@skaile/workspaces 6.0.0 → 6.2.0

package/dist/{chunk-VXEYX73S.js → chunk-KB56WBQ3.js}

@@ -1,5 +1,5 @@
-import { getAccessToken, loadStoreAuthConfig, hasStoredAuth } from './chunk-TKHJXPSB.js';
-import { globalSettingsPath, mapLegacyFields } from './chunk-L4YKW5AY.js';
+import { getAccessToken, loadStoreAuthConfig, hasStoredAuth } from './chunk-2XM3ZH36.js';
+import { globalSettingsPath, mapLegacyFields } from './chunk-BRK5QZKI.js';
 import { existsSync, readFileSync } from 'fs';
 
 function getStoreConfig() {
@@ -60,5 +60,5 @@ function isStoreAuthenticated() {
 }
 
 export { getStoreConfig, getStoreToken, isStoreAuthenticated, storeFetch };
-//# sourceMappingURL=chunk-VXEYX73S.js.map
-//# sourceMappingURL=chunk-VXEYX73S.js.map
+//# sourceMappingURL=chunk-KB56WBQ3.js.map
+//# sourceMappingURL=chunk-KB56WBQ3.js.map

package/dist/{chunk-VXEYX73S.js.map → chunk-KB56WBQ3.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../cli/src/store-client.ts"],"names":[],"mappings":";;;;AAuBO,SAAS,cAAA,GAA8B;AAC5C,EAAA,MAAM,eAAe,kBAAA,EAAmB;AACxC,EAAA,IAAI,WAAgC,EAAC;AACrC,EAAA,IAAI,UAAA,CAAW,YAAY,CAAA,EAAG;AAC5B,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,gBAAgB,IAAA,CAAK,KAAA,CAAM,aAAa,YAAA,EAAc,OAAO,CAAC,CAAC,CAAA;AAAA,IAC5E,CAAA,CAAA,MAAQ;AACN,MAAA,QAAA,GAAW,EAAC;AAAA,IACd;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,QAAA,CAAS,QAAA,IAAY,OAAA,CAAQ,IAAI,gBAAA,IAAoB,0BAAA;AAAA,IAC1D,GAAA,EAAK;AAAA,GACP;AACF;AAOO,SAAS,cAAc,IAAA,EAAkC;AAC9D,EAAA,OAAO,cAAA,CAAe,mBAAA,EAAoB,EAAG,IAAI,CAAA;AACnD;AAaA,eAAsB,UAAA,CACpB,MAAA,EACA,IAAA,EACA,IAAA,EAOY;AACZ,EAAA,IAAI,GAAA,GAAM,CAAA,EAAG,MAAA,CAAO,GAAG,GAAG,IAAI,CAAA,CAAA;AAC9B,EAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,IAAA,MAAM,EAAA,GAAK,IAAI,eAAA,CAAgB,IAAA,CAAK,MAAM,CAAA;AAC1C,IAAA,GAAA,IAAO,IAAI,EAAE,CAAA,CAAA;AAAA,EACf;AAEA,EAAA,MAAM,OAAA,GAAkC;AAAA,IACtC,cAAA,EAAgB,kBAAA;AAAA,IAChB,MAAA,EAAQ,kBAAA;AAAA,IACR,GAAI,IAAA,EAAM,OAAA,IAAW;AAAC,GACxB;AACA,EAAA,IAAI,OAAO,GAAA,EAAK;AACd,IAAA,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,MAAA,CAAO,GAAG,CAAA,CAAA;AAAA,EAC9C;AAEA,EAAA,MAAM,SAAA,GAAyB;AAAA,IAC7B,MAAA,EAAQ,MAAM,MAAA,IAAU,KAAA;AAAA,IACxB;AAAA,GACF;AACA,EAAA,IAAI,MAAM,IAAA,EAAM;AACd,IAAA,SAAA,CAAU,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA;AAAA,EAC3C;AAEA,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,OAAA,GAAU,WAAW,MAAM,UAAA,CAAW,OAAM,EAAG,IAAA,EAAM,aAAa,IAAK,CAAA;AAC7E,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,SAAA,EAAW,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AACxE,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK,CAAE,KAAA,CAAM,OAAO,EAAE,KAAA,EAAO,CAAA,KAAA,EAAQ,GAAA,CAAI,MAAM,IAAG,CAAE,CAAA;AAI3E,MAAA,MAAM,CAAA,GAAI,IAAA;AACV,MAAA,MAAM,IAAI,MAAM,CAAA,CAAE,OAAA,IAAW,EAAE,KAAA,IAAS,CAAA,iBAAA,EAAoB,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,IAC1E;AACA,IAAA,OAAO,IAAI,IAAA,EAAK;AAAA,EAClB,CAAA,SAAE;AACA,IAAA,YAAA,CAAa,OAAO,CAAA;AAAA,EACtB;AACF;AASO,SAAS,oBAAA,GAAgC;AAC9C,EAAA,OAAO,aAAA,CAAc,qBAAqB,CAAA;AAC5C","file":"chunk-VXEYX73S.js","sourcesContent":["import { existsSync, readFileSync } from \"node:fs\";\nimport { globalSettingsPath, mapLegacyFields } from \"@skaile/workspaces/core\";\nimport { type AuthDeps, getAccessToken, hasStoredAuth, loadStoreAuthConfig } from \"./store-auth.ts\";\n\n/**\n * Connection configuration for the AI Asset Store API. `jwt` is normally left\n * null here and filled per-call by the caller from {@link getStoreToken} (the\n * device-flow session); it stays on the type for the `{ ...config, jwt }` spread.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport interface StoreConfig {\n  url: string;\n  jwt: string | null;\n}\n\n/**\n * Read the store API base URL (settings `storeUrl` → `SKAILE_STORE_URL` →\n * default). Auth is not read here — it lives in the device-flow session; see\n * {@link getStoreToken}.