@open-agent-toolkit/cli 0.2.66 → 0.2.67

package/dist/config/resolve.js

@@ -1,5 +1,6 @@
 import { isWorkflowDispatchCandidateLadder } from './dispatch-matrix.js';
 import { BUILTIN_EXEC_TARGETS, isWorkflowPostImplementStructuredSequence, readOatConfig, readOatLocalConfig, readUserConfig, } from './oat-config.js';
+import { getOwnKey, setOwnKey } from './own-keys.js';
 const DEFAULT_DEPENDENCIES = {
     readOatConfig,
     readOatLocalConfig,
@@ -38,6 +39,11 @@ const DEFAULT_SHARED_CONFIG = {
         tooling: null,
         config: null,
         index: null,
+        // `oat config dump` enumerates the resolved map, so a catalogued key that
+        // is absent here has no row at all while it is unset. `null` keeps meaning
+        // "not set at this layer", so a configured array still wins.
+        excludes: null,
+        instructionPointerExcludes: null,
         requireForProjectCompletion: false,
     },
     tools: {
@@ -229,27 +235,33 @@ export function resolveExecTargetViews(effective) {
         }
         for (const [id, override] of Object.entries(layer)) {
             if (override === null) {
-                const target = targets[id] ?? views[id]?.target;
+                // Exec-target ids come from user config, which can now carry a key
+                // named `__proto__` as an own key, so every lookup here is own-key
+                // guarded. `delete` needs no guard: it removes an own key and is a
+                // no-op otherwise.
+                const target = getOwnKey(targets, id) ?? getOwnKey(views, id)?.target;
                 delete targets[id];
                 if (target) {
-                    views[id] = {
+                    setOwnKey(views, id, {
                         target: cloneExecTarget(target),
                         origin,
                         explicitlyConfigured: true,
                         enabled: false,
-                    };
+                    });
                 }
                 continue;
             }
+            // The one-entry layer uses a computed key in an object literal, which
+            // is define semantics and already safe.
             mergeExecTargetLayer(targets, { [id]: override });
-            const target = targets[id];
+            const target = getOwnKey(targets, id);
             if (target) {
-                views[id] = {
+                setOwnKey(views, id, {
                     target: cloneExecTarget(target),
                     origin,
                     explicitlyConfigured: true,
                     enabled: true,
-                };
+                });
             }
         }
     }
@@ -261,12 +273,14 @@ function mergeExecTargetLayer(targets, layer) {
     }
     for (const [id, override] of Object.entries(layer)) {
         if (override === null) {
+            // `delete` removes an own key and is a no-op otherwise, so it is already
+            // correct for a user-supplied id such as `__proto__`.
             delete targets[id];
             continue;
         }
-        const existing = targets[id];
+        const existing = getOwnKey(targets, id);
         if (existing) {
-            targets[id] = cloneExecTarget({
+            setOwnKey(targets, id, cloneExecTarget({
                 runtime: override.runtime ?? existing.runtime,
                 baseCommand: override.baseCommand ?? existing.baseCommand,
                 invocation: mergeExecTargetInvocation(existing.invocation, override.invocation),
@@ -275,12 +289,12 @@ function mergeExecTargetLayer(targets, layer) {
                 availabilityCommand: override.availabilityCommand ?? existing.availabilityCommand,
                 priority: override.priority ?? existing.priority,
                 timeoutMs: override.timeoutMs ?? existing.timeoutMs,
-            });
+            }));
             continue;
         }
         const completeTarget = toCompleteExecTarget(override);
         if (completeTarget) {
-            targets[id] = completeTarget;
+            setOwnKey(targets, id, completeTarget);
         }
     }
 }
@@ -388,7 +402,17 @@ function isAtomicConfigLeaf(key, value) {
         (key === 'workflow.postImplementSequence' &&
             isWorkflowPostImplementStructuredSequence(value)));
 }
-function resolveEnvOverride(key, env) {
+/**
+ * Report the environment override for `key`, if one is live.
+ *
+ * Exported because `oat config unset` needs the answer to "is this key
+ * environment-overridden?" without performing a whole-config read, which a
+ * malformed stored value aborts -- and a malformed stored value is exactly what
+ * `unset` exists to remove. `ENV_OVERRIDE_MAP` plus the env-first branch of
+ * `resolveEffectiveConfig` is the single source of that answer, so callers that
+ * only need the boolean must not resolve the whole config to derive it.
+ */
+export function resolveEnvOverride(key, env) {
     const envKey = ENV_OVERRIDE_MAP[key];
     if (!envKey) {
         return undefined;

