@open-agent-toolkit/cli 0.3.38 → 0.3.39

package/dist/config/oat-config.js

@@ -1,4 +1,4 @@
-import { execSync } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
 import { lstat, readFile } from 'node:fs/promises';
 import { basename, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { CliError } from '../errors/cli-error.js';
@@ -1726,29 +1726,21 @@ export async function clearActiveIdea(repoRoot) {
         activeIdea: null,
     });
 }
-export function detectDefaultBranch(repoRoot) {
-    try {
-        const branch = execSync('gh repo view --json defaultBranchRef --jq .defaultBranchRef.name', {
-            cwd: repoRoot,
-            encoding: 'utf8',
-            timeout: 10_000,
-            stdio: ['pipe', 'pipe', 'pipe'],
-        }).trim();
-        if (branch)
-            return branch;
-    }
-    catch {
-        // gh not available or not authenticated — fall through
-    }
+const runGitCommand = (args, cwd) => execFileSync('git', args, {
+    cwd,
+    encoding: 'utf8',
+    timeout: 5_000,
+    stdio: ['pipe', 'pipe', 'pipe'],
+});
+/**
+ * Local-only default-branch detection: `origin/HEAD`, then `main`. It runs
+ * only `git`, so it never contacts a remote service or runs `gh`.
+ */
+export function detectDefaultBranch(repoRoot, runGit = runGitCommand) {
     try {
-        const ref = execSync('git rev-parse --abbrev-ref origin/HEAD', {
-            cwd: repoRoot,
-            encoding: 'utf8',
-            timeout: 5_000,
-            stdio: ['pipe', 'pipe', 'pipe'],
-        }).trim();
+        const ref = runGit(['rev-parse', '--abbrev-ref', 'origin/HEAD'], repoRoot).trim();
         if (ref.startsWith('origin/'))
-            return ref.replace('origin/', '');
+            return ref.slice('origin/'.length);
     }
     catch {
         // origin/HEAD not set — fall through

package/dist/index.d.ts

@@ -2,4 +2,10 @@
 export declare function normalizeArgv(argv: string[]): string[];
 export declare function main(argv?: string[], platform?: NodeJS.Platform): Promise<void>;
 export declare function isEntrypoint(argv?: string[], entrypointUrl?: string): boolean;
+/**
+ * A reader that hangs up early (`oat tools list | head -1`) has received all
+ * the output it wanted, so a broken pipe ends the process quietly. Any other
+ * stream error is rethrown and stays fatal.
+ */
+export declare function exitQuietlyOnBrokenPipe(stream: NodeJS.WriteStream, exit?: (code: number) => void): void;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAuBA,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAatD;AAED,wBAAsB,IAAI,CACxB,IAAI,GAAE,MAAM,EAAiB,EAC7B,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,OAAO,CAAC,IAAI,CAAC,CA0Cf;AAED,wBAAgB,YAAY,CAC1B,IAAI,GAAE,MAAM,EAAiB,EAC7B,aAAa,GAAE,MAAwB,GACtC,OAAO,CAaT"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAuBA,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAatD;AAED,wBAAsB,IAAI,CACxB,IAAI,GAAE,MAAM,EAAiB,EAC7B,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,OAAO,CAAC,IAAI,CAAC,CA0Cf;AAED,wBAAgB,YAAY,CAC1B,IAAI,GAAE,MAAM,EAAiB,EAC7B,aAAa,GAAE,MAAwB,GACtC,OAAO,CAaT;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,CAAC,WAAW,EAC1B,IAAI,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAmC,GAC1D,IAAI,CAQN"}

package/dist/index.js

@@ -81,7 +81,23 @@ export function isEntrypoint(argv = process.argv, entrypointUrl = import.meta.ur
         return entrypointUrl === pathToFileURL(argvPath).href;
     }
 }
+/**
+ * A reader that hangs up early (`oat tools list | head -1`) has received all
+ * the output it wanted, so a broken pipe ends the process quietly. Any other
+ * stream error is rethrown and stays fatal.
+ */
+export function exitQuietlyOnBrokenPipe(stream, exit = (code) => process.exit(code)) {
+    stream.on('error', (error) => {
+        if (error.code === 'EPIPE') {
+            exit(0);
+            return;
+        }
+        throw error;
+    });
+}
 if (isEntrypoint()) {
+    exitQuietlyOnBrokenPipe(process.stdout);
+    exitQuietlyOnBrokenPipe(process.stderr);
     void main().catch((error) => {
         const logger = createLogger({ json: false, verbose: false });
         if (error instanceof CliError) {

