@open-agent-toolkit/cli 0.2.63 → 0.2.65

package/dist/commands/tools/update/update-tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update-tools.d.ts","sourceRoot":"","sources":["../../../../src/commands/tools/update/update-tools.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,8BAA8B,CAAC;AACpF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0CAA0C,CAAC;AAM3E,OAAO,KAAK,EACV,wBAAwB,EACxB,mBAAmB,EACpB,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACzB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,+CAA+C,CAAC;AAEvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC;AAEpB,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,UAAU,GAAG,QAAQ,GAAG,WAAW,GAAG,MAAM,CAAC;IACnD,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,SAAS,GAAG,WAAW,CAAC;CACjC;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,QAAQ,EAAE,CAAC;IACvB,cAAc,EAAE,gBAAgB,EAAE,CAAC;IACnC,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAE,oBAAoB,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9D,gBAAgB,EAAE,CAChB,KAAK,EAAE,aAAa,EACpB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,KACT,OAAO,CAAC,MAAM,CAAC,CAAC;IACrB,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,iBAAiB,EAAE,CACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,OAAO,KACX,OAAO,CAAC,UAAU,CAAC,CAAC;IACzB,kBAAkB,EAAE,CAClB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,OAAO,KACX,OAAO,CAAC,UAAU,CAAC,CAAC;IACzB,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,qBAAqB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC1E,yBAAyB,CAAC,EAAE,CAC1B,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,+BAA+B,CAAC,CAAC;IAC9C,mBAAmB,CAAC,EAAE,CACpB,KAAK,EAAE,wBAAwB,KAC5B,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAClC,cAAc,CAAC,EAAE,CACf,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EACzC,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,KAC3B,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;CACrC;AAqDD,wBAAsB,WAAW,CAC/B,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,aAAa,EAAE,EACvB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,OAAO,EACf,YAAY,EAAE,uBAAuB,GACpC,OAAO,CAAC,YAAY,CAAC,CAuQvB;AAmDD,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,EAC/C,MAAM,EAAE,SAAS,aAAa,EAAE,EAChC,KAAK,EAAE,OAAO,GACb,oBAAoB,EAAE,CAmBxB"}
+{"version":3,"file":"update-tools.d.ts","sourceRoot":"","sources":["../../../../src/commands/tools/update/update-tools.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,8BAA8B,CAAC;AACpF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0CAA0C,CAAC;AAM3E,OAAO,KAAK,EACV,wBAAwB,EACxB,mBAAmB,EACpB,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACzB,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAIL,KAAK,oBAAoB,EAC1B,MAAM,+CAA+C,CAAC;AAMvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAE/E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC1E,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE,CAAC;AAEpB,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,UAAU,GAAG,QAAQ,GAAG,WAAW,GAAG,MAAM,CAAC;IACnD,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,EAAE,aAAa,CAAC;IACrB,MAAM,EAAE,SAAS,GAAG,WAAW,CAAC;CACjC;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,QAAQ,EAAE,CAAC;IACvB,cAAc,EAAE,gBAAgB,EAAE,CAAC;IACnC,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAE,oBAAoB,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9D,gBAAgB,EAAE,CAChB,KAAK,EAAE,aAAa,EACpB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,KACT,OAAO,CAAC,MAAM,CAAC,CAAC;IACrB,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,iBAAiB,EAAE,CACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,OAAO,KACX,OAAO,CAAC,UAAU,CAAC,CAAC;IACzB,kBAAkB,EAAE,CAClB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,OAAO,KACX,OAAO,CAAC,UAAU,CAAC,CAAC;IACzB,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,qBAAqB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC1E,yBAAyB,CAAC,EAAE,CAC1B,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,+BAA+B,CAAC,CAAC;IAC9C,mBAAmB,CAAC,EAAE,CACpB,KAAK,EAAE,wBAAwB,KAC5B,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAClC,cAAc,CAAC,EAAE,CACf,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EACzC,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,KAC3B,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;CACrC;AAqDD,wBAAsB,WAAW,CAC/B,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,aAAa,EAAE,EACvB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,OAAO,EACf,YAAY,EAAE,uBAAuB,GACpC,OAAO,CAAC,YAAY,CAAC,CAuQvB;AAwED,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,EAC/C,MAAM,EAAE,SAAS,aAAa,EAAE,EAChC,KAAK,EAAE,OAAO,GACb,oBAAoB,EAAE,CAsBxB"}

