@aiwg/cli 2026.10.0 → 2026.10.3

package/dist/src/mcp/tool-filters.mjs

@@ -0,0 +1,357 @@
+/**
+ * MCP profile tool filters.
+ *
+ * A profile's providerOverrides hold toolDeny / toolAllow patterns of the form
+ * `<server>__<tool>`, where <tool> may contain `*`. The `*` provider key applies
+ * to every harness; a harness's own key adds to it.
+ *
+ * Each harness enforces tool filters differently, and some not at all:
+ *
+ *   claude-code  permissions.deny rules `mcp__<server>__<tool>` in
+ *                .claude/settings.local.json (project) or ~/.claude/settings.json (user).
+ *                toolAllow is refused: Claude has no restrict-only allowlist.
+ *                https://code.claude.com/docs/en/permissions
+ *   codex        per-server disabled_tools / enabled_tools, exact names; enabled = false
+ *                for a whole-server deny. https://learn.chatgpt.com/docs/extend/mcp
+ *   opencode     top-level tools map of `<server>_<tool>` globs; the last matching entry
+ *                wins. https://opencode.ai/docs/mcp-servers
+ *   factory      per-server disabledTools; disabled = true for a whole-server deny.
+ *                https://docs.factory.com/cli/configuration/mcp
+ *   windsurf     per-server disabledTools. https://docs.devin.ai/desktop/cascade/mcp
+ *   antigravity  per-server disabledTools; disabled = true for a whole-server deny.
+ *                https://antigravity.google/docs/mcp
+ *
+ * Cursor, Warp, OMP and Grok Build document no file-level tool filter.
+ * Anything a harness cannot express is returned as a warning, never dropped silently.
+ */
+
+import { readFile } from 'fs/promises';
+import { createHash } from 'node:crypto';
+import { assertConfigDestination, canonicalConfigPath, prepareConfigWrite, writeConfigTransaction } from './config-file.mjs';
+import { resolve } from 'path';
+import { homedir } from 'os';
+import { normalizeRuntimeProviderId } from '../providers/provider-definitions.mjs';
+
+const PER_SERVER_DISABLED_TOOLS = new Set(['factory', 'windsurf', 'antigravity']);
+const SERVER_DISABLE_KEY = { factory: 'disabled', antigravity: 'disabled' };
+
+function unique(values) {
+  return [...new Set(values)];
+}
+
+/** Merge the `*` overrides with the harness's own. Keys are normalized, so `claude` and `claude-code` both apply. */
+export function resolveToolFilters(profile, provider) {
+  const target = normalizeRuntimeProviderId(provider) || provider;
+  const deny = [];
+  const allow = [];
+  for (const [key, override] of Object.entries(profile?.providerOverrides || {})) {
+    if (key !== '*' && (normalizeRuntimeProviderId(key) || key) !== target) continue;
+    deny.push(...(override?.toolDeny || []));
+    allow.push(...(override?.toolAllow || []));
+  }
+  return { deny: unique(deny), allow: unique(allow) };
+}
+
+export function hasToolFilters(filters) {
+  return Boolean(filters && (filters.deny.length > 0 || filters.allow.length > 0));
+}
+
+/** Split `<server>__<tool>`; returns null when there is no server part. */
+export function parseToolPattern(pattern) {
+  const index = pattern.indexOf('__');
+  if (index <= 0 || index + 2 >= pattern.length) return null;
+  return { server: pattern.slice(0, index), tool: pattern.slice(index + 2) };
+}
+
+const isGlob = value => value.includes('*');
+
+/**
+ * Group patterns by injected server. Patterns for servers outside the injected
+ * set do not apply; malformed patterns and glob server names are warnings.
+ */
+function groupByServer(patterns, serverNames, kind, warnings) {
+  const groups = new Map();
+  for (const pattern of patterns) {
+    const parsed = parseToolPattern(pattern);
+    if (!parsed || isGlob(parsed.server)) {
+      warnings.push(`${kind} pattern "${pattern}" is not <server>__<tool> with a literal server name; not rendered.`);
+      continue;
+    }
+    if (!serverNames.includes(parsed.server)) continue;
+    if (!groups.has(parsed.server)) groups.set(parsed.server, []);
+    groups.get(parsed.server).push(parsed.tool);
+  }
+  return groups;
+}
+
+/** Claude Code and opencode name a server's tools after the server with these characters replaced. */
+const sanitize = value => value.replace(/[^a-zA-Z0-9_-]/g, '_');
+
+/**
+ * Compute what a harness should receive.
+ *
+ * Returns:
+ *   serverFields      per-server fields to merge into each entry (JSON harnesses)
