@aiwg/cli 2026.10.0 → 2026.10.3

package/dist/src/cli/prompt-utils.js

@@ -127,6 +127,78 @@ export async function askChoice(rl, prompt, options, fallback, signal) {
         return pick;
     }, pick, label, promptTimeoutMs(), signal);
 }
+/**
+ * Prompt for a strict, distinguishable consent answer. Two differences from
+ * {@link askYesNo}, both deliberately scoped to this helper so no existing
+ * `askYesNo` call site changes behavior:
+ *
+ * 1. **Strict parsing**: only a trimmed, case-insensitive `y` or `yes`
+ *    counts as yes. `askYesNo`'s `startsWith('y')` would also accept
+ *    `yesterday` or `yolo` — too loose for an irreversible opt-in.
+ * 2. **Answered vs. not-answered**: the caller gets a {@link ConsentOutcome}
+ *    instead of a bare boolean, so a timeout or a closed/EOF'd stdin (the
+ *    `rl.on('close', ...)` listener settles immediately — it does not wait
+ *    out the timeout) is distinguishable from an actual "no" answer. A
+ *    caller that records a persistent decline must only do so for
+ *    `{ kind: 'answered', value: false }`.
+ *
+ * Signal abort still rejects (same contract as {@link askWithTimeout}).
+ */
+export function askConsent(rl, question, timeoutMs = promptTimeoutMs(), signal) {
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const cleanup = () => {
+            clearTimeout(timer);
+            rl.removeListener('close', onClose);
+            signal?.removeEventListener('abort', onAbort);
+        };
+        const timer = setTimeout(() => {
+            if (settled)
+                return;
+            settled = true;
+            ui.warn(`  No input within ${Math.round(timeoutMs / 1000)}s — leaving the setting unchanged.`);
+            cleanup();
+            resolve({ kind: 'timeout' });
+        }, timeoutMs);
+        // See askWithTimeout: unref so a closed event loop never waits on this.
+        timer.unref?.();
+        // Stdin closing (EOF, piped input exhausted, or the interface being
+        // closed elsewhere) must settle immediately, not after the full
+        // timeout — a closed stdin must never hang a consent prompt.
+        const onClose = () => {
+            if (settled)
+                return;
+            settled = true;
+            ui.warn('  Input closed before an answer — leaving the setting unchanged.');
+            cleanup();
+            resolve({ kind: 'closed' });
+        };
+        rl.on('close', onClose);
+        const onAbort = () => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            try {
+                rl.close();
+            }
+            catch { /* already closed */ }
+            reject(signal.reason ?? new Error('Aborted'));
+        };
+        if (signal?.aborted) {
+            onAbort();
+            return;
+        }
+        signal?.addEventListener('abort', onAbort, { once: true });
+        rl.question(question, (answer) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            resolve({ kind: 'answered', value: ['y', 'yes'].includes(answer.trim().toLowerCase()) });
+        });
+    });
+}
 /**
  * Prompt for a labeled selection from a list of options. Renders each option
  * as a numbered line before asking. Users can respond by number (1-based) or

package/dist/src/cli/provider-resolution.js

@@ -19,6 +19,17 @@ function uniqueProviders(providers) {
     }
     return result;
 }
+/**
+ * Sources that say which harness this process is actually running under.
+ * `config`, `deployment` and `default` describe the project, not the session:
+ * a project deployed for one provider is still not "inside" that provider
+ * when a command is run from a plain terminal.
