@open-agent-toolkit/cli 0.2.13 → 0.2.15

package/dist/commands/tools/has/has-pack.js

@@ -0,0 +1,33 @@
+export const PACK_NAMES = [
+    'core',
+    'ideas',
+    'docs',
+    'workflows',
+    'utility',
+    'project-management',
+    'research',
+    'brainstorm',
+];
+export function isPackName(value) {
+    return PACK_NAMES.includes(value);
+}
+export async function resolvePackAvailability(pack, scopes, context, dependencies) {
+    const assetsRoot = await dependencies.resolveAssetsRoot();
+    const matchingScopes = [];
+    for (const scope of scopes) {
+        const scopeRoot = await dependencies.resolveScopeRoot(scope, context.cwd, context.home);
+        const tools = await dependencies.scanTools({
+            scope,
+            scopeRoot,
+            assetsRoot,
+        });
+        if (tools.some((tool) => tool.pack === pack)) {
+            matchingScopes.push(scope);
+        }
+    }
+    return {
+        pack,
+        available: matchingScopes.length > 0,
+        scopes: matchingScopes,
+    };
+}

package/dist/commands/tools/has/index.d.ts

@@ -0,0 +1,4 @@
+import { Command } from 'commander';
+import { type PackAvailabilityDependencies } from './has-pack.js';
+export declare function createToolsHasCommand(dependencies?: PackAvailabilityDependencies): Command;
+//# sourceMappingURL=index.d.ts.map

package/dist/commands/tools/has/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/tools/has/index.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EACL,KAAK,4BAA4B,EAIlC,MAAM,YAAY,CAAC;AAapB,wBAAgB,qBAAqB,CACnC,YAAY,GAAE,4BAAkD,GAC/D,OAAO,CA0CT"}

package/dist/commands/tools/has/index.js

@@ -0,0 +1,57 @@
+import { buildCommandContext } from '../../../app/command-context.js';
+import { withScopeOption } from '../../shared/scope-option.js';
+import { readGlobalOptions, resolveConcreteScopes, } from '../../shared/shared.utils.js';
+import { scanTools } from '../../tools/shared/scan-tools.js';
+import { resolveAssetsRoot } from '../../../fs/assets.js';
+import { resolveProjectRoot, resolveScopeRoot } from '../../../fs/paths.js';
+import { Command } from 'commander';
+import { PACK_NAMES, isPackName, resolvePackAvailability, } from './has-pack.js';
+const defaultDependencies = {
+    scanTools,
+    resolveScopeRoot: async (scope, cwd, home) => {
+        if (scope === 'project') {
+            return resolveProjectRoot(cwd);
+        }
+        return resolveScopeRoot(scope, cwd, home);
+    },
+    resolveAssetsRoot,
+};
+export function createToolsHasCommand(dependencies = defaultDependencies) {
+    return withScopeOption(new Command('has'))
+        .description('Check whether a bundled tool pack is available')
+        .argument('<pack>', 'Bundled tool pack name')
+        .action(async (pack, _options, command) => {
+        const context = buildCommandContext(readGlobalOptions(command));
+        if (!isPackName(pack)) {
+            const message = `Invalid pack '${pack}'. Expected one of: ${PACK_NAMES.join(', ')}.`;
+            if (context.json) {
+                context.logger.json({ status: 'error', message });
+            }
+            else {
+                context.logger.error(message);
+            }
+            process.exitCode = 1;
+            return;
+        }
+        try {
+            const availability = await resolvePackAvailability(pack, resolveConcreteScopes(context.scope), context, dependencies);
+            if (context.json) {
+                context.logger.json(availability);
+            }
+            else {
+                context.logger.info(String(availability.available));
+            }
+            process.exitCode = 0;
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            if (context.json) {
+                context.logger.json({ status: 'error', message });
+            }
+            else {
+                context.logger.error(message);
+            }
+            process.exitCode = 2;
+        }
+    });
+}

package/dist/commands/tools/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/tools/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AASpC,wBAAgB,kBAAkB,IAAI,OAAO,CAa5C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/tools/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAUpC,wBAAgB,kBAAkB,IAAI,OAAO,CAc5C"}

