@aiwg/cli 2026.10.0 → 2026.10.3

package/dist/src/storage/backends/logseq.js

@@ -146,7 +146,7 @@ export class LogseqAdapter {
         }
         // Defensive: refuse to write `id::` block IDs ourselves. Logseq
         // auto-assigns them; if the caller smuggled one in, strip it.
-        body = body.replace(/^\s*id::\s*[^\n]+\n/gm, '');
+        body = stripBlockIds(body);
         await writeFile(abs, body, 'utf-8');
     }
     async list(prefix) {
@@ -221,6 +221,34 @@ function expandHome(p) {
     }
     return p;
 }
+function stripBlockIds(content) {
+    const chunks = [];
+    let start = 0;
+    while (start < content.length) {
+        let property = start;
+        while (property < content.length && /\s/u.test(content[property]))
+            property++;
+        if (content.startsWith('id::', property)) {
+            // Only the property's own line belongs to the block ID.
+            let end = property + 4;
+            while (end < content.length && !/[\n\r\u2028\u2029]/u.test(content[end]))
+                end++;
+            if (content[end] === '\r' && content[end + 1] === '\n')
+                end++;
+            start = end < content.length ? end + 1 : content.length;
+            continue;
+        }
+        // Keep the original line and any preceding blank lines verbatim.
+        let end = property;
+        while (end < content.length && !/[\n\r\u2028\u2029]/u.test(content[end]))
+            end++;
+        if (end < content.length)
+            end++;
+        chunks.push(content.slice(start, end));
+        start = end;
+    }
+    return chunks.join('');
+}
 /**
  * If `content` starts with a `---` YAML block, parse the block and
  * return the parsed fields plus the body without the YAML. Otherwise
@@ -230,18 +258,51 @@ function expandHome(p) {
  * Anything more complex falls back to dropping the value as a string.
  */
 function extractYamlFrontmatter(content) {
-    const match = /^---\s*\r?\n([\s\S]*?)\r?\n---\s*\r?\n?([\s\S]*)$/.exec(content);
-    if (!match)
+    if (!content.startsWith('---'))
+        return null;
+    let openingEnd = 3;
+    let firstNewline = -1;
+    let lastNewline = -1;
+    while (openingEnd < content.length && /\s/u.test(content[openingEnd])) {
+        if (content[openingEnd] === '\n') {
+            if (firstNewline < 0)
+                firstNewline = openingEnd;
+            lastNewline = openingEnd;
+        }
+        openingEnd++;
+    }
+    if (firstNewline < 0)
         return null;
-    const [, yamlBody, body] = match;
+    let yamlStart = lastNewline + 1;
+    let closing = content.indexOf('\n---', yamlStart);
+    if (closing < 0) {
+        closing = content.indexOf('\n---', firstNewline + 1);
+        if (closing < 0)
+            return null;
+        yamlStart = firstNewline + 1;
+        for (let index = yamlStart; index < closing; index++) {
+            if (content[index] === '\n')
+                yamlStart = index + 1;
+        }
+    }
+    const yamlBody = content.slice(yamlStart, content[closing - 1] === '\r' ? closing - 1 : closing);
+    let bodyStart = closing + 4;
+    while (bodyStart < content.length && /\s/u.test(content[bodyStart]))
+        bodyStart++;
+    const body = content.slice(bodyStart);
     const fields = {};
     for (const line of yamlBody.split(/\r?\n/)) {
         if (line.trim().length === 0 || line.trim().startsWith('#'))
             continue;
-        const m = /^([A-Za-z_][A-Za-z0-9_-]*)\s*:\s*(.*)$/.exec(line);
-        if (!m)
+        const separator = line.indexOf(':');
+        if (separator < 0)
+            continue;
+        const k = line.slice(0, separator).trimEnd();
+        if (!/^[A-Za-z_][A-Za-z0-9_-]*$/.test(k))
+            continue;
+        const rawV = line.slice(separator + 1).trimStart();
+        if (/[\r\u2028\u2029]/u.test(rawV))
             continue;
-        const [, k, rawV] = m;
         fields[k] = parseYamlScalar(rawV.trim());
     }
     return { fields, body };

