@open-agent-toolkit/cli 0.3.16 → 0.3.18

package/dist/validation/skills.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../../src/validation/skills.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,uBAAuB;IACtC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,uCAAuC;IACtD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sCAAsC;IACrD,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,CACzB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,KAChD,OAAO,CAAC,cAAc,CAAC,CAAC;AAE7B,UAAU,6BAA6B;IACrC,WAAW,CAAC,EAAE,YAAY,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAu1CD,wBAAsB,gCAAgC,CACpD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,uCAAuC,EAChD,YAAY,GAAE,6BAAkC,GAC/C,OAAO,CAAC,sCAAsC,CAAC,CAsBjD;AAsGD,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,wBAA6B,EACtC,YAAY,GAAE,6BAAkC,GAC/C,OAAO,CAAC,uBAAuB,CAAC,CAoKlC"}
+{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../../src/validation/skills.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,uBAAuB;IACtC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,uCAAuC;IACtD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sCAAsC;IACrD,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,CACzB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,KAChD,OAAO,CAAC,cAAc,CAAC,CAAC;AAE7B,UAAU,6BAA6B;IACrC,WAAW,CAAC,EAAE,YAAY,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAqgDD,wBAAsB,gCAAgC,CACpD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,uCAAuC,EAChD,YAAY,GAAE,6BAAkC,GAC/C,OAAO,CAAC,sCAAsC,CAAC,CAsBjD;AAsGD,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,wBAA6B,EACtC,YAAY,GAAE,6BAAkC,GAC/C,OAAO,CAAC,uBAAuB,CAAC,CAoKlC"}

package/dist/validation/skills.js

@@ -1,6 +1,6 @@
 import { execFile as execFileCallback } from 'node:child_process';
-import { readdir, readFile, stat } from 'node:fs/promises';
-import { join } from 'node:path';
+import { readdir, readFile, realpath, stat } from 'node:fs/promises';
+import { isAbsolute, join, relative, sep } from 'node:path';
 import { promisify } from 'node:util';
 import { findSkillFrontmatterTypeProblems, getFrontmatterBlock, parseSkillFrontmatter, resolveSkillVersion, } from '../commands/shared/frontmatter.js';
 const execFileAsync = promisify(execFileCallback);
@@ -82,7 +82,7 @@ function projectArtifactArrays(content) {
 function executesCommand(line, command) {
     const prefix = '(?:(?:&&|\\|\\||;|\\bthen\\b|\\belse\\b|\\bdo\\b|\\bif\\b)\\s+)';
     const modifiers = '(?:!\\s+)?(?:command\\s+)?(?:env\\s+)?(?:[A-Z][A-Z0-9_]*=\\S+\\s+)*';
-    return new RegExp(`^\\s*(?:(?:[A-Z][A-Z0-9_]*)=\\$\\()?${command}\\b|${prefix}${modifiers}${command}\\b`).test(line);
+    return new RegExp(`^\\s*(?:(?:[A-Z][A-Z0-9_]*)=\\$\\()?${modifiers}${command}\\b|${prefix}${modifiers}${command}\\b`).test(line);
 }
 function executesGitCommand(line) {
     return executesCommand(line, 'git');
@@ -103,6 +103,15 @@ function logicalLines(content) {
             combined += continuation.trimStart();
             offset += continuation.length + 1;
         }
+        // Quoted helper messages may span lines; include their ownership tail.