package/dist/config/sync-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sync-config.d.ts","sourceRoot":"","sources":["../../src/config/sync-config.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,QAAA,MAAM,oBAAoB;;;;;;;;;EAGxB,CAAC;AAEH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAK3B,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAEtE,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,GAAG;IAC1D,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;CAC/C,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,UAKjC,CAAC;AAkBF,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAW7E;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GACnC,MAAM,EAAE,CAMV;AAED,wBAAgB,gBAAgB,CAC9B,GAAG,QAAQ,EAAE,aAAa,CAAC,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC,GACxD,MAAM,EAAE,CAEV;AAqCD,wBAAsB,cAAc,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,GAAE,UAAgC,GACzC,OAAO,CAAC,UAAU,CAAC,CA6BrB;AAED,wBAAsB,cAAc,CAClC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,UAAU,CAAC,CAWrB;AAED,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,UAAU,CAAC,CAcrB;AAED,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,UAAU,CAAC,CAcrB"}
+{"version":3,"file":"sync-config.d.ts","sourceRoot":"","sources":["../../src/config/sync-config.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,QAAA,MAAM,oBAAoB;;;;;;;;;EAGxB,CAAC;AAEH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAK3B,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAEtE,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,GAAG;IAC1D,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;CAC/C,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,UAKjC,CAAC;AAkCF,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAW7E;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GACnC,MAAM,EAAE,CAMV;AAED,wBAAgB,gBAAgB,CAC9B,GAAG,QAAQ,EAAE,aAAa,CAAC,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC,GACxD,MAAM,EAAE,CAEV;AAqCD,wBAAsB,cAAc,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,GAAE,UAAgC,GACzC,OAAO,CAAC,UAAU,CAAC,CA6BrB;AAED,wBAAsB,cAAc,CAClC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,UAAU,CAAC,CAWrB;AAED,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,UAAU,CAAC,CAcrB;AAED,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,UAAU,CAAC,CAcrB"}

package/dist/config/sync-config.js

@@ -21,6 +21,22 @@ export const DEFAULT_SYNC_CONFIG = {
     knownStrays: [],
     providers: {},
 };
+/**
+ * Provider names reaching this family are guarded twice, so no own-key access
+ * is needed here even though `config/json.ts` preserves a key literally named
+ * `__proto__` as an own data property.
+ *
+ * 1. `SyncConfigSchema.providers` is a `z.record`, which drops that key during
+ *    parsing, so it never reaches `merged[name]` below.
+ * 2. `commands/providers/set/index.ts` rejects any provider name outside
+ *    `knownProviders`, and the init and sync commands iterate adapter names
+ *    and detection results rather than raw user strings.
+ *
+ * Guard 1 is pinned by the `drops a \`__proto__\` provider during zod record
+ * parsing` case in `sync-config.test.ts`. If a future zod upgrade stops
+ * stripping the key that test fails, and this classification must be re-opened
+ * rather than assumed.
+ */
 function mergeProviderConfigs(base, override) {
     const merged = { ...base };
     for (const [name, config] of Object.entries(override)) {

package/dist/drift/detector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"detector.d.ts","sourceRoot":"","sources":["../../src/drift/detector.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAEhE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,MAAM,WAAW,aAAa;IAC5B,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,KAAK,MAAM,CAAC;CACxE;AAcD,wBAAsB,WAAW,CAC/B,KAAK,EAAE,eAAe,EACtB,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,aAAa,GAC5B,OAAO,CAAC,WAAW,CAAC,CAoGtB"}
+{"version":3,"file":"detector.d.ts","sourceRoot":"","sources":["../../src/drift/detector.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAEhE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,MAAM,WAAW,aAAa;IAC5B,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,KAAK,MAAM,CAAC;CACxE;AAcD,wBAAsB,WAAW,CAC/B,KAAK,EAAE,eAAe,EACtB,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,aAAa,GAC5B,OAAO,CAAC,WAAW,CAAC,CAgKtB"}