package/dist/commands/tools/index.js

@@ -1,4 +1,5 @@
 import { Command } from 'commander';
+import { createToolsHasCommand } from './has/index.js';
 import { createToolsInfoCommand } from './info/index.js';
 import { createToolsInstallCommand } from './install/index.js';
 import { createToolsListCommand } from './list/index.js';
@@ -10,6 +11,7 @@ export function createToolsCommand() {
     cmd.addCommand(createToolsListCommand());
     cmd.addCommand(createToolsOutdatedCommand());
     cmd.addCommand(createToolsInfoCommand());
+    cmd.addCommand(createToolsHasCommand());
     cmd.addCommand(createToolsUpdateCommand());
     cmd.addCommand(createToolsRemoveCommand());
     cmd.addCommand(createToolsInstallCommand());

package/dist/commands/tools/remove/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/tools/remove/index.ts"],"names":[],"mappings":"AASA,OAAO,EACL,KAAK,oBAAoB,EAE1B,MAAM,kCAAkC,CAAC;AAM1C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAEL,KAAK,uBAAuB,EAE7B,MAAM,gBAAgB,CAAC;AA4CxB,wBAAgB,wBAAwB,CACtC,YAAY,GAAE,uBAA6C,EAC3D,gBAAgB,GAAE,oBAA8C,GAC/D,OAAO,CAwGT"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/tools/remove/index.ts"],"names":[],"mappings":"AASA,OAAO,EACL,KAAK,oBAAoB,EAE1B,MAAM,kCAAkC,CAAC;AAO1C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAEL,KAAK,uBAAuB,EAE7B,MAAM,gBAAgB,CAAC;AA4CxB,wBAAgB,wBAAwB,CACtC,YAAY,GAAE,uBAA6C,EAC3D,gBAAgB,GAAE,oBAA8C,GAC/D,OAAO,CAuFT"}

package/dist/commands/tools/remove/index.js

@@ -4,6 +4,7 @@ import { buildCommandContext } from '../../../app/command-context.js';
 import { withScopeOption } from '../../shared/scope-option.js';
 import { readGlobalOptions, resolveConcreteScopes, } from '../../shared/shared.utils.js';
 import { autoSync, } from '../../tools/shared/auto-sync.js';
+import { reconcileProjectToolsConfig } from '../../tools/shared/project-tools-config.js';
 import { scanTools } from '../../tools/shared/scan-tools.js';
 import { readOatConfig, writeOatConfig } from '../../../config/oat-config.js';
 import { resolveAssetsRoot } from '../../../fs/assets.js';
@@ -69,27 +70,16 @@ export function createToolsRemoveCommand(dependencies = defaultDependencies, syn
         const dryRun = opts.dryRun ?? false;
         const result = await removeTools(target, scopes, context.cwd, context.home, dryRun, dependencies);
         if (!dryRun && result.removed.length > 0) {
-            const assetsRoot = await dependencies.resolveAssetsRoot();
             const repoRoot = await resolveProjectRoot(context.cwd);
-            const config = await readOatConfig(repoRoot);
-            const installedPacks = new Set();
-            const configScopes = resolveConcreteScopes('all');
-            for (const scope of configScopes) {
-                const scopeRoot = await dependencies.resolveScopeRoot(scope, context.cwd, context.home);
-                const tools = await dependencies.scanTools({
-                    scope,
-                    scopeRoot,
-                    assetsRoot,
-                });
-                for (const tool of tools) {
-                    if (tool.pack !== 'custom') {
-                        installedPacks.add(tool.pack);
-                    }
-                }
-            }
-            await writeOatConfig(repoRoot, {
-                ...config,
-                tools: Object.fromEntries(VALID_PACKS.map((pack) => [pack, installedPacks.has(pack)])),
+            await reconcileProjectToolsConfig({
+                repoRoot,
+                cwd: context.cwd,
+                home: context.home,
+            }, {
+                resolveAssetsRoot: dependencies.resolveAssetsRoot,
+                scanTools: dependencies.scanTools,
+                readOatConfig,
+                writeOatConfig,
             });
         }
         if (result.notInstalled.length > 0) {

