@wardby/cli 0.6.0 → 0.8.0

package/dist/import/create.js

@@ -3,12 +3,18 @@
  * attachments, secrets, datastores, webhooks, budget groups) to the database
  * from a validated bundle + reconciliation.
  */
+import { toolTimeoutProblem } from "../sandbox/tool-timeout.js";
+import { loadToolMaxTimeoutMs } from "../config/tool-timeout.js";
 import { Prisma } from "#prisma";
+import { scheduleStartFields } from "../core/schedule-start.js";
 import { createSecret, attachSecret } from "../core/secrets.js";
 import { createDatastore, attachDatastore } from "../core/datastores.js";
+import { guardDatastore } from "../core/secret-guarded-stores.js";
+import { SecretCheckUnavailableError, SecretInValueError, createDbSecretWriteGuard, loadAgentSecretValues, secretNamesIn, } from "../core/secret-guard.js";
 import { createWebhook } from "../core/webhooks.js";
 import { deriveJsonSchema } from "../sandbox/zod-params.js";
-import { findSameNamedAttachedTool, reservedToolNameReason } from "../core/tool-names.js";
+import { toolSubject, zod3ToolWarnings } from "../core/zod3-window.js";
+import { findSameNamedAttachedTool, findSameNamedMcpTool, reservedToolNameReason } from "../core/tool-names.js";
 import { ToolCapabilitiesPatchSchema, FETCH_WILDCARD } from "../sandbox/tool-capabilities.js";
 import { PostgresDatastore } from "../providers/datastore/postgres.js";
 import { decryptTransferEnvelope } from "../providers/secrets/transfer-envelope.js";
@@ -24,6 +30,10 @@ function nativeSandboxConfigured() {
         return false;
     }
 }
+/** A seeded entry's key for a warning; withheld when the entry was refused over a secret (the key may hold it). */
+function seedKeyLabel(key, err) {
+    return err instanceof SecretInValueError || err instanceof SecretCheckUnavailableError ? "<key withheld>" : key;
+}
 export async function createFromBundle(bundle, recon, opts) {
     const { db, cipher, ownerId, secretMode, transferPrivateKey, allowOpenFetch } = opts;
     const agentOwnerId = opts.agentOwnerId === undefined ? ownerId : opts.agentOwnerId;
@@ -62,6 +72,13 @@ export async function createFromBundle(bundle, recon, opts) {
             warnings.push(`tool ${t.name}: failed to derive JSON schema, skipping`);
             continue;
         }
+        const timeoutProblem = t.timeoutMs === undefined || t.timeoutMs === null
+            ? undefined
+            : toolTimeoutProblem(t.timeoutMs, loadToolMaxTimeoutMs());
+        if (timeoutProblem) {
+            warnings.push(`tool ${t.name}: ${timeoutProblem} Skipping`);
+            continue;
+        }
         // Names are unique per owner: reuse the target owner's own same-named
         // tool (what upsert-by-name used to do), never another owner's. A
         // compound unique with a nullable column can't key an upsert, hence
@@ -75,9 +92,12 @@ export async function createFromBundle(bundle, recon, opts) {
                     code: t.code,
                     jsonSchema: schema.value,
                     ownerId,
+                    ...(t.timeoutMs !== undefined && t.timeoutMs !== null ? { timeoutMs: t.timeoutMs } : {}),
                 },
             }));
         toolIdMap.set(t.name, tool.id);
+        if (tool.paramsZod === t.paramsZod)
+            warnings.push(...(await zod3ToolWarnings(toolSubject(tool.name), t.paramsZod)));
         toolsCreated++;
     }
     // Step 2: Agents
@@ -100,6 +120,11 @@ export async function createFromBundle(bundle, recon, opts) {
                 timezone: a.timezone,
                 maxTurns: a.maxTurns,
                 scheduleEnabled,
+                ...(await scheduleStartFields(db, null, {
+                    schedule: a.schedule || null,
+                    timezone: a.timezone,
+                    scheduleEnabled,
+                })),
                 ownerId: agentOwnerId,
                 ...(a.nativeExecutionMode
                     ? { nativeExecutionMode: a.nativeExecutionMode === "sandbox" ? "sandbox" : "control_plane" }
