@zaip-ai/cli 0.1.0 → 1.0.1

package/dist/services/adapters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapters.js","sourceRoot":"","sources":["../../src/services/adapters.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,gBAAgB,EAEhB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACnF,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAE3F,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAOxC,MAAM,aAAa,GAAG;;;;;;;;;;;;;CAarB,CAAC;AAEF,MAAM,eAAe,GAAG;;;;;;;;CAQvB,CAAC;AAEF,MAAM,gCAAgC,GAAG,8BAA8B,CAAC;AAExE,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;6CA0BwB,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoF5E,CAAC;AAEF,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2crC,CAAC;AAEF,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;AAEpE,MAAM,6BAA6B,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6FrC,CAAC;AAEF,MAAM,eAAe,GAAG;;;;;;CAMvB,CAAC;AAEF,MAAM,UAAU,YAAY,CAC1B,aAAqB,EACrB,OAA4B;IAE5B,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,CACtC,gCAAgC,EAChC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CACvC,CAAC;IACF,OAAO;QACL,OAAO,CAAC,WAAW,EAAE,aAAa,EAAE,eAAe,CAAC;QACpD,OAAO,CAAC,WAAW,EAAE,aAAa,EAAE,eAAe,CAAC;QACpD,OAAO,CAAC,kCAAkC,EAAE,eAAe,EAAE,iBAAiB,CAAC;QAC/E,OAAO,CAAC,mCAAmC,EAAE,eAAe,EAAE,iBAAiB,CAAC;QAChF,OAAO,CACL,oBAAoB,EACpB,GAAG,WAAW,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,EAChF,cAAc,CACf;QACD,OAAO,CAAC,oCAAoC,EAAE,mBAAmB,EAAE,mBAAmB,CAAC;QACvF,OAAO,CACL,0CAA0C,EAC1C,6BAA6B,EAC7B,+BAA+B,CAChC;QACD,OAAO,CACL,uCAAuC,EACvC,yBAAyB,EACzB,2BAA2B,CAC5B;QACD,OAAO,CAAC,kCAAkC,EAAE,oBAAoB,EAAE,sBAAsB,CAAC;QACzF,OAAO,CAAC,uBAAuB,EAAE,eAAe,EAAE,iBAAiB,CAAC;KACrE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY;IAI9C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,MAAM,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnF,IACE,OAAO,KAAK,IAAI,CAAC,OAAO;YACxB,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,EACjE,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAY,EACZ,KAAK,GAAG,KAAK;IAEb,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,MAAM,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACnF,IAAI,OAAO,KAAK,IAAI,CAAC,OAAO;YAAE,SAAS;QACvC,IAAI,OAAO,KAAK,IAAI,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,SAAS;QAC7E,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;YACxE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;IACjF,MAAM,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,IAAY;IAC9C,MAAM,OAAO,GAAG,uBAAuB,CACrC,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,oCAAoC,CAAC,EAAE,MAAM,CAAC,CAC5E,CAAC;IACF,OAAO,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,OAAe;IAC5D,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC;IAC1E,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;IACzE,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;IACzE,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC1E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAgC,CAAC;QAClE,OAAO,CACL,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,eAAe,CAAC,CAC7F,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAY,EAAE,OAAe;IAC3D,OAAO,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,IAAY,EAAE,MAAc;IACzD,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,6CAA6C,MAAM,YAAY,gBAAgB,WAAW,QAAQ,EAAE,CAAC;IACpH,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,MAAM,SAAS,IAAI,EAAE,EAAE,CAAC;IAClF,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,MAAM,KAAK,IAAI,EAAE,EAAE,CAAC;IAC7E,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,KAAK,IAAI,EAAE,EAAE,CAAC;IAC7E,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,MAAM,KAAK,IAAI,EAAE,EAAE,CAAC;IAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;IAC3D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AACjG,CAAC"}

package/dist/services/adapters.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=adapters.test.d.ts.map

package/dist/services/adapters.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapters.test.d.ts","sourceRoot":"","sources":["../../src/services/adapters.test.ts"],"names":[],"mappings":""}