+ *   tomlLines         per-server TOML lines to append to each [mcp_servers.<name>] table
+ *   topLevel          fields to merge into the harness config root (opencode `tools`)
+ *   claudePermissions permission rules for Claude Code's settings file
+ *   warnings          filters the harness cannot express
+ */
+export function planToolFilters(provider, serverNames, filters) {
+  const target = normalizeRuntimeProviderId(provider) || provider;
+  const plan = { serverFields: {}, tomlLines: {}, topLevel: {}, claudePermissions: null, warnings: [] };
+  if (target === 'claude-code' && filters?.allow.length) {
+    throw new Error(`claude-code: refusing toolAllow patterns ${filters.allow.map(pattern => JSON.stringify(pattern)).join(', ')}: `
+      + 'Claude Code has no restrict-only allowlist. permissions.allow pre-approves tools; deny rules cannot express all except, '
+      + 'and allow rules cannot carve exceptions out of deny rules. Use toolDeny instead.');
+  }
+  if (!hasToolFilters(filters)) return plan;
+  const deny = groupByServer(filters.deny, serverNames, 'toolDeny', plan.warnings);
+  const allow = groupByServer(filters.allow, serverNames, 'toolAllow', plan.warnings);
+  if (deny.size === 0 && allow.size === 0) return plan;
+
+  if (target === 'claude-code') {
+    const rule = (server, tool) => (tool === '*' ? `mcp__${sanitize(server)}` : `mcp__${sanitize(server)}__${tool}`);
+    const denyRules = [...deny].flatMap(([server, tools]) => tools.map(tool => rule(server, tool)));
+    plan.claudePermissions = { deny: unique(denyRules), allow: [] };
+    return plan;
+  }
+
+  if (target === 'opencode') {
+    const tools = {};
+    for (const server of allow.keys()) tools[`${sanitize(server)}_*`] = false;
+    for (const [server, list] of deny) {
+      for (const tool of list) {
+        const key = `${sanitize(server)}_${tool}`;
+        delete tools[key];
+        tools[key] = false;
+      }
+    }
+    // Specific allows follow denies under last-match-wins. An identical deny key wins.
+    for (const [server, list] of allow) {
+      for (const tool of list) {
+        if (deny.get(server)?.includes(tool)) continue;
+        const key = `${sanitize(server)}_${tool}`;
+        delete tools[key];
+        tools[key] = true;
+      }
+    }
+    plan.topLevel.tools = tools;
+    return plan;
+  }
+
+  if (target === 'codex') {
+    if (allow.size) {
+      const unrestricted = serverNames.filter(name => !allow.has(name) && !deny.get(name)?.includes('*'));
+      if (unrestricted.length) {
+        plan.warnings.push(`codex: toolAllow is per-server; servers without an allowlist remain unrestricted by toolAllow: ${unrestricted.join(', ')}. Add toolAllow patterns or toolDeny <server>__* for them.`);
+      }
+    }
+    for (const name of serverNames) {
+      const lines = [];
+      const denied = deny.get(name) || [];
+      const allowed = allow.get(name) || [];
+      if (denied.includes('*')) {
+        plan.tomlLines[name] = ['enabled = false'];
+        continue;
+      }
+      const exact = (list, kind) => list.filter(tool => {
+        if (!isGlob(tool)) return true;
+        plan.warnings.push(`codex: ${kind} "${name}__${tool}" is a glob; Codex matches tool names exactly, so it is not rendered.`);
+        return false;
+      });
+      const enabled = allowed.includes('*') ? [] : exact(allowed, 'toolAllow');
+      const disabled = exact(denied, 'toolDeny');
+      if (enabled.length > 0) lines.push(`enabled_tools = [${enabled.map(tool => JSON.stringify(tool)).join(', ')}]`);
+      if (disabled.length > 0) lines.push(`disabled_tools = [${disabled.map(tool => JSON.stringify(tool)).join(', ')}]`);
+      if (lines.length > 0) plan.tomlLines[name] = lines;
+    }
+    return plan;
+  }
+
+  if (PER_SERVER_DISABLED_TOOLS.has(target)) {
+    for (const [server, list] of deny) {
+      if (list.includes('*')) {
+        const key = SERVER_DISABLE_KEY[target];
+        if (key) plan.serverFields[server] = { [key]: true };
+        else plan.warnings.push(`${target}: toolDeny "${server}__*" disables a whole server, which ${target} has no documented file key for; not rendered.`);
+        continue;
+      }
+      const exact = list.filter(tool => {
+        if (!isGlob(tool)) return true;
