@aiwg/cli 0.0.0-bootstrap.0 → 2026.7.17

package/dist/src/smiths/commandsmith/templates.js

@@ -0,0 +1,296 @@
+/**
+ * Command templates for different command types
+ */
+/**
+ * Generate frontmatter for a command
+ */
+export function generateFrontmatter(name, description, args = [], options = [], modelRole = 'efficiency', modelTier = 'economy') {
+    // Build args string
+    const argParts = [];
+    // Required args
+    args.filter(a => a.required).forEach(arg => {
+        argParts.push(`<${arg.name}>`);
+    });
+    // Optional args
+    args.filter(a => !a.required).forEach(arg => {
+        argParts.push(`[${arg.name}]`);
+    });
+    // Options
+    options.forEach(opt => {
+        if (opt.type === 'boolean') {
+            argParts.push(`[--${opt.name}]`);
+        }
+        else {
+            argParts.push(`[--${opt.name} <value>]`);
+        }
+    });
+    // Always add standard options
+    argParts.push('[--interactive]');
+    argParts.push('[--guidance "text"]');
+    const argsString = argParts.join(' ');
+    return `---
+name: ${name}
+description: ${description}
+args: ${argsString}
+commandHint:
+  modelRole: ${modelRole}
+  modelTier: ${modelTier}
+---`;
+}
+/**
+ * Generate Arguments section
+ */
+export function generateArgumentsSection(args) {
+    if (args.length === 0) {
+        return '';
+    }
+    let section = '\n## Arguments\n\n';
+    section += '| Argument | Required | Description |\n';
+    section += '|----------|----------|-------------|\n';
+    args.forEach(arg => {
+        const defaultStr = arg.default ? ` (default: ${arg.default})` : '';
+        section += `| ${arg.name} | ${arg.required ? 'Yes' : 'No'} | ${arg.description}${defaultStr} |\n`;
+    });
+    return section;
+}
+/**
+ * Generate Options section
+ */
+export function generateOptionsSection(options) {
+    if (options.length === 0) {
+        return '';
+    }
+    let section = '\n## Options\n\n';
+    section += '| Option | Type | Description |\n';
+    section += '|--------|------|-------------|\n';
+    options.forEach(opt => {
+        const defaultStr = opt.default !== undefined ? ` (default: ${opt.default})` : '';
+        section += `| --${opt.name} | ${opt.type} | ${opt.description}${defaultStr} |\n`;
+    });
+    // Add standard options
+    section += '| --interactive | boolean | Enable interactive mode with guided questions |\n';
+    section += '| --guidance | string | Provide strategic guidance for execution |\n';
+    return section;
+}
+/**
+ * Utility template - simple operation, single action
+ */
+export function generateUtilityTemplate(name, description, args = [], options = [], guidance, modelRole = 'efficiency', modelTier = 'economy') {
+    const frontmatter = generateFrontmatter(name, description, args, options, modelRole, modelTier);
+    const argsSection = generateArgumentsSection(args);
+    const optionsSection = generateOptionsSection(options);
+    const titleCase = name.split('-').map(w => w.charAt(0).toUpperCase() + w.slice(1)).join(' ');
+    return `${frontmatter}
+
+# ${titleCase}
+
+${description}
+
+## Usage
+
+\`\`\`
+/${name}${args.length > 0 ? ' ' + args.map(a => a.required ? `<${a.name}>` : `[${a.name}]`).join(' ') : ''}${options.length > 0 ? ' [options]' : ''}
+\`\`\`
+${argsSection}${optionsSection}
+
+## Execution
+
+1. **Validate inputs**: Verify all required arguments are provided
+2. **Process request**: Execute the primary operation
+3. **Generate output**: Return results in appropriate format
+4. **Report status**: Indicate success or failure with clear messaging
+
+${guidance ? `## Guidance\n\n${guidance}\n` : ''}
+## Output
+
+The command returns:
+- Success message with operation details
+- Any generated artifacts or file paths
+- Relevant metrics or status information
+
+## Examples
+
+\`\`\`bash
+# Basic usage
+/${name}${args.length > 0 && args[0].required ? ` <${args[0].name}>` : ''}
+
+# With options
