@aiwg/cli 2026.10.1 → 2026.10.4

package/dist/src/cli/handlers/refresh.js

@@ -24,6 +24,7 @@ import { refreshAllPackages } from '../../packages/registry.js';
 import { resolveActiveProvider } from '../provider-resolution.js';
 import { readAiwgConfig, writeAiwgConfig, hashManifest, getProviderParallelismDefaults, } from '../../config/aiwg-config.js';
 import { discoverProjectLocalBundles } from '../../extensions/project-local-discovery.js';
+import { detectInstalledWorkerClis, evaluateWorkerDispatchOffer, workerDispatchOfferHint } from '../../models/worker-dispatch-offer.js';
 import { getProviderArtifactPathStrings } from '../../providers/provider-definitions.js';
 import { collectPackagedAgentInventory, normalizeAgentArtifactName, parseManagedArtifactMarker, } from '../../agents/packaged-agent-inventory.js';
 import * as ui from '../ui.js';
@@ -571,6 +572,7 @@ export const refreshHandler = {
                         // #2507: give operators a reclaim path for artifacts an older
                         // AIWG left behind without a managed marker.
                         ...(forceDeploy ? ['--force'] : []),
+                        ...(hasFlag(ctx.args, '--allow-over-budget') ? ['--allow-over-budget'] : []),
                         ...modelDeployArgs,
                     ],
                     rawArgs: ['use', fw],
@@ -595,6 +597,17 @@ export const refreshHandler = {
                 }
             }
         }
+        // Runtime updates can change the corpus even when there are no recorded
+        // deployments. Refresh both discovery representations, independently of use.
+        if (!dryRun) {
+            try {
+                const { refreshFrameworkCapabilities } = await import('../../artifacts/framework-capabilities.js');
+                await refreshFrameworkCapabilities(frameworkRoot, true, { force: true });
+            }
+            catch (error) {
+                ui.warn(`Capability index refresh failed: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
         // Step 4.25: Report planned project-local deploys (#1035).
         // The active use handler performs the actual project-local deploy during
         // framework refresh; this block surfaces dry-run and completion details.
@@ -786,6 +799,21 @@ export const refreshHandler = {
                 // Non-fatal — refresh continues even if migration fails
             }
         }
+        // Step 4.65: Direct worker dispatch opt-in hint (#3050). Refresh never
+        // prompts; this only names the enable command when dispatch is off and
+        // two or more worker CLIs are detected (presence-only PATH scan, no
+        // spawn). Silent otherwise, including after a previous decline.
+        if (!quiet) {
+            try {
+                const config = await readAiwgConfig(process.cwd());
+                const offer = evaluateWorkerDispatchOffer(config?.parallelism, config?.setup, detectInstalledWorkerClis());
+                if (offer.shouldOffer)
+                    ui.info(workerDispatchOfferHint(offer.detected));
+            }
+            catch {
+                // Non-fatal — refresh continues even if the hint check fails
+            }
+        }
         // Step 5: Health check
         if (!quiet)
             ui.info(dryRun ? 'Would run health check...' : 'Running health check...');

package/dist/src/cli/handlers/regenerate.js

@@ -150,6 +150,20 @@ async function handleRegenerate(args, cwd) {
     console.log(`  Selected: ${selection.explicit ? 'explicit' : 'inferred'} — ${selection.reason}`);
     if (selection.evidence.length > 0)
         console.log(`  Evidence: ${selection.evidence.join(', ')}`);
+    // #3050: regenerate never prompts. Point at direct worker dispatch when
+    // it is off and two or more worker CLIs are detected (presence-only PATH
+    // scan, no spawn); silent otherwise, including after a decline.
+    try {
+        const { readAiwgConfig } = await import('../../config/aiwg-config.js');
+        const { detectInstalledWorkerClis, evaluateWorkerDispatchOffer, workerDispatchOfferHint } = await import('../../models/worker-dispatch-offer.js');
+        const dispatchConfig = await readAiwgConfig(target);
+        const offer = evaluateWorkerDispatchOffer(dispatchConfig?.parallelism, dispatchConfig?.setup, detectInstalledWorkerClis());
+        if (offer.shouldOffer)
+            console.log(`  ${workerDispatchOfferHint(offer.detected)}`);
+    }
+    catch {
+        // Non-fatal — this is an informational nudge, never a regenerate gate.
+    }
     if (existingProject) {
         const preflight = await migrateWorkspaceContext(target, {
             dryRun: true,

