@aiwg/cli 2026.10.1 → 2026.10.3

package/dist/src/decision/validate.js

@@ -5,7 +5,7 @@ import { fileURLToPath } from 'node:url';
 import Ajv2020 from 'ajv/dist/2020.js';
 import addFormats from 'ajv-formats';
 import { canonicalJson } from '../security/artifact-trust.js';
-import { admitEntry, EntryAdmissionError } from './entry.js';
+import { admissionClockStart, admitEntry, elapsedAdmissionMs, EntryAdmissionError } from './entry.js';
 import { DECISION_API_VERSION, DECISION_API_VERSION_STRUCTURED } from './types.js';
 const schemaFiles = {
     DecisionBinding: 'DecisionBinding.schema.json',
@@ -83,10 +83,13 @@ export function preprocessingLineageSchemaErrors(value) {
     return validate(value) ? null : ajvMessage(validate.errors);
 }
 export function artifactDigest(value) {
-    const started = performance.now();
+    // Per-thread CPU time, not wall-clock: see entry.ts `admissionClockStart`
+    // for why a `performance.now()` budget here would be tripped by host
+    // scheduling contention rather than actual digesting cost.
+    const started = admissionClockStart();
     admitEntry(value);
     const canonical = canonicalJson(value);
-    if (performance.now() - started > 1000) {
+    if (elapsedAdmissionMs(started) > 1000) {
         throw new EntryAdmissionError('time-budget', { bytes: Buffer.byteLength(canonical), entries: 0 });
     }
     return `sha256:${createHash('sha256').update(canonical).digest('hex')}`;