package/dist/commands/tools/shared/project-tools-config.d.ts

@@ -0,0 +1,16 @@
+import { type OatConfig } from '../../../config/oat-config.js';
+import { type ScanToolsOptions } from './scan-tools.js';
+import type { ToolInfo } from './types.js';
+export interface ReconcileProjectToolsOptions {
+    repoRoot: string;
+    cwd: string;
+    home: string;
+}
+export interface ProjectToolsConfigDependencies {
+    resolveAssetsRoot: () => Promise<string>;
+    scanTools: (options: ScanToolsOptions) => Promise<ToolInfo[]>;
+    readOatConfig: (repoRoot: string) => Promise<OatConfig>;
+    writeOatConfig: (repoRoot: string, config: OatConfig) => Promise<void>;
+}
+export declare function reconcileProjectToolsConfig(options: ReconcileProjectToolsOptions, dependencies?: ProjectToolsConfigDependencies): Promise<'written' | 'unchanged'>;
+//# sourceMappingURL=project-tools-config.d.ts.map

package/dist/commands/tools/shared/project-tools-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-tools-config.d.ts","sourceRoot":"","sources":["../../../../src/commands/tools/shared/project-tools-config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,SAAS,EAIf,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAa,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,KAAK,EAAY,QAAQ,EAAE,MAAM,SAAS,CAAC;AAalD,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,8BAA8B;IAC7C,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,SAAS,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9D,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,cAAc,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACxE;AA8CD,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,4BAA4B,EACrC,YAAY,GAAE,8BAAoD,GACjE,OAAO,CAAC,SAAS,GAAG,WAAW,CAAC,CAuBlC"}

package/dist/commands/tools/shared/project-tools-config.js

@@ -0,0 +1,59 @@
+import { readOatConfig, writeOatConfig, } from '../../../config/oat-config.js';
+import { resolveAssetsRoot } from '../../../fs/assets.js';
+import { scanTools } from './scan-tools.js';
+const ALL_PACKS = [
+    'core',
+    'ideas',
+    'docs',
+    'workflows',
+    'utility',
+    'project-management',
+    'research',
+    'brainstorm',
+];
+const defaultDependencies = {
+    resolveAssetsRoot,
+    scanTools,
+    readOatConfig,
+    writeOatConfig,
+};
+function buildProjectToolsConfig(tools) {
+    const installedPacks = new Set(tools
+        .filter((tool) => tool.scope === 'project' && tool.pack !== 'custom')
+        .map((tool) => tool.pack));
+    if (installedPacks.size === 0) {
+        return undefined;
+    }
+    return Object.fromEntries(ALL_PACKS.map((pack) => [pack, installedPacks.has(pack)]));
+}
+function toolsConfigEquals(left, right) {
+    if (left === undefined || right === undefined) {
+        return left === right;
+    }
+    const leftKeys = Object.keys(left);
+    const rightKeys = Object.keys(right);
+    return (leftKeys.length === rightKeys.length &&
+        ALL_PACKS.every((pack) => left[pack] === right[pack]));
+}
+export async function reconcileProjectToolsConfig(options, dependencies = defaultDependencies) {
+    const assetsRoot = await dependencies.resolveAssetsRoot();
+    const projectTools = await dependencies.scanTools({
+        scope: 'project',
+        scopeRoot: options.repoRoot,
+        assetsRoot,
+    });
+    const config = await dependencies.readOatConfig(options.repoRoot);
+    const tools = buildProjectToolsConfig(projectTools);
+    if (toolsConfigEquals(config.tools, tools)) {
+        return 'unchanged';
+    }
+    const nextConfig = { ...config };
+    if (tools === undefined) {
+        delete nextConfig.tools;
+    }
+    else {
+        nextConfig.tools = tools;
+    }
+    await dependencies.writeOatConfig(options.repoRoot, nextConfig);
+    return 'written';
+}

package/dist/commands/tools/update/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/tools/update/index.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,KAAK,oBAAoB,EAE1B,MAAM,kCAAkC,CAAC;AAE1C,OAAO,KAAK,EAAY,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAKvE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,uBAAuB,EAE7B,MAAM,gBAAgB,CAAC;AAgBxB,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAAE,EAClB,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAAA;CAAE,GAClD,MAAM,EAAE,CAaV;AAgCD,wBAAgB,wBAAwB,CACtC,YAAY,GAAE,uBAA6C,EAC3D,gBAAgB,GAAE,oBAA8C,GAC/D,OAAO,CAqKT;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAI7E;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,YAAY,GACnB,OAAO,CAOT;AAED,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,OAAO,GACd,MAAM,CAMR"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/tools/update/index.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,KAAK,oBAAoB,EAE1B,MAAM,kCAAkC,CAAC;AAG1C,OAAO,KAAK,EAAY,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAKvE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,uBAAuB,EAE7B,MAAM,gBAAgB,CAAC;AAgBxB,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAAE,EAClB,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAAA;CAAE,GAClD,MAAM,EAAE,CAaV;AAgCD,wBAAgB,wBAAwB,CACtC,YAAY,GAAE,uBAA6C,EAC3D,gBAAgB,GAAE,oBAA8C,GAC/D,OAAO,CAmJT;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAI7E;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,YAAY,GACnB,OAAO,CAOT;AAED,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,OAAO,GACd,MAAM,CAMR"}

