@aiwg/cli 2026.10.1 → 2026.10.4

package/dist/src/config/cli.js

@@ -8,7 +8,7 @@
  *   validate            — Validate all config files
  *   reset [<key>]       — Reset key or all config to defaults
  *   path                — Print the active config directory path
- *   edit                — Open config in $EDITOR
+ *   edit [--print-path] — Open config in $EDITOR/$VISUAL, or print its path headlessly
  *   gitignore           — Show/check/fix .gitignore for AIWG runtime dirs
  *
  * Global flags:
@@ -19,10 +19,36 @@
  */
 import { fileURLToPath } from 'url';
 import path from 'path';
+import { isDeepStrictEqual } from 'node:util';
+import { normalizeProviderDefinitionId } from '../providers/provider-definitions.js';
 import { UserConfig } from './user-config.js';
 import { AiwgError, EXIT_CODES } from '../cli/errors.js';
+import { isInteractive } from '../cli/env.js';
+import { exitCodeForSpawnResult } from '../cli/child-process-result.js';
 import { projectControlPath, resolveProjectAiwgDir } from './project-artifacts.js';
 const _scriptDir = path.dirname(fileURLToPath(import.meta.url));
+function warnStaleParallelism(cfg, projectDir, key, before) {
+    if (key !== 'parallelism' && !key.startsWith('parallelism.'))
+        return;
+    if (isDeepStrictEqual(before, getDottedPath(cfg, key)))
+        return;
+    const configured = (cfg.providers ?? []).map(normalizeProviderDefinitionId).filter((id) => !!id);
+    const recorded = Object.values(cfg.installed ?? {}).flatMap(entry => Object.keys(entry.deployedTo ?? {}))
+        .map(normalizeProviderDefinitionId).filter((id) => !!id).sort();
+    const providers = [...new Set([...configured, ...recorded])];
+    const targets = providers.length ? providers : ['<provider>'];
+    const lines = [
+        `WARNING: ${key} changed project configuration; generated workspace/provider guidance may now be stale.`,
+        `From project root ${path.resolve(projectDir)}, preview and refresh every configured or recorded provider context:`,
+        ...targets.flatMap(provider => [
+            `  aiwg regenerate --workspace --provider ${provider} --dry-run`,
+            `  aiwg regenerate --workspace --provider ${provider}`,
+        ]),
+        '  aiwg workspace-context doctor',
+        `Shared parallelism defaults and labels use primary provider '${cfg.providers?.[0] ?? 'unknown'}' (providers[0]); --provider selects the adapter/context target.`,
+    ];
+    console.error(lines.join('\n'));
+}
 /**
  * Main CLI entry point for `aiwg config <subcommand> [args]`
  */
@@ -63,7 +89,7 @@ export async function main(args) {
             handlePath(config);
             break;
         case 'edit':
-            await handleEdit(config);
+            await handleEdit(config, subArgs);
             break;
         case 'gitignore':
             await handleGitignore(subArgs);
@@ -86,7 +112,7 @@ export async function main(args) {
 }
 async function handleGet(config, args) {
     const isProject = args.includes('--project');
-    const positional = args.filter(a => a !== '--project' && a !== '--user');
+    const positional = configPositionals(args);
     const key = positional[0];
     if (!key) {
         throw new AiwgError({
@@ -100,6 +126,11 @@ async function handleGet(config, args) {
         await projectConfigGet(key, args);
         return;
     }
+    if (key === 'rules' || key.startsWith('rules.')) {
+        const { loadRulePinConfigs } = await import('../rules/pins.mjs');
+        console.log(JSON.stringify(getDottedPath(loadRulePinConfigs(process.cwd(), undefined, config.getPath()).user, key)) ?? '(not set)');
+        return;
+    }
     const value = await config.get(key);
     if (value === undefined) {
         console.log(`(not set)`);
@@ -113,7 +144,7 @@ async function handleGet(config, args) {
 }
 async function handleSet(config, args) {
     const isProject = args.includes('--project');
-    const positional = args.filter(a => a !== '--project' && a !== '--user');
+    const positional = configPositionals(args);
     const key = positional[0];
     const value = positional[1];
     if (!key || value === undefined) {
@@ -128,6 +159,11 @@ async function handleSet(config, args) {
         await projectConfigSet(key, value, args);
         return;
     }
+    if (key === 'rules' || key.startsWith('rules.')) {
+        await setRuleConfigKey(process.cwd(), 'user', key, value, config.getPath());
+        console.log(`Set --user ${key} = ${value}`);
+        return;
+    }
     await config.set(key, value);
     console.log(`Set ${key} = ${value}`);
 }
@@ -167,8 +203,14 @@ const ENUM_RULES = {
     'security.threatAssessment.mode': ['off', 'audit', 'enforce'],
     'artifact_outputs.canonical': ['aiwg'],
     'artifact_outputs.provider_native': ['disabled', 'explicit-only', 'project-default'],
+    // #3050: a setup/onboarding preference, not worker policy — kept out of
+    // the frozen `parallelism` contract fragment (B-OG-29). String enum (not
+    // boolean) so a future state (e.g. "snoozed") can be added without a
+    // breaking schema change.