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport function getStoreConfig(): StoreConfig {\n  const settingsPath = globalSettingsPath();\n  let settings: Record<string, any> = {};\n  if (existsSync(settingsPath)) {\n    try {\n      settings = mapLegacyFields(JSON.parse(readFileSync(settingsPath, \"utf-8\")));\n    } catch {\n      settings = {};\n    }\n  }\n  return {\n    url: settings.storeUrl ?? process.env.SKAILE_STORE_URL ?? \"https://api.skaile.store\",\n    jwt: null,\n  };\n}\n\n/**\n * Return a valid store access token (Keycloak device-flow session, refreshed if\n * needed). Throws a \"run `skaile store login`\" error when there is no session.\n * This is the auth source for every `/api/v1/*` publisher call.\n */\nexport function getStoreToken(deps?: AuthDeps): Promise<string> {\n  return getAccessToken(loadStoreAuthConfig(), deps);\n}\n\n/**\n * Make an authenticated HTTP request to the store REST API.\n *\n * @param config - Store connection config (URL + auth token).\n * @param path - API path (e.g. `/api/assets`).\n * @param opts - Optional method, body, query params, extra headers, and\n *   `timeoutMs` (default 1500). Publisher calls pass a longer timeout because\n *   they trigger server-side clone/sync work.\n * @returns Parsed JSON response body.\n * @docLink cli/dev-guide#store-client\n */\nexport async function storeFetch<T = any>(\n  config: StoreConfig,\n  path: string,\n  opts?: {\n    method?: string;\n    body?: unknown;\n    params?: Record<string, string>;\n    headers?: Record<string, string>;\n    timeoutMs?: number;\n  },\n): Promise<T> {\n  let url = `${config.url}${path}`;\n  if (opts?.params) {\n    const sp = new URLSearchParams(opts.params);\n    url += `?${sp}`;\n  }\n\n  const headers: Record<string, string> = {\n    \"Content-Type\": \"application/json\",\n    Accept: \"application/json\",\n    ...(opts?.headers ?? {}),\n  };\n  if (config.jwt) {\n    headers.Authorization = `Bearer ${config.jwt}`;\n  }\n\n  const fetchOpts: RequestInit = {\n    method: opts?.method ?? \"GET\",\n    headers,\n  };\n  if (opts?.body) {\n    fetchOpts.body = JSON.stringify(opts.body);\n  }\n\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), opts?.timeoutMs ?? 1_500);\n  try {\n    const res = await fetch(url, { ...fetchOpts, signal: controller.signal });\n    if (!res.ok) {\n      const body = await res.json().catch(() => ({ error: `HTTP ${res.status}` }));\n      // Prefer the store's human-readable `message` (e.g. \"Namespace '@x' is\n      // reserved … Sign in with GitHub to claim it\") over the bare `error` code\n      // (`UNPROCESSABLE_CONTENT`) — the message is the actionable part.\n      const b = body as { message?: string; error?: string };\n      throw new Error(b.message ?? b.error ?? `Store API error: ${res.status}`);\n    }\n    return res.json() as Promise<T>;\n  } finally {\n    clearTimeout(timeout);\n  }\n}\n\n/**\n * Return `true` when a store session exists (a Keycloak device-flow token cached\n * at `~/.skaile/auth.json`). Validity/refresh is resolved on use via\n * {@link getStoreToken}.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport function isStoreAuthenticated(): boolean {\n  return hasStoredAuth(loadStoreAuthConfig());\n}\n"]}
