@aiwg/cli 2026.10.1 → 2026.10.4

package/dist/src/channel/manager.mjs

@@ -9,13 +9,15 @@
  * @version 2024.12.0
  */
 
+import { signalChild } from '../process/signal-child.mjs';
 import fs from 'fs/promises';
 import { readFileSync, existsSync } from 'fs';
 import path from 'path';
 import { fileURLToPath } from 'url';
-import { execFileSync, execSync, spawn } from 'child_process';
+import { spawn } from 'child_process';
 import os from 'os';
 import { resolveUserConfigDir } from '../config/user-config-dir.mjs';
+import { boundedExecFileSync } from '../process/bounded-child-process.mjs';
 import {
   assertCanonicalInstallation,
   createInstallationIdentity,
@@ -52,9 +54,9 @@ async function runWithTimeout(cmd, args, options = {}) {
     let settled = false;
     const timer = setTimeout(() => {
       if (settled) return;
-      try { child.kill('SIGTERM'); } catch { /* already exited */ }
+      try { signalChild(child, 'SIGTERM'); } catch { /* already exited */ }
       const kill9 = setTimeout(() => {
-        try { child.kill('SIGKILL'); } catch { /* already exited */ }
+        try { signalChild(child, 'SIGKILL'); } catch { /* already exited */ }
       }, 5_000);
       kill9.unref?.();
       settled = true;
@@ -135,6 +137,50 @@ export function getPackageRoot() {
   return path.resolve(__dirname, '..', '..');
 }
 
+/**
+ * Resolve the installation root bin/aiwg.mjs actually dispatches to.
+ *
+ * This is the exact decision `resolveRouterPath()` in bin/aiwg.mjs makes
+ * when picking which `dist/` to load the compiled router (and therefore
+ * every compiled-dist module it imports, including the MCP server) from:
+ * the dev-mode edge checkout when configured and present and distinct from
+ * the package root, otherwise the package root itself. Shared so health
+ * checks (doctor) validate the layout the launcher will actually execute
+ * instead of re-deriving — and risking drifting from — the same decision
+ * (#276).
+ *
+ * @param {string} packageRoot - This install's own package root (`getPackageRoot()`).
+ * @param {{devMode?: boolean, edgePath?: string}} config - Channel config (`loadConfig()`).
+ * @returns {string} The effective root whose `dist/src/...` the launcher loads from.
+ */
+export function resolveEffectiveInstallationRoot(packageRoot, config) {
+  if (config?.devMode && config.edgePath && config.edgePath !== packageRoot) {
+    return config.edgePath;
+  }
+  return packageRoot;
+}
+
+/**
+ * Resolve the absolute path to the MCP server entrypoint the production
+ * launcher actually loads: `bin/aiwg.mjs` always dispatches to the
+ * *compiled* router (`resolveRouterPath()`, never an uncompiled `src/`
+ * tree), whose MCP handler imports `../../mcp/cli.mjs` relative to its own
+ * compiled location, which in turn imports `./server.mjs` relative to
+ * itself — i.e. always `<effective root>/dist/src/mcp/server.mjs`, in every
+ * layout (npm install, source checkout, dev-mode edge checkout). There is
+ * no runtime path that falls back to `src/mcp/server.mjs` directly, so a
+ * health check that also accepts that source path can report OK for a
+ * layout where `aiwg mcp serve` will actually fail (#276).
+ *
+ * @param {string} packageRoot - This install's own package root (`getPackageRoot()`).
+ * @param {{devMode?: boolean, edgePath?: string}} config - Channel config (`loadConfig()`).
+ * @returns {string} Absolute path to the compiled MCP server entrypoint.
+ */
+export function resolveMcpServerEntrypointPath(packageRoot, config) {
+  const root = resolveEffectiveInstallationRoot(packageRoot, config);
+  return path.join(root, 'dist', 'src', 'mcp', 'server.mjs');
+}
+
 /**
  * Load channel configuration
  * @returns {Promise<object>} Channel configuration
@@ -237,6 +283,9 @@ export async function getFrameworkRoot(options = {}) {
  */
 export async function switchToEdge() {
   const config = await loadConfig();
+  if (typeof config.edgePath !== 'string' || !path.isAbsolute(config.edgePath)) {
+    throw new Error('Edge installation path must be absolute');
+  }
 
