@open-agent-toolkit/cli 0.2.51 → 0.2.52

package/dist/manifest/manifest.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.types.d.ts","sourceRoot":"","sources":["../../src/manifest/manifest.types.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2B5B,CAAC;AAEL,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsBvB,CAAC;AAEL,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC"}
+{"version":3,"file":"manifest.types.d.ts","sourceRoot":"","sources":["../../src/manifest/manifest.types.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAoDxB,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAED,CAAC;AAElC,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmC9B,CAAC;AAEH,QAAA,MAAM,oCAAoC;;;;;;;;;;;;EAIxC,CAAC;AAEH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUxC,CAAC;AAiCH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAOkD,CAAC;AAEhF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgEzB,CAAC;AAEL,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAAgD,CAAC;AAE5E,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAClE,8EAA8E;AAC9E,MAAM,MAAM,aAAa,GAAG,eAAe,CAAC;AAC5C,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC3C,OAAO,6BAA6B,CACrC,CAAC;AACF,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAClD,OAAO,oCAAoC,CAC5C,CAAC;AACF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG;IACnD,OAAO,EAAE,aAAa,EAAE,CAAC;CAC1B,CAAC"}

package/dist/manifest/manifest.types.js

@@ -4,18 +4,20 @@ const RelativePathSchema = z
     .string()
     .min(1)
     .refine((value) => !value.startsWith('/') && !value.startsWith('~'), 'Path must be relative');
-export const ManifestEntrySchema = z
-    .object({
+const CollectionRelativePathSchema = RelativePathSchema.refine((value) => !value.includes('\\') &&
+    value
+        .split('/')
+        .every((segment) => segment !== '' && segment !== '.' && segment !== '..'), 'Collection path must be a normalized relative POSIX path');
+const ManifestEntryBaseSchema = z.object({
     canonicalPath: RelativePathSchema,
     providerPath: RelativePathSchema,
     provider: z.string().min(1),
     contentType: ContentTypeSchema,
-    strategy: z.enum(['symlink', 'copy']),
     contentHash: z.string().nullable(),
     isFile: z.boolean().default(false),
     lastSynced: z.string().datetime(),
-})
-    .superRefine((entry, ctx) => {
+});
+function validateEntryHash(entry, ctx) {
     if (entry.strategy === 'copy' && entry.contentHash === null) {
         ctx.addIssue({
             code: z.ZodIssueCode.custom,
@@ -23,34 +25,148 @@ export const ManifestEntrySchema = z
             path: ['contentHash'],
         });
     }
-    if (entry.strategy === 'symlink' && entry.contentHash !== null) {
+    if (entry.strategy !== 'copy' && entry.contentHash !== null) {
         ctx.addIssue({
             code: z.ZodIssueCode.custom,
-            message: 'symlink strategy requires null contentHash',
+            message: `${entry.strategy} strategy requires null contentHash`,
             path: ['contentHash'],
         });
     }
+}
+export const ManifestEntryV1Schema = ManifestEntryBaseSchema.extend({
+    strategy: z.enum(['symlink', 'copy']),
+}).superRefine(validateEntryHash);
+export const ManifestEntrySchema = ManifestEntryBaseSchema.extend({
+    strategy: z.enum(['symlink', 'copy', 'collection']),
+    collectionId: z.string().min(1).optional(),
+}).superRefine((entry, ctx) => {
+    validateEntryHash(entry, ctx);
+    if (entry.strategy === 'collection' && entry.collectionId === undefined) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: 'collection strategy requires collectionId',
+            path: ['collectionId'],
+        });
+    }
+    if (entry.strategy !== 'collection' && entry.collectionId !== undefined) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: 'collectionId is only valid for collection strategy',
+            path: ['collectionId'],
+        });
+    }
+    if (entry.strategy === 'collection') {
+        for (const field of ['canonicalPath', 'providerPath']) {