+        while (/\boat\s+internal\s+commit-paths\b/.test(combined) &&
+            (combined.match(/(?<!\\)"/g)?.length ?? 0) % 2 === 1 &&
+            index + 1 < physicalLines.length) {
+            index += 1;
+            const continuation = physicalLines[index] ?? '';
+            combined += `\n${continuation}`;
+            offset += continuation.length + 1;
+        }
         logical.push({
             content: combined,
             endLine: index,
@@ -116,7 +125,7 @@ function isProjectArtifactWriterLine(line, artifactArrays = new Set()) {
     const trimmed = line.trim();
     const executesGitOrOat = executesGitCommand(trimmed) || executesCommand(trimmed, 'oat');
     const writesProjectArtifact = executesGitOrOat &&
-        /\bgit\s+(?:add|commit)\b|\boat\s+project\s+push\b/.test(trimmed) &&
+        /\bgit\s+(?:add|commit)\b|\boat\s+(?:project\s+push|internal\s+commit-paths)\b/.test(trimmed) &&
         referencesProjectArtifactVariable(line, artifactArrays);
     const writesActiveProject = executesGitOrOat && /\boat\s+config\s+set\s+activeProject\b/.test(trimmed);
     return writesProjectArtifact || writesActiveProject;
@@ -180,8 +189,11 @@ function projectArtifactWriterSites(content) {
     const sites = new Map();
     const artifactArrays = projectArtifactArrays(content);
     for (const line of logicalLines(content)) {
-        if (isProjectArtifactWriterLine(line.content, artifactArrays)) {
-            const site = contentSiteAt(content, line.offset, fencedSites);
+        const site = contentSiteAt(content, line.offset, fencedSites);
+        const writerArrays = /\boat\s+internal\s+commit-paths\b/.test(line.content)
+            ? projectArtifactArrays(site.content)
+            : artifactArrays;
+        if (isProjectArtifactWriterLine(line.content, writerArrays)) {
             sites.set(`${site.start}:${site.end}`, site);
         }
     }
@@ -196,11 +208,12 @@ function collectSyncedContentFindings(file, content, findings) {
         });
     }
     const logical = logicalLines(content);
+    const fencedSites = fencedContentSites(content);
     const artifactArrays = projectArtifactArrays(content);
     for (const [logicalIndex, site] of logical.entries()) {
         const line = site.content;
         const lineNumber = site.startLine + 1;
-        if (/\bgit\s+add\b[^\n]*\.oat\/projects\/synced(?:\/|\b)/.test(line)) {
+        if (/\b(?:git\s+add|oat\s+internal\s+commit-paths)\b[^\n]*\.oat\/projects\/synced(?:\/|\b)/.test(line)) {
             findings.push({
                 file,
                 message: `Line ${lineNumber}: Never stage a path under .oat/projects/synced/; use oat project push`,
@@ -231,6 +244,60 @@ function collectSyncedContentFindings(file, content, findings) {
                 message: `Line ${lineNumber}: Project-artifact staging must name exact files, not the project directory or a glob`,
             });
         }
+        const isExactCommit = executesCommand(line, 'oat') &&
+            /\boat\s+internal\s+commit-paths\b/.test(line) &&
+            !/\bcommit-paths\s+--help(?:\s|$)/.test(line);
+        if (isExactCommit && isLifecycleSafetyFile(file)) {
+            const ownedTail = /\s--\s+([\s\S]+?)(?:\s+\|\||\s+&&|$)/.exec(line)?.[1];
+            if (!/--identity\s+\S/.test(line) ||
+                !/--message\s+\S/.test(line) ||
+                !ownedTail?.trim()) {
+                findings.push({
+                    file,
+                    message: `Line ${lineNumber}: Exact-path commits require a stable identity, message, and explicit owned file list after --`,
+                });
+            }
+            if (ownedTail) {
+                const arrays = new Set([...ownedTail.matchAll(/\$\{([A-Z][A-Z0-9_]*)\[@\]\}/g)].map((match) => match[1] ?? ''));
+                let ownedValues = ownedTail;
+                for (let changed = true; changed;) {
+                    changed = false;
+                    for (const candidate of logicalLines(contentSiteAt(content, site.offset, fencedSites).content)) {
+                        const assignment = /^\s*([A-Z][A-Z0-9_]*)(?:\+)?=\((.*)\)\s*$/.exec(candidate.content);
+                        if (!assignment?.[1] ||
+                            !arrays.has(assignment[1]) ||
+                            !assignment[2])
+                            continue;
+                        const value = assignment[2];
+                        ownedValues += ` ${value}`;
+                        for (const match of value.matchAll(/\$\{([A-Z][A-Z0-9_]*)\[@\]\}/g)) {
+                            if (match[1] && !arrays.has(match[1])) {
+                                arrays.add(match[1]);
+                                changed = true;
+                            }
+                        }
+                    }
+                }