+ */
+const SESSION_PROVIDER_SOURCES = new Set(['explicit', 'env', 'runtime-env', 'process']);
+/** True when a resolution came from the running session rather than project state. */
+export function isSessionProviderResolution(resolution) {
+    return resolution.provider != null && SESSION_PROVIDER_SOURCES.has(resolution.source);
+}
 function detectProviderFromRuntimeEnv(env) {
     const definitions = [...listProviderDefinitions()].sort((a, b) => (a.detection.runtimeEnvPriority ?? Number.MAX_SAFE_INTEGER) - (b.detection.runtimeEnvPriority ?? Number.MAX_SAFE_INTEGER));
     for (const definition of definitions) {

package/dist/src/config/aiwg-config.js

@@ -8,6 +8,13 @@
  *
  * @implements #621
  */
+import { resolveDispatchHostThresholds } from './dispatch-thresholds-runtime.mjs';
+export { DEFAULT_DISPATCH_HOST_THRESHOLDS, resolveDispatchHostThresholds } from './dispatch-thresholds-runtime.mjs';
+import Ajv from 'ajv';
+import addFormats from 'ajv-formats';
+import { readFileSync, existsSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { isCanonicalWorkerModelKey, loadProviderModelCapabilities, resolveWorkerInstallation } from '../models/provider-policy.js';
 import { readFile, writeFile, mkdir, access, readdir, rename, unlink } from 'fs/promises';
 import { createHash, randomBytes } from 'crypto';
 import { resolve, join, dirname, isAbsolute } from 'path';
@@ -162,6 +169,166 @@ export function resolveDelivery(delivery) {
         issue_comment_on_cycle: delivery?.issue_comment_on_cycle ?? true,
     };
 }
+let parallelismValidator;
+/** Offline shape and declaration validation. Qualification is checked at use time. */
+export function validateParallelismConfig(value) {
+    if (value === undefined)
+        return [];
+    if (!parallelismValidator) {
+        const here = dirname(fileURLToPath(import.meta.url));
+        const candidates = [resolve(here, '../../vscode-extension/schemas/aiwg.config.v1.json'), resolve(here, '../../../vscode-extension/schemas/aiwg.config.v1.json')];
+        const file = candidates.find(existsSync);
+        if (!file)
+            throw new Error('Parallelism schema is unavailable');
+        const schema = JSON.parse(readFileSync(file, 'utf8'));
+        const ajv = addFormats(new Ajv({ strict: true, allErrors: true }));
+        parallelismValidator = ajv.compile({ ...schema.properties.parallelism, definitions: schema.definitions });
+    }
+    if (!parallelismValidator(value))
+        return (parallelismValidator.errors ?? []).map(error => `OG_CONFIG_REFERENCE /parallelism${error.instancePath}: ${error.message}`);
+    const policy = value;
+    const errors = [];
+    const error = (pointer, message) => { errors.push(`OG_CONFIG_REFERENCE /parallelism/${pointer}: ${message}`); };
+    const builtinIds = new Set(PROVIDER_IDS.filter(id => id !== 'generic'));
+    for (const [id, installation] of Object.entries(policy.clis ?? {})) {
+        if (installation.adapter.startsWith('providers:') && !builtinIds.has(installation.adapter.slice(10)))
+            error(`clis/${id}/adapter`, 'Unknown provider binding');
+    }
+    for (const [id, group] of Object.entries(policy.groups ?? {})) {
+        const ids = new Set();
+        for (const member of group.members) {
+            if (ids.has(member.id))
+                error(`groups/${id}/members`, 'Duplicate member ID');
+            ids.add(member.id);
+            if (!policy.clis?.[member.cli] && !builtinIds.has(member.cli))
+                error(`groups/${id}/members/${member.id}/cli`, 'Unknown installation');
+        }
+        for (const member of group.fallback ?? [])
+            if (!ids.has(member))
+                error(`groups/${id}/fallback`, 'Unknown fallback member');
+        for (const role of group.requiredRoles ?? []) {
+            if (!group.members.some(m => m.enabled !== false && policy.clis?.[m.cli]?.enabled !== false && m.roles.includes(role)))
+                error(`groups/${id}/requiredRoles`, `No enabled member covers ${role}`);
+        }
+    }
+    const admission = policy.admission;
+    for (const group of Object.keys(admission?.groupCaps ?? {}))
+        if (!policy.groups?.[group])
+            error('admission/groupCaps', 'Unknown group');
+    for (const cli of Object.keys(admission?.cliCaps ?? {}))
+        if (!policy.clis?.[cli] && !builtinIds.has(cli))