package/dist/services/adapters.test.js

@@ -0,0 +1,25 @@
+import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import { buildAdapters, checkAdapters } from "./adapters.js";
+const roots = [];
+const repositoryRoot = resolve(import.meta.dirname, "../../../../..");
+afterEach(async () => {
+    await Promise.all(roots.splice(0).map((root) => rm(root, { force: true, recursive: true })));
+});
+describe("public adapter overlays", () => {
+    it("preserves a user-owned Codex project config", async () => {
+        const root = await mkdtemp(join(tmpdir(), "zaip-public-adapters-"));
+        roots.push(root);
+        await mkdir(join(root, ".agents/config/agents"), { recursive: true });
+        await mkdir(join(root, ".codex"), { recursive: true });
+        await writeFile(join(root, ".agents/config/agents/catalog.yaml"), await readFile(join(repositoryRoot, ".agents/config/agents/catalog.yaml"), "utf8"), "utf8");
+        const localConfig = 'personality = "pragmatic"\n';
+        await writeFile(join(root, ".codex/config.toml"), localConfig, "utf8");
+        await expect(buildAdapters(root)).resolves.toEqual({ applied: true, conflicts: [] });
+        await expect(readFile(join(root, ".codex/config.toml"), "utf8")).resolves.toBe(localConfig);
+        await expect(checkAdapters(root)).resolves.toEqual({ valid: true, drifted: [] });
+    });
+});
+//# sourceMappingURL=adapters.test.js.map

package/dist/services/adapters.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapters.test.js","sourceRoot":"","sources":["../../src/services/adapters.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE7D,MAAM,KAAK,GAAa,EAAE,CAAC;AAC3B,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;AAEtE,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC;QACpE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,uBAAuB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,SAAS,CACb,IAAI,CAAC,IAAI,EAAE,oCAAoC,CAAC,EAChD,MAAM,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,oCAAoC,CAAC,EAAE,MAAM,CAAC,EAClF,MAAM,CACP,CAAC;QACF,MAAM,WAAW,GAAG,6BAA6B,CAAC;QAClD,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAEvE,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAErF,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5F,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/services/agent-adapters.d.ts

@@ -0,0 +1,41 @@
+import type { AdapterFile } from "./adapters.js";
+export interface PublicAgentDefinition {
+    id: string;
+    codex_name: string;
+    purpose: string;
+    role: string;
+    nickname_candidates: string[];
+    capabilities: string[];
+    tools: string[];
+    skills: string[];
+    model: {
+        preferred: string[];
+        reasoning_effort?: "low" | "medium" | "high" | "xhigh" | "ultra";
+    };
+    write_scopes: string[];
+    contract: {
+        inputs: string[];
+        outputs: string[];
+        evidence: string[];
+    };
+    review: {
+        can_approve: boolean;
+        cannot_review_roles: string[];
+    };
+    escalation: string[];
+    [key: string]: unknown;
+}
+export interface PublicAgentCatalog {
+    schema_version: 1;
+    agents: PublicAgentDefinition[];
+    squads: Array<{
+        id: string;
+        purpose: string;
+        max_parallelism: number;
+        [key: string]: unknown;
+    }>;
+}
+export declare function parsePublicAgentCatalog(source: string): PublicAgentCatalog;
+export declare function publicAgentAdapterFiles(catalog: PublicAgentCatalog): readonly AdapterFile[];
+export declare function codexAgentConfig(catalog: PublicAgentCatalog): string;
+//# sourceMappingURL=agent-adapters.d.ts.map

package/dist/services/agent-adapters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-adapters.d.ts","sourceRoot":"","sources":["../../src/services/agent-adapters.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAAC,gBAAgB,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAA;KAAE,CAAC;IACjG,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACtE,MAAM,EAAE;QAAE,WAAW,EAAE,OAAO,CAAC;QAAC,mBAAmB,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAChE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,CAAC,CAAC;IAClB,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAChC,MAAM,EAAE,KAAK,CAAC;QACZ,EAAE,EAAE,MAAM,CAAC;QACX,OAAO,EAAE,MAAM,CAAC;QAChB,eAAe,EAAE,MAAM,CAAC;QACxB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC,CAAC;CACJ;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,kBAAkB,CAkB1E;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,kBAAkB,GAAG,SAAS,WAAW,EAAE,CAqB3F;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,kBAAkB,GAAG,MAAM,CAUpE"}