+/${name}${args.length > 0 && args[0].required ? ` <${args[0].name}>` : ''}${options.length > 0 ? ` --${options[0].name} value` : ''}
+
+# Interactive mode
+/${name}${args.length > 0 && args[0].required ? ` <${args[0].name}>` : ''} --interactive
+\`\`\`
+
+## Related Commands
+
+- See other commands in the same domain for related functionality
+`;
+}
+/**
+ * Transformation template - input/output pipeline
+ */
+export function generateTransformationTemplate(name, description, args = [], options = [], guidance, modelRole = 'efficiency', modelTier = 'economy') {
+    const frontmatter = generateFrontmatter(name, description, args, options, modelRole, modelTier);
+    const argsSection = generateArgumentsSection(args);
+    const optionsSection = generateOptionsSection(options);
+    const titleCase = name.split('-').map(w => w.charAt(0).toUpperCase() + w.slice(1)).join(' ');
+    return `${frontmatter}
+
+# ${titleCase}
+
+${description}
+
+## Usage
+
+\`\`\`
+/${name}${args.length > 0 ? ' ' + args.map(a => a.required ? `<${a.name}>` : `[${a.name}]`).join(' ') : ''}${options.length > 0 ? ' [options]' : ''}
+\`\`\`
+${argsSection}${optionsSection}
+
+## Transformation Pipeline
+
+1. **Input validation**: Verify input format and content
+2. **Pre-processing**: Prepare input for transformation
+3. **Core transformation**: Apply main transformation logic
+4. **Post-processing**: Format and validate output
+5. **Output generation**: Write transformed content to target
+
+${guidance ? `## Guidance\n\n${guidance}\n` : ''}
+## Input Requirements
+
+Describe expected input format, structure, or constraints.
+
+## Output Format
+
+Describe output format, structure, and location.
+
+## Examples
+
+\`\`\`bash
+# Basic transformation
+/${name}${args.length > 0 && args[0].required ? ` <${args[0].name}>` : ''}
+
+# With custom options
+/${name}${args.length > 0 && args[0].required ? ` <${args[0].name}>` : ''}${options.length > 0 ? ` --${options[0].name} value` : ''}
+
+# Interactive mode
+/${name} --interactive
+\`\`\`
+
+## Validation
+
+- Input validation criteria
+- Output validation criteria
+- Error handling and recovery
+
+## Related Commands
+
+- See other transformation commands for similar pipelines
+`;
+}
+/**
+ * Orchestration template - multi-agent workflow
+ */
+export function generateOrchestrationTemplate(name, description, args = [], options = [], guidance, modelRole = 'coding', modelTier = 'standard') {
+    const frontmatter = generateFrontmatter(name, description, args, options, modelRole, modelTier);
+    const argsSection = generateArgumentsSection(args);
+    const optionsSection = generateOptionsSection(options);
+    const titleCase = name.split('-').map(w => w.charAt(0).toUpperCase() + w.slice(1)).join(' ');
+    return `${frontmatter}
+
+# ${titleCase}
+
+${description}
+
+## Usage
+
+\`\`\`
+/${name}${args.length > 0 ? ' ' + args.map(a => a.required ? `<${a.name}>` : `[${a.name}]`).join(' ') : ''}${options.length > 0 ? ' [options]' : ''}
+\`\`\`
+${argsSection}${optionsSection}
+
+## Workflow Phases
+
+### Phase 1: Initialization
+- Validate prerequisites
+- Gather required inputs
+- Set up working context
+
+### Phase 2: Primary Execution
+- Coordinate agent assignments
+- Execute parallel tasks
+- Monitor progress
+
+### Phase 3: Review & Synthesis
+- Collect agent outputs
+- Synthesize results
+- Validate completeness
+
+### Phase 4: Finalization
+- Archive artifacts
+- Generate reports
+- Update project state
+
+${guidance ? `## Guidance\n\n${guidance}\n` : ''}
+## Agent Coordination
+
+### Primary Author
+- Responsible agent for main deliverable
+- Draft initial version
+
+### Parallel Reviewers
+Launch in single message for concurrent review:
+- Domain expert reviews
+- Quality validation
+- Technical validation
+
+### Synthesizer
+- Merge review feedback
+- Resolve conflicts
+- Generate final version
+
+## Artifacts Generated
+
+List expected artifacts, their locations, and purposes.
