@open-agent-toolkit/cli 0.2.41 → 0.2.46

package/dist/projects/split/write-parent.js

@@ -3,6 +3,7 @@ import { join } from 'node:path';
 import { scaffoldProject as defaultScaffoldProject, } from '../../commands/project/new/scaffold.js';
 import { getFrontmatterBlock } from '../../commands/shared/frontmatter.js';
 import { replaceFrontmatter } from '../../commands/shared/frontmatter-write.js';
+import { resolveProjectScope, } from '../../commands/shared/project-scope.js';
 import { assertValidProjectStateFilesystemContent } from '../../validation/project-state.js';
 import YAML from 'yaml';
 function readObjectFrontmatter(content, filePath) {
@@ -22,9 +23,6 @@ async function writeObjectFrontmatter(filePath, updates) {
     updates(frontmatter);
     await writeFile(filePath, replaceFrontmatter(content, YAML.stringify(frontmatter).trimEnd()), 'utf8');
 }
-function projectPathFor(projectsRoot, slug) {
-    return join(projectsRoot, slug).split('\\').join('/');
-}
 function renderParentDiscovery(document) {
     const { plan } = document;
     const orderedChildren = plan.children
@@ -138,9 +136,14 @@ async function replaceMarkdownBody(filePath, body) {
 }
 export async function writeCoordinationParent(document, context) {
     const scaffoldProject = context.scaffoldProject ?? defaultScaffoldProject;
+    const projectsRoot = context.projectsRoot ?? '.oat/projects/shared';
+    const scope = context.scope ??
+        resolveProjectScope(join(projectsRoot, document.plan.parentSlug), projectsRoot, context.repoRoot) ??
+        'shared';
     const scaffold = await scaffoldProject({
         repoRoot: context.repoRoot,
         projectName: document.plan.parentSlug,
+        scope,
         mode: 'quick',
         setActive: false,
         refreshDashboard: false,
@@ -170,7 +173,7 @@ export async function writeCoordinationParent(document, context) {
         projectPath: parentRoot,
     });
     return {
-        parentProjectPath: projectPathFor(context.projectsRoot ?? scaffold.projectsRoot, document.plan.parentSlug),
+        parentProjectPath: scaffold.projectPath,
         scaffold,
     };
 }

package/dist/release/public-package-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"public-package-contract.d.ts","sourceRoot":"","sources":["../../src/release/public-package-contract.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,KAAK,GAAG,cAAc,GAAG,iBAAiB,CAAC;IACjD,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,uBAAuB,EAAE,yBAAyB,EAAE,CAAC;IACrD,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,4BAA4B,EAAE,MAAM,EAAE,CAAC;IACvC,2BAA2B,EAAE,MAAM,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AA4KD,wBAAgB,yBAAyB,IAAI,qBAAqB,EAAE,CAenE;AAED,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,QAAQ,EAAE,qBAAqB,GAC9B,MAAM,EAAE,CAIV;AAED,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,QAAQ,EAAE,qBAAqB,GAC9B,MAAM,EAAE,CAIV;AAED,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,QAAQ,EAAE,qBAAqB,GAC9B,MAAM,EAAE,CAMV;AAED,wBAAgB,6BAA6B,CAC3C,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACjD,QAAQ,EAAE,qBAAqB,GAC9B,MAAM,EAAE,CAoBV;AAED,wBAAgB,oCAAoC,CAClD,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,MAAM,EAAE,CAmBV;AAED,wBAAgB,qCAAqC,CACnD,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,kBAAkB,EAAE,SAAS,MAAM,EAAE,EACrC,qBAAqB,EAAE,SAAS,MAAM,EAAE,GACvC,MAAM,EAAE,CA0BV"}
+{"version":3,"file":"public-package-contract.d.ts","sourceRoot":"","sources":["../../src/release/public-package-contract.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,KAAK,GAAG,cAAc,GAAG,iBAAiB,CAAC;IACjD,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,uBAAuB,EAAE,yBAAyB,EAAE,CAAC;IACrD,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,4BAA4B,EAAE,MAAM,EAAE,CAAC;IACvC,2BAA2B,EAAE,MAAM,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AA6KD,wBAAgB,yBAAyB,IAAI,qBAAqB,EAAE,CAenE;AAED,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,QAAQ,EAAE,qBAAqB,GAC9B,MAAM,EAAE,CAIV;AAED,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,QAAQ,EAAE,qBAAqB,GAC9B,MAAM,EAAE,CAIV;AAED,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,QAAQ,EAAE,qBAAqB,GAC9B,MAAM,EAAE,CAMV;AAED,wBAAgB,6BAA6B,CAC3C,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACjD,QAAQ,EAAE,qBAAqB,GAC9B,MAAM,EAAE,CAoBV;AAED,wBAAgB,oCAAoC,CAClD,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,MAAM,EAAE,CAmBV;AAED,wBAAgB,qCAAqC,CACnD,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,kBAAkB,EAAE,SAAS,MAAM,EAAE,EACrC,qBAAqB,EAAE,SAAS,MAAM,EAAE,GACvC,MAAM,EAAE,CA0BV"}