+                if (/(?:\$PROJECT_PATH|\$\{PROJECT_PATH\}|\{PROJECT_PATH\})(?:\/(?:reviews|references|pr))?\/?(?:["'\s]|$)|[^\s"']*\*[^\s"']*|[^\s"']\/["']/.test(ownedValues)) {
+                    findings.push({
+                        file,
+                        message: `Line ${lineNumber}: Exact-path commits must name concrete owned files, not a directory or glob`,
+                    });
+                }
+                if (/\.oat\/projects\/synced(?:\/|\b)/.test(ownedValues)) {
+                    findings.push({
+                        file,
+                        message: `Line ${lineNumber}: Never commit a path under .oat/projects/synced/; use oat project push`,
+                    });
+                }
+            }
+            if (!/\|\|\s*(?:\{|exit\b)/.test(line)) {
+                findings.push({
+                    file,
+                    message: `Line ${lineNumber}: Exact-path commit must handle a nonzero exit explicitly and stop bookkeeping`,
+                });
+            }
+        }
         const pushReceipt = /^\s*([A-Z][A-Z0-9_]*)=\$\(oat project push\b[^\n]*--json\b/.exec(line);
         if (pushReceipt) {
             const outputVariable = pushReceipt[1] ?? '';
@@ -281,9 +348,11 @@ function collectSyncedContentFindings(file, content, findings) {
     }
     const lines = content.split('\n');
     const logicalByStart = new Map(logical.map((line) => [line.startLine, line.content]));
+    const logicalOffsetByStart = new Map(logical.map((line) => [line.startLine, line.offset]));
     const continuedLines = new Set(logical.flatMap((line) => Array.from({ length: line.endLine - line.startLine }, (_, offset) => line.startLine + offset + 1)));
     let fenceMarker = null;
     let scopeGuardSeen = false;
+    let fencedArtifactArrays = artifactArrays;
     for (const [index, line] of lines.entries()) {
         const lineNumber = index + 1;
         const fenceMatch = line.match(/^\s*(`{3,}|~{3,})(?:[^`~]*)$/);
@@ -292,6 +361,7 @@ function collectSyncedContentFindings(file, content, findings) {
             if (fenceMarker === null) {
                 fenceMarker = marker;
                 scopeGuardSeen = false;
+                fencedArtifactArrays = projectArtifactArrays(contentSiteAt(content, logicalOffsetByStart.get(index) ?? 0, fencedSites).content);
             }
             else if (marker[0] === fenceMarker[0] &&
                 marker.length >= fenceMarker.length &&
@@ -315,8 +385,10 @@ function collectSyncedContentFindings(file, content, findings) {
             /\bsynced\b/.test(inspectedLine)) {
             scopeGuardSeen = true;
         }
-        if (/\bgit\s+(?:add|commit)\b/.test(inspectedLine) &&
-            referencesProjectArtifactVariable(inspectedLine, artifactArrays) &&
+        if (/\bgit\s+(?:add|commit)\b|\boat\s+internal\s+commit-paths\b/.test(inspectedLine) &&
+            referencesProjectArtifactVariable(inspectedLine, /\boat\s+internal\s+commit-paths\b/.test(inspectedLine)
+                ? fencedArtifactArrays
+                : artifactArrays) &&
             !scopeGuardSeen) {
             findings.push({
                 file,
@@ -766,9 +838,63 @@ async function resolveOwningVersionedFiles(repoRoot, changedPath) {
     }
     return [];
 }
+/** Follow vendored file and directory links without escaping the repo or cycles. */
+async function sharedDocConsumers(repoRoot, changedPaths) {
+    const consumers = new Map();
+    const sharedPaths = changedPaths.filter((path) => path.startsWith('.agents/docs/'));
+    if (sharedPaths.length === 0)
+        return consumers;
+    const root = await realpath(repoRoot);
+    const withinRepo = (path) => {
+        const local = relative(root, path);
+        return (local !== '..' && !local.startsWith(`..${sep}`) && !isAbsolute(local));
+    };
+    const targets = new Map();
+    for (const path of sharedPaths) {
+        const target = await realpath(join(root, path)).catch(() => null);
+        if (target === null || !withinRepo(target))
+            continue;
+        targets.set(target, [...(targets.get(target) ?? []), path]);
+    }
+    const skillsRoot = join(root, '.agents/skills');
+    const skills = await readdir(skillsRoot, { withFileTypes: true }).catch(() => []);
+    for (const skill of skills) {
+        if (!skill.isDirectory())
+            continue;
+        const owner = `${SKILLS_PATH_PREFIX}${skill.name}/SKILL.md`;
+        if (!(await isFile(join(root, owner))))
+            continue;
+        const skillRoot = join(skillsRoot, skill.name);
+        const owned = new Set();
+        async function visit(path, ancestors) {
+            // realpath rejects missing targets and symlink loops. An ancestor set also
+            // catches directory links back into an already visited directory.
