@open-agent-toolkit/cli 0.2.45 → 0.2.47

package/assets/bundle-metadata.json

@@ -1,4 +1,4 @@
 {
   "schemaVersion": 1,
-  "oatVersion": "0.2.45"
+  "oatVersion": "0.2.47"
 }

package/assets/docs/cli-utilities/tool-packs.md

@@ -92,6 +92,25 @@ still fail closed with the owning pack's install or update command. See
 [Writing Skills → Portable sibling reads](../contributing/skills.md#portable-sibling-reads-skills-and-agents)
 for the full contract.
 
+Skills that read a fixed canonical workflows role use a different, local
+`${AGENT_PROVIDER_ROOT}` binding. They try the loaded skill's provider root,
+then `${HOME}/.agents`, then the repository's `.agents` root. The loaded tier
+qualifies only when the exact unsuffixed `agents/<canonical-name>.md` target is
+the same-scope canonical Markdown file or a symlink resolving exactly to it.
+Copies, broken or escaping links, Cursor model/effort variants, and Codex TOML
+roles are misses; resolution continues to the next tier.
+
+That binding only locates canonical source instructions for the one owning
+dependency. It does not select a provider, model, effort, variant, route, or
+native agent. Resolve simultaneous pack dependencies independently. If every
+workflows candidate misses, stop before fallback dispatch and report the
+intended-scope recovery explicitly:
+
+```bash
+oat tools install workflows --scope <user|project>
+oat tools update --pack workflows --scope <user|project>
+```
+
 The packs remain independently installable. If the workflows adapter is
 present without the utility contracts, it fails closed and reports the missing
 dependency instead of inventing a fallback route. Non-project analytical
@@ -140,6 +159,12 @@ Two independent facts describe a pack:
   release manifest declares for that pack and scope, its presence, and its
   version or content digest.
 
+Versioned skills and agents must match on both version metadata and canonical
+content. A same-version content change is therefore reported as outdated rather
+than current. Content comparison ignores the executable-bit normalization OAT
+intentionally applies while materializing managed scripts, but still detects
+file content, entry-type, and symlink-target changes.
+
 Commands report both. `oat tools list` and `oat tools info` show placement,
 intent source, and completeness. `oat status` and `oat doctor` report drift
 between intent and inventory with a scoped recovery command.
@@ -182,11 +207,12 @@ without qualification. Install the pack at **project scope** when you need its
 agents; `oat tools update` cannot repair this, because it is a scope limitation
 rather than drift.
 
-Repository templates under `.oat/templates/` are **owner overrides**. Once a
-project-scope template exists, OAT will not rewrite it: the managed default now
-lives at user scope and in the bundle. Delete the repository copy to resume
-managed-default behavior. `oat status` and `oat doctor` report retained
-overrides so the divergence is visible rather than silent.
+Repository templates under `.oat/templates/` are **owner-owned seeds**. OAT
+compares a source-backed seed with its bundled default: a byte-equivalent copy
+is reported as current, while an edited copy is retained and reported as a
+`retained-override`. OAT will not rewrite the retained copy. Delete a repository
+template only when you intentionally want the bundled default seeded again;
+never delete edited mutable seed content merely to clear the diagnostic.
 
 ### Evolving pack membership
 
@@ -454,8 +480,15 @@ Key behavior:
 - Every pack's fresh-install default is user scope (`defaultScope` in the release manifest); existing installs keep their current placement on re-install, so a re-install never moves a pack between scopes or creates a second copy at the other one. This applies to the per-pack subcommands too: a bare `oat tools install docs` in a repository where `docs` is already at project scope stays at project scope, and only an explicit `--scope` overrides that
 - Removing a pack from a scope happens only when you explicitly choose a narrower end-state in the interactive flow (e.g. a pack at `both` set to `project` only). All staged removals are shown in a single change summary and applied only after one batch confirmation — declining makes no changes
 - Non-interactive installs (including `--scope project`, `--scope user`, and the default pack set) are strictly additive and never remove a pack from a scope. Removal is interactive-only
-- Tracks installed vs bundled skill versions and reports outdated skills
+- Tracks installed versus bundled skill and agent versions and canonical
+  content, reporting same-version content drift as outdated while ignoring
+  expected executable-bit normalization
 - Writes pack intent into the config file for the scope you installed into: a project install sets `tools.<pack>: true` in `.oat/config.json`, and a user install sets it in `~/.oat/config.json`. A user-only install never writes repository config
+- When a project install discovers existing project-scoped packs whose intent
+  is missing, it writes those exact intents in canonical pack order. Human
+  output prints `Adopted project tool pack: <pack>` once per adopted pack;
+  JSON output adds `adoptedPacks` only when the list is non-empty. This is pack
+  intent reconciliation, not repository PJM adoption
 - A user-only install needs no Git repository and performs no repository writes
 - Refreshes the managed `OAT tools` section in the repository-root `AGENTS.md` **only for project-scope runs of the aggregate `oat tools install`**. The per-pack subcommands (`oat tools install workflows`, `oat tools install docs`, and the rest) never write `AGENTS.md`, at either scope
 - Repository `AGENTS.md` guidance for project management is owned by adoption, not by pack placement. Installing the `project-management` pack no longer upserts a managed `OAT project-management` section; `oat pjm init` writes that repository guidance when the repository actually adopts PJM
@@ -474,12 +507,17 @@ Key behavior:
 
 - Accepts a tool name, `--pack <pack>`, or `--all` (mutually exclusive)
 - With no target, exits without mutation and suggests the explicit bulk command `oat tools update --all`; invalid packs and conflicting targets keep their own targeted diagnostics
-- Compares installed versions against bundled versions and copies updated assets
+- Compares installed versions and canonical content against bundled assets and
+  copies updates; equal version metadata does not hide content drift
 - For `--pack <pack>` and `--all`, an already-installed pack is reconciled to the **current** release membership in the scopes where it is installed, adding newly bundled skills, agents, templates, and scripts
 - A pack whose managed assets are all missing but whose intent is still declared is repaired from intent rather than skipped
 - Managed template and script companions are refreshed at **user** scope. A project-scope repository template is an owner override and is left alone
 - Non-versioned assets are compared by content digest, so an identical refresh is a no-op instead of a rewrite
 - Update persists inferred legacy intent only after a successful explicit mutation, so a read never rewrites your config
+- A successful project-scope update reports the exact newly adopted legacy pack
+  intents in canonical order. Human output uses
+  `Adopted project tool pack: <pack>`; JSON output adds the optional
+  `adoptedPacks` array only when at least one intent was written
 - `--scope all` outside a Git repository completes the user-scope work instead of failing. Unlike `oat status` and `oat doctor`, update skips project scope silently and does not name it in the result; an explicitly requested `--scope project` outside a repository is still a hard failure
 - Dry-run mode with `--dry-run`; auto-sync after mutations by default
 - Use `--no-sync` to skip auto-sync
@@ -735,8 +773,9 @@ Removal and migration use the symmetric contract: the follow-up sync prunes exac
 User-scope tool packs and explicit PJM adoption changed several defaults and
 exit codes. Nothing here is data-destructive, and legacy config keeps working —
 `tools.<pack>: false` still parses, complete pre-adoption PJM scaffolds are
-grandfathered as `inferred-legacy`, and no CLI flag was removed or renamed. But
-several commands you already run behave differently.
+grandfathered as `inferred-legacy`, and existing installs remain additive. One
+inert per-pack install flag was removed, and several commands you already run
+behave differently.
 
 ### Install scope defaults flipped to user
 
@@ -781,6 +820,26 @@ is not installed. Test for a truthy value instead. Legacy `false` values that
 already exist in a config file are still read (see
 [Legacy `false` intent](#legacy-false-intent)) — they are just never written.
 