package/dist/release/public-package-contract.js

@@ -10,6 +10,7 @@ const COMMON_METADATA_FIELDS = [
 const COMMON_FORBIDDEN_PATH_PATTERNS = [
     'src/**',
     '**/*.test.*',
+    '**/__tests__/**',
     'tsconfig.tsbuildinfo',
 ];
 const PACKED_DEPENDENCY_FIELDS = [

package/dist/validation/skills.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../../src/validation/skills.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAChC;AAED,MAAM,WAAW,uBAAuB;IACtC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,uCAAuC;IACtD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sCAAsC;IACrD,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,CACzB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,KAChD,OAAO,CAAC,cAAc,CAAC,CAAC;AAE7B,UAAU,6BAA6B;IACrC,WAAW,CAAC,EAAE,YAAY,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAuSD,wBAAsB,gCAAgC,CACpD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,uCAAuC,EAChD,YAAY,GAAE,6BAAkC,GAC/C,OAAO,CAAC,sCAAsC,CAAC,CAoBjD;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,wBAA6B,EACtC,YAAY,GAAE,6BAAkC,GAC/C,OAAO,CAAC,uBAAuB,CAAC,CAmIlC"}
+{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../../src/validation/skills.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAChC;AAED,MAAM,WAAW,uBAAuB;IACtC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,uCAAuC;IACtD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sCAAsC;IACrD,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,CACzB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,KAChD,OAAO,CAAC,cAAc,CAAC,CAAC;AAE7B,UAAU,6BAA6B;IACrC,WAAW,CAAC,EAAE,YAAY,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AA04BD,wBAAsB,gCAAgC,CACpD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,uCAAuC,EAChD,YAAY,GAAE,6BAAkC,GAC/C,OAAO,CAAC,sCAAsC,CAAC,CAoBjD;AAED,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,wBAA6B,EACtC,YAAY,GAAE,6BAAkC,GAC/C,OAAO,CAAC,uBAAuB,CAAC,CAqIlC"}

package/dist/validation/skills.js

@@ -13,6 +13,439 @@ async function isDirectory(path) {
         return false;
     }
 }
+async function isFile(path) {
+    try {
+        const s = await stat(path);
+        return s.isFile();
+    }
+    catch {
+        return false;
+    }
+}
+async function listMarkdownFiles(root) {
+    if (!(await isDirectory(root))) {
+        return [];
+    }
+    const files = [];
+    for (const entry of await readdir(root, { withFileTypes: true })) {
+        const path = join(root, entry.name);
+        if (entry.isDirectory()) {
+            files.push(...(await listMarkdownFiles(path)));
+        }
+        else if (entry.isFile() && entry.name.endsWith('.md')) {
+            files.push(path);
+        }
+    }
+    return files.sort();
+}
+function countOccurrences(content, anchor) {
+    if (anchor.length === 0) {
+        return 0;
+    }
+    let count = 0;
+    let offset = 0;
+    while ((offset = content.indexOf(anchor, offset)) !== -1) {
+        count += 1;
+        offset += anchor.length;
+    }
+    return count;
+}
+function isLifecycleSafetyFile(file) {
+    return (/\/\.agents\/skills\/(?:oat-project-[^/]+|oat-worktree-[^/]+|oat-brainstorm|oat-wave-execute)\//.test(file) || file.endsWith('/.agents/agents/oat-phase-implementer.md'));
+}
+function referencesProjectArtifactVariable(line, artifactArrays = new Set()) {
+    if (/\$PROJECT_PATH|\$\{PROJECT_PATH\}|\{PROJECT_PATH\}|\$ARTIFACT_PATH|\$\{ARTIFACT_PATH\}|\$ACTIVE_PROJECT(?!_PATH)|\$\{ACTIVE_PROJECT\}|\$REVIEW_PATH|\$\{REVIEW_PATH\}|\$\{(?:PROJECT|RETRO)_[A-Z0-9_]*(?:PATHS|FILES)\[@\]\}/.test(line)) {