package/dist/providers/codex/codec/config-merge.d.ts

@@ -15,11 +15,30 @@ export interface CodexSingleRoleConfigMergeArgs {
     staleManagedRoles?: string[];
     inheritedMaxDepth?: number;
 }
+export type CodexConfigUserKey = 'features.multi_agent' | 'agents.max_depth';
+export interface CodexConfigAddedKey {
+    key: CodexConfigUserKey;
+    value: boolean | number;
+}
+/** An explicit user value that sync kept although OAT would choose another. */
+export interface CodexConfigUserValueNotice {
+    key: CodexConfigUserKey;
+    kind: 'conflict' | 'note';
+    value: unknown;
+    message: string;
+}
 export interface CodexConfigMergeResult {
     mergedContent: string;
     changed: boolean;
     removedRoles: string[];
+    addedKeys: CodexConfigAddedKey[];
+    userValueNotices: CodexConfigUserValueNotice[];
 }
+/**
+ * One line per key sync added and per explicit user value it kept against
+ * OAT's preference, for command output.
+ */
+export declare function describeCodexConfigMerge(result: Pick<CodexConfigMergeResult, 'addedKeys' | 'userValueNotices'>): string[];
 /** Reads a valid numeric agents.max_depth value from Codex TOML content. */
 export declare function readCodexMaxDepth(content: string | null): number | null;
 /**

package/dist/providers/codex/codec/config-merge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-merge.d.ts","sourceRoot":"","sources":["../../../../src/providers/codex/codec/config-merge.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,YAAY,EAAE,sBAAsB,EAAE,CAAC;IACvC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,8BAA8B;IAC7C,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,IAAI,EAAE,sBAAsB,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAqFD,4EAA4E;AAC5E,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAIvE;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,eAAe,EACf,YAAY,EACZ,iBAAsB,EACtB,iBAAiB,GAClB,EAAE,oBAAoB,GAAG,sBAAsB,CAkH/C;AAED,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,EACtC,eAAe,EACf,IAAI,EACJ,iBAAsB,EACtB,iBAAiB,GAClB,EAAE,8BAA8B,GAAG,sBAAsB,CAOzD"}
+{"version":3,"file":"config-merge.d.ts","sourceRoot":"","sources":["../../../../src/providers/codex/codec/config-merge.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,YAAY,EAAE,sBAAsB,EAAE,CAAC;IACvC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,8BAA8B;IAC7C,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,IAAI,EAAE,sBAAsB,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,kBAAkB,GAAG,sBAAsB,GAAG,kBAAkB,CAAC;AAE7E,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,kBAAkB,CAAC;IACxB,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC;CACzB;AAED,+EAA+E;AAC/E,MAAM,WAAW,0BAA0B;IACzC,GAAG,EAAE,kBAAkB,CAAC;IACxB,IAAI,EAAE,UAAU,GAAG,MAAM,CAAC;IAC1B,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,EAAE,mBAAmB,EAAE,CAAC;IACjC,gBAAgB,EAAE,0BAA0B,EAAE,CAAC;CAChD;AA6HD;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,IAAI,CAAC,sBAAsB,EAAE,WAAW,GAAG,kBAAkB,CAAC,GACrE,MAAM,EAAE,CAUV;AAED,4EAA4E;AAC5E,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAIvE;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,eAAe,EACf,YAAY,EACZ,iBAAsB,EACtB,iBAAiB,GAClB,EAAE,oBAAoB,GAAG,sBAAsB,CA0H/C;AAED,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,EACtC,eAAe,EACf,IAAI,EACJ,iBAAsB,EACtB,iBAAiB,GAClB,EAAE,8BAA8B,GAAG,sBAAsB,CAOzD"}