+Direct config writes now enforce the same true-or-absent contract.
+`oat config set tools.<pack> false` exits `1` without changing the config. To
+remove a project-scoped pack and clear its intent, run:
+
+```bash
+oat tools remove --pack <pack> --scope project
+```
+
+Existing legacy `false` values remain readable migration input.
+
+### Per-pack install `--force` was removed
+
+`oat tools install <pack> --force` is now rejected as an unknown option. The
+flag was inert in the unified additive lifecycle. To reconcile installed
+assets, use the scoped update command instead:
+
+```bash
+oat tools update --pack <pack> --scope <scope>
+```
+
 ### Per-pack install `--json` changed shape
 
 The per-pack subcommands (`oat tools install docs`, `oat tools install
@@ -803,6 +862,12 @@ above. The previous single-scope payload's `scope`, `targetRoot`, `assetsRoot`,
 keying on them reads `undefined` rather than failing. Read `scopes` for the
 scopes acted on, and `results[].request.scopeRoot` for the target root of each.
 
+When a project-scope aggregate install, direct pack install, or update adopts
+missing legacy pack intents, the same single payload also contains
+`"adoptedPacks": ["docs", "workflows"]`. The field is omitted when nothing was
+adopted, and entries follow the manifest's canonical pack order. Human output
+reports the same set as one `Adopted project tool pack: <pack>` line per pack.
+
 ### Other behavior changes worth knowing
 
 - `oat tools remove --pack <pack>` deletes every managed asset the release

package/assets/docs/contributing/skills.md

@@ -51,6 +51,37 @@ Probe each candidate for the exact target and use the first match. If none
 exists, name the missing sibling, give an actionable install or update command,
 and stop that workflow branch instead of improvising the sibling's process.
 
+### Skills bind canonical agent reads through a local provider root
+
+When a skill must read one fixed canonical role instruction, bind a local
+`${AGENT_PROVIDER_ROOT}` for that dependency in this order:
+
+1. Derive `${SKILL_DIR}/../..` from the loaded skill path, but admit it only
+   when the exact unsuffixed `agents/<canonical-name>.md` target is the
+   same-scope canonical Markdown file or a symlink whose real path is exactly
+   that file.
+2. Try the user-scope root at `${HOME}/.agents`.
+3. Fall back to the project-scope root at `<repo-root>/.agents`.
+
+An invalid loaded target is a candidate miss, so resolution continues to the
+user and project roots. Regular provider copies, broken or escaping symlinks,
+transformed content, other role names, model/effort/variant-suffixed files, and
+`.codex/agents/*.toml` are never canonical candidates. Claude and Cursor base
+role symlinks can qualify when they resolve exactly to the same-scope canonical
+file; Cursor materialized variants cannot.
+
+`${AGENT_PROVIDER_ROOT}` is local authored-instruction notation, not a global
+environment variable or a provider-native role selector. It has no authority
+over provider, model, effort, variant, route, or dispatch choice. Resolve every
+owning pack independently, even when multiple role dependencies coexist. If
+all candidates miss for a workflows-owned role, stop before fallback launch
+and report both recovery forms for the intended scope:
+
+```bash
+oat tools install workflows --scope <user|project>
+oat tools update --pack workflows --scope <user|project>
+```
+
 ### Materialized agents resolve in two steps
 
 Canonical agents are materialized into provider-specific views — Codex receives
@@ -88,21 +119,26 @@ dependency.
 
 ### The ratchet allows only exact historical baselines
 
-Do not use a bare `.agents/skills/<sibling>/SKILL.md`, `./.agents/...`, or
-`../.agents/...` path for an executable read in any user-default skill or
-agent. The bundled-docs contract test enforces this over the whole
-manifest-derived surface and reports each violation as exact
-`source -> target` evidence.
-
-The only exemption is a pinned historical baseline: non-executable evidence
-such as a dogfood transcript or a fixture README, recorded by exact source
-file, target skill, and target path. There is no wildcard, directory-wide, or
-skill-wide allowance, and no temporary migration allowlist — executable debt is
-fixed at the caller instead of being exempted. The same assertions run against
-the bundled CLI copies of both skills and agents, and the sync contract test
-re-checks the roles it materializes for Codex, so a canonical fix must survive
-bundling and Codex sync as well. No test yet gates the generated `.claude` or
-`.cursor` agent views, so regenerate and spot-check those by hand.
+Do not use a bare `.agents/skills/<sibling>/SKILL.md`,
+`.agents/agents/<canonical-name>.md`, dot-relative equivalent, or repeated-parent
+canonical `agents/<canonical-name>.md` hop for an executable read in any
+user-default skill or agent. The bundled-docs contract test enforces this over
+the whole manifest-derived surface and reports each violation as exact
+`source -> target` evidence. Executable agent findings have a zero baseline, so
+every bare canonical-agent read fails the ratchet. Portable
+`${AGENT_PROVIDER_ROOT}/agents/...` reads and legitimate `.claude` or `.cursor`
+provider-view examples are classified as non-findings.
+
+The pinned historical baseline applies only to skill findings: its six exact
+entries are non-executable evidence such as dogfood transcripts or fixture
+READMEs, recorded by source file, target skill, and target path. There is no
+wildcard, directory-wide, or skill-wide allowance, and no temporary migration
+allowlist — executable debt is fixed at the caller instead of being exempted.
+The same assertions run against the bundled CLI copies of both skills and
+agents, and the sync contract test re-checks the roles it materializes for
+Codex, so a canonical fix must survive bundling and Codex sync as well. No test
+yet gates the generated `.claude` or `.cursor` agent views, so regenerate and
+spot-check those by hand.
 
 ## Contract components
 

package/assets/docs/reference/troubleshooting.md

@@ -77,8 +77,10 @@ Use [Instruction Sync](../provider-sync/instruction-sync.md) for the full strate
 
 - Run `oat init tools` to install/update bundled OAT tool packs.
 - In TTY mode, select which outdated skills to update when prompted.
-- In non-interactive mode, rerun the relevant pack subcommand with `--force` if you want to overwrite outdated installed skills.
-- For pack-level drift rather than a single skill, prefer the scoped command doctor prints: `oat tools update --pack <pack> --scope <scope>`.
+- In non-interactive mode, run the scoped command doctor prints:
+  `oat tools update --pack <pack> --scope <scope>`.
+- Per-pack install commands no longer accept the previously inert `--force`
+  option.
 
 ## `sync` reports an unsafe provider parent
 
@@ -147,18 +149,23 @@ Both commands report managed pack state with a scoped recovery command:
 
 - `partial` — some managed assets are missing, or intent is declared with none
   installed. Fix with `oat tools update --pack <pack> --scope <scope>`.
-- `stale` — installed assets are behind the bundled release. Same fix.
+- `stale` — installed assets are behind the bundled release, or a managed skill
+  or agent has the bundled version metadata but different canonical content.
+  Expected executable-bit normalization on managed scripts is ignored. Fix with
+  the same scoped update command.
 - `newer` — installed assets are ahead of the bundle. This is informational and
   usually means the CLI is older than the assets; update the CLI rather than
   downgrading the pack.
-- `retained-override` — an owner-owned seeded asset exists at the scope, so the
-  managed default is intentionally not applied there. This covers repository
-  templates under `.oat/templates/` **and** seeded content such as
-  `.oat/ideas/backlog.md` and `.oat/ideas/scratchpad.md`. Deleting the file is
-  the right move only for a **template** you want OAT to manage again; never
-  delete seeded content you have edited, because the next install or update
-  reseeds the bundled default in its place and your edits are gone. The finding
-  is informational and carries no recovery command for exactly that reason.
+- `retained-override` — a source-backed owner-owned seed differs from its
+  bundled default, so OAT retains the edited copy instead of overwriting it. A
+  bundle-equal seed is current and does not produce this finding. Retained
+  overrides cover repository templates under `.oat/templates/` **and** seeded
+  content such as `.oat/ideas/backlog.md` and `.oat/ideas/scratchpad.md`.
+  Deleting the file is the right move only for a **template** you intentionally
+  want OAT to seed from the bundle again; never delete seeded content you have
+  edited, because the next install or update reseeds the bundled default in its
+  place and your edits are gone. The finding is informational and carries no
+  recovery command for exactly that reason.
 - `user-agent-unmaterialized` — the pack installed canonical agents into
   `~/.agents/agents/`, but user scope materializes no provider view for them
   beyond the bundled managed role files. `oat tools update` cannot fix this.