+
+## Success Criteria
+
+Define what constitutes successful completion:
+- Required deliverables present
+- Quality gates passed
+- All reviews completed
+
+## Examples
+
+\`\`\`bash
+# Standard execution
+/${name}${args.length > 0 && args[0].required ? ` <${args[0].name}>` : ''}
+
+# With strategic guidance
+/${name}${args.length > 0 && args[0].required ? ` <${args[0].name}>` : ''} --guidance "Focus on security and performance"
+
+# Interactive mode
+/${name} --interactive
+\`\`\`
+
+## Related Workflows
+
+- See other orchestration commands for similar multi-agent patterns
+`;
+}
+/**
+ * Generate command content based on template type
+ */
+export function generateCommandContent(template, name, description, args = [], options = [], guidance, modelRole, modelTier) {
+    switch (template) {
+        case 'utility':
+            return generateUtilityTemplate(name, description, args, options, guidance, modelRole, modelTier);
+        case 'transformation':
+            return generateTransformationTemplate(name, description, args, options, guidance, modelRole, modelTier);
+        case 'orchestration':
+            return generateOrchestrationTemplate(name, description, args, options, guidance, modelRole, modelTier);
+        default:
+            throw new Error(`Unknown template type: ${template}`);
+    }
+}
+//# sourceMappingURL=templates.js.map

package/dist/src/smiths/commandsmith/types.js

@@ -0,0 +1,7 @@
+/**
+ * Type definitions for CommandSmith feature
+ *
+ * CommandSmith generates platform-aware slash commands for agent orchestration.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/smiths/context-pipeline/aiwg-md.js

@@ -0,0 +1,104 @@
+/**
+ * AIWG.md generator — content-rich CLAUDE.md companion for non-Claude providers.
+ *
+ * Per ADR-1 §0.5: AIWG.md at project root has the same content shape as
+ * CLAUDE.md. Both files `@`-reference the project's `.aiwg/AIWG.md` (the
+ * source of truth). Non-Claude providers reach AIWG.md transitively via the
+ * provider startup adapters. WORKSPACE.md and AIWG.md contain
+ * identical framework prose; they exist as two named files because Claude
+ * Code looks for `CLAUDE.md` and the seven AGENTS.md providers reach
+ * AIWG.md via the AGENTS.md hook-up.
+ *
+ * Generation strategy: read the project's CLAUDE.md (which already exists in
+ * a properly-configured repo) and emit AIWG.md as the same content with the
+ * AIWG signature comment in place. If CLAUDE.md is absent (early-init repos),
+ * fall back to a minimal stub that points readers at `.aiwg/AIWG.md`.
+ */
+import { promises as fs } from 'node:fs';
+import * as path from 'node:path';
+import { buildParallelismSection, replaceOrAppendParallelismBlock } from './parallelism-section.js';
+import { buildContextFinalizationBlock, replaceOrAppendFinalizationBlock } from './finalization.js';
+import { buildExternalLinksSection, replaceOrAppendExternalLinksBlock, } from './external-links-section.js';
+const AIWG_SIGNATURE_COMMENT = '<!-- aiwg-managed -->';
+/**
+ * Build the AIWG.md content for emission at project root.