package/dist/commands/tools/update/index.js

@@ -7,6 +7,7 @@ import { copyDirWithStatus, copyFileWithStatus, } from '../../init/tools/shared/
 import { withScopeOption } from '../../shared/scope-option.js';
 import { readGlobalOptions, resolveConcreteScopes, } from '../../shared/shared.utils.js';
 import { autoSync, } from '../../tools/shared/auto-sync.js';
+import { reconcileProjectToolsConfig } from '../../tools/shared/project-tools-config.js';
 import { scanTools } from '../../tools/shared/scan-tools.js';
 import { readOatConfig, writeOatConfig } from '../../../config/oat-config.js';
 import { resolveAssetsRoot } from '../../../fs/assets.js';
@@ -111,29 +112,17 @@ export function createToolsUpdateCommand(dependencies = defaultDependencies, syn
             const docsDestination = join(userRoot, '.oat', 'docs');
             await dependencies.copyDirWithStatus(docsSource, docsDestination, true);
         }
-        if (assetsRoot && (target.kind === 'all' || target.kind === 'pack')) {
+        if (assetsRoot && result.notInstalled.length === 0) {
             const repoRoot = await resolveProjectRoot(context.cwd);
-            const config = await readOatConfig(repoRoot);
-            const installedPacks = new Set();
-            const configScopes = resolveConcreteScopes('all');
-            for (const scope of configScopes) {
-                const scopeRoot = await dependencies.resolveScopeRoot(scope, context.cwd, context.home);
-                const tools = await dependencies.scanTools({
-                    scope,
-                    scopeRoot,
-                    assetsRoot,
-                });
-                for (const tool of tools) {
-                    if (tool.pack !== 'custom') {
-                        installedPacks.add(tool.pack);
-                    }
-                }
-            }
-            // Preserve unrelated shared config keys while rebuilding tools state
-            // from the repo-wide installed-pack scan.
-            await writeOatConfig(repoRoot, {
-                ...config,
-                tools: Object.fromEntries(VALID_PACKS.map((pack) => [pack, installedPacks.has(pack)])),
+            await reconcileProjectToolsConfig({
+                repoRoot,
+                cwd: context.cwd,
+                home: context.home,
+            }, {
+                resolveAssetsRoot: dependencies.resolveAssetsRoot,
+                scanTools: dependencies.scanTools,
+                readOatConfig,
+                writeOatConfig,
             });
         }
         if (result.notInstalled.length > 0) {

package/dist/engine/compute-plan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compute-plan.d.ts","sourceRoot":"","sources":["../../src/engine/compute-plan.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAGtD,OAAO,KAAK,EAAE,QAAQ,EAAiB,MAAM,0BAA0B,CAAC;AACxE,OAAO,KAAK,EAEV,eAAe,EAChB,MAAM,iCAAiC,CAAC;AAIzC,OAAO,KAAK,EACV,WAAW,EAEX,QAAQ,EAET,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEhD,UAAU,mBAAmB;IAC3B,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,WAAW,CAAC;IACnB,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;CAClC;AA0dD,wBAAsB,eAAe,CAAC,EACpC,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,KAAK,EACL,MAAM,EACN,SAAS,EAAE,iBAAiB,EAC5B,qBAAqB,GACtB,EAAE,mBAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsIzC"}
+{"version":3,"file":"compute-plan.d.ts","sourceRoot":"","sources":["../../src/engine/compute-plan.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAGtD,OAAO,KAAK,EAAE,QAAQ,EAAiB,MAAM,0BAA0B,CAAC;AACxE,OAAO,KAAK,EAEV,eAAe,EAChB,MAAM,iCAAiC,CAAC;AAIzC,OAAO,KAAK,EACV,WAAW,EAEX,QAAQ,EAET,MAAM,gBAAgB,CAAC;AAGxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEhD,UAAU,mBAAmB;IAC3B,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,WAAW,CAAC;IACnB,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;CAClC;AA0dD,wBAAsB,eAAe,CAAC,EACpC,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,KAAK,EACL,MAAM,EACN,SAAS,EAAE,iBAAiB,EAC5B,qBAAqB,GACtB,EAAE,mBAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAyIzC"}