+        return true;
+    }
+    return [...artifactArrays].some((name) => line.includes(`\${${name}[@]}`));
+}
+function projectArtifactArrays(content) {
+    const arrays = new Set();
+    let changed = true;
+    while (changed) {
+        changed = false;
+        for (const { content: line } of logicalLines(content)) {
+            const assignment = /^\s*([A-Z][A-Z0-9_]*)(?:\+)?=\((.*)\)\s*$/.exec(line);
+            const name = assignment?.[1];
+            const value = assignment?.[2];
+            if (name &&
+                value &&
+                !arrays.has(name) &&
+                referencesProjectArtifactVariable(value, arrays)) {
+                arrays.add(name);
+                changed = true;
+            }
+        }
+    }
+    return arrays;
+}
+function executesCommand(line, command) {
+    const prefix = '(?:(?:&&|\\|\\||;|\\bthen\\b|\\belse\\b|\\bdo\\b|\\bif\\b)\\s+)';
+    const modifiers = '(?:!\\s+)?(?:command\\s+)?(?:env\\s+)?(?:[A-Z][A-Z0-9_]*=\\S+\\s+)*';
+    return new RegExp(`^\\s*(?:(?:[A-Z][A-Z0-9_]*)=\\$\\()?${command}\\b|${prefix}${modifiers}${command}\\b`).test(line);
+}
+function executesGitCommand(line) {
+    return executesCommand(line, 'git');
+}
+function logicalLines(content) {
+    const physicalLines = content.split('\n');
+    const logical = [];
+    let offset = 0;
+    for (let index = 0; index < physicalLines.length; index += 1) {
+        const startLine = index;
+        const startOffset = offset;
+        let combined = physicalLines[index] ?? '';
+        offset += combined.length + 1;
+        while (/\\\s*$/.test(combined) && index + 1 < physicalLines.length) {
+            combined = combined.replace(/\\\s*$/, ' ');
+            index += 1;
+            const continuation = physicalLines[index] ?? '';
+            combined += continuation.trimStart();
+            offset += continuation.length + 1;
+        }
+        logical.push({
+            content: combined,
+            endLine: index,
+            offset: startOffset,
+            startLine,
+        });
+    }
+    return logical;
+}
+function isProjectArtifactWriterLine(line, artifactArrays = new Set()) {
+    const trimmed = line.trim();
+    const executesGitOrOat = executesGitCommand(trimmed) || executesCommand(trimmed, 'oat');
+    const writesProjectArtifact = executesGitOrOat &&
+        /\bgit\s+(?:add|commit)\b|\boat\s+project\s+push\b/.test(trimmed) &&
+        referencesProjectArtifactVariable(line, artifactArrays);
+    const writesActiveProject = executesGitOrOat && /\boat\s+config\s+set\s+activeProject\b/.test(trimmed);
+    return writesProjectArtifact || writesActiveProject;
+}
+function fencedContentSites(content) {
+    const lines = content.split('\n');
+    const sites = [];
+    let offset = 0;
+    let opening = null;
+    for (const line of lines) {
+        const lineEnd = offset + line.length;
+        const fenceMatch = line.match(/^\s*(`{3,}|~{3,})(?:[^`~]*)$/);
+        if (fenceMatch) {
+            const marker = fenceMatch[1] ?? '';
+            if (opening === null) {
+                opening = { marker, start: offset };
+            }
+            else if (marker[0] === opening.marker[0] &&
+                marker.length >= opening.marker.length &&
+                /^\s*[`~]+\s*$/.test(line)) {
+                const end = lineEnd;
+                sites.push({
+                    start: opening.start,
+                    end,
+                    content: content.slice(opening.start, end),
+                });
+                opening = null;
+            }
+        }
+        offset = lineEnd + 1;
+    }
+    return sites;
+}
+function contentSiteAt(content, offset, fencedSites) {
+    const fenced = fencedSites.find((site) => offset >= site.start && offset < site.end);
+    if (fenced)
+        return fenced;
+    const preceding = content.slice(0, offset);
+    const headings = [...preceding.matchAll(/^([#]{1,6})\s+.+$/gm)];