package/dist/commands/tools/update/update-tools.js

@@ -2,8 +2,10 @@ import { join } from 'node:path';
 import { hasScopedPackRealizationEvidence, packScopeFactsFromInventory, projectPackEvidence, } from '../../tools/shared/pack-evidence.js';
 import { inventoryScopedPack } from '../../tools/shared/pack-inventory.js';
 import {} from '../../tools/shared/pack-lifecycle.js';
-import { evaluatePackLifecycleOutcome, resolveAdditivePackScopeSelection, } from '../../tools/shared/pack-lifecycle-outcome.js';
+import { evaluatePackLifecycleOutcome, notRunProviderSyncOutcome, resolveAdditivePackScopeSelection, } from '../../tools/shared/pack-lifecycle-outcome.js';
 import { getPackDefinition } from '../../tools/shared/pack-manifest.js';
+import { lifecycleProviderEvidence, withLifecycleProviderEvidence, } from '../../tools/shared/pack-provider-evidence.js';
+import { resolveProviderScopeContexts } from '../../tools/shared/provider-context.js';
 function getBundledPackAssets(pack, scope) {
     const assets = getPackDefinition(pack).assets.filter(({ scopes, ownership }) => scopes.includes(scope) && ownership[scope] === 'managed');
     return {
@@ -71,7 +73,7 @@ export async function updateTools(target, scopes, cwd, home, dryRun, dependencie
             return result;
         }
         const lifecycle = await dependencies.reconcilePacks(requests, { dryRun });
-        result.lifecycle = updateLifecycleOutcomes(lifecycle);
+        result.lifecycle = await updateLifecycleOutcomes(lifecycle);
         result.plans.push(...lifecycle.map(({ plan }) => plan));
         for (const entry of lifecycle) {
             const definition = getPackDefinition(entry.request.pack);
@@ -252,9 +254,14 @@ export async function updateTools(target, scopes, cwd, home, dryRun, dependencie
     }
     return result;
 }
-function updateLifecycleOutcomes(results) {
+async function updateLifecycleOutcomes(results) {
     const verifiable = results.filter(({ apply }) => apply === null || ('inventory' in apply && apply.inventory !== undefined));
     const packs = [...new Set(verifiable.map(({ request }) => request.pack))];
+    // Every request carries the scope root it acted on, so the config-aware
+    // provider context is resolvable without re-deriving paths here.
+    const providerContexts = await resolveProviderScopeContexts({
+        scopeRoots: Object.fromEntries(verifiable.map(({ request }) => [request.scope, request.scopeRoot])),
+    });
     return packs.map((pack) => {
         const lifecycle = verifiable.filter(({ request }) => request.pack === pack);
         const requestedScopes = lifecycle.map(({ request }) => request.scope);
@@ -273,13 +280,21 @@ function updateLifecycleOutcomes(results) {
                 .map(({ request }) => request.scope),
             unknownScopes: [],
         });
+        const providers = lifecycleProviderEvidence({
+            pack,
+            scopedInventories: finalScopes,
+            providerContexts,
+            scopes: selection.targetScopes,
+        });
+        const sync = notRunProviderSyncOutcome(providers, 'Auto-sync has not run for this operation');
+        const providerEvidence = withLifecycleProviderEvidence(finalEvidence, providers);
         if (lifecycle.every(({ apply }) => apply === null)) {
             return {
                 schemaVersion: 1,
                 selection,
                 canonical: { status: 'unchanged', results: lifecycle },
-                sync: { scopes: [], status: 'not-run', providers: [] },
-                finalEvidence,
+                sync,
+                finalEvidence: providerEvidence,
                 status: 'complete',
                 recovery: [],
             };
@@ -287,8 +302,8 @@ function updateLifecycleOutcomes(results) {
         return evaluatePackLifecycleOutcome({
             selection,
             lifecycle,
-            sync: { scopes: [], status: 'not-run', providers: [] },
-            finalEvidence,
+            sync,
+            finalEvidence: providerEvidence,
         });
     });
 }
@@ -305,7 +320,7 @@ export function failedUpdateLifecycleOutcomes(target, scopes, error) {
             targetScopes: scopes,
         },
         canonical: { status: 'failed', results: [] },
-        sync: { scopes: [], status: 'not-run', providers: [] },
+        sync: notRunProviderSyncOutcome([], 'Canonical apply failed before auto-sync'),
         finalEvidence: null,
         status: 'failed',
         recovery: [{ code: 'canonical-apply-failed', message }],