package/dist/src/storage/fortemi-qualification-receipt.js

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { link, mkdir, unlink, writeFile } from "node:fs/promises";
 import { dirname } from "node:path";
-import { execFileSync } from "node:child_process";
+import { boundedExecFileSync } from "../process/bounded-child-process.mjs";
 export const FORTEMI_QUALIFICATION_RECEIPT = "aiwg.fortemi-live-qualification-receipt/v1";
 const DIGEST = /^sha256:[0-9a-f]{64}$/;
 const COMMIT = /^[0-9a-f]{40}$/;
@@ -23,7 +23,7 @@ function hasCompleteOperationInventory(operations) {
         names.every((name) => REQUIRED_OPERATIONS.has(name)));
 }
 export function resolveFortemiQualificationSource(env = process.env, cwd = process.cwd()) {
-    const git = (...args) => execFileSync("git", args, {
+    const git = (...args) => boundedExecFileSync("git", args, 'quick', {
         cwd,
         encoding: "utf8",
         stdio: ["ignore", "pipe", "ignore"],

package/dist/src/testing/generators/test-code-generator.js

@@ -31,6 +31,7 @@ export class TestCodeGenerator {
         const warnings = [];
         const files = [];
         try {
+            this.validateInputs(suite);
             // Group test cases by level
             const unitTests = suite.testCases.filter(tc => tc.level === 'unit');
             const integrationTests = suite.testCases.filter(tc => tc.level === 'integration');
@@ -80,6 +81,33 @@ export class TestCodeGenerator {
             };
         }
     }
+    /** Validate declared string inputs before rendering any files. */
+    validateInputs(suite) {
+        const requireString = (value, field) => {
+            if (typeof value !== 'string')
+                throw new Error(`${field} must be a string`);
+        };
+        requireString(suite.name, 'suite.name');
+        for (const [index, testCase] of suite.testCases.entries()) {
+            const field = `testCases[${index}]`;
+            requireString(testCase.name, `${field}.name`);
+            if (!Array.isArray(testCase.testData))
+                throw new Error(`${field}.testData must be an array`);
+            for (const [dataIndex, data] of testCase.testData.entries()) {
+                const dataField = `${field}.testData[${dataIndex}]`;
+                requireString(data.name, `${dataField}.name`);
+                if (!Array.isArray(data.examples))
+                    throw new Error(`${dataField}.examples must be an array`);
+                for (const [exampleIndex, example] of data.examples.entries()) {
+                    requireString(example, `${dataField}.examples[${exampleIndex}]`);
+                }
+            }
+            for (const [stepIndex, step] of testCase.steps.entries()) {
+                if (step.testData !== undefined)
+                    requireString(step.testData, `${field}.steps[${stepIndex}].testData`);
+            }
+        }
+    }
     /**
      * Generate a test file for unit or integration tests
      */
@@ -95,7 +123,7 @@ export class TestCodeGenerator {
         lines.push(this.generateImports(level));
         lines.push('');
         // Test suite
-        lines.push(`describe('${suite.name} - ${level.charAt(0).toUpperCase() + level.slice(1)} Tests', () => {`);
+        lines.push(`describe(${JSON.stringify(`${suite.name} - ${level.charAt(0).toUpperCase() + level.slice(1)} Tests`)}, () => {`);
         // Setup/teardown
         if (this.options.includeSetup) {
             lines.push(this.generateSetup(indent, suite));
@@ -137,7 +165,7 @@ export class TestCodeGenerator {
         }
         lines.push('');
         // Test suite
-        lines.push(`test.describe('${suite.name} - E2E Tests', () => {`);
+        lines.push(`test.describe(${JSON.stringify(`${suite.name} - E2E Tests`)}, () => {`);