+            const target = await realpath(path).catch(() => null);
+            if (target === null || !withinRepo(target) || ancestors.has(target))
+                return;
+            const info = await stat(target);
+            if (info.isFile()) {
+                for (const changed of targets.get(target) ?? [])
+                    owned.add(changed);
+            }
+            else if (info.isDirectory()) {
+                const next = new Set([...ancestors, target]);
+                for (const entry of await readdir(path, { withFileTypes: true })) {
+                    // Test fixtures are not shipped skill content, including linked docs.
+                    if (path !== skillRoot || entry.name !== 'tests')
+                        await visit(join(path, entry.name), next);
+                }
+            }
+        }
+        await visit(skillRoot, new Set());
+        if (owned.size)
+            consumers.set(owner, [...owned]);
+    }
+    return consumers;
+}
 /**
  * List the canonical files whose version must move, given everything that
- * changed under `.agents/skills` and `.agents/agents`.
+ * changed under `.agents/skills`, `.agents/agents`, and vendored `.agents/docs`.
  *
  * The pathspec is deliberately wider than the files that carry a version: a
  * skill's `scripts/` and `references/` ship to every `oat tools install`
@@ -794,6 +920,7 @@ async function listChangedVersionedFiles(repoRoot, baseRef, dependencies) {
         '--',
         '.agents/skills',
         '.agents/agents/*.md',
+        '.agents/docs',
     ], {
         cwd: repoRoot,
         env: dependencies.env ?? process.env,
@@ -802,7 +929,7 @@ async function listChangedVersionedFiles(repoRoot, baseRef, dependencies) {
     // legitimately begin or end with a space. The trailing empty entry after the
     // final NUL is what the length filter removes.
     const changedPaths = stdout.split('\0').filter((entry) => entry.length > 0);
-    const grouped = new Map();
+    const grouped = await sharedDocConsumers(repoRoot, changedPaths);
     for (const changedPath of changedPaths) {
         const owningFiles = await resolveOwningVersionedFiles(repoRoot, changedPath);
         for (const owningFile of owningFiles) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-agent-toolkit/cli",
-  "version": "0.3.16",
+  "version": "0.3.18",
   "private": false,
   "description": "Open Agent Toolkit CLI",
   "homepage": "https://github.com/voxmedia/open-agent-toolkit/tree/main/packages/cli",
@@ -30,11 +30,12 @@
     "@inquirer/prompts": "^8.2.0",
     "chalk": "^5.6.2",
     "commander": "^12.1.0",
+    "entities": "6.0.1",
     "jsonc-parser": "3.2.1",
     "ora": "^9.0.0",
     "yaml": "2.8.2",
     "zod": "^3.25.76",
-    "@open-agent-toolkit/control-plane": "0.3.16"
+    "@open-agent-toolkit/control-plane": "0.3.18"
   },
   "devDependencies": {
     "@types/node": "^22.10.0",