package/dist/drift/detector.js

@@ -1,7 +1,8 @@
 import { lstat, readFile, readlink, stat } from 'node:fs/promises';
 import { dirname, resolve } from 'node:path';
 import { proveCollectionIdentity } from '../engine/collection-sync.js';
-import { computeContentHash, computeStringHash } from '../manifest/hash.js';
+import { computeManagedDirectoryCopyHash } from '../engine/managed-copy-hash.js';
+import { computeContentHash, computeDirectoryDigests, computeStringHash, } from '../manifest/hash.js';
 function createReport(entry, state) {
     return {
         canonical: entry.canonicalPath,
@@ -80,6 +81,56 @@ export async function detectDrift(entry, scopeRoot, copyTransform) {
     if (entry.contentHash === currentHash) {
         return createReport(entry, { status: 'in_sync' });
     }
+    // A directory copy is decorated by the writer: `applyCopyMarker` adds the
+    // `.oat-generated` sentinel and prepends the banner to SKILL.md/AGENT.md,
+    // while the manifest records the undecorated canonical hash. Re-ask the
+    // question with those two artifacts excluded, so a faithful copy reads
+    // `in_sync` instead of permanently `modified`.
+    //
+    // Deliberately *not* gated on `copyTransform`: the banner and sentinel are
+    // engine-owned rather than adapter-owned, and `commands/tools/info/index.ts`
+    // passes no transform. Gating here would leave `oat tools info` disagreeing
+    // with `oat status`. A `null` result — no sentinel, a sentinel naming a
+    // different canonical path, a marker file that is absent or does not carry
+    // the banner, a non-regular entry — falls through to the raw verdict below,
+    // as does any other digest, so a tampered or unverifiable copy is still
+    // `drifted`.
+    if (!entry.isFile && entry.contentHash !== null) {
+        const managedHash = await computeManagedDirectoryCopyHash(providerPath, canonicalPath, entry.contentType);
+        if (managedHash !== null) {
+            if (managedHash === entry.contentHash) {
+                return createReport(entry, { status: 'in_sync' });
+            }
+            // Pre-framing manifest bridge (wave-7 final review, Critical 4).
+            // Length framing changed every directory digest, and a no-op `oat sync`
+            // does not restamp an entry it already owns (`ensureSkipEntryManaged` in
+            // `engine/execute-plan.ts` returns the manifest untouched for `skip`), so
+            // a manifest written before the change keeps its legacy value
+            // indefinitely. Without this branch every pre-existing copy-strategy
+            // install would report drift that no command repairs.
+            //
+            // This cannot reopen the collision. It fires only when the recorded hash
+            // is the legacy digest of the canonical tree, and acceptance still rests
+            // entirely on the framed digests: framing is injective, so
+            // `managedHash === framed` means the copy's logical content is exactly
+            // the canonical file set, which the legacy digests therefore also agreed
+            // on. Every input accepted here was accepted before the change too, so
+            // the branch cannot widen the acceptance set. That argument needs both
+            // digests to describe one canonical state, which is why
+            // `computeDirectoryDigests` folds them from a single capture rather than
+            // from two traversals — pairing `framed` from one state with `legacy`
+            // from another would accept a view the pre-framing detector rejected.
+            //
+            // Any failure to read the canonical tree is treated as "cannot verify",
+            // which falls through to `drifted` below.
+            const canonicalDigests = await computeDirectoryDigests(canonicalPath).catch(() => null);
+            if (canonicalDigests !== null &&
+                entry.contentHash === canonicalDigests.legacy &&
+                managedHash === canonicalDigests.framed) {
+                return createReport(entry, { status: 'in_sync' });
+            }
+        }
+    }
     // When the manifest hash is stale (e.g. frontmatter-only edits to the
     // canonical source that don't change the rendered output), re-derive the
     // expected provider content from the current canonical + transform and

package/dist/drift/skill-view-diagnostic.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill-view-diagnostic.d.ts","sourceRoot":"","sources":["../../src/drift/skill-view-diagnostic.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAEhE,OAAO,KAAK,EACV,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEhE,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,MAAM,cAAc,GACtB,SAAS,GACT,kBAAkB,GAClB,SAAS,GACT,UAAU,GACV,WAAW,GACX,YAAY,GACZ,UAAU,GACV,aAAa,GACb,UAAU,CAAC;AAEf;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,WAAW,CAAC;IACzB;;;OAGG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,UAAU,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,WAAW,CAAC;IACrE,QAAQ,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CACnD;AAED,mEAAmE;AACnE,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,kBAAkB,CAAC;IAC/B,2EAA2E;IAC3E,aAAa,EAAE,eAAe,GAAG,IAAI,CAAC;IACtC,yEAAyE;IACzE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAC1B,6DAA6D;IAC7D,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;CAC1C;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,aAAa,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,cAAc,CAAC;IAC1B,+EAA+E;IAC/E,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IAC9B;;;;;;;OAOG;IACH,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;IAC7C,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,gEAAgE;IAChE,iBAAiB,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,eAAe,CAAC,EAAE,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACjD,sEAAsE;IACtE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,aAAa,CAAC;IACrB;;;;;;;;;;OAUG;IACH,MAAM,EAAE,WAAW,GAAG,eAAe,GAAG,aAAa,CAAC;IACtD,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,mBAAmB,EAAE,CAAC;CAC9B;AAeD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,aAAa,CAAC;IACrB,aAAa,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC/C,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C,GAAG,kBAAkB,EAAE,CAwBvB;AAoLD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,aAAa,CAAC;IACrB,wDAAwD;IACxD,gBAAgB,EAAE,OAAO,CAAC;IAC1B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,oBAAoB,EAAE,oBAAoB,CAAC;IAC3C,YAAY,EAAE,SAAS,oBAAoB,EAAE,CAAC;CAC/C,GAAG,kBAAkB,CA+JrB"}
+{"version":3,"file":"skill-view-diagnostic.d.ts","sourceRoot":"","sources":["../../src/drift/skill-view-diagnostic.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAEhE,OAAO,KAAK,EACV,oBAAoB,EACpB,oBAAoB,EACrB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEhE,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,MAAM,cAAc,GACtB,SAAS,GACT,kBAAkB,GAClB,SAAS,GACT,UAAU,GACV,WAAW,GACX,YAAY,GACZ,UAAU,GACV,aAAa,GACb,UAAU,CAAC;AAEf;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,WAAW,CAAC;IACzB;;;OAGG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB,+EAA+E;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,UAAU,GAAG,QAAQ,GAAG,UAAU,GAAG,UAAU,GAAG,WAAW,CAAC;IACrE,QAAQ,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CACnD;AAED,mEAAmE;AACnE,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,kBAAkB,CAAC;IAC/B,2EAA2E;IAC3E,aAAa,EAAE,eAAe,GAAG,IAAI,CAAC;IACtC,yEAAyE;IACzE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAC1B,6DAA6D;IAC7D,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;CAC1C;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,aAAa,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,cAAc,CAAC;IAC1B,+EAA+E;IAC/E,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IAC9B;;;;;;;OAOG;IACH,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;IAC7C,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,gEAAgE;IAChE,iBAAiB,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,eAAe,CAAC,EAAE,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACjD,sEAAsE;IACtE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,aAAa,CAAC;IACrB;;;;;;;;;;OAUG;IACH,MAAM,EAAE,WAAW,GAAG,eAAe,GAAG,aAAa,CAAC;IACtD,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,mBAAmB,EAAE,CAAC;CAC9B;AAeD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,aAAa,CAAC;IACrB,aAAa,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC/C,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C,GAAG,kBAAkB,EAAE,CAwBvB;AAoLD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,aAAa,CAAC;IACrB,wDAAwD;IACxD,gBAAgB,EAAE,OAAO,CAAC;IAC1B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,oBAAoB,EAAE,oBAAoB,CAAC;IAC3C,YAAY,EAAE,SAAS,oBAAoB,EAAE,CAAC;CAC/C,GAAG,kBAAkB,CAwIrB"}