package/dist/services/agent-adapters.js

@@ -0,0 +1,122 @@
+import { createHash } from "node:crypto";
+import { parse } from "yaml";
+export function parsePublicAgentCatalog(source) {
+    const value = parse(source);
+    if (value.schema_version !== 1 || !Array.isArray(value.agents) || !Array.isArray(value.squads)) {
+        throw new Error("Invalid .agents/config/agents/catalog.yaml");
+    }
+    for (const agent of value.agents) {
+        if (typeof agent.id !== "string" ||
+            typeof agent.codex_name !== "string" ||
+            typeof agent.purpose !== "string" ||
+            !Array.isArray(agent.nickname_candidates) ||
+            agent.nickname_candidates.length === 0 ||
+            agent.nickname_candidates.some((nickname) => !nickname.startsWith("zaip-agent-"))) {
+            throw new Error("Agent catalog cannot generate native Codex profiles");
+        }
+    }
+    return value;
+}
+export function publicAgentAdapterFiles(catalog) {
+    const files = [];
+    for (const agent of [...catalog.agents].sort(byId)) {
+        const payload = stableJson({ kind: "agent", schema_version: 1, definition: agent });
+        const codexName = agent.codex_name;
+        files.push({
+            path: `.codex/agents/${codexName}.toml`,
+            content: renderCodexAgent(agent, payload),
+        });
+        files.push({
+            path: `.claude/agents/${agent.id}.md`,
+            content: renderGuidance(agent.id, agent.purpose, payload),
+        });
+    }
+    for (const squad of [...catalog.squads].sort(byId)) {
+        const payload = stableJson({ kind: "squad", schema_version: 1, definition: squad });
+        const content = renderGuidance(squad.id, squad.purpose, payload);
+        files.push({ path: `.codex/squads/${squad.id}.md`, content });
+        files.push({ path: `.claude/squads/${squad.id}.md`, content });
+    }
+    return files;
+}
+export function codexAgentConfig(catalog) {
+    const maxThreads = Math.max(1, ...catalog.squads.map((squad) => squad.max_parallelism));
+    const registrations = [...catalog.agents]
+        .sort(byId)
+        .map((agent) => `[agents.${JSON.stringify(agent.codex_name)}]\ndescription = ${JSON.stringify(agent.purpose)}\nconfig_file = ${JSON.stringify(`./agents/${agent.codex_name}.toml`)}\nnickname_candidates = [${agent.nickname_candidates.map((value) => JSON.stringify(value)).join(", ")}]`)
+        .join("\n\n");
+    return `[agents]\nmax_threads = ${maxThreads}\nmax_depth = 2\njob_max_runtime_seconds = 1800\ninterrupt_message = true\n\n${registrations}\n`;
+}
+function renderCodexAgent(agent, payload) {
+    const name = agent.codex_name;
+    const instructions = [
+        `Operate as Codex agent ${name} (ZAIP catalog id ${agent.id}) with role ${agent.role}.`,
+        agent.purpose,
+        `Capabilities: ${agent.capabilities.join(", ")}.`,
+        `Allowed tools: ${agent.tools.join(", ") || "none"}.`,
+        `Required skills: ${agent.skills.join(", ") || "none"}.`,
+        `Model policy: ${agent.model.preferred.join(", ")}; select model and reasoning effort once when this Agent Run starts and keep both immutable until it finishes.`,
+        `Write scopes: ${agent.write_scopes.join(", ") || "read-only"}.`,
+        agent.write_scopes.length === 0
+            ? "This role is read-only. Do not create, modify, move, or delete workspace files."
+            : "The Codex host grants workspace-write at the workspace boundary, not per-path. Treat the declared write scopes as mandatory: do not modify files outside them; report any required expansion to the parent before writing.",
+        `Inputs: ${agent.contract.inputs.join(", ")}.`,
+        `Outputs: ${agent.contract.outputs.join(", ")}.`,
+        `Evidence: ${agent.contract.evidence.join(", ")}.`,
+        ...(agent.role === "orchestrator"
+            ? [
+                "You are the first catalog subagent of a delegated Execution and its sole dispatcher. Select and start all subsequent catalog Sub-Runs yourself; the root host must not dispatch peer roles directly.",
