@open-agent-toolkit/cli 0.1.46 → 0.1.50

package/dist/providers/codex/codec/catalog.js

@@ -0,0 +1,21 @@
+import { buildCodexMaterializedRoleName } from './materialize.js';
+import { SUPPORTED_CODEX_ROLE_TARGETS } from './shared.js';
+export { SUPPORTED_CODEX_ROLE_TARGETS } from './shared.js';
+export const SUPPORTED_CODEX_BASE_ROLES = [
+    'oat-phase-implementer',
+    'oat-reviewer',
+];
+export function isSupportedCodexRoleTarget(target) {
+    return SUPPORTED_CODEX_ROLE_TARGETS.some((supported) => supported.model === target.model && supported.effort === target.effort);
+}
+export function expandSupportedCodexRoleCatalogue() {
+    return SUPPORTED_CODEX_BASE_ROLES.flatMap((baseRole) => SUPPORTED_CODEX_ROLE_TARGETS.map((target) => ({
+        baseRole,
+        ...target,
+        roleName: buildCodexMaterializedRoleName({
+            agentName: baseRole,
+            model: target.model,
+            effort: target.effort,
+        }),
+    }))).sort((left, right) => left.roleName.localeCompare(right.roleName));
+}

package/dist/providers/codex/codec/materialize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"materialize.d.ts","sourceRoot":"","sources":["../../../../src/providers/codex/codec/materialize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAGhE,OAAO,EACL,KAAK,eAAe,EAErB,MAAM,mBAAmB,CAAC;AAG3B,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,sBAAsB,CAAC;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gCAAgC;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAUD,wBAAgB,8BAA8B,CAAC,EAC7C,SAAS,EACT,KAAK,EACL,MAAM,GACP,EAAE,gCAAgC,GAAG,MAAM,CAa3C;AAWD,wBAAgB,oBAAoB,CAAC,EACnC,KAAK,EACL,KAAK,EACL,MAAM,EACN,QAAQ,GACT,EAAE,2BAA2B,GAAG,eAAe,CA+B/C"}
+{"version":3,"file":"materialize.d.ts","sourceRoot":"","sources":["../../../../src/providers/codex/codec/materialize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAGhE,OAAO,EACL,KAAK,eAAe,EAErB,MAAM,mBAAmB,CAAC;AAM3B,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,sBAAsB,CAAC;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gCAAgC;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAUD,wBAAgB,8BAA8B,CAAC,EAC7C,SAAS,EACT,KAAK,EACL,MAAM,GACP,EAAE,gCAAgC,GAAG,MAAM,CAY3C;AAWD,wBAAgB,oBAAoB,CAAC,EACnC,KAAK,EACL,KAAK,EACL,MAAM,EACN,QAAQ,GACT,EAAE,2BAA2B,GAAG,eAAe,CA+B/C"}

package/dist/providers/codex/codec/materialize.js

@@ -1,6 +1,6 @@
 import { CliError } from '../../../errors/index.js';
 import { exportCanonicalAgentToCodexRole, } from './export-to-codex.js';
-import { normalizeCodexRoleName, sanitizeCodexRoleName } from './shared.js';
+import { buildCodexMaterializedTargetRoleName, sanitizeCodexRoleName, } from './shared.js';
 function requireNonEmpty(value, label) {
     const normalized = value.trim();
     if (!normalized) {
@@ -9,10 +9,11 @@ function requireNonEmpty(value, label) {
     return normalized;
 }
 export function buildCodexMaterializedRoleName({ agentName, model, effort, }) {
-    const normalizedAgentName = sanitizeCodexRoleName(agentName);
-    const normalizedModel = normalizeCodexRoleName(model);
-    const normalizedEffort = normalizeCodexRoleName(effort);
-    const roleName = normalizeCodexRoleName(`${normalizedAgentName}-${normalizedModel}-${normalizedEffort}`);
+    const roleName = buildCodexMaterializedTargetRoleName({
+        agentName,
+        model,
+        effort,
+    });
     if (!roleName) {
         throw new CliError('Cannot materialize Codex role: missing role name.');
     }