package/dist/src/cli/handlers/resource-versions.js

@@ -159,6 +159,9 @@ export const versionsHandler = {
     description: "Browse and resolve signed AIWG web resource releases",
     category: "index",
     aliases: [],
+    async help() {
+        return { exitCode: 0, message: usage(), rawOutput: true };
+    },
     async execute(ctx) {
         if (ctx.args[0] === "help" || ctx.args[0] === "--help" || ctx.args[0] === "-h") {
             console.log(usage());

package/dist/src/cli/handlers/rules.js

@@ -0,0 +1,195 @@
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { loadRulePinConfigs, selectorKey, validateRulePinCapabilities } from '../../rules/pins.mjs';
+const usage = `Usage: aiwg rules pin|unpin [rule...] [--tier critical,high] [--capability id,... | --group name] [--all-tiers] [--all]
+       aiwg rules pinned [--capability id] [--json]
+       aiwg rules inventory|list [--scope workspace|user|installation|catalog] [--capability id,...] [--activation mode,...] [--tier level,...] [--provider name] [--bodies] [--json]
+       aiwg rules group set <name> <capability>... | group list
+Flags: --project (default), --user, --dry-run, --no-deploy, --json, --allow-over-budget
+Pins and group changes validate every input without prompting. --dry-run prints effective rules and per-provider startup bytes.`;
+const valueFlags = new Set(['--tier', '--capability', '--group', '--scope', '--activation', '--provider']);
+const boolFlags = new Set(['--all-tiers', '--all', '--dry-run', '--no-deploy', '--json', '--allow-over-budget', '--user', '--project', '--help', '-h', '--bodies']);
+function parse(args) {
+    const values = new Map();
+    const flags = new Set();
+    const positional = [];
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (valueFlags.has(arg)) {
+            if (!args[i + 1] || args[i + 1].startsWith('-') || values.has(arg))
+                throw new Error(`${arg} requires one value`);
+            values.set(arg, args[++i]);
+        }
+        else if (boolFlags.has(arg))
+            flags.add(arg);
+        else if (arg.startsWith('-'))
+            throw new Error(`Unknown flag: ${arg}`);
+        else
+            positional.push(arg);
+    }
+    if (flags.has('--user') && flags.has('--project'))
+        throw new Error('Choose --project or --user');
+    const list = (flag) => values.get(flag)?.split(',').map(id => id.trim());
+    return { values, flags, positional, list };
+}
+// Provider helpers log progress while assembling staged output. Keep the command's
+// stdout a single JSON document (and keep temporary staging paths out of text output).
+async function quietDeployment(deploy, options) {
+    const log = console.log;
+    const warn = console.warn;
+    try {
+        console.log = () => { };
+        console.warn = () => { };
+        return await deploy(options);
+    }
+    finally {
+        console.log = log;
+        console.warn = warn;
+    }
+}
+export const rulesHandler = {
+    id: 'rules', name: 'Rule pins', category: 'config', aliases: [],
+    description: 'Pin rules to every request, inspect pins, and manage capability groups',
+    async help() { return { exitCode: 0, message: usage, rawOutput: true }; },
+    async execute(ctx) {
+        const json = ctx.args.includes('--json');
+        try {
+            const { values, flags, positional, list } = parse(ctx.args);
+            if (flags.has('--help') || flags.has('-h') || !positional.length)
+                return { exitCode: 0, message: usage, rawOutput: true };
+            const { rulePinState } = await import('../../rules/pin-state.js');
+            const { setRuleConfigKey } = await import('../../config/cli.js');
+            const [command, ...ids] = positional;
+            if (command === 'inventory' || command === 'list') {
+                if (ids.length || values.has('--group') || [...flags].some(flag => !['--json', '--bodies'].includes(flag)))
+                    throw new Error('inventory accepts only inventory filters and output flags');
+                const scope = values.get('--scope') ?? 'workspace';
+                if (!['workspace', 'user', 'installation', 'catalog'].includes(scope))
+                    throw new Error('Invalid inventory scope');
+                const activation = list('--activation');
+                const tier = list('--tier');
+                if (activation?.some(value => !['kernel', 'summary', 'bound', 'paths', 'on-demand'].includes(value)))
+                    throw new Error('Invalid activation filter');
+                if (tier?.some(value => !['critical', 'high', 'medium', 'low'].includes(value)))