package/dist/src/effects/dispatch-verifier.js

@@ -0,0 +1,252 @@
+/**
+ * Worker-dispatch effect verification (#2891, S1 direct/shared checkpoint).
+ *
+ * Modelled on the ledger lock recovery (`src/effects/lock-recovery.ts`): an
+ * extension kind whose verifier is registered only when the evidence it
+ * checks actually exists. Here the evidence is Tier 0 supervisor evidence
+ * held by the conductor — the dispatch record digest for one invocation,
+ * plus optional `file.digest` artifacts. Without supervisor evidence the
+ * factory returns null and the kind stays unregistered, so reconciliation
+ * through the existing ledger answers `unknown` / `verifier-missing` instead
+ * of manufacturing proof.
+ *
+ * Artifact checks reuse the built-in `file.digest` verifier by delegation;
+ * this module owns no second ledger and no file hashing of its own.
+ *
+ * Managed (S2+) durable dispatch proof and Tier 1 registration are out of
+ * scope; this verifier covers direct/shared supervisor evidence only.
+ *
+ * @see docs/contracts/effect-ledger.v1.md "Verifier interface"
+ */
+import { createHash } from 'node:crypto';
+import { constants } from 'node:fs';
+import { open } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { EffectLedgerError } from './errors.js';
+import { fileDigestVerifier } from './verifiers/file.js';
+import { EffectVerifierError } from './verifiers/types.js';
+export const DISPATCH_KIND = 'x.aiwg.worker-dispatch';
+export const DISPATCH_VERIFIER_VERSION = '1.0.0';
+const DIGEST_PATTERN = /^sha256:[a-f0-9]{64}$/;
+/**
+ * Canonical invocation-ID shape for dispatch evidence (#2891). This is the
+ * SINGLE definition: `tools/ralph-external/lib/dispatch-evidence.mjs`
+ * imports this exact binding (through `tools/_resolve-impl.mjs`'s
+ * `importImpl`, since `tools/` cannot import `src/*.js` directly) rather
+ * than duplicating the literal, so the two can never drift.
+ */
+export const INVOCATION_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/;
+/** Conductor-owned evidence directories and files are owner-only. */
+export const DISPATCH_EVIDENCE_DIR_MODE = 0o700;
+export const DISPATCH_EVIDENCE_FILE_MODE = 0o600;
+export function dispatchEffectTarget(invocationId) {
+    return `x-aiwg:dispatch/${invocationId}`;
+}
+/**
+ * Test-only race-injection seam (#2891 R1/R7), mirroring the equivalent hook
+ * in `tools/ralph-external/lib/dispatch-evidence.mjs`. No-op in production
+ * (`afterOpen` defaults to `null`); this package's own conformance suite
+ * sets it to a one-shot callback that performs a deterministic TOCTOU swap
+ * between `loadSupervisorEvidence`'s two `open()` calls, then clears
+ * itself. Never read outside `openTraced` below.
+ */
+export const __raceTestHooks = { afterOpen: null };
+async function openTraced(path, flags) {
+    const handle = await open(path, flags);
+    if (__raceTestHooks.afterOpen)
+        await __raceTestHooks.afterOpen(path);
+    return handle;
+}
+/**
+ * Read supervisor evidence from the conductor-owned evidence location. The
+ * evidence directory is opened `O_NOFOLLOW` ONCE and kept open for the
+ * whole read: the file `<invocationId>.json` is then opened through that
+ * SAME still-open directory descriptor, via `/proc/self/fd/<dirfd>/<name>`,
+ * never by re-resolving `<evidenceDir>/<invocationId>.json` as a fresh path
+ * string. This means a swap of `evidenceDir`'s path between validating the
+ * directory and reading the file cannot redirect the read onto an attacker-
+ * controlled location — the descriptor still refers to the original,
+ * validated directory regardless of what the path now names.
+ *
+ * Every check runs against an open fd: the evidence directory must be a
+ * real directory owned by us with mode exactly 0700, and the evidence file
+ * must be a regular file owned by us with mode exactly 0600 and exactly one
+ * link (no surprise hardlink). Supervisor evidence is never read from a
+ * worker-writable path: any symlink, wrong mode, wrong owner, extra link or
+ * unbound invocationId throws instead of verifying.
+ *
+ * When `expectedRecordDigest` is supplied (the sha256 of the evidence
+ * file's raw bytes, recorded by the conductor at capture time — for
+ * example from the effect ledger intent this evidence backs), the freshly
+ * read bytes must hash to it or the load throws. Shape and permission
+ * checks alone cannot detect in-place mutation of an already-captured
+ * evidence file; this closes that gap for any caller that has an earlier
+ * recorded digest to check against.
+ */
+export async function loadSupervisorEvidence(options) {
+    const invocationId = options?.invocationId;
+    if (typeof invocationId !== 'string' || !INVOCATION_PATTERN.test(invocationId)) {
+        throw new EffectVerifierError('malformed-response', 'Supervisor evidence needs a valid invocation ID');
+    }
+    if (!options || typeof options.evidenceDir !== 'string' || !options.evidenceDir) {
+        throw new EffectVerifierError('container-unreadable', 'Supervisor evidence needs a conductor-owned evidence directory');
+    }
+    const dirResolved = resolve(options.evidenceDir);
+    let dirHandle;
+    try {
+        dirHandle = await openTraced(dirResolved, constants.O_RDONLY | (constants.O_DIRECTORY ?? 0) | constants.O_NOFOLLOW);
+    }
+    catch {
+        throw new EffectVerifierError('container-unreadable', `Supervisor evidence directory is not a real directory: ${dirResolved}`);
+    }
+    try {
+        const dirStat = await dirHandle.stat();
+        const uid = typeof process.getuid === 'function' ? process.getuid() : null;
+        if (!dirStat.isDirectory() || (dirStat.mode & 0o777) !== DISPATCH_EVIDENCE_DIR_MODE
+            || (uid !== null && dirStat.uid !== uid)) {
+            throw new EffectVerifierError('container-unreadable', `Supervisor evidence directory is not owner-only 0700: ${dirResolved}`);
+        }
+        const name = `${invocationId}.json`;
+        const ref = `/proc/self/fd/${dirHandle.fd}/${name}`;
+        let handle;
+        try {
+            handle = await openTraced(ref, constants.O_RDONLY | constants.O_NOFOLLOW);
+        }
+        catch {
+            throw new EffectVerifierError('container-unreadable', `Supervisor evidence is unreadable: ${dirResolved}/${name}`);
+        }
+        try {
+            const stat = await handle.stat();
+            const fileUid = typeof process.getuid === 'function' ? process.getuid() : null;
+            if (!stat.isFile() || (stat.mode & 0o777) !== DISPATCH_EVIDENCE_FILE_MODE
+                || (fileUid !== null && stat.uid !== fileUid) || stat.nlink !== 1) {
+                throw new EffectVerifierError('container-unreadable', `Supervisor evidence is not an owner-only 0600 regular file with a single link: ${dirResolved}/${name}`);
