@open-agent-toolkit/cli 0.3.10 → 0.3.12

package/dist/providers/identity/oat-dispatch-record.js

@@ -1,4 +1,3 @@
-import { createHash } from 'node:crypto';
 import { z } from 'zod';
 import { redactAbsolutePathsDeep } from './absolute-paths.js';
 import { assertBoundedDispatchRecordSize, assertNoSensitiveDispatchContent, genericDispatchRecordSchema, normalizeDispatchKey, parseGenericDispatchRecord, } from './generic-dispatch-record.js';
@@ -62,136 +61,6 @@ const preStartRejectionCodeSchema = z
             : `A ${prohibited} outcome is not a pre-start native-selection rejection and never authorizes fallback or replacement.`,
     });
 });
-/**
- * Immutable configured controls across a fallback link.
- *
- * The rule, so a newly added generic field has a default: a field is immutable
- * when it describes the configured selection, the authorization for that
- * selection, or the evidence that justified it. A field is mutable when it
- * describes this record's own identity, how the work is briefed to its own
- * child, its own launch lifecycle, or its own child's observed behaviour. When
- * a new field is ambiguous, treat it as immutable — a false "controls
- * preserved" claim is worse than a false mismatch.
- *
- * All 46 generic fields are accounted for. The 31 immutable ones are listed
- * below. The 15 mutable ones, each with its reason:
- * - `request_id`: the fallback is a distinct request and must have its own ID.
- * - `caller`: the adapter layer that launches the fallback may differ.
- * - `objective`: a canonical-instruction fallback necessarily rebriefs the work
- *   for a generic child rather than a resolved role.
- * - `role_name`, `role_selector`: the fallback deliberately targets a generic
- *   worker; substituting the role is the whole point of the approximation, and
- *   the resolved role identity is bound separately through `roleInstructions`.
- * - `candidates_considered`: the fallback evaluated a different candidate set.
- * - `selection_reason`: constrained separately — a fallback must declare
- *   `pre-start-rejection`, which by definition differs from the trigger's.
- * - `launch_status`, `child_outcome`: each record's own lifecycle state.
- * - `runtime_confirmation`: observation of that record's own child. The
- *   fallback is a different child, so equality would be a false assertion.
- * - `diagnostics`: per-record narration. A fallback legitimately explains why
- *   it exists.
- * - `continuation_events`: continuation linkage belongs to the record that
- *   owns the handle.
- * - `expected_output`, `verification_evidence`, `escalate_when`: the brief
- *   given to this record's own child, in the same class as `objective`.
- *
- * Included even though they are evidence rather than controls, because they
- * record why the preserved selection was allowed:
- * - `configured_invocation_evidence`: names the configuration that authorized
- *   the preserved route.
- * - `catalog_snapshot`: names the catalog the selection was made against.
- * - `guidance_reference`, `guidance_version`, `guidance_verified_at`,
- *   `guidance_status`: name the dated model guidance behind the selection and
- *   how fresh it was; a fallback restating `stale` as `fresh` would misstate
- *   provenance for a preserved target.
- * - `classification_reason`: the rationale for `task_class`, which is itself a
- *   compared authorization control.
- */
-export const IMMUTABLE_FALLBACK_CONTROL_FIELDS = [
-    'provider',
-    'selection_source',
-    'model_selector',
-    'model_selector_granularity',
-    'effort_selector',
-    'reasoning_mode_selector',
-    'service_tier_selector',
-    'selected_route',
-    'authority',
-    'authorization_scope',
-    'deadline_seconds',
-    'retry_limit',
-    'payload',
-    'fallback',
-    'catalog_snapshot',
-    'configured_invocation_evidence',
-    'guidance_reference',
-    'guidance_version',
-    'guidance_verified_at',
-    'guidance_status',
-    'dispatch_context',
-    'dispatch_policy',
-    'dispatch_ceiling',
-    'scope',
-    'action',
-    'role_class',
-    'task_class',
-    'model_class_floor',
-    'classification_source',
-    'classification_reason',
-    'floor_satisfaction',
-];
-/**
- * The mutable complement, kept executable rather than only described above so a
- * newly added generic field fails `covers every generic dispatch field` until