package/dist/drift/skill-view-diagnostic.js

@@ -277,33 +277,12 @@ export function diagnoseSkillViews(input) {
             input.canonicalVersion !== null &&
             viewVersion !== null &&
             viewVersion !== input.canonicalVersion;
-        // The mirror case: the detector reports a copy as drifted while its
-        // version matches canonical. That is the expected state after a
-        // copy-strategy sync, because the OAT-managed banner and `.oat-generated`
-        // sentinel are not accounted for in the manifest hash
-        // (BL-260908-make-copy-strategy-skill), and no sync clears it.
-        //
-        // Suppressing the repair here is a conservative heuristic, not a proof:
-        // equal versions do not establish equal bodies, so an edit to either side
-        // that kept the version reaches this branch too, and a sync would fix
-        // that one. The detail therefore says which case it cannot distinguish
-        // and names the concrete scope command, rather than claiming the content
-        // is current.
-        const unrepairableCopy = versionComparable &&
-            classification.viewClass === 'modified' &&
-            input.canonicalVersion !== null &&
-            viewVersion === input.canonicalVersion;
         const { viewClass, detail } = staleCopy
             ? {
                 viewClass: 'modified',
                 detail: `The tracked copy still matches the hash recorded at its last sync, but its version (${viewVersion}) differs from the canonical version (${input.canonicalVersion}), so the view is stale.`,
             }
-            : unrepairableCopy
-                ? {
-                    viewClass: 'modified',
-                    detail: `The detector reports this copy as drifted while its version still matches canonical (${input.canonicalVersion}). That is expected after a copy-strategy sync until BL-260908-make-copy-strategy-skill lands: the OAT-managed banner and ".oat-generated" sentinel are not accounted for in the manifest hash, and no sync clears it. Equal versions do not prove the bodies match, so if either side was edited without a version change, compare them and run "oat sync --scope ${input.scope}" yourself.`,
-                }
-                : classification;
+            : classification;
         views.push({
             skill: input.skillName,
             scope: input.scope,
@@ -326,7 +305,7 @@ export function diagnoseSkillViews(input) {
             // The narrowest safe repair is the single concrete scope where the gap
             // was observed. `--scope all` would widen a one-scope repair into a
             // two-scope write.
-            suggestion: REPAIRABLE.includes(viewClass) && !unrepairableCopy
+            suggestion: REPAIRABLE.includes(viewClass)
                 ? `oat sync --scope ${input.scope}`
                 : null,
             detail: `${versionComparable ? detail : `${detail}${versionNote(strategy)}`}${copyViewReadable