package/assets/public-package-versions.json

@@ -1,6 +1,6 @@
 {
-  "cli": "0.2.45",
-  "docs-config": "0.2.45",
-  "docs-theme": "0.2.45",
-  "docs-transforms": "0.2.45"
+  "cli": "0.2.47",
+  "docs-config": "0.2.47",
+  "docs-theme": "0.2.47",
+  "docs-transforms": "0.2.47"
 }

package/assets/skills/oat-project-implement/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: oat-project-implement
-version: 2.3.0
+version: 2.3.1
 description: Use when plan.md is ready for execution. Dispatches one phase implementer per phase, owns independent phase review and bounded fix routing, and supports plan-declared worktree-isolated parallel phases.
 oat_gateable: true
 argument-hint: '[--retry-limit <N>] [--dry-run]'

package/assets/skills/oat-project-implement/references/dispatch-and-dry-run.md

@@ -13,6 +13,32 @@ canonical.
 
 ### Step 0.5: Capability Detection and Tier Selection
 
+**Canonical fallback role instructions:** Before a fresh-child fallback can
+read either workflows-owned role, independently resolve each exact target. For
+`oat-phase-implementer`, bind the first valid root to
+`${IMPLEMENTER_AGENT_PROVIDER_ROOT}`; for `oat-reviewer`, bind the first valid
+root to `${REVIEWER_AGENT_PROVIDER_ROOT}`. For each role independently probe
+candidates in this order: `${SKILL_DIR}/../..`, `${HOME}/.agents`, then
+`<repo-root>/.agents`. Do not reuse one role's resolved root for the other.
+
+Each loaded candidate is valid only when the exact unsuffixed role target is
+the same-scope canonical file or a symlink whose realpath is exactly that
+canonical file. Treat a missing, broken, escaping, copied, transformed,
+suffixed, wrong-role, or otherwise noncanonical candidate as a miss and
+continue to the next candidate. If either required role misses every candidate,
+name that role, stop before the fresh-child fallback, and report
+`oat tools install workflows --scope <user|project>` or
+`oat tools update --pack workflows --scope <user|project>` for the intended
+scope.
+
+These canonical role instructions cannot change the immutable target,
+provider, model, effort, or variant fields selected by the resolver. Native
+dispatch sends the exact resolver-selected variant or `agent_type` first. A
+fresh child is allowed only after an explicit pre-start native role-selection
+rejection before any child starts. Once accepted, continue only through the existing
+handle; terminal results, including `BLOCKED`, never authorize replacement or
+fallback.
+
 **Mandatory target-first order:** Complete Dispatch Policy Preflight and
 resolve the concrete managed target before probing generic agent availability
 or locking Tier 1/Tier 2. A concrete target takes precedence over tier
@@ -22,9 +48,10 @@ native spawn API as native `agent_type`; spawn acceptance plus the constructed
 launcher payload is configured invocation evidence, and independent runtime
 telemetry or agent self-report is not required. Launch a fresh Codex child
 pinned to the resolver target's explicit model, reasoning effort, and
-canonical role instructions from `.agents/agents/oat-phase-implementer.md` or
-`.agents/agents/oat-reviewer.md` only after a native role-selection rejection
-as defined below.
+canonical role instructions from
+`${IMPLEMENTER_AGENT_PROVIDER_ROOT}/agents/oat-phase-implementer.md` or
+`${REVIEWER_AGENT_PROVIDER_ROOT}/agents/oat-reviewer.md` only after a native
+role-selection rejection as defined below.
 If that fresh child cannot be launched, fail closed and block; never
 substitute a base or coordinator role for a managed phase target. Inline
 execution is allowed only with verified equivalent current-host model and

package/assets/skills/oat-project-plan-writing/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: oat-project-plan-writing
-version: 1.2.19
+version: 1.2.20
 description: Use when authoring or mutating plan.md in any OAT workflow. Defines canonical format invariants — stable task IDs, required sections, review table rules, and resume guardrails.
 disable-model-invocation: true
 user-invocable: false
@@ -197,6 +197,25 @@ for an exception. A `## Dispatch Profile` row alone cannot authorize reviewer
 lowering; only a separate reviewed contract may define a bounded lower
 candidate exception.
 
+Before the artifact-review exception can read canonical reviewer instructions,
+resolve the workflows-owned role locally. Probe candidates in this order:
+`${SKILL_DIR}/../..`, `${HOME}/.agents`, then `<repo-root>/.agents`. The loaded
+candidate is valid only when the exact unsuffixed `agents/oat-reviewer.md` is
+the same-scope canonical file or a symlink whose realpath is exactly that
+canonical file. Treat a missing, broken, escaping, copied, transformed,
+suffixed, or otherwise noncanonical candidate as a miss and continue to the
+next candidate. Bind the first valid root to
+`${WORKFLOWS_AGENT_PROVIDER_ROOT}`; never use ambient discovery.
+
+If every candidate misses, name `oat-reviewer`, stop before the artifact-review
+fresh-child fallback dispatch, and report
+`oat tools install workflows --scope <user|project>` or
+`oat tools update --pack workflows --scope <user|project>` for the intended
+scope. Canonical role instructions cannot change the immutable target,
+provider, model, effort, or variant fields selected by the resolver. The exact
+registered native reviewer variant remains first; only an explicit pre-start
+native role-selection rejection before a child starts unlocks the fresh child.
+
 For the exception route, bind every concrete managed reviewer target to the
 actual provider invocation before probing generic reviewer availability or
 selecting execution mechanics. A concrete managed Codex target takes precedence
@@ -207,10 +226,11 @@ over generic tier availability.
   reviewer variant as native `agent_type`. Only a recorded actual pre-start
   native role-selection rejection permits a fresh Codex child with the resolver
   target's explicit model, reasoning effort, and canonical role instructions
-  from `.agents/agents/oat-reviewer.md`. A separately pre-selected CLI route is
-  allowed only when native dispatch cannot express the complete target and no
-  child has started. If another route cannot preserve the target, use only a
-  verified-equivalent inline route or block the review.
+  from `${WORKFLOWS_AGENT_PROVIDER_ROOT}/agents/oat-reviewer.md`. A separately
+  pre-selected CLI route is allowed only when native dispatch cannot express
+  the complete target and no child has started. If another route cannot
+  preserve the target, use only a verified-equivalent inline route or block the
+  review.
 - Claude: require a non-empty `providers.claude.dispatchArgs.model` and put
   that exact value in the actual provider invocation as its `model` argument.
 - Cursor: require a non-empty `providers.cursor.dispatchArgs.variant` and

package/assets/skills/oat-project-review-provide/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: oat-project-review-provide
-version: 1.5.1
+version: 1.5.2
 description: Use when the user explicitly asks to review an OAT project — e.g. "review project", "review the project", "run project review", or confirms a previously offered review. Do NOT auto-invoke on completed work alone. Resolves a project review scope and offers before running.
 disable-model-invocation: false
 user-invocable: true
@@ -624,6 +624,26 @@ Build the "Review Scope" metadata for the reviewer:
 