+        plan.warnings.push(`${target}: toolDeny "${server}__${tool}" is a glob; disabledTools takes exact names, so it is not rendered.`);
+        return false;
+      });
+      if (exact.length > 0) plan.serverFields[server] = { disabledTools: exact };
+    }
+    for (const server of allow.keys()) {
+      plan.warnings.push(`${target}: toolAllow for "${server}" is not rendered; ${target} has no tool allowlist.`);
+    }
+    return plan;
+  }
+
+  plan.warnings.push(`${target}: tool filters are not rendered; ${target} documents no per-tool filter in its MCP config.`);
+  return plan;
+}
+
+/** Merge the per-server fields and top-level fields of a plan into a JSON harness config. */
+export function applyJsonToolFilterPlan(config, serversKey, plan) {
+  const servers = config[serversKey] || {};
+  for (const [name, fields] of Object.entries(plan.serverFields)) {
+    if (servers[name]) {
+      const previous = servers[name];
+      if (Object.hasOwn(previous, 'disabledTools') && !Array.isArray(previous.disabledTools)) {
+        throw new Error(`Refusing tool filters for server "${name}": existing disabledTools must be an array`);
+      }
+      servers[name] = { ...previous, ...fields };
+      if (fields.disabledTools && Array.isArray(previous.disabledTools)) {
+        servers[name].disabledTools = unique([...previous.disabledTools, ...fields.disabledTools]);
+      }
+    }
+  }
+  if (plan.topLevel.tools) {
+    const tools = { ...(config.tools || {}) };
+    // opencode uses last-match-wins, including when an existing wildcard conflicts.
+    for (const key of Object.keys(plan.topLevel.tools)) delete tools[key];
+    config.tools = { ...tools, ...plan.topLevel.tools };
+  }
+  return config;
+}
+
+export function claudeSettingsPath(projectDir = '.', scope = 'project') {
+  if (scope === 'user') return resolve(process.env.HOME || process.env.USERPROFILE || homedir(), '.claude/settings.json');
+  return resolve(projectDir, '.claude/settings.local.json');
+}
+
+const isObject = value => value !== null && typeof value === 'object' && !Array.isArray(value);
+const digest = value => createHash('sha256').update(value).digest('hex');
+
+function validateSettings(settings, settingsPath) {
+  if (!isObject(settings)) throw new Error(`Claude Code settings ${settingsPath} must contain an object`);
+  if (Object.hasOwn(settings, 'permissions')) {
+    if (!isObject(settings.permissions)) {
+      throw new Error(`Claude Code settings ${settingsPath}: permissions must be an object`);
+    }
+    for (const key of ['allow', 'deny', 'ask', 'additionalDirectories']) {
+      if (Object.hasOwn(settings.permissions, key)
+        && (!Array.isArray(settings.permissions[key]) || settings.permissions[key].some(rule => typeof rule !== 'string'))) {
+        throw new Error(`Claude Code settings ${settingsPath}: permissions.${key} must be an array of strings`);
+      }
+    }
+  }
+}
+
+/** Validate destinations and settings before any MCP writes; keep ownership outside Claude's schema. */
+export async function prepareClaudePermissions(settingsPath, permissions, {
+  userScope = false, projectRoot, managedDir, sidecar = false, mcpPath,
+} = {}) {
+  if (permissions.allow?.length) {
+    throw new Error(`Claude Code: refusing permissions.allow ${permissions.allow.map(rule => JSON.stringify(rule)).join(', ')}: no restrict-only allowlist; use permissions.deny instead.`);
+  }
+  settingsPath = resolve(settingsPath);
+  if (mcpPath && settingsPath === resolve(mcpPath)) {
+    throw new Error(`Refusing Claude Code settings sidecar ${settingsPath}: collides with MCP config`);
+  }
+  const info = await assertConfigDestination(settingsPath, projectRoot);
+  if (mcpPath && info) {
+    const mcpInfo = await assertConfigDestination(mcpPath, projectRoot);
+    if (mcpInfo && info.dev === mcpInfo.dev && info.ino === mcpInfo.ino) {
+      throw new Error(`Refusing Claude Code settings sidecar ${settingsPath}: collides with MCP config`);
+    }
+  }
+  let content;
+  let existing = {};
+  if (info) {
+    content = await readFile(settingsPath, 'utf-8');
+    try {
+      existing = JSON.parse(content);
+    } catch (error) {
+      if (error instanceof SyntaxError) {
+        throw new Error(`Refusing to overwrite malformed Claude Code settings ${settingsPath}: invalid JSON`);
+      }
+      throw error;
+    }
+  }