+                    throw new Error('Invalid tier filter');
+                if (list('--capability')?.some(value => !value))
+                    throw new Error('Invalid capability filter');
+                const { ruleInventory } = await import('../../rules/inventory.js');
+                const report = await ruleInventory(ctx.cwd, ctx.frameworkRoot, { scope: scope, capability: list('--capability'), activation, enforcement: tier, provider: values.get('--provider'), bodies: flags.has('--bodies') });
+                return { exitCode: 0, rawOutput: true, message: json ? JSON.stringify(report, null, 2) :
+                        [`Scope: ${report.scope} (${report.scope_description})`, 'Per-rule delivery and session loading: unknown.', ...report.rules.map(rule => `${rule.capability}/${rule.name} [${rule.effective_activation ?? 'unconfigured'}, ${rule.enforcement ?? 'unknown'}]: ${rule.summary ?? '(no summary)'}; ${rule.fetch_command ?? 'fetch ID unknown'}${rule.content ? `\n${rule.content}` : ''}`), ...report.warnings, ...(!report.rules.length ? ['No matching rules.'] : [])].join('\n') };
+            }
+            if (values.has('--scope') || values.has('--activation') || values.has('--provider') || flags.has('--bodies'))
+                throw new Error('Inventory filters are only valid for rules inventory');
+            const source = flags.has('--user') ? 'user' : 'project';
+            const configs = loadRulePinConfigs(ctx.cwd);
+            const before = rulePinState(ctx.cwd, ctx.frameworkRoot, configs, true);
+            if (command === 'pinned') {
+                if (ids.length || [...values.keys()].some(key => key !== '--capability'))
+                    throw new Error('pinned accepts only --capability and output/scope flags');
+                const filter = list('--capability');
+                if (filter?.some(id => !before.installed.includes(id)))
+                    throw new Error(`Unknown capability. Installed ids: ${before.installed.join(', ')}`);
+                const rules = before.rules.filter(rule => !filter || filter.includes(rule.capability?.replace(/^(framework|addon|extension|plugin):/, '') || ''));
+                return { exitCode: 0, message: json ? JSON.stringify({ rules, warnings: before.warnings }, null, 2)
+                        : [...rules.map(rule => `${rule.name}: pinned kernel (canonical ${rule.canonical_activation}) ${rule.matches.map(match => `${match.source}: ${JSON.stringify(match.selector)}`).join('; ')}`), ...before.warnings, ...(!rules.length ? ['No effective rule pins.'] : [])].join('\n'), rawOutput: true };
+            }
+            if (command === 'group' && ids[0] === 'list') {
+                if (ids.length !== 1 || values.size)
+                    throw new Error('Usage: aiwg rules group list');
+                const groups = { user: configs.user.rules?.pin_groups || {}, project: configs.project.rules?.pin_groups || {} };
+                return { exitCode: 0, message: JSON.stringify(groups, null, 2), rawOutput: true };
+            }
+            const selected = configs[source];
+            selected.rules = { ...selected.rules };
+            if (command === 'group') {
+                const [action, name, ...capabilities] = ids;
+                if (action !== 'set' || !name || !capabilities.length || values.size)
+                    throw new Error('Usage: aiwg rules group set <name> <capability>...');
+                selected.rules.pin_groups = { ...selected.rules.pin_groups, [name]: [...new Set(capabilities.flatMap(id => id.split(',')))].sort() };
+            }
+            else if (command === 'pin' || command === 'unpin') {
+                if (flags.has('--all-tiers') && values.has('--tier'))
+                    throw new Error('--all-tiers and --tier are mutually exclusive');
+                const selector = {};
+                if (ids.length)
+                    selector.rules = [...new Set(ids)].sort();
+                if (values.has('--tier'))
+                    selector.enforcement = list('--tier');
+                if (values.has('--capability'))
+                    selector.capabilities = list('--capability');
+                if (values.has('--group'))
+                    selector.group = values.get('--group');
+                if (flags.has('--all'))
+                    selector.all = true;
+                if (!Object.keys(selector).length)
+                    throw new Error('Supply rule ids, --tier, --capability, --group, or --all');
+                if (flags.has('--all-tiers') && !selector.capabilities && !selector.group && !selector.all)
+                    throw new Error('--all-tiers requires --capability, --group or --all');