   console.log('Switching to edge channel (bleeding edge from main branch)...');
   console.log('');
@@ -256,8 +305,8 @@ export async function switchToEdge() {
         const sparseConfig = path.join(config.edgePath, '.git', 'info', 'sparse-checkout');
         const hasSparse = await fs.access(sparseConfig).then(() => true).catch(() => false);
         if (!hasSparse) {
-          execSync('git sparse-checkout init --cone', { cwd: config.edgePath, stdio: 'pipe' });
-          execSync('git sparse-checkout set --no-cone "/*" "!/.aiwg"', { cwd: config.edgePath, stdio: 'pipe' });
+          boundedExecFileSync('git', ['sparse-checkout', 'init', '--cone'], 'quick', { cwd: config.edgePath, stdio: 'pipe' });
+          boundedExecFileSync('git', ['sparse-checkout', 'set', '--no-cone', '/*', '!/.aiwg'], 'quick', { cwd: config.edgePath, stdio: 'pipe' });
         }
       } catch {
         // Sparse checkout is optional — older git may not support it
@@ -275,11 +324,12 @@ export async function switchToEdge() {
     console.log(`Cloning repository to ${config.edgePath}...`);
     await fs.mkdir(path.dirname(config.edgePath), { recursive: true });
     try {
-      execSync(`git clone --branch main ${REPO_URL} "${config.edgePath}"`, { stdio: 'inherit' });
+      // Cloning the full repository; long tier (#3062).
+      boundedExecFileSync('git', ['clone', '--branch', 'main', '--', REPO_URL, config.edgePath], 'long', { stdio: 'inherit' });
       // Exclude dogfooding artifacts from edge clones — users want framework source only
       try {
-        execSync('git sparse-checkout init --cone', { cwd: config.edgePath, stdio: 'pipe' });
-        execSync('git sparse-checkout set --no-cone "/*" "!/.aiwg"', { cwd: config.edgePath, stdio: 'pipe' });
+        boundedExecFileSync('git', ['sparse-checkout', 'init', '--cone'], 'quick', { cwd: config.edgePath, stdio: 'pipe' });
+        boundedExecFileSync('git', ['sparse-checkout', 'set', '--no-cone', '/*', '!/.aiwg'], 'quick', { cwd: config.edgePath, stdio: 'pipe' });
       } catch {
         // Sparse checkout is optional — older git versions may not support it
         console.log('Note: sparse checkout not available, .aiwg/ will be present in edge install.');
@@ -375,7 +425,7 @@ export async function switchToNext() {
   console.log('');
 
   try {
-    execFileSync(status.identity.managerExecutable, ['install', '--global', 'aiwg@next'], { stdio: 'inherit' });
+    boundedExecFileSync(status.identity.managerExecutable, ['install', '--global', 'aiwg@next'], 'long', { stdio: 'inherit' });
   } catch (error) {
     console.error('Failed to install aiwg@next:', error.message);
     console.error('Check that npm is available and you have write access to the global prefix.');
@@ -409,7 +459,7 @@ export async function switchToNightly() {
   console.log('');
 
   try {
-    execFileSync(status.identity.managerExecutable, ['install', '--global', 'aiwg@nightly'], { stdio: 'inherit' });
+    boundedExecFileSync(status.identity.managerExecutable, ['install', '--global', 'aiwg@nightly'], 'long', { stdio: 'inherit' });
   } catch (error) {
     console.error('Failed to install aiwg@nightly:', error.message);
     console.error('Check that npm is available and you have write access to the global prefix.');
@@ -491,6 +541,19 @@ export async function getVersionInfo() {
   const packageJsonPath = path.join(packageRoot, 'package.json');
   const packageJson = JSON.parse(await fs.readFile(packageJsonPath, 'utf8'));
 