package/dist/config/json.d.ts

@@ -1,2 +1,38 @@
+/**
+ * Parse one OAT config document.
+ *
+ * This is the single parse chokepoint for every OAT config read, so the
+ * prototype question is decided here rather than in each consumer.
+ *
+ * `jsonc-parser`'s `parse` fills a plain object by assignment, and assignment
+ * to a member literally named `__proto__` reaches the legacy prototype setter.
+ * That loses the key as data *and* installs its value as the parsed object's
+ * prototype, after which normalization reads the injected members as though
+ * they had been configured: a config file holding only
+ * `{"__proto__":{"git":{"defaultBranch":"x"}}}` made `oat config get
+ * git.defaultBranch` answer `x`. So the tree API is used instead, and the tree
+ * is materialized here rather than by `getNodeValue`.
+ *
+ * Materialization defines every own key with `Object.defineProperty`, which
+ * stores `__proto__` as an ordinary own data property without ever invoking
+ * the prototype setter. The objects it builds are otherwise completely
+ * ordinary: they keep `Object.prototype`, so every consumer coercion — most
+ * importantly `String(value)` in the `projects.defaultScope` diagnostic at
+ * `config/oat-config.ts` — behaves byte-identically to the previous
+ * implementation, and the result round-trips through `JSON.stringify`
+ * unchanged. `getNodeValue` is deliberately not used: it returns
+ * null-prototype objects, which break those coercions, and it recurses, which
+ * roughly halved the accepted nesting depth and turned deep-but-valid
+ * documents into a `RangeError` instead of the contracted `SyntaxError`. The
+ * walk below uses an explicit stack for that reason, which restores parity
+ * with the previous implementation. Parity, not a guarantee: `parseTree` still
+ * recurses while scanning, so the hard limit is a stack depth that moves with
+ * the host and the JIT rather than a fixed number.
+ *
+ * The error contract is untouched: `parseTree` reports the same `ParseError`
+ * codes at the same offsets as `parse` for every input, so the set of
+ * documents that are rejected and the `SyntaxError` message are both
+ * byte-identical to the previous implementation.
+ */
 export declare function parseJsonConfig(raw: string, configPath: string): unknown;
 //# sourceMappingURL=json.d.ts.map

package/dist/config/json.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../../src/config/json.ts"],"names":[],"mappings":"AAYA,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAcxE"}
+{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../../src/config/json.ts"],"names":[],"mappings":"AAaA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAuBxE"}