package/dist/providers/codex/codec/shared.d.ts

@@ -1,8 +1,27 @@
 export declare const OAT_MANAGED_ROLE_HEADER = "# oat-managed: true";
 export declare const OAT_MANAGED_ROLE_NAME_PREFIX = "# oat-role: ";
+export declare const OAT_MANAGED_ROLE_OWNER_PREFIX = "# oat-owner: ";
+export type CodexRoleOwner = 'supported-catalogue' | 'user-config' | 'project-config';
+export declare const SUPPORTED_CODEX_ROLE_TARGETS: readonly ({
+    model: string;
+    effort: "high" | "medium" | "low" | "xhigh";
+} | {
+    model: string;
+    effort: "high" | "medium" | "low" | "xhigh";
+} | {
+    model: string;
+    effort: string;
+})[];
 export declare function sanitizeCodexRoleName(input: string): string;
 export declare function normalizeCodexRoleName(input: string): string;
+export declare function buildCodexMaterializedTargetRoleName(options: {
+    agentName: string;
+    model: string;
+    effort: string;
+}): string;
 export declare function isOatManagedCodexRoleFile(content: string, roleName?: string): boolean;
 export declare function withOatManagedCodexHeader(roleName: string, tomlBody: string): string;
+export declare function readOatManagedCodexRoleOwner(content: string): CodexRoleOwner | null;
+export declare function withOatManagedCodexRoleOwner(content: string, owner: CodexRoleOwner): string;
 export declare function stringifyToml(object: Record<string, unknown>): string;
 //# sourceMappingURL=shared.d.ts.map

package/dist/providers/codex/codec/shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../../../src/providers/codex/codec/shared.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAC7D,eAAO,MAAM,4BAA4B,iBAAiB,CAAC;AAE3D,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAO5D;AAED,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAUT;AAED,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,MAAM,CAER;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE"}
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../../../src/providers/codex/codec/shared.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAC7D,eAAO,MAAM,4BAA4B,iBAAiB,CAAC;AAC3D,eAAO,MAAM,6BAA6B,kBAAkB,CAAC;AAE7D,MAAM,MAAM,cAAc,GACtB,qBAAqB,GACrB,aAAa,GACb,gBAAgB,CAAC;AAoBrB,eAAO,MAAM,4BAA4B;;;;;;;;;IAa/B,CAAC;AAEX,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAO5D;AAQD,wBAAgB,oCAAoC,CAAC,OAAO,EAAE;IAC5D,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CAiBT;AAgDD,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAOT;AAED,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,MAAM,CAER;AAED,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,MAAM,GACd,cAAc,GAAG,IAAI,CAEvB;AAED,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,cAAc,GACpB,MAAM,CAkBR;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE"}