package/dist/providers/codex/codec/config-merge.js

@@ -65,6 +65,53 @@ function canonicalTomlValue(value) {
     }
     return value;
 }
+function renderNoticeValue(value) {
+    return typeof value === 'string' ? JSON.stringify(value) : String(value);
+}
+function multiAgentNotice(value) {
+    if (value === undefined || value === true) {
+        return null;
+    }
+    return {
+        key: 'features.multi_agent',
+        kind: 'conflict',
+        value,
+        message: 'OAT-managed Codex roles need true',
+    };
+}
+function maxDepthNotice(value) {
+    if (value === undefined) {
+        return null;
+    }
+    const depth = getFiniteNumber(value);
+    if (depth === null || depth < 1) {
+        return {
+            key: 'agents.max_depth',
+            kind: 'conflict',
+            value,
+            message: 'default OAT dispatch needs at least 1',
+        };
+    }
+    if (depth < 2) {
+        return {
+            key: 'agents.max_depth',
+            kind: 'note',
+            value,
+            message: 'this disables only optional nested work',
+        };
+    }
+    return null;
+}
+/**
+ * One line per key sync added and per explicit user value it kept against
+ * OAT's preference, for command output.
+ */
+export function describeCodexConfigMerge(result) {
+    return [
+        ...result.addedKeys.map(({ key, value }) => `added ${key} = ${renderNoticeValue(value)}`),
+        ...result.userValueNotices.map(({ key, kind, value, message }) => `${kind}: kept ${key} = ${renderNoticeValue(value)} (${message})`),
+    ];
+}
 /** Reads a valid numeric agents.max_depth value from Codex TOML content. */
 export function readCodexMaxDepth(content) {
     const parsed = parseConfig(content);
@@ -94,8 +141,29 @@ export function mergeCodexConfig({ existingContent, desiredRoles, staleManagedRo
         requireNotTable(role.description, `agents.${roleName}.description`);
         requireNotTable(role.config_file, `agents.${roleName}.config_file`);
     }
-    const maxDepth = Math.max(2, getFiniteNumber(agents.max_depth) ?? 2, getFiniteNumber(inheritedMaxDepth) ?? 2);
-    const expectedAgents = { ...agents, max_depth: maxDepth };
+    // Explicit user values are never rewritten; only absent keys are added.
+    const addedKeys = [];
+    const userValueNotices = [];
+    const expectedFeatures = { ...features };
+    if (features.multi_agent === undefined) {
+        expectedFeatures.multi_agent = true;
+        addedKeys.push({ key: 'features.multi_agent', value: true });
+    }
+    const expectedAgents = { ...agents };
+    const manageMaxDepth = !stale.has('max_depth');
+    if (manageMaxDepth && agents.max_depth === undefined) {
+        const maxDepth = Math.max(2, getFiniteNumber(inheritedMaxDepth) ?? 2);
+        expectedAgents.max_depth = maxDepth;
+        addedKeys.push({ key: 'agents.max_depth', value: maxDepth });
+    }
+    for (const notice of [
+        multiAgentNotice(features.multi_agent),
+        manageMaxDepth ? maxDepthNotice(agents.max_depth) : null,
+    ]) {
+        if (notice) {
+            userValueNotices.push(notice);
+        }
+    }
     for (const role of roles.values()) {
         expectedAgents[role.roleName] = {
             ...getObject(agents[role.roleName]),
@@ -115,11 +183,8 @@ export function mergeCodexConfig({ existingContent, desiredRoles, staleManagedRo
         ? existingContent
         : '';
     let mergedContent = original;
-    if (features.multi_agent !== true) {
-        mergedContent = setTomlValue(mergedContent, ['features', 'multi_agent'], 'true');
-    }
-    if (agents.max_depth !== maxDepth && !removed.has('max_depth')) {
-        mergedContent = setTomlValue(mergedContent, ['agents', 'max_depth'], String(maxDepth));
+    for (const { key, value } of addedKeys) {
+        mergedContent = setTomlValue(mergedContent, key.split('.'), String(value));
     }
     for (const staleRole of removedRoles) {
         mergedContent = removeTomlTable(mergedContent, ['agents', staleRole]);
@@ -138,7 +203,7 @@ export function mergeCodexConfig({ existingContent, desiredRoles, staleManagedRo
     }
     const expected = {
         ...parsed,
-        features: { ...features, multi_agent: true },
+        features: expectedFeatures,
         agents: expectedAgents,
     };
     let actual;
@@ -157,6 +222,8 @@ export function mergeCodexConfig({ existingContent, desiredRoles, staleManagedRo
         mergedContent,
         changed: mergedContent !== (existingContent ?? ''),
         removedRoles,
+        addedKeys,
+        userValueNotices,
     };
 }
 /** Merges one managed Codex role using the shared configuration contract. */