         // Setup
         if (this.options.includeSetup) {
             lines.push(`${indent}test.beforeEach(async ({ page }) => {`);
@@ -167,12 +195,12 @@ export class TestCodeGenerator {
         if (!this.options.includeComments)
             return '';
         return `/**
- * ${_level.toUpperCase()} Tests: ${suite.name}
+ * ${_level.toUpperCase()} Tests: ${this.escapeComment(suite.name)}
  *
- * Auto-generated from ${suite.useCaseId}
- * Generated at: ${suite.generatedAt}
+ * Auto-generated from ${this.escapeComment(suite.useCaseId)}
+ * Generated at: ${this.escapeComment(suite.generatedAt)}
  *
- * @module test/${_level}/${suite.useCaseId.toLowerCase()}
+ * @module test/${_level}/${this.escapeComment(suite.useCaseId.toLowerCase())}
  */`;
     }
     /**
@@ -246,19 +274,19 @@ export class TestCodeGenerator {
         // Test description comment
         if (this.options.includeComments) {
             lines.push(`${indent}/**`);
-            lines.push(`${indent} * ${testCase.id}: ${testCase.name}`);
-            lines.push(`${indent} * ${testCase.description}`);
-            lines.push(`${indent} * Type: ${testCase.type}`);
-            lines.push(`${indent} * Priority: ${testCase.priority}`);
+            lines.push(`${indent} * ${this.escapeComment(testCase.id)}: ${this.escapeComment(testCase.name)}`);
+            lines.push(`${indent} * ${this.escapeComment(testCase.description)}`);
+            lines.push(`${indent} * Type: ${this.escapeComment(testCase.type)}`);
+            lines.push(`${indent} * Priority: ${this.escapeComment(testCase.priority)}`);
             lines.push(`${indent} */`);
         }
         // Test function
-        lines.push(`${indent}it('${this.escapeString(testCase.name)}', async () => {`);
+        lines.push(`${indent}it(${JSON.stringify(testCase.name)}, async () => {`);
         // Preconditions
         if (testCase.preconditions.length > 0) {
             lines.push(`${indent2}// Preconditions:`);
             for (const pre of testCase.preconditions) {
-                lines.push(`${indent2}// - ${pre}`);
+                lines.push(`${indent2}// - ${this.escapeComment(pre)}`);
             }
             lines.push('');
         }
@@ -267,7 +295,7 @@ export class TestCodeGenerator {
         if (testCase.testData.length > 0) {
             lines.push(`${indent2}const testData = {`);
             for (const data of testCase.testData) {
-                lines.push(`${indent3}${data.name}: ${this.getExampleValue(data.examples)}, // ${data.type}: ${data.constraints.join(', ')}`);
+                lines.push(`${indent3}${JSON.stringify(data.name)}: ${this.getExampleValue(data.examples)}, // ${this.escapeComment(data.type)}: ${this.escapeComment(data.constraints.join(', '))}`);
             }
             lines.push(`${indent2}};`);
         }
@@ -282,7 +310,7 @@ export class TestCodeGenerator {
                 step.action.toLowerCase().includes('check')) {
                 continue; // Skip verification steps for Act section
             }
-            lines.push(`${indent2}// Step ${step.number}: ${step.action}`);
+            lines.push(`${indent2}// Step ${this.escapeComment(step.number)}: ${this.escapeComment(step.action)}`);
             lines.push(`${indent2}// TODO: Implement action`);
         }
         lines.push('');
@@ -293,7 +321,7 @@ export class TestCodeGenerator {
                 !step.action.toLowerCase().includes('check')) {
                 continue; // Skip action steps for Assert section
             }
-            lines.push(`${indent2}// ${step.expectedResult}`);
+            lines.push(`${indent2}// ${this.escapeComment(step.expectedResult)}`);
             lines.push(`${indent2}// expect(result).toEqual(expected);`);
         }
         // Default assertion if no verify steps