package/dist/engine/compute-plan.js

@@ -5,6 +5,7 @@ import { computeContentHash, computeStringHash } from '../manifest/hash.js';
 import { findEntry } from '../manifest/manager.js';
 import { getSyncMappings } from '../providers/shared/adapter.utils.js';
 import { OAT_DIRECTORY_SENTINEL, OAT_MARKER_PREFIX } from './markers.js';
+import { assertSafeProviderMutationPath } from './provider-path-safety.js';
 function buildUpLevels(depth) {
     return Array.from({ length: depth }, () => '..');
 }
@@ -359,6 +360,7 @@ export async function computeSyncPlan({ canonical, adapters, manifest, scope, co
                 const entryStrategy = mapping.transformCanonical
                     ? 'copy'
                     : (manifestEntry?.strategy ?? mappingStrategy);
+                await assertSafeProviderMutationPath(entryScopeRoot, providerPath);
                 const operation = await classifyOperation(canonicalEntry, providerPath, entryStrategy, renderedContent);
                 entries.push({
                     canonical: canonicalEntry,
@@ -392,9 +394,13 @@ export async function computeSyncPlan({ canonical, adapters, manifest, scope, co
             continue;
         }
         const mappingStillExists = (activeMappingsByProvider.get(manifestEntry.provider) ?? []).some((mapping) => manifestEntryInsideMapping(manifestEntry, mapping));
-        removals.push(mappingStillExists
+        const removal = mappingStillExists
             ? createRemovalEntry(manifestEntry, scopeRoot)
-            : await classifyObsoleteMappingRetirement(manifestEntry, scopeRoot));
+            : await classifyObsoleteMappingRetirement(manifestEntry, scopeRoot);
+        if (removal.operation === 'remove') {
+            await assertSafeProviderMutationPath(scopeRoot, removal.providerPath);
+        }
+        removals.push(removal);
     }
     return { scope, entries, removals };
 }

package/dist/engine/execute-plan.d.ts

@@ -1,5 +1,9 @@
 import type { Manifest } from '../manifest/manifest.types.js';
 import type { SyncPlan, SyncResult } from './engine.types.js';
+interface ExecuteSyncPlanDependencies {
+    beforeFirstMutation?: () => Promise<void>;
+}
 export declare function inferScopeRoot(canonicalPath: string): string;
-export declare function executeSyncPlan(plan: SyncPlan, manifest: Manifest, manifestPath: string): Promise<SyncResult>;
+export declare function executeSyncPlan(plan: SyncPlan, manifest: Manifest, manifestPath: string, dependencies?: ExecuteSyncPlanDependencies): Promise<SyncResult>;
+export {};
 //# sourceMappingURL=execute-plan.d.ts.map

package/dist/engine/execute-plan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execute-plan.d.ts","sourceRoot":"","sources":["../../src/engine/execute-plan.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,QAAQ,EAAiB,MAAM,0BAA0B,CAAC;AAExE,OAAO,KAAK,EAAE,QAAQ,EAAiB,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAG1E,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAW5D;AA2JD,wBAAsB,eAAe,CACnC,IAAI,EAAE,QAAQ,EACd,QAAQ,EAAE,QAAQ,EAClB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,UAAU,CAAC,CA0BrB"}
+{"version":3,"file":"execute-plan.d.ts","sourceRoot":"","sources":["../../src/engine/execute-plan.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,QAAQ,EAAiB,MAAM,0BAA0B,CAAC;AAExE,OAAO,KAAK,EAAE,QAAQ,EAAiB,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAI1E,UAAU,2BAA2B;IACnC,mBAAmB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C;AAeD,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAW5D;AA2JD,wBAAsB,eAAe,CACnC,IAAI,EAAE,QAAQ,EACd,QAAQ,EAAE,QAAQ,EAClB,YAAY,EAAE,MAAM,EACpB,YAAY,GAAE,2BAAoE,GACjF,OAAO,CAAC,UAAU,CAAC,CAwCrB"}