package/dist/providers/codex/codec/shared.js

@@ -1,6 +1,30 @@
+import { createHash } from 'node:crypto';
 import TOML from '@iarna/toml';
 export const OAT_MANAGED_ROLE_HEADER = '# oat-managed: true';
 export const OAT_MANAGED_ROLE_NAME_PREFIX = '# oat-role: ';
+export const OAT_MANAGED_ROLE_OWNER_PREFIX = '# oat-owner: ';
+const CODEX_ROLE_MARKER_PATTERN = /^# oat-role: ([a-zA-Z0-9_-]+)$/;
+const CODEX_OWNER_MARKER_PATTERN = /^# oat-owner: (supported-catalogue|user-config|project-config)$/;
+const STANDARD_SUPPORTED_CODEX_EFFORTS = [
+    'low',
+    'medium',
+    'high',
+    'xhigh',
+];
+export const SUPPORTED_CODEX_ROLE_TARGETS = [
+    ...STANDARD_SUPPORTED_CODEX_EFFORTS.map((effort) => ({
+        model: 'gpt-5.6-luna',
+        effort,
+    })),
+    ...STANDARD_SUPPORTED_CODEX_EFFORTS.map((effort) => ({
+        model: 'gpt-5.6-terra',
+        effort,
+    })),
+    ...[...STANDARD_SUPPORTED_CODEX_EFFORTS, 'max'].map((effort) => ({
+        model: 'gpt-5.6-sol',
+        effort,
+    })),
+];
 export function sanitizeCodexRoleName(input) {
     return normalizeCodexRoleName(input.replace(/\.md$/i, ''));
 }
@@ -12,18 +36,87 @@ export function normalizeCodexRoleName(input) {
         .replace(/-{2,}/g, '-')
         .replace(/^-+|-+$/g, '');
 }
+function isSupportedCodexRoleTarget(model, effort) {
+    return SUPPORTED_CODEX_ROLE_TARGETS.some((supported) => supported.model === model && supported.effort === effort);
+}
+export function buildCodexMaterializedTargetRoleName(options) {
+    const normalizedAgentName = sanitizeCodexRoleName(options.agentName);
+    const normalizedModel = normalizeCodexRoleName(options.model);
+    const normalizedEffort = normalizeCodexRoleName(options.effort);
+    const customTargetSuffix = isSupportedCodexRoleTarget(options.model, options.effort)
+        ? ''
+        : `-${createHash('sha256')
+            .update(`${options.model}\0${options.effort}`)
+            .digest('hex')
+            .slice(0, 10)}`;
+    return normalizeCodexRoleName(`${normalizedAgentName}-${normalizedModel}-${normalizedEffort}${customTargetSuffix}`);
+}
+function parseOatManagedCodexRoleHeader(content) {
+    const lines = content
+        .split('\n')
+        .map((line) => (line.endsWith('\r') ? line.slice(0, -1) : line));
+    const headerLines = [];
+    for (const line of lines) {
+        if (!line.startsWith('# oat-')) {
+            break;
+        }
+        headerLines.push(line);
+    }
+    if (headerLines.length < 2 ||
+        headerLines.length > 3 ||
+        headerLines[0] !== OAT_MANAGED_ROLE_HEADER) {
+        return null;
+    }
+    const roleMatch = CODEX_ROLE_MARKER_PATTERN.exec(headerLines[1]);
+    if (!roleMatch) {
+        return null;
+    }
+    let owner = null;
+    let ownerLineIndex = null;
+    if (headerLines.length === 3) {
+        const ownerMatch = CODEX_OWNER_MARKER_PATTERN.exec(headerLines[2]);
+        if (!ownerMatch) {
+            return null;
+        }
+        owner = ownerMatch[1];
+        ownerLineIndex = 2;
+    }
+    return {
+        roleName: roleMatch[1],
+        roleLineIndex: 1,
+        owner,
+        ownerLineIndex,
+    };
+}
 export function isOatManagedCodexRoleFile(content, roleName) {
-    if (!content.includes(OAT_MANAGED_ROLE_HEADER)) {
+    const header = parseOatManagedCodexRoleHeader(content);
+    if (!header) {
         return false;
     }
-    if (!roleName) {
-        return true;
-    }
-    return content.includes(`${OAT_MANAGED_ROLE_NAME_PREFIX}${roleName}`);
+    return roleName === undefined || header.roleName === roleName;
 }
 export function withOatManagedCodexHeader(roleName, tomlBody) {
     return `${OAT_MANAGED_ROLE_HEADER}\n${OAT_MANAGED_ROLE_NAME_PREFIX}${roleName}\n${tomlBody}`;
 }
+export function readOatManagedCodexRoleOwner(content) {
+    return parseOatManagedCodexRoleHeader(content)?.owner ?? null;
+}
+export function withOatManagedCodexRoleOwner(content, owner) {
+    const header = parseOatManagedCodexRoleHeader(content);
+    if (!header) {
+        return content;
+    }
+    const lines = content.split('\n');
+    const ownerLine = `${OAT_MANAGED_ROLE_OWNER_PREFIX}${owner}`;
+    const usesCarriageReturn = lines[header.roleLineIndex]?.endsWith('\r') ?? false;
+    const encodedOwnerLine = `${ownerLine}${usesCarriageReturn ? '\r' : ''}`;
+    if (header.ownerLineIndex !== null) {
+        lines[header.ownerLineIndex] = encodedOwnerLine;
+        return lines.join('\n');
+    }
+    lines.splice(header.roleLineIndex + 1, 0, encodedOwnerLine);
+    return lines.join('\n');
+}
 export function stringifyToml(object) {
     return TOML.stringify(object);
 }