+  validateSettings(existing, settingsPath);
+
+  const canonicalPath = await canonicalConfigPath(settingsPath);
+  const recordPath = managedDir ? resolve(managedDir, 'claude-tool-permissions', `${digest(canonicalPath)}.json`) : null;
+  let record = null;
+  if (recordPath && await assertConfigDestination(recordPath, managedDir)) {
+    try {
+      record = JSON.parse(await readFile(recordPath, 'utf-8'));
+      if (!isObject(record) || record.settingsPath !== canonicalPath || !Array.isArray(record.denyAdded)
+        || record.denyAdded.some(rule => typeof rule !== 'string')
+        || (record.denyDigest !== undefined && (typeof record.denyDigest !== 'string' || !/^[a-f0-9]{64}$/.test(record.denyDigest)))
+        || (record.denyPreserved !== undefined && (!Array.isArray(record.denyPreserved)
+          || record.denyPreserved.some(rule => typeof rule !== 'string' || !record.denyAdded.includes(rule))))) {
+        throw new Error('unsupported ownership record shape');
+      }
+    } catch (error) {
+      throw new Error(`Invalid Claude permission ownership record ${recordPath}: ${error.message}. Delete ${recordPath} to reset ownership; existing deny rules will be treated as user-owned.`);
+    }
+  }
+  if (sidecar && info && (!record?.sidecar || record.contentDigest !== digest(content))) {
+    throw new Error(`Refusing implicit Claude Code settings sidecar ${settingsPath}: existing file was not created by AIWG or was changed. Choose another --out path.`);
+  }
+  if (sidecar && !recordPath) throw new Error('Claude settings sidecars require an ownership record directory');
+
+  const desired = unique(permissions.deny);
+  const current = existing.permissions || {};
+  const deny = [...(current.deny || [])];
+  const owned = [];
+  const preserved = [];
+  const warnings = [];
+  const unchangedDeny = record?.denyDigest === digest(JSON.stringify(deny));
+  for (const rule of record?.denyAdded || []) {
+    const index = deny.indexOf(rule);
+    if (index < 0) continue;
+    if (!unchangedDeny || record.denyPreserved?.includes(rule)) {
+      owned.push(rule);
+      preserved.push(rule);
+    } else if (desired.includes(rule)) owned.push(rule);
+    else deny.splice(index, 1); // Remove only our occurrence; preserve user-added duplicates.
+  }
+  for (const rule of desired) {
+    if (deny.includes(rule)) continue; // A pre-existing user rule never becomes AIWG-owned.
+    deny.push(rule);
+    owned.push(rule);
+  }
+  const retained = preserved.filter(rule => !desired.includes(rule));
+  if (retained.length) {
+    warnings.push(`Claude Code settings ${settingsPath}: preserving previously tracked deny rules because permissions.deny changed or ownership is uncertain: ${unique(retained).join(', ')}. Remove these rules manually from permissions.deny in ${settingsPath} if no longer wanted.`);
+  }
+  const active = Boolean(record || desired.length || sidecar);
+  const merged = active ? { ...existing, permissions: { ...current, deny } } : existing;
+  const nextContent = JSON.stringify(merged, null, 2) + '\n';
+  const writes = active ? [{
+    file: settingsPath, content: nextContent,
+    options: { userScope: userScope || sidecar, projectRoot, newFileMode: 0o600 },
+  }] : [];
+  if (active && recordPath) {
+    writes.push({
+      file: recordPath,
+      content: JSON.stringify({
+        settingsPath: canonicalPath, denyAdded: owned, denyPreserved: unique(preserved),
+        denyDigest: digest(JSON.stringify(deny)), sidecar,
+        ...(sidecar ? { contentDigest: digest(nextContent) } : {}),
+      }, null, 2) + '\n',
+      options: { userScope: true, projectRoot: managedDir },
+    });
+  }
+  for (const { file, options } of writes) await prepareConfigWrite(file, options);
+  return {
+    merged, active, warnings, writes,
+    async commit() { await writeConfigTransaction(writes); },
+  };
+}
+
+/** Merge deny rules after validation, optionally tracking ownership for profile switching. */
+export async function mergeClaudePermissions(settingsPath, permissions, { dryRun = false, ...options } = {}) {
+  const prepared = await prepareClaudePermissions(settingsPath, permissions, options);
+  if (!dryRun) {
+    await prepared.commit();
+    for (const warning of prepared.warnings) console.warn(`WARNING ${warning}`);
+  }
+  return prepared.merged;
+}