@@ -165,6 +190,11 @@ export async function createFromBundle(bundle, recon, opts) {
             warnings.push(`agent-tool ${at.agentName}/${at.toolName}: skipped — the agent already has a different tool with the same name (${clash.id})`);
             continue;
         }
+        const mcpClash = await findSameNamedMcpTool(db, agentId, eff(at.toolName));
+        if (mcpClash) {
+            warnings.push(`agent-tool ${at.agentName}/${at.toolName}: skipped — the agent already has a tool with this name from MCP server "${mcpClash.serverName}"`);
+            continue;
+        }
         const caps = capsPatch.data;
         // The importing operator is trusted with the database, so on an agent
         // this import owns it grants the bundle's capabilities in the owner's
@@ -259,7 +289,7 @@ export async function createFromBundle(bundle, recon, opts) {
         }
     }
     // Step 6: Per-agent datastore seed
-    const ds = new PostgresDatastore(db, cipher);
+    const ds = guardDatastore(new PostgresDatastore(db, cipher), createDbSecretWriteGuard(db, cipher));
     for (const d of bundle.readSingleDatastores()) {
         const agentId = agentIdMap.get(d.agentName);
         if (!agentId)
@@ -270,7 +300,7 @@ export async function createFromBundle(bundle, recon, opts) {
                 datastoreEntries++;
             }
             catch (err) {
-                warnings.push(`datastore ${d.agentName}/${entry.key}: failed to set (${err instanceof Error ? err.message : String(err)})`);
+                warnings.push(`datastore ${d.agentName}/${seedKeyLabel(entry.key, err)}: failed to set (${err instanceof Error ? err.message : String(err)})`);
             }
         }
     }
@@ -283,6 +313,10 @@ export async function createFromBundle(bundle, recon, opts) {
     }
     else {
         const owner = ownerId; // hasOwner guarantees non-null
+        // The import is one writer for shared seeds: check them against the secrets
+        // of every agent it created, loaded once and fail closed if unreadable.
+        let importedSecrets;
+        const loadImportedSecrets = () => (importedSecrets ??= Promise.all([...agentIdMap.values()].map((id) => loadAgentSecretValues(db, cipher, id))).then((all) => all.flat()));
         for (const sd of bundle.readSharedDatastores()) {
             let created;
             try {
@@ -302,12 +336,22 @@ export async function createFromBundle(bundle, recon, opts) {
             datastoresSharedCreated++;
             for (const entry of sd.entries) {
                 try {
+                    let named;
+                    try {
+                        named = await loadImportedSecrets();
+                    }
+                    catch {
+                        throw new SecretCheckUnavailableError();
+                    }
+                    const names = secretNamesIn([entry.key, entry.value], named);
+                    if (names.length > 0)
+                        throw new SecretInValueError(names);
                     await db.datastoreEntry.create({
                         data: { datastoreId: created.id, key: entry.key, value: entry.value, pii: false },
                     });
                 }
                 catch (err) {
-                    warnings.push(`shared-datastore ${sd.name}/${entry.key}: failed to seed (${err instanceof Error ? err.message : String(err)})`);
+                    warnings.push(`shared-datastore ${sd.name}/${seedKeyLabel(entry.key, err)}: failed to seed (${err instanceof Error ? err.message : String(err)})`);
                 }
             }
             for (const agentName of sd.attachedAgentNames) {

package/dist/import/neutral-schema.d.ts

@@ -6,83 +6,38 @@ export declare const CiphertextSchema: z.ZodObject<{
     nonce: z.ZodString;
     ct: z.ZodString;
     tag: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    tag: string;
-    alg: string;
-    v: number;
-    epk: string;
-    nonce: string;
-    ct: string;
-}, {
-    tag: string;
-    alg: string;
-    v: number;
-    epk: string;