package/dist/providers/codex/codec/sync-extension.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sync-extension.d.ts","sourceRoot":"","sources":["../../../../src/providers/codex/codec/sync-extension.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAUpD,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;AAC3E,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,QAAQ,CAAC;AAErD,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,oBAAoB,CAAC;IAC7B,MAAM,EAAE,oBAAoB,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,4BAA6B,SAAQ,uBAAuB;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,4BAA4B,EAAE,CAAC;IAC3C,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAeD,UAAU,iCAAiC;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAmYD,wBAAsB,gCAAgC,CACpD,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,cAAc,EAAE,EAClC,qBAAqB,CAAC,EAAE,MAAM,EAAE,EAChC,OAAO,GAAE,iCAAsC,GAC9C,OAAO,CAAC,kBAAkB,CAAC,CA0H7B;AAED,wBAAsB,8BAA8B,CAClD,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,yBAAyB,CAAC,CA6BpC;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAE1E;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,kBAAkB,GAAG;IACjE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB,CAaA;AAED,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,kBAAkB,GACvB,uBAAuB,EAAE,CAQ3B"}
+{"version":3,"file":"sync-extension.d.ts","sourceRoot":"","sources":["../../../../src/providers/codex/codec/sync-extension.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAqBpD,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;AAC3E,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,QAAQ,CAAC;AAErD,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,oBAAoB,CAAC;IAC7B,MAAM,EAAE,oBAAoB,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,4BAA6B,SAAQ,uBAAuB;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,4BAA4B,EAAE,CAAC;IAC3C,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAgBD,UAAU,iCAAiC;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAwhBD,wBAAsB,gCAAgC,CACpD,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,cAAc,EAAE,EAClC,qBAAqB,CAAC,EAAE,MAAM,EAAE,EAChC,OAAO,GAAE,iCAAsC,GAC9C,OAAO,CAAC,kBAAkB,CAAC,CA+I7B;AAED,wBAAsB,8BAA8B,CAClD,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,yBAAyB,CAAC,CA6BpC;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAE1E;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,kBAAkB,GAAG;IACjE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB,CAaA;AAED,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,kBAAkB,GACvB,uBAAuB,EAAE,CAQ3B"}