package/dist/config/json.js

@@ -1,18 +1,150 @@
-import { parse as parseJsonc, printParseErrorCode, } from 'jsonc-parser';
+import { parseTree, printParseErrorCode, } from 'jsonc-parser';
 const JSON_CONFIG_PARSE_OPTIONS = {
     allowTrailingComma: true,
     disallowComments: true,
 };
+/**
+ * Parse one OAT config document.
+ *
+ * This is the single parse chokepoint for every OAT config read, so the
+ * prototype question is decided here rather than in each consumer.
+ *
+ * `jsonc-parser`'s `parse` fills a plain object by assignment, and assignment
+ * to a member literally named `__proto__` reaches the legacy prototype setter.
+ * That loses the key as data *and* installs its value as the parsed object's
+ * prototype, after which normalization reads the injected members as though
+ * they had been configured: a config file holding only
+ * `{"__proto__":{"git":{"defaultBranch":"x"}}}` made `oat config get
+ * git.defaultBranch` answer `x`. So the tree API is used instead, and the tree
+ * is materialized here rather than by `getNodeValue`.
+ *
+ * Materialization defines every own key with `Object.defineProperty`, which
+ * stores `__proto__` as an ordinary own data property without ever invoking
+ * the prototype setter. The objects it builds are otherwise completely
+ * ordinary: they keep `Object.prototype`, so every consumer coercion — most
+ * importantly `String(value)` in the `projects.defaultScope` diagnostic at
+ * `config/oat-config.ts` — behaves byte-identically to the previous
+ * implementation, and the result round-trips through `JSON.stringify`
+ * unchanged. `getNodeValue` is deliberately not used: it returns
+ * null-prototype objects, which break those coercions, and it recurses, which
+ * roughly halved the accepted nesting depth and turned deep-but-valid
+ * documents into a `RangeError` instead of the contracted `SyntaxError`. The
+ * walk below uses an explicit stack for that reason, which restores parity
+ * with the previous implementation. Parity, not a guarantee: `parseTree` still
+ * recurses while scanning, so the hard limit is a stack depth that moves with
+ * the host and the JIT rather than a fixed number.
+ *
+ * The error contract is untouched: `parseTree` reports the same `ParseError`
+ * codes at the same offsets as `parse` for every input, so the set of
+ * documents that are rejected and the `SyntaxError` message are both
+ * byte-identical to the previous implementation.
+ */
 export function parseJsonConfig(raw, configPath) {
     const errors = [];
-    const parsed = parseJsonc(raw, errors, JSON_CONFIG_PARSE_OPTIONS);
+    const root = parseTree(raw, errors, JSON_CONFIG_PARSE_OPTIONS);
     if (errors.length > 0) {
         const details = errors
             .map((error) => formatParseError(raw, error))
             .join('; ');
         throw new SyntaxError(`Config at ${configPath} is not valid JSON: ${details}`);
     }
-    return parsed;
+    // TypeScript narrowing after the rejection above: `parseTree` returns no root
+    // for any document that holds no value — empty or whitespace-only content,
+    // but also a stray `]` or comment-only content — and every one of those
+    // records a parse error and has already thrown. The branch keeps the walk
+    // total rather than describing a reachable case.
+    if (root === undefined) {
+        return undefined;
+    }
+    return materializeTree(root);
+}
+/**
+ * Assignment that cannot be intercepted by an accessor on the prototype chain.
+ *
+ * `target[key] = value` would invoke the legacy `__proto__` setter; a data
+ * descriptor never does. The descriptor matches what a plain assignment would
+ * otherwise produce, so the property is indistinguishable from an ordinary
+ * one, and re-defining a repeated key overwrites in place exactly as
+ * assignment did.
+ */
+function defineOwnProperty(target, key, value) {
+    Object.defineProperty(target, key, {
+        value,
+        enumerable: true,
+        writable: true,
+        configurable: true,
+    });
+}
+/**
+ * Convert a parse tree into plain JavaScript values without recursion.
+ *
+ * Each frame carries the callback that attaches its finished value to the
+ * parent container, so containers are created on the way down and filled as
+ * their children pop. Nesting depth costs a heap array entry rather than a
+ * call frame, which is what keeps a deeply nested config from overflowing the
+ * stack.
+ */
+function materializeTree(root) {
+    let result;
+    const stack = [
+        {
+            node: root,
+            attach: (value) => {
+                result = value;
+            },
+        },
+    ];
+    while (stack.length > 0) {
+        const frame = stack.pop();
+        if (frame === undefined) {
+            break;
+        }
+        const { node } = frame;
+        if (node.type === 'array') {
+            const children = node.children ?? [];
+            const array = new Array(children.length);
+            frame.attach(array);
+            // Pushed in reverse so children pop in source order.
+            for (let index = children.length - 1; index >= 0; index -= 1) {
+                const child = children[index];
+                if (child === undefined) {
+                    continue;
+                }
+                stack.push({
+                    node: child,
+                    attach: (value) => {
+                        array[index] = value;
+                    },
+                });
+            }
+            continue;
+        }
+        if (node.type === 'object') {
+            const object = {};
+            frame.attach(object);
+            const properties = node.children ?? [];
+            for (let index = properties.length - 1; index >= 0; index -= 1) {
+                const property = properties[index];
+                const keyNode = property?.children?.[0];
+                const valueNode = property?.children?.[1];
+                // A property with no value node is an incomplete document, which the
+                // error check has already rejected; skipping it matches `getNodeValue`.
+                if (keyNode === undefined || valueNode === undefined) {
+                    continue;
+                }
+                const key = String(keyNode.value);
+                stack.push({
+                    node: valueNode,
+                    attach: (value) => {
+                        defineOwnProperty(object, key, value);
+                    },
+                });
+            }
+            continue;
+        }
+        frame.attach(node.value);
+    }
+    return result;
 }
 function formatParseError(raw, error) {
     const location = offsetToLineColumn(raw, error.offset);