- * somebody records a decision for it.
- */
-export const MUTABLE_FALLBACK_CONTROL_FIELDS = [
-    'request_id',
-    'caller',
-    'objective',
-    'role_name',
-    'role_selector',
-    'candidates_considered',
-    'selection_reason',
-    'launch_status',
-    'child_outcome',
-    'runtime_confirmation',
-    'diagnostics',
-    'continuation_events',
-    'expected_output',
-    'verification_evidence',
-    'escalate_when',
-];
-export function canonicalEvidenceJson(value) {
-    if (Array.isArray(value)) {
-        return `[${value.map(canonicalEvidenceJson).join(',')}]`;
-    }
-    if (value !== null && typeof value === 'object') {
-        return `{${Object.entries(value)
-            .filter(([, entry]) => entry !== undefined)
-            .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
-            .map(([key, entry]) => `${JSON.stringify(key)}:${canonicalEvidenceJson(entry)}`)
-            .join(',')}}`;
-    }
-    return JSON.stringify(value ?? null);
-}
-function controlProjection(record) {
-    return Object.fromEntries(IMMUTABLE_FALLBACK_CONTROL_FIELDS.map((field) => [
-        field,
-        record[field] ?? null,
-    ]));
-}
-export function configuredControlDigest(record) {
-    return `sha256:${createHash('sha256')
-        .update(canonicalEvidenceJson(controlProjection(record)))
-        .digest('hex')}`;
-}
-function differingControlFields(left, right) {
-    const leftControls = controlProjection(left);
-    const rightControls = controlProjection(right);
-    return IMMUTABLE_FALLBACK_CONTROL_FIELDS.filter((field) => canonicalEvidenceJson(leftControls[field]) !==
-        canonicalEvidenceJson(rightControls[field]));
-}
 const redactedPathSchema = z
     .string()
     .regex(/^<(?:loaded|user|project)>\/agents\/[a-z0-9][a-z0-9_-]*\.md$/, 'expected <loaded|user|project>/agents/<name>.md');
@@ -449,9 +318,10 @@ export function buildRuntimeObservation(input) {
     return parsed.success ? parsed.data : { status: 'not-reported' };
 }
 /**
- * The rejected trigger owns the single-fallback right. Publishing a fallback
- * record requires this durable claim on the trigger first, so two concurrent
- * callers cannot each observe "no fallback yet" and then create their own.
+ * Record shape only. The fallback claim and the fallback link were published
+ * through the removed dispatch journal; no event kind writes either now, so a
+ * validated record carries `fallbackClaim: null` and a `not-applicable`
+ * fallback. The fields stay so the validated output keeps its shape.
  */
 const fallbackClaimSchema = z
     .object({
@@ -499,22 +369,6 @@ const oatDispatchEvidenceEventSchema = z.discriminatedUnion('kind', [
         rejection: rejectionSchema,
     })
         .strict(),
-    z
-        .object({
-        kind: z.literal('fallback-claim'),
-        requestId: z.string().min(1),
-        source: z.literal('provider-wrapper'),
-        claim: fallbackClaimSchema,
-    })
-        .strict(),
-    z
-        .object({
-        kind: z.literal('fallback-link'),
-        requestId: z.string().min(1),
-        source: z.literal('provider-wrapper'),
-        evidence: fallbackDispatchSchema,
-    })
-        .strict(),
     z
         .object({
         kind: z.literal('runtime-observation'),
@@ -550,16 +404,6 @@ function oatPart(record) {
         ? oatRecordSchema.parse(record.oat)
         : initialOatRecord();
 }
-function targetFor(record) {
-    return {
-        provider: record.provider,
-        modelSelector: record.model_selector,
-        effortSelector: record.effort_selector,
-        reasoningModeSelector: record.reasoning_mode_selector ?? null,
-        serviceTierSelector: record.service_tier_selector ?? null,
-        selectedRoute: record.selected_route,
-    };
-}
 function assertMatchingRequest(record, requestId) {
     if (record.request_id !== requestId) {
         throw new Error('OAT event request ID must match the generic record.');
@@ -611,82 +455,6 @@ export function augmentDispatchRecord(input) {
             oat.preStartRejection = rejectionSchema.parse(event.rejection);
             break;
         }
-        case 'fallback-claim': {
-            const claim = event.claim;
-            if (record.launch_status !== 'blocked-before-start') {
-                throw new Error('Only a request blocked before start can claim a fallback.');