package/dist/providers/codex/codec/sync-extension.js

@@ -2,19 +2,19 @@ import { createHash } from 'node:crypto';
 import { readdir, readFile, rm, writeFile } from 'node:fs/promises';
 import { basename, dirname, join, relative, resolve } from 'node:path';
 import { parseCanonicalAgentFile } from '../../../agents/canonical/index.js';
-import { isCodexMaterializedRouteTarget, resolveActiveProject, validateDispatchRouteTarget, } from '../../../config/oat-config.js';
+import { isCodexMaterializedRouteTarget, isWorkflowDispatchCandidateLadder, isWorkflowDispatchFallbackRoute, normalizeProjectPath, resolveActiveProject, validateDispatchRouteTarget, } from '../../../config/oat-config.js';
 import { resolveEffectiveConfig } from '../../../config/resolve.js';
+import { CliError } from '../../../errors/index.js';
 import { ensureDir, fileExists } from '../../../fs/io.js';
+import { validateRealPathWithinScope } from '../../../fs/paths.js';
 import TOML from '@iarna/toml';
 import YAML from 'yaml';
+import { SUPPORTED_CODEX_BASE_ROLES, SUPPORTED_CODEX_ROLE_TARGETS, } from './catalog.js';
 import { mergeCodexConfig } from './config-merge.js';
 import { exportCanonicalAgentToCodexRole } from './export-to-codex.js';
 import { materializeCodexRole } from './materialize.js';
-import { isOatManagedCodexRoleFile } from './shared.js';
-const CODEX_MATERIALIZED_BASE_ROLES = new Set([
-    'oat-phase-implementer',
-    'oat-reviewer',
-]);
+import { isOatManagedCodexRoleFile, readOatManagedCodexRoleOwner, withOatManagedCodexRoleOwner, } from './shared.js';
+const CODEX_MATERIALIZED_BASE_ROLES = new Set(SUPPORTED_CODEX_BASE_ROLES);
 function hashContent(content) {
     return createHash('sha256').update(content).digest('hex');
 }
@@ -74,14 +74,22 @@ async function desiredRolesFromCanonical(canonicalEntries, scopeRoot, materializ
                     description: materialized.description,
                     configFile: materialized.configFile,
                     rolePath: join(scopeRoot, '.codex', materialized.configFile),
-                    content: materialized.content,
+                    content: withOatManagedCodexRoleOwner(materialized.content, target.owner),
                 });
             }
         }
     }
+    const roleContents = new Map();
+    for (const role of roles) {
+        const existing = roleContents.get(role.roleName);
+        if (existing !== undefined && existing !== role.content) {
+            throw new CliError(`Distinct Codex targets produced the same role name ${role.roleName}. Refusing ambiguous role writes.`);
+        }
+        roleContents.set(role.roleName, role.content);
+    }
     return roles.sort((left, right) => left.roleName.localeCompare(right.roleName));
 }
-function collectCodexTargetFromEntry(entry, targets) {
+function collectCodexTargetFromEntry(entry, targets, owner) {
     if (typeof entry === 'string') {
         return;
     }
@@ -92,26 +100,42 @@ function collectCodexTargetFromEntry(entry, targets) {
     if (!validation.valid || !entry.model || !entry.effort) {
         return;
     }
-    targets.set(`${entry.model}\0${entry.effort}`, {
-        model: entry.model,
-        effort: entry.effort,
-    });
+    const key = `${entry.model}\0${entry.effort}`;
+    if (!targets.has(key)) {
+        targets.set(key, {
+            model: entry.model,
+            effort: entry.effort,
+            owner,
+        });
+    }
 }
-function collectCodexTargetsFromCell(cell, targets) {
+function collectCodexTargetsFromCell(cell, targets, owner) {
     if (typeof cell === 'string') {
         return;
     }
+    if (isWorkflowDispatchCandidateLadder(cell)) {
+        for (const candidate of cell.candidates) {
+            if (isWorkflowDispatchFallbackRoute(candidate)) {
+                for (const entry of candidate.route) {
+                    collectCodexTargetFromEntry(entry, targets, owner);
+                }
+                continue;
+            }
+            collectCodexTargetFromEntry(candidate, targets, owner);
+        }
+        return;
+    }
     for (const entry of cell) {
-        collectCodexTargetFromEntry(entry, targets);
+        collectCodexTargetFromEntry(entry, targets, owner);
     }
 }
-function collectCodexMaterializationTargetsFromProvider(providerValue, targets) {
+function collectCodexMaterializationTargetsFromProvider(providerValue, targets, owner) {
     if (providerValue === undefined || typeof providerValue === 'string') {
         return;
     }
     for (const cell of Object.values(providerValue)) {
         if (cell !== undefined) {
-            collectCodexTargetsFromCell(cell, targets);