+  const launcherRoot = process.env.AIWG_LAUNCHER_ROOT || packageRoot;
+  const runtimePath = resolveEffectiveInstallationRoot(launcherRoot, config);
+  const readVersion = async (root) => {
+    try {
+      const pkg = JSON.parse(await fs.readFile(path.join(root, 'package.json'), 'utf8'));
+      return typeof pkg.version === 'string' ? pkg.version : '(unknown)';
+    } catch {
+      return '(unknown)';
+    }
+  };
+  const launcherVersion = await readVersion(launcherRoot);
+  const runtimeVersion = await readVersion(runtimePath);
+
   // Detect pre-release channel from version string when channel.json says 'stable'
   // This handles the case where a user ran `npm install -g aiwg@next` directly —
   // npm updates the binary but channel.json stays as 'stable'.
@@ -510,6 +573,9 @@ export async function getVersionInfo() {
 
   const info = {
     version,
+    launcherVersion,
+    runtimeVersion,
+    runtimePath,
     channel,
     packageRoot,
     installation,
@@ -526,11 +592,11 @@ export async function getVersionInfo() {
   if (config.channel === 'edge') {
     // Get git info for edge channel
     try {
-      const gitHash = execSync('git rev-parse --short HEAD', {
+      const gitHash = boundedExecFileSync('git', ['rev-parse', '--short', 'HEAD'], 'quick', {
         cwd: config.edgePath,
         encoding: 'utf8',
       }).trim();
-      const gitBranch = execSync('git branch --show-current', {
+      const gitBranch = boundedExecFileSync('git', ['branch', '--show-current'], 'quick', {
         cwd: config.edgePath,
         encoding: 'utf8',
       }).trim();

package/dist/src/cli/child-process-result.js

@@ -0,0 +1,40 @@
+/**
+ * Shared `spawnSync`/`boundedSpawnSync` result-to-exit-code mapping (#3062
+ * review item 7).
+ *
+ * `SpawnSyncReturns.status` is `null` on spawn failure, timeout, or signal
+ * termination — not `0`. Several call sites derived a CLI exit code with
+ * `result.status ?? 0`, which reports *success* for exactly those failure
+ * cases. This helper never does that: a `status` of `null` defaults to a
+ * non-zero exit, and when the bounded helper's `error`/`signal` fields are
+ * present, their message (already enriched with the tier/bound/override
+ * guidance for a timeout) is surfaced instead of being silently dropped.
+ *
+ * Deliberately lives under `src/cli/` rather than `src/process/` so it
+ * composes with, but does not modify, the bounded helper itself.
+ *
+ * @module src/cli/child-process-result
+ */
+/**
+ * Map one spawn result to `{ exitCode, message? }`.
+ *
+ * - `result.error` set (spawn failure, or a bounded-helper timeout with its
+ *   enriched message) → non-zero, `message` is `error.message` (optionally
+ *   prefixed with `context`).
+ * - No `error`, but `result.signal` set (child killed by a signal, with no
+ *   separate error object) → non-zero, `message` names the signal.
+ * - Otherwise → `result.status ?? 1` (a `null`/`undefined` status with
+ *   neither `error` nor `signal` set is still treated as a failure, never
+ *   as success).
+ */
+export function exitCodeForSpawnResult(result, context) {
+    const prefix = context ? `${context}: ` : '';
+    if (result.error) {
+        return { exitCode: 1, message: `${prefix}${result.error.message}` };
+    }
+    if (result.signal) {
+        return { exitCode: 1, message: `${prefix}terminated by signal ${result.signal}` };
+    }
+    return { exitCode: result.status ?? 1 };
+}
+//# sourceMappingURL=child-process-result.js.map