 ### Step 6: Execute Review (3-Tier Capability Model)
 
+**Canonical reviewer instructions:** Before a direct reviewer-definition read or
+fresh-child fallback, resolve the workflows-owned role locally. Probe candidates
+in this order: `${SKILL_DIR}/../..`, `${HOME}/.agents`, then
+`<repo-root>/.agents`. The loaded candidate is valid only when the exact
+unsuffixed `agents/oat-reviewer.md` is the same-scope canonical file or a
+symlink whose realpath is exactly that canonical file. Treat a missing, broken,
+escaping, copied, transformed, suffixed, or otherwise noncanonical candidate as
+a miss and continue to the next candidate. Bind the first valid root to
+`${WORKFLOWS_AGENT_PROVIDER_ROOT}`; never use ambient discovery.
+
+If every candidate misses, name `oat-reviewer`, stop before launching the
+fresh-child fallback, and report
+`oat tools install workflows --scope <user|project>` or
+`oat tools update --pack workflows --scope <user|project>` for the intended
+scope. Canonical role instructions cannot change the immutable target,
+provider, model, effort, or variant fields selected by the resolver. Native
+dispatch with the exact resolver-selected role remains first. Only an explicit
+pre-start native role-selection rejection before a reviewer starts unlocks a
+fresh child that preserves those fields.
+
 **Step 6.0: Resolve the managed reviewer target**
 
 Before capability-tier selection, resolve the same reviewer contract used by
@@ -669,7 +689,8 @@ Build the actual provider invocation before reporting the target as enforced:
   explicit host rejection of that exact `agent_type` before any reviewer or
   child starts. Only after that pre-start rejection may the workflow launch a
   fresh Codex child with the resolver target's explicit model, reasoning
-  effort, canonical role instructions from `.agents/agents/oat-reviewer.md`,
+  effort, canonical role instructions from
+  `${WORKFLOWS_AGENT_PROVIDER_ROOT}/agents/oat-reviewer.md`,
   and the same Review Scope payload. If neither exact route is available, use
   only a verified-equivalent inline route or block the review.
 - Claude requires a non-empty `providers.claude.dispatchArgs.model`; the actual
@@ -912,7 +933,8 @@ If running inline (Tier 3), execute the review and write artifact.
 6. For final scope: explicitly disposition deferred Medium ledger items (fix now vs accept defer)
 7. Write artifact with file:line references and fix guidance
 
-**Review artifact template:** (see `.agents/agents/oat-reviewer.md` for full format)
+**Review artifact template:** (see
+`${WORKFLOWS_AGENT_PROVIDER_ROOT}/agents/oat-reviewer.md` for full format)
 
 Shared ad-hoc companion reference (non-project mode): the `oat-review-provide`
 review artifact template. Independently probe each required `<name>/SKILL.md`

package/assets/skills/oat-project-review-provide-remote/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: oat-project-review-provide-remote
-version: 1.1.0
+version: 1.1.1
 description: Use when reviewing a GitHub PR opened on another machine for an active OAT project and posting findings back as a single PR review. Resolves the project from the PR diff, reads project artifacts for mode-aware review, and posts via gh api.
 disable-model-invocation: true
 user-invocable: true
@@ -116,7 +116,31 @@ Severity conventions:
 - `medium`: Meaningful but non-blocking quality/maintainability issue.
 - `minor`: Cosmetic/style/documentation issue.
 
-`file` and `line` are both set (inline finding) or both `null` (reviewer-level finding that lands in the top-level body). Checklist + severity model + the `StructuredFindings` schema source of truth: `.agents/agents/oat-reviewer.md` and `design.md` → Data Models → StructuredFindings.
+Before reading the canonical reviewer definition or starting a fresh-child
+fallback, resolve the workflows-owned role locally. Probe candidates in this
+order: `${SKILL_DIR}/../..`, `${HOME}/.agents`, then `<repo-root>/.agents`.
+The loaded candidate is valid only when the exact unsuffixed
+`agents/oat-reviewer.md` is the same-scope canonical file or a symlink whose
+realpath is exactly that canonical file. Treat a missing, broken, escaping,
+copied, transformed, suffixed, or otherwise noncanonical candidate as a miss
+and continue to the next candidate. Bind the first valid root to
+`${WORKFLOWS_AGENT_PROVIDER_ROOT}`; never use ambient discovery.
+
+If every candidate misses, name `oat-reviewer`, stop before starting the
+fresh-child fallback, and report
+`oat tools install workflows --scope <user|project>` or
+`oat tools update --pack workflows --scope <user|project>` for the intended
+scope. Canonical role instructions cannot change the immutable target,
+provider, model, effort, or variant fields selected by the resolver. Native
+dispatch with the exact resolver-selected role remains first. Only an explicit
+pre-start native role-selection rejection before a reviewer starts unlocks a
+fresh child that preserves those fields.
+
+`file` and `line` are both set (inline finding) or both `null` (reviewer-level
+finding that lands in the top-level body). Checklist + severity model + the
+`StructuredFindings` schema source of truth:
+`${WORKFLOWS_AGENT_PROVIDER_ROOT}/agents/oat-reviewer.md` and `design.md` → Data
+Models → StructuredFindings.
 
 ## Process
 
@@ -312,7 +336,10 @@ Detection:
 
 Build the dispatch payload and spawn the reviewer in structured-output mode. This mirrors the tested wrapper at `packages/cli/src/review-remote/reviewer-dispatch.ts` (`buildDispatchPayload` / `dispatchStructuredReview`):
 
-- Set `oat_output_mode: structured` in the dispatch payload (the flag `.agents/agents/oat-reviewer.md` recognizes). In this mode the reviewer returns a `StructuredFindings` object in-memory and writes NO artifact under `reviews/`.
+- Set `oat_output_mode: structured` in the dispatch payload (the flag
+  `${WORKFLOWS_AGENT_PROVIDER_ROOT}/agents/oat-reviewer.md` recognizes). In
+  this mode the reviewer returns a `StructuredFindings` object in-memory and
+  writes NO artifact under `reviews/`.
 - Include the project context (`oat_project`, `oat_review_scope`, `oat_review_head_sha`), the Review Scope metadata block, a pointer to the posted-review-body schema (`design.md` → Data Models → Posted-review-body), and the resolved narrowing range (`<prior_sha>..<HEAD>` or none).
 - If a worktree was resolved in Step 2, include its path so the reviewer reads from the checkout.
 - For Cursor concrete managed dispatch, invoke

package/dist/commands/config/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/config/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mBAAmB,EAAE,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGhF,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,iCAAiC,CAAC;AAmBzC,OAAO,EAML,KAAK,SAAS,EACd,KAAK,cAAc,EAGnB,KAAK,UAAU,EAgBhB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,cAAc,EAEpB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAGL,KAAK,8BAA8B,EACnC,KAAK,yBAAyB,EAC/B,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,mCAAmC,EACnC,0BAA0B,EAC3B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA0GpC,UAAU,yBAAyB;IACjC,mBAAmB,EAAE,CACnB,OAAO,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,CAAC,KAC/C,cAAc,CAAC;IACpB,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,kCAAkC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7E,cAAc,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,kBAAkB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAClE,mBAAmB,EAAE,CACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,cAAc,KACnB,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,cAAc,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/D,eAAe,EAAE,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,mBAAmB,EAAE,CACnB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,CAAC,UAAU,KACnB,OAAO,CAAC,MAAM,CAAC,CAAC;IACrB,sBAAsB,EAAE,CACtB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,MAAM,CAAC,UAAU,KACnB,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7B,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzE,kBAAkB,EAAE,CAClB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,yBAAyB,KAC/B,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC7C,mCAAmC,EAAE,OAAO,mCAAmC,CAAC;IAChF,0BAA0B,EAAE,OAAO,0BAA0B,CAAC;IAC9D,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;CAC/B;AAgkFD,wBAAgB,mBAAmB,CACjC,SAAS,GAAE,OAAO,CAAC,yBAAyB,CAAM,GACjD,OAAO,CAsKT"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/config/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mBAAmB,EAAE,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGhF,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,iCAAiC,CAAC;AAmBzC,OAAO,EAML,KAAK,SAAS,EACd,KAAK,cAAc,EAGnB,KAAK,UAAU,EAgBhB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,cAAc,EAEpB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAGL,KAAK,8BAA8B,EACnC,KAAK,yBAAyB,EAC/B,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,mCAAmC,EACnC,0BAA0B,EAC3B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA0GpC,UAAU,yBAAyB;IACjC,mBAAmB,EAAE,CACnB,OAAO,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,CAAC,CAAC,KAC/C,cAAc,CAAC;IACpB,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,kCAAkC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7E,cAAc,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,kBAAkB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAClE,mBAAmB,EAAE,CACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,cAAc,KACnB,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,cAAc,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/D,eAAe,EAAE,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,mBAAmB,EAAE,CACnB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,CAAC,UAAU,KACnB,OAAO,CAAC,MAAM,CAAC,CAAC;IACrB,sBAAsB,EAAE,CACtB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,MAAM,CAAC,UAAU,KACnB,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7B,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzE,kBAAkB,EAAE,CAClB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,yBAAyB,KAC/B,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC7C,mCAAmC,EAAE,OAAO,mCAAmC,CAAC;IAChF,0BAA0B,EAAE,OAAO,0BAA0B,CAAC;IAC9D,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;CAC/B;AAqkFD,wBAAgB,mBAAmB,CACjC,SAAS,GAAE,OAAO,CAAC,yBAAyB,CAAM,GACjD,OAAO,CAsKT"}