+            collectCodexTargetsFromCell(cell, targets, owner);
         }
     }
 }
@@ -137,26 +161,54 @@ function routeTargetFromUnknown(value) {
     }
     return Object.keys(target).length > 0 ? target : null;
 }
-function collectCodexTargetsFromUnknownCell(value, targets) {
-    if (typeof value === 'string' || !Array.isArray(value)) {
+function collectCodexTargetsFromUnknownCell(value, targets, owner) {
+    const collectCandidate = (candidate) => {
+        if (!candidate ||
+            typeof candidate !== 'object' ||
+            Array.isArray(candidate)) {
+            return;
+        }
+        const route = candidate['route'];
+        if (Array.isArray(route)) {
+            for (const entry of route) {
+                const target = routeTargetFromUnknown(entry);
+                if (target) {
+                    collectCodexTargetFromEntry(target, targets, owner);
+                }
+            }
+            return;
+        }
+        const target = routeTargetFromUnknown(candidate);
+        if (target) {
+            collectCodexTargetFromEntry(target, targets, owner);
+        }
+    };
+    if (Array.isArray(value)) {
+        for (const entry of value) {
+            collectCandidate(entry);
+        }
+        return;
+    }
+    if (!value || typeof value !== 'object') {
+        return;
+    }
+    const candidates = value['candidates'];
+    if (!Array.isArray(candidates)) {
         return;
     }
-    for (const entry of value) {
+    for (const entry of candidates) {
         if (typeof entry === 'string') {
             continue;
         }
-        const target = routeTargetFromUnknown(entry);
-        if (target) {
-            collectCodexTargetFromEntry(target, targets);
-        }
+        collectCandidate(entry);
     }
 }
-function collectCodexTargetsFromUnknownProvider(value, targets) {
+function collectCodexTargetsFromUnknownProvider(value, targets, owner) {
     if (!value || typeof value !== 'object' || Array.isArray(value)) {
         return;
     }
     for (const cell of Object.values(value)) {
-        collectCodexTargetsFromUnknownCell(cell, targets);
+        collectCodexTargetsFromUnknownCell(cell, targets, owner);
     }
 }
 function frontmatterBlock(content) {
@@ -168,13 +220,31 @@ function frontmatterBlock(content) {
     return end > 0 ? normalized.slice(4, end) : null;
 }
 async function collectProjectStateCodexTargets(scopeRoot, options, targets) {
-    const projectPath = options.projectPath === undefined
+    const projectPathCandidate = options.projectPath === undefined
         ? (await resolveActiveProject(scopeRoot)).path
         : options.projectPath;
+    if (!projectPathCandidate) {
+        return;
+    }
+    const projectPath = normalizeProjectPath(scopeRoot, projectPathCandidate);
     if (!projectPath) {
+        if (options.projectPath !== undefined) {
+            throw new CliError(`Project-scoped Codex materialization path must be repo-relative or inside repo root: ${projectPathCandidate}`);
+        }
+        return;
+    }
+    let realProjectPath;
+    try {
+        const validated = await validateRealPathWithinScope(join(scopeRoot, projectPath), scopeRoot);
+        realProjectPath = validated.realPath;
+    }
+    catch {
+        if (options.projectPath !== undefined) {
+            throw new CliError(`Project-scoped Codex materialization path must be repo-relative or inside repo root: ${projectPathCandidate}`);
+        }
         return;
     }
-    const statePath = join(resolve(scopeRoot, projectPath), 'state.md');
+    const statePath = join(realProjectPath, 'state.md');
     const stateContent = await readOptionalFile(statePath);
     if (!stateContent) {
         return;
@@ -195,17 +265,32 @@ async function collectProjectStateCodexTargets(scopeRoot, options, targets) {
     if (!matrix || typeof matrix !== 'object' || Array.isArray(matrix)) {
         return;
     }
-    collectCodexTargetsFromUnknownProvider(matrix['codex'], targets);
+    collectCodexTargetsFromUnknownProvider(matrix['codex'], targets, 'project-config');
+}
+function isUserCodexScope(scopeRoot, options) {
+    if (!options.userConfigDir) {
+        return false;
+    }
+    return resolve(scopeRoot) === resolve(options.userConfigDir, '..');
 }
 async function readCodexMaterializationTargets(scopeRoot, options = {}) {
     const targets = new Map();
     const effectiveConfig = await resolveEffectiveConfig(scopeRoot, options.userConfigDir ?? join(scopeRoot, '.oat', '__no-user-config__'), options.env);
+    if (isUserCodexScope(scopeRoot, options)) {
+        collectCodexMaterializationTargetsFromProvider(effectiveConfig.user.workflow?.dispatchCeiling?.providers?.codex, targets, 'user-config');