package/dist/providers/codex/codec/sync-extension.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sync-extension.d.ts","sourceRoot":"","sources":["../../../../src/providers/codex/codec/sync-extension.ts"],"names":[],"mappings":"AAkBA,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AAKvB,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,6BAA6B,EACnC,MAAM,mBAAmB,CAAC;AAsB3B,MAAM,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;AACzD,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,QAAQ,CAAC;AAErD,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,oBAAoB,CAAC;IAC7B,MAAM,EAAE,oBAAoB,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,4BAA6B,SAAQ,6BAA6B,CACjF,OAAO,EACP,oBAAoB,CACrB;IACC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAmB,SAAQ,mBAAmB,CAC7D,OAAO,EACP,oBAAoB,EACpB,0BAA0B,CAC3B;IACC,UAAU,EAAE,4BAA4B,EAAE,CAAC;IAC3C,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,yBAAyB,GAAG,0BAA0B,CAAC;AAiBnE,MAAM,WAAW,iCAAiC;IAChD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAoiBD,wBAAsB,gCAAgC,CACpD,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,cAAc,EAAE,EAClC,qBAAqB,CAAC,EAAE,MAAM,EAAE,EAChC,OAAO,GAAE,iCAAsC,GAC9C,OAAO,CAAC,kBAAkB,CAAC,CAkL7B;AAED,wBAAsB,8BAA8B,CAClD,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,yBAAyB,CAAC,CA+DpC;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAE1E;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,kBAAkB,GAAG;IACjE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB,CAEA;AAED,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,kBAAkB,GACvB,uBAAuB,EAAE,CAQ3B;AAED,eAAO,MAAM,6BAA6B,EAAE,wBAAwB,CAClE,kBAAkB,EAClB,sBAAsB,CAAC,iCAAiC,CAAC,CAa1D,CAAC"}
+{"version":3,"file":"sync-extension.d.ts","sourceRoot":"","sources":["../../../../src/providers/codex/codec/sync-extension.ts"],"names":[],"mappings":"AAkBA,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,eAAe,CAAC;AAKvB,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,6BAA6B,EACnC,MAAM,mBAAmB,CAAC;AAwB3B,MAAM,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;AACzD,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,QAAQ,CAAC;AAErD,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,oBAAoB,CAAC;IAC7B,MAAM,EAAE,oBAAoB,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,4BAA6B,SAAQ,6BAA6B,CACjF,OAAO,EACP,oBAAoB,CACrB;IACC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAmB,SAAQ,mBAAmB,CAC7D,OAAO,EACP,oBAAoB,EACpB,0BAA0B,CAC3B;IACC,UAAU,EAAE,4BAA4B,EAAE,CAAC;IAC3C,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,yBAAyB,GAAG,0BAA0B,CAAC;AAiBnE,MAAM,WAAW,iCAAiC;IAChD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AA4mBD,wBAAsB,gCAAgC,CACpD,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,cAAc,EAAE,EAClC,qBAAqB,CAAC,EAAE,MAAM,EAAE,EAChC,OAAO,GAAE,iCAAsC,GAC9C,OAAO,CAAC,kBAAkB,CAAC,CAoN7B;AAED,wBAAsB,8BAA8B,CAClD,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,yBAAyB,CAAC,CA+DpC;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAE1E;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,kBAAkB,GAAG;IACjE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB,CAEA;AAED,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,kBAAkB,GACvB,uBAAuB,EAAE,CAQ3B;AAED,eAAO,MAAM,6BAA6B,EAAE,wBAAwB,CAClE,kBAAkB,EAClB,sBAAsB,CAAC,iCAAiC,CAAC,CAa1D,CAAC"}