+    const heading = headings.at(-1);
+    if (heading?.index !== undefined) {
+        const level = heading[1]?.length ?? 6;
+        const following = content.slice(offset);
+        const nextHeading = [...following.matchAll(/^([#]{1,6})\s+.+$/gm)].find((candidate) => (candidate[1]?.length ?? 7) <= level);
+        const end = nextHeading?.index === undefined
+            ? content.length
+            : offset + nextHeading.index;
+        return {
+            start: heading.index,
+            end,
+            content: content.slice(heading.index, end),
+        };
+    }
+    const start = content.lastIndexOf('\n', Math.max(0, offset - 1)) + 1;
+    const nextNewline = content.indexOf('\n', offset);
+    const end = nextNewline === -1 ? content.length : nextNewline;
+    return { start, end, content: content.slice(start, end) };
+}
+function projectArtifactWriterSites(content) {
+    const fencedSites = fencedContentSites(content);
+    const sites = new Map();
+    const artifactArrays = projectArtifactArrays(content);
+    for (const line of logicalLines(content)) {
+        if (isProjectArtifactWriterLine(line.content, artifactArrays)) {
+            const site = contentSiteAt(content, line.offset, fencedSites);
+            sites.set(`${site.start}:${site.end}`, site);
+        }
+    }
+    return [...sites.values()];
+}
+function collectSyncedContentFindings(file, content, findings) {
+    for (const match of content.matchAll(/PROJECT_SCOPE=\$\(oat project scope[^\n]+\) \|\| exit 1\n\s*\[\s*"?\$PROJECT_SCOPE"?\s*=\s*"?synced"?\s*\]\s*&&\s*oat\s+project\s+pull\b/g)) {
+        const lineNumber = content.slice(0, match.index).split('\n').length + 1;
+        findings.push({
+            file,
+            message: `Line ${lineNumber}: Synced arrival pull must use an if block so shared and local arrival exits successfully`,
+        });
+    }
+    const logical = logicalLines(content);
+    const artifactArrays = projectArtifactArrays(content);
+    for (const [logicalIndex, site] of logical.entries()) {
+        const line = site.content;
+        const lineNumber = site.startLine + 1;
+        if (/\bgit\s+add\b[^\n]*\.oat\/projects\/synced(?:\/|\b)/.test(line)) {
+            findings.push({
+                file,
+                message: `Line ${lineNumber}: Never stage a path under .oat/projects/synced/; use oat project push`,
+            });
+        }
+        if (/\boat\s+project\s+scope\b/.test(line) &&
+            (/--json\b/.test(line) || /\|[^\n]*\bjq\b/.test(line))) {
+            findings.push({
+                file,
+                message: `Line ${lineNumber}: Resolve project scope with --format value; do not parse --json or pipe into jq`,
+            });
+        }
+        if (isLifecycleSafetyFile(file) &&
+            executesGitCommand(line) &&
+            /\bgit\s+add\s+-A(?:\s*$|\s*[;&|])/.test(line)) {
+            findings.push({
+                file,
+                message: `Line ${lineNumber}: Project-artifact staging must use exact pathspecs; broad git add -A is forbidden`,
+            });
+        }
+        if (isLifecycleSafetyFile(file) &&
+            executesGitCommand(line) &&
+            /\bgit\s+add\b/.test(line) &&
+            /(?:\$PROJECT_PATH|\$\{PROJECT_PATH\})(?:\/?(?:\*|\*\*)?)?(?:["'}\s]|$)/.test(line) &&
+            !/\$PROJECT_PATH\/[A-Za-z0-9_.-]+|\$\{PROJECT_PATH\}\/[A-Za-z0-9_.-]+/.test(line)) {
+            findings.push({
+                file,
+                message: `Line ${lineNumber}: Project-artifact staging must name exact files, not the project directory or a glob`,
+            });
+        }
+        const pushReceipt = /^\s*([A-Z][A-Z0-9_]*)=\$\(oat project push\b[^\n]*--json\b/.exec(line);
+        if (pushReceipt) {
+            const outputVariable = pushReceipt[1] ?? '';
+            const validationLines = logical
+                .slice(logicalIndex + 1, logicalIndex + 5)
+                .map((candidate) => candidate.content);