+    'setup.worker_dispatch_offer': ['declined'],
 };
 const BOOLEAN_FIELDS = new Set([
+    'decision.enabled',
     'delivery.delete_branch_on_merge',
     'delivery.require_ci_green',
     'delivery.require_signed_commits',
@@ -178,6 +220,7 @@ const BOOLEAN_FIELDS = new Set([
     'telemetry.skill_usage.enabled',
 ]);
 const STRING_ARRAY_FIELDS = new Set([
+    'providers',
     'remotes.tracker_actor.forbid_actors',
     'remotes.customer_tracker_actor.forbid_actors',
     'command_log.scopes',
@@ -186,6 +229,10 @@ const STRING_ARRAY_FIELDS = new Set([
 // Integer fields with valid range constraints. Validated at `aiwg config set`.
 // Bounds mirror the JSON schema (vscode-extension/schemas/aiwg.config.v1.json).
 const INTEGER_FIELDS = {
+    'decision.ask.passes': { min: 1, max: Number.MAX_SAFE_INTEGER },
+    'decision.ask.escalation_passes': { min: 1, max: Number.MAX_SAFE_INTEGER },
+    'decision.ask.savings.reasoning_tokens': { min: 0, max: 1_000_000 },
+    'decision.ask.savings.output_tokens': { min: 0, max: 1_000_000 },
     'parallelism.max_parallel_subagents': { min: 1, max: 50 },
     'parallelism.max_parallel_ralph_loops': { min: 1, max: 20 },
     'parallelism.max_parallel_mc_missions': { min: 1, max: 20 },
@@ -193,6 +240,7 @@ const INTEGER_FIELDS = {
     'telemetry.skill_usage.max_bytes': { min: 1024, max: 104_857_600 },
 };
 async function projectConfigGet(key, args) {
+    assertSafeConfigPath(key);
     const { readAiwgConfig, getProjectDir } = await import('./aiwg-config.js');
     const projectDir = getProjectDir(undefined, args);
     const cfg = await readAiwgConfig(projectDir);
@@ -204,6 +252,21 @@ async function projectConfigGet(key, args) {
             exitCode: EXIT_CODES.CONFIG,
         });
     }
+    // Model preferences keep their existing file owner. Inspection uses the same
+    // merged policy and pre-merge origins as worker resolution, never aiwg.config.
+    if (key === 'defaults.workerSelection' || key.startsWith('defaults.workerSelection.')) {
+        const { ConfigLoader } = await import('../models/config-loader.js');
+        const loader = new ConfigLoader(projectDir);
+        const models = await loader.load(cfg.parallelism);
+        const value = getDottedPath(models, key);
+        const pointer = `/${key.split('.').join('/')}`;
+        const origins = Object.fromEntries(Object.entries(models.workerPolicyOrigins ?? {})
+            .filter(([field]) => field === pointer || field.startsWith(`${pointer}/`)));
+        console.log(args.includes('--origins')
+            ? JSON.stringify({ value: value ?? null, origins, digests: loader.getInputDigests() }, null, 2)
+            : value === undefined ? '(not set)' : JSON.stringify(value, null, 2));
+        return;
+    }
     const value = getDottedPath(cfg, key);
     if (value === undefined) {
         console.log('(not set)');
@@ -215,7 +278,16 @@ async function projectConfigGet(key, args) {
         console.log(String(value));
     }
 }
-async function projectConfigSet(key, raw, args) {
+async function projectConfigSet(key, raw, args, quiet = false) {
+    assertSafeConfigPath(key);
+    if (key === 'defaults' || key.startsWith('defaults.')) {
+        throw new AiwgError({
+            code: 'ERR_INVALID_KEY',
+            message: `Project model preferences '${key}' belong in models.json, not aiwg.config.`,
+            hint: 'Edit project-root models.json to change defaults, including defaults.workerSelection.',
+            exitCode: EXIT_CODES.USAGE,
+        });
+    }
     const { readAiwgConfig, writeAiwgConfig, getProjectDir, emptyConfig, validateExternalLinks, } = await import('./aiwg-config.js');
     const projectDir = getProjectDir(undefined, args);
     // Validate enum fields before writing. Deprecated spellings normalize forward with a