+            error('admission/cliCaps', 'Unknown installation');
+    for (const key of Object.keys(admission?.memberCaps ?? {})) {
+        const [group, member, extra] = key.split('/');
+        if (extra !== undefined || !policy.groups?.[group]?.members.some(m => m.id === member))
+            error('admission/memberCaps', 'Unknown group/member');
+    }
+    for (const key of Object.keys(admission?.modelCaps ?? {}))
+        if (!isCanonicalWorkerModelKey(key))
+            error('admission/modelCaps', 'Noncanonical inference model key');
+    if (admission?.hostResources !== undefined) {
+        try {
+            resolveDispatchHostThresholds(undefined, admission.hostResources);
+        }
+        catch (validation) {
+            error('admission/hostResources', validation instanceof Error ? validation.message : String(validation));
+        }
+    }
+    errors.push(...validateWorkerHealthConfig(policy.health));
+    return errors;
+}
+/** Cross-field health preferences are validated offline; controls are qualified at dispatch. */
+export function validateWorkerHealthConfig(health) {
+    if (health === undefined)
+        return [];
+    const errors = [];
+    const error = (field, message) => { errors.push(`OG_CONFIG_REFERENCE /parallelism/health/${field}: ${message}`); };
+    const checkSeconds = health.checkSeconds ?? 15;
+    if (checkSeconds > (health.startupSeconds ?? 60))
+        error('checkSeconds', 'Must not exceed startupSeconds');
+    if ((health.quietSeconds ?? 90) >= (health.stallSeconds ?? 300))
+        error('quietSeconds', 'Must be less than stallSeconds');
+    if ((health.cooldownSeconds ?? 120) > (health.maxCooldownSeconds ?? 900))
+        error('cooldownSeconds', 'Must not exceed maxCooldownSeconds');
+    for (const role of Object.keys(health.roleScale ?? {})) {
+        if (!['efficiency', 'coding', 'reasoning'].includes(role))
+            error('roleScale', `Unknown role ${role}`);
+    }
+    for (const field of ['modelScale', 'modelStartupSeconds']) {
+        for (const [key, value] of Object.entries(health[field] ?? {})) {
+            if (!isCanonicalWorkerModelKey(key))
+                error(field, 'Noncanonical inference model key');
+            if (field === 'modelStartupSeconds' && checkSeconds > value)
+                error(field, 'Model startup must cover checkSeconds');
+        }
+    }
+    return errors;
+}
+/** Resolve one enabled installation through trusted metadata, without probes.
+ * Implicit canonical IDs inherit current-account auth; no account/quota identity
+ * is invented. Profile qualification remains the invocation owner's obligation.
+ */
+export function resolveWorkerGroupInstallation(parallelism, installationId, registry = loadProviderModelCapabilities()) {
+    const errors = validateParallelismConfig(parallelism);
+    if (errors.length)
+        throw new Error(errors.join('; '));
+    if (!parallelism.worker_dispatch)
+        throw new Error('OG_CONFIG_REFERENCE /parallelism/worker_dispatch: Worker dispatch is disabled');
+    const explicit = parallelism.clis?.[installationId];
+    const installation = explicit
+        ? structuredClone(explicit)
+        : { adapter: `providers:${installationId}`, enabled: true };
+    if (!explicit && (!PROVIDER_IDS.includes(installationId) || installationId === 'generic')) {
+        throw new Error(`OG_CONFIG_REFERENCE /parallelism/clis/${installationId}: Unknown canonical installation`);
+    }
+    if (installation.enabled === false)
+        throw new Error(`OG_CONFIG_REFERENCE /parallelism/clis/${installationId}: Installation is disabled`);
+    try {
+        return { installation: { ...installation, enabled: true }, ...resolveWorkerInstallation(registry, installation) };
+    }
+    catch (error) {
+        throw new Error(`OG_ADAPTER_UNQUALIFIED /parallelism/clis/${installationId}: ${error}`);
+    }
+}
+/** Validate current model restrictions and group references before any write.
+ * Disabled/unbound projects retain their existing config-only edit behavior.
+ * This is shared validation, not Tier 1 coherent activation.
+ *
+ * `options.aiwgHome`, when provided, is passed through to `ConfigLoader`
+ * unchanged — it never reads or writes `process.env.AIWG_HOME`. Omitting it
+ * keeps `ConfigLoader`'s own default precedence (`AIWG_HOME` env, else the
+ * user-home install).