+                const existing = selected.rules.always_load || [];
+                const key = selectorKey(selector);
+                if (command === 'pin') {
+                    const unknown = ids.filter(id => !before.inventory.some(rule => [rule.name, rule.id, rule.path].includes(id)));
+                    if (unknown.length)
+                        throw new Error(`Unknown installed rule ids: ${unknown.join(', ')}`);
+                    selected.rules.always_load = existing.some(item => selectorKey(item) === key) ? existing : [...existing, selector];
+                }
+                else
+                    selected.rules.always_load = existing.filter(item => selectorKey(item) !== key);
+            }
+            else
+                throw new Error(usage);
+            // Only the edited scope is strict: stale pins in another scope remain visible warnings.
+            const errors = validateRulePinCapabilities(selected.rules, before.installed, { ...configs.user.rules?.pin_groups, ...configs.project.rules?.pin_groups });
+            if (errors.length)
+                throw new Error(errors.join('\n'));
+            const after = rulePinState(ctx.cwd, ctx.frameworkRoot, configs, true);
+            const providers = [...new Set([...(configs.project.providers || []), ...Object.values(configs.project.installed || {}).flatMap(entry => Object.keys(entry.deployedTo || {}))])];
+            const reports = [];
+            const failures = [];
+            const plans = [];
+            // Use precisely the installed rule inventory, including local bundles; do not select new capabilities.
+            for (const provider of providers) {
+                if (!['claude', 'codex', 'cursor', 'hermes', 'warp', 'openclaw'].includes(provider)) {
+                    failures.push(`Rule pin projection is unavailable for provider '${provider}'`);
+                    continue;
+                }
+                const module = await import(pathToFileURL(path.join(ctx.frameworkRoot, 'tools/agents/providers', `${provider}.mjs`)).href);
+                const options = { srcRoot: path.join(ctx.frameworkRoot, 'agentic/code'), target: ctx.cwd, mode: 'all',
+                    ruleSources: after.inventory.map(rule => rule.path), config: configs.project, pinConfigs: configs,
+                    rulesOnly: true, deployRules: true, deploySkills: false, deployCommands: false,
+                    force: true, quiet: true, allowOverBudget: flags.has('--allow-over-budget') };
+                try {
+                    const report = await quietDeployment(module.deploy, { ...options, dryRun: true, previewReport: true });
+                    reports.push(report);
+                    plans.push({ deploy: module.deploy, options });
+                }
+                catch (error) {
+                    failures.push(`${provider}: ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
+            if (failures.length)
+                throw new Error(failures.join('\n'));
+            const dryRun = flags.has('--dry-run') || ctx.dryRun;
+            if (!dryRun) {
+                await setRuleConfigKey(ctx.cwd, source, 'rules', JSON.stringify(selected.rules));
+                if (!flags.has('--no-deploy'))
+                    for (const plan of plans)
+                        await quietDeployment(plan.deploy, plan.options);
+            }
+            const redeploy = 'aiwg refresh --skip-update --force' + (flags.has('--allow-over-budget') ? ' --allow-over-budget' : '');
+            const needsRedeploy = flags.has('--no-deploy') || plans.length === 0;
+            const output = { dry_run: !!dryRun, source, rules: after.rules, warnings: after.warnings, providers: reports,
+                deployed: !dryRun && !needsRedeploy, ...(needsRedeploy ? { redeploy } : {}) };
+            return { exitCode: 0, message: json ? JSON.stringify(output, null, 2)
+                    : [dryRun ? 'Rule pin preview (config unchanged)' : 'Rule pins updated', ...after.rules.map(rule => `${rule.name}: kernel (canonical ${rule.canonical_activation})`),
+                        ...reports.map(report => { const r = report; return `${r.provider}: ${r.selected_bytes} startup bytes${report.exceeded ? ' (over budget; explicitly allowed)' : ''}`; }),
+                        ...after.warnings, ...(needsRedeploy ? [`Redeploy: ${redeploy}`] : [])].join('\n'), rawOutput: true };
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            return { exitCode: 1, message: json ? JSON.stringify({ error: message }) : message, rawOutput: json };
+        }
+    },
+};
+//# sourceMappingURL=rules.js.map