@@ -237,6 +309,12 @@ async function projectConfigSet(key, raw, args) {
     }
     // Coerce booleans for known boolean fields
     let value = raw;
+    if (key === 'rules' || key.startsWith('rules.') || key === 'parallelism' || /^parallelism\.(worker_dispatch|worker_mode|groups|clis|admission|budgets|health|retry|activation)(\.|$)/.test(key)) {
+        try {
+            value = JSON.parse(raw);
+        }
+        catch { /* String leaves are validated by the whole-object writer. */ }
+    }
     if (/^externalLinks\.[^.]+$/.test(key) || key === 'security.threatAssessment') {
         try {
             value = JSON.parse(raw);
@@ -267,10 +345,24 @@ async function projectConfigSet(key, raw, args) {
         }
     }
     if (STRING_ARRAY_FIELDS.has(key)) {
-        value = raw
-            .split(',')
-            .map(item => item.trim())
-            .filter(Boolean);
+        let items = raw.split(',');
+        if (raw.trimStart().startsWith('[')) {
+            try {
+                items = JSON.parse(raw);
+            }
+            catch {
+                items = undefined;
+            }
+            if (!Array.isArray(items) || items.some(item => typeof item !== 'string')) {
+                throw new AiwgError({
+                    code: 'ERR_INVALID_VALUE',
+                    message: `${key} must be a comma-separated list or a JSON array of strings`,
+                    hint: `Try: aiwg config set --project ${key} '["a","b"]' (or a,b)`,
+                    exitCode: EXIT_CODES.USAGE,
+                });
+            }
+        }
+        value = items.map(item => item.trim()).filter(Boolean);
         if (key === 'command_log.scopes' || key === 'telemetry.skill_usage.scopes') {
             const invalid = value.filter(item => item !== 'project' && item !== 'global');
             if (invalid.length > 0) {
@@ -287,7 +379,7 @@ async function projectConfigSet(key, raw, args) {
     const intRule = INTEGER_FIELDS[key];
     if (intRule) {
         const n = Number(raw);
-        if (!Number.isInteger(n) || n < intRule.min || n > intRule.max) {
+        if (!raw.trim() || !Number.isInteger(n) || n < intRule.min || n > intRule.max) {
             throw new AiwgError({
                 code: 'ERR_INVALID_VALUE',
                 message: `${key} must be an integer between ${intRule.min} and ${intRule.max}, got '${raw}'`,
@@ -297,9 +389,32 @@ async function projectConfigSet(key, raw, args) {
         }
         value = n;
     }
+    if (key === 'decision.ask.min_agreement' || key === 'decision.ask.agreement_confidence_floor') {
+        const n = Number(raw);
+        if (!raw.trim() || !Number.isFinite(n) || n < 0 || n > 1) {
+            throw new AiwgError({
+                code: 'ERR_INVALID_VALUE',
+                message: `${key} must be a probability from 0 to 1, got '${raw}'`,
+                exitCode: EXIT_CODES.USAGE,
+            });
+        }
+        value = n;
+    }
+    if (key === 'decision.ask.cost.llm_per_mtok' || key === 'decision.ask.cost.jev_per_mtok') {
+        const n = Number(raw);
+        if (!raw.trim() || !Number.isFinite(n) || n < 0 || n > 1_000_000) {
+            throw new AiwgError({ code: 'ERR_INVALID_VALUE', message: `${key} must be a non-negative number <= 1000000`, exitCode: EXIT_CODES.USAGE });
+        }
+        value = n;
+    }
     // Read-modify-write — preserve unrelated fields. emptyConfig() seeds the
     // base shape when no config file exists yet (e.g. brand-new project).
-    const cfg = (await readAiwgConfig(projectDir)) ?? emptyConfig();
+    const { existsSync, readFileSync } = await import('node:fs');
+    const file = projectControlPath(projectDir, 'aiwg.config');
+    const cfg = key === 'rules' || key.startsWith('rules.')