+        return sortCodexMaterializationTargets(targets);
+    }
+    for (const target of SUPPORTED_CODEX_ROLE_TARGETS) {
+        targets.set(`${target.model}\0${target.effort}`, {
+            ...target,
+            owner: 'supported-catalogue',
+        });
+    }
     for (const providerValue of [
-        effectiveConfig.user.workflow?.dispatchCeiling?.providers?.codex,
         effectiveConfig.shared.workflow?.dispatchCeiling?.providers?.codex,
         effectiveConfig.local.workflow?.dispatchCeiling?.providers?.codex,
     ]) {
-        collectCodexMaterializationTargetsFromProvider(providerValue, targets);
+        collectCodexMaterializationTargetsFromProvider(providerValue, targets, 'project-config');
     }
     await collectProjectStateCodexTargets(scopeRoot, options, targets);
     return sortCodexMaterializationTargets(targets);
@@ -235,7 +320,7 @@ function parseConfigAgentTable(content) {
         return {};
     }
 }
-async function collectStaleManagedRoles(scopeRoot, existingConfigContent, desiredRoleNames) {
+async function collectStaleManagedRoles(scopeRoot, existingConfigContent, desiredRoleNames, cleanupOwner, removeLegacyProjectRoles) {
     const agents = parseConfigAgentTable(existingConfigContent);
     const stale = new Set();
     for (const [roleName, roleConfig] of Object.entries(agents)) {
@@ -251,6 +336,13 @@ async function collectStaleManagedRoles(scopeRoot, existingConfigContent, desire
         if (!roleContent || !isOatManagedCodexRoleFile(roleContent, roleName)) {
             continue;
         }
+        const owner = readOatManagedCodexRoleOwner(roleContent);
+        const legacyProjectRole = removeLegacyProjectRoles &&
+            owner === null &&
+            SUPPORTED_CODEX_BASE_ROLES.some((baseRole) => roleName.startsWith(`${baseRole}-`));
+        if (owner !== cleanupOwner && !legacyProjectRole) {
+            continue;
+        }
         stale.add(roleName);
     }
     const agentsDir = join(scopeRoot, '.codex', 'agents');
@@ -274,6 +366,13 @@ async function collectStaleManagedRoles(scopeRoot, existingConfigContent, desire
         if (!roleContent || !isOatManagedCodexRoleFile(roleContent, roleName)) {
             continue;
         }
+        const owner = readOatManagedCodexRoleOwner(roleContent);
+        const legacyProjectRole = removeLegacyProjectRoles &&
+            owner === null &&
+            SUPPORTED_CODEX_BASE_ROLES.some((baseRole) => roleName.startsWith(`${baseRole}-`));
+        if (owner !== cleanupOwner && !legacyProjectRole) {
+            continue;
+        }
         stale.add(roleName);
     }
     return [...stale].sort((left, right) => left.localeCompare(right));
@@ -281,13 +380,24 @@ async function collectStaleManagedRoles(scopeRoot, existingConfigContent, desire
 export async function computeCodexProjectExtensionPlan(scopeRoot, canonicalEntries, allowedCanonicalPaths, options = {}) {
     const isPartialSync = allowedCanonicalPaths !== undefined && allowedCanonicalPaths.length > 0;
     const materializationTargets = await readCodexMaterializationTargets(scopeRoot, options);
+    if (!isPartialSync &&
+        isUserCodexScope(scopeRoot, options) &&
+        materializationTargets.length > 0) {
+        const canonicalBaseRoles = new Set(canonicalEntries
+            .filter((entry) => entry.type === 'agent' && entry.isFile)
+            .map((entry) => entry.name.replace(/\.md$/i, '')));
+        const missingBaseRoles = SUPPORTED_CODEX_BASE_ROLES.filter((role) => !canonicalBaseRoles.has(role));
+        if (missingBaseRoles.length > 0) {
+            throw new CliError(`Bundled managed Codex role definitions are unavailable for user sync: ${missingBaseRoles.join(', ')}. Refusing stale user-role cleanup.`);
+        }
+    }
     const desiredRoles = await desiredRolesFromCanonical(canonicalEntries.filter((entry) => canonicalPathAllowed(scopeRoot, entry, allowedCanonicalPaths)), scopeRoot, materializationTargets);
     const desiredRoleNames = new Set(desiredRoles.map((role) => role.roleName));
     const existingConfigPath = configPath(scopeRoot);
     const existingConfigContent = await readOptionalFile(existingConfigPath);
     const staleRoles = isPartialSync
         ? []
-        : await collectStaleManagedRoles(scopeRoot, existingConfigContent, desiredRoleNames);
+        : await collectStaleManagedRoles(scopeRoot, existingConfigContent, desiredRoleNames, isUserCodexScope(scopeRoot, options) ? 'user-config' : 'project-config', !isUserCodexScope(scopeRoot, options));
     if (isPartialSync && desiredRoles.length === 0) {
         return {
             operations: [],