package/dist/drift/index.d.ts

@@ -3,5 +3,7 @@ export type { CopyTransform } from './detector.js';
 export type { DriftReport, DriftState } from './drift.types.js';
 export { filterKnownStrays } from './known-strays.js';
 export type { FilterKnownStraysOptions, FilterKnownStraysResult, KnownStrayCandidate, KnownStraySources, } from './known-strays.js';
+export { diagnoseSkillViews, resolveExpectedSkillProjections, } from './skill-view-diagnostic.js';
+export type { ExpectedProjection, ProjectedSkillVersion, SkillViewClass, SkillViewDiagnosis, SkillViewDiagnostic, SkillViewObservation, } from './skill-view-diagnostic.js';
 export { detectStrays } from './strays.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/drift/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/drift/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,YAAY,EACV,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/drift/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,YAAY,EACV,wBAAwB,EACxB,uBAAuB,EACvB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,kBAAkB,EAClB,+BAA+B,GAChC,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,kBAAkB,EAClB,qBAAqB,EACrB,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC"}

package/dist/drift/index.js

@@ -1,3 +1,4 @@
 export { detectDrift } from './detector.js';
 export { filterKnownStrays } from './known-strays.js';
+export { diagnoseSkillViews, resolveExpectedSkillProjections, } from './skill-view-diagnostic.js';
 export { detectStrays } from './strays.js';