+        ? (existsSync(file) ? JSON.parse(readFileSync(file, 'utf8')) : emptyConfig())
+        : (await readAiwgConfig(projectDir)) ?? emptyConfig();
+    const before = structuredClone(getDottedPath(cfg, key));
     setDottedPath(cfg, key, value);
     const externalLinkErrors = validateExternalLinks(cfg.externalLinks);
     if (externalLinkErrors.length > 0) {
@@ -321,7 +436,10 @@ async function projectConfigSet(key, raw, args) {
         });
     }
     await writeAiwgConfig(projectDir, cfg);
-    console.log(`Set --project ${key} = ${raw}`);
+    if (!quiet)
+        console.log(`Set --project ${key} = ${raw}`);
+    if (!quiet)
+        warnStaleParallelism(cfg, projectDir, key, before);
 }
 /** Read a dotted path from a nested record. Returns undefined when any segment is missing. */
 function getDottedPath(obj, key) {
@@ -336,6 +454,7 @@ function getDottedPath(obj, key) {
 }
 /** Write a dotted path into a nested record, creating intermediate objects. */
 function setDottedPath(obj, key, value) {
+    assertSafeConfigPath(key);
     const parts = key.split('.');
     const last = parts.pop();
     let cur = obj;
@@ -348,6 +467,25 @@ function setDottedPath(obj, key, value) {
     }
     cur[last] = value;
 }
+function assertSafeConfigPath(key) {
+    if (key.split('.').some(part => !part || ['__proto__', 'prototype', 'constructor'].includes(part))) {
+        throw new AiwgError({ code: 'ERR_INVALID_KEY', message: 'Unsafe configuration path', exitCode: EXIT_CODES.USAGE });
+    }
+}
+/** Scope/inspection flags are not dotted keys, irrespective of flag order. */
+function configPositionals(args) {
+    const result = [];
+    for (let i = 0; i < args.length; i++) {
+        if (['--target', '--prefix'].includes(args[i])) {
+            i++;
+            continue;
+        }
+        if (['--project', '--user', '--origins'].includes(args[i]))
+            continue;
+        result.push(args[i]);
+    }
+    return result;
+}
 async function handleList(config) {
     const allConfig = await config.list();
     console.log(`Config directory: ${config.getPath()}\n`);
@@ -368,6 +506,16 @@ async function handleValidate(config, args) {
         return;
     }
     const issues = await config.validate();
+    try {
+        const { loadRulePinConfigs, installedRuleCapabilities, validateRulePinCapabilities } = await import('../rules/pins.mjs');
+        const configs = loadRulePinConfigs(process.cwd(), undefined, config.getPath());
+        for (const message of validateRulePinCapabilities(configs.user.rules, installedRuleCapabilities(configs), configs.project.rules?.pin_groups)) {
+            issues.push({ file: 'aiwg.config', severity: 'error', message });
+        }
+    }
+    catch (error) {
+        issues.push({ file: 'aiwg.config', severity: 'error', message: error instanceof Error ? error.message : String(error) });
+    }
     console.log(`Config directory: ${config.getPath()}\n`);
     if (issues.length === 0) {
         console.log('✓ All config files valid');
@@ -392,7 +540,7 @@ async function handleValidate(config, args) {
     }
 }
 async function handleProjectValidate(args) {
-    const { getProjectDir, readAiwgConfig, resolveIssueLabels, validateExternalLinks, validateIndexConfig, validateIssueLabels, } = await import('./aiwg-config.js');
+    const { getProjectDir, readAiwgConfig, resolveIssueLabels, validateExternalLinks, validateIndexConfig, validateIssueLabels, validateWorkerConfigCandidate, } = await import('./aiwg-config.js');
     const projectDir = getProjectDir(undefined, args);
     const cfg = await readAiwgConfig(projectDir);
     if (!cfg) {
@@ -403,6 +551,7 @@ async function handleProjectValidate(args) {
             exitCode: EXIT_CODES.CONFIG,
         });
     }
+    await validateWorkerConfigCandidate(projectDir, cfg);
     const providerIndex = args.indexOf('--provider');
     const providerArg = providerIndex >= 0 ? args[providerIndex + 1] : undefined;
     const allowedProviders = ['gitea', 'github', 'local'];
@@ -463,7 +612,7 @@ async function handleProjectValidate(args) {
 }
 async function handleReset(config, args) {
     const isProject = args.includes('--project');
-    const positional = args.filter(a => a !== '--project');
+    const positional = configPositionals(args);
     const key = positional[0];
     if (isProject) {
         await projectConfigReset(key, args);
@@ -496,6 +645,7 @@ async function projectConfigReset(key, args) {
             exitCode: EXIT_CODES.USAGE,
         });
     }
+    assertSafeConfigPath(key);
     const projectDir = getProjectDir(undefined, args);
     const cfg = await readAiwgConfig(projectDir);
     if (!cfg) {
@@ -508,6 