+            const parsed = CollectionRelativePathSchema.safeParse(entry[field]);
+            if (!parsed.success) {
+                ctx.addIssue({
+                    code: z.ZodIssueCode.custom,
+                    message: 'Inherited collection paths must be normalized relative POSIX paths',
+                    path: [field],
+                });
+            }
+        }
+    }
 });
-export const ManifestSchema = z
+const ManifestCollectionLinkIdentitySchema = z.object({
+    device: z.string().min(1),
+    inode: z.string().min(1),
+    linkText: z.string().min(1),
+});
+export const ManifestCollectionEntrySchema = z.object({
+    id: z.string().min(1),
+    provider: z.string().min(1),
+    contentType: ContentTypeSchema,
+    canonicalDir: CollectionRelativePathSchema,
+    providerDir: CollectionRelativePathSchema,
+    linkTarget: CollectionRelativePathSchema,
+    ownership: z.enum(['oat-created', 'adopted-exact']),
+    createdLink: ManifestCollectionLinkIdentitySchema.optional(),
+    lastVerified: z.string().datetime(),
+});
+function isStrictPathDescendant(parent, candidate) {
+    const parentSegments = parent.split('/');
+    const candidateSegments = candidate.split('/');
+    return (candidateSegments.length > parentSegments.length &&
+        parentSegments.every((segment, index) => candidateSegments[index] === segment));
+}
+function validateUniqueEntries(entries, ctx) {
+    const seen = new Set();
+    for (const [index, entry] of entries.entries()) {
+        const key = `${entry.canonicalPath}::${entry.provider}`;
+        if (seen.has(key)) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: 'duplicate (canonicalPath, provider) pair',
+                path: ['entries', index],
+            });
+        }
+        else {
+            seen.add(key);
+        }
+    }
+}
+export const ManifestV1Schema = z
     .object({
     version: z.literal(1),
     oatVersion: z.string().min(1),
+    entries: z.array(ManifestEntryV1Schema),
+    lastUpdated: z.string().datetime(),
+})
+    .superRefine((manifest, ctx) => validateUniqueEntries(manifest.entries, ctx));
+export const ManifestV2Schema = z
+    .object({
+    version: z.literal(2),
+    oatVersion: z.string().min(1),
     entries: z.array(ManifestEntrySchema),
+    collections: z.array(ManifestCollectionEntrySchema),
     lastUpdated: z.string().datetime(),
 })
     .superRefine((manifest, ctx) => {
-    const seen = new Set();
-    for (const [index, entry] of manifest.entries.entries()) {
-        const key = `${entry.canonicalPath}::${entry.provider}`;
-        if (seen.has(key)) {
+    validateUniqueEntries(manifest.entries, ctx);
+    const collections = new Map();
+    for (const [index, collection] of manifest.collections.entries()) {
+        if (collections.has(collection.id)) {
             ctx.addIssue({
                 code: z.ZodIssueCode.custom,
-                message: 'duplicate (canonicalPath, provider) pair',
-                path: ['entries', index],
+                message: 'duplicate collection id',
+                path: ['collections', index, 'id'],
             });
         }
         else {
-            seen.add(key);
+            collections.set(collection.id, collection);
+        }
+        if (collection.linkTarget !== collection.canonicalDir) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: 'collection linkTarget must exactly reference canonicalDir',
+                path: ['collections', index, 'linkTarget'],
+            });
+        }
+    }
+    for (const [index, entry] of manifest.entries.entries()) {
+        if (entry.strategy !== 'collection') {
+            continue;
+        }
+        const collection = collections.get(entry.collectionId ?? '');
+        if (collection === undefined) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: 'collection entry must reference exactly one collection',
+                path: ['entries', index, 'collectionId'],
+            });
+            continue;
+        }
+        if (entry.provider !== collection.provider ||