-    nonce: string;
-    ct: string;
-}>;
+}, z.core.$strip>;
 export declare const ManifestSchema: z.ZodObject<{
     bundleVersion: z.ZodNumber;
     source: z.ZodObject<{
         product: z.ZodString;
         exporterVersion: z.ZodString;
         exportedAt: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        product: string;
-        exporterVersion: string;
-        exportedAt: string;
-    }, {
-        product: string;
-        exporterVersion: string;
-        exportedAt: string;
+    }, z.core.$strip>;
+    secretMode: z.ZodEnum<{
+        references: "references";
+        envelope: "envelope";
     }>;
-    secretMode: z.ZodEnum<["references", "envelope"]>;
     transferKeyId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
     contentWindowDays: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
     contentSince: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    toolCallDetail: z.ZodDefault<z.ZodEnum<["metadata", "full"]>>;
+    toolCallDetail: z.ZodDefault<z.ZodEnum<{
+        metadata: "metadata";
+        full: "full";
+    }>>;
     runAuditWindowDays: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
     runAuditSince: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    capabilities: z.ZodArray<z.ZodString, "many">;
+    capabilities: z.ZodArray<z.ZodString>;
     counts: z.ZodRecord<z.ZodString, z.ZodNumber>;
-}, "strip", z.ZodTypeAny, {
-    source: {
-        product: string;
-        exporterVersion: string;
-        exportedAt: string;
-    };
-    capabilities: string[];
-    bundleVersion: number;
-    secretMode: "references" | "envelope";
-    transferKeyId: string | null;
-    contentWindowDays: number | null;
-    contentSince: string | null;
-    toolCallDetail: "metadata" | "full";
-    runAuditWindowDays: number | null;
-    runAuditSince: string | null;
-    counts: Record<string, number>;
-}, {
-    source: {
-        product: string;
-        exporterVersion: string;
-        exportedAt: string;
-    };
-    capabilities: string[];
-    bundleVersion: number;
-    secretMode: "references" | "envelope";
-    counts: Record<string, number>;
-    transferKeyId?: string | null | undefined;
-    contentWindowDays?: number | null | undefined;
-    contentSince?: string | null | undefined;
-    toolCallDetail?: "metadata" | "full" | undefined;
-    runAuditWindowDays?: number | null | undefined;
-    runAuditSince?: string | null | undefined;
-}>;
+}, z.core.$strip>;
 export type Manifest = z.infer<typeof ManifestSchema>;
 export declare const NeutralAgentSchema: z.ZodObject<{
     name: z.ZodString;
     systemPrompt: z.ZodString;
-    provider: z.ZodEnum<["openai", "bedrock"]>;
+    provider: z.ZodEnum<{
+        openai: "openai";
+        bedrock: "bedrock";
+    }>;
     model: z.ZodString;
     region: z.ZodDefault<z.ZodNullable<z.ZodString>>;
     schedule: z.ZodDefault<z.ZodNullable<z.ZodString>>;
@@ -91,64 +46,20 @@ export declare const NeutralAgentSchema: z.ZodObject<{
     maxTurns: z.ZodNumber;
     budgetUsd: z.ZodString;
     ownerEmail: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    kind: z.ZodDefault<z.ZodEnum<["native"]>>;
+    kind: z.ZodDefault<z.ZodEnum<{
+        native: "native";
+    }>>;
     memoryEnabled: z.ZodDefault<z.ZodBoolean>;
-    /** Where the agent's runs execute; absent = control-plane. Native agents only (every imported agent is native). */
-    nativeExecutionMode: z.ZodOptional<z.ZodEnum<["control-plane", "sandbox"]>>;
-    unmodeled: z.ZodDefault<z.ZodObject<{
-        description: z.ZodOptional<z.ZodDefault<z.ZodNullable<z.ZodString>>>;
-        slug: z.ZodOptional<z.ZodDefault<z.ZodNullable<z.ZodString>>>;
-        emailAllowlist: z.ZodOptional<z.ZodDefault<z.ZodNullable<z.ZodUnknown>>>;
-    }, "strip", z.ZodTypeAny, {
-        description?: string | null | undefined;
-        slug?: string | null | undefined;
-        emailAllowlist?: unknown;
-    }, {
-        description?: string | null | undefined;
-        slug?: string | null | undefined;