+            }
+            const raw = await handle.readFile('utf8');
+            if (typeof options.expectedRecordDigest === 'string' && options.expectedRecordDigest) {
+                const actual = `sha256:${createHash('sha256').update(raw, 'utf8').digest('hex')}`;
+                if (actual !== options.expectedRecordDigest) {
+                    throw new EffectVerifierError('malformed-response', 'Supervisor evidence does not match its recorded digest; mutation after capture is not trusted');
+                }
+            }
+            let parsed;
+            try {
+                parsed = JSON.parse(raw);
+            }
+            catch {
+                throw new EffectVerifierError('malformed-response', 'Supervisor evidence is not valid JSON');
+            }
+            if (!hasSupervisorEvidence(parsed) || parsed.invocationId !== invocationId) {
+                throw new EffectVerifierError('malformed-response', 'Supervisor evidence is not bound to this invocation');
+            }
+            return parsed;
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    finally {
+        await dirHandle.close();
+    }
+}
+/** True only when actual supervisor evidence exists: a bound invocation and digest. */
+export function hasSupervisorEvidence(evidence) {
+    if (!evidence || typeof evidence !== 'object')
+        return false;
+    const record = evidence;
+    if (typeof record.invocationId !== 'string' || !INVOCATION_PATTERN.test(record.invocationId))
+        return false;
+    if (typeof record.evidenceDigest !== 'string' || !DIGEST_PATTERN.test(record.evidenceDigest))
+        return false;
+    if (record.artifactPath !== undefined || record.artifactDigest !== undefined) {
+        if (typeof record.artifactPath !== 'string' || !record.artifactPath)
+            return false;
+        if (typeof record.artifactDigest !== 'string' || !DIGEST_PATTERN.test(record.artifactDigest))
+            return false;
+    }
+    return true;
+}
+function assertContextShape(context, target) {
+    const invocationId = context.invocationId;
+    const evidenceDigest = context.evidenceDigest;
+    if (typeof invocationId !== 'string' || !INVOCATION_PATTERN.test(invocationId)
+        || target !== dispatchEffectTarget(invocationId)) {
+        throw new EffectVerifierError('malformed-response', 'Dispatch effect has an unexpected target or invocation');
+    }
+    if (typeof evidenceDigest !== 'string' || !DIGEST_PATTERN.test(evidenceDigest)) {
+        throw new EffectVerifierError('malformed-response', 'Dispatch effect has no evidence digest');
+    }
+    return {
+        invocationId,
+        evidenceDigest,
+        ...(typeof context.artifactPath === 'string' ? { artifactPath: context.artifactPath } : {}),
+        ...(typeof context.artifactDigest === 'string' ? { artifactDigest: context.artifactDigest } : {}),
+    };
+}
+/**
+ * Build the dispatch verifier bound to one project's supervisor evidence, or
+ * null when no actual supervisor evidence exists. Callers register the
+ * returned verifier (for example through the `extensions` of
+ * `buildCliVerifierRegistry`) only when it is non-null; a null result means
+ * the kind stays unregistered and reconciliation reports unknown.
+ */
+export function createDispatchVerifierIfSupervised(options) {
+    if (!options || typeof options.projectDir !== 'string' || !options.projectDir) {
+        throw new EffectLedgerError('usage', 'Dispatch verification needs a project directory', 'invalid-project');
+    }
+    if (!hasSupervisorEvidence(options.evidence))
+        return null;
+    const supervised = options.evidence;
+    // The record never picks its own strictness: artifacts root ONLY at the
+    // conductor-owned evidence directory, and the branch below is driven by
+    // what the SUPERVISOR evidence names, not by what the ledger context
+    // offers. No evidenceDir means no delegation target: `verify()` below
+    // reports `evidence-conflict` for an artifact check rather than silently
+    // widening the trusted root to `projectDir`.
+    const files = options.evidenceDir ? fileDigestVerifier({ root: options.evidenceDir }) : null;
+    return {
+        kind: DISPATCH_KIND,
+        version: DISPATCH_VERIFIER_VERSION,
+        canReportAbsent: true,
+        async verify(request) {
+            const context = assertContextShape((request.context ?? {}), request.target);
+            if (context.invocationId !== supervised.invocationId) {
+                throw new EffectVerifierError('malformed-response', 'Dispatch evidence is bound to a different invocation');
+            }
+            const expected = request.expected.digest ?? request.payloadDigest;
+            if (expected !== supervised.evidenceDigest || context.evidenceDigest !== supervised.evidenceDigest) {
+                return { result: 'unknown', reason: 'evidence-conflict', complete: false };
+            }
+            // Supervisor-driven: when supervised evidence names an artifact the
+            // verifier ALWAYS delegates to file.digest. A context that omits the
+            // artifact (or mismatches it), or a missing evidenceDir to delegate
+            // into, is evidence-conflict, never a present/complete downgrade and
+            // never a projectDir fallback.
+            if (supervised.artifactPath !== undefined) {
+                if (!files) {
+                    return { result: 'unknown', reason: 'evidence-conflict', complete: false };
+                }
+                if (context.artifactPath !== supervised.artifactPath || context.artifactDigest !== supervised.artifactDigest) {
+                    return { result: 'unknown', reason: 'evidence-conflict', complete: false };
+                }
+                const observation = await files.verify({
+                    ...request,
+                    kind: 'file.digest',
+                    target: `file:${supervised.artifactPath}@${supervised.artifactDigest}`,
+                    expected: { digest: supervised.artifactDigest },
+                });
+                if (observation.result !== 'present')
+                    return observation;
+                return {
+                    result: 'present', reason: 'state-match', complete: true,
+                    evidence: { invocationId: context.invocationId, evidenceDigest: supervised.evidenceDigest, artifact: supervised.artifactPath },
+                };
+            }
+            return {
+                result: 'present', reason: 'state-match', complete: true,
+                evidence: { invocationId: context.invocationId, evidenceDigest: supervised.evidenceDigest },
+            };
+        },
+    };
+}
+//# sourceMappingURL=dispatch-verifier.js.map