@@ -308,7 +336,7 @@ export class TestCodeGenerator {
             lines.push('');
             lines.push(`${indent2}// Postconditions:`);
             for (const post of testCase.postconditions) {
-                lines.push(`${indent2}// - ${post}`);
+                lines.push(`${indent2}// - ${this.escapeComment(post)}`);
             }
         }
         lines.push(`${indent}});`);
@@ -323,15 +351,15 @@ export class TestCodeGenerator {
         // Test description comment
         if (this.options.includeComments) {
             lines.push(`${indent}/**`);
-            lines.push(`${indent} * ${testCase.id}: ${testCase.name}`);
-            lines.push(`${indent} * ${testCase.description}`);
+            lines.push(`${indent} * ${this.escapeComment(testCase.id)}: ${this.escapeComment(testCase.name)}`);
+            lines.push(`${indent} * ${this.escapeComment(testCase.description)}`);
             lines.push(`${indent} */`);
         }
         // Test function
-        lines.push(`${indent}test('${this.escapeString(testCase.name)}', async ({ page }) => {`);
+        lines.push(`${indent}test(${JSON.stringify(testCase.name)}, async ({ page }) => {`);
         // Steps
         for (const step of testCase.steps) {
-            lines.push(`${indent2}// Step ${step.number}: ${step.action}`);
+            lines.push(`${indent2}// Step ${this.escapeComment(step.number)}: ${this.escapeComment(step.action)}`);
             lines.push(this.generateE2EStepCode(step, indent2));
             lines.push('');
         }
@@ -350,7 +378,7 @@ export class TestCodeGenerator {
             return `${indent}await page.click('selector'); // TODO: Update selector`;
         }
         if (action.includes('enter') || action.includes('type') || action.includes('input')) {
-            return `${indent}await page.fill('selector', '${step.testData || 'test-data'}'); // TODO: Update`;
+            return `${indent}await page.fill('selector', ${JSON.stringify(step.testData || 'test-data')}); // TODO: Update`;
         }
         if (action.includes('navigate') || action.includes('go to')) {
             return `${indent}await page.goto('/path'); // TODO: Update path`;
@@ -359,15 +387,14 @@ export class TestCodeGenerator {
             return `${indent}await page.waitForSelector('selector'); // TODO: Update selector`;
         }
         if (action.includes('verify') || action.includes('check') || action.includes('see')) {
-            return `${indent}await expect(page.locator('selector')).toBeVisible(); // ${step.expectedResult}`;
+            return `${indent}await expect(page.locator('selector')).toBeVisible(); // ${this.escapeComment(step.expectedResult)}`;
         }
-        return `${indent}// TODO: Implement step - ${step.action}`;
+        return `${indent}// TODO: Implement step - ${this.escapeComment(step.action)}`;
     }
-    /**
-     * Escape string for use in test names
-     */
-    escapeString(str) {
-        return str.replace(/'/g, "\\'").replace(/"/g, '\\"');
+    /** Keep metadata within a single line or block comment. */
+    escapeComment(value) {
+        return String(value).replace(/\*\//g, '* /')
+            .replace(/[\r\n\u2028\u2029]/g, (char) => '\\u' + char.charCodeAt(0).toString(16).padStart(4, '0'));
     }
     /**
      * Get example value from test data
@@ -376,9 +403,9 @@ export class TestCodeGenerator {
         if (examples.length === 0)
             return "'test-value'";
         const example = examples[0];
-        if (example.match(/^\d+$/))
+        if (/^\d+$/.test(example) && String(Number(example)) === example)
             return example;
-        return `'${example}'`;
+        return JSON.stringify(example);
     }
 }
 //# sourceMappingURL=test-code-generator.js.map

