    }
+    validatePathWithinScope(realCandidatePath, realScopeRoot);
+    return { realScopeRoot, realPath: realCandidatePath };
+}

package/dist/providers/ceiling/registry.d.ts

@@ -27,6 +27,7 @@ export type CeilingDispatchArgs = {
 } | {
     model: string;
 } | null;
+export declare function isDirectDispatchRoleName(value: string): boolean;
 export interface ProviderCeilingAdapter {
     provider: string;
     supportsCeiling: boolean;

package/dist/providers/ceiling/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/providers/ceiling/registry.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,oBAAoB,GAAG,gBAAgB,GAAG,WAAW,GAAG,MAAM,CAAC;AAE3E,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,UAAU,CAAC;AAErD,MAAM,WAAW,qBAAqB;IACpC,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE;QACP,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,IAAI,CAAC;CACV;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GACnB;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GACjB,IAAI,CAAC;AAET,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,EAAE,oBAAoB,CAAC;IAChC;;;OAGG;IACH,qBAAqB,CACnB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,WAAW,EACjB,GAAG,EAAE,qBAAqB,GACzB,mBAAmB,CAAC;IACvB;;;;OAIG;IACH,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,qBAAqB,GAAG,OAAO,CAAC;CACtE;AAMD,wEAAwE;AACxE,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAK9C,CAAC;AAqGF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,sBAAsB,CAE1E"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/providers/ceiling/registry.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,oBAAoB,GAAG,gBAAgB,GAAG,WAAW,GAAG,MAAM,CAAC;AAE3E,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,UAAU,CAAC;AAErD,MAAM,WAAW,qBAAqB;IACpC,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE;QACP,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,IAAI,CAAC;CACV;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GACnB;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GACjB,IAAI,CAAC;AAKT,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,EAAE,oBAAoB,CAAC;IAChC;;;OAGG;IACH,qBAAqB,CACnB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,WAAW,EACjB,GAAG,EAAE,qBAAqB,GACzB,mBAAmB,CAAC;IACvB;;;;OAIG;IACH,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,qBAAqB,GAAG,OAAO,CAAC;CACtE;AAMD,wEAAwE;AACxE,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAK9C,CAAC;AA4GF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,sBAAsB,CAE1E"}

package/dist/providers/ceiling/registry.js

@@ -1,5 +1,9 @@
 import { VALID_CLAUDE_DISPATCH_CEILINGS, VALID_CODEX_DISPATCH_CEILINGS, } from '../../config/oat-config.js';
-import { buildCodexMaterializedRoleName } from '../codex/codec/materialize.js';
+import { buildCodexMaterializedTargetRoleName } from '../codex/codec/shared.js';
+const DIRECT_DISPATCH_ROLE_PATTERN = /^oat-(?:phase-implementer|reviewer)(?:-|$)/;
+export function isDirectDispatchRoleName(value) {
+    return DIRECT_DISPATCH_ROLE_PATTERN.test(value.trim());
+}
 /** Codex materialized-role base names (must match sync-extension output). */
 const CODEX_IMPLEMENTER_ROLE = 'oat-phase-implementer';
 const CODEX_REVIEWER_ROLE = 'oat-reviewer';
@@ -20,12 +24,14 @@ const codexAdapter = {
             return null;
         }
         const target = ctx.target;
-        if (!target?.model || !target.effort) {
+        if (!target?.model ||
+            !target.effort ||
+            isDirectDispatchRoleName(target.model)) {
             return null;
         }
         const baseRole = role === 'reviewer' ? CODEX_REVIEWER_ROLE : CODEX_IMPLEMENTER_ROLE;
         return {
-            variant: buildCodexMaterializedRoleName({
+            variant: buildCodexMaterializedTargetRoleName({
                 agentName: baseRole,
                 model: target.model,
                 effort: target.effort,
@@ -55,7 +61,8 @@ const claudeAdapter = {
     validValues: [...VALID_CLAUDE_DISPATCH_CEILINGS],
     mechanism: 'model-arg',
     compileToDispatchArgs(value) {
-        if (!VALID_CLAUDE_DISPATCH_CEILINGS.includes(value)) {
+        if (isDirectDispatchRoleName(value) ||
+            !VALID_CLAUDE_DISPATCH_CEILINGS.includes(value)) {
             return null;
         }
         return { model: value };
@@ -72,7 +79,7 @@ const cursorAdapter = {
     mechanism: 'model-arg',
     compileToDispatchArgs(value) {
         const model = value.trim();
-        return model ? { model } : null;
+        return model && !isDirectDispatchRoleName(model) ? { model } : null;
     },
     // Cursor model slugs do not share a total order, so upgrade verification is
     // not meaningful here; availability is checked by the identity oracle layer.

package/dist/providers/codex/codec/catalog.d.ts

@@ -0,0 +1,14 @@
+export { SUPPORTED_CODEX_ROLE_TARGETS } from './shared.js';
+export declare const SUPPORTED_CODEX_BASE_ROLES: readonly ["oat-phase-implementer", "oat-reviewer"];
+export interface SupportedCodexRoleCatalogueEntry {
+    baseRole: (typeof SUPPORTED_CODEX_BASE_ROLES)[number];
+    model: string;
+    effort: string;
+    roleName: string;
+}
+export declare function isSupportedCodexRoleTarget(target: {
+    model: string;
+    effort: string;
+}): boolean;
+export declare function expandSupportedCodexRoleCatalogue(): SupportedCodexRoleCatalogueEntry[];
+//# sourceMappingURL=catalog.d.ts.map

package/dist/providers/codex/codec/catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../../../src/providers/codex/codec/catalog.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,4BAA4B,EAAE,MAAM,UAAU,CAAC;AAExD,eAAO,MAAM,0BAA0B,oDAG7B,CAAC;AAEX,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,EAAE,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAKV;AAED,wBAAgB,iCAAiC,IAAI,gCAAgC,EAAE,CAYtF"}