package/dist/engine/execute-plan.js

@@ -4,6 +4,15 @@ import { copyDirectory, copySingleFile, createSymlink } from '../fs/io.js';
 import { computeContentHash, computeStringHash } from '../manifest/hash.js';
 import { addEntry, findEntry, removeEntry, saveManifest, } from '../manifest/manager.js';
 import { insertMarker, writeDirectorySentinel } from './markers.js';
+import { assertSafeProviderMutationPath } from './provider-path-safety.js';
+const DEFAULT_EXECUTE_SYNC_PLAN_DEPENDENCIES = {};
+function mutatesProviderPath(entry) {
+    return entry.operation !== 'skip' && entry.operation !== 'detach';
+}
+async function assertSafeEntryProviderPath(entry) {
+    const scopeRoot = inferScopeRoot(resolve(entry.canonical.canonicalPath));
+    await assertSafeProviderMutationPath(scopeRoot, entry.providerPath);
+}
 export function inferScopeRoot(canonicalPath) {
     const normalizedPath = canonicalPath.replaceAll('\\', '/');
     const marker = '/.agents/';
@@ -118,14 +127,20 @@ async function ensureSkipEntryManaged(planEntry, manifest) {
     const manifestEntry = await toManifestEntry(planEntry, planEntry.strategy);
     return addEntry(manifest, manifestEntry);
 }
-export async function executeSyncPlan(plan, manifest, manifestPath) {
+export async function executeSyncPlan(plan, manifest, manifestPath, dependencies = DEFAULT_EXECUTE_SYNC_PLAN_DEPENDENCIES) {
     let nextManifest = manifest;
+    let beforeFirstMutationCalled = false;
     const result = {
         applied: 0,
         failed: 0,
         skipped: 0,
     };
     const operations = [...plan.entries, ...plan.removals];
+    for (const operation of operations) {
+        if (mutatesProviderPath(operation)) {
+            await assertSafeEntryProviderPath(operation);
+        }
+    }
     for (const operation of operations) {
         if (operation.operation === 'skip') {
             nextManifest = await ensureSkipEntryManaged(operation, nextManifest);
@@ -133,6 +148,13 @@ export async function executeSyncPlan(plan, manifest, manifestPath) {
             continue;
         }
         try {
+            if (mutatesProviderPath(operation)) {
+                if (!beforeFirstMutationCalled) {
+                    beforeFirstMutationCalled = true;
+                    await dependencies.beforeFirstMutation?.();
+                }
+                await assertSafeEntryProviderPath(operation);
+            }
             nextManifest = await applyEntry(operation, nextManifest);
             result.applied += 1;
         }

package/dist/engine/index.d.ts

@@ -4,6 +4,7 @@ export { executeSyncPlan } from './execute-plan.js';
 export { configureLocalHooksPath, getHookInstallInfo, HOOK_DRIFT_WARNING, HOOK_MARKER_END, HOOK_MARKER_START, HOOK_STRAY_INFO, installHook, isHookInstalled, REPO_GITHOOKS_PATH, runHookCheck, uninstallHook, } from './hook.js';
 export type { HookInstallInfo, HookStatus } from './hook.js';
 export { hasMarker, insertMarker, OAT_DIRECTORY_SENTINEL, OAT_MARKER_PREFIX, writeDirectorySentinel, } from './markers.js';
+export { assertSafeProviderMutationPath } from './provider-path-safety.js';
 export type { CanonicalEntry } from './scanner.js';
 export { scanBundledManagedAgents, scanBundledManagedCodexAgents, scanCanonical, } from './scanner.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/engine/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/engine/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,UAAU,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,YAAY,EACZ,aAAa,GACd,MAAM,QAAQ,CAAC;AAChB,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EACL,SAAS,EACT,YAAY,EACZ,sBAAsB,EACtB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EACL,wBAAwB,EACxB,6BAA6B,EAC7B,aAAa,GACd,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/engine/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,UAAU,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,WAAW,EACX,eAAe,EACf,kBAAkB,EAClB,YAAY,EACZ,aAAa,GACd,MAAM,QAAQ,CAAC;AAChB,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EACL,SAAS,EACT,YAAY,EACZ,sBAAsB,EACtB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AACxE,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EACL,wBAAwB,EACxB,6BAA6B,EAC7B,aAAa,GACd,MAAM,WAAW,CAAC"}