+{"version":3,"sources":["../cli/src/store-client.ts"],"names":[],"mappings":";;;;AAuBO,SAAS,cAAA,GAA8B;AAC5C,EAAA,MAAM,eAAe,kBAAA,EAAmB;AACxC,EAAA,IAAI,WAAgC,EAAC;AACrC,EAAA,IAAI,UAAA,CAAW,YAAY,CAAA,EAAG;AAC5B,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,gBAAgB,IAAA,CAAK,KAAA,CAAM,aAAa,YAAA,EAAc,OAAO,CAAC,CAAC,CAAA;AAAA,IAC5E,CAAA,CAAA,MAAQ;AACN,MAAA,QAAA,GAAW,EAAC;AAAA,IACd;AAAA,EACF;AACA,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,QAAA,CAAS,QAAA,IAAY,OAAA,CAAQ,IAAI,gBAAA,IAAoB,0BAAA;AAAA,IAC1D,GAAA,EAAK;AAAA,GACP;AACF;AAOO,SAAS,cAAc,IAAA,EAAkC;AAC9D,EAAA,OAAO,cAAA,CAAe,mBAAA,EAAoB,EAAG,IAAI,CAAA;AACnD;AAaA,eAAsB,UAAA,CACpB,MAAA,EACA,IAAA,EACA,IAAA,EAOY;AACZ,EAAA,IAAI,GAAA,GAAM,CAAA,EAAG,MAAA,CAAO,GAAG,GAAG,IAAI,CAAA,CAAA;AAC9B,EAAA,IAAI,MAAM,MAAA,EAAQ;AAChB,IAAA,MAAM,EAAA,GAAK,IAAI,eAAA,CAAgB,IAAA,CAAK,MAAM,CAAA;AAC1C,IAAA,GAAA,IAAO,IAAI,EAAE,CAAA,CAAA;AAAA,EACf;AAEA,EAAA,MAAM,OAAA,GAAkC;AAAA,IACtC,cAAA,EAAgB,kBAAA;AAAA,IAChB,MAAA,EAAQ,kBAAA;AAAA,IACR,GAAI,IAAA,EAAM,OAAA,IAAW;AAAC,GACxB;AACA,EAAA,IAAI,OAAO,GAAA,EAAK;AACd,IAAA,OAAA,CAAQ,aAAA,GAAgB,CAAA,OAAA,EAAU,MAAA,CAAO,GAAG,CAAA,CAAA;AAAA,EAC9C;AAEA,EAAA,MAAM,SAAA,GAAyB;AAAA,IAC7B,MAAA,EAAQ,MAAM,MAAA,IAAU,KAAA;AAAA,IACxB;AAAA,GACF;AACA,EAAA,IAAI,MAAM,IAAA,EAAM;AACd,IAAA,SAAA,CAAU,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA;AAAA,EAC3C;AAEA,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,MAAM,OAAA,GAAU,WAAW,MAAM,UAAA,CAAW,OAAM,EAAG,IAAA,EAAM,aAAa,IAAK,CAAA;AAC7E,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,SAAA,EAAW,MAAA,EAAQ,UAAA,CAAW,MAAA,EAAQ,CAAA;AACxE,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK,CAAE,KAAA,CAAM,OAAO,EAAE,KAAA,EAAO,CAAA,KAAA,EAAQ,GAAA,CAAI,MAAM,IAAG,CAAE,CAAA;AAI3E,MAAA,MAAM,CAAA,GAAI,IAAA;AACV,MAAA,MAAM,IAAI,MAAM,CAAA,CAAE,OAAA,IAAW,EAAE,KAAA,IAAS,CAAA,iBAAA,EAAoB,GAAA,CAAI,MAAM,CAAA,CAAE,CAAA;AAAA,IAC1E;AACA,IAAA,OAAO,IAAI,IAAA,EAAK;AAAA,EAClB,CAAA,SAAE;AACA,IAAA,YAAA,CAAa,OAAO,CAAA;AAAA,EACtB;AACF;AASO,SAAS,oBAAA,GAAgC;AAC9C,EAAA,OAAO,aAAA,CAAc,qBAAqB,CAAA;AAC5C","file":"chunk-KB56WBQ3.js","sourcesContent":["import { existsSync, readFileSync } from \"node:fs\";\nimport { globalSettingsPath, mapLegacyFields } from \"@skaile/workspaces/core\";\nimport { type AuthDeps, getAccessToken, hasStoredAuth, loadStoreAuthConfig } from \"./store-auth.ts\";\n\n/**\n * Connection configuration for the AI Asset Store API. `jwt` is normally left\n * null here and filled per-call by the caller from {@link getStoreToken} (the\n * device-flow session); it stays on the type for the `{ ...config, jwt }` spread.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport interface StoreConfig {\n  url: string;\n  jwt: string | null;\n}\n\n/**\n * Read the store API base URL (settings `storeUrl` → `SKAILE_STORE_URL` →\n * default). Auth is not read here — it lives in the device-flow session; see\n * {@link getStoreToken}.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport function getStoreConfig(): StoreConfig {\n  const settingsPath = globalSettingsPath();\n  let settings: Record<string, any> = {};\n  if (existsSync(settingsPath)) {\n    try {\n      settings = mapLegacyFields(JSON.parse(readFileSync(settingsPath, \"utf-8\")));\n    } catch {\n      settings = {};\n    }\n  }\n  return {\n    url: settings.storeUrl ?? process.env.SKAILE_STORE_URL ?? \"https://api.skaile.store\",\n    jwt: null,\n  };\n}\n\n/**\n * Return a valid store access token (Keycloak device-flow session, refreshed if\n * needed). Throws a \"run `skaile store login`\" error when there is no session.\n * This is the auth source for every `/api/v1/*` publisher call.\n */\nexport function getStoreToken(deps?: AuthDeps): Promise<string> {\n  return getAccessToken(loadStoreAuthConfig(), deps);\n}\n\n/**\n * Make an authenticated HTTP request to the store REST API.\n *\n * @param config - Store connection config (URL + auth token).\n * @param path - API path (e.g. `/api/assets`).\n * @param opts - Optional method, body, query params, extra headers, and\n *   `timeoutMs` (default 1500). Publisher calls pass a longer timeout because\n *   they trigger server-side clone/sync work.