package/dist/providers/codex/codec/sync-extension.js

@@ -12,7 +12,7 @@ import TOML from '@iarna/toml';
 import { hasMaterializationChanges, summarizeMaterializationPlan, } from '../../shared/index.js';
 import YAML from 'yaml';
 import { SUPPORTED_CODEX_BASE_ROLES, SUPPORTED_CODEX_ROLE_TARGETS, } from './catalog.js';
-import { mergeCodexConfig, readCodexMaxDepth, } from './config-merge.js';
+import { describeCodexConfigMerge, mergeCodexConfig, readCodexMaxDepth, } from './config-merge.js';
 import { exportCanonicalAgentToCodexRole } from './export-to-codex.js';
 import { materializeCodexRole } from './materialize.js';
 import { isOatManagedCodexRoleFile, readOatManagedCodexRoleOwner, withOatManagedCodexRoleOwner, } from './shared.js';
@@ -35,6 +35,13 @@ async function readOptionalFile(path) {
     }
     return readFile(path, 'utf8');
 }
+function describeConfigOperation(summary, configMerge) {
+    const details = describeCodexConfigMerge(configMerge);
+    if (configMerge.removedRoles.length > 0) {
+        details.unshift(`removes stale role tables: ${configMerge.removedRoles.map((role) => `agents.${role}`).join(', ')}`);
+    }
+    return [summary, ...details].join('; ');
+}
 function normalizeManagedRolesConfig(desiredRoles) {
     return desiredRoles.map((role) => ({
         roleName: role.roleName,
@@ -42,7 +49,7 @@ function normalizeManagedRolesConfig(desiredRoles) {
         configFile: role.configFile,
     }));
 }
-async function desiredRolesFromCanonical(canonicalEntries, scopeRoot, materializationTargets) {
+async function desiredRolesFromCanonical(canonicalEntries, scopeRoot, materializationTargets, scopeOwner) {
     const roles = [];
     for (const entry of canonicalEntries) {
         if (entry.type !== 'agent' ||
@@ -57,7 +64,7 @@ async function desiredRolesFromCanonical(canonicalEntries, scopeRoot, materializ
             description: exported.description,
             configFile: exported.configFile,
             rolePath: join(scopeRoot, '.codex', exported.configFile),
-            content: exported.content,
+            content: withOatManagedCodexRoleOwner(exported.content, scopeOwner),
             sourcePath: entry.canonicalPath,
         });
         if (CODEX_MATERIALIZED_BASE_ROLES.has(exported.roleName)) {
@@ -329,9 +336,47 @@ function parseConfigAgentTable(content) {
         return {};
     }
 }
-async function collectStaleManagedRoles(scopeRoot, existingConfigContent, desiredRoleNames, cleanupOwner, removeLegacyProjectRoles) {
+function codexScopeOwner(scopeRoot, options) {
+    return isUserCodexScope(scopeRoot, options)
+        ? 'user-config'
+        : 'project-config';
+}
+function codexCleanupOwners(scopeRoot, options) {
+    return isUserCodexScope(scopeRoot, options)
+        ? ['user-config']
+        : ['supported-catalogue', 'project-config'];
+}
+/**
+ * Whether a partial sync removes a canonical agent. A removed file can no
+ * longer be parsed for the role name it declared, so such a sync runs the full
+ * stale cleanup against the roles every present canonical agent produces.
+ */
+function removesCanonicalAgent(canonicalEntries, allowedCanonicalPaths) {
+    const presentFiles = new Set(canonicalEntries
+        .filter((entry) => entry.type === 'agent' && entry.isFile)
+        .map((entry) => entry.name));
+    return allowedCanonicalPaths.some((path) => {
+        const match = /^\.agents\/agents\/([^/]+\.md)$/.exec(path);
+        return match?.[1] !== undefined && !presentFiles.has(match[1]);
+    });
+}
+async function collectStaleManagedRoles(scopeRoot, existingConfigContent, desiredRoleNames, cleanupOwners, removeLegacyProjectRoles) {
     const agents = parseConfigAgentTable(existingConfigContent);
-    const stale = new Set();
+    const staleFiles = new Set();
+    const staleTables = new Set();
+    const isStaleManagedRole = (roleName, roleContent) => {
+        if (!roleContent || !isOatManagedCodexRoleFile(roleContent, roleName)) {
+            return false;
+        }
+        const owner = readOatManagedCodexRoleOwner(roleContent);
+        const legacyProjectRole = removeLegacyProjectRoles &&
+            owner === null &&
+            SUPPORTED_CODEX_BASE_ROLES.some((baseRole) => roleName.startsWith(`${baseRole}-`));
+        return ((owner !== null && cleanupOwners.includes(owner)) || legacyProjectRole);
+    };
+    // Stale cleanup deletes files, so a candidate whose real path (through a
+    // symlinked file or `.codex/agents` directory) leaves the scope is skipped.
+    const isWithinScope = (rolePath) => validateRealPathWithinScope(rolePath, scopeRoot).then(() => true, () => false);
     for (const [roleName, roleConfig] of Object.entries(agents)) {
         if (desiredRoleNames.has(roleName)) {
             continue;
@@ -341,18 +386,12 @@ async function collectStaleManagedRoles(scopeRoot, existingConfigContent, desire
             continue;
         }
         const rolePath = join(scopeRoot, '.codex', configFile);
-        const roleContent = await readOptionalFile(rolePath);
-        if (!roleContent || !isOatManagedCodexRoleFile(roleContent, roleName)) {
+        if (!(await isWithinScope(rolePath)) ||
+            !isStaleManagedRole(roleName, await readOptionalFile(rolePath))) {
             continue;
         }
-        const owner = readOatManagedCodexRoleOwner(roleContent);
-        const legacyProjectRole = removeLegacyProjectRoles &&
-            owner === null &&
-            SUPPORTED_CODEX_BASE_ROLES.some((baseRole) => roleName.startsWith(`${baseRole}-`));
-        if (owner !== cleanupOwner && !legacyProjectRole) {
-            continue;
-        }
-        stale.add(roleName);
+        staleTables.add(roleName);
+        staleFiles.add(roleName);
     }
     const agentsDir = join(scopeRoot, '.codex', 'agents');
     let roleFiles;
@@ -367,28 +406,27 @@ async function collectStaleManagedRoles(scopeRoot, existingConfigContent, desire
             continue;
         }
         const roleName = basename(roleFile, '.toml');
-        if (desiredRoleNames.has(roleName) || stale.has(roleName)) {
+        if (desiredRoleNames.has(roleName) || staleFiles.has(roleName)) {
             continue;
         }