+                "For every Execution, delegate at least one bounded Sub-Run to a catalog agent whose capabilities satisfy the work; interaction Executions normally use zaip-agent-analyst, while delivery Executions may use any eligible executor. Never select an executor by a fixed identity rule.",
+                "Reviewer, auditor, and integrator Sub-Runs are permitted when their capabilities match the work.",
+                "After all other descendants finish, delegate one real final Sub-Run to zaip-agent-execution-finalizer with agent_type zaip-agent-execution-finalizer and task_name zaip_agent_execution_finalizer. Do not finish the root Run or report a terminal Execution outcome before that Sub-Run has completed.",
+            ]
+            : []),
+        ...(agent.role === "orchestrator"
+            ? []
+            : [
+                "You are a worker selected by zaip-agent-orchestrator. Do not dispatch peer catalog roles; return your bounded result to the orchestrator, which exclusively controls further delegation.",
+            ]),
+        `Escalate only to catalog identities: ${agent.escalation.map((id) => codexAgentName(id)).join(", ") || "root agent"}.`,
+        "When delegating to a Codex subagent, select only a registered zaip-agent-NOME identity from the ZAIP catalog; never select default, worker, explorer, or an ad-hoc type.",
+        "Set agent_type to the exact zaip-agent-NOME identity. Set task_name exactly to the matching host-compatible identity zaip_agent_NOME (for example, zaip_agent_builder); never add a work title, purpose label, or other suffix.",
+        "Codex may render task_name in its Subagents pane. The exact zaip_agent_NOME task_name is therefore mandatory: the host renders it as Zaip Agent NOME. Do not use a task-specific label there and do not claim that the UI label can be forced to include hyphens.",
+        "Accept only concrete bounded delegated work. Preserve parent requirements and return a concise result with evidence locators.",
+        agent.review.can_approve
+            ? `You may approve only roles outside: ${agent.review.cannot_review_roles.join(", ") || "none"}.`
+            : "You cannot approve your own work or issue final approval.",
+    ].join("\n");
+    const sandboxMode = agent.write_scopes.length === 0 ? "read-only" : "workspace-write";
+    const preferredModel = agent.model.preferred[0];
+    const modelConfig = agent.model.preferred.length === 1 &&
+        preferredModel !== undefined &&
+        preferredModel !== "policy-selected"
+        ? `model = ${JSON.stringify(preferredModel)}\n${agent.model.reasoning_effort === undefined ? "" : `model_reasoning_effort = ${JSON.stringify(agent.model.reasoning_effort)}\n`}`
+        : "";
+    return `# zaip-managed generated-do-not-edit source=agent-catalog schema=1 sha256=${digest(payload)}\nname = ${JSON.stringify(name)}\ndescription = ${JSON.stringify(agent.purpose)}\nnickname_candidates = [${agent.nickname_candidates.map((value) => JSON.stringify(value)).join(", ")}]\n${modelConfig}sandbox_mode = ${JSON.stringify(sandboxMode)}\ndeveloper_instructions = """\n${instructions.replaceAll('"""', '\\"\\"\\"')}\n"""\n`;
+}
+function codexAgentName(catalogId) {
+    return `zaip-agent-${catalogId.replace(/^agent-/, "")}`;
+}
+function renderGuidance(subject, purpose, payload) {
+    return `<!-- zaip-managed generated-do-not-edit source=agent-catalog schema=1 sha256=${digest(payload)} -->\n# ${subject}\n\n${purpose}\n\n## Canonical contract\n\n\`\`\`json\n${payload}\n\`\`\`\n`;
+}
+function stableJson(value) {
+    return `${JSON.stringify(sortValue(value), null, 2)}\n`;
+}
+function sortValue(value) {
+    if (Array.isArray(value))
+        return value.map(sortValue);
+    if (value !== null && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, item]) => [key, sortValue(item)]));
+    }
+    return value;
+}
+function digest(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+function byId(left, right) {
+    return left.id.localeCompare(right.id);
+}
+//# sourceMappingURL=agent-adapters.js.map