\n * @returns Parsed JSON response body.\n * @docLink cli/dev-guide#store-client\n */\nexport async function storeFetch<T = any>(\n  config: StoreConfig,\n  path: string,\n  opts?: {\n    method?: string;\n    body?: unknown;\n    params?: Record<string, string>;\n    headers?: Record<string, string>;\n    timeoutMs?: number;\n  },\n): Promise<T> {\n  let url = `${config.url}${path}`;\n  if (opts?.params) {\n    const sp = new URLSearchParams(opts.params);\n    url += `?${sp}`;\n  }\n\n  const headers: Record<string, string> = {\n    \"Content-Type\": \"application/json\",\n    Accept: \"application/json\",\n    ...(opts?.headers ?? {}),\n  };\n  if (config.jwt) {\n    headers.Authorization = `Bearer ${config.jwt}`;\n  }\n\n  const fetchOpts: RequestInit = {\n    method: opts?.method ?? \"GET\",\n    headers,\n  };\n  if (opts?.body) {\n    fetchOpts.body = JSON.stringify(opts.body);\n  }\n\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), opts?.timeoutMs ?? 1_500);\n  try {\n    const res = await fetch(url, { ...fetchOpts, signal: controller.signal });\n    if (!res.ok) {\n      const body = await res.json().catch(() => ({ error: `HTTP ${res.status}` }));\n      // Prefer the store's human-readable `message` (e.g. \"Namespace '@x' is\n      // reserved … Sign in with GitHub to claim it\") over the bare `error` code\n      // (`UNPROCESSABLE_CONTENT`) — the message is the actionable part.\n      const b = body as { message?: string; error?: string };\n      throw new Error(b.message ?? b.error ?? `Store API error: ${res.status}`);\n    }\n    return res.json() as Promise<T>;\n  } finally {\n    clearTimeout(timeout);\n  }\n}\n\n/**\n * Return `true` when a store session exists (a Keycloak device-flow token cached\n * at `~/.skaile/auth.json`). Validity/refresh is resolved on use via\n * {@link getStoreToken}.\n *\n * @docLink cli/dev-guide#store-client\n */\nexport function isStoreAuthenticated(): boolean {\n  return hasStoredAuth(loadStoreAuthConfig());\n}\n"]}

package/dist/{chunk-OHNKYHRR.js → chunk-KJSC2ZD6.js}

@@ -1,9 +1,9 @@
 import { globalCacheRoot, globalSkaileDir, mergeLegacyEntriesInto, mergeLegacyEntriesKeyed } from './chunk-L5VSIPQD.js';
 import { SUPPORTED_HARNESSES, globalHarnessRoot } from './chunk-VTETQCR6.js';
-import { decodeSkaileManifest, compositeSha256, listAssetFiles, SKAILE_MANIFEST_FILENAME, sha256Hex } from './chunk-UQ33Y4DM.js';
+import { decodeSkaileManifest, compositeSha256, listAssetFiles, SKAILE_MANIFEST_FILENAME, sha256Hex } from './chunk-KPKGWXUJ.js';
 import { readPluginGroupings } from './chunk-RVRB27AN.js';
-import { scanDirectory, parseFrontmatter, parseRequires, dedupeRequirementRefs, fromMcpServerMdContent, withFsDeadline, tryWithFsDeadline, fsDeadlineMs, assetDepRefs, agentYamlRequires } from './chunk-GOCWM7FN.js';
-import { isValidAssetName, slugifyAssetName, depToStr, parseAssetRef, assetRefToStr } from './chunk-WDXZA7QW.js';
+import { scanDirectory, parseFrontmatter, parseRequires, dedupeRequirementRefs, fromMcpServerMdContent, withFsDeadline, tryWithFsDeadline, fsDeadlineMs, assetDepRefs, agentYamlRequires, yamlQuotingHint } from './chunk-JMIKGAUA.js';
+import { isValidAssetName, slugifyAssetName, depToStr, parseAssetRef, assetRefToStr } from './chunk-IZQOO6MN.js';
 import { isRetentionValue } from './chunk-C3CAXQMA.js';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, lstatSync, symlinkSync, rmSync, readdirSync, realpathSync, constants, statSync } from 'fs';
 import { readdir, stat, cp, rm, open, readFile } from 'fs/promises';
@@ -35,6 +35,29 @@ var INSTANCE_KEYS = {
   connectors: true,
   budget: true
 };
+var NESTED_KEYS = {
+  model: ["preferred", "fallback"],
+  memory: ["scope"],
+  budget: ["max_turns", "max_tokens"],