+            entry.contentType !== collection.contentType ||
+            !isStrictPathDescendant(collection.canonicalDir, entry.canonicalPath) ||
+            !isStrictPathDescendant(collection.providerDir, entry.providerPath)) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                message: 'collection entry provider, content type, and ancestry must match its collection',
+                path: ['entries', index],
+            });
         }
     }
 });
+export const ManifestSchema = z.union([ManifestV1Schema, ManifestV2Schema]);

package/dist/providers/codex/codec/sync-extension.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sync-extension.d.ts","sourceRoot":"","sources":["../../../../src/providers/codex/codec/sync-extension.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,6BAA6B,EACnC,MAAM,mBAAmB,CAAC;AAqB3B,MAAM,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;AACzD,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,QAAQ,CAAC;AAErD,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,oBAAoB,CAAC;IAC7B,MAAM,EAAE,oBAAoB,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,4BAA6B,SAAQ,6BAA6B,CACjF,OAAO,EACP,oBAAoB,CACrB;IACC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAmB,SAAQ,mBAAmB,CAC7D,OAAO,EACP,oBAAoB,EACpB,0BAA0B,CAC3B;IACC,UAAU,EAAE,4BAA4B,EAAE,CAAC;IAC3C,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,yBAAyB,GAAG,0BAA0B,CAAC;AAgBnE,MAAM,WAAW,iCAAiC;IAChD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAqiBD,wBAAsB,gCAAgC,CACpD,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,cAAc,EAAE,EAClC,qBAAqB,CAAC,EAAE,MAAM,EAAE,EAChC,OAAO,GAAE,iCAAsC,GAC9C,OAAO,CAAC,kBAAkB,CAAC,CAkL7B;AAED,wBAAsB,8BAA8B,CAClD,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,yBAAyB,CAAC,CA6BpC;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAE1E;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,kBAAkB,GAAG;IACjE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB,CAEA;AAED,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,kBAAkB,GACvB,uBAAuB,EAAE,CAQ3B;AAED,eAAO,MAAM,6BAA6B,EAAE,wBAAwB,CAClE,kBAAkB,EAClB,sBAAsB,CAAC,iCAAiC,CAAC,CAY1D,CAAC"}
+{"version":3,"file":"sync-extension.d.ts","sourceRoot":"","sources":["../../../../src/providers/codex/codec/sync-extension.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,6BAA6B,EACnC,MAAM,mBAAmB,CAAC;AAsB3B,MAAM,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;AACzD,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,QAAQ,CAAC;AAErD,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,oBAAoB,CAAC;IAC7B,MAAM,EAAE,oBAAoB,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,4BAA6B,SAAQ,6BAA6B,CACjF,OAAO,EACP,oBAAoB,CACrB;IACC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAmB,SAAQ,mBAAmB,CAC7D,OAAO,EACP,oBAAoB,EACpB,0BAA0B,CAC3B;IACC,UAAU,EAAE,4BAA4B,EAAE,CAAC;IAC3C,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,yBAAyB,GAAG,0BAA0B,CAAC;AAgBnE,MAAM,WAAW,iCAAiC;IAChD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAqiBD,wBAAsB,gCAAgC,CACpD,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,cAAc,EAAE,EAClC,qBAAqB,CAAC,EAAE,MAAM,EAAE,EAChC,OAAO,GAAE,iCAAsC,GAC9C,OAAO,CAAC,kBAAkB,CAAC,CAkL7B;AAED,wBAAsB,8BAA8B,CAClD,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,yBAAyB,CAAC,CA+DpC;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAE1E;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,kBAAkB,GAAG;IACjE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB,CAEA;AAED,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,kBAAkB,GACvB,uBAAuB,EAAE,CAQ3B;AAED,eAAO,MAAM,6BAA6B,EAAE,wBAAwB,CAClE,kBAAkB,EAClB,sBAAsB,CAAC,iCAAiC,CAAC,CAY1D,CAAC"}

package/dist/providers/codex/codec/sync-extension.js

@@ -519,14 +519,17 @@ export async function computeCodexProjectExtensionPlan(scopeRoot, canonicalEntri
     };
 }
 export async function applyCodexProjectExtensionPlan(scopeRoot, plan) {
-    const result = {
-        applied: 0,
-        failed: 0,
-        skipped: 0,
-    };
+    const operationResults = [];
     for (const operation of plan.operations) {