package/dist/src/cli/command-log.js

@@ -2,7 +2,7 @@ import { mkdir, readFile, rename, stat, writeFile, appendFile } from 'fs/promise
 import { existsSync } from 'fs';
 import { createHash } from 'crypto';
 import path from 'path';
-import os from 'os';
+import { getUserStateDir } from '../config/user-state.js';
 import { readAiwgConfig } from '../config/aiwg-config.js';
 import { PROJECT_AIWG_LOCATION_FILE, projectAiwgPath, projectControlPath, } from '../config/project-artifacts.js';
 const DEFAULT_MAX_BYTES = 1_048_576;
@@ -170,8 +170,7 @@ function resolveLogPath(scope, projectRoot, env) {
             return null;
         return projectAiwgPath(projectRoot, 'telemetry', 'cli-commands.jsonl');
     }
-    const stateHome = env.XDG_STATE_HOME || path.join(os.homedir(), '.local', 'state');
-    return path.join(stateHome, 'aiwg', 'cli-commands.jsonl');
+    return path.join(getUserStateDir(env), 'cli-commands.jsonl');
 }
 async function appendBoundedJsonl(filePath, event, maxBytes) {
     await mkdir(path.dirname(filePath), { recursive: true });

package/dist/src/cli/env.js

@@ -25,9 +25,24 @@
  *
  * Handlers MUST call this helper instead of re-deriving the check locally.
  * Divergent isTTY checks scattered across handlers have caused bugs in the
- * past (#918 audit findings).
+ * past (#918 audit findings, and #3062 review item 12: `init` only checked
+ * `CI === 'true'`, `setup project` ignored CI/TERM entirely, and `session`
+ * ignored its own `--non-interactive` flag — each reinventing a narrower
+ * version of this same check instead of using it).
+ *
+ * @param explicitNonInteractive When `true`, short-circuits to `false`
+ *   without inspecting the environment at all. Pass the caller's own
+ *   explicit non-interactive flag here (e.g. `--non-interactive`, or
+ *   `--yes` where it means "don't prompt") so the single interactive
+ *   decision takes the command's explicit flags as input, rather than
+ *   every call site re-deriving its own mix of flag-vs-environment
+ *   precedence. Omit it (or pass `false`) to fall through to the
+ *   environment-only checks below, unchanged from before this parameter
+ *   existed.
  */
-export function isInteractive() {
+export function isInteractive(explicitNonInteractive = false) {
+    if (explicitNonInteractive)
+        return false;
     if (!process.stdin.isTTY)
         return false;
     if (!process.stdout.isTTY)
@@ -40,25 +55,32 @@ export function isInteractive() {
         return false;
     return true;
 }
+/**
+ * Variables that mark a continuous-integration environment. Exported so tests
+ * that need the interactive path can clear exactly what `isCI()` reads.
+ */
+export const CI_ENV_VARS = [
+    'CI',
+    'CONTINUOUS_INTEGRATION',
+    'BUILD_NUMBER',
+    'RUN_ID',
+    'GITHUB_ACTIONS',
+    'GITLAB_CI',
+    'CIRCLECI',
+    'TRAVIS',
+    'BUILDKITE',
+    'JENKINS_URL',
+    'TF_BUILD', // Azure DevOps
+    'TEAMCITY_VERSION',
+];
+/** Other variables `isInteractive()` reads. */
+export const INTERACTIVE_ENV_VARS = ['TERM', 'DEBIAN_FRONTEND'];
 /**
  * Return true iff we're running in a continuous-integration environment.
  * Checks the common CI env vars set by major CI systems.
  */
 export function isCI() {
-    const ciVars = [
-        'CI',
-        'CONTINUOUS_INTEGRATION',
-        'BUILD_NUMBER',
-        'RUN_ID',
-        'GITHUB_ACTIONS',
-        'GITLAB_CI',
-        'CIRCLECI',
-        'TRAVIS',
-        'BUILDKITE',
-        'JENKINS_URL',
-        'TF_BUILD', // Azure DevOps
-        'TEAMCITY_VERSION',
-    ];
+    const ciVars = CI_ENV_VARS;
     for (const v of ciVars) {
         const val = process.env[v];
         if (val && val !== '0' && val.toLowerCase() !== 'false')