package/dist/src/mcp/tools/agentic-sandbox.mjs

@@ -10,7 +10,7 @@
 
 import { readFile, stat } from 'node:fs/promises';
 import { z } from 'zod';
-import { mcpError, mcpJson } from '../helpers.mjs';
+import { assertNoWorkerBinding, mcpError, mcpJson } from '../helpers.mjs';
 
 const FLEET_VERSION = 'agentic-orchestration/v1';
 const ACTIVITY_VERSION = 'activity.event/v1';
@@ -143,6 +143,7 @@ export class AgenticSandboxMcpClient {
   }
 
   async request(path, { method = 'GET', body, headers = {}, validate = (value) => safeResponse(value) } = {}) {
+    assertNoWorkerBinding(body, 'mcp');
     const baseUrl = configuredBaseUrl(this.env);
     const token = await managementBearer(this.env);
     const response = await this.fetch(`${baseUrl}${path}`, {
@@ -158,6 +159,7 @@ export class AgenticSandboxMcpClient {
       else return mcpError(`sandbox returned non-JSON HTTP ${response.status}`);
     }
     try {
+      assertNoWorkerBinding(parsed, 'mcp');
       return typedResult(parsed, response.status, validate);
     } catch (error) {
       return mcpError(`${error.code ?? 'sandbox_malformed_response'}: ${error.message}`);