package/dist/engine/compute-plan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compute-plan.d.ts","sourceRoot":"","sources":["../../src/engine/compute-plan.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAGtD,OAAO,KAAK,EACV,QAAQ,EACR,aAAa,EAGd,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAEV,eAAe,EAChB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGjD,OAAO,KAAK,EAEV,WAAW,EACX,oBAAoB,EACpB,QAAQ,EAET,MAAM,gBAAgB,CAAC;AAGxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEhD,UAAU,mBAAmB;IAC3B,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,WAAW,CAAC;IACnB,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,sCAAsC,CAAC,EAAE,QAAQ,CAC/C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAClC,CAAC;IACF,+BAA+B,CAAC,EAAE,SAAS;QACzC,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,WAAW,CAAC;KAC1B,EAAE,CAAC;IACJ,gCAAgC,CAAC,EAAE,OAAO,CAAC;CAC5C;AAqTD,wBAAsB,iCAAiC,CACrD,aAAa,EAAE,aAAa,EAC5B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,oBAAoB,CAAC,CAqG/B;AAiID,wBAAsB,eAAe,CAAC,EACpC,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,KAAK,EACL,MAAM,EACN,SAAS,EAAE,iBAAiB,EAC5B,qBAAqB,EACrB,sCAAsC,EACtC,+BAAoC,EACpC,gCAAwC,GACzC,EAAE,mBAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC,CA4bzC"}
+{"version":3,"file":"compute-plan.d.ts","sourceRoot":"","sources":["../../src/engine/compute-plan.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAGtD,OAAO,KAAK,EACV,QAAQ,EACR,aAAa,EAGd,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAEV,eAAe,EAChB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAGjD,OAAO,KAAK,EAEV,WAAW,EACX,oBAAoB,EACpB,QAAQ,EAET,MAAM,gBAAgB,CAAC;AAGxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEhD,UAAU,mBAAmB;IAC3B,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,WAAW,CAAC;IACnB,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;IACjC,sCAAsC,CAAC,EAAE,QAAQ,CAC/C,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAClC,CAAC;IACF,+BAA+B,CAAC,EAAE,SAAS;QACzC,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,WAAW,CAAC;KAC1B,EAAE,CAAC;IACJ,gCAAgC,CAAC,EAAE,OAAO,CAAC;CAC5C;AAiOD,wBAAsB,iCAAiC,CACrD,aAAa,EAAE,aAAa,EAC5B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,oBAAoB,CAAC,CAqG/B;AAyJD,wBAAsB,eAAe,CAAC,EACpC,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,KAAK,EACL,MAAM,EACN,SAAS,EAAE,iBAAiB,EAC5B,qBAAqB,EACrB,sCAAsC,EACtC,+BAAoC,EACpC,gCAAwC,GACzC,EAAE,mBAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC,CA4bzC"}

package/dist/engine/compute-plan.js

@@ -1,11 +1,10 @@
-import { createHash } from 'node:crypto';
-import { access, lstat, readdir, readFile, readlink, stat, } from 'node:fs/promises';
+import { access, lstat, readFile, readlink, stat } from 'node:fs/promises';
 import { basename, dirname, join, normalize, relative, resolve, } from 'node:path';
 import { computeContentHash, computeStringHash } from '../manifest/hash.js';
 import { findEntry } from '../manifest/manager.js';
 import { getSyncMappings } from '../providers/shared/adapter.utils.js';
 import { proveCollectionIdentity } from './collection-sync.js';
-import { OAT_DIRECTORY_SENTINEL, OAT_MARKER_PREFIX } from './markers.js';
+import { computeManagedDirectoryCopyHash } from './managed-copy-hash.js';
 import { assertSafeProviderMutationPath } from './provider-path-safety.js';
 function buildUpLevels(depth) {
     return Array.from({ length: depth }, () => '..');
@@ -150,75 +149,6 @@ function manifestEntryInsideMapping(entry, mapping) {
     return (canonicalPath === canonicalDir ||
         canonicalPath.startsWith(`${canonicalDir}/`));
 }
-async function computeManagedDirectoryCopyHash(providerPath, canonicalPath, contentType) {
-    const expectedMarker = `${OAT_MARKER_PREFIX} Source: ${canonicalPath} -->`;
-    const sentinelPath = join(providerPath, OAT_DIRECTORY_SENTINEL);
-    try {
-        const sentinel = await readFile(sentinelPath, 'utf8');
-        if (sentinel !== `${expectedMarker}\n`) {
-            return null;
-        }
-    }
-    catch {
-        return null;
-    }
-    const files = [];
-    async function collectFiles(current) {
-        const entries = await readdir(current, { withFileTypes: true });
-        for (const entry of entries) {
-            const fullPath = join(current, entry.name);
-            if (fullPath === sentinelPath) {
-                continue;
-            }
-            if (entry.isDirectory()) {
-                if (!(await collectFiles(fullPath))) {
-                    return false;
-                }
-                continue;
-            }
-            if (!entry.isFile()) {
-                return false;
-            }
-            files.push(fullPath);
-        }
-        return true;
-    }
-    try {
-        if (!(await collectFiles(providerPath))) {
-            return null;
-        }
-        files.sort((left, right) => relative(providerPath, left).localeCompare(relative(providerPath, right)));
-        const markerFileName = contentType === 'skill'
-            ? 'SKILL.md'
-            : contentType === 'agent'
-                ? 'AGENT.md'
-                : null;
-        const markerPath = markerFileName
-            ? join(providerPath, markerFileName)
-            : null;
-        const hash = createHash('sha256');
-        for (const file of files) {
-            const relativePath = relative(providerPath, file);
-            let content = await readFile(file);
-            if (file === markerPath) {
-                const markerPrefix = Buffer.from(`${expectedMarker}\n`);
-                if (content.length < markerPrefix.length ||
-                    !content.subarray(0, markerPrefix.length).equals(markerPrefix)) {
-                    return null;
-                }
-                content = content.subarray(markerPrefix.length);
-            }
-            hash.update(relativePath);
-            hash.update('\0');
-            hash.update(content);
-            hash.update('\0');
-        }
-        return hash.digest('hex');
-    }
-    catch {
-        return null;
-    }
-}
 export async function classifyObsoleteMappingRetirement(manifestEntry, scopeRoot) {
     const providerPath = resolve(scopeRoot, manifestEntry.providerPath);
     const canonicalPath = resolve(scopeRoot, manifestEntry.canonicalPath);
@@ -335,6 +265,26 @@ async function classifyOperation(canonicalEntry, providerPath, strategy, rendere
             reason: 'already in sync',
         };
     }
+    // A directory copy is decorated by the writer: `applyCopyMarker` adds the
+    // `.oat-generated` sentinel and prepends the banner to SKILL.md/AGENT.md, so
+    // the raw hashes above can never agree and every re-plan produced another
+    // `update_copy`. Re-ask the question with those two artifacts excluded. This
+    // runs only after the raw comparison already failed, so a genuinely in-sync
+    // tree is never hashed twice. `null` means "not a verifiable managed copy"
+    // (no sentinel, a sentinel naming a different canonical path, a missing
+    // banner, a non-regular entry) and keeps the `update_copy` below, as does any
+    // other digest — a tampered body still re-syncs.
+    if (strategy === 'copy' && !canonicalEntry.isFile) {
+        const managedHash = await computeManagedDirectoryCopyHash(providerPath, 
+        // Exactly the string `applyCopyMarker` wrote into the sentinel.
+        canonicalEntry.canonicalPath, canonicalEntry.type);
+        if (managedHash !== null && managedHash === canonicalHash) {
+            return {
+                operation: 'skip',
+                reason: 'already in sync',
+            };
+        }
+    }
     return {
         operation: 'update_copy',
         reason: 'copied content differs from canonical content',