-            }
-            if (oat.preStartRejection === null) {
-                throw new Error('A fallback claim requires proven pre-start rejection evidence.');
-            }
-            if (oat.canonicalRole === null ||
-                oat.canonicalRole.status !== 'resolved') {
-                throw new Error('A fallback claim requires resolved canonical role evidence.');
-            }
-            if (oat.fallbackClaim !== null &&
-                oat.fallbackClaim.fallbackRequestId !== claim.fallbackRequestId) {
-                throw new Error('The rejected request already has a fallback.');
-            }
-            oat.fallbackClaim = claim;
-            break;
-        }
-        case 'fallback-link': {
-            const trigger = input.triggerRecord
-                ? parsePersistedOatDispatchRecord(input.triggerRecord)
-                : null;
-            if (!trigger) {
-                throw new Error('Fallback requires the rejected trigger record.');
-            }
-            const evidence = fallbackDispatchSchema.parse(event.evidence);
-            if (evidence.triggerRequestId !== trigger.request_id ||
-                evidence.fallbackRequestId !== record.request_id ||
-                trigger.launch_status !== 'blocked-before-start' ||
-                trigger.oat.preStartRejection === null ||
-                evidence.rejection.source !== 'provider-wrapper' ||
-                evidence.rejection.code !== trigger.oat.preStartRejection.code ||
-                evidence.rejection.rejectedAt !==
-                    trigger.oat.preStartRejection.rejectedAt ||
-                evidence.rejection.provesNoChildStarted !== true) {
-                throw new Error('Fallback lacks matching pre-start rejection evidence.');
-            }
-            if (record.selection_reason !== 'pre-start-rejection') {
-                throw new Error('A fallback record must state selection_reason pre-start-rejection.');
-            }
-            if (canonicalEvidenceJson(evidence.preservedTarget) !==
-                canonicalEvidenceJson(targetFor(record)) ||
-                canonicalEvidenceJson(targetFor(trigger)) !==
-                    canonicalEvidenceJson(targetFor(record))) {
-                throw new Error('Fallback must preserve the exact target and controls.');
-            }
-            const changedControls = differingControlFields(trigger, record);
-            if (changedControls.length > 0) {
-                throw new Error(`Fallback must preserve the exact target and controls; ${changedControls.join(', ')} changed.`);
-            }
-            if (configuredControlDigest(trigger) !== configuredControlDigest(record)) {
-                throw new Error('Fallback must preserve the exact target and controls; the configured control digest changed.');
-            }
-            if (trigger.oat.fallbackClaim === null ||
-                trigger.oat.fallbackClaim.fallbackRequestId !== record.request_id) {
-                throw new Error('The rejected trigger must durably claim this fallback request before the fallback can publish.');
-            }
-            const triggerRole = trigger.oat.canonicalRole;
-            if (triggerRole === null || triggerRole.status !== 'resolved') {
-                throw new Error('Fallback requires resolved canonical role evidence on the rejected trigger.');
-            }
-            if (canonicalEvidenceJson(evidence.roleInstructions) !==
-                canonicalEvidenceJson(triggerRole)) {
-                throw new Error("Fallback role evidence must equal the trigger's resolved canonical role evidence exactly.");
-            }
-            if ((input.relatedRecords ?? [])
-                .map(parsePersistedOatDispatchRecord)
-                .some((related) => related.oat.fallback.status === 'fallback-dispatch' &&
-                related.oat.fallback.triggerRequestId === trigger.request_id) ||
-                oat.fallback.status === 'fallback-dispatch') {
-                throw new Error('The rejected request already has a fallback.');
-            }
-            oat.fallback = evidence;
-            break;
-        }
         case 'runtime-observation':
             if (oat.runtimeObservation.status === 'reported' &&
                 JSON.stringify(oat.runtimeObservation) !==