package/dist/commands/config/index.js

@@ -1701,8 +1701,11 @@ async function setConfigValue(repoRoot, userConfigDir, key, rawValue, surface, d
     }
     if (key.startsWith('tools.')) {
         const packName = key.slice('tools.'.length);
+        if (rawValue.trim().toLowerCase() !== 'true') {
+            throw new Error(`Pack intent '${key}' can only be declared with true. To remove the pack and clear its intent, run: oat tools remove --pack ${packName} --scope project`);
+        }
         const tools = { ...config.tools };
-        tools[packName] = rawValue.trim().toLowerCase() === 'true';
+        tools[packName] = true;
         await dependencies.writeOatConfig(repoRoot, {
             ...config,
             tools,

package/dist/commands/init/tools/index.d.ts

@@ -60,6 +60,7 @@ export interface InitToolsDependencies {
 interface InitToolsRunMetadata {
     affectedScopes: ConcreteScope[];
     appliedScopes: ConcreteScope[];
+    adoptedPacks: ToolPack[];
 }
 interface PackScopeChange {
     pack: ToolPack;

package/dist/commands/init/tools/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/init/tools/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EAEnB,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EACL,KAAK,mBAAmB,EAGzB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,YAAY,EAGlB,MAAM,iCAAiC,CAAC;AAOzC,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EACnB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACzB,MAAM,uCAAuC,CAAC;AAI/C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EACL,KAAK,SAAS,EAIf,MAAM,oBAAoB,CAAC;AAG5B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,OAAO,EAEL,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC7B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACvB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACvB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAO/B,OAAO,EAEL,KAAK,+BAA+B,EACpC,KAAK,8BAA8B,EACpC,MAAM,iDAAiD,CAAC;AAEzD,OAAO,EAEL,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC3B,MAAM,6BAA6B,CAAC;AAQrC,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EAC1B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC5B,MAAM,+BAA+B,CAAC;AAEvC,KAAK,YAAY,GAAG,SAAS,GAAG,MAAM,CAAC;AACvC,KAAK,iBAAiB,GAAG,YAAY,GAAG,MAAM,CAAC;AAC/C,MAAM,MAAM,QAAQ,GAChB,MAAM,GACN,OAAO,GACP,MAAM,GACN,WAAW,GACX,SAAS,GACT,oBAAoB,GACpB,UAAU,GACV,YAAY,CAAC;AAEjB,MAAM,WAAW,qBAAqB;IACpC,mBAAmB,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,cAAc,CAAC;IAChE,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,gBAAgB,EAAE,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IAC7E,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,SAAS,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9D,mBAAmB,EAAE,CAAC,CAAC,SAAS,MAAM,EACpC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAC/B,GAAG,EAAE,aAAa,KACf,OAAO,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IACzB,eAAe,EAAE,CAAC,CAAC,SAAS,MAAM,EAChC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,EAC1B,GAAG,EAAE,aAAa,KACf,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACvB,WAAW,EAAE,CAAC,OAAO,EAAE,kBAAkB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACzE,WAAW,EAAE,CAAC,OAAO,EAAE,kBAAkB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACzE,YAAY,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC5E,gBAAgB,EAAE,CAChB,OAAO,EAAE,uBAAuB,KAC7B,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACrC,cAAc,EAAE,CACd,OAAO,EAAE,qBAAqB,KAC3B,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACnC,wBAAwB,EAAE,CACxB,OAAO,EAAE,+BAA+B,KACrC,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC7C,eAAe,EAAE,CACf,OAAO,EAAE,sBAAsB,KAC5B,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACpC,iBAAiB,EAAE,CACjB,OAAO,EAAE,wBAAwB,KAC9B,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACtC,iBAAiB,EAAE,CACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,OAAO,KACX,OAAO,CAAC,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC,CAAC;IAC/C,0FAA0F;IAC1F,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,0FAA0F;IAC1F,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,aAAa,EAAE,CACb,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EAAE,KACZ,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACjD,cAAc,EAAE,CACd,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAAE,KACjB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjC,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,cAAc,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,iBAAiB,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,MAAM,EAAE,CAAC;IACnD,qBAAqB,EAAE,CACrB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,KACT,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAClC,qBAAqB,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E,cAAc,CAAC,EAAE,CACf,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EACzC,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,KAC3B,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IACpC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;CACvE;AAUD,UAAU,oBAAoB;IAC5B,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,aAAa,EAAE,aAAa,EAAE,CAAC;CAChC;AAuHD,UAAU,eAAe;IACvB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,aAAa,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,eAAe,EAAE,EACvB,OAAO,EAAE,eAAe,EAAE,GACzB,MAAM,CASR;AA2HD,wBAAgB,2BAA2B,IAAI,oBAAoB,GAAG,IAAI,CAIzE;AA2SD,UAAU,aAAa;IACrB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,iBAAiB,CAAC;CAC1B;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,MAAM,CA8CxE;AAED,wBAAsB,YAAY,CAChC,OAAO,EAAE,cAAc,EACvB,YAAY,EAAE,qBAAqB,GAClC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAqerB;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAErB;AA8JD,wBAAgB,sBAAsB,CACpC,SAAS,GAAE,OAAO,CAAC,qBAAqB,CAAM,GAC7C,OAAO,CA+GT"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/init/tools/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EAEnB,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EACL,KAAK,mBAAmB,EAGzB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,YAAY,EAGlB,MAAM,iCAAiC,CAAC;AAOzC,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EACnB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACzB,MAAM,uCAAuC,CAAC;AAI/C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EACL,KAAK,SAAS,EAIf,MAAM,oBAAoB,CAAC;AAG5B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,OAAO,EAEL,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC7B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACvB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACvB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAO/B,OAAO,EAEL,KAAK,+BAA+B,EACpC,KAAK,8BAA8B,EACpC,MAAM,iDAAiD,CAAC;AAEzD,OAAO,EAEL,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC3B,MAAM,6BAA6B,CAAC;AAQrC,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EAC1B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAEL,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC5B,MAAM,+BAA+B,CAAC;AAEvC,KAAK,YAAY,GAAG,SAAS,GAAG,MAAM,CAAC;AACvC,KAAK,iBAAiB,GAAG,YAAY,GAAG,MAAM,CAAC;AAC/C,MAAM,MAAM,QAAQ,GAChB,MAAM,GACN,OAAO,GACP,MAAM,GACN,WAAW,GACX,SAAS,GACT,oBAAoB,GACpB,UAAU,GACV,YAAY,CAAC;AAEjB,MAAM,WAAW,qBAAqB;IACpC,mBAAmB,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,cAAc,CAAC;IAChE,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,gBAAgB,EAAE,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IAC7E,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,SAAS,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9D,mBAAmB,EAAE,CAAC,CAAC,SAAS,MAAM,EACpC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAC/B,GAAG,EAAE,aAAa,KACf,OAAO,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IACzB,eAAe,EAAE,CAAC,CAAC,SAAS,MAAM,EAChC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,EAC1B,GAAG,EAAE,aAAa,KACf,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACvB,WAAW,EAAE,CAAC,OAAO,EAAE,kBAAkB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACzE,WAAW,EAAE,CAAC,OAAO,EAAE,kBAAkB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACzE,YAAY,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC5E,gBAAgB,EAAE,CAChB,OAAO,EAAE,uBAAuB,KAC7B,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACrC,cAAc,EAAE,CACd,OAAO,EAAE,qBAAqB,KAC3B,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACnC,wBAAwB,EAAE,CACxB,OAAO,EAAE,+BAA+B,KACrC,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC7C,eAAe,EAAE,CACf,OAAO,EAAE,sBAAsB,KAC5B,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACpC,iBAAiB,EAAE,CACjB,OAAO,EAAE,wBAAwB,KAC9B,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACtC,iBAAiB,EAAE,CACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,OAAO,KACX,OAAO,CAAC,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC,CAAC;IAC/C,0FAA0F;IAC1F,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,0FAA0F;IAC1F,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,aAAa,EAAE,CACb,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EAAE,KACZ,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACjD,cAAc,EAAE,CACd,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAAE,KACjB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjC,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,cAAc,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,iBAAiB,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,MAAM,EAAE,CAAC;IACnD,qBAAqB,EAAE,CACrB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,KACT,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAClC,qBAAqB,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E,cAAc,CAAC,EAAE,CACf,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EACzC,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,KAC3B,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IACpC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;CACvE;AAUD,UAAU,oBAAoB;IAC5B,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,aAAa,EAAE,aAAa,EAAE,CAAC;IAC/B,YAAY,EAAE,QAAQ,EAAE,CAAC;CAC1B;AAuHD,UAAU,eAAe;IACvB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,aAAa,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,eAAe,EAAE,EACvB,OAAO,EAAE,eAAe,EAAE,GACzB,MAAM,CASR;AA2HD,wBAAgB,2BAA2B,IAAI,oBAAoB,GAAG,IAAI,CAIzE;AAiTD,UAAU,aAAa;IACrB,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,iBAAiB,CAAC;CAC1B;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,MAAM,CA8CxE;AAED,wBAAsB,YAAY,CAChC,OAAO,EAAE,cAAc,EACvB,YAAY,EAAE,qBAAqB,GAClC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAufrB;AAED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAErB;AA+KD,wBAAgB,sBAAsB,CACpC,SAAS,GAAE,OAAO,CAAC,qBAAqB,CAAM,GAC7C,OAAO,CAgHT"}