package/dist/src/uhp/client.js

@@ -5,6 +5,7 @@ import path from 'node:path';
 import { DEFAULT_UHP_LIMITS, isUhpLoopback, isUhpPrivateAddress, resolveUhpLimits, validateUhpEndpoint } from './config.js';
 import { parseUhpError, redactUhpText, UhpError } from './errors.js';
 import { parseUhpEventStream } from './sse.js';
+import { assertMissionWorkerHandoff } from '../mission-protocol/codecs.js';
 import { UHP_VERSION, } from './types.js';
 const ID_PATTERNS = {
     harness: /^chrn_[A-Za-z0-9_-]+$/,
@@ -100,6 +101,7 @@ function ensureDiscovery(value) {
     return discovery;
 }
 function ensureResponse(value) {
+    assertMissionWorkerHandoff(value, 'uhp');
     if (!value || typeof value !== 'object')
         throw new UhpError('invalid_response', 'UHP response must be an object', { remoteState: 'unknown' });
     const response = value;
@@ -238,6 +240,7 @@ export class UhpClient {
         return this.json(harnessId ? `v1/harnesses/${encodeURIComponent(assertId('harness', harnessId))}/models` : 'v1/models');
     }
     async createResponse(request, options = {}) {
+        assertMissionWorkerHandoff(request, 'uhp');
         const normalized = { ...request, stream: false, metadata: { ...request.metadata, ...(request.metadata?.harness_id || !this.profile.defaultHarness ? {} : { harness_id: this.profile.defaultHarness }) }, ...(request.model || !this.profile.defaultModel ? {} : { model: this.profile.defaultModel }) };
         if ((normalized.timeout_seconds ?? this.limits.maxTaskSeconds) > this.limits.maxTaskSeconds)
             throw new UhpError('task_budget_exceeded', 'Requested UHP task duration exceeds the profile limit', { remoteState: 'not-started' });
@@ -267,6 +270,7 @@ export class UhpClient {
         }
     }
     async *streamResponse(request, options = {}) {
+        assertMissionWorkerHandoff(request, 'uhp');
         const normalized = { ...request, stream: true, metadata: { ...request.metadata, ...(request.metadata?.harness_id || !this.profile.defaultHarness ? {} : { harness_id: this.profile.defaultHarness }) } };
         const digest = canonicalUhpRequestDigest(normalized);
         const key = options.idempotencyKey ?? `aiwg-${digest}`;
@@ -285,7 +289,12 @@ export class UhpClient {
             throw parseUhpError(response.status, parseJson(await readBounded(response)), secret ? [secret] : []);
         if (!response.headers.get('content-type')?.toLowerCase().startsWith('text/event-stream') || !response.body)
             throw new UhpError('invalid_stream', 'UHP streaming response must be text/event-stream', { remoteState: 'unknown' });
-        yield* parseUhpEventStream(response.body, { inactivityTimeoutMs: this.limits.inactivityTimeoutMs, secrets: secret ? [secret] : [], signal: options.signal });
+        for await (const event of parseUhpEventStream(response.body, { inactivityTimeoutMs: this.limits.inactivityTimeoutMs, secrets: secret ? [secret] : [], signal: options.signal })) {
+            assertMissionWorkerHandoff(event, 'uhp');
+            if (event.response)
+                assertMissionWorkerHandoff(event.response, 'uhp');
+            yield event;
+        }
     }
     async readResponse(responseId) {
         return ensureResponse(await this.json(`v1/responses/${encodeURIComponent(assertId('response', responseId))}`));
@@ -295,6 +304,7 @@ export class UhpClient {
         return this.readResponse(responseId);
     }
     async continueResponse(previousResponseId, request, options = {}) {
+        assertMissionWorkerHandoff(request, 'uhp');
         const previous = await this.readResponse(previousResponseId);
         const harness = previous.metadata.harness_id;
         if (request.metadata?.harness_id && harness && request.metadata.harness_id !== harness)

package/dist/src/uhp/mission.js

@@ -1,5 +1,6 @@
 import { UHP_VERSION } from './types.js';
 import { decodeMission } from '../mission-protocol/index.js';
+import { assertMissionWorkerHandoff } from '../mission-protocol/codecs.js';
 function collectArtifacts(response) {
     const artifacts = new Map();
     const visit = (value) => {
@@ -48,6 +49,10 @@ function collectInputFiles(request) {
     return files;
 }
 export function projectUhpResponseToMission(profile, response, request = { input: '' }, event) {
+    assertMissionWorkerHandoff(response, 'uhp');
+    assertMissionWorkerHandoff(request, 'uhp');
+    if (event)
+        assertMissionWorkerHandoff(event, 'uhp');
     const known = ['in_progress', 'completed', 'failed', 'incomplete', 'cancelled'].includes(response.status);
     const state = response.status === 'in_progress' ? 'running' : known ? response.status : 'unknown';
     const metadata = response.metadata ?? {};

package/dist/src/update/checker.mjs

@@ -12,7 +12,7 @@
 import fs from 'fs/promises';
 import path from 'path';
 import https from 'https';
-import { execSync } from 'child_process';
+import { boundedExecFileSync } from '../process/bounded-child-process.mjs';
 import { createInterface } from 'readline';
 import { loadConfig, saveConfig, getChannel, getPackageRoot } from '../channel/manager.mjs';
 import { updateInstallation } from './service.mjs';
@@ -68,15 +68,15 @@ async function fetchLatestNpmVersion() {
 async function checkGitUpdates(edgePath) {
   try {
     // Fetch latest without merging
-    execSync('git fetch --quiet', { cwd: edgePath, timeout: 10000 });
+    boundedExecFileSync('git', ['fetch', '--quiet'], 'network', { cwd: edgePath, timeout: 10000 });
 
     // Check if local is behind remote
-    const localHash = execSync('git rev-parse HEAD', {
+    const localHash = boundedExecFileSync('git', ['rev-parse', 'HEAD'], 'quick', {
       cwd: edgePath,
       encoding: 'utf8',
     }).trim();
 