package/dist/release/public-package-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"public-package-contract.d.ts","sourceRoot":"","sources":["../../src/release/public-package-contract.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,KAAK,GAAG,cAAc,GAAG,iBAAiB,CAAC;IACjD,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,uBAAuB,EAAE,yBAAyB,EAAE,CAAC;IACrD,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,4BAA4B,EAAE,MAAM,EAAE,CAAC;IACvC,2BAA2B,EAAE,MAAM,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AA0LD,wBAAgB,yBAAyB,IAAI,qBAAqB,EAAE,CAenE;AAED,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,QAAQ,EAAE,qBAAqB,GAC9B,MAAM,EAAE,CAIV;AAED,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,QAAQ,EAAE,qBAAqB,GAC9B,MAAM,EAAE,CAIV;AAED,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,QAAQ,EAAE,qBAAqB,GAC9B,MAAM,EAAE,CAMV;AAED,wBAAgB,6BAA6B,CAC3C,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACjD,QAAQ,EAAE,qBAAqB,GAC9B,MAAM,EAAE,CAoBV;AAED,wBAAgB,oCAAoC,CAClD,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,MAAM,EAAE,CAmBV;AAED,wBAAgB,qCAAqC,CACnD,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,kBAAkB,EAAE,SAAS,MAAM,EAAE,EACrC,qBAAqB,EAAE,SAAS,MAAM,EAAE,GACvC,MAAM,EAAE,CA0BV"}
+{"version":3,"file":"public-package-contract.d.ts","sourceRoot":"","sources":["../../src/release/public-package-contract.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,KAAK,GAAG,cAAc,GAAG,iBAAiB,CAAC;IACjD,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,uBAAuB,EAAE,yBAAyB,EAAE,CAAC;IACrD,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,4BAA4B,EAAE,MAAM,EAAE,CAAC;IACvC,2BAA2B,EAAE,MAAM,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAkMD,wBAAgB,yBAAyB,IAAI,qBAAqB,EAAE,CAenE;AAED,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,QAAQ,EAAE,qBAAqB,GAC9B,MAAM,EAAE,CAIV;AAED,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,QAAQ,EAAE,qBAAqB,GAC9B,MAAM,EAAE,CAIV;AAED,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,QAAQ,EAAE,qBAAqB,GAC9B,MAAM,EAAE,CAMV;AAED,wBAAgB,6BAA6B,CAC3C,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACjD,QAAQ,EAAE,qBAAqB,GAC9B,MAAM,EAAE,CAoBV;AAED,wBAAgB,oCAAoC,CAClD,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACnC,MAAM,EAAE,CAmBV;AAED,wBAAgB,qCAAqC,CACnD,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,kBAAkB,EAAE,SAAS,MAAM,EAAE,EACrC,qBAAqB,EAAE,SAAS,MAAM,EAAE,GACvC,MAAM,EAAE,CA0BV"}