         if (operation.action === 'skip') {
-            result.skipped += 1;
+            operationResults.push({
+                provider: operation.provider,
+                target: operation.target,
+                path: operation.path,
+                entryName: operation.entryName,
+                action: operation.action,
+                status: 'current',
+            });
             continue;
         }
         const absolutePath = resolve(scopeRoot, operation.path);
@@ -538,13 +541,41 @@ export async function applyCodexProjectExtensionPlan(scopeRoot, plan) {
                 await ensureDir(dirname(absolutePath));
                 await writeFile(absolutePath, operation.content ?? '', 'utf8');
             }
-            result.applied += 1;
+            operationResults.push({
+                provider: operation.provider,
+                target: operation.target,
+                path: operation.path,
+                entryName: operation.entryName,
+                action: operation.action,
+                status: 'changed',
+            });
         }
-        catch {
-            result.failed += 1;
+        catch (error) {
+            const missing = typeof error === 'object' &&
+                error !== null &&
+                'code' in error &&
+                error.code === 'ENOENT';
+            operationResults.push({
+                provider: operation.provider,
+                target: operation.target,
+                path: operation.path,
+                entryName: operation.entryName,
+                action: operation.action,
+                status: missing ? 'missing' : 'failed',
+                failure: missing
+                    ? 'Materialization input was missing; restore it and retry sync.'
+                    : 'Materialization failed; inspect local verbose diagnostics and retry sync.',
+            });
         }
     }
-    return result;
+    return {
+        applied: operationResults.filter(({ status }) => status === 'changed')
+            .length,
+        failed: operationResults.filter(({ status }) => status === 'failed' || status === 'missing').length,
+        skipped: operationResults.filter(({ status }) => status === 'current')
+            .length,
+        operations: operationResults,
+    };
 }
 export function hasCodexExtensionChanges(plan) {
     return hasMaterializationChanges(plan);

package/dist/providers/cursor/codec/sync-extension.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sync-extension.d.ts","sourceRoot":"","sources":["../../../../src/providers/cursor/codec/sync-extension.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAIpD,OAAO,EAIL,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,6BAA6B,EACnC,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,WAAW,CAAC;AAMnB,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,UAAU,CAAC;AAElB,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAE3C,MAAM,WAAW,wBAAyB,SAAQ,wBAAwB,CACxE,QAAQ,EACR,qBAAqB,CACtB;IACC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,6BAA8B,SAAQ,6BAA6B,CAClF,QAAQ,EACR,qBAAqB,CACtB;IACC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE,eAAe,EAAE,CAAC;IACjC,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,mBAAoB,SAAQ,mBAAmB,CAC9D,QAAQ,EACR,qBAAqB,EACrB,2BAA2B,CAC5B;IACC,UAAU,EAAE,6BAA6B,EAAE,CAAC;CAC7C;AAED,MAAM,MAAM,0BAA0B,GAAG,0BAA0B,CAAC;AAQpE,MAAM,WAAW,kCAAkC;IACjD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACjD,gBAAgB,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;CACrD;AAoWD,wBAAsB,iCAAiC,CACrD,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,cAAc,EAAE,EAClC,qBAAqB,CAAC,EAAE,MAAM,EAAE,EAChC,OAAO,GAAE,kCAAuC,GAC/C,OAAO,CAAC,mBAAmB,CAAC,CAmH9B;AA6DD,wBAAsB,+BAA+B,CACnD,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,0BAA0B,CAAC,CA0BrC;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAE5E;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,mBAAmB,GAAG;IACnE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB,CAEA;AAED,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,mBAAmB,GACxB,wBAAwB,EAAE,CAM5B;AAED,eAAO,MAAM,8BAA8B,EAAE,wBAAwB,CACnE,mBAAmB,EACnB,sBAAsB,CAAC,kCAAkC,CAAC,CAY3D,CAAC"}