package/dist/engine/index.js

@@ -3,4 +3,5 @@ export { SYNC_OPERATION_TYPES, } from './engine.types.js';
 export { executeSyncPlan } from './execute-plan.js';
 export { configureLocalHooksPath, getHookInstallInfo, HOOK_DRIFT_WARNING, HOOK_MARKER_END, HOOK_MARKER_START, HOOK_STRAY_INFO, installHook, isHookInstalled, REPO_GITHOOKS_PATH, runHookCheck, uninstallHook, } from './hook.js';
 export { hasMarker, insertMarker, OAT_DIRECTORY_SENTINEL, OAT_MARKER_PREFIX, writeDirectorySentinel, } from './markers.js';
+export { assertSafeProviderMutationPath } from './provider-path-safety.js';
 export { scanBundledManagedAgents, scanBundledManagedCodexAgents, scanCanonical, } from './scanner.js';

package/dist/engine/provider-path-safety.d.ts

@@ -0,0 +1,2 @@
+export declare function assertSafeProviderMutationPath(scopeRoot: string, providerPath: string): Promise<void>;
+//# sourceMappingURL=provider-path-safety.d.ts.map

package/dist/engine/provider-path-safety.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-path-safety.d.ts","sourceRoot":"","sources":["../../src/engine/provider-path-safety.ts"],"names":[],"mappings":"AAiBA,wBAAsB,8BAA8B,CAClD,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAuDf"}

package/dist/engine/provider-path-safety.js

@@ -0,0 +1,54 @@
+import { lstat } from 'node:fs/promises';
+import { dirname, isAbsolute, relative, resolve, sep } from 'node:path';
+function isMissingPathError(error) {
+    return (typeof error === 'object' &&
+        error !== null &&
+        'code' in error &&
+        error.code === 'ENOENT');
+}
+function displayRelativePath(scopeRoot, path) {
+    const relativePath = relative(scopeRoot, path);
+    return relativePath || '.';
+}
+export async function assertSafeProviderMutationPath(scopeRoot, providerPath) {
+    const resolvedRoot = resolve(scopeRoot);
+    const resolvedProviderPath = resolve(providerPath);
+    const relativeProviderPath = relative(resolvedRoot, resolvedProviderPath);
+    if (relativeProviderPath === '') {
+        throw new Error('Provider destination must not equal the sync scope root.');
+    }
+    if (relativeProviderPath === '..' ||
+        relativeProviderPath.startsWith(`..${sep}`) ||
+        isAbsolute(relativeProviderPath)) {
+        throw new Error(`Provider destination is outside the sync scope: ${providerPath}`);
+    }
+    const relativeParentPath = dirname(relativeProviderPath);
+    const parentSegments = relativeParentPath === '.'
+        ? []
+        : relativeParentPath.split(sep).filter(Boolean);
+    const ancestry = [resolvedRoot];
+    let currentPath = resolvedRoot;
+    for (const segment of parentSegments) {
+        currentPath = resolve(currentPath, segment);
+        ancestry.push(currentPath);
+    }
+    for (const ancestor of ancestry) {
+        let stat;
+        try {
+            stat = await lstat(ancestor);
+        }
+        catch (error) {
+            if (isMissingPathError(error)) {
+                return;
+            }
+            throw error;
+        }
+        const displayedPath = displayRelativePath(resolvedRoot, ancestor);
+        if (stat.isSymbolicLink()) {
+            throw new Error(`Unsafe provider parent "${displayedPath}": symbolic links are not allowed in provider ancestry.`);
+        }
+        if (!stat.isDirectory()) {
+            throw new Error(`Unsafe provider parent "${displayedPath}": provider ancestry is not a directory.`);
+        }
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-agent-toolkit/cli",
-  "version": "0.2.13",
+  "version": "0.2.15",
   "private": false,
   "description": "Open Agent Toolkit CLI",
   "homepage": "https://github.com/voxmedia/open-agent-toolkit/tree/main/packages/cli",
@@ -34,7 +34,7 @@
     "ora": "^9.0.0",
     "yaml": "2.8.2",
     "zod": "^3.25.76",
-    "@open-agent-toolkit/control-plane": "0.2.13"
+    "@open-agent-toolkit/control-plane": "0.2.15"
   },
   "devDependencies": {
     "@types/node": "^22.10.0",