-    const remoteHash = execSync('git rev-parse origin/main', {
+    const remoteHash = boundedExecFileSync('git', ['rev-parse', 'origin/main'], 'quick', {
       cwd: edgePath,
       encoding: 'utf8',
     }).trim();
@@ -322,7 +322,7 @@ async function checkEdgeUpdates(config) {
       console.log('');
       console.log('Updating edge installation...');
       try {
-        execSync('git pull --ff-only', { cwd: config.edgePath, stdio: 'inherit' });
+        boundedExecFileSync('git', ['pull', '--ff-only'], 'network', { cwd: config.edgePath, stdio: 'inherit' });
         console.log('Update complete!');
       } catch (error) {
         console.error('Update failed. Run manually:');

package/dist/src/update/notifier.mjs

@@ -8,7 +8,11 @@
  *      `bin/aiwg.mjs`. It spawns a **detached, unref()'d** child Node
  *      process that runs this file with `--check` and writes the result
  *      to `~/.aiwg/update-notifier.json`. The child exits immediately
- *      after writing; the parent never waits on it.
+ *      after writing; the parent never waits on it. The child's
+ *      environment is an explicit allow-list (`notifierChildEnv()`), never
+ *      the whole parent environment — see that function's doc comment.
+ *      `bin/aiwg.mjs` also never calls this at all for a command that
+ *      itself handles a credential (`isCredentialHandlingCommand()`).
  *
  *   2. On the *next* invocation, `maybePrintNotice()` reads the cache
  *      and prints a single-line "update available" message to stderr.
@@ -217,6 +221,54 @@ async function runCheck(packageRoot) {
   });
 }
 
+/**
+ * Environment variable names copied from the parent into the background
+ * check child (go/no-go review, blocker 1B) — never the whole environment,
+ * which is what let a secret-bearing variable set for an entirely
+ * unrelated command (or read by one of this CLI's own credential-handling
+ * commands) reach this child too, visible to `NODE_DEBUG=child_process`
+ * and to anything else that can observe a child's own environment while it
+ * runs. Chosen by reading what this file's own `--check` path (module load
+ * + `runCheck()`) actually consults:
+ *
+ *   PATH                                   general process hygiene
+ *   HOME, USERPROFILE, HOMEDRIVE, HOMEPATH  `os.homedir()` (POSIX / Windows),
+ *                                           consulted by `resolveUserConfigDir()`
+ *   AIWG_CONFIG                             `resolveUserConfigDir()`'s own override
+ *   NODE_EXTRA_CA_CERTS                     Node's own TLS trust-store
+ *                                           augmentation — needed for the
+ *                                           registry HTTPS GET to succeed
+ *                                           behind a custom-CA proxy
+ *
+ * `fetchLatestVersion()` is a plain `https.get()` with no proxy-aware
+ * agent, so `HTTP(S)_PROXY`/`NO_PROXY` have no effect on it today and are
+ * deliberately left out — add them here (and give `fetchLatestVersion()` a
+ * proxy-aware agent) in the same change if proxy support is ever added.
+ * `loadInstallationIdentity()` is imported but never called by `--check`
+ * (only by the parent, before deciding whether to spawn at all), so its own
+ * env reads do not apply here either.
+ */
+const NOTIFIER_CHILD_ENV_ALLOWLIST = Object.freeze([
+  'PATH', 'HOME', 'USERPROFILE', 'HOMEDRIVE', 'HOMEPATH', 'AIWG_CONFIG', 'NODE_EXTRA_CA_CERTS',
+]);
+
+/**
+ * Build the background check child's environment: only the allow-listed
+ * names, copied from `parentEnv` when present, plus the child-identity
+ * marker the child's own entry point does not otherwise need but existing
+ * tooling may key off of. Exported for the unit test that pins "only
+ * allow-listed names cross over, even when the parent env holds an extra
+ * secret-shaped variable" (go/no-go review, blocker 1 tests).
+ */
+export function notifierChildEnv(parentEnv = process.env) {
+  const env = {};
+  for (const name of NOTIFIER_CHILD_ENV_ALLOWLIST) {
+    if (parentEnv[name] !== undefined) env[name] = parentEnv[name];
+  }
+  env.AIWG_UPDATE_NOTIFIER_CHILD = '1';
+  return env;
+}
+
 /**
  * Schedule a background update check if one hasn't run in the last
  * CHECK_INTERVAL_MS. Non-blocking: spawns a detached child process and
@@ -248,7 +300,7 @@ export function scheduleBackgroundCheck(packageRoot) {
       {
         detached: true,
         stdio: 'ignore',
-        env: { ...process.env, AIWG_UPDATE_NOTIFIER_CHILD: '1' },
+        env: notifierChildEnv(),
       },
     );
     // Unref so the parent can exit without waiting for the child. This is