package/dist/release/public-package-contract.js

@@ -108,7 +108,15 @@ const PUBLIC_PACKAGE_CONTRACTS = [
             '.oat/scripts',
             'apps/oat-docs/docs',
         ],
-        versionPolicyIgnorePatterns: ['assets/**'],
+        // Generated bundled assets, plus exactly the test paths this package's
+        // tsconfig leaves out of `dist` (DR-260927-test-only-paths-skip). Never
+        // broader than the compile exclusion: a test helper that compiles into
+        // `dist` still counts.
+        versionPolicyIgnorePatterns: [
+            'assets/**',
+            'src/**/*.test.ts',
+            'src/**/__tests__/**',
+        ],
     },
     {
         workspaceDir: 'packages/control-plane',
@@ -119,7 +127,7 @@ const PUBLIC_PACKAGE_CONTRACTS = [
         requiredPackedTextFiles: [],
         forbiddenPathPatterns: [...COMMON_FORBIDDEN_PATH_PATTERNS],
         versionPolicyAdditionalRoots: [],
-        versionPolicyIgnorePatterns: [],
+        versionPolicyIgnorePatterns: ['**/*.test.ts', '**/*.spec.ts'],
     },
     {
         workspaceDir: 'packages/docs-config',
@@ -130,7 +138,7 @@ const PUBLIC_PACKAGE_CONTRACTS = [
         requiredPackedTextFiles: [],
         forbiddenPathPatterns: [...COMMON_FORBIDDEN_PATH_PATTERNS],
         versionPolicyAdditionalRoots: [],
-        versionPolicyIgnorePatterns: [],
+        versionPolicyIgnorePatterns: ['src/**/*.test.ts'],
     },
     {
         workspaceDir: 'packages/docs-theme',
@@ -152,7 +160,7 @@ const PUBLIC_PACKAGE_CONTRACTS = [
         requiredPackedTextFiles: [],
         forbiddenPathPatterns: [...COMMON_FORBIDDEN_PATH_PATTERNS],
         versionPolicyAdditionalRoots: [],
-        versionPolicyIgnorePatterns: [],
+        versionPolicyIgnorePatterns: ['src/**/*.test.ts'],
     },
 ];
 function getMetadataValue(packageJson, fieldPath) {

package/dist/validation/skills.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../../src/validation/skills.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,uBAAuB;IACtC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,uCAAuC;IACtD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sCAAsC;IACrD,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,CACzB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,KAChD,OAAO,CAAC,cAAc,CAAC,CAAC;AAE7B,UAAU,6BAA6B;IACrC,WAAW,CAAC,EAAE,YAAY,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAm0CD,wBAAsB,gCAAgC,CACpD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,uCAAuC,EAChD,YAAY,GAAE,6BAAkC,GAC/C,OAAO,CAAC,sCAAsC,CAAC,CAsBjD;AAsGD,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,wBAA6B,EACtC,YAAY,GAAE,6BAAkC,GAC/C,OAAO,CAAC,uBAAuB,CAAC,CAyIlC"}
+{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../../src/validation/skills.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,uBAAuB;IACtC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,uCAAuC;IACtD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sCAAsC;IACrD,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,CACzB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,KAChD,OAAO,CAAC,cAAc,CAAC,CAAC;AAE7B,UAAU,6BAA6B;IACrC,WAAW,CAAC,EAAE,YAAY,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAu1CD,wBAAsB,gCAAgC,CACpD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,uCAAuC,EAChD,YAAY,GAAE,6BAAkC,GAC/C,OAAO,CAAC,sCAAsC,CAAC,CAsBjD;AAsGD,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,wBAA6B,EACtC,YAAY,GAAE,6BAAkC,GAC/C,OAAO,CAAC,uBAAuB,CAAC,CAsJlC"}