         const rolePath = join(agentsDir, roleFile);
-        const roleContent = await readOptionalFile(rolePath);
-        if (!roleContent || !isOatManagedCodexRoleFile(roleContent, roleName)) {
-            continue;
-        }
-        const owner = readOatManagedCodexRoleOwner(roleContent);
-        const legacyProjectRole = removeLegacyProjectRoles &&
-            owner === null &&
-            SUPPORTED_CODEX_BASE_ROLES.some((baseRole) => roleName.startsWith(`${baseRole}-`));
-        if (owner !== cleanupOwner && !legacyProjectRole) {
+        if (!(await isWithinScope(rolePath)) ||
+            !isStaleManagedRole(roleName, await readOptionalFile(rolePath))) {
             continue;
         }
-        stale.add(roleName);
+        // A table of the same name that points elsewhere was re-pointed by the
+        // user; only the leftover file is OAT's to remove.
+        staleFiles.add(roleName);
     }
-    return [...stale].sort((left, right) => left.localeCompare(right));
+    const sorted = (names) => [...names].sort((left, right) => left.localeCompare(right));
+    return { roleFiles: sorted(staleFiles), configTables: sorted(staleTables) };
 }
 export async function computeCodexProjectExtensionPlan(scopeRoot, canonicalEntries, allowedCanonicalPaths, options = {}) {
     const isPartialSync = allowedCanonicalPaths !== undefined && allowedCanonicalPaths.length > 0;
+    const cleansStaleRoles = !isPartialSync ||
+        removesCanonicalAgent(canonicalEntries, allowedCanonicalPaths);
     const materializationTargets = await readCodexMaterializationTargets(scopeRoot, options);
+    const scopeOwner = codexScopeOwner(scopeRoot, options);
     if (!isPartialSync &&
         isUserCodexScope(scopeRoot, options) &&
         materializationTargets.length > 0) {
@@ -400,11 +438,20 @@ export async function computeCodexProjectExtensionPlan(scopeRoot, canonicalEntri
             throw new CliError(`Bundled managed Codex role definitions are unavailable for user sync: ${missingBaseRoles.join(', ')}. Refusing stale user-role cleanup.`);
         }
     }
-    const desiredRoles = await desiredRolesFromCanonical(canonicalEntries.filter((entry) => canonicalPathAllowed(scopeRoot, entry, allowedCanonicalPaths)), scopeRoot, materializationTargets);
+    const desiredRoles = await desiredRolesFromCanonical(canonicalEntries.filter((entry) => canonicalPathAllowed(scopeRoot, entry, allowedCanonicalPaths)), scopeRoot, materializationTargets, scopeOwner);
     const desiredRoleNames = new Set(desiredRoles.map((role) => role.roleName));
     const existingConfigPath = configPath(scopeRoot);
     const existingConfigContent = await readOptionalFile(existingConfigPath);
-    if (isPartialSync && desiredRoles.length === 0) {
+    const producedRoleNames = isPartialSync && cleansStaleRoles
+        ? new Set((await desiredRolesFromCanonical(canonicalEntries, scopeRoot, materializationTargets, scopeOwner)).map((role) => role.roleName))
+        : desiredRoleNames;
+    const staleRoles = cleansStaleRoles
+        ? await collectStaleManagedRoles(scopeRoot, existingConfigContent, producedRoleNames, codexCleanupOwners(scopeRoot, options), !isUserCodexScope(scopeRoot, options))
+        : { roleFiles: [], configTables: [] };
+    if (isPartialSync &&
+        desiredRoles.length === 0 &&
+        staleRoles.roleFiles.length === 0 &&
+        staleRoles.configTables.length === 0) {
         const aggregateConfigHash = hashContent(existingConfigContent ?? '');
         return {
             provider: 'codex',
@@ -420,9 +467,6 @@ export async function computeCodexProjectExtensionPlan(scopeRoot, canonicalEntri
         };
     }
     const inheritedMaxDepth = await readInheritedCodexMaxDepth(scopeRoot, options);
-    const staleRoles = isPartialSync
-        ? []
-        : await collectStaleManagedRoles(scopeRoot, existingConfigContent, desiredRoleNames, isUserCodexScope(scopeRoot, options) ? 'user-config' : 'project-config', !isUserCodexScope(scopeRoot, options));
     const operations = [];
     for (const role of desiredRoles) {
         const existingRoleContent = await readOptionalFile(role.rolePath);
@@ -462,10 +506,12 @@ export async function computeCodexProjectExtensionPlan(scopeRoot, canonicalEntri
             roleName: role.roleName,
         });
     }
-    for (const staleRole of staleRoles) {
+    for (const staleRole of staleRoles.roleFiles) {
         const staleRolePath = join(scopeRoot, '.codex', 'agents', `${staleRole}.toml`);
         const staleRoleContent = await readOptionalFile(staleRolePath);
-        if (staleRoleContent &&
+        const staleRoleWithinScope = await validateRealPathWithinScope(staleRolePath, scopeRoot).then(() => true, () => false);
+        if (staleRoleWithinScope &&
+            staleRoleContent &&
             isOatManagedCodexRoleFile(staleRoleContent, staleRole)) {
             operations.push({
                 provider: 'codex',
@@ -481,7 +527,7 @@ export async function computeCodexProjectExtensionPlan(scopeRoot, canonicalEntri
     const configMerge = mergeCodexConfig({
         existingContent: existingConfigContent,
         desiredRoles: normalizeManagedRolesConfig(desiredRoles),
-        staleManagedRoles: staleRoles,
+        staleManagedRoles: staleRoles.configTables,
         inheritedMaxDepth,
     });
     operations.push({
@@ -493,16 +539,16 @@ export async function computeCodexProjectExtensionPlan(scopeRoot, canonicalEntri
                 : 'skip',
         target: 'config',
         path: '.codex/config.toml',
-        reason: existingConfigContent === null
+        reason: describeConfigOperation(existingConfigContent === null
             ? 'codex config missing'
             : configMerge.changed
                 ? 'codex config differs from desired managed state'
-                : 'codex config already in sync',
+                : 'codex config already in sync', configMerge),
         content: configMerge.mergedContent,
     });
     const managedRoles = [
         ...desiredRoles.map((role) => role.roleName),
-        ...staleRoles,
+        ...staleRoles.roleFiles,
     ];
     const aggregateConfigHash = hashContent(configMerge.mergedContent);
     return {