-        emailAllowlist?: unknown;
+    nativeExecutionMode: z.ZodOptional<z.ZodEnum<{
+        sandbox: "sandbox";
+        "control-plane": "control-plane";
     }>>;
-}, "strip", z.ZodTypeAny, {
-    name: string;
-    model: string;
-    budgetUsd: string;
-    maxTurns: number;
-    provider: "openai" | "bedrock";
-    kind: "native";
-    systemPrompt: string;
-    schedule: string | null;
-    timezone: string;
-    scheduleEnabled: boolean;
-    memoryEnabled: boolean;
-    region: string | null;
-    ownerEmail: string | null;
-    unmodeled: {
-        description?: string | null | undefined;
-        slug?: string | null | undefined;
-        emailAllowlist?: unknown;
-    };
-    nativeExecutionMode?: "sandbox" | "control-plane" | undefined;
-}, {
-    name: string;
-    model: string;
-    budgetUsd: string;
-    maxTurns: number;
-    provider: "openai" | "bedrock";
-    systemPrompt: string;
-    scheduleEnabled: boolean;
-    kind?: "native" | undefined;
-    nativeExecutionMode?: "sandbox" | "control-plane" | undefined;
-    schedule?: string | null | undefined;
-    timezone?: string | undefined;
-    memoryEnabled?: boolean | undefined;
-    region?: string | null | undefined;
-    ownerEmail?: string | null | undefined;
-    unmodeled?: {
-        description?: string | null | undefined;
-        slug?: string | null | undefined;
-        emailAllowlist?: unknown;
-    } | undefined;
-}>;
+    unmodeled: z.ZodDefault<z.ZodObject<{
+        description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        slug: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        emailAllowlist: z.ZodOptional<z.ZodNullable<z.ZodUnknown>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
 export type NeutralAgent = z.infer<typeof NeutralAgentSchema>;
 export declare const NeutralToolSchema: z.ZodObject<{
     name: z.ZodString;
@@ -157,47 +68,18 @@ export declare const NeutralToolSchema: z.ZodObject<{
     jsonSchema: z.ZodDefault<z.ZodNullable<z.ZodUnknown>>;
     code: z.ZodString;
     secretSchema: z.ZodDefault<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    name: string;
-    code: string;
-    description: string;
-    paramsZod: string;
-    secretSchema: string;
-    jsonSchema?: unknown;
-}, {
-    name: string;
-    code: string;
-    paramsZod: string;
-    description?: string | undefined;
-    jsonSchema?: unknown;
-    secretSchema?: string | undefined;
-}>;
+    timeoutMs: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+}, z.core.$strip>;
 export type NeutralTool = z.infer<typeof NeutralToolSchema>;
 export declare const NeutralAgentToolSchema: z.ZodObject<{
     agentName: z.ZodString;
     toolName: z.ZodString;
-    allowedSecrets: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    allowedDatastorePrefixes: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    allowedHosts: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-    allowedSharedDatastorePrefixes: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString, "many">>>;
+    allowedSecrets: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    allowedDatastorePrefixes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    allowedHosts: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    allowedSharedDatastorePrefixes: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
     hostsSource: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    allowedSecrets: string[];
-    allowedDatastorePrefixes: string[];
-    allowedHosts: string[];
-    allowedSharedDatastorePrefixes: Record<string, string[]>;
-    agentName: string;
-    toolName: string;
-    hostsSource?: string | undefined;
-}, {
-    agentName: string;
-    toolName: string;
-    allowedSecrets?: string[] | undefined;
-    allowedDatastorePrefixes?: string[] | undefined;
-    allowedHosts?: string[] | undefined;
-    allowedSharedDatastorePrefixes?: Record<string, string[]> | undefined;
-    hostsSource?: string | undefined;
-}>;
+}, z.core.$strip>;