+  permissions: ["max_turns", "permission_mode", "deny_write", "deny_read", "network"],
+  "permissions.network": ["mode", "allowlist"]
+};
+function unknownNestedKeys(block, raw, at, subject, code) {
+  const known = NESTED_KEYS[block];
+  if (!known || !isRecord(raw)) return [];
+  const out = Object.keys(raw).filter((key) => !known.includes(key)).map((key) => ({
+    code,
+    severity: "warning",
+    message: `Unknown key "${key}" under \`${at}\` is ignored${subject} \u2014 expected one of: ${known.join(", ")}.`,
+    path: `${at}.${key}`
+  }));
+  if (block === "permissions") {
+    out.push(
+      ...unknownNestedKeys("permissions.network", raw.network, `${at}.network`, subject, code)
+    );
+  }
+  return out;
+}
 function normalizeAgentInstances(raw, diagnostics) {
   if (raw === void 0 || raw === null) return void 0;
   if (!isRecord(raw)) {
@@ -83,6 +106,17 @@ function normalizeInstance(id, raw, ref, diagnostics) {
       path: `${path}.${key}`
     });
   }
+  for (const block of ["model", "permissions", "memory", "budget"]) {
+    diagnostics.push(
+      ...unknownNestedKeys(
+        block,
+        raw[block],
+        `${path}.${block}`,
+        ` on agent instance "${id}"`,
+        "unknown_agent_instance_key"
+      )
+    );
+  }
   if (raw.lifecycle !== void 0) {
     if (AGENT_INSTANCE_LIFECYCLES.includes(raw.lifecycle)) {
       instance.lifecycle = raw.lifecycle;
@@ -269,12 +303,159 @@ var AGENT_BLOCK_KEYS = /* @__PURE__ */ new Set([
 ]);
 function agentBlockKeyDiagnostics(agent) {
   if (!isRecord(agent)) return [];
-  return Object.keys(agent).filter((key) => !AGENT_BLOCK_KEYS.has(key)).map((key) => ({
-    code: "unknown_agent_key",
-    severity: "warning",
-    message: `Unknown key "${key}" under \`agent:\` is ignored \u2014 expected one of: ${[...AGENT_BLOCK_KEYS].filter((k) => k !== "subagents").join(", ")}. Per-instance overrides (lifecycle, model, memory, triggers, connectors, budget) belong under \`agents.<id>\`.`,
-    path: `agent.${key}`
-  }));
+  const nested = unknownNestedKeys(
+    "permissions",
+    agent.permissions,
+    "agent.permissions",
+    "",
+    "unknown_agent_key"
+  );
+  return [
+    ...nested,
+    ...Object.keys(agent).filter((key) => !AGENT_BLOCK_KEYS.has(key)).map((key) => ({
+      code: "unknown_agent_key",
+      severity: "warning",
+      message: `Unknown key "${key}" under \`agent:\` is ignored \u2014 expected one of: ${[...AGENT_BLOCK_KEYS].filter((k) => k !== "subagents").join(", ")}. Per-instance overrides (lifecycle, model, memory, triggers, connectors, budget) belong under \`agents.<id>\`.`,
+      path: `agent.${key}`
+    }))
+  ];
+}
+
+// core/src/config-key-diagnostics.ts
+var TOP_LEVEL_KEYS = [
+  "name",
+  "description",
+  "agent-config",
+  "agent_config",
+  "agentConfig",
+  "roles",
+  "startup",
+  "dependencies",
+  "global_harnesses",
+  "global-harnesses",
+  "global_backends",
+  "global-backends",
+  "plugins",
+  "sources",
+  "stores",
+  "overrides",
+  "connectors",
+  "mcp_servers",
+  "deploy",
+  "mounts",
+  "agent",
+  "agents",
+  "workspace",
+  "secrets",
+  "telemetry",
+  "compaction",
+  "model_endpoint",
+  "patches",
+  "logging",
+  // Rejected with their own message before this check runs; listed so it never says more.
+  "repositories",
+  "ai_resources",
+  "aiResources",
+  "providers",
+  "base_url",
+  "credential",
+  "headers",
+  "query_params",
+  "transport",
+  "publisher",
+  "version",
+  "assets"
+];
+var PROFILE_KEYS = [
+  "agent",
+  "harness",
+  "driver",
+  "model",
+  "thinking",
+  "effort",
+  "max_turns",
+  "skills_dir",
+  "agents_dir",
+  "prompts_dir",
+  // Rejected with their own message (`skaile migrate providers`).