package/dist/src/cli/flag-parsing.js

@@ -0,0 +1,236 @@
+/**
+ * Shared strict CLI flag/value parsing (#3062 review item 11, and the
+ * second-round review's finding 4).
+ *
+ * Several handlers (`init`, `setup`, `session`, `setup-run`) each grew
+ * their own small `flagValue(args, name)` helper, and every one of them
+ * treated a flag that is present but missing its value the same as a flag
+ * that was never given at all — `--prompt` as the very last token, or
+ * immediately followed by another flag, silently resolved to `undefined`
+ * instead of erroring. At a terminal that let the handler fall through
+ * into an interactive prompt instead of reporting the mistake; without one
+ * it could proceed on a silently-wrong default.
+ *
+ * The first-round shared parser fixed that but introduced its own gaps,
+ * found by the second review:
+ *
+ *   - It validated only the *first* occurrence of a repeated single-value
+ *     flag, so `--provider claude --provider` (a malformed second
+ *     occurrence) silently passed.
+ *   - It always resolved a repeated flag to its first occurrence, which
+ *     silently changed `aiwg session`'s pre-existing last-occurrence-wins
+ *     precedence for `--provider`/`--profile` to first-wins — a real
+ *     behavior regression, not just a new validation gap.
+ *   - `--flag=value` was never recognized at all.
+ *   - Scanning never stopped at a bare `--` terminator.
+ *   - An empty-string value (`--prompt ''`) was accepted as a valid value
+ *     for flags where that is never meaningful.
+ *
+ * {@link scanFlagOccurrences} is the single-pass tokenizer every other
+ * helper here is built on: it finds *every* occurrence of the named
+ * flag(s), in one scan, validating each one independently, and stops
+ * recognizing flags entirely once it sees a bare `--` token (everything
+ * after that point is positional, per POSIX convention). `--flag value`
+ * and `--flag=value` are both accepted; in the space-separated form a
+ * value that itself looks like another flag (starts with `--`) is treated
+ * as a missing value — pass it via the `=` form instead
+ * (`--flag=--literal`) when a value must start with `--`. A value starting
+ * with a single `-` is always accepted in either form.
+ *
+ * Callers choose `precedence: 'first' | 'last'` to match whatever
+ * precedence the command already had before this module existed — see
+ * each call site's own comment for which one applies and why. Callers
+ * MUST catch {@link MissingFlagValueError} (or let it propagate to a
+ * handler-level catch) and report it before any preflight check, spawn,
+ * or write — never after.
+ */
+/** Thrown when a recognized flag is present but has no usable value following it. */
+export class MissingFlagValueError extends Error {
+    /** The exact flag token that was missing its value (e.g. `--prompt`). */
+    flagName;
+    constructor(flagName) {
+        super(`${flagName} requires a value`);
+        this.name = 'MissingFlagValueError';
+        this.flagName = flagName;
+    }
+}
+function splitEquals(token) {
+    const eq = token.indexOf('=');
+    if (eq === -1)
+        return null;
+    return [token.slice(0, eq), token.slice(eq + 1)];
+}
+/**
+ * Single-pass scan for every occurrence of any of `names` in `args`. See
+ * the module doc comment for the full set of semantics this implements.
+ *
+ * Throws {@link MissingFlagValueError} on the *first* occurrence (in
+ * left-to-right order) that has no usable value or an empty one (when
+ * `options.rejectEmpty`) — every occurrence is checked, not just the
+ * first one found overall, so a malformed *later* occurrence is still an
+ * error even when an earlier one was valid.
+ */
+export function scanFlagOccurrences(args, names, options = {}) {
+    const occurrences = [];
+    for (let i = 0; i < args.length; i += 1) {
+        const token = args[i];