+{"version":3,"file":"sync-extension.d.ts","sourceRoot":"","sources":["../../../../src/providers/cursor/codec/sync-extension.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAIpD,OAAO,EAIL,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,6BAA6B,EACnC,MAAM,mBAAmB,CAAC;AAI3B,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,WAAW,CAAC;AAMnB,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,UAAU,CAAC;AAElB,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAE3C,MAAM,WAAW,wBAAyB,SAAQ,wBAAwB,CACxE,QAAQ,EACR,qBAAqB,CACtB;IACC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,6BAA8B,SAAQ,6BAA6B,CAClF,QAAQ,EACR,qBAAqB,CACtB;IACC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE,eAAe,EAAE,CAAC;IACjC,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,mBAAoB,SAAQ,mBAAmB,CAC9D,QAAQ,EACR,qBAAqB,EACrB,2BAA2B,CAC5B;IACC,UAAU,EAAE,6BAA6B,EAAE,CAAC;CAC7C;AAED,MAAM,MAAM,0BAA0B,GAAG,0BAA0B,CAAC;AAQpE,MAAM,WAAW,kCAAkC;IACjD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,aAAa,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACjD,gBAAgB,CAAC,EAAE,SAAS,qBAAqB,EAAE,CAAC;CACrD;AAoWD,wBAAsB,iCAAiC,CACrD,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,cAAc,EAAE,EAClC,qBAAqB,CAAC,EAAE,MAAM,EAAE,EAChC,OAAO,GAAE,kCAAuC,GAC/C,OAAO,CAAC,mBAAmB,CAAC,CAmH9B;AA6DD,wBAAsB,+BAA+B,CACnD,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,0BAA0B,CAAC,CA4DrC;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAE5E;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,mBAAmB,GAAG;IACnE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB,CAEA;AAED,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,mBAAmB,GACxB,wBAAwB,EAAE,CAM5B;AAED,eAAO,MAAM,8BAA8B,EAAE,wBAAwB,CACnE,mBAAmB,EACnB,sBAAsB,CAAC,kCAAkC,CAAC,CAY3D,CAAC"}

package/dist/providers/cursor/codec/sync-extension.js

@@ -343,14 +343,17 @@ async function assertSafeCursorMutationPath(scopeRoot, absolutePath) {
     }
 }
 export async function applyCursorProjectExtensionPlan(scopeRoot, plan) {
-    const result = {
-        applied: 0,
-        failed: 0,
-        skipped: 0,
-    };
+    const operationResults = [];
     for (const operation of plan.operations) {
         if (operation.action === 'skip') {
-            result.skipped += 1;
+            operationResults.push({
+                provider: operation.provider,
+                target: operation.target,
+                path: operation.path,
+                entryName: operation.entryName,
+                action: operation.action,
+                status: 'current',
+            });
             continue;
         }
         const absolutePath = resolve(scopeRoot, operation.path);
@@ -363,13 +366,41 @@ export async function applyCursorProjectExtensionPlan(scopeRoot, plan) {
                 await ensureDir(dirname(absolutePath));
                 await writeFile(absolutePath, operation.content ?? '', 'utf8');
             }
-            result.applied += 1;
+            operationResults.push({
+                provider: operation.provider,
+                target: operation.target,
+                path: operation.path,
+                entryName: operation.entryName,
+                action: operation.action,
+                status: 'changed',
+            });
         }
-        catch {
-            result.failed += 1;
+        catch (error) {
+            const missing = typeof error === 'object' &&
+                error !== null &&
+                'code' in error &&
+                error.code === 'ENOENT';
+            operationResults.push({
+                provider: operation.provider,
+                target: operation.target,
+                path: operation.path,
+                entryName: operation.entryName,
+                action: operation.action,
+                status: missing ? 'missing' : 'failed',
+                failure: missing
+                    ? 'Materialization input was missing; restore it and retry sync.'