package/dist/src/effects/index.js

@@ -19,6 +19,7 @@ export { writeCheckpoint } from './checkpoint.js';
 export { checkpointDigest, verifyLedger, } from './verify.js';
 export { EFFECT_RETENTION_POLICY, purgeEffect } from './lifecycle.js';
 export { LEDGER_LOCK_NAME_PATTERN, LOCK_RECOVERY_KIND, LOCK_RECOVERY_VERIFIER_VERSION, inspectLedgerLock, inspectLedgerLocks, ledgerLockRecoveryVerifier, lockRecoveryTarget, recoverStaleLedgerLock, } from './lock-recovery.js';
+export { DISPATCH_KIND, DISPATCH_VERIFIER_VERSION, INVOCATION_PATTERN, createDispatchVerifierIfSupervised, dispatchEffectTarget, hasSupervisorEvidence, loadSupervisorEvidence, } from './dispatch-verifier.js';
 export { assertDigestOnly, containsRestrictedMaterial } from './redaction.js';
 export { EFFECT_SCHEMA_IDS, effectSchemaErrors, isEffectSchemaValid } from './schema.js';
 export { decisionLinkOf, verifyDecisionLinks, } from './decision-links.js';

package/dist/src/features/installer.js

@@ -1,4 +1,4 @@
-import { spawnSync } from 'node:child_process';
+import { boundedSpawnSync } from '../process/bounded-child-process.mjs';
 import { promises as fs } from 'node:fs';
 import path from 'node:path';
 import { FEATURE_CATALOG, getFeature } from './catalog.js';
@@ -46,7 +46,7 @@ export async function installFeature(name, options = {}) {
     const root = options.root ?? getFeaturesRoot();
     await prepareFeatureManifest(feature, root);
     const npmCommand = options.npmCommand ?? (process.platform === 'win32' ? 'npm.cmd' : 'npm');
-    const result = spawnSync(npmCommand, ['install', '--prefix', root, '--no-audit', '--no-fund'], { stdio: 'inherit', env: process.env });
+    const result = boundedSpawnSync(npmCommand, ['install', '--prefix', root, '--no-audit', '--no-fund'], 'long', { stdio: 'inherit', env: process.env });
     if (result.error)
         throw result.error;
     if (result.status !== 0) {

package/dist/src/flow/graph-metadata.js

@@ -1,3 +1,4 @@
+import { assertMissionWorkerHandoff } from '../mission-protocol/codecs.js';
 /** A2A/telemetry metadata key reserved for the optional Flow graph profile. */
 export const AIWG_GRAPH_METADATA_KEY = 'aiwg.flow.graph';
 function nonEmpty(value) {
@@ -15,9 +16,12 @@ export function isGraphExecutionMetadata(value) {
         && nonEmpty(item.nodeRunId);
 }
 export function graphMetadataRecord(value) {
+    assertMissionWorkerHandoff(value, 'graph');
     return { [AIWG_GRAPH_METADATA_KEY]: value };
 }
 export function extractGraphMetadata(metadata) {
+    if (metadata)
+        assertMissionWorkerHandoff({ metadata }, 'graph');
     const value = metadata?.[AIWG_GRAPH_METADATA_KEY];
     return isGraphExecutionMetadata(value) ? value : undefined;
 }
@@ -28,6 +32,7 @@ export function extractGraphMetadata(metadata) {
  * member of this contract and is therefore dropped by construction.
  */
 export function projectGraphMetadata(value, audience) {
+    assertMissionWorkerHandoff(value, 'graph');
     if (!isGraphExecutionMetadata(value))
         throw new Error('Invalid graph execution metadata.');
     if (audience === 'internal')