package/dist/validation/skills.js

@@ -2,7 +2,7 @@ import { execFile as execFileCallback } from 'node:child_process';
 import { readdir, readFile, stat } from 'node:fs/promises';
 import { join } from 'node:path';
 import { promisify } from 'node:util';
-import { getFrontmatterBlock, parseSkillFrontmatter, resolveSkillVersion, } from '../commands/shared/frontmatter.js';
+import { findSkillFrontmatterTypeProblems, getFrontmatterBlock, parseSkillFrontmatter, resolveSkillVersion, } from '../commands/shared/frontmatter.js';
 const execFileAsync = promisify(execFileCallback);
 async function isDirectory(path) {
     try {
@@ -459,12 +459,26 @@ function hasTrueFrontmatterValue(frontmatter, key) {
     return (frontmatterHasKey(frontmatter, key) &&
         getFrontmatterScalar(frontmatter, key) === 'true');
 }
-function unreadableFrontmatterFinding(file) {
+/**
+ * A block-relative problem position as a SKILL.md line and column. The block
+ * starts on the line after the opening `---`, so block line N is file line
+ * N + 1.
+ */
+function fileLocation(problem) {
+    return problem.line === null
+        ? null
+        : `line ${problem.line + 1}, column ${problem.column ?? 1}`;
+}
+function unreadableFrontmatterFinding(file, problem) {
+    const location = problem ? fileLocation(problem) : null;
+    const detail = problem
+        ? `: ${location === null ? '' : `${location}: `}${problem.message}`
+        : '';
     return {
         file,
         code: 'skill-frontmatter-unreadable',
         severity: 'error',
-        message: 'Frontmatter must be a valid YAML mapping with unique keys (version could not be read)',
+        message: `Frontmatter must be a valid YAML mapping with unique keys (version could not be read)${detail}`,
     };
 }
 function pushUniqueFinding(findings, finding) {
@@ -882,7 +896,7 @@ async function collectChangedSkillVersionBumpFindings(repoRoot, baseRef, changed
         // `validateOatSkills` runs the structural version-source pass before this
         // collector, so the same file can already carry the current-side finding.
         if (parsedCurrent?.malformed) {
-            pushUniqueFinding(findings, unreadableFrontmatterFinding(skillPath));
+            pushUniqueFinding(findings, unreadableFrontmatterFinding(skillPath, parsedCurrent.problem));
             continue;
         }
         if (parsedCurrent?.unusableVersionDeclaration) {
@@ -1024,8 +1038,8 @@ async function collectSkillVersionSourceFindings(skillsRoot, skillDirs, findings
         if (parsed.malformed) {
             // Reported for every skill, not just `oat-*` ones: unreadable
             // frontmatter is exactly the state that would otherwise make a version
-            // silently unreadable everywhere.
-            findings.push(unreadableFrontmatterFinding(skillPath));
+            // silently unreadable everywhere. The parser's position travels with it.
+            findings.push(unreadableFrontmatterFinding(skillPath, parsed.problem));
             continue;
         }
         // Declaration usability is checked here, before the unresolved bail, so it
@@ -1102,6 +1116,18 @@ export async function validateOatSkills(repoRoot, options = {}, dependencies = {
                 });
             }
         }
+        // Typed after parsing, beside the semantic checks below rather than in
+        // place of them; a block that does not parse is reported once, with its
+        // location, by collectSkillVersionSourceFindings.
+        for (const problem of findSkillFrontmatterTypeProblems(fm)) {
+            const location = fileLocation(problem);
+            findings.push({
+                file: skillPath,
+                code: 'skill-frontmatter-type',
+                severity: 'error',
+                message: `Frontmatter key ${problem.message}${location === null ? '' : ` (${location})`}`,
+            });
+        }
         const frontmatterName = getFrontmatterScalar(fm, 'name');
         if (frontmatterName && frontmatterName !== dir) {
             findings.push({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-agent-toolkit/cli",
-  "version": "0.3.10",
+  "version": "0.3.12",
   "private": false,
   "description": "Open Agent Toolkit CLI",
   "homepage": "https://github.com/voxmedia/open-agent-toolkit/tree/main/packages/cli",
@@ -34,7 +34,7 @@
     "ora": "^9.0.0",
     "yaml": "2.8.2",
     "zod": "^3.25.76",
-    "@open-agent-toolkit/control-plane": "0.3.10"
+    "@open-agent-toolkit/control-plane": "0.3.12"
   },
   "devDependencies": {
     "@types/node": "^22.10.0",

package/dist/commands/pjm/template-source.d.ts

@@ -1,14 +0,0 @@
-export type PjmTemplateTier = 'repository' | 'user' | 'bundle';
-export interface ResolvePjmTemplateOptions {
-    name: string;
-    assetsRoot: string;
-    templatesRoot?: string;
-    home?: string;
-}
-export interface ResolvedPjmTemplate {
-    content: string;
-    path: string;
-    tier: PjmTemplateTier;
-}
-export declare function resolvePjmTemplate(options: ResolvePjmTemplateOptions): Promise<ResolvedPjmTemplate>;
-//# sourceMappingURL=template-source.d.ts.map

package/dist/commands/pjm/template-source.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"template-source.d.ts","sourceRoot":"","sources":["../../../src/commands/pjm/template-source.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,eAAe,GAAG,YAAY,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE/D,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,eAAe,CAAC;CACvB;AAkBD,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,mBAAmB,CAAC,CA2C9B"}