+ *
+ * - When CLAUDE.md exists at project root: copy its content with the AIWG
+ *   signature comment inserted in the second line so future runs of the
+ *   generator know the file is AIWG-managed.
+ * - When CLAUDE.md does not exist: emit a minimal stub directing readers to
+ *   the project's `.aiwg/AIWG.md` source.
+ *
+ * Returns the rendered content as a string. Caller is responsible for the
+ * atomic-write emission and the operator-claimed-file detection.
+ */
+export async function buildAiwgMdContent(projectPath, stagedClaudeMdContent) {
+    let claudeMdContent = stagedClaudeMdContent;
+    if (stagedClaudeMdContent === undefined) {
+        const claudeMdPath = path.join(projectPath, 'CLAUDE.md');
+        try {
+            claudeMdContent = await fs.readFile(claudeMdPath, 'utf8');
+        }
+        catch (err) {
+            if (err.code !== 'ENOENT') {
+                throw err;
+            }
+            claudeMdContent = null;
+        }
+    }
+    // #1362: parallelism cap section, injected after generation so it surfaces
+    // in regenerated context files regardless of CLAUDE.md content.
+    const parallelismSection = await buildParallelismSection(projectPath);
+    const finalizationBlock = await buildContextFinalizationBlock(projectPath);
+    const externalLinksSection = await buildExternalLinksSection(projectPath);
+    if (claudeMdContent) {
+        // Insert the AIWG signature comment as the second line.
+        // Top line is typically `# AIWG` or `# Project` heading; preserve it.
+        const lines = claudeMdContent.split('\n');
+        // #1268: strip `@AIWG.md` self-include directives. CLAUDE.md uses
+        // `@AIWG.md` to pull in the framework context; AIWG.md IS that framework
+        // context, so the directive becomes a self-reference when copied through.
+        // Match the directive when it appears on its own line (possibly indented).
+        const SELF_INCLUDE_PATTERN = /^\s*@AIWG\.md\s*$/;
+        const filtered = lines.filter((line) => !SELF_INCLUDE_PATTERN.test(line));
+        const firstLine = filtered[0] ?? '';
+        const rest = filtered.slice(1);
+        // If the file already carries the signature elsewhere, don't double-insert.
+        const alreadySigned = filtered.slice(0, 4).some((l) => l.includes(AIWG_SIGNATURE_COMMENT));
+        const baseContent = alreadySigned
+            ? filtered.join('\n')
+            : [
+                firstLine,
+                AIWG_SIGNATURE_COMMENT,
+                '<!-- AIWG.md is the CLAUDE.md companion for non-Claude providers; same content. -->',
+                ...rest,
+            ].join('\n');
+        const withParallelism = replaceOrAppendParallelismBlock(baseContent, parallelismSection);
+        const withFinalization = replaceOrAppendFinalizationBlock(withParallelism, finalizationBlock);
+        return replaceOrAppendExternalLinksBlock(withFinalization, externalLinksSection);
+    }
+    // Fallback stub.
+    const stub = [
+        '# AIWG.md',
+        AIWG_SIGNATURE_COMMENT,
+        '<!-- CLAUDE.md companion for non-Claude providers. -->',
+        '',
+        'CLAUDE.md was not found at project root. AIWG.md normally mirrors that content.',
+        'See [.aiwg/AIWG.md](./.aiwg/AIWG.md) for the project framework context.',
+        '',
+    ].join('\n');
+    const withParallelism = replaceOrAppendParallelismBlock(stub, parallelismSection);
+    const withFinalization = replaceOrAppendFinalizationBlock(withParallelism, finalizationBlock);
+    return replaceOrAppendExternalLinksBlock(withFinalization, externalLinksSection);
+}
+/**
+ * Public API: build AIWG.md content for a given project.
+ *
+ * The wrapper exists so future variants (per-provider AIWG.md customization,
+ * AIWG.local.md operator overrides, etc.) have a single entry point in the
+ * surface API without callers reaching into the implementation.