+ */
+export async function validateWorkerConfigCandidate(projectDir, config, options) {
+    const errors = validateParallelismConfig(config.parallelism);
+    if (errors.length)
+        throw new Error(errors.join('; '));
+    if (!config.parallelism?.worker_dispatch)
+        return;
+    const { ConfigLoader } = await import('../models/config-loader.js');
+    await new ConfigLoader(projectDir, options).load(config.parallelism);
+}
+/** Hash canonical JSON, treating absent optional model files as null. */
+export function workerConfigDigest(value) {
+    const canonical = (node) => {
+        if (Array.isArray(node))
+            return node.map(canonical);
+        if (node !== null && typeof node === 'object')
+            return Object.fromEntries(Object.keys(node).sort().filter(key => node[key] !== undefined).map(key => [key, canonical(node[key])]));
+        return node ?? null;
+    };
+    return `sha256:${createHash('sha256').update(JSON.stringify(canonical(value))).digest('hex')}`;
+}
+export function workerActivationDigests(config, projectModels, userModels, builtinModels) {
+    const candidate = structuredClone(config);
+    if (candidate.parallelism)
+        delete candidate.parallelism.activation;
+    return { configDigest: workerConfigDigest(candidate), projectModelsDigest: workerConfigDigest(projectModels), userModelsDigest: workerConfigDigest(userModels), builtinModelsDigest: workerConfigDigest(builtinModels) };
+}
+/** Pure inventory only: this does not activate, lock, synchronize, or admit work. */
+export function workerActivationCopyInventory(projectDir, compatibilityConfig, userModels, builtinModels) {
+    return [...new Set([getConfigPath(projectDir), join(projectDir, 'models.json'), compatibilityConfig, userModels, builtinModels].map(file => resolve(file)))];
+}
 /**
  * Per-provider parallelism defaults. Conservative numbers for Anthropic-backed
  * providers reflect Pro/Team-plan rate limits — operators on Enterprise tiers
@@ -235,6 +402,30 @@ export function resolveParallelism(parallelism, primaryProvider) {
     };
     if (parallelism?.rationale !== undefined)
         resolved.rationale = parallelism.rationale;
+    const errors = validateParallelismConfig(parallelism);
+    if (errors.length)
+        throw new Error(errors.join('; '));
+    if (parallelism?.worker_dispatch) {
+        Object.assign(resolved, Object.fromEntries(Object.entries(structuredClone(parallelism)).filter(([, value]) => value !== undefined)));
+        resolved.worker_mode ??= 'direct';
+        for (const group of Object.values(resolved.groups ?? {})) {
+            group.fallback ??= [];
+            group.requiredRoles ??= [];
+            group.execution = { isolation: 'worktree', sandbox: 'workspace-write', approval: 'never', network: 'deny', transport: 'shell', receipts: 'optional', ...group.execution };
+            for (const member of group.members) {
+                member.enabled ??= true;
+                member.priority ??= 50;
+            }
+        }
+        for (const cli of Object.values(resolved.clis ?? {}))
+            cli.enabled ??= true;
+        if (resolved.admission)
+            resolved.admission = { maxQueued: 128, queueTimeoutSeconds: 300, leaseSeconds: 60, authorityRef: 'project', ...resolved.admission };
+        if (resolved.budgets)
+            resolved.budgets = { enforcement: 'observed', unknownCost: 'deny', ...resolved.budgets };
+        if (resolved.retry)
+            resolved.retry = { maxAttempts: 3, on: ['rate-limit', 'unavailable', 'timeout'], baseDelaySeconds: 2, maxDelaySeconds: 60, ...resolved.retry };
+    }
     return resolved;
 }
 const GRAPH_BACKENDS = ['json', 'graphology', 'sqlite'];
@@ -826,24 +1017,35 @@ export function getProjectDir(ctx, args = []) {
     return targetValue || ctx?.cwd || process.cwd();
 }
 /**
- * Read .aiwg/aiwg.config.
+ * Read and independently validate .aiwg/aiwg.config EXCEPT for the
+ * worker-model defaults step (`validateWorkerConfigCandidate`), which needs
+ * its own `aiwgHome` resolution and can fail solely because the bundled
+ * model defaults are unreachable. Callers that want to degrade gracefully
+ * on that one failure mode (e.g. generated-context rendering) read the
+ * candidate here, then call `validateWorkerConfigCandidate` themselves and
+ * handle its failure explicitly. `readAiwgConfig` below is the composition
+ * of both steps for callers that want the original all-or-nothing contract.
  * Returns null if the file does not exist.
  */
-export async function readAiwgConfig(projectDir) {
+export async function readAiwgConfigCandidate(projectDir) {
     const localPath = getConfigPath(projectDir);
     const artifactPath = projectAiwgPath(projectDir, CONFIG_FILENAME);
     let filePath = localPath;
     try {
         await access(localPath);
     }
-    catch {
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
         if (artifactPath === localPath)
             return null;
         try {
             await access(artifactPath);
             filePath = artifactPath;
         }
-        catch {
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
             return null;
         }
     }
@@ -873,6 +1075,7 @@ export async function readAiwgConfig(projectDir) {
     const threatAssessmentErrors = [
         ...validateThreatAssessmentConfig(parsed.security?.threatAssessment),
         ...validateProjectConfig(parsed.project),
+        ...validateParallelismConfig(parsed.parallelism),
     ];
     if (threatAssessmentErrors.length > 0) {
         throw new Error(`Invalid .aiwg/aiwg.config:\n${threatAssessmentErrors.join('\n')}`);
@@ -894,6 +1097,22 @@ export async function readAiwgConfig(projectDir) {
     }
     return parsed;
 }
+/**
+ * Read .aiwg/aiwg.config, including worker-model default validation.
+ * Returns null if the file does not exist.