package/dist/src/cli/handlers/run.js

@@ -62,6 +62,10 @@ export const runHandler = {
     description: 'Run a user-defined script from aiwg.config',
     category: 'utility',
     aliases: [],
+    async help() {
+        printRunUsage();
+        return { exitCode: 0 };
+    },
     async execute(ctx) {
         let parsed;
         try {

package/dist/src/cli/handlers/runtime-info.js

@@ -12,6 +12,7 @@ import path from 'path';
 import { AiwgError, EXIT_CODES, handlerResultFromError } from '../errors.js';
 import { getPackageRoot } from '../../channel/manager.mjs';
 import { inspectInstallation } from '../../installation/manager.mjs';
+import { isSessionProviderResolution, resolveActiveProvider } from '../provider-resolution.js';
 function isMissingRuntimeCatalogError(error) {
     return error instanceof Error && error.message.includes('No catalog found');
 }
@@ -201,8 +202,7 @@ async function handleRuntimeInfo(args, cwd = process.cwd()) {
     const { RuntimeDiscovery } = await import('../../smiths/toolsmith/runtime-discovery.mjs');
     const discovery = new RuntimeDiscovery();
     if (hasDiscover) {
-        // Full discovery
-        const catalog = await discovery.discover();
+        const catalog = await discovery.discover({ force: args.includes('--force') });
         if (hasJson) {
             console.log(JSON.stringify(catalog, null, 2));
         }
@@ -304,21 +304,35 @@ async function handleRuntimeInfo(args, cwd = process.cwd()) {
             console.log(`  Run mode:  ${installation.identity?.runMode ?? '(unrecorded)'}`);
             console.log(`  State:     ${installation.state}`);
             // Scheduler backend detection
-            const { execSync } = await import('child_process');
+            const { boundedExecFileSync } = await import('../../process/bounded-child-process.mjs');
             let schedulerBackend = 'external trigger required (system cron/systemd/CI)';
             let chronyInstalled = false;
-            try {
-                execSync('which chronyc 2>/dev/null || which chronyd 2>/dev/null', { stdio: 'pipe' });
-                chronyInstalled = true;
-            }
-            catch {
-                // chrony not found
+            for (const tool of ['chronyc', 'chronyd']) {
+                try {
+                    boundedExecFileSync('which', [tool], 'quick', { stdio: ['pipe', 'pipe', 'ignore'] });
+                    chronyInstalled = true;
+                    break;
+                }
+                catch {
+                    // Try the next chrony binary.
+                }
             }
             // Native CronCreate is only available when running inside a Claude Code agent context.
             // The CLI itself cannot call agent tools, so we report based on platform heuristics.
             // When invoked from within an agent, the schedule skill performs live detection.
-            const isClaudeCodeContext = process.env.CLAUDE_CODE_VERSION !== undefined ||
-                process.env.ANTHROPIC_API_KEY !== undefined;
+            //
+            // Resolved through the same shared provider-resolution path `steward
+            // capabilities` uses (`resolveActiveProvider` -> the `claude` provider's
+            // `detection.env` markers in provider-definitions.ts) so the two never
+            // disagree about which provider the current session is running under
+            // (#2623, #2627). The ad-hoc `CLAUDE_CODE_VERSION`/`ANTHROPIC_API_KEY`
+            // check this replaced was stale (neither is set by current Claude Code)
+            // and `ANTHROPIC_API_KEY` was a false positive for any non-Claude
+            // session with that key set.
+            const activeProviderResolution = await resolveActiveProvider({ cwd });
+            // Only a session signal counts: a project merely configured or deployed
+            // for Claude is not a Claude Code agent context.
+            const isClaudeCodeContext = activeProviderResolution.provider === 'claude' && isSessionProviderResolution(activeProviderResolution);
             if (isClaudeCodeContext) {
                 schedulerBackend = 'native-cron (CronCreate); external trigger outside agent sessions';
             }