package/dist/providers/cursor/codec/materialize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"materialize.d.ts","sourceRoot":"","sources":["../../../../src/providers/cursor/codec/materialize.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAKhE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAEvD,OAAO,EAKL,KAAK,eAAe,EACrB,MAAM,UAAU,CAAC;AAQlB,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,eAAe,CAAC;IACvB,OAAO,EAAE,qBAAqB,CAAC;CAChC;AAED,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,sBAAsB,CAAC;IAC9B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,KAAK,EAAE,eAAe,CAAC;CACxB;AAWD,wBAAgB,sBAAsB,CAAC,EACrC,KAAK,EACL,OAAO,EACP,KAAK,GACN,EAAE,6BAA6B,GAAG,uBAAuB,CA8BzD;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE;IAC/C,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACjC,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC1C,KAAK,EAAE,eAAe,CAAC;CACxB,GAAG,uBAAuB,EAAE,CAwB5B;AAqCD,wBAAsB,sCAAsC,CAC1D,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,GACjC,OAAO,CAAC,IAAI,CAAC,CA0Ef"}
+{"version":3,"file":"materialize.d.ts","sourceRoot":"","sources":["../../../../src/providers/cursor/codec/materialize.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAKhE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAEvD,OAAO,EAKL,KAAK,eAAe,EACrB,MAAM,UAAU,CAAC;AAQlB,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,eAAe,CAAC;IACvB,OAAO,EAAE,qBAAqB,CAAC;CAChC;AAED,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,sBAAsB,CAAC;IAC9B,OAAO,EAAE,qBAAqB,CAAC;IAC/B,KAAK,EAAE,eAAe,CAAC;CACxB;AAWD,wBAAgB,sBAAsB,CAAC,EACrC,KAAK,EACL,OAAO,EACP,KAAK,GACN,EAAE,6BAA6B,GAAG,uBAAuB,CA8BzD;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE;IAC/C,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACjC,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC1C,KAAK,EAAE,eAAe,CAAC;CACxB,GAAG,uBAAuB,EAAE,CAwB5B;AAgDD,wBAAsB,sCAAsC,CAC1D,SAAS,EAAE,MAAM,EACjB,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,GACjC,OAAO,CAAC,IAAI,CAAC,CA+Ef"}