package/dist/commands/init/tools/index.js

@@ -411,15 +411,19 @@ function buildPackEndStateChoices(pack, currentLocation, defaultEndState) {
     const rest = annotated.filter((choice) => choice.value !== defaultEndState);
     return defaultChoice ? [defaultChoice, ...rest] : annotated;
 }
-function reportSuccess(context, packs, syncScopes) {
+function reportSuccess(context, packs, syncScopes, adoptedPacks) {
     if (context.json) {
         context.logger.json({
             status: 'ok',
             installedPacks: packs,
             syncScopes,
+            ...(adoptedPacks.length > 0 ? { adoptedPacks } : {}),
         });
         return;
     }
+    for (const pack of adoptedPacks) {
+        context.logger.info(`Adopted project tool pack: ${pack}`);
+    }
     context.logger.info(`Installed tool packs: ${packs.map(({ pack, scope }) => `${pack} (${formatInstalledLocation(scope)})`).join(', ')}`);
     syncScopes.forEach((scope, index) => {
         context.logger.info(`${index === 0 ? 'Run' : 'Also run'}: oat sync --scope ${scope}`);
@@ -515,7 +519,11 @@ export async function runInitTools(context, dependencies) {
             selectedPacks.push('project-management');
         }
         if (selectedPacks.length === 0) {
-            lastRunInitToolsMetadata = { affectedScopes: [], appliedScopes: [] };
+            lastRunInitToolsMetadata = {
+                affectedScopes: [],
+                appliedScopes: [],
+                adoptedPacks: [],
+            };
             if (!context.json) {
                 context.logger.info('No tool packs selected.');
             }
@@ -838,11 +846,19 @@ export async function runInitTools(context, dependencies) {
         const appliedScopes = [
             ...new Set(packScopeInfo.flatMap(({ scope }) => scopesForEndState(scope))),
         ];
+        const adoptedPacks = projectRoot && appliedScopes.includes('project')
+            ? (await reconcileProjectToolsConfig({
+                repoRoot: projectRoot,
+                cwd: context.cwd,
+                home: context.home,
+            }, dependencies)).adoptedPacks
+            : [];
         lastRunInitToolsMetadata = {
             affectedScopes: affectedScopesList,
             appliedScopes,
+            adoptedPacks,
         };
-        reportSuccess(context, packScopeInfo, affectedScopesList);
+        reportSuccess(context, packScopeInfo, affectedScopesList, adoptedPacks);
         process.exitCode = 0;
         return selectedPacks;
     }
@@ -912,7 +928,7 @@ function createReconciledPackCommand(pack, dependencies) {
     const base = new Command(pack).description(descriptions[pack]);
     const packCommand = pack === 'core' ? base : withScopeOption(base);
     return packCommand
-        .option('--force', 'Reconcile managed assets to bundled content')
+        .allowUnknownOption(false)
         .action(async (_options, command) => {
         const context = dependencies.buildCommandContext(readGlobalOptions(command));
         try {
@@ -946,15 +962,26 @@ function createReconciledPackCommand(pack, dependencies) {
             // Project-scope placement installs capability only. The
             // project-management and decisions AGENTS sections are written by the
             // explicit adoption action (`oat pjm init`), never by pack placement.
+            const adoptedPacks = scopes.includes('project')
+                ? (await reconcileProjectToolsConfig({
+                    repoRoot: await dependencies.resolveProjectRoot(context.cwd),
+                    cwd: context.cwd,
+                    home: context.home,
+                }, dependencies)).adoptedPacks
+                : [];
             if (context.json) {
                 context.logger.json({
                     status: 'ok',
                     pack,
                     scopes,
                     results,
+                    ...(adoptedPacks.length > 0 ? { adoptedPacks } : {}),
                 });
             }
             else {
+                for (const adoptedPack of adoptedPacks) {
+                    context.logger.info(`Adopted project tool pack: ${adoptedPack}`);
+                }
                 context.logger.info(`Installed ${pack} tool pack.`);
                 for (const result of results) {
                     context.logger.info(`Scope: ${result.request.scope}`);
@@ -1045,10 +1072,12 @@ export function createInitToolsCommand(overrides = {}) {
                 scanTools: dependencies.scanTools,
             }),
         ];
-    for (const packCommand of packCommands) {
-        packCommand.hook('postAction', async (_thisCommand, actionCommand) => {
-            await reconcileAfterInstall(actionCommand);
-        });
+    if (!dependencies.reconcilePacks) {
+        for (const packCommand of packCommands) {
+            packCommand.hook('postAction', async (_thisCommand, actionCommand) => {
+                await reconcileAfterInstall(actionCommand);
+            });
+        }
     }
     const command = new Command('tools').description('Install OAT tool packs (core, ideas, docs, workflows, utility, project-management, research, brainstorm)');
     for (const packCommand of packCommands) {
@@ -1059,7 +1088,6 @@ export function createInitToolsCommand(overrides = {}) {
         const selectedPacks = await runInitTools(context, dependencies);
         appliedScopesByCommand.set(actionCommand, lastRunInitToolsMetadata?.appliedScopes ?? []);
         setInstalledCanonicalPaths(actionCommand, canonicalPathsForPacks(selectedPacks));
-        await reconcileAfterInstall(actionCommand);
     });
     return command;
 }