package/dist/src/mcp/tools/decision.mjs

@@ -82,6 +82,21 @@ const SYNTHETIC_SETUP = z.object({
   pattern: z.object({ id: z.string(), version: z.string() }).passthrough(),
   files: z.record(z.string(), z.unknown()),
 }).passthrough();
+const ASK = z.object({
+  schema: z.literal('aiwg-decision-ask/v1'),
+  status: z.enum(['answered', 'fallback']),
+  answer: z.union([z.string(), z.boolean(), z.number()]).nullable(),
+  confidence: z.number().min(0).max(1).nullable(),
+  probability: z.number().min(0).max(1).optional(),
+  fallback: z.enum(['llm']).nullable(),
+  reason: z.string(),
+  model: z.string().nullable(),
+  usage: z.object({
+    inputTokens: z.number().int().nonnegative().nullable(),
+    outputTokens: z.number().int().nonnegative().nullable(),
+  }).nullable(),
+  latencyMs: z.number().nonnegative(),
+}).passthrough();
 
 let driverPromise;
 
@@ -176,6 +191,49 @@ export function registerDecisionToolset(server) {
     annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
   }, async ({ profile, opt_in }) => (await driver()).evaluateMcpProfile(profile, opt_in, options()), EVALUATE);
 
+  registerJsonTool(server, 'decision-ask', {
+    title: 'Ask bounded Jev decision',
+    description: 'Ask a bounded yes/no, choice, or small ordinal decision. Falls back to the caller on missing setup or low confidence.',
+    inputSchema: {
+      question: z.string().min(1),
+      yes_no: z.boolean().default(false),
+      choices: z.array(z.string()).min(2).max(255).optional().describe('Choice ids, each optionally written as id=description so Jev knows what the option means'),
+      scale: z.object({ low: z.number().int(), high: z.number().int() }).optional(),
+      context: z.string().optional(),
+      threshold: z.number().min(0).max(1).default(0.8),
+      timeout_ms: z.number().int().positive().default(15000),
+      caller: z.string().optional().describe('Optional decision-point attribution tag, recorded in the decision ledger (#2946)'),
+    },
+    annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: true },
+  }, async ({ question, yes_no, choices, scale, context, threshold, timeout_ms, caller }) => {
+    const modeCount = (yes_no ? 1 : 0) + (choices ? 1 : 0) + (scale ? 1 : 0);
+    if (modeCount !== 1) throw new Error('Select exactly one of yes_no, choices, or scale');
+    const driverModule = await driver();
+    const opts = options();
+    const input = {
+      question,
+      mode: yes_no ? { kind: 'yes-no' } : choices ? { kind: 'choices', choices } : { kind: 'scale', low: scale.low, high: scale.high },
+      ...(context === undefined ? {} : { context }),
+      threshold,
+      timeoutMs: timeout_ms,
+    };
+    const result = await driverModule.askDecision(input, opts);
+    // Every decision-ask call records through the same ledger function the CLI
+    // `ask` handler uses, tagged with this tool's transport (#2946). Attribution
+    // resolution and the write both happen inside recordDecisionAsk's own
+    // bounded, never-throwing step (review r1 findings 3 and 4): a provider-
+    // detection failure, a slow/failed write, or an invalid caller tag can
+    // never replace `result` with an error or hold up this tool call.
+    const sanitizedCaller = typeof caller === 'string' && driverModule.ATTRIBUTION_FIELD_PATTERN.test(caller) ? caller : null;
+    await driverModule.recordDecisionAsk(input, result, {
+      transport: 'mcp',
+      projectRoot: opts.cwd,
+      env: opts.env,
+      caller: sanitizedCaller,
+    });
+    return result;
+  }, ASK);
+
   registerJsonTool(server, 'decision-setup-synthetic-classification', {
     title: 'Prepare synthetic classification artifacts',
     description: 'Return reviewable pinned synthetic classification artifacts and a dispatcher request.',