package/dist/src/cli/handlers/script-runner.js

@@ -8,6 +8,7 @@
  * @source @src/cli/router.ts
  * @issue #33
  */
+import { signalChild } from '../../process/signal-child.mjs';
 import { spawn } from 'child_process';
 import path from 'path';
 /**
@@ -30,8 +31,8 @@ export class DefaultScriptRunner {
     async run(scriptPath, args = [], options = {}) {
         const fullPath = path.join(this.frameworkRoot, scriptPath);
         return new Promise((resolve) => {
-            // When capture mode is enabled, stdout/stderr are piped back to the
-            // caller so that quiet-mode callers can suppress output. When not
+            // When capture mode is enabled, stdout/stderr are piped so that
+            // quiet-mode callers can suppress output. When not
             // capturing, stdio: 'inherit' lets subprocess output flow directly to
             // the terminal (verbose mode).
             const stdio = options.capture ? 'pipe' : 'inherit';
@@ -40,10 +41,20 @@ export class DefaultScriptRunner {
                 cwd: options.cwd || process.cwd(),
                 env: { ...process.env, ...options.env },
             });
-            let capturedStderr = '';
+            // Always drain captured pipes, even after the diagnostic cap is reached.
+            // stdout is not part of HandlerResult; discard it. Retain only the first
+            // 1 MiB of stderr for failure messages, discarding any excess.
+            child.stdout?.resume();
+            const stderrLimit = 1024 * 1024;
+            const capturedStderr = [];
+            let capturedStderrBytes = 0;
             if (options.capture && child.stderr) {
                 child.stderr.on('data', (data) => {
-                    capturedStderr += data.toString();
+                    const retained = data.subarray(0, stderrLimit - capturedStderrBytes);
+                    if (retained.length > 0) {
+                        capturedStderr.push(Buffer.from(retained));
+                        capturedStderrBytes += retained.length;
+                    }
                 });
             }
             const timeout = options.timeout;
@@ -63,12 +74,12 @@ export class DefaultScriptRunner {
                     // does not exit within the deadline. Both kill() calls are wrapped
                     // because they can throw ESRCH on an already-exited child.
                     try {
-                        child.kill('SIGTERM');
+                        signalChild(child, 'SIGTERM');
                     }
                     catch { /* already exited */ }
                     killEscalationId = setTimeout(() => {
                         try {
-                            child.kill('SIGKILL');
+                            signalChild(child, 'SIGKILL');
                         }
                         catch { /* already exited */ }
                     }, killDeadlineMs);
@@ -86,10 +97,10 @@ export class DefaultScriptRunner {
                 if (killEscalationId)
                     clearTimeout(killEscalationId);
                 // On failure in capture mode, surface the captured stderr
-                if (options.capture && code !== 0 && capturedStderr) {
+                if (options.capture && code !== 0 && capturedStderrBytes > 0) {
                     resolve({
                         exitCode: code ?? 1,
-                        message: capturedStderr.trim(),
+                        message: Buffer.concat(capturedStderr).toString().trim(),
                     });
                 }
                 else {