package/dist/services/agent-adapters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-adapters.js","sourceRoot":"","sources":["../../src/services/agent-adapters.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AA+B7B,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAgC,CAAC;IAC3D,IAAI,KAAK,CAAC,cAAc,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/F,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,IACE,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;YAC5B,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;YACpC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;YACjC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC;YACzC,KAAK,CAAC,mBAAmB,CAAC,MAAM,KAAK,CAAC;YACtC,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,EACjF,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IACD,OAAO,KAA2B,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAA2B;IACjE,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QACpF,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,iBAAiB,SAAS,OAAO;YACvC,OAAO,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC;SAC1C,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,kBAAkB,KAAK,CAAC,EAAE,KAAK;YACrC,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC;SAC1D,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QACpF,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACjE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,KAAK,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9D,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,KAAK,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAA2B;IAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IACxF,MAAM,aAAa,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;SACtC,IAAI,CAAC,IAAI,CAAC;SACV,GAAG,CACF,CAAC,KAAK,EAAE,EAAE,CACR,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,IAAI,CAAC,SAAS,CAAC,YAAY,KAAK,CAAC,UAAU,OAAO,CAAC,4BAA4B,KAAK,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC9Q;SACA,IAAI,CAAC,MAAM,CAAC,CAAC;IAChB,OAAO,2BAA2B,UAAU,gFAAgF,aAAa,IAAI,CAAC;AAChJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAA4B,EAAE,OAAe;IACrE,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC;IAC9B,MAAM,YAAY,GAAG;QACnB,0BAA0B,IAAI,qBAAqB,KAAK,CAAC,EAAE,eAAe,KAAK,CAAC,IAAI,GAAG;QACvF,KAAK,CAAC,OAAO;QACb,iBAAiB,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QACjD,kBAAkB,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG;QACrD,oBAAoB,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG;QACxD,iBAAiB,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,gHAAgH;QACjK,iBAAiB,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,GAAG;QAChE,KAAK,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;YAC7B,CAAC,CAAC,iFAAiF;YACnF,CAAC,CAAC,4NAA4N;QAChO,WAAW,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QAC9C,YAAY,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QAChD,aAAa,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QAClD,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc;YAC/B,CAAC,CAAC;gBACE,sMAAsM;gBACtM,wRAAwR;gBACxR,kGAAkG;gBAClG,ySAAyS;aAC1S;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc;YAC/B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,0LAA0L;aAC3L,CAAC;QACN,wCAAwC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,YAAY,GAAG;QACtH,0KAA0K;QAC1K,iOAAiO;QACjO,mQAAmQ;QACnQ,+HAA+H;QAC/H,KAAK,CAAC,MAAM,CAAC,WAAW;YACtB,CAAC,CAAC,uCAAuC,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG;YACjG,CAAC,CAAC,2DAA2D;KAChE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,WAAW,GAAG,KAAK,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,iBAAiB,CAAC;IACtF,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,WAAW,GACf,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAClC,cAAc,KAAK,SAAS;QAC5B,cAAc,KAAK,iBAAiB;QAClC,CAAC,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,4BAA4B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAChL,CAAC,CAAC,EAAE,CAAC;IACT,OAAO,6EAA6E,MAAM,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,4BAA4B,KAAK,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,WAAW,kBAAkB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,mCAAmC,YAAY,CAAC,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC,SAAS,CAAC;AACjb,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB;IACvC,OAAO,cAAc,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,OAAe,EAAE,OAAe;IACvE,OAAO,gFAAgF,MAAM,CAAC,OAAO,CAAC,WAAW,OAAO,OAAO,OAAO,4CAA4C,OAAO,YAAY,CAAC;AACxM,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;aAC7C,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;aACpD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,IAAI,CAAC,IAAoB,EAAE,KAAqB;IACvD,OAAO,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACzC,CAAC"}