package/dist/engine/managed-copy-hash.d.ts

@@ -0,0 +1,69 @@
+import type { ManifestEntry } from '../manifest/manifest.types.js';
+/**
+ * The banner-and-sentinel-aware hash of an OAT-managed directory copy.
+ *
+ * When `oat sync` materializes a directory copy it deliberately decorates the
+ * provider tree with two artifacts the canonical tree does not have: an
+ * `.oat-generated` sentinel and a marker line prepended to `SKILL.md` /
+ * `AGENT.md`. Hashing that tree raw therefore never equals the canonical hash
+ * the manifest records, which is why every raw reader saw a fresh copy as
+ * drifted. This module owns the comparison that accounts for both.
+ *
+ * Standing claims owned here (backstop: `managed-copy-hash.test.ts`):
+ *
+ * 1. For a faithful managed directory copy the digest returned is **equal** to
+ *    `computeDirectoryHash` of the canonical directory — the same value
+ *    `execute-plan.ts` writes into the manifest `contentHash`. The encoding is
+ *    not merely the same shape as `manifest/hash.ts`: this module calls that
+ *    module's `createFramedDirectoryDigest`, `compareDirectoryRelativePaths`
+ *    and `updateFramedDirectoryDigest`, so the domain tag, the ordering and
+ *    the per-field length framing cannot drift apart. That framing is what
+ *    makes the digest a self-delimiting encoding of the sorted file list
+ *    (wave-7 final review, Critical 4 — the header of `manifest/hash.ts`
+ *    records the collision that motivated it, the cross-encoding forgery the
+ *    domain tag closes, and the one-time manifest migration it forces).
+ * 2. `null` is returned rather than a digest whenever the sentinel does not
+ *    name exactly this canonical path — and likewise when the sentinel is
+ *    absent or has trailing content, when the marker file is missing or does
+ *    not start with exactly the expected banner, or when the provider tree
+ *    holds any non-regular entry.
+ * 3. "Non-regular entry" includes two shapes the pre-hardening helper waved
+ *    through, for two different reasons: a `.oat-generated` sentinel that is a
+ *    symlink (or anything other than a regular file) — it was skipped by
+ *    pathname before its type was ever examined and then read through a
+ *    symlink-following `readFile`; and a provider root that is a symlink
+ *    rather than a real directory — the root was never type-checked before
+ *    `readdir`, which traverses a symlinked directory. Both return `null`.
+ *    Without this the detector and planner would newly accept a
+ *    symlink-substituted provider view as `in_sync`.
+ * 4. A `skill` or `agent` copy must actually contain its marker file. The
+ *    banner check used to be keyed on `file === markerPath` while walking the
+ *    tree, so deleting `SKILL.md` outright did not fail the check — it simply
+ *    skipped it. Combined with the unframed digest that let a view drop
+ *    `SKILL.md`, fuse its bytes into a surviving file, and read `in_sync`. The
+ *    requirement is unconditional, so a skill directory that genuinely has no
+ *    `SKILL.md` (a layout `applyCopyMarker` tolerates as best-effort) is now
+ *    permanently `drifted` / `update_copy` rather than `in_sync`: the safe
+ *    direction, and the direction the review asked for.
+ *
+ * These claims describe a quiescent tree. Every check here is path-based, so
+ * none of them survives an adversary swapping an entry between the check and
+ * the read — the same pre-existing limitation every other filesystem reader in
+ * this package shares. The guarantee that does hold unconditionally is the
+ * superset property below: each check is additive, so no interleaving lets
+ * this helper accept an input the pre-hardening helper rejected.
+ *
+ * This module's rejection set is therefore a strict superset of the original
+ * private helper's, on every consumer. `classifyObsoleteMappingRetirement`
+ * inherits the stricter contract deliberately: for the symlinked-sentinel
+ * shape it now classifies `detach` rather than `remove`, the safe direction
+ * for a destructive path (a symlinked root was already `detach` there, because
+ * `expectedTypeMatches` is computed from `lstat` before the helper runs).
+ *
+ * `null` means "this is not a verifiable managed copy", never "it matches".
+ * Callers must fall back to their raw comparison on `null`, so an unverifiable
+ * copy degrades to `drifted` / `update_copy` rather than to a false `in_sync`.
+ * A tampered body still produces a digest, but a different one.
+ */
+export declare function computeManagedDirectoryCopyHash(providerPath: string, canonicalPath: string, contentType: ManifestEntry['contentType']): Promise<string | null>;
+//# sourceMappingURL=managed-copy-hash.d.ts.map