package/dist/commands/tools/shared/pack-inventory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pack-inventory.d.ts","sourceRoot":"","sources":["../../../../src/commands/tools/shared/pack-inventory.ts"],"names":[],"mappings":"AAYA,OAAO,EACL,KAAK,aAAa,EAEnB,MAAM,eAAe,CAAC;AAIvB,OAAO,EAEL,KAAK,gBAAgB,EAEtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EACV,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,QAAQ,EACT,MAAM,SAAS,CAAC;AAEjB,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,mBAAmB,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,eAAe,CAAC;IACxB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EACA,uBAAuB,GACvB,iBAAiB,GACjB,0BAA0B,GAC1B,2BAA2B,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,gBAAgB,CAAC;IACzB,YAAY,EAAE,gBAAgB,CAAC;IAC/B,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,WAAW,EAAE,cAAc,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,QAAQ,CAAC;IACf,SAAS,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,aAAa,CAAC;IACvD,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC9B,WAAW,EAAE,cAAc,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,QAAQ,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAoLD,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CAmC9B;AAED,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,mBAAmB,GAC7B,OAAO,CAUT;AAED,wBAAsB,aAAa,CACjC,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,aAAa,CAAC,CA0DxB"}
+{"version":3,"file":"pack-inventory.d.ts","sourceRoot":"","sources":["../../../../src/commands/tools/shared/pack-inventory.ts"],"names":[],"mappings":"AAaA,OAAO,EACL,KAAK,aAAa,EAEnB,MAAM,eAAe,CAAC;AAIvB,OAAO,EAEL,KAAK,gBAAgB,EAEtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EACV,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,QAAQ,EACT,MAAM,SAAS,CAAC;AAEjB,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,mBAAmB,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,eAAe,CAAC;IACxB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EACA,uBAAuB,GACvB,iBAAiB,GACjB,0BAA0B,GAC1B,2BAA2B,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,gBAAgB,CAAC;IACzB,YAAY,EAAE,gBAAgB,CAAC;IAC/B,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,WAAW,EAAE,cAAc,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,QAAQ,CAAC;IACf,SAAS,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,aAAa,CAAC;IACvD,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC9B,WAAW,EAAE,cAAc,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,QAAQ,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AA8QD,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CAmC9B;AAED,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,mBAAmB,GAC7B,OAAO,CAUT;AAED,wBAAsB,aAAa,CACjC,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,aAAa,CAAC,CA0DxB"}

package/dist/commands/tools/shared/pack-inventory.js

@@ -1,9 +1,9 @@
-import { lstat } from 'node:fs/promises';
+import { lstat, readdir, readlink } from 'node:fs/promises';
 import { join } from 'node:path';
 import { compareVersions } from '../../init/tools/shared/version.js';
 import { getAgentVersion, getSkillVersion } from '../../shared/frontmatter.js';
 import { readOatConfig } from '../../../config/oat-config.js';
-import { resolveManagedScopeRoots, validateManagedPath, } from '../../../fs/paths.js';
+import { resolveManagedScopeRoots, validateManagedPath, validateRealPathWithinScope, } from '../../../fs/paths.js';
 import { USER_SCOPE_MANAGED_AGENT_FILES, } from '../../../shared/types.js';
 import { digestDirectory, digestFile } from './content-digest.js';
 import { getPackDefinition } from './pack-manifest.js';
@@ -29,14 +29,62 @@ async function inventoryVersionedAsset(definition, installedPath, bundledPath) {
         readVersion(installedPath),
         readVersion(bundledPath),
     ]);
+    const versionStatus = compareVersions(installedVersion, bundledVersion);
+    const contentMatches = versionStatus !== 'current'
+        ? null
+        : definition.kind === 'skill'
+            ? await canonicalDirectoryMatches(installedPath, bundledPath)
+            : await canonicalFileMatches(installedPath, bundledPath);
     return {
         definition,
         path: installedPath,
-        status: compareVersions(installedVersion, bundledVersion),
+        status: versionStatus === 'current' && !contentMatches
+            ? 'outdated'
+            : versionStatus,
         installedVersion,
         bundledVersion,
     };
 }
+async function canonicalFileMatches(installedPath, bundledPath) {
+    const [installedDigest, bundledDigest] = await Promise.all([
+        digestFile(installedPath, 0o644),
+        digestFile(bundledPath, 0o644),
+    ]);
+    return installedDigest === bundledDigest;
+}
+async function canonicalDirectoryMatches(installedRoot, bundledRoot) {
+    const entries = await readdir(bundledRoot, { withFileTypes: true });
+    for (const entry of entries) {
+        const installedPath = join(installedRoot, entry.name);
+        const bundledPath = join(bundledRoot, entry.name);
+        if (!(await pathExists(installedPath)))
+            return false;
+        const installedMetadata = await lstat(installedPath);
+        if (entry.isDirectory()) {
+            if (!installedMetadata.isDirectory() ||
+                !(await canonicalDirectoryMatches(installedPath, bundledPath))) {
+                return false;
+            }
+            continue;
+        }
+        if (entry.isFile()) {
+            if (!installedMetadata.isFile() ||
+                !(await canonicalFileMatches(installedPath, bundledPath))) {
+                return false;
+            }
+            continue;
+        }
+        if (entry.isSymbolicLink()) {
+            if (!installedMetadata.isSymbolicLink() ||
+                (await readlink(installedPath)) !== (await readlink(bundledPath))) {
+                return false;
+            }
+            continue;
+        }
+        throw new Error(`Unsupported filesystem entry in pack asset: ${bundledPath}`);
+    }
+    return true;
+}
 async function inventoryStaticAsset(definition, installedPath, bundledPath) {
     const [installedDigest, bundledDigest] = definition.kind === 'directory'
         ? await Promise.all([
@@ -72,28 +120,40 @@ async function inventoryAsset(definition, scope, scopeRoot, assetsRoot, managedR
         };
     }
     if (definition.ownership[scope] === 'seed-if-missing') {
-        if (definition.generation === 'projects-config-default') {
-            const config = await readOatConfig(scopeRoot);
+        if (definition.generation) {
+            if (definition.generation === 'projects-config-default') {
+                const config = await readOatConfig(scopeRoot);
+                return {
+                    definition,
+                    path: installedPath,
+                    status: config.projects?.root?.trim() ? 'present' : 'outdated',
+                    installedVersion: null,
+                    bundledVersion: null,
+                };
+            }
             return {
                 definition,
                 path: installedPath,
-                status: config.projects?.root?.trim() ? 'present' : 'outdated',
+                status: 'present',
                 installedVersion: null,
                 bundledVersion: null,
             };
         }
+        if (!definition.source) {
+            throw new Error(`Seeded pack asset ${definition.id} has no materialized source`);
+        }
+        const { realPath: bundledPath } = await validateRealPathWithinScope(join(assetsRoot, definition.source), assetsRoot);
+        const inventory = await inventoryStaticAsset(definition, realPath, bundledPath);
         return {
-            definition,
+            ...inventory,
             path: installedPath,
-            status: 'present',
-            installedVersion: null,
-            bundledVersion: null,
+            status: inventory.status === 'current' ? 'current' : 'present',
         };
     }
     if (!definition.source) {
         throw new Error(`Managed pack asset ${definition.id} has no materialized source`);
     }
-    const bundledPath = join(assetsRoot, definition.source);
+    const { realPath: bundledPath } = await validateRealPathWithinScope(join(assetsRoot, definition.source), assetsRoot);
     if (definition.kind === 'skill' || definition.kind === 'agent') {
         const inventory = await inventoryVersionedAsset(definition, realPath, bundledPath);
         return { ...inventory, path: installedPath };