package/dist/services/agent-adapters.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=agent-adapters.test.d.ts.map

package/dist/services/agent-adapters.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-adapters.test.d.ts","sourceRoot":"","sources":["../../src/services/agent-adapters.test.ts"],"names":[],"mappings":""}

package/dist/services/agent-adapters.test.js

@@ -0,0 +1,40 @@
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it } from "vitest";
+import { adapterFiles } from "./adapters.js";
+import { parsePublicAgentCatalog, publicAgentAdapterFiles } from "./agent-adapters.js";
+const root = new URL("../../../../../", import.meta.url);
+const templates = new URL("templates/", new URL("../../", import.meta.url));
+describe("public native agent adapters", () => {
+    it("reproduces the managed Codex and Claude files from the canonical catalog", () => {
+        const catalog = parsePublicAgentCatalog(readFileSync(new URL(".agents/config/agents/catalog.yaml", root), "utf8"));
+        const files = publicAgentAdapterFiles(catalog);
+        expect(files).toHaveLength((catalog.agents.length + catalog.squads.length) * 2);
+        for (const file of files) {
+            expect(readFileSync(new URL(file.path, root), "utf8"), file.path).toBe(file.content);
+        }
+        const workspaceRoot = fileURLToPath(root);
+        const codexConfig = adapterFiles(workspaceRoot, catalog).find((file) => file.path === ".codex/config.toml");
+        expect(codexConfig).toBeDefined();
+        expect(codexConfig?.content).toContain("max_depth = 2");
+        expect(codexConfig?.content).toContain('[agents."zaip-agent-builder"]');
+        const localOverlay = readFileSync(new URL(".codex/config.toml", root), "utf8");
+        expect(localOverlay).toContain("#:schema");
+        expect(localOverlay).not.toBe(codexConfig?.content);
+        const builder = files.find((file) => file.path === ".codex/agents/zaip-agent-builder.toml");
+        expect(builder?.content).toContain('sandbox_mode = "workspace-write"');
+        expect(builder?.content).toContain("keep both immutable until it finishes");
+        expect(builder?.content).not.toContain("default_permissions");
+        const reviewer = files.find((file) => file.path === ".codex/agents/zaip-agent-reviewer.toml");
+        expect(reviewer?.content).toContain('sandbox_mode = "read-only"');
+        expect(reviewer?.content).not.toContain("default_permissions");
+        const rootGuidance = adapterFiles(workspaceRoot, catalog).find((file) => file.path === "AGENTS.md");
+        expect(rootGuidance?.content).toContain("--intent new-work");
+        expect(rootGuidance?.content).toContain("Never copy or truncate the prompt");
+        expect(rootGuidance?.content).toContain("When in doubt, classify as conversation");
+    });
+    it("ships the canonical catalog in the public installation template", () => {
+        expect(readFileSync(new URL(".agents/config/agents/catalog.yaml", templates), "utf8")).toBe(readFileSync(new URL(".agents/config/agents/catalog.yaml", root), "utf8"));
+    });
+});
+//# sourceMappingURL=agent-adapters.test.js.map