+        if (token === undefined)
+            continue;
+        if (token === '--')
+            break; // bare terminator — stop recognizing flags entirely
+        if (token.startsWith('--')) {
+            const eqSplit = splitEquals(token);
+            if (eqSplit && names.includes(eqSplit[0])) {
+                const [flag, value] = eqSplit;
+                if (options.rejectEmpty && value === '')
+                    throw new MissingFlagValueError(flag);
+                occurrences.push({ index: i, flag, value });
+                continue;
+            }
+        }
+        if (names.includes(token)) {
+            const next = args[i + 1];
+            if (next === undefined || next.startsWith('--')) {
+                throw new MissingFlagValueError(token);
+            }
+            if (options.rejectEmpty && next === '') {
+                throw new MissingFlagValueError(token);
+            }
+            occurrences.push({ index: i, flag: token, value: next });
+            i += 1; // skip the consumed value token
+        }
+    }
+    return occurrences;
+}
+/**
+ * Look up the value of a (possibly repeated) single-value flag.
+ *
+ * - None of `names` appear at all → `undefined` (the flag was never
+ *   given; not an error).
+ * - `names` appear once or more, every occurrence validated → the first
+ *   or last occurrence's value, per `options.precedence` (default
+ *   `'first'`). Pass `'last'` only for a command whose pre-existing
+ *   behavior (before this module existed) already let a later occurrence
+ *   override an earlier one — see the call site's comment.
+ */
+export function requireFlagValue(args, options, ...names) {
+    const occurrences = scanFlagOccurrences(args, names, options);
+    if (occurrences.length === 0)
+        return undefined;
+    return options.precedence === 'last'
+        ? occurrences[occurrences.length - 1].value
+        : occurrences[0].value;
+}
+/**
+ * Same validation contract as {@link requireFlagValue}, but collects the
+ * value of *every* occurrence in left-to-right order — for repeatable
+ * flags such as `--param`/`--script`. Returns `[]` when the flag never
+ * appears.
+ */
+export function collectFlagValues(args, options, ...names) {
+    return scanFlagOccurrences(args, names, options).map((occurrence) => occurrence.value);
+}
+/**
+ * Parse a strict `true`/`false` flag value. `undefined` in means the flag
+ * was not given (not an error, and not a default — callers decide the
+ * default). Anything other than exactly `true`/`false` throws, naming
+ * `flagName` in the message.
+ */
+export function parseBooleanFlagValue(value, flagName) {
+    if (value === undefined)
+        return undefined;
+    if (value === 'true')
+        return true;
+    if (value === 'false')
+        return false;
+    throw new Error(`${flagName} must be true or false (got '${value}')`);
+}
+/**
+ * Parse a comma-separated list flag value, trimming whitespace and
+ * dropping empty entries. Returns `undefined` when `raw` is `undefined`
+ * (flag not given); returns `[]` only if every entry was empty.
+ */
+export function parseListFlagValue(raw) {
+    if (raw === undefined)
+        return undefined;
+    return raw.split(',').map((entry) => entry.trim()).filter(Boolean);
+}
+/**
+ * Split one repeatable `<name>=<value>` entry (as used by `--script`,
+ * `--param`) into its parts. Throws, naming `flagName`, when `entry` has
+ * no `=`, an empty name, or an empty value.
+ */
+export function parseKeyValueEntry(entry, flagName) {
+    const eq = entry.indexOf('=');
+    if (eq <= 0 || eq === entry.length - 1) {
+        throw new Error(`${flagName} requires the form <name>=<value> (got '${entry}')`);
+    }
+    return [entry.slice(0, eq).trim(), entry.slice(eq + 1).trim()];
+}
+/**
+ * The index of the first bare `--` terminator in `args`, or `args.length`