package/dist/drift/skill-view-diagnostic.d.ts

@@ -0,0 +1,197 @@
+import type { ManifestEntryV2 } from '../manifest/manifest.types.js';
+import type { ProviderRegistration, ProviderScopeContext } from '../providers/shared/registry.js';
+import type { ConcreteScope, ContentType } from '../shared/types.js';
+import type { DriftReport, DriftState } from './drift.types.js';
+/**
+ * Resolution-time classification of one canonical skill against one provider
+ * view.
+ *
+ * This is a new field that sits *beside* the unchanged {@link DriftState}, not
+ * a replacement for it: `detectDrift` answers "does the tracked view still
+ * match?", which presupposes a manifest entry. The headline case this module
+ * exists for — a canonical skill nobody ever synced — has no manifest entry at
+ * all, so its provider and path identity come from the provider scope context
+ * and the adapter mappings instead.
+ *
+ * - `missing-additive`: active, supported, nothing tracked, nothing on disk at
+ *   the expected path. The only true projection gap.
+ * - `removed`: tracked, but the provider file is gone.
+ * - `modified`: tracked, and the provider file diverged.
+ * - `in-sync`: the view matches the canonical skill (including a native-read
+ *   provider, whose view *is* the canonical file).
+ * - `untracked`: something exists at the expected path with no manifest entry.
+ *   Reported as such rather than as missing, because nothing is absent.
+ * - `unverified`: the view's state is unknown — either a manifest entry arrived
+ *   with no drift observation, or reading this one view failed and the
+ *   observation carries the redacted reason. Never `untracked`, which would
+ *   contradict `tracked: true` on the same record.
+ * - `inactive`, `unsupported`, `excluded`: no projection is expected at all, so
+ *   none of these ever carries a sync suggestion.
+ *
+ * Reachability today: `unsupported` needs a registered adapter with no `skill`
+ * mapping for the scope, and every shipped adapter maps skills in both scopes;
+ * `excluded` needs a canonical-path filter that the `oat tools info` wiring
+ * never passes. Both are defensive branches, covered by fixtures rather than by
+ * a live CLI path, and they exist so a future adapter or filter cannot be
+ * silently misreported as a projection gap. `unverified` is reachable: an
+ * unreadable provider path makes `detectDrift` throw, and that one view
+ * degrades to `unverified` with its reason.
+ */
+export type SkillViewClass = 'in-sync' | 'missing-additive' | 'removed' | 'modified' | 'untracked' | 'unverified' | 'inactive' | 'unsupported' | 'excluded';
+/**
+ * Where a provider's view of one canonical skill is expected to live.
+ *
+ * Derived from the adapter's scope mappings, so it exists whether or not a
+ * manifest entry does. Deliberately carries no `strategy`: the concrete
+ * symlink/copy choice for an *untracked* projection is resolved by the sync
+ * engine from config at sync time (`resolveStrategy` in
+ * `engine/compute-plan.ts`), and re-deriving that precedence here could
+ * contradict it. A tracked projection carries its real strategy on the
+ * manifest entry, which is what the version-comparability rule needs.
+ */
+export interface ExpectedProjection {
+    provider: string;
+    /** Scope-relative path, matching the manifest's `providerPath` convention. */
+    providerPath: string;
+    contentKind: ContentType;
+    /**
+     * The provider reads canonical content in place (`nativeRead` mapping), so
+     * the "view" is the canonical file and there is nothing to project.
+     */
+    nativeRead: boolean;
+    /** Set when a canonical-path filter keeps this skill out of the projection. */
+    excludedReason?: string;
+}
+/**
+ * How the projected view's own version declaration read.
+ *
+ * Carries the shared resolver's verdict rather than just a string: a
+ * `conflict`, `unusable`, or `malformed` declaration is a parse artifact, and
+ * a copy must never be reported as stale on that evidence.
+ */
+export interface ProjectedSkillVersion {
+    version: string | null;
+    state: 'resolved' | 'absent' | 'conflict' | 'unusable' | 'malformed';
+    conflict?: {
+        metadata: string;
+        topLevel: string;
+    };
+}
+/** One provider's observed reality for the expected projection. */
+export interface SkillViewObservation {
+    projection: ExpectedProjection;
+    /** The manifest entry keyed by (canonicalPath, provider), when tracked. */
+    manifestEntry: ManifestEntryV2 | null;
+    /** `detectDrift` output; only available when a manifest entry exists. */
+    drift: DriftReport | null;
+    /** Whether anything exists at the expected provider path. */
+    viewPresent: boolean;
+    /**
+     * Set when reading *this* view failed, carrying the already-redacted reason.
+     *
+     * A per-view read failure — `detectDrift` throwing on an unreadable provider
+     * path, for instance — says nothing about the other providers in the same
+     * scope, so it degrades one row instead of the whole section.
+     */
+    unavailableReason?: string;
+    /**
+     * Version read from the provider copy, with the resolver's verdict. Only
+     * meaningful for `copy` entries.
+     */
+    projectedVersion?: ProjectedSkillVersion;
+}
+export interface SkillViewDiagnostic {
+    skill: string;
+    scope: ConcreteScope;
+    provider: string;
+    viewClass: SkillViewClass;
+    /** Unchanged `DriftState`; `null` when no manifest entry allowed detection. */
+    driftState: DriftState | null;
+    /**
+     * Scope-relative path this row is about; `null` when no view is expected.
+     *
+     * When a manifest entry tracks the view at a path that is not the adapter's
+     * expected projection path, this is the *manifest's* path, because that is
+     * the path the drift verdict, the version, and the detail all describe. The
+     * expected path then travels separately in `expectedProviderPath`.
+     */
+    providerPath: string | null;
+    /**
+     * The adapter's expected projection path, present only when the manifest
+     * tracks the view somewhere else.
+     *
+     * Absent on every ordinary row: a row whose manifest entry sits at the
+     * expected path has one path, not two.
+     */
+    expectedProviderPath?: string;
+    tracked: boolean;
+    strategy: ManifestEntryV2['strategy'] | null;
+    nativeRead: boolean;
+    canonicalVersion: string | null;
+    viewVersion: string | null;
+    /** Versions are comparable only for `copy` views that exist. */
+    versionComparable: boolean;
+    /**
+     * How the view's own version declaration read. `conflict`, `unusable`, and
+     * `malformed` are why a comparison may have been withheld.
+     */
+    versionEvidence?: ProjectedSkillVersion['state'];
+    /** Narrowest safe repair: one concrete scope, never `--scope all`. */
+    suggestion: string | null;
+    detail: string;
+}
+export interface SkillViewDiagnosis {
+    skill: string;
+    scope: ConcreteScope;
+    /**
+     * `unknown-skill` is a distinct top-level result from a skill that exists
+     * canonically but reaches no provider view, so missing distribution is never
+     * confused with a name the repository does not have.
+     *
+     * `unavailable` means the diagnostic's own inputs could not be read (an
+     * unreadable or invalid manifest, for instance). It is reported in the
+     * section with its reason and never raised as a command failure: this
+     * diagnostic is additive evidence, so it must not take down the tool detail
+     * of the very user whose sync state is already broken.
+     */
+    result: 'diagnosed' | 'unknown-skill' | 'unavailable';
+    /** Why the diagnosis is `unavailable`; scope-root paths are redacted. */
+    reason?: string;
+    views: SkillViewDiagnostic[];
+}
+/**
+ * Builds the expected provider path for one canonical skill, per registered
+ * adapter that maps skills in this scope.
+ *
+ * Mirrors the engine's own derivation (`providerDir` + entry name in
+ * `computeSyncPlan`). A canonical skill is a directory, and the engine applies
+ * `providerExtension` only to file entries, so the directory name is carried
+ * through unchanged.
+ *
+ * `allowedCanonicalPaths` mirrors `computeSyncPlan`'s filter of the same name:
+ * a targeted sync narrows the plan to specific canonical paths. No durable
+ * config excludes a canonical skill today, so the `oat tools info` wiring
+ * passes nothing; the parameter exists so that a filtered projection is
+ * reported as `excluded` rather than as a projection gap.
+ */
+export declare function resolveExpectedSkillProjections(input: {
+    skillName: string;
+    scope: ConcreteScope;
+    registrations: readonly ProviderRegistration[];
+    allowedCanonicalPaths?: readonly string[];
+}): ExpectedProjection[];
+/**
+ * Maps one canonical skill onto one diagnostic per registered provider for a
+ * single concrete scope. Pure: every filesystem, manifest, and drift fact is
+ * supplied by the caller.
+ */
+export declare function diagnoseSkillViews(input: {
+    skillName: string;
+    scope: ConcreteScope;
+    /** Whether the canonical skill exists in this scope. */
+    canonicalPresent: boolean;
+    canonicalVersion: string | null;
+    providerScopeContext: ProviderScopeContext;
+    observations: readonly SkillViewObservation[];
+}): SkillViewDiagnosis;
+//# sourceMappingURL=skill-view-diagnostic.d.ts.map