+            const parserNeedle = `parse_synced_push_receipt "$${outputVariable}"`;
+            const parserOffset = validationLines.findIndex((candidate) => candidate.includes(parserNeedle));
+            if (parserOffset === -1) {
+                findings.push({
+                    file,
+                    message: `Line ${lineNumber}: Synced push JSON receipt must validate status as pushed or up-to-date and require a full SHA before use`,
+                });
+            }
+            else {
+                for (const [offset, candidate] of validationLines
+                    .slice(0, parserOffset)
+                    .entries()) {
+                    if (candidate.includes(`$${outputVariable}`) &&
+                        /(?:\.sha\b|\[['"]sha['"]\])/.test(candidate)) {
+                        findings.push({
+                            file,
+                            message: `Line ${lineNumber + offset + 1}: Synced push JSON receipt must not extract or use .sha before parse_synced_push_receipt validation`,
+                        });
+                    }
+                }
+            }
+        }
+        if (/\boat\s+project\s+scope\b/.test(line) &&
+            /\|\|\s*echo\s+["']?shared\b/.test(line)) {
+            findings.push({
+                file,
+                message: `Line ${lineNumber}: Project scope resolution must fail closed; do not fall back to shared`,
+            });
+        }
+        const isPushCommand = executesCommand(line, 'oat') && /\boat\s+project\s+push\b/.test(line);
+        const pushFailureHandled = /\|\|\s*(?:\{|exit\b)/.test(line) ||
+            ((line.match(/"/g)?.length ?? 0) % 2 === 1 &&
+                logical
+                    .slice(logicalIndex + 1, logicalIndex + 16)
+                    .some((candidate) => /"\s*\|\|\s*(?:\{|exit\b)/.test(candidate.content)));
+        if (isPushCommand && !pushFailureHandled) {
+            findings.push({
+                file,
+                message: `Line ${lineNumber}: Project push must handle a nonzero exit explicitly and stop bookkeeping`,
+            });
+        }
+    }
+    const lines = content.split('\n');
+    const logicalByStart = new Map(logical.map((line) => [line.startLine, line.content]));
+    const continuedLines = new Set(logical.flatMap((line) => Array.from({ length: line.endLine - line.startLine }, (_, offset) => line.startLine + offset + 1)));
+    let fenceMarker = null;
+    let scopeGuardSeen = false;
+    for (const [index, line] of lines.entries()) {
+        const lineNumber = index + 1;
+        const fenceMatch = line.match(/^\s*(`{3,}|~{3,})(?:[^`~]*)$/);
+        if (fenceMatch) {
+            const marker = fenceMatch[1] ?? '';
+            if (fenceMarker === null) {
+                fenceMarker = marker;
+                scopeGuardSeen = false;
+            }
+            else if (marker[0] === fenceMarker[0] &&
+                marker.length >= fenceMarker.length &&
+                /^\s*[`~]+\s*$/.test(line)) {
+                fenceMarker = null;
+                scopeGuardSeen = false;
+            }
+            continue;
+        }
+        if (continuedLines.has(index))
+            continue;
+        const inspectedLine = logicalByStart.get(index) ?? line;
+        if (fenceMarker === null || !isLifecycleSafetyFile(file)) {
+            continue;
+        }
+        if (/\boat\s+project\s+scope\b/.test(inspectedLine) &&
+            /--format\s+value\b/.test(inspectedLine)) {
+            scopeGuardSeen = true;
+        }
+        if (/\bPROJECT_SCOPE\b/.test(inspectedLine) &&
+            /\bsynced\b/.test(inspectedLine)) {
+            scopeGuardSeen = true;
+        }
+        if (/\bgit\s+(?:add|commit)\b/.test(inspectedLine) &&
+            referencesProjectArtifactVariable(inspectedLine, artifactArrays) &&
+            !scopeGuardSeen) {
+            findings.push({
+                file,
+                message: `Line ${lineNumber}: Project-artifact git writes require an oat project scope --format value guard earlier in the same fenced block`,