package/dist/src/mcp/tools/orchestration.mjs

@@ -215,6 +215,7 @@ export function registerFlowToolset(server) {
 }
 
 export function registerMissionToolset(server) {
+  registerWorkerResolveTool(server);
   server.registerTool('mission-guide', {
     title: 'Show AIWG Mission Primitive',
     description: 'Fetch the aiwg-mission kernel skill. This is the AIWG-owned Mission primitive; it is distinct from the lower-level mc-* Mission Control toolset.',
@@ -318,3 +319,40 @@ export function registerMissionToolset(server) {
     }
   });
 }
+
+/** Frozen B-OG-33/35 read-only surface; the CLI and MCP share the typed renderer. */
+export function registerWorkerResolveTool(server) {
+  server.registerTool('worker-resolve', {
+    title: 'Resolve Worker Invocation',
+    description: 'Resolve a nonlaunching qualified worker plan without Mission or MC state.',
+    inputSchema: z.object({
+      role: z.enum(['efficiency', 'coding', 'reasoning']),
+      task: z.string().min(1),
+      group: z.string().min(1).regex(/^[a-z][a-z0-9-]{0,62}$/),
+      brief: z.string().min(1),
+      workdir: z.string().min(1),
+      final_output: z.string().min(1),
+      transport: z.enum(['shell', 'mcp']).default('shell'),
+      format: z.enum(['shell', 'json']).optional(),
+      project_dir: z.string().min(1).optional(),
+    }).strict(),
+    annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: false },
+  }, async input => {
+    try {
+      const args = ['models', 'resolve'];
+      for (const [key, value] of Object.entries(input)) {
+        if (key === 'project_dir' || key === 'format') continue;
+        args.push(`--${key === 'final_output' ? 'final-output' : key}=${value}`);
+      }
+      const format = input.format ?? 'json';
+      args.push(`--format=${format}`);
+      const { stdout, stderr, code } = await runAiwgCli(args, { cwd: input.project_dir, timeoutMs: 30000 });
+      if (format === 'shell') {
+        return { ...mcpJson(stdout || stderr), ...(code === 0 ? {} : { isError: true }) };
+      }
+      let plan;
+      try { plan = JSON.parse(stdout); } catch { return mcpError(`worker-resolve failed (exit ${code}): ${stderr}`); }
+      return { ...mcpJson(plan), ...(code === 0 ? {} : { isError: true }) };
+    } catch (error) { return mcpError(`worker-resolve: ${error.message}`); }
+  });
+}

package/dist/src/mcp/tools/subsystems.mjs

@@ -17,6 +17,7 @@
 import { z } from 'zod';
 import { runAiwgCli, mcpError, mcpJson } from '../helpers.mjs';
 import { registerFlowToolset, registerMissionToolset } from './orchestration.mjs';
+import { registerWorkerInvokeToolset, WORKERS_TOOLSET_NAME } from './worker-invoke.mjs';
 import { registerAgenticSandboxToolset } from './agentic-sandbox.mjs';
 import { registerDecisionToolset } from './decision.mjs';
 
@@ -572,6 +573,9 @@ function registerOpsToolset(server) {
 const TOOLSET_REGISTRY = {
   flows: registerFlowToolset,
   missions: registerMissionToolset,
+  // #2892: bounded direct worker run/status/cancel. Explicit opt-in name
+  // ONLY — see WILDCARD_EXCLUDED_TOOLSETS below for why `all` cannot reach it.
+  [WORKERS_TOOLSET_NAME]: registerWorkerInvokeToolset,
   memory: (server) => {
     registerStorageSubsystem(server, STORAGE_SUBSYSTEMS.find(s => s.name === 'memory'));
     registerStorageSubsystem(server, STORAGE_SUBSYSTEMS.find(s => s.name === 'reflections'));
@@ -592,6 +596,14 @@ const TOOLSET_REGISTRY = {
   decision: registerDecisionToolset,
 };
 