package/dist/engine/managed-copy-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-copy-hash.d.ts","sourceRoot":"","sources":["../../src/engine/managed-copy-hash.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAI9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AACH,wBAAsB,+BAA+B,CACnD,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,aAAa,CAAC,aAAa,CAAC,GACxC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAyHxB"}

package/dist/engine/managed-copy-hash.js

@@ -0,0 +1,175 @@
+import { lstat, readdir, readFile } from 'node:fs/promises';
+import { join, relative } from 'node:path';
+import { compareDirectoryRelativePaths, createFramedDirectoryDigest, updateFramedDirectoryDigest, } from '../manifest/hash.js';
+import { OAT_DIRECTORY_SENTINEL, OAT_MARKER_PREFIX } from './markers.js';
+/**
+ * The banner-and-sentinel-aware hash of an OAT-managed directory copy.
+ *
+ * When `oat sync` materializes a directory copy it deliberately decorates the
+ * provider tree with two artifacts the canonical tree does not have: an
+ * `.oat-generated` sentinel and a marker line prepended to `SKILL.md` /
+ * `AGENT.md`. Hashing that tree raw therefore never equals the canonical hash
+ * the manifest records, which is why every raw reader saw a fresh copy as
+ * drifted. This module owns the comparison that accounts for both.
+ *
+ * Standing claims owned here (backstop: `managed-copy-hash.test.ts`):
+ *
+ * 1. For a faithful managed directory copy the digest returned is **equal** to
+ *    `computeDirectoryHash` of the canonical directory — the same value
+ *    `execute-plan.ts` writes into the manifest `contentHash`. The encoding is
+ *    not merely the same shape as `manifest/hash.ts`: this module calls that
+ *    module's `createFramedDirectoryDigest`, `compareDirectoryRelativePaths`
+ *    and `updateFramedDirectoryDigest`, so the domain tag, the ordering and
+ *    the per-field length framing cannot drift apart. That framing is what
+ *    makes the digest a self-delimiting encoding of the sorted file list
+ *    (wave-7 final review, Critical 4 — the header of `manifest/hash.ts`
+ *    records the collision that motivated it, the cross-encoding forgery the
+ *    domain tag closes, and the one-time manifest migration it forces).
+ * 2. `null` is returned rather than a digest whenever the sentinel does not
+ *    name exactly this canonical path — and likewise when the sentinel is
+ *    absent or has trailing content, when the marker file is missing or does
+ *    not start with exactly the expected banner, or when the provider tree
+ *    holds any non-regular entry.
+ * 3. "Non-regular entry" includes two shapes the pre-hardening helper waved
+ *    through, for two different reasons: a `.oat-generated` sentinel that is a
+ *    symlink (or anything other than a regular file) — it was skipped by
+ *    pathname before its type was ever examined and then read through a
+ *    symlink-following `readFile`; and a provider root that is a symlink
+ *    rather than a real directory — the root was never type-checked before
+ *    `readdir`, which traverses a symlinked directory. Both return `null`.
+ *    Without this the detector and planner would newly accept a
+ *    symlink-substituted provider view as `in_sync`.
+ * 4. A `skill` or `agent` copy must actually contain its marker file. The
+ *    banner check used to be keyed on `file === markerPath` while walking the
+ *    tree, so deleting `SKILL.md` outright did not fail the check — it simply
+ *    skipped it. Combined with the unframed digest that let a view drop
+ *    `SKILL.md`, fuse its bytes into a surviving file, and read `in_sync`. The
+ *    requirement is unconditional, so a skill directory that genuinely has no
+ *    `SKILL.md` (a layout `applyCopyMarker` tolerates as best-effort) is now
+ *    permanently `drifted` / `update_copy` rather than `in_sync`: the safe
+ *    direction, and the direction the review asked for.
+ *
+ * These claims describe a quiescent tree. Every check here is path-based, so
+ * none of them survives an adversary swapping an entry between the check and
+ * the read — the same pre-existing limitation every other filesystem reader in
+ * this package shares. The guarantee that does hold unconditionally is the
+ * superset property below: each check is additive, so no interleaving lets
+ * this helper accept an input the pre-hardening helper rejected.
+ *
+ * This module's rejection set is therefore a strict superset of the original
+ * private helper's, on every consumer. `classifyObsoleteMappingRetirement`
+ * inherits the stricter contract deliberately: for the symlinked-sentinel
+ * shape it now classifies `detach` rather than `remove`, the safe direction
+ * for a destructive path (a symlinked root was already `detach` there, because
+ * `expectedTypeMatches` is computed from `lstat` before the helper runs).
+ *
+ * `null` means "this is not a verifiable managed copy", never "it matches".