package/dist/services/agent-adapters.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-adapters.test.js","sourceRoot":"","sources":["../../src/services/agent-adapters.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAEvF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,iBAAiB,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AACzD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE5E,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,OAAO,GAAG,uBAAuB,CACrC,YAAY,CAAC,IAAI,GAAG,CAAC,oCAAoC,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAC1E,CAAC;QACF,MAAM,KAAK,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAChF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,aAAa,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,WAAW,GAAG,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,CAC3D,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,oBAAoB,CAC7C,CAAC;QACF,MAAM,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QACxD,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,+BAA+B,CAAC,CAAC;QACxE,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/E,MAAM,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAEpD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,uCAAuC,CAAC,CAAC;QAC5F,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;QACvE,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAC5E,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,wCAAwC,CAAC,CAAC;QAC9F,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;QAClE,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;QAE/D,MAAM,YAAY,GAAG,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,CAC5D,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,CACpC,CAAC;QACF,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAC7D,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC;QAC7E,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,yCAAyC,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,oCAAoC,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CACzF,YAAY,CAAC,IAAI,GAAG,CAAC,oCAAoC,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAC1E,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/services/codex-rules.d.ts

@@ -0,0 +1,3 @@
+export declare const CODEX_GITHUB_DEPLOY_RULES = "# GitHub-only publication commands that may cross the workspace sandbox without prompting.\n# The ZAIP GitHub deploy skill permits standing automatic publication only for the demo branch.\n\nprefix_rule(\n    pattern = [\"node\", \".agents/skills/zaip-skill-github-deploy/scripts/preflight.mjs\"],\n    decision = \"allow\",\n    justification = \"Run the sanitized, repository-owned folder-scoped SSH preflight.\",\n    match = [\"node .agents/skills/zaip-skill-github-deploy/scripts/preflight.mjs --repository . --remote origin --branch demo\"],\n    not_match = [\"node scripts/other.mjs\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"add\", \"-A\"],\n    decision = \"allow\",\n    justification = \"Stage the current repository exactly once in an authorized publication cycle.\",\n    match = [\"git add -A\"],\n    not_match = [\"git add -f .env\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"commit\", [\"-m\", \"--message\"]],\n    decision = \"allow\",\n    justification = \"Create the bounded ZAIP publication commit without bypassing hooks or rewriting history.\",\n    match = [\"git commit -m [AUTO][CODEX] publish\", \"git commit --message [AUTO][CODEX] publish\"],\n    not_match = [\"git commit --amend\", \"git commit --no-verify -m publish\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"fetch\"],\n    decision = \"allow\",\n    justification = \"Fetch the selected GitHub remote once to prove the branch is not behind or diverged.\",\n    match = [\"git fetch origin demo\"],\n    not_match = [\"git pull origin demo\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"push\"],\n    decision = \"allow\",\n    justification = \"Publish only the policy-authorized demo branch after ZAIP preflight.\",\n    match = [\"git push origin demo\", \"git push -u origin demo\"],\n    not_match = [\"git pull\", \"ssh -i key git@github.com\"],\n)\n\nprefix_rule(\n    pattern = [\"git\", \"ls-remote\"],\n    decision = \"allow\",\n    justification = \"Verify GitHub connectivity and the exact remote branch hash.\",\n    match = [\"git ls-remote origin refs/heads/demo\"],\n    not_match = [\"git remote set-url origin git@github.com:other/repo.git\"],\n)\n\nprefix_rule(\n    pattern = [\"gh\", \"auth\", \"status\"],\n    decision = \"allow\",\n    justification = \"Inspect GitHub CLI authentication without changing credentials.\",\n    match = [\"gh auth status\"],\n    not_match = [\"gh auth login\"],\n)\n\nprefix_rule(\n    pattern = [\"gh\", \"run\", [\"list\", \"view\", \"watch\"]],\n    decision = \"allow\",\n    justification = \"Observe GitHub Actions checks for the just-pushed commit.\",\n    match = [\"gh run list\", \"gh run view 123\", \"gh run watch 123\"],\n    not_match = [\"gh run cancel 123\", \"gh run delete 123\"],\n)\n\nprefix_rule(\n    pattern = [\"gh\", \"pr\", [\"view\", \"checks\"]],\n    decision = \"allow\",\n    justification = \"Read pull-request metadata and required checks for the current repository.\",\n    match = [\"gh pr view\", \"gh pr checks\"],\n    not_match = [\"gh pr create\", \"gh pr merge\"],\n)\n";
+export declare const CODEX_SECURITY_RULES = "# Fail-closed defense in depth for commands that must never prompt or execute.\n# Native permission profiles, repository instructions, and these forbidden rules form the active boundary.\n\nprefix_rule(\n    pattern = [\"git\", [\"clean\", \"reset\", \"restore\"]],\n    decision = \"forbidden\",\n    justification = \"Use non-destructive Git inspection and an explicit file-level patch instead.\",\n    match = [\"git reset --hard\", \"git clean -fd\", \"git restore README.md\"],\n)\n\nprefix_rule(\n    pattern = [[\"reg\", \"reg.exe\", \"schtasks\", \"schtasks.exe\", \"sc\", \"sc.exe\", \"diskpart\", \"format\", \"bcdedit\", \"fsutil\", \"takeown\", \"icacls\"]],\n    decision = \"forbidden\",\n    justification = \"Operating-system persistence, disk, service, ownership, and ACL changes are outside repository scope.\",\n    match = [\"reg add HKCU\\Software\\Example\", \"schtasks /create /tn example\", \"diskpart\"],\n)\n\nprefix_rule(\n    pattern = [[\"runas\", \"sudo\", \"gsudo\"]],\n    decision = \"forbidden\",\n    justification = \"Privilege escalation is never allowed from ZAIP repository work.\",\n    match = [\"runas /user:Administrator cmd\", \"sudo rm -rf /\"],\n)\n\nprefix_rule(\n    pattern = [[\"winget\", \"choco\", \"scoop\"]],\n    decision = \"forbidden\",\n    justification = \"System package management is outside repository scope; use project-local dependencies.\",\n    match = [\"winget install Git.Git\", \"choco upgrade nodejs\", \"scoop install jq\"],\n)\n\nprefix_rule(\n    pattern = [[\"ssh\", \"scp\", \"sftp\", \"rsync\", \"ftp\", \"telnet\", \"nc\", \"ncat\"]],\n    decision = \"forbidden\",\n    justification = \"Use the repository-owned GitHub deploy preflight and Git commands instead of direct remote clients.\",\n    match = [\"ssh host\", \"scp file host:/tmp\", \"nc -l 4444\"],\n)\n";
+//# sourceMappingURL=codex-rules.d.ts.map

package/dist/services/codex-rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-rules.d.ts","sourceRoot":"","sources":["../../src/services/codex-rules.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,yBAAyB,ygGA0ErC,CAAC;AAEF,eAAO,MAAM,oBAAoB,yzDAqChC,CAAC"}