+  "provider",
+  "cloud",
+  "cloud_config",
+  "providers",
+  "base_url",
+  "credential",
+  "headers",
+  "query_params",
+  "transport"
+];
+var SUGGESTED_PROFILE_KEYS = PROFILE_KEYS.filter((k) => k !== "driver");
+var SUGGESTED_TOP_LEVEL_KEYS = TOP_LEVEL_KEYS.filter(
+  (k) => !["agent_config", "agentConfig", "global-harnesses", "global_backends"].includes(k)
+);
+function editDistance(a, b) {
+  let prev = Array.from({ length: b.length + 1 }, (_, i) => i);
+  for (let i = 1; i <= a.length; i++) {
+    const cur = [i];
+    for (let j = 1; j <= b.length; j++) {
+      cur[j] = Math.min(
+        (prev[j] ?? 0) + 1,
+        (cur[j - 1] ?? 0) + 1,
+        (prev[j - 1] ?? 0) + (a[i - 1] === b[j - 1] ? 0 : 1)
+      );
+    }
+    prev = cur;
+  }
+  return prev[b.length] ?? 0;
+}
+function nearestKey(typed, known) {
+  const t = typed.toLowerCase().replace(/_/g, "-");
+  let best;
+  for (const key of known) {
+    const k = key.toLowerCase().replace(/_/g, "-");
+    const d = editDistance(t, k);
+    if (!best || d < best.d) best = { key, d };
+  }
+  const limit = Math.max(2, Math.floor(t.length / 3));
+  if (!best || best.d > limit) return void 0;
+  return best.key === "driver" ? "harness" : best.key;
+}
+function agentConfigBlock(raw) {
+  for (const key of ["agent-config", "agent_config", "agentConfig"]) {
+    if (raw[key] !== void 0) return { key, block: raw[key] };
+  }
+  return void 0;
+}
+function unknownConfigKeyDiagnostics(raw) {
+  const out = [];
+  for (const key of Object.keys(raw)) {
+    if (TOP_LEVEL_KEYS.includes(key)) continue;
+    const near = nearestKey(key, SUGGESTED_TOP_LEVEL_KEYS);
+    out.push({
+      code: "unknown_config_key",
+      severity: "warning",
+      message: `Unknown key "${key}" is ignored${near ? `. Did you mean "${near}"?` : `. Known keys: ${SUGGESTED_TOP_LEVEL_KEYS.join(", ")}.`}`,
+      path: key
+    });
+  }
+  const found = agentConfigBlock(raw);
+  if (found && isRecord(found.block)) {
+    const block = found.block;
+    const flat = PROFILE_KEYS.some((k) => typeof block[k] === "string");
+    const profiles = flat ? [["default", block, found.key]] : Object.entries(block).filter((e) => isRecord(e[1])).map(([name, p]) => [name, p, `${found.key}.${name}`]);
+    for (const [, profile, where] of profiles) {
+      for (const key of Object.keys(profile)) {
+        if (PROFILE_KEYS.includes(key)) continue;
+        const near = nearestKey(key, SUGGESTED_PROFILE_KEYS);
+        out.push({
+          code: "unknown_profile_key",
+          severity: "warning",
+          message: `Unknown key "${key}" under \`${where}\` is ignored${near ? `. Did you mean "${near}"?` : `. Known keys: ${SUGGESTED_PROFILE_KEYS.slice(0, 7).join(", ")}.`}`,
+          path: `${where}.${key}`
+        });
+      }
+    }
+  }
+  return out;
 }
 function fileSha256(p) {
   return sha256Hex(readFileSync(p));
@@ -1514,7 +1695,8 @@ function listConfigFiles(dir, strict, absolute = false) {
 }
 function configParseError(label, d) {
   const reason = (d.message.replace(/^Invalid YAML: /, "").split("\n")[0] ?? "").replace(/:$/, "");
-  return new Error(`${label} \u2014 parse error: ${reason}`);
+  const hint = yamlQuotingHint(reason);
+  return new Error(`${label} \u2014 parse error: ${reason}${hint ? `.${hint}` : ""}`);
 }
 function rejectedKeyError(d) {
   return d.code === "invalid_source_entry" ? new SourceEntryError(d.message) : new LegacyKeyError(d.message);
@@ -2027,6 +2209,7 @@ function normalizeConfigInternal(raw) {
   assertNoLegacyTopLevelKeys(raw);
   if (raw.name) config.name = String(raw.name);
   if (raw.description) config.description = String(raw.description);
+  diagnostics.push(...unknownConfigKeyDiagnostics(raw));
   normalizeAgentConfigSection(raw, config, diagnostics);
   normalizeRolesSection(raw, config, diagnostics);
   if (Array.isArray(raw.startup)) {
@@ -2037,6 +2220,39 @@ function normalizeConfigInternal(raw) {
   normalizeDependencySection(raw, config);
   return { config, diagnostics };
 }
+function describeYamlValue(value) {