package/dist/src/gates/providers/loader.js

@@ -7,6 +7,7 @@ import { GateProviderEntrySchema } from '../../extensions/manifest.js';
 import { artifactDigest } from '../../decision/validate.js';
 import { providerSourceDigest } from './types.js';
 import { ISOLATED_CHILD_SOURCE } from './isolated-child-source.js';
+import { positiveTimeoutMs } from '../../process/bounded-child-process.mjs';
 /**
  * Addon/extension metric-provider loading, isolated rework (P1-P5).
  *
@@ -684,7 +685,8 @@ function runIsolatedRecordSync(record, args, limits) {
     const completed = spawnSync(plan.command, plan.args, {
         env: plan.env,
         input,
-        timeout: limits.timeoutMs,
+        // Validated upstream; clamped here so the bound holds at the call site.
+        timeout: positiveTimeoutMs(limits.timeoutMs, GATE_PROVIDER_DEFAULT_TIMEOUT_MS),
         killSignal: 'SIGKILL',
         maxBuffer: limits.maxOutputBytes,
         encoding: 'utf8',

package/dist/src/installation/manager-command.mjs

@@ -20,7 +20,7 @@ export function resolveManagerCommand(file, args, options = {}) {
   const command = `"${[file, ...args].map(quoteCmdArgument).join(' ')}"`;
   return {
     file: commandInterpreter,
-    args: ['/d', '/s', '/c', command],
+    args: ['/d', '/v:off', '/s', '/c', command],
     // The payload above already contains cmd.exe-native quoting. Instruct
     // Node not to apply MSVCRT escaping to those embedded quotes (#173).
     windowsVerbatimArguments: true,

package/dist/src/installation/manager.mjs

@@ -1,4 +1,4 @@
-import { execFileSync } from 'node:child_process';
+import { boundedExecFileSync } from '../process/bounded-child-process.mjs';
 import {
   accessSync,
   constants,
@@ -50,7 +50,22 @@ function resolveExecutable(name, options = {}) {
   if (existsSync(besideNode)) return canonicalPath(besideNode);
   try {
     const finder = process.platform === 'win32' ? 'where.exe' : 'which';
-    const found = execFileSync(finder, [name], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })
+    // Go/no-go review, blocker 1B: this runs unconditionally on first
+    // launch (creating the installation identity) for *every* command,
+    // including a credential-handling one — before `bin/aiwg.mjs` even
+    // knows which command that is. `which`/`where.exe` only need `PATH`
+    // (and, on Windows, `PATHEXT`/`SystemRoot` for its own resolution), so
+    // this never inherits the whole parent environment the way an absent
+    // `env` option otherwise would.
+    const lookupEnv = {
+      PATH: env.PATH ?? '',
+      ...(process.platform === 'win32' ? { PATHEXT: env.PATHEXT ?? '', SystemRoot: env.SystemRoot ?? '' } : {}),
+    };
+    const found = boundedExecFileSync(finder, [name], 'quick', {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+      env: lookupEnv,
+    })
       .split(/\r?\n/, 1)[0]?.trim();
     return found ? canonicalPath(found) : null;
   } catch {

package/dist/src/lint/runner.js

@@ -7,7 +7,7 @@
  * @issue #810
  */
 import fs from 'fs';
-import { spawnSync } from 'child_process';
+import { boundedSpawnSync } from '../process/bounded-child-process.mjs';
 import fsp from 'fs/promises';
 import path from 'path';
 import { glob } from 'glob';
@@ -560,7 +560,7 @@ function dropGitignored(targetDir, files) {
     if (files.length === 0)
         return files;
     try {
-        const result = spawnSync('git', ['check-ignore', '--stdin'], {
+        const result = boundedSpawnSync('git', ['check-ignore', '--stdin'], 'quick', {
             cwd: targetDir,
             input: `${files.join('\n')}\n`,
             encoding: 'utf8',