@open-agent-toolkit/cli 0.2.51 → 0.2.53

package/dist/engine/scanner.js

@@ -1,5 +1,5 @@
 import { readdir } from 'node:fs/promises';
-import { join, resolve } from 'node:path';
+import { isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { CliError } from '../errors/index.js';
 import { resolveAssetsRoot } from '../fs/assets.js';
 import { SCOPE_CONTENT_TYPES, USER_SCOPE_MANAGED_AGENT_FILES, } from '../shared/types.js';
@@ -58,13 +58,67 @@ export async function scanBundledManagedAgents() {
         isFile: true,
     }));
 }
+/**
+ * User-scope Codex/Cursor materialization reads the bundled managed role files,
+ * not the installed copies under `~/.agents/agents/`. Concatenating both lists
+ * produces the same Cursor/Codex role name twice and aborts the whole sync.
+ */
+export function mergeUserScopeMaterializationEntries(canonicalEntries, bundledManagedAgents) {
+    const bundledNames = new Set(bundledManagedAgents.map((entry) => entry.name));
+    const merged = [];
+    const seenBundledNames = new Set();
+    for (const entry of bundledManagedAgents) {
+        if (seenBundledNames.has(entry.name)) {
+            continue;
+        }
+        seenBundledNames.add(entry.name);
+        merged.push(entry);
+    }
+    for (const entry of canonicalEntries) {
+        if (entry.type === 'agent' && bundledNames.has(entry.name)) {
+            continue;
+        }
+        merged.push(entry);
+    }
+    return merged;
+}
+export function materializationCanonicalPathAllowed(scopeRoot, canonicalEntry, allowedCanonicalPaths) {
+    if (!allowedCanonicalPaths?.length) {
+        return true;
+    }
+    const allowed = new Set(allowedCanonicalPaths);
+    const relativePath = relative(scopeRoot, canonicalEntry.canonicalPath).replaceAll('\\', '/');
+    if (allowed.has(relativePath)) {
+        return true;
+    }
+    return (canonicalEntry.type === 'agent' &&
+        canonicalEntry.isFile &&
+        allowed.has(join('.agents', 'agents', canonicalEntry.name).replaceAll('\\', '/')));
+}
 /** @deprecated Use scanBundledManagedAgents for provider-neutral materialization. */
 export const scanBundledManagedCodexAgents = scanBundledManagedAgents;
-export async function scanCanonical(basePath, scope) {
+export async function scanCanonical(basePath, scope, targets) {
     const scopeRoot = resolve(basePath);
     const entries = [];
-    for (const contentType of SCOPE_CONTENT_TYPES[scope]) {
-        const contentDir = join(scopeRoot, '.agents', canonicalDirectoryName(contentType));
+    const scanTargets = targets ??
+        SCOPE_CONTENT_TYPES[scope].map((contentType) => ({
+            contentType,
+            canonicalDir: join('.agents', canonicalDirectoryName(contentType)),
+        }));
+    const seenTargets = new Set();
+    for (const { contentType, canonicalDir } of scanTargets) {
+        const contentDir = resolve(scopeRoot, canonicalDir);
+        const relativeContentDir = relative(scopeRoot, contentDir);
+        if (isAbsolute(canonicalDir) ||
+            relativeContentDir === '..' ||
+            relativeContentDir.startsWith(`..${sep}`)) {
+            throw new CliError(`Canonical scan target must stay within the scope root: ${canonicalDir}`);
+        }
+        const targetKey = `${contentType}::${contentDir}`;
+        if (seenTargets.has(targetKey)) {
+            continue;
+        }
+        seenTargets.add(targetKey);
         const includeFiles = contentType === 'agent' || contentType === 'rule';
         const scanned = await readEntries(contentDir);
         for (const scannedEntry of scanned) {