+            });
+        }
+    }
+}
+async function collectSyncedBookkeepingInventoryFindings(repoRoot, safetyFiles, findings) {
+    const inventoryPath = join(repoRoot, 'packages', 'cli', 'src', 'validation', 'synced-bookkeeping-sites.json');
+    if (!(await isFile(inventoryPath))) {
+        return;
+    }
+    let sites;
+    try {
+        const parsed = JSON.parse(await readFile(inventoryPath, 'utf8'));
+        if (!Array.isArray(parsed)) {
+            throw new Error('expected a JSON array');
+        }
+        sites = parsed;
+    }
+    catch (error) {
+        findings.push({
+            file: inventoryPath,
+            message: `Invalid synced-bookkeeping inventory: ${error instanceof Error ? error.message : String(error)}`,
+        });
+        return;
+    }
+    const inventoriedWriterSites = new Map();
+    for (const site of sites) {
+        if (typeof site?.file !== 'string' ||
+            typeof site?.anchor !== 'string' ||
+            typeof site?.guard !== 'string' ||
+            !['resolve', 'arrival', 'write'].includes(site?.kind)) {
+            findings.push({
+                file: inventoryPath,
+                message: 'Each synced-bookkeeping inventory entry requires file, unique anchor, companion guard, and kind (resolve | arrival | write)',
+            });
+            continue;
+        }
+        const sitePath = join(repoRoot, site.file);
+        let content;
+        try {
+            content = await readFile(sitePath, 'utf8');
+        }
+        catch {
+            findings.push({
+                file: inventoryPath,
+                message: `Missing synced-bookkeeping inventory file: ${sitePath}`,
+            });
+            continue;
+        }
+        const occurrences = countOccurrences(content, site.anchor);
+        if (occurrences === 0) {
+            findings.push({
+                file: inventoryPath,
+                message: `Stale synced-bookkeeping inventory anchor in ${sitePath}: ${site.anchor}`,
+            });
+        }
+        else if (occurrences > 1) {
+            findings.push({
+                file: inventoryPath,
+                message: `Synced-bookkeeping inventory anchor is not unique in ${sitePath}: ${site.anchor}`,
+            });
+        }
+        if (occurrences === 1) {
+            const fencedSites = fencedContentSites(content);
+            const anchorOffset = content.indexOf(site.anchor);
+            const anchorSite = contentSiteAt(content, anchorOffset, fencedSites);
+            const companionGuardPresent = site.kind === 'write' && site.guard === 'project-scope'
+                ? /\boat\s+project\s+scope\b[^\n]*--format\s+value\b|\bPROJECT_SCOPE\b[^\n]*\bsynced\b/.test(anchorSite.content)
+                : site.kind === 'arrival' && site.guard === 'materialized-arrival'
+                    ? /\boat\s+project\s+pull\b|pulled and materialized/i.test(anchorSite.content)
+                    : site.kind === 'resolve' && site.guard === 'canonical-resolution'
+                        ? /\bresolve(?:Project|NamedProject|SyncedTarget|ProjectScope|ActiveProject)\b|\bprojectScope\s*===\s*['"]synced['"]|options\.remote[^\n]*synced|\boat\s+project\s+new\b[^\n]*--scope\b|project:synced_tracked_artifacts|\boat\s+config\s+get\s+activeProject\b/.test(anchorSite.content)
+                        : anchorSite.content.includes(site.guard);
+            if (!companionGuardPresent) {
+                findings.push({
+                    file: inventoryPath,
+                    message: `Synced-bookkeeping ${site.kind} site lacks its companion guard in the same function or fenced block: ${sitePath}: ${site.anchor}`,
+                });
+            }
+            if (site.kind === 'write') {
+                const fileSites = inventoriedWriterSites.get(sitePath) ?? [];
+                fileSites.push(anchorSite);
+                inventoriedWriterSites.set(sitePath, fileSites);
+            }
+        }
+    }
+    for (const file of safetyFiles) {