+  if (value === null) return "an empty value";
+  if (Array.isArray(value)) return "a list";
+  if (typeof value === "object") return "a map";
+  if (typeof value === "string") return "a string";
+  return `a ${typeof value}`;
+}
+function valueShapeError(raw) {
+  const deps = raw.dependencies;
+  if (deps !== void 0 && deps !== null) {
+    if (!Array.isArray(deps)) {
+      return {
+        message: `dependencies must be a list of asset refs, found ${describeYamlValue(deps)}`,
+        path: "dependencies"
+      };
+    }
+    const at = deps.findIndex((d) => typeof d !== "string");
+    if (at >= 0) {
+      return {
+        message: `dependencies[${at}] must be an asset ref string (kind:@publisher/name), found ${describeYamlValue(deps[at])}`,
+        path: `dependencies[${at}]`
+      };
+    }
+  }
+  const sources = raw.sources;
+  if (sources !== void 0 && sources !== null && !Array.isArray(sources)) {
+    return {
+      message: `sources must be a list, found ${describeYamlValue(sources)}`,
+      path: "sources"
+    };
+  }
+  return void 0;
+}
 function decodeSkaileYaml(text) {
   let parsed;
   try {
@@ -2065,6 +2281,20 @@ function decodeSkaileYaml(text) {
       ]
     };
   }
+  const wrongShape = valueShapeError(parsed);
+  if (wrongShape) {
+    return {
+      config: {},
+      diagnostics: [
+        {
+          code: "invalid_value_shape",
+          severity: "error",
+          message: wrongShape.message,
+          path: wrongShape.path
+        }
+      ]
+    };
+  }
   let result;
   try {
     result = normalizeConfigInternal(parsed);
@@ -2269,7 +2499,7 @@ function parseConfigFile(filePath, name, strictLabel) {
   }
   const { config, diagnostics } = decodeSkaileYaml(raw);
   const unparseable = diagnostics.find(
-    (d) => d.code === "yaml_syntax" || d.code === "non_object_root"
+    (d) => d.code === "yaml_syntax" || d.code === "non_object_root" || d.code === "invalid_value_shape"
   );
   if (unparseable && strictLabel !== void 0) throw configParseError(strictLabel, unparseable);
   if (diagnostics.some((d) => d.code === "yaml_syntax")) return null;
@@ -2437,6 +2667,16 @@ function foldInstanceEnv(decl, instancePath, name) {
     );
   }
 }
+function mcpDeclarationFromMdContent(mdContent, name) {
+  const { body } = parseFrontmatter(mdContent);
+  const entry = fromMcpServerMdContent(mdContent, name, `${name}/MCP.md`);
+  const decl = mcpDeclFromCatalogEntry(entry);
+  if (!decl) return null;
+  decl.id = entry.name || name;
+  const trimmedBody = body.trim();
+  if (trimmedBody.length > 0) decl.instructions = trimmedBody;
+  return decl;
+}
 function deriveSingleMaterializedMcpDeclaration(subDir, name) {
   const mdPath = join(subDir, "MCP.md");
   if (!existsSync(mdPath)) return null;
@@ -2749,11 +2989,13 @@ function collectMcpRefStrings(dependencies) {
   return mcpRefStrings;
 }
 var MCP_LOOKUP_KINDS = /* @__PURE__ */ new Set(["mcp-server"]);
-async function buildMcpProvenanceIndex(sources, projectDir) {
-  return sources.length > 0 ? await buildProvenanceIndex(buildSourceClones(sources), {
+async function buildMcpProvenanceIndex(sources, projectDir, mcpRefStrings) {
+  return sources.length > 0 && mcpRefStrings.length > 0 ? await buildProvenanceIndex(buildSourceClones(sources), {
     projectDir,
     // Only `mcp-server` refs are looked up in this index.
-    knownKinds: MCP_LOOKUP_KINDS
+    knownKinds: MCP_LOOKUP_KINDS,
+    onSourceError: () => {
+    }
   }) : /* @__PURE__ */ new Map();
 }
 function upsertCatalogMcpDecls(mcpRefStrings, provenanceIndex, upsert) {
@@ -2788,7 +3030,11 @@ async function loadMcpServerDeclarations(projectDir, opts) {
     ...config.dependencies ?? [],
     ...opts?.alsoDeclared ?? []
   ]);
-  const provenanceIndex = await buildMcpProvenanceIndex(config.sources ?? [], projectDir);
+  const provenanceIndex = await buildMcpProvenanceIndex(
+    config.sources ?? [],
+    projectDir,
+    mcpRefStrings
+  );
   const byId = /* @__PURE__ */ new Map();
   const order = [];
   const upsert = (decl) => {