 export type NeutralAgentTool = z.infer<typeof NeutralAgentToolSchema>;
 export declare const NeutralSecretSchema: z.ZodObject<{
     name: z.ZodString;
@@ -210,60 +92,14 @@ export declare const NeutralSecretSchema: z.ZodObject<{
         nonce: z.ZodString;
         ct: z.ZodString;
         tag: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        tag: string;
-        alg: string;
-        v: number;
-        epk: string;
-        nonce: string;
-        ct: string;
-    }, {
-        tag: string;
-        alg: string;
-        v: number;
-        epk: string;
-        nonce: string;
-        ct: string;
-    }>>;
-}, "strip", z.ZodTypeAny, {
-    name: string;
-    description: string | null;
-    ownerEmail: string | null;
-    ciphertext?: {
-        tag: string;
-        alg: string;
-        v: number;
-        epk: string;
-        nonce: string;
-        ct: string;
-    } | undefined;
-}, {
-    name: string;
-    description?: string | null | undefined;
-    ciphertext?: {
-        tag: string;
-        alg: string;
-        v: number;
-        epk: string;
-        nonce: string;
-        ct: string;
-    } | undefined;
-    ownerEmail?: string | null | undefined;
-}>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
 export type NeutralSecret = z.infer<typeof NeutralSecretSchema>;
 export declare const NeutralAgentSecretSchema: z.ZodObject<{
     agentName: z.ZodString;
     secretName: z.ZodString;
     alias: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-}, "strip", z.ZodTypeAny, {
-    secretName: string;
-    agentName: string;
-    alias: string | null;
-}, {
-    secretName: string;
-    agentName: string;
-    alias?: string | null | undefined;
-}>;
+}, z.core.$strip>;
 export type NeutralAgentSecret = z.infer<typeof NeutralAgentSecretSchema>;
 export declare const NeutralSingleDatastoreSchema: z.ZodObject<{
     agentName: z.ZodString;
@@ -272,102 +108,36 @@ export declare const NeutralSingleDatastoreSchema: z.ZodObject<{
         key: z.ZodString;
         value: z.ZodUnknown;
         pii: z.ZodDefault<z.ZodBoolean>;
-    }, "strip", z.ZodTypeAny, {
-        key: string;
-        pii: boolean;
-        value?: unknown;
-    }, {
-        key: string;
-        value?: unknown;
-        pii?: boolean | undefined;
-    }>, "many">>;
-}, "strip", z.ZodTypeAny, {
-    entries: {
-        key: string;
-        pii: boolean;
-        value?: unknown;
-    }[];
-    agentName: string;
-    name?: string | undefined;
-}, {
-    agentName: string;
-    name?: string | undefined;
-    entries?: {
-        key: string;
-        value?: unknown;
-        pii?: boolean | undefined;
-    }[] | undefined;
-}>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
 export type NeutralSingleDatastore = z.infer<typeof NeutralSingleDatastoreSchema>;
 export declare const NeutralSharedDatastoreSchema: z.ZodObject<{
     name: z.ZodString;
     ownerEmail: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    attachedAgentNames: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    attachedAgentNames: z.ZodDefault<z.ZodArray<z.ZodString>>;
     entries: z.ZodDefault<z.ZodArray<z.ZodObject<{
         key: z.ZodString;
         value: z.ZodUnknown;
-    }, "strip", z.ZodTypeAny, {
-        key: string;
-        value?: unknown;
-    }, {
-        key: string;
-        value?: unknown;
-    }>, "many">>;
-}, "strip", z.ZodTypeAny, {
-    name: string;
-    entries: {
-        key: string;
-        value?: unknown;
-    }[];
-    ownerEmail: string | null;
-    attachedAgentNames: string[];
-}, {
-    name: string;
-    entries?: {
-        key: string;
-        value?: unknown;
-    }[] | undefined;
-    ownerEmail?: string | null | undefined;
-    attachedAgentNames?: string[] | undefined;
-}>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
 export type NeutralSharedDatastore = z.infer<typeof NeutralSharedDatastoreSchema>;
 export declare const NeutralWebhookSchema: z.ZodObject<{
     agentName: z.ZodString;
     enabled: z.ZodBoolean;