package/dist/providers/identity/availability.d.ts

@@ -39,7 +39,19 @@ export interface ValidateMatrixCellOptions {
         effort?: string;
     } | null;
 }
+export interface CursorTaskProbeResult extends MatrixCellAvailabilityResult {
+    decisive: boolean;
+    evidence: 'task-probe' | 'subagent-allow-list' | 'none';
+}
+export interface CursorCatalogResult {
+    status: 'resolved' | 'unavailable' | 'failed';
+    candidates: string[];
+    sourceCommand: 'models' | 'list-models' | null;
+    diagnostic: string | null;
+}
 export declare function normalizeMatrixCellAvailability(result: MatrixCellAvailabilityResponse): MatrixCellAvailabilityResult;
+export declare function probeCursorSubagentModel(value: string, options: ValidateMatrixCellOptions): Promise<CursorTaskProbeResult>;
+export declare function resolveCursorModelCatalog(options: ValidateMatrixCellOptions): Promise<CursorCatalogResult>;
 export declare function validateCursorSubagentModel(value: string, options: ValidateMatrixCellOptions): Promise<MatrixCellAvailabilityResult>;
 export declare function validateMatrixCell(provider: string, value: string, options: ValidateMatrixCellOptions): Promise<MatrixCellAvailabilityResponse>;
 //# sourceMappingURL=availability.d.ts.map

package/dist/providers/identity/availability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"availability.d.ts","sourceRoot":"","sources":["../../../src/providers/identity/availability.ts"],"names":[],"mappings":"AAQA,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,eAAe,GAAG,aAAa,CAAC;AAE/E,MAAM,WAAW,4BAA4B;IAC3C,YAAY,EAAE,sBAAsB,CAAC;IACrC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,8BAA8B,GACtC,sBAAsB,GACtB,4BAA4B,CAAC;AAEjC,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,8BAA8B;IAC7C,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,cAAc,EAAE,CACd,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE,qBAAqB,KAC3B,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACnC,QAAQ,EAAE,CACR,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE,eAAe,KACrB,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC,8BAA8B,CAAC,CAAC;IACvD,MAAM,CAAC,EAAE;QACP,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,IAAI,CAAC;CACV;AAWD,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,8BAA8B,GACrC,4BAA4B,CAE9B;AA+VD,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,4BAA4B,CAAC,CAsEvC;AAED,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,8BAA8B,CAAC,CA2CzC"}
+{"version":3,"file":"availability.d.ts","sourceRoot":"","sources":["../../../src/providers/identity/availability.ts"],"names":[],"mappings":"AAQA,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,eAAe,GAAG,aAAa,CAAC;AAE/E,MAAM,WAAW,4BAA4B;IAC3C,YAAY,EAAE,sBAAsB,CAAC;IACrC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,8BAA8B,GACtC,sBAAsB,GACtB,4BAA4B,CAAC;AAEjC,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,8BAA8B;IAC7C,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,cAAc,EAAE,CACd,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE,qBAAqB,KAC3B,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACnC,QAAQ,EAAE,CACR,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE,eAAe,KACrB,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC,8BAA8B,CAAC,CAAC;IACvD,MAAM,CAAC,EAAE;QACP,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,IAAI,CAAC;CACV;AAED,MAAM,WAAW,qBAAsB,SAAQ,4BAA4B;IACzE,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,YAAY,GAAG,qBAAqB,GAAG,MAAM,CAAC;CACzD;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,UAAU,GAAG,aAAa,GAAG,QAAQ,CAAC;IAC9C,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,aAAa,EAAE,QAAQ,GAAG,aAAa,GAAG,IAAI,CAAC;IAC/C,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAWD,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,8BAA8B,GACrC,4BAA4B,CAE9B;AAwWD,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,qBAAqB,CAAC,CAwChC;AAED,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAkD9B;AAED,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,4BAA4B,CAAC,CAqBvC;AAED,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,8BAA8B,CAAC,CAuCzC"}