+        const content = await readFile(file, 'utf8');
+        if (!isLifecycleSafetyFile(file))
+            continue;
+        const inventoriedSites = inventoriedWriterSites.get(file) ?? [];
+        const writerSites = projectArtifactWriterSites(content);
+        const artifactArrays = projectArtifactArrays(content);
+        if (writerSites.length > 0 && inventoriedSites.length === 0) {
+            findings.push({
+                file: inventoryPath,
+                message: `Lifecycle project-artifact writer is missing from synced-bookkeeping inventory: ${file}`,
+            });
+            continue;
+        }
+        for (const writerSite of writerSites) {
+            if (inventoriedSites.some((site) => site.start === writerSite.start && site.end === writerSite.end)) {
+                continue;
+            }
+            const writer = writerSite.content
+                .split('\n')
+                .find((line) => isProjectArtifactWriterLine(line, artifactArrays))
+                ?.trim();
+            findings.push({
+                file: inventoryPath,
+                message: `Lifecycle project-artifact writer site is missing from synced-bookkeeping inventory: ${file}: ${writer ?? '(unknown writer)'}`,
+            });
+        }
+    }
+}
+async function collectSyncedSafetyFindings(repoRoot, oatSkillDirs, findings) {
+    const skillFiles = (await Promise.all(oatSkillDirs.map((dir) => listMarkdownFiles(join(repoRoot, '.agents', 'skills', dir))))).flat();
+    const phaseImplementerPath = join(repoRoot, '.agents', 'agents', 'oat-phase-implementer.md');
+    const safetyFiles = (await isFile(phaseImplementerPath))
+        ? [...skillFiles, phaseImplementerPath]
+        : skillFiles;
+    for (const file of safetyFiles) {
+        collectSyncedContentFindings(file, await readFile(file, 'utf8'), findings);
+    }
+    await collectSyncedBookkeepingInventoryFindings(repoRoot, safetyFiles, findings);
+}
 function frontmatterHasKey(frontmatter, key) {
     const re = new RegExp(`^${key}:`, 'm');
     return re.test(frontmatter);
@@ -299,6 +732,7 @@ export async function validateOatSkills(repoRoot, options = {}, dependencies = {
             validateQuickStartSemantics(skillPath, content, findings);
         }
     }
+    await collectSyncedSafetyFindings(repoRoot, oatSkillDirs, findings);
     await collectGateabilityFindings(skillsRoot, options.gateSkillNames, findings);
     if (options.baseRef) {
         const changedSkillFiles = await listChangedSkillFiles(repoRoot, options.baseRef, dependencies);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-agent-toolkit/cli",
-  "version": "0.2.41",
+  "version": "0.2.46",
   "private": false,
   "description": "Open Agent Toolkit CLI",
   "homepage": "https://github.com/voxmedia/open-agent-toolkit/tree/main/packages/cli",
@@ -34,7 +34,7 @@
     "ora": "^9.0.0",
     "yaml": "2.8.2",
     "zod": "^3.25.76",
-    "@open-agent-toolkit/control-plane": "0.2.41"
+    "@open-agent-toolkit/control-plane": "0.2.46"
   },
   "devDependencies": {
     "@types/node": "^22.10.0",
@@ -48,7 +48,7 @@
     "node": ">=22.17.0"
   },
   "scripts": {
-    "build": "bash scripts/bundle-assets.sh && tsc && tsc-alias && chmod +x dist/index.js && touch dist/index.js",
+    "build": "bash scripts/bundle-assets.sh && { [ ! -d dist ] || find dist -type d -name __tests__ -prune -exec rm -rf {} +; } && tsc && tsc-alias && chmod +x dist/index.js && touch dist/index.js",
     "clean": "rm -rf dist tsconfig.tsbuildinfo",
     "dev": "tsx watch src/index.ts",
     "check": "oxlint . && oxlint --type-aware -A all -D typescript/no-floating-promises -D typescript/no-misused-promises --ignore-pattern '**/*.test.ts' --ignore-pattern '**/*.spec.ts' . && oxfmt --check .",
@@ -60,6 +60,6 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
-    "type-check": "tsc --noEmit"
+    "type-check": "tsc --noEmit && tsc -p tsconfig.test-support.json"
   }
 }

package/dist/__tests__/skills/split-flow-fixtures.d.ts