+ *
+ * `aiwgHome` (optional) resolves the bundled AIWG model-defaults location
+ * passed through to `validateWorkerConfigCandidate` / `ConfigLoader`,
+ * without ever reading or writing `process.env.AIWG_HOME`. Omit it to keep
+ * the default precedence (`AIWG_HOME` env, else the user-home install).
+ */
+export async function readAiwgConfig(projectDir, options) {
+    const parsed = await readAiwgConfigCandidate(projectDir);
+    if (!parsed)
+        return null;
+    await validateWorkerConfigCandidate(projectDir, parsed, options);
+    return parsed;
+}
 /**
  * Write aiwg.config to the repository-local control plane. When a reachable
  * external corpus also carries the compatibility control copy, keep it in
@@ -903,6 +1122,7 @@ export async function writeAiwgConfig(projectDir, config) {
     const threatAssessmentErrors = [
         ...validateThreatAssessmentConfig(config.security?.threatAssessment),
         ...validateProjectConfig(config.project),
+        ...validateParallelismConfig(config.parallelism),
     ];
     if (threatAssessmentErrors.length > 0) {
         throw new Error(`Invalid .aiwg/aiwg.config:\n${threatAssessmentErrors.join('\n')}`);
@@ -916,6 +1136,7 @@ export async function writeAiwgConfig(projectDir, config) {
     const gatesErrors = validateGatesConfig(config.gates);
     if (gatesErrors.length > 0)
         throw new Error(`Invalid .aiwg/aiwg.config:\n${gatesErrors.join('\n')}`);
+    await validateWorkerConfigCandidate(projectDir, config);
     const localPath = getConfigPath(projectDir);
     const artifactDir = resolveProjectAiwgDir(projectDir);
     const artifactPath = join(artifactDir, CONFIG_FILENAME);
@@ -1134,4 +1355,47 @@ export async function populateDeployedTo(config, projectDir) {
     }
     return config;
 }
+/** Shape validation alone cannot infer process/HTTP metadata or model authority. */
+export function validateWorkerInstallationBindings(parallelism, adapters) {
+    const errors = [];
+    for (const [id, cli] of Object.entries(parallelism.clis ?? {})) {
+        if (cli.enabled === false)
+            continue;
+        const metadata = adapters[cli.adapter];
+        if (!metadata)
+            errors.push(`OG_ADAPTER_UNQUALIFIED /parallelism/clis/${id}/adapter: Unknown trusted binding`);
+        else if (metadata.transport === 'http' ? (!cli.endpoint || cli.executable !== undefined) : (cli.endpoint !== undefined || !(cli.executable ?? metadata.executable)))
+            errors.push(`OG_CONFIG_REFERENCE /parallelism/clis/${id}: Invalid transport binding`);
+    }
+    return errors;
+}
+export function validateWorkerGroupReferences(parallelism, selection, qualifiedRoles) {
+    const errors = validateParallelismConfig(parallelism);
+    if (errors.length)
+        return errors;
+    for (const [role, guidance] of Object.entries(selection.roleGuidance ?? {})) {
+        for (const group of guidance.groups)
+            if (!parallelism.groups?.[group])
+                errors.push(`OG_CONFIG_REFERENCE /defaults/workerSelection/roleGuidance/${role}/groups: Unknown group ${group}`);
+    }
+    if (qualifiedRoles)
+        for (const [id, group] of Object.entries(parallelism.groups ?? {})) {
+            for (const role of group.requiredRoles ?? [])
+                if (!group.members.some(m => m.enabled !== false && parallelism.clis?.[m.cli]?.enabled !== false && m.roles.includes(role) && qualifiedRoles[`${id}/${m.id}`]?.includes(role)))
+                    errors.push(`OG_ADAPTER_UNQUALIFIED /parallelism/groups/${id}/requiredRoles: No qualified route covers ${role}`);
+        }
+    return errors;
+}
+/** A configured hard ceiling is eligible only where a qualified control enforces it. */
+export function validateWorkerBudgetEnforcement(budgets, enforceable) {
+    if (budgets?.enforcement !== 'hard')
+        return [];
+    const errors = [];
+    for (const scope of ['perRun', 'perTask'])
+        for (const dimension of ['tokens', 'costUsd', 'wallSeconds']) {
+            if (budgets[scope]?.[dimension] !== undefined && !enforceable.includes(dimension))
+                errors.push(`OG_BUDGET_UNMEASURABLE /parallelism/budgets/${scope}/${dimension}: No qualified enforcing control`);
+        }
+    return errors;
+}
 //# sourceMappingURL=aiwg-config.js.map