-}, "strip", z.ZodTypeAny, {
-    enabled: boolean;
-    agentName: string;
-}, {
-    enabled: boolean;
-    agentName: string;
-}>;
+}, z.core.$strip>;
 export type NeutralWebhook = z.infer<typeof NeutralWebhookSchema>;
 export declare const NeutralBudgetSchema: z.ZodObject<{
     name: z.ZodString;
     ownerEmail: z.ZodDefault<z.ZodNullable<z.ZodString>>;
-    period: z.ZodEnum<["daily", "weekly", "monthly"]>;
+    period: z.ZodEnum<{
+        daily: "daily";
+        weekly: "weekly";
+        monthly: "monthly";
+    }>;
     alertThreshold: z.ZodString;
     blockThreshold: z.ZodString;
-    alertEmails: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    alertEmails: z.ZodDefault<z.ZodArray<z.ZodString>>;
     enabled: z.ZodBoolean;
-    attachedAgentNames: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-}, "strip", z.ZodTypeAny, {
-    name: string;
-    enabled: boolean;
-    period: "daily" | "weekly" | "monthly";
-    ownerEmail: string | null;
-    attachedAgentNames: string[];
-    alertThreshold: string;
-    blockThreshold: string;
-    alertEmails: string[];
-}, {
-    name: string;
-    enabled: boolean;
-    period: "daily" | "weekly" | "monthly";
-    alertThreshold: string;
-    blockThreshold: string;
-    ownerEmail?: string | null | undefined;
-    attachedAgentNames?: string[] | undefined;
-    alertEmails?: string[] | undefined;
-}>;
+    attachedAgentNames: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
 export type NeutralBudget = z.infer<typeof NeutralBudgetSchema>;

package/dist/import/neutral-schema.js

@@ -36,13 +36,14 @@ export const NeutralAgentSchema = z.object({
     memoryEnabled: z.boolean().default(false),
     /** Where the agent's runs execute; absent = control-plane. Native agents only (every imported agent is native). */
     nativeExecutionMode: z.enum(["control-plane", "sandbox"]).optional(),
+    // Each field optional with no default: Zod 4 would apply a default inside
+    // .partial(), where Zod 3 left an absent field absent.
     unmodeled: z
         .object({
-        description: z.string().nullable().default(null),
-        slug: z.string().nullable().default(null),
-        emailAllowlist: z.unknown().nullable().default(null),
+        description: z.string().nullable().optional(),
+        slug: z.string().nullable().optional(),
+        emailAllowlist: z.unknown().nullable().optional(),
     })
-        .partial()
         .default({}),
 });
 export const NeutralToolSchema = z.object({
@@ -52,6 +53,8 @@ export const NeutralToolSchema = z.object({
     jsonSchema: z.unknown().nullable().default(null), // ignored; we re-derive (ruling 2)
     code: z.string(),
     secretSchema: z.string().default(""),
+    /** The tool's own time limit (ms); absent or null keeps the default. Checked against WARDBY_TOOL_MAX_TIMEOUT_MS on import. */
+    timeoutMs: z.number().int().nullable().optional(),
 });
 export const NeutralAgentToolSchema = z.object({
     agentName: z.string(),

package/dist/knowledge/check.d.ts

@@ -1,5 +1,5 @@
 export type CheckSeverity = "error" | "warning";
-export type CheckCode = "concept_invalid" | "concept_secret" | "index_missing" | "index_link_broken" | "concept_not_indexed" | "citation_unverifiable" | "citation_stale";
+export type CheckCode = "concept_invalid" | "concept_secret" | "index_missing" | "index_link_broken" | "concept_not_indexed" | "citation_unverifiable" | "citation_stale" | "knowledge_config_invalid";
 export interface CheckIssue {
     severity: CheckSeverity;
     code: CheckCode;

package/dist/knowledge/cli.d.ts

@@ -1,5 +1,6 @@
 export declare function parseKnowledgeArgs(args: string[]): {
-    dir: string;
+    /** Unset: the folder `.wardby/knowledge.yaml` names under `root`, else the default. */
+    dir: string | undefined;
     root: string;
     strict: boolean;
     json: boolean;
@@ -11,4 +12,13 @@ export declare function parseKnowledgeArgs(args: string[]): {
  * a bundle is plain files, and following links could loop or leave the bundle.