@@ -1,50 +0,0 @@
-import { type SplitChildInput, type SplitPayload, type SplitPlanDocument } from '../../projects/split/child-plan.js';
-import { type Signal } from '../../projects/split/signals.js';
-export type TranscriptSpeaker = 'assistant' | 'user';
-export interface TranscriptTurn {
-    speaker: TranscriptSpeaker;
-    text: string;
-}
-export type StubbedUserChoice = 'broad-first' | 'children-known' | 'decompose-children' | 'inline-only' | 'keep-one-project' | 'promote-n-projects' | 'split-now';
-export interface StubbedQuestion {
-    id: string;
-    prompt: string;
-    options: string[];
-    response: StubbedUserChoice;
-}
-export interface TranscriptFixture {
-    transcript: TranscriptTurn[];
-    parentSlug: string;
-    children: SplitChildInput[];
-    discoveryPath?: string;
-    inheritedContext?: string;
-    integrationSketch?: string;
-}
-export declare const SPLIT_HANDOFF_TARGET: {
-    readonly skill: 'oat-project-split';
-    readonly hookCreatesProjects: false;
-    readonly responsibilities: readonly ['normalize-split-plan', 'write-coordination-parent', 'scaffold-children', 'activate-initial-child'];
-};
-export declare function inferSplitSignals(transcript: TranscriptTurn[]): Signal[];
-export declare function runDiscoverDetectionFixture(fixture: TranscriptFixture, responses: Record<string, StubbedUserChoice>): {
-    asked: StubbedQuestion[];
-    confidence: 'below' | 'high' | 'soft';
-    decision?: StubbedUserChoice;
-    document?: SplitPlanDocument;
-    payload?: SplitPayload;
-    triggered: boolean;
-};
-export declare function runDeclaredBrainstormFixture(fixture: TranscriptFixture, responses: Record<string, StubbedUserChoice>): {
-    asked: StubbedQuestion[];
-    document?: SplitPlanDocument;
-    handoffTarget: typeof SPLIT_HANDOFF_TARGET;
-    payload?: SplitPayload;
-};
-export declare function runBrainstormPickerFixture(fixture: TranscriptFixture, responses: Record<string, StubbedUserChoice>): {
-    asked: StubbedQuestion[];
-    document?: SplitPlanDocument;
-    handoffTarget: typeof SPLIT_HANDOFF_TARGET;
-    options: string[];
-    payload?: SplitPayload;
-};
-//# sourceMappingURL=split-flow-fixtures.d.ts.map

package/dist/__tests__/skills/split-flow-fixtures.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"split-flow-fixtures.d.ts","sourceRoot":"","sources":["../../../src/__tests__/skills/split-flow-fixtures.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAmB,KAAK,MAAM,EAAE,MAAM,8BAA8B,CAAC;AAE5E,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,MAAM,CAAC;AAErD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,iBAAiB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,iBAAiB,GACzB,aAAa,GACb,gBAAgB,GAChB,oBAAoB,GACpB,aAAa,GACb,kBAAkB,GAClB,oBAAoB,GACpB,WAAW,CAAC;AAEhB,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,iBAAiB,CAAC;CAC7B;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,oBAAoB;aAC/B,KAAK,EAAE,mBAAmB;aAC1B,mBAAmB;aACnB,gBAAgB,YACd,sBAAsB,EACtB,2BAA2B,EAC3B,mBAAmB,EACnB,wBAAwB;CAElB,CAAC;AAsBX,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,cAAc,EAAE,GAAG,MAAM,EAAE,CA+BxE;AAED,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,iBAAiB,EAC1B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAC3C;IACD,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,UAAU,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;IACtC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,SAAS,EAAE,OAAO,CAAC;CACpB,CAqDA;AAED,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,iBAAiB,EAC1B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAC3C;IACD,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,aAAa,EAAE,OAAO,oBAAoB,CAAC;IAC3C,OAAO,CAAC,EAAE,YAAY,CAAC;CACxB,CAmCA;AAED,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,iBAAiB,EAC1B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAC3C;IACD,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,aAAa,EAAE,OAAO,oBAAoB,CAAC;IAC3C,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,YAAY,CAAC;CACxB,CA4CA"}