package/dist/drift/skill-view-diagnostic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-view-diagnostic.d.ts","sourceRoot":"","sources":["../../src/drift/skill-view-diagnostic.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAEhE,OAAO,KAAK,EACV,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEhE,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,MAAM,cAAc,GACtB,SAAS,GACT,kBAAkB,GAClB,SAAS,GACT,UAAU,GACV,WAAW,GACX,YAAY,GACZ,UAAU,GACV,aAAa,GACb,UAAU,CAAC;AAEf;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,WAAW,CAAC;IACzB;;;OAGG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,UAAU,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,WAAW,CAAC;IACrE,QAAQ,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CACnD;AAED,mEAAmE;AACnE,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,kBAAkB,CAAC;IAC/B,2EAA2E;IAC3E,aAAa,EAAE,eAAe,GAAG,IAAI,CAAC;IACtC,yEAAyE;IACzE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAC1B,6DAA6D;IAC7D,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;CAC1C;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,aAAa,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,cAAc,CAAC;IAC1B,+EAA+E;IAC/E,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IAC9B;;;;;;;OAOG;IACH,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;IAC7C,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,gEAAgE;IAChE,iBAAiB,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,eAAe,CAAC,EAAE,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACjD,sEAAsE;IACtE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,aAAa,CAAC;IACrB;;;;;;;;;;OAUG;IACH,MAAM,EAAE,WAAW,GAAG,eAAe,GAAG,aAAa,CAAC;IACtD,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,mBAAmB,EAAE,CAAC;CAC9B;AAeD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,aAAa,CAAC;IACrB,aAAa,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC/C,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C,GAAG,kBAAkB,EAAE,CAwBvB;AAoLD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,aAAa,CAAC;IACrB,wDAAwD;IACxD,gBAAgB,EAAE,OAAO,CAAC;IAC1B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,oBAAoB,EAAE,oBAAoB,CAAC;IAC3C,YAAY,EAAE,SAAS,oBAAoB,EAAE,CAAC;CAC/C,GAAG,kBAAkB,CA+JrB"}