+                    : 'Materialization failed; inspect local verbose diagnostics and retry sync.',
+            });
         }
     }
-    return result;
+    return {
+        applied: operationResults.filter(({ status }) => status === 'changed')
+            .length,
+        failed: operationResults.filter(({ status }) => status === 'failed' || status === 'missing').length,
+        skipped: operationResults.filter(({ status }) => status === 'current')
+            .length,
+        operations: operationResults,
+    };
 }
 export function hasCursorExtensionChanges(plan) {
     return hasMaterializationChanges(plan);

package/dist/providers/identity/absolute-paths.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Absolute-path detection for dispatch records and messages.
+ *
+ * Two patterns, deliberately different. `IDENTITY_PATH_PATTERN` is strict and
+ * used where a path is never a legitimate value, so ambiguity resolves to
+ * rejection. `PROSE_PATH_PATTERN` is conservative and used where a false
+ * positive would corrupt legitimate evidence, so it under-matches by design:
+ * colon-prefixed forms, path-shaped routes inside URLs, and trailing-slash
+ * candidates survive. Prose redaction is therefore best-effort, not a
+ * guarantee — see `spec.md` NFR1, amended 2026-09-03.
+ *
+ * Before this module there were two independent notions of
+ * "looks like a path": a regex inside `redactDispatchMessage`, which only
+ * scrubbed error text, and nothing at all on the persistence boundary. The
+ * durable journal is committed to a shared repository, so a username or local
+ * layout that reaches it is in git history permanently.
+ *
+ * Message redaction and record sanitization now share this detector, because
+ * the gap between them is precisely what allowed paths to be scrubbed from a
+ * message and written verbatim into the record in the same command.
+ */
+/** The stable stand-in, matching the `<tier>/agents/<role>.md` precedent. */
+export declare const REDACTED_PATH = "<redacted-path>";
+/**
+ * Identity-field detector. Rejects on ambiguity by design.
+ */
+export declare function containsAbsolutePath(value: string): boolean;
+/**
+ * Best-effort prose redaction. NOT a guarantee.
+ *
+ * Known limits, stated so they are visible rather than assumed away:
+ * - A colon-prefixed path (`cwd:/Users/alice`) survives, because `:` cannot be
+ *   treated as a path delimiter without mangling every URL.
+ * - A candidate inside an http(s) URL is left alone, so a path-shaped route
+ *   such as `?next=/dashboard` survives.
+ * - A candidate ending in `/` is left alone, because `/foo/bar/` is far more
+ *   often a regex literal than a directory in prose.
+ * - Any path shape the pattern does not match survives.
+ *
+ * The bias is deliberate. A path leaked into prose is a disclosure; a mangled
+ * URL or regex is corrupted evidence, and corrupted evidence is worse in a
+ * provenance record. Identity and control fields carry the enforceable half of
+ * the guarantee via {@link containsAbsolutePath}.
+ */
+export declare function redactAbsolutePaths(value: string): string;
+/**
+ * Recursively redact every string in a JSON value. Used for prose and nested
+ * evidence containers, where a path is plausible incidental content rather than
+ * a malformed identifier.
+ */
+export declare function redactAbsolutePathsDeep<T>(value: T): T;
+/**
+ * Recursively reject any absolute path. Used for identity and control fields,
+ * where a path is never a legitimate value and silently rewriting one would
+ * corrupt the identifier it claims to be.
+ */
+export declare function assertNoAbsolutePath(value: unknown, path: string): void;
+/**
+ * The publication postcondition, scoped to what is actually guaranteed.
+ *
+ * It hard-fails on a path in an identity or control field, which is the half of
+ * NFR1 that is enforceable. It deliberately does **not** claim that no absolute
+ * path remains anywhere in the revision: prose redaction is best-effort, and a
+ * postcondition that asserted more than the sanitizer can deliver would be a
+ * false guarantee rather than a check.