  */
 export declare function loadBundle(dir: string): Map<string, string>;
+/**
+ * The bundle folder when no `dir` is given: the one `.wardby/knowledge.yaml`
+ * under `root` names, else the default. An unusable file is reported as an
+ * error (the server would ignore it) and the default is checked instead.
+ */
+export declare function bundleDirFromConfig(root: string): {
+    dir: string;
+    configError?: string;
+};
 export declare function knowledgeCommand(args: string[]): Promise<void>;

package/dist/knowledge/cli.js

@@ -3,6 +3,7 @@ import { join, relative, resolve, sep } from "node:path";
 import { parseArgs } from "node:util";
 import { checkBundle } from "./check.js";
 import { DEFAULT_KNOWLEDGE_BUNDLE_PATH } from "./concept.js";
+import { KNOWLEDGE_CONFIG_PATH, parseKnowledgeConfig } from "./location.js";
 const USAGE = "usage: wardby knowledge check [dir] [--root <repo root>] [--strict] [--json]";
 export function parseKnowledgeArgs(args) {
     const [sub, ...rest] = args;
@@ -16,7 +17,7 @@ export function parseKnowledgeArgs(args) {
     if (positionals.length > 1)
         throw new Error(USAGE);
     return {
-        dir: positionals[0] ?? DEFAULT_KNOWLEDGE_BUNDLE_PATH,
+        dir: positionals[0],
         root: values.root ?? ".",
         strict: values.strict ?? false,
         json: values.json ?? false,
@@ -43,10 +44,38 @@ export function loadBundle(dir) {
     walk(dir);
     return files;
 }
+/**
+ * The bundle folder when no `dir` is given: the one `.wardby/knowledge.yaml`
+ * under `root` names, else the default. An unusable file is reported as an
+ * error (the server would ignore it) and the default is checked instead.
+ */
+export function bundleDirFromConfig(root) {
+    let text;
+    try {
+        text = readFileSync(join(root, KNOWLEDGE_CONFIG_PATH), "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return { dir: DEFAULT_KNOWLEDGE_BUNDLE_PATH };
+        return { dir: DEFAULT_KNOWLEDGE_BUNDLE_PATH, configError: `it could not be read (${err.message})` };
+    }
+    const parsed = parseKnowledgeConfig(text);
+    return parsed.ok ? { dir: parsed.bundlePath } : { dir: DEFAULT_KNOWLEDGE_BUNDLE_PATH, configError: parsed.error };
+}
 export async function knowledgeCommand(args) {
     const options = parseKnowledgeArgs(args);
     const root = resolve(options.root);
-    const files = loadBundle(resolve(root, options.dir));
+    const located = options.dir === undefined ? bundleDirFromConfig(root) : { dir: options.dir };
+    const dir = located.dir;
+    const configIssue = located.configError
+        ? {
+            severity: "error",
+            code: "knowledge_config_invalid",
+            file: KNOWLEDGE_CONFIG_PATH,
+            message: `ignored because ${located.configError}; checked ${DEFAULT_KNOWLEDGE_BUNDLE_PATH}/ instead`,
+        }
+        : undefined;
+    const files = loadBundle(resolve(root, dir));
     const issues = checkBundle({ files }, (path) => {
         try {
             return readFileSync(join(root, path), "utf8");
@@ -55,11 +84,15 @@ export async function knowledgeCommand(args) {
             return null;
         }
     });
+    if (configIssue)
+        issues.unshift(configIssue);
     if (options.json)
         process.stdout.write(`${JSON.stringify({ issues }, null, 2)}\n`);
     else {
-        for (const issue of issues)
-            process.stdout.write(`${issue.severity} ${issue.code} ${options.dir}/${issue.file}: ${issue.message}\n`);
+        for (const issue of issues) {
+            const where = issue === configIssue ? issue.file : `${dir}/${issue.file}`;
+            process.stdout.write(`${issue.severity} ${issue.code} ${where}: ${issue.message}\n`);
+        }
         process.stdout.write(`${files.size} files checked, ${issues.filter((i) => i.severity === "error").length} errors, ${issues.filter((i) => i.severity === "warning").length} warnings\n`);
     }
     if (issues.some((i) => i.severity === "error" || (options.strict && i.severity === "warning")))