+/**
+ * Toolsets that a bare `all` must NOT silently enable. Enabling these
+ * requires naming them explicitly in the AIWG_MCP_TOOLSETS list (#2892
+ * defect 4: a worker-invoke bridge must not become reachable just because
+ * an operator wanted "every read-only discovery toolset" via `all`).
+ */
+const WILDCARD_EXCLUDED_TOOLSETS = new Set([WORKERS_TOOLSET_NAME]);
+
 /**
  * Parse AIWG_MCP_TOOLSETS env or `--toolsets` CLI value into a Set.
  *
@@ -601,18 +613,19 @@ const TOOLSET_REGISTRY = {
  * Examples:
  *   AIWG_MCP_TOOLSETS=flows,missions,ralph
  *   AIWG_MCP_TOOLSETS=core,memory          (core is implicit; harmless)
- *   AIWG_MCP_TOOLSETS=all                  (all known toolsets)
+ *   AIWG_MCP_TOOLSETS=all                  (all known toolsets EXCEPT `workers`,
+ *                                            which needs an explicit opt-in)
+ *   AIWG_MCP_TOOLSETS=all,workers          (explicit opt-in on top of `all`)
  */
 export function parseToolsets(value) {
   if (!value || typeof value !== 'string') return new Set();
   const items = value.split(',').map((s) => s.trim().toLowerCase()).filter(Boolean);
-  if (items.includes('all')) {
-    return new Set(Object.keys(TOOLSET_REGISTRY));
-  }
-  const out = new Set();
   const known = new Set(Object.keys(TOOLSET_REGISTRY));
+  const out = items.includes('all')
+    ? new Set([...known].filter((name) => !WILDCARD_EXCLUDED_TOOLSETS.has(name)))
+    : new Set();
   for (const item of items) {
-    if (item === 'core') continue;  // always on
+    if (item === 'core' || item === 'all') continue;  // 'core' always on; 'all' handled above
     if (!known.has(item)) {
       console.error(`[AIWG MCP] Unknown toolset: "${item}" — known: core, ${[...known].join(', ')}, all`);
       continue;
@@ -624,16 +637,34 @@ export function parseToolsets(value) {
 
 /**
  * Register all opt-in toolsets requested via env/flag.
+ *
+ * `options` is passed through to every registration function; only `workers`
+ * (#2892 B1) consumes it (`projectRoot`, pinned at registration — the served
+ * root must be resolved by the caller, e.g. `server.mjs`'s `findProjectRoot()`,
+ * never defaulted to `process.cwd()` here). Every other registration
+ * function in `TOOLSET_REGISTRY` is synchronous and ignores the extra arg.
+ *
+ * This function is `async` (returns a `Promise`) because `workers`'
+ * registration does real async work (realpath the root, resolve the default
+ * concurrency cap) before it calls `server.registerTool`. Calling it WITHOUT
+ * `await` is still safe for every other toolset: each registration function
+ * is invoked synchronously inside the loop below, so a purely-synchronous
+ * toolset's `server.registerTool` calls complete before this function's
+ * first (and only) `await` is ever reached — only `workers`'s own Promise is
+ * deferred into `pending`, and only an `await`ing caller needs to wait on it.
  */
-export function registerOptInToolsets(server, toolsets) {
+export async function registerOptInToolsets(server, toolsets, options = {}) {
   const enabled = [];
+  const pending = [];
   for (const name of toolsets) {
     const fn = TOOLSET_REGISTRY[name];
     if (fn) {
-      fn(server);
+      const result = fn(server, options);
+      if (result && typeof result.then === 'function') pending.push(result);
       enabled.push(name);
     }
   }
+  if (pending.length > 0) await Promise.all(pending);
   if (enabled.length > 0) {
     console.error(`[AIWG MCP] Opt-in toolsets enabled: ${enabled.join(', ')}`);
   } else {