@@ -2953,6 +3199,6 @@ function resolveAgentDefinitionDir(projectDir, definition) {
   return resolve(projectDir, definition);
 }
 
-export { AGENT_INSTANCE_ID_PATTERN, AGENT_INSTANCE_LIFECYCLES, AGENT_INSTANCE_MEMORY_SCOPES, AGENT_INSTANCE_TRIGGER_KINDS, AGENT_PROFILE_FIELDS, AgentRefResolutionError, COMPACTION_DEFAULTS, CanonicalRefConflictError, DEFAULT_AGENT_INSTANCE_ID, DEFAULT_RECIPE_ATTR, LegacyKeyError, MAX_PRESET_DEPTH, PresetDepthError, SKAILE_YAML_DEFAULT, SKAILE_YAML_SUFFIX, SKILL_ALLOWLIST_FILE, SKILL_ALLOWLIST_VERSION, SK_WORKSPACE_DEFAULT_NAME, SK_WORKSPACE_SUFFIX, STAGED_SKILL_MARKER, SourceEntryError, UnknownAssetKindError, agentBlockKeyDiagnostics, agentInstanceDiagnostics, agentSourceCacheDir, attachToBranch, buildProvenanceIndex, checkRepoStatus, checkoutPin, cloneRepo, coerceVersion, decodeSkaileYaml, deriveSingleMaterializedMcpDeclaration, effectiveAgentInstances, encodeSkaileYaml, ensureRepo, findWorkspaceRoot, getGlobalCacheDir, getRepoCommit, isCommitOnRemote, isInsideProject, isStagedSkillMarkerFor, isWorkspaceConfigFilename, legacySourceCacheKey, linkRepo, listSkWorkspaceConfigs, loadMcpServerDeclarations, loadSkWorkspaceConfig, localConnectorMountDir, matchPin, mergeAgentInstances, mergeAgentPermissions, mergeSkWorkspaceConfigs, normalizeAgentInstances, normalizeConfig, parseSourceEntries, priorSourceCacheKeys, priorStoreManifestSlugs, pullRepo, pullRepoResult, readLinks, readSkillAllowList, resolveAgentDefinitionDir, resolveAgentDir, resolveAll, resolveAsset, resolveCompactionThresholdPercent, resolveGlobalHarnesses, resolveGlobalSkWorkspaceConfig, resolveSkWorkspaceConfig, resolveSourcePublisher, saveSkWorkspaceConfig, scanRepo, slashGitSourceCacheKey, sourceCacheKey, sourceShortName, stageMaterializedSkills, stagedSkillMarkerState, storeManifestSlug, symlinkEscapeOfProject, unlinkRepo, unstageSkill, validateAssetRecipeAttr, validateAssetRecipeFlake, workspaceConfigFilename, workspaceNameFromFilename, writeLinks };
-//# sourceMappingURL=chunk-OHNKYHRR.js.map
-//# sourceMappingURL=chunk-OHNKYHRR.js.map
+export { AGENT_INSTANCE_ID_PATTERN, AGENT_INSTANCE_LIFECYCLES, AGENT_INSTANCE_MEMORY_SCOPES, AGENT_INSTANCE_TRIGGER_KINDS, AGENT_PROFILE_FIELDS, AgentRefResolutionError, COMPACTION_DEFAULTS, CanonicalRefConflictError, DEFAULT_AGENT_INSTANCE_ID, DEFAULT_RECIPE_ATTR, LegacyKeyError, MAX_PRESET_DEPTH, PresetDepthError, SKAILE_YAML_DEFAULT, SKAILE_YAML_SUFFIX, SKILL_ALLOWLIST_FILE, SKILL_ALLOWLIST_VERSION, SK_WORKSPACE_DEFAULT_NAME, SK_WORKSPACE_SUFFIX, STAGED_SKILL_MARKER, SourceEntryError, UnknownAssetKindError, agentBlockKeyDiagnostics, agentInstanceDiagnostics, agentSourceCacheDir, attachToBranch, buildProvenanceIndex, checkRepoStatus, checkoutPin, cloneRepo, coerceVersion, decodeSkaileYaml, deriveSingleMaterializedMcpDeclaration, effectiveAgentInstances, encodeSkaileYaml, ensureRepo, findWorkspaceRoot, getGlobalCacheDir, getRepoCommit, isCommitOnRemote, isInsideProject, isStagedSkillMarkerFor, isWorkspaceConfigFilename, legacySourceCacheKey, linkRepo, listSkWorkspaceConfigs, loadMcpServerDeclarations, loadSkWorkspaceConfig, localConnectorMountDir, matchPin, mcpDeclarationFromMdContent, mergeAgentInstances, mergeAgentPermissions, mergeSkWorkspaceConfigs, normalizeAgentInstances, normalizeConfig, parseSourceEntries, priorSourceCacheKeys, priorStoreManifestSlugs, pullRepo, pullRepoResult, readLinks, readSkillAllowList, resolveAgentDefinitionDir, resolveAgentDir, resolveAll, resolveAsset, resolveCompactionThresholdPercent, resolveGlobalHarnesses, resolveGlobalSkWorkspaceConfig, resolveSkWorkspaceConfig, resolveSourcePublisher, saveSkWorkspaceConfig, scanRepo, slashGitSourceCacheKey, sourceCacheKey, sourceShortName, stageMaterializedSkills, stagedSkillMarkerState, storeManifestSlug, symlinkEscapeOfProject, unlinkRepo, unstageSkill, validateAssetRecipeAttr, validateAssetRecipeFlake, valueShapeError, workspaceConfigFilename, workspaceNameFromFilename, writeLinks };
+//# sourceMappingURL=chunk-KJSC2ZD6.js.map
+//# sourceMappingURL=chunk-KJSC2ZD6.js.map