package/dist/src/writing/fidelity.js

@@ -2,6 +2,23 @@ import { parseWritingBrief, writingBriefHash, applyProofreadCorrections } from '
 function matches(text, pattern) {
     return [...text.matchAll(pattern)].map(m => ({ text: m[0], start: m.index, end: m.index + m[0].length }));
 }
+function sentences(text) {
+    const result = [];
+    let start = 0;
+    for (let index = 0; index < text.length; index++) {
+        const character = text[index];
+        if (character === '\n' || character === '.' || character === '!' || character === '?') {
+            if (index > start) {
+                const end = character === '\n' ? index : index + 1;
+                result.push({ text: text.slice(start, end), start, end });
+            }
+            start = index + 1;
+        }
+    }
+    if (start < text.length)
+        result.push({ text: text.slice(start), start, end: text.length });
+    return result;
+}
 /** Literal invariants fail closed; lexical signals locate changes requiring semantic review. */
 export function assessWritingFidelity(original, candidate, value) {
     const brief = value ? parseWritingBrief(value) : undefined;
@@ -40,7 +57,7 @@ export function assessWritingFidelity(original, candidate, value) {
     }
     const firstPerson = /\b(?:I|we|my|our|me|us)\b/giu;
     const allowedPersonal = brief?.authorClaims.map(c => c.text) ?? [];
-    for (const claim of matches(candidate, /[^.!?\n]+(?:[.!?]|$)/gu)) {
+    for (const claim of sentences(candidate)) {
         if (matches(claim.text, firstPerson).length && !original.includes(claim.text.trim()) && !allowedPersonal.some(text => text === claim.text.trim())) {
             changes.push({ kind: 'first-person', side: 'candidate', start: claim.start, end: claim.end, reason: 'New first-person wording lacks exact supplied author grounding; review is required.' });
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwg/cli",
-  "version": "2026.10.0",
+  "version": "2026.10.3",
   "description": "Lightweight AIWG CLI for signed, versioned web-backed resources.",
   "type": "module",
   "license": "MIT",
@@ -30,6 +30,9 @@
     "schemas/security/",
     "schemas/decision/",
     "schemas/dataset/",
+    "schemas/mission-v1.schema.json",
+    "schemas/models/",
+    "vscode-extension/schemas/aiwg.config.v1.json",
     "dist/src/",
     "!dist/**/*.d.ts",
     "!dist/**/*.map",
@@ -38,6 +41,19 @@
     "dist/src/resources/web-release.d.ts",
     "dist/src/dataset/**/*.d.ts",
     "tools/_resolve-impl.mjs",
+    "tools/ralph-external/lib/provider-adapter.mjs",
+    "tools/ralph-external/lib/worker-health.mjs",
+    "tools/ralph-external/lib/claude-adapter.mjs",
+    "tools/ralph-external/lib/codex-adapter.mjs",
+    "tools/ralph-external/lib/opencode-adapter.mjs",
+    "tools/ralph-external/lib/factory-adapter.mjs",
+    "tools/ralph-external/lib/pi-adapter.mjs",
+    "tools/ralph-external/lib/omp-adapter.mjs",
+    "tools/ralph-external/lib/deepseek-harness-adapter.mjs",
+    "tools/ralph-external/lib/muse-adapter.mjs",
+    "tools/ralph-external/lib/openhuman-adapter.mjs",
+    "tools/providers/omp-transport.mjs",
+    "tools/providers/deepseek-harness-transport.mjs",
     "tools/agents/deploy-agents.mjs",
     "tools/agents/providers/",
     "tools/providers/antigravity-transport.mjs",
@@ -71,6 +87,7 @@
   "dependencies": {
     "@fortemi/core": "2026.7.15",
     "@modelcontextprotocol/sdk": "^1.30.0",
+    "acorn": "^8.16.0",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
     "chalk": "^4.1.2",