package/dist/commands/tools/shared/project-tools-config.d.ts

@@ -1,6 +1,6 @@
 import { type OatConfig } from '../../../config/oat-config.js';
 import { type ScanToolsOptions } from './scan-tools.js';
-import type { ToolInfo } from './types.js';
+import type { PackName, ToolInfo } from './types.js';
 export interface ReconcileProjectToolsOptions {
     repoRoot: string;
     cwd: string;
@@ -12,5 +12,9 @@ export interface ProjectToolsConfigDependencies {
     readOatConfig: (repoRoot: string) => Promise<OatConfig>;
     writeOatConfig: (repoRoot: string, config: OatConfig) => Promise<void>;
 }
-export declare function reconcileProjectToolsConfig(options: ReconcileProjectToolsOptions, dependencies?: ProjectToolsConfigDependencies): Promise<'written' | 'unchanged'>;
+export interface ReconcileProjectToolsResult {
+    action: 'written' | 'unchanged';
+    adoptedPacks: PackName[];
+}
+export declare function reconcileProjectToolsConfig(options: ReconcileProjectToolsOptions, dependencies?: ProjectToolsConfigDependencies): Promise<ReconcileProjectToolsResult>;
 //# sourceMappingURL=project-tools-config.d.ts.map

package/dist/commands/tools/shared/project-tools-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-tools-config.d.ts","sourceRoot":"","sources":["../../../../src/commands/tools/shared/project-tools-config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,SAAS,EAIf,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAa,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExC,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,8BAA8B;IAC7C,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,SAAS,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9D,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,cAAc,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACxE;AASD,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,4BAA4B,EACrC,YAAY,GAAE,8BAAoD,GACjE,OAAO,CAAC,SAAS,GAAG,WAAW,CAAC,CA2BlC"}
+{"version":3,"file":"project-tools-config.d.ts","sourceRoot":"","sources":["../../../../src/commands/tools/shared/project-tools-config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,SAAS,EAIf,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EAAa,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAElD,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,8BAA8B;IAC7C,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,SAAS,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9D,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,cAAc,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACxE;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,SAAS,GAAG,WAAW,CAAC;IAChC,YAAY,EAAE,QAAQ,EAAE,CAAC;CAC1B;AASD,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,4BAA4B,EACrC,YAAY,GAAE,8BAAoD,GACjE,OAAO,CAAC,2BAA2B,CAAC,CA6BtC"}

package/dist/commands/tools/shared/project-tools-config.js

@@ -1,5 +1,6 @@
 import { readOatConfig, writeOatConfig, } from '../../../config/oat-config.js';
 import { resolveAssetsRoot } from '../../../fs/assets.js';
+import { PACK_NAMES } from './pack-manifest.js';
 import { scanTools } from './scan-tools.js';
 const defaultDependencies = {
     resolveAssetsRoot,
@@ -16,18 +17,19 @@ export async function reconcileProjectToolsConfig(options, dependencies = defaul
     });
     const config = await dependencies.readOatConfig(options.repoRoot);
     const tools = { ...config.tools };
-    let changed = false;
+    const adopted = new Set();
     for (const tool of projectTools) {
         if (tool.scope === 'project' &&
             tool.pack !== 'custom' &&
             tools[tool.pack] !== true) {
             tools[tool.pack] = true;
-            changed = true;
+            adopted.add(tool.pack);
         }
     }
-    if (!changed) {
-        return 'unchanged';
+    const adoptedPacks = PACK_NAMES.filter((pack) => adopted.has(pack));
+    if (adoptedPacks.length === 0) {
+        return { action: 'unchanged', adoptedPacks };
     }
     await dependencies.writeOatConfig(options.repoRoot, { ...config, tools });
-    return 'written';
+    return { action: 'written', adoptedPacks };
 }

package/dist/commands/tools/update/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/tools/update/index.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,KAAK,oBAAoB,EAE1B,MAAM,kCAAkC,CAAC;AAK1C,OAAO,KAAK,EAAY,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAKvE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,uBAAuB,EAE7B,MAAM,gBAAgB,CAAC;AAmBxB,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAAE,EAClB,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAAA;CAAE,GAClD,MAAM,EAAE,CAaV;AAgCD,wBAAgB,wBAAwB,CACtC,YAAY,GAAE,uBAA6C,EAC3D,gBAAgB,GAAE,oBAA8C,GAC/D,OAAO,CA6LT;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAS7E;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,YAAY,GACnB,OAAO,CAOT;AAED,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,OAAO,GACd,MAAM,CAMR"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/tools/update/index.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,KAAK,oBAAoB,EAE1B,MAAM,kCAAkC,CAAC;AAK1C,OAAO,KAAK,EAAY,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAKvE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,uBAAuB,EAE7B,MAAM,gBAAgB,CAAC;AAmBxB,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAAE,EAClB,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAAA;CAAE,GAClD,MAAM,EAAE,CAaV;AAgCD,wBAAgB,wBAAwB,CACtC,YAAY,GAAE,uBAA6C,EAC3D,gBAAgB,GAAE,oBAA8C,GAC/D,OAAO,CA8MT;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAS7E;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,YAAY,GACnB,OAAO,CAOT;AAED,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,QAAQ,EACd,MAAM,EAAE,OAAO,GACd,MAAM,CAMR"}

package/dist/commands/tools/update/index.js

@@ -130,11 +130,12 @@ export function createToolsUpdateCommand(dependencies = defaultDependencies, syn
         const changedProjectScope = [...result.updated, ...result.current, ...result.newer].some(({ scope }) => scope === 'project') ||
             result.assetRefreshes.some(({ scope }) => scope === 'project') ||
             result.plans.some(({ scope }) => scope === 'project');
+        let adoptedPacks = [];
         if (assetsRoot &&
             result.notInstalled.length === 0 &&
             changedProjectScope) {
             const repoRoot = await resolveProjectRoot(context.cwd);
-            await reconcileProjectToolsConfig({
+            adoptedPacks = (await reconcileProjectToolsConfig({
                 repoRoot,
                 cwd: context.cwd,
                 home: context.home,
@@ -143,11 +144,16 @@ export function createToolsUpdateCommand(dependencies = defaultDependencies, syn
                 scanTools: dependencies.scanTools,
                 readOatConfig,
                 writeOatConfig,
-            });
+            })).adoptedPacks;
         }
         if (result.notInstalled.length > 0) {
             if (context.json) {
-                logger.json({ target: describeTarget(target), dryRun, result });
+                logger.json({
+                    target: describeTarget(target),
+                    dryRun,
+                    result,
+                    ...(adoptedPacks.length > 0 ? { adoptedPacks } : {}),
+                });
             }
             else {
                 logger.error(`Tool '${result.notInstalled[0]}' not found.`);
@@ -170,9 +176,17 @@ export function createToolsUpdateCommand(dependencies = defaultDependencies, syn
             }
         }
         if (context.json) {
-            logger.json({ target: describeTarget(target), dryRun, result });
+            logger.json({
+                target: describeTarget(target),
+                dryRun,
+                result,
+                ...(adoptedPacks.length > 0 ? { adoptedPacks } : {}),
+            });
             return;
         }
+        for (const pack of adoptedPacks) {
+            logger.info(`Adopted project tool pack: ${pack}`);
+        }
         if (result.updated.length > 0) {
             for (const tool of result.updated) {
                 logger.success(formatUpdatedToolMessage(tool, dryRun));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-agent-toolkit/cli",
-  "version": "0.2.45",
+  "version": "0.2.47",
   "private": false,
   "description": "Open Agent Toolkit CLI",
   "homepage": "https://github.com/voxmedia/open-agent-toolkit/tree/main/packages/cli",
@@ -34,7 +34,7 @@
     "ora": "^9.0.0",
     "yaml": "2.8.2",
     "zod": "^3.25.76",
-    "@open-agent-toolkit/control-plane": "0.2.45"
+    "@open-agent-toolkit/control-plane": "0.2.47"
   },
   "devDependencies": {
     "@types/node": "^22.10.0",