package/dist/fs/io.d.ts

@@ -1,10 +1,77 @@
 export declare function fileExists(path: string): Promise<boolean>;
 export declare function dirExists(path: string): Promise<boolean>;
 export type LinkStrategy = 'symlink' | 'copy';
+export interface CreatedCollectionSymlink {
+    linkText: string;
+    device: string;
+    inode: string;
+}
+export interface CollectionSymlinkCreationGuard {
+    scopeRoot: string;
+    expectedParent: {
+        device: string;
+        inode: string;
+    };
+}
 export type CopyDirectoryFilter = (sourcePath: string, relativePath: string) => boolean | Promise<boolean>;
 export declare function ensureDir(dirPath: string): Promise<void>;
 export declare function copyDirectory(src: string, dest: string, filter?: CopyDirectoryFilter, sourceRoot?: string): Promise<void>;
 export declare function copySingleFile(src: string, dest: string): Promise<void>;
+export declare function copySingleFileNoClobber(src: string, dest: string): Promise<void>;
+export declare function writeFileNoClobber(dest: string, content: string): Promise<void>;
 export declare function createSymlink(target: string, linkPath: string, onFallback?: (error: unknown) => void, isFile?: boolean): Promise<LinkStrategy>;
+export declare function createSymlinkNoClobber(target: string, linkPath: string, isFile?: boolean): Promise<'symlink'>;
+export declare function createCollectionSymlinkNoClobber(_target: string, linkPath: string, guard: CollectionSymlinkCreationGuard): Promise<CreatedCollectionSymlink>;
+export declare function removeCollectionSymlinkIfUnchanged(linkPath: string, created: CreatedCollectionSymlink): Promise<boolean>;
+/**
+ * The one serialization of a JSON document OAT writes to disk.
+ *
+ * Every size bound that claims to constrain a published file must measure this
+ * exact string. Validating compact `JSON.stringify` while writing pretty-printed
+ * output with a trailing newline let a record validated at 65,536 bytes land on
+ * disk at 65,874.
+ */
+export declare function serializeJsonDocument(data: unknown): string;
 export declare function atomicWriteJson(filePath: string, data: unknown): Promise<void>;
+export interface ContainedWriterLockOptions {
+    timeoutMs?: number;
+    minReclaimMs?: number;
+    hardStaleMs?: number;
+}
+/**
+ * Exclusive contained writer lock. `mkdir` without `recursive` is the atomic
+ * primitive: exactly one caller can create the directory, and every other
+ * caller observes `EEXIST`. The lock is validated as a real directory so a
+ * planted symlink fails closed instead of redirecting the guarded section, it
+ * records holder evidence so a crashed writer can be reclaimed rather than
+ * wedging the project forever, and no message it raises contains an absolute
+ * path.
+ */
+export declare function withContainedWriterLock<T>(lockPath: string, scopeRoot: string, run: () => Promise<T>, options?: ContainedWriterLockOptions): Promise<T>;
+export declare function journalErrorCode(error: unknown): string | null;
+/**
+ * Re-raise a filesystem error without Node's absolute-path message text while
+ * preserving its `code` so callers can still branch on `EEXIST`/`ENOENT`.
+ * Exported so every journal producer redacts identically instead of each one
+ * re-deriving the rule.
+ */
+export declare function redactedFsError(error: unknown, operation: string, relativeTarget: string): Error;
+/**
+ * Publish one immutable JSON journal revision.
+ *
+ * Guarantees, stated as what the code does:
+ * - The destination is created with `link` only. An occupied destination raises
+ *   `EEXIST`; the destination is never renamed onto, removed, or truncated.
+ * - After publication the destination is proven to be the exact staged inode,
+ *   inside the same directory inode validated before staging, still resolving
+ *   inside `scopeRoot`. Failure raises and removes nothing.
+ * - Staging cleanup removes only the inode this call created.
+ * - No raised message contains an absolute path.
+ *
+ * Residual, unchanged by this design: a privileged concurrent process that
+ * swaps the validated directory pathname can cause the `link` to create an
+ * unreferenced file under a directory it controls, and can strand the staged
+ * file. Neither outcome replaces or deletes pre-existing content.
+ */
+export declare function publishContainedJsonRevision(filePath: string, data: unknown, scopeRoot: string): Promise<void>;
 //# sourceMappingURL=io.d.ts.map

package/dist/fs/io.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"io.d.ts","sourceRoot":"","sources":["../../src/fs/io.ts"],"names":[],"mappings":"AAaA,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAO/D;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAO9D;AAED,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,MAAM,CAAC;AAC9C,MAAM,MAAM,mBAAmB,GAAG,CAChC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,KACjB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9D;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,mBAAmB,EAC5B,UAAU,SAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAwBf;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI7E;AAED,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,EACrC,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,YAAY,CAAC,CAuBvB;AAED,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,IAAI,CAAC,CAKf"}
+{"version":3,"file":"io.d.ts","sourceRoot":"","sources":["../../src/fs/io.ts"],"names":[],"mappings":"AA4BA,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAO/D;AAED,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAO9D;AAED,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,MAAM,CAAC;AAC9C,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AACD,MAAM,WAAW,8BAA8B;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE;QACd,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAGD,MAAM,MAAM,mBAAmB,GAAG,CAChC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,KACjB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9D;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,mBAAmB,EAC5B,UAAU,SAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAwBf;AAED,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI7E;AAED,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAGf;AAED,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,EACrC,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,YAAY,CAAC,CAuBvB;AAED,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,SAAS,CAAC,CAOpB;AAED,wBAAsB,gCAAgC,CACpD,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,wBAAwB,CAAC,CA0FnC;AAED,wBAAsB,kCAAkC,CACtD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,OAAO,CAAC,CAsBlB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAE3D;AAED,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,IAAI,CAAC,CAKf;AA2GD,MAAM,WAAW,0BAA0B;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAAC,CAAC,EAC7C,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACrB,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,CAAC,CAAC,CA6EZ;AAiED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAE9D;AAQD;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,GACrB,KAAK,CAOP;AAsFD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,4BAA4B,CAChD,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CA2If"}