package/dist/services/codex-rules.js

@@ -0,0 +1,114 @@
+export const CODEX_GITHUB_DEPLOY_RULES = `# GitHub-only publication commands that may cross the workspace sandbox without prompting.
+# The ZAIP GitHub deploy skill permits standing automatic publication only for the demo branch.
+
+prefix_rule(
+    pattern = ["node", ".agents/skills/zaip-skill-github-deploy/scripts/preflight.mjs"],
+    decision = "allow",
+    justification = "Run the sanitized, repository-owned folder-scoped SSH preflight.",
+    match = ["node .agents/skills/zaip-skill-github-deploy/scripts/preflight.mjs --repository . --remote origin --branch demo"],
+    not_match = ["node scripts/other.mjs"],
+)
+
+prefix_rule(
+    pattern = ["git", "add", "-A"],
+    decision = "allow",
+    justification = "Stage the current repository exactly once in an authorized publication cycle.",
+    match = ["git add -A"],
+    not_match = ["git add -f .env"],
+)
+
+prefix_rule(
+    pattern = ["git", "commit", ["-m", "--message"]],
+    decision = "allow",
+    justification = "Create the bounded ZAIP publication commit without bypassing hooks or rewriting history.",
+    match = ["git commit -m [AUTO][CODEX] publish", "git commit --message [AUTO][CODEX] publish"],
+    not_match = ["git commit --amend", "git commit --no-verify -m publish"],
+)
+
+prefix_rule(
+    pattern = ["git", "fetch"],
+    decision = "allow",
+    justification = "Fetch the selected GitHub remote once to prove the branch is not behind or diverged.",
+    match = ["git fetch origin demo"],
+    not_match = ["git pull origin demo"],
+)
+
+prefix_rule(
+    pattern = ["git", "push"],
+    decision = "allow",
+    justification = "Publish only the policy-authorized demo branch after ZAIP preflight.",
+    match = ["git push origin demo", "git push -u origin demo"],
+    not_match = ["git pull", "ssh -i key git@github.com"],
+)
+
+prefix_rule(
+    pattern = ["git", "ls-remote"],
+    decision = "allow",
+    justification = "Verify GitHub connectivity and the exact remote branch hash.",
+    match = ["git ls-remote origin refs/heads/demo"],
+    not_match = ["git remote set-url origin git@github.com:other/repo.git"],
+)
+
+prefix_rule(
+    pattern = ["gh", "auth", "status"],
+    decision = "allow",
+    justification = "Inspect GitHub CLI authentication without changing credentials.",
+    match = ["gh auth status"],
+    not_match = ["gh auth login"],
+)
+
+prefix_rule(
+    pattern = ["gh", "run", ["list", "view", "watch"]],
+    decision = "allow",
+    justification = "Observe GitHub Actions checks for the just-pushed commit.",
+    match = ["gh run list", "gh run view 123", "gh run watch 123"],
+    not_match = ["gh run cancel 123", "gh run delete 123"],
+)
+
+prefix_rule(
+    pattern = ["gh", "pr", ["view", "checks"]],
+    decision = "allow",
+    justification = "Read pull-request metadata and required checks for the current repository.",
+    match = ["gh pr view", "gh pr checks"],
+    not_match = ["gh pr create", "gh pr merge"],
+)
+`;
+export const CODEX_SECURITY_RULES = `# Fail-closed defense in depth for commands that must never prompt or execute.
+# Native permission profiles, repository instructions, and these forbidden rules form the active boundary.
+
+prefix_rule(
+    pattern = ["git", ["clean", "reset", "restore"]],
+    decision = "forbidden",
+    justification = "Use non-destructive Git inspection and an explicit file-level patch instead.",
+    match = ["git reset --hard", "git clean -fd", "git restore README.md"],
+)
+
+prefix_rule(
+    pattern = [["reg", "reg.exe", "schtasks", "schtasks.exe", "sc", "sc.exe", "diskpart", "format", "bcdedit", "fsutil", "takeown", "icacls"]],
+    decision = "forbidden",
+    justification = "Operating-system persistence, disk, service, ownership, and ACL changes are outside repository scope.",
+    match = ["reg add HKCU\\Software\\Example", "schtasks /create /tn example", "diskpart"],
+)
+
+prefix_rule(
+    pattern = [["runas", "sudo", "gsudo"]],
+    decision = "forbidden",
+    justification = "Privilege escalation is never allowed from ZAIP repository work.",
+    match = ["runas /user:Administrator cmd", "sudo rm -rf /"],
+)
+
+prefix_rule(
+    pattern = [["winget", "choco", "scoop"]],
+    decision = "forbidden",
+    justification = "System package management is outside repository scope; use project-local dependencies.",
+    match = ["winget install Git.Git", "choco upgrade nodejs", "scoop install jq"],
+)
+
+prefix_rule(
+    pattern = [["ssh", "scp", "sftp", "rsync", "ftp", "telnet", "nc", "ncat"]],
+    decision = "forbidden",
+    justification = "Use the repository-owned GitHub deploy preflight and Git commands instead of direct remote clients.",
+    match = ["ssh host", "scp file host:/tmp", "nc -l 4444"],
+)
+`;
+//# sourceMappingURL=codex-rules.js.map

package/dist/services/codex-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-rules.js","sourceRoot":"","sources":["../../src/services/codex-rules.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,yBAAyB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0ExC,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqCnC,CAAC"}

package/dist/services/doctor.d.ts

@@ -0,0 +1,12 @@
+export interface DoctorFinding {
+    severity: "error" | "warning";
+    path: string;
+    message: string;
+}
+export interface DoctorResult {
+    root: string;
+    valid: boolean;
+    findings: readonly DoctorFinding[];
+}
+export declare function doctorProject(directory: string): Promise<DoctorResult>;
+//# sourceMappingURL=doctor.d.ts.map

package/dist/services/doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/services/doctor.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;CACpC;AAsCD,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAmH5E"}