+ */
+export declare function assertJournalIdentityHasNoAbsolutePath(identityFields: Readonly<Record<string, unknown>>): void;
+//# sourceMappingURL=absolute-paths.d.ts.map

package/dist/providers/identity/absolute-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"absolute-paths.d.ts","sourceRoot":"","sources":["../../../src/providers/identity/absolute-paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AA6BH,6EAA6E;AAC7E,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAM/C;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE3D;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOzD;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CActD;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAmBvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,sCAAsC,CACpD,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAChD,IAAI,CAIN"}

package/dist/providers/identity/absolute-paths.js

@@ -0,0 +1,144 @@
+/**
+ * Absolute-path detection for dispatch records and messages.
+ *
+ * Two patterns, deliberately different. `IDENTITY_PATH_PATTERN` is strict and
+ * used where a path is never a legitimate value, so ambiguity resolves to
+ * rejection. `PROSE_PATH_PATTERN` is conservative and used where a false
+ * positive would corrupt legitimate evidence, so it under-matches by design:
+ * colon-prefixed forms, path-shaped routes inside URLs, and trailing-slash
+ * candidates survive. Prose redaction is therefore best-effort, not a
+ * guarantee — see `spec.md` NFR1, amended 2026-09-03.
+ *
+ * Before this module there were two independent notions of
+ * "looks like a path": a regex inside `redactDispatchMessage`, which only
+ * scrubbed error text, and nothing at all on the persistence boundary. The
+ * durable journal is committed to a shared repository, so a username or local
+ * layout that reaches it is in git history permanently.
+ *
+ * Message redaction and record sanitization now share this detector, because
+ * the gap between them is precisely what allowed paths to be scrubbed from a
+ * message and written verbatim into the record in the same command.
+ */
+/**
+ * Two detectors, because one regex cannot serve both jobs.
+ *
+ * `/dashboard` is a URL route, `/foo/bar/` is a regex literal, and
+ * `path:/Users/alice` is a real disclosure. Three rounds of tuning a single
+ * delimiter-sensitive pattern traded a leak for a mangled value each time, so
+ * the detectors are now split by what the field can legitimately contain.
+ *
+ * IDENTITY fields (caller, scope, selectors, routes, guidance references,
+ * authority, catalog snapshot, candidates, fallback) admit no URL, no regex and
+ * no path, so ambiguity there is resolved by rejecting. Its lookbehind includes
+ * `:` so `cwd:/Users/alice` is caught.
+ *
+ * PROSE fields carry human text and quoted evidence, where a URL or a regex is
+ * legitimate content. Redaction there is deliberately conservative and
+ * best-effort — see {@link redactAbsolutePaths}.
+ */
+const IDENTITY_PATH_PATTERN = /(?<=^|[\s'"`([{<=,;|:])(?:file:\/\/[^\s'"`;,)\]}]*|\\\\[^\s'"`;,)\]}]+|[A-Za-z]:[\\/][^\s'"`;,)\]}]*|\/(?!\/)[^\s'"`;,)\]}]+)/g;
+/** As above, minus `:`, which is what makes URLs and regexes distinguishable. */
+const PROSE_PATH_PATTERN = /(?<=^|[\s'"`([{<=,;|])(?:file:\/\/[^\s'"`;,)\]}]*|\\\\[^\s'"`;,)\]}]+|[A-Za-z]:[\\/][^\s'"`;,)\]}]*|\/(?!\/)[^\s'"`;,)\]}]+)/g;
+/** Spans of an http(s) URL, whose internal slashes are routes, not paths. */
+const HTTP_URL_PATTERN = /https?:\/\/[^\s'"`)\]}]*/g;
+/** The stable stand-in, matching the `<tier>/agents/<role>.md` precedent. */
+export const REDACTED_PATH = '<redacted-path>';
+function fresh(pattern) {
+    return new RegExp(pattern.source, 'g');
+}
+/**
+ * Identity-field detector. Rejects on ambiguity by design.