+ * when there is none — a loop bounded by this never looks at anything
+ * after the terminator, which per POSIX convention is never a flag or a
+ * command word again (#3062 go/no-go review, blocker 4).
+ */
+export function argsTerminatorIndex(args) {
+    const index = args.indexOf('--');
+    return index === -1 ? args.length : index;
+}
+/**
+ * The set of array indexes in `args` consumed as the *value* of a
+ * `--flag value` (two-token) occurrence of any name in `valueFlagNames`
+ * (#3062 go/no-go review, blocker 4). A `--flag=value` (one-token) form
+ * has no separate value index to report — the value is part of the same
+ * token, so it can never coincidentally equal a bare positional word or a
+ * different flag's own name the way a space-separated value can.
+ *
+ * This does not validate occurrences (a missing/malformed value is the
+ * paired value-flag parser's own job — e.g. {@link requireFlagValue} on
+ * the same `args` and `valueFlagNames`, called separately); it exists
+ * purely so a positional/switch scan knows which indexes are already
+ * spoken for and must not be reinterpreted as something else.
+ */
+export function valueTokenIndexes(args, valueFlagNames) {
+    const consumed = new Set();
+    const limit = args.length;
+    for (let i = 0; i < limit; i += 1) {
+        const token = args[i];
+        if (token === undefined)
+            continue;
+        if (token === '--')
+            break;
+        if (token.startsWith('--') && token.includes('='))
+            continue; // value is part of this same token
+        if (valueFlagNames.includes(token) && i + 1 < limit) {
+            consumed.add(i + 1);
+            i += 1; // the value token itself is spoken for; do not also treat it as a flag name
+        }
+    }
+    return consumed;
+}
+/**
+ * True iff `name` appears as a bare positional token or an exact-match
+ * boolean switch anywhere in `args` *before* the `--` terminator, and is
+ * not itself the already-consumed value of one of `valueFlagNames` (#3062
+ * go/no-go review, blocker 4).
+ *
+ * Use this instead of `args.includes(name)` (or an equivalent hand-rolled
+ * loop) for any boolean switch or positional command word that a value-
+ * taking flag's own value could coincidentally equal — e.g. a free-text
+ * `--prompt` argument that happens to contain the literal word a command
+ * also uses as a switch, or a value that collides with another flag's own
+ * name.
+ */
+export function hasPositionalOrSwitch(args, name, valueFlagNames) {
+    const consumed = valueTokenIndexes(args, valueFlagNames);
+    const limit = argsTerminatorIndex(args);
+    for (let i = 0; i < limit; i += 1) {
+        if (consumed.has(i))
+            continue;
+        if (args[i] === name)
+            return true;
+    }
+    return false;
+}
+//# sourceMappingURL=flag-parsing.js.map

package/dist/src/cli/handlers/artifacts.js

@@ -32,6 +32,9 @@ export const artifactsHandler = {
     description: 'Move or inspect the configured project AIWG artifact root',
     category: 'index',
     aliases: ['artifact'],
+    async help() {
+        return { exitCode: 0, message: usage(), rawOutput: true };
+    },
     async execute(ctx) {
         const action = ctx.args.find(arg => !arg.startsWith('-')) ?? 'help';
         if (action === 'help' || ctx.args.includes('--help') || ctx.args.includes('-h')) {

package/dist/src/cli/handlers/auth.js

@@ -37,6 +37,9 @@ export function createAuthHandler(dependencies = {}) {
         description: "Log in, inspect access, and log out of paid AIWG web resources",
         category: "maintenance",
         aliases: [],
+        async help() {
+            return { exitCode: 0, message: usage(), rawOutput: true };
+        },
         async execute(ctx) {
             if (!ctx.args.length || ["help", "--help", "-h"].includes(ctx.args[0])) {
                 console.log(usage());