+ */
+export async function generateAiwgMd(projectPath) {
+    return buildAiwgMdContent(projectPath);
+}
+//# sourceMappingURL=aiwg-md.js.map

package/dist/src/smiths/context-pipeline/allowlist.js

@@ -0,0 +1,195 @@
+/**
+ * Path-emission allowlist for AGENTS.md link-index entries.
+ *
+ * Per ADR-1 §2 (security mitigation R2): the generator MUST only emit `Path:` values
+ * that match a path produced by the AIWG-owned ProviderDefinition registry plus
+ * the canonical `~/.agents/skills/` cross-provider user-scope target. Files
+ * deployed by project-local manifests at non-AIWG paths are not indexed. This
+ * closes the link-redirect attack surface where a malicious project-local
+ * artifact could cite a shadow file outside AIWG's path-map domain.
+ */
+import { homedir } from 'node:os';
+import * as path from 'node:path';
+/**
+ * The AIWG-owned path prefixes that may appear in an AGENTS.md link entry.
+ *
+ * Mirrors the per-provider directory list from `ProviderDefinition.paths.artifacts`,
+ * generalized to prefixes (so per-artifact subpaths under each prefix are accepted).
+ *
+ * Sources kept in sync:
+ * - `src/providers/provider-definitions.ts`
+ * - `src/smiths/platform-paths.ts` (TypeScript path resolvers)
+ * - `src/config/aiwg-config.ts`
+ *
+ * If a new platform path is added there, add it here.
+ */
+const AIWG_PATH_PREFIXES_RELATIVE = [
+    // Claude Code
+    '.claude/agents/',
+    '.claude/skills/',
+    '.claude/commands/',
+    '.claude/rules/',
+    '.claude/hooks/',
+    // Factory AI
+    '.factory/droids/',
+    '.factory/skills/',
+    '.factory/commands/',
+    '.factory/rules/',
+    // OpenAI Codex (project scope; user scope handled below via homedir)
+    '.codex/agents/',
+    '.codex/skills/',
+    '.codex/commands/',
+    '.codex/rules/',
+    // OpenCode
+    '.opencode/agent/',
+    '.opencode/skill/',
+    '.opencode/rule/',
+    // Copilot
+    '.github/agents/',
+    '.github/skills/',
+    '.github/copilot-rules/',
+    '.github/prompts/',
+    '.github/instructions/',
+    // Cursor
+    '.cursor/agents/',
+    '.cursor/skills/',
+    '.cursor/commands/',
+    '.cursor/rules/',
+    // Warp
+    '.warp/agents/',
+    '.warp/skills/',
+    '.warp/commands/',
+    '.warp/rules/',
+    // Windsurf
+    '.windsurf/agents/',
+    '.windsurf/skills/',
+    '.windsurf/workflows/',
+    '.windsurf/rules/',
+    // Cross-agent canonical project-scope path (#766 + ADR-1)
+    '.agents/agents/',
+    '.agents/skills/',
+    '.agents/rules/',
+    '.agents/behaviors/',
+];
+/**
+ * User-scope path prefixes (resolved with homedir() at check time).
+ *
+ * Per ADR-4 §2 user-global path map.