+ */
+export function containsAbsolutePath(value) {
+    return fresh(IDENTITY_PATH_PATTERN).test(value);
+}
+function httpUrlSpans(value) {
+    const spans = [];
+    const pattern = fresh(HTTP_URL_PATTERN);
+    let match;
+    while ((match = pattern.exec(value)) !== null) {
+        spans.push([match.index, match.index + match[0].length]);
+    }
+    return spans;
+}
+/**
+ * Best-effort prose redaction. NOT a guarantee.
+ *
+ * Known limits, stated so they are visible rather than assumed away:
+ * - A colon-prefixed path (`cwd:/Users/alice`) survives, because `:` cannot be
+ *   treated as a path delimiter without mangling every URL.
+ * - A candidate inside an http(s) URL is left alone, so a path-shaped route
+ *   such as `?next=/dashboard` survives.
+ * - A candidate ending in `/` is left alone, because `/foo/bar/` is far more
+ *   often a regex literal than a directory in prose.
+ * - Any path shape the pattern does not match survives.
+ *
+ * The bias is deliberate. A path leaked into prose is a disclosure; a mangled
+ * URL or regex is corrupted evidence, and corrupted evidence is worse in a
+ * provenance record. Identity and control fields carry the enforceable half of
+ * the guarantee via {@link containsAbsolutePath}.
+ */
+export function redactAbsolutePaths(value) {
+    const spans = httpUrlSpans(value);
+    return value.replace(fresh(PROSE_PATH_PATTERN), (match, offset) => {
+        if (match.endsWith('/'))
+            return match;
+        const inUrl = spans.some(([from, to]) => offset >= from && offset < to);
+        return inUrl ? match : REDACTED_PATH;
+    });
+}
+/**
+ * Recursively redact every string in a JSON value. Used for prose and nested
+ * evidence containers, where a path is plausible incidental content rather than
+ * a malformed identifier.
+ */
+export function redactAbsolutePathsDeep(value) {
+    if (typeof value === 'string')
+        return redactAbsolutePaths(value);
+    if (Array.isArray(value)) {
+        return value.map((entry) => redactAbsolutePathsDeep(entry));
+    }
+    if (value !== null && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value).map(([key, entry]) => [
+            key,
+            redactAbsolutePathsDeep(entry),
+        ]));
+    }
+    return value;
+}
+/**
+ * Recursively reject any absolute path. Used for identity and control fields,
+ * where a path is never a legitimate value and silently rewriting one would
+ * corrupt the identifier it claims to be.
+ */
+export function assertNoAbsolutePath(value, path) {
+    if (typeof value === 'string') {
+        if (containsAbsolutePath(value)) {
+            throw new Error(`A dispatch record must not carry an absolute filesystem path at ${path}.`);
+        }
+        return;
+    }
+    if (Array.isArray(value)) {
+        value.forEach((entry, index) => assertNoAbsolutePath(entry, `${path}[${index}]`));
+        return;
+    }
+    if (value === null || typeof value !== 'object')
+        return;
+    for (const [key, entry] of Object.entries(value)) {
+        assertNoAbsolutePath(entry, `${path}.${key}`);
+    }
+}
+/**
+ * The publication postcondition, scoped to what is actually guaranteed.
+ *
+ * It hard-fails on a path in an identity or control field, which is the half of
+ * NFR1 that is enforceable. It deliberately does **not** claim that no absolute
+ * path remains anywhere in the revision: prose redaction is best-effort, and a
+ * postcondition that asserted more than the sanitizer can deliver would be a
+ * false guarantee rather than a check.
+ */
+export function assertJournalIdentityHasNoAbsolutePath(identityFields) {
+    for (const [field, value] of Object.entries(identityFields)) {
+        assertNoAbsolutePath(value, `<journal>.${field}`);
+    }
+}