package/dist/providers/cursor/codec/materialize.js

@@ -1,4 +1,4 @@
-import { lstat, readFile, readdir } from 'node:fs/promises';
+import { lstat, readFile, readdir, stat } from 'node:fs/promises';
 import { join } from 'node:path';
 import { CliError } from '../../../errors/index.js';
 import { validateRealPathWithinScope } from '../../../fs/paths.js';
@@ -70,6 +70,17 @@ async function readPathStats(path) {
         throw error;
     }
 }
+async function isDanglingLink(path) {
+    try {
+        await stat(path);
+        return false;
+    }
+    catch (error) {
+        // Other failures, such as a link loop, fall through to the scope check
+        // and its controlled refusal.
+        return error.code === 'ENOENT';
+    }
+}
 function readDeclaredCursorAgentName(content) {
     const normalized = content.startsWith('\uFEFF') ? content.slice(1) : content;
     const match = /^---\n([\s\S]*?)\n---(?:\n|$)/.exec(normalized);
@@ -118,6 +129,11 @@ export async function assertNoUnmanagedCursorAgentCollisions(scopeRoot, desiredR
                 continue;
             }
             if (fileStats.isSymbolicLink()) {
+                // A dangling link cannot define a role, and the main sync plan
+                // removes the manifest-tracked view it was created as.
+                if (await isDanglingLink(absolutePath)) {
+                    continue;
+                }
                 try {
                     await validateRealPathWithinScope(absolutePath, scopeRoot);
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-agent-toolkit/cli",
-  "version": "0.3.38",
+  "version": "0.3.39",
   "private": false,
   "description": "Open Agent Toolkit CLI",
   "homepage": "https://github.com/voxmedia/open-agent-toolkit/tree/main/packages/cli",
@@ -41,8 +41,8 @@
     "unified": "11.0.5",
     "yaml": "2.8.2",
     "zod": "^3.25.76",
-    "@open-agent-toolkit/control-plane": "0.3.38",
-    "@open-agent-toolkit/docs-transforms": "0.3.38"
+    "@open-agent-toolkit/control-plane": "0.3.39",
+    "@open-agent-toolkit/docs-transforms": "0.3.39"
   },
   "devDependencies": {
     "@types/node": "^22.10.0",