+ */
+const AIWG_PATH_PREFIXES_USER = [
+    // Cross-agent canonical user-scope path (ADR-4)
+    '.agents/skills/',
+    // Per-provider user-scope paths
+    '.claude/agents/',
+    '.claude/skills/',
+    '.claude/commands/',
+    '.claude/rules/',
+    '.claude/hooks/',
+    '.codex/skills/',
+    '.codex/prompts/',
+    '.codex/agents/',
+    '.codex/rules/',
+    '.cursor/agents/',
+    '.cursor/skills/',
+    '.cursor/commands/',
+    '.cursor/rules/',
+    '.warp/agents/',
+    '.warp/skills/',
+    '.warp/commands/',
+    '.warp/rules/',
+    '.windsurf/agents/',
+    '.windsurf/skills/',
+    '.windsurf/workflows/',
+    '.windsurf/rules/',
+    '.opencode/agent/',
+    '.opencode/skill/',
+    '.opencode/rule/',
+    '.openclaw/agents/',
+    '.openclaw/skills/',
+    '.openclaw/commands/',
+    '.openclaw/rules/',
+    '.openclaw/behaviors/',
+    '.openclaw/hooks/',
+    '.factory/droids/',
+    '.factory/skills/',
+    '.factory/commands/',
+    '.factory/rules/',
+    '.config/github-copilot/agents/',
+    '.config/github-copilot/prompts/',
+    '.config/github-copilot/instructions/',
+    '.hermes/skills/',
+];
+/**
+ * Check whether a path is allowed in an AGENTS.md link-index entry.
+ *
+ * Accepts both relative project-scope paths and absolute user-scope paths
+ * (rooted in homedir()). Rejects all other paths.
+ *
+ * Path normalization:
+ * - Backslashes are converted to forward slashes for cross-platform compatibility.
+ * - Leading `./` is stripped.
+ * - `..` segments anywhere in the path cause rejection (prevents escaping the project root).
+ */
+export function checkPathAllowed(inputPath) {
+    if (typeof inputPath !== 'string' || inputPath.length === 0) {
+        return { ok: false, rejectedFor: 'empty or non-string path', isUserScope: false };
+    }
+    // Reject any path with a parent-dir traversal segment.
+    const segments = inputPath.split(/[/\\]/);
+    if (segments.includes('..')) {
+        return { ok: false, rejectedFor: 'parent-dir traversal (..) not allowed', isUserScope: false };
+    }
+    // Normalize to forward slashes; strip leading ./
+    let normalized = inputPath.replace(/\\/g, '/');
+    if (normalized.startsWith('./')) {
+        normalized = normalized.slice(2);
+    }
+    // User-scope: starts with ~/ (or absolute home directory)
+    const home = homedir();
+    const homeNormalized = home.replace(/\\/g, '/');
+    let isUserScope = false;
+    let userScopeRelative = '';
+    if (normalized.startsWith('~/')) {
+        isUserScope = true;
+        userScopeRelative = normalized.slice(2);
+    }
+    else if (normalized.startsWith(homeNormalized + '/')) {
+        isUserScope = true;
+        userScopeRelative = normalized.slice(homeNormalized.length + 1);
+    }
+    else if (path.isAbsolute(inputPath)) {
+        return {
+            ok: false,
+            rejectedFor: 'absolute path outside home directory',
+            isUserScope: false,
+        };
+    }
+    if (isUserScope) {
+        for (const prefix of AIWG_PATH_PREFIXES_USER) {
+            if (userScopeRelative === prefix.replace(/\/$/, '') || userScopeRelative.startsWith(prefix)) {
+                return { ok: true, rejectedFor: '', isUserScope: true };
+            }
+        }
+        return {
+            ok: false,
+            rejectedFor: 'user-scope path not in AIWG-owned prefix list',
+            isUserScope: true,
+        };
+    }
+    // Project-scope: must start with one of AIWG_PATH_PREFIXES_RELATIVE.
+    for (const prefix of AIWG_PATH_PREFIXES_RELATIVE) {
+        if (normalized === prefix.replace(/\/$/, '') || normalized.startsWith(prefix)) {
+            return { ok: true, rejectedFor: '', isUserScope: false };
+        }
+    }
+    return {
+        ok: false,
+        rejectedFor: 'project-scope path not in AIWG-owned prefix list',
+        isUserScope: false,
+    };
+}
+export const ALLOWLIST_INTERNALS = {
+    AIWG_PATH_PREFIXES_RELATIVE,
+    AIWG_PATH_PREFIXES_USER,
+};
+//# sourceMappingURL=allowlist.js.map