+ * Callers must fall back to their raw comparison on `null`, so an unverifiable
+ * copy degrades to `drifted` / `update_copy` rather than to a false `in_sync`.
+ * A tampered body still produces a digest, but a different one.
+ */
+export async function computeManagedDirectoryCopyHash(providerPath, canonicalPath, contentType) {
+    const expectedMarker = `${OAT_MARKER_PREFIX} Source: ${canonicalPath} -->`;
+    const sentinelPath = join(providerPath, OAT_DIRECTORY_SENTINEL);
+    try {
+        // The provider root must be a real directory. `lstat` does not resolve the
+        // final component, so a symlink pointing at an otherwise faithful tree is
+        // rejected here rather than silently traversed by `readdir`.
+        const providerStat = await lstat(providerPath);
+        if (!providerStat.isDirectory()) {
+            return null;
+        }
+        // Type-check the sentinel before reading it. `readFile` follows symlinks,
+        // so without this a symlink to a file holding the exact marker would
+        // authenticate a tree the writer never produced.
+        //
+        // This is a check against the state on disk, not a handle-bound one: like
+        // every other filesystem reader in this package (`manifest/hash.ts`, the
+        // detector's own `lstat` + `computeContentHash`, and this file's caller in
+        // `classifyObsoleteMappingRetirement`), it resolves each path more than
+        // once and so cannot exclude a concurrent swap between the check and the
+        // read. It is not a defence against an adversary racing writes inside the
+        // provider directory; closing that would take handle-bound traversal
+        // (`openat`/`O_NOFOLLOW`) across all of those readers. What it does
+        // guarantee is that this helper's checks are a strict superset of the ones
+        // it replaced, so no input accepted here was rejected before.
+        const sentinelStat = await lstat(sentinelPath);
+        if (!sentinelStat.isFile()) {
+            return null;
+        }
+        const sentinel = await readFile(sentinelPath, 'utf8');
+        if (sentinel !== `${expectedMarker}\n`) {
+            return null;
+        }
+    }
+    catch {
+        return null;
+    }
+    const files = [];
+    async function collectFiles(current) {
+        const entries = await readdir(current, { withFileTypes: true });
+        for (const entry of entries) {
+            const fullPath = join(current, entry.name);
+            if (fullPath === sentinelPath) {
+                // Validate the type before skipping by pathname: a non-regular
+                // sentinel must disqualify the tree, not be waved through.
+                if (!entry.isFile()) {
+                    return false;
+                }
+                continue;
+            }
+            if (entry.isDirectory()) {
+                if (!(await collectFiles(fullPath))) {
+                    return false;
+                }
+                continue;
+            }
+            if (!entry.isFile()) {
+                return false;
+            }
+            files.push(fullPath);
+        }
+        return true;
+    }
+    try {
+        if (!(await collectFiles(providerPath))) {
+            return null;
+        }
+        files.sort((left, right) => compareDirectoryRelativePaths(relative(providerPath, left), relative(providerPath, right)));
+        const markerFileName = contentType === 'skill'
+            ? 'SKILL.md'
+            : contentType === 'agent'
+                ? 'AGENT.md'
+                : null;
+        const markerPath = markerFileName
+            ? join(providerPath, markerFileName)
+            : null;
+        // The marker file must be present, not merely validated when it happens to
+        // exist. Keying the banner check on `file === markerPath` inside the loop
+        // below meant a view with no `SKILL.md` at all skipped the check entirely,
+        // which is half of the forgery this module now rejects.
+        if (markerPath !== null && !files.includes(markerPath)) {
+            return null;
+        }
+        const hash = createFramedDirectoryDigest();
+        for (const file of files) {
+            const relativePath = relative(providerPath, file);
+            let content = await readFile(file);
+            if (file === markerPath) {
+                const markerPrefix = Buffer.from(`${expectedMarker}\n`);
+                if (content.length < markerPrefix.length ||
+                    !content.subarray(0, markerPrefix.length).equals(markerPrefix)) {
+                    return null;
+                }
+                content = content.subarray(markerPrefix.length);
+            }
+            // Shared with `manifest/hash.ts` rather than mirrored: the canonical
+            // digest this must reproduce is produced by the very same encoder.
+            updateFramedDirectoryDigest(hash, relativePath, content);
+        }
+        return hash.digest('hex');
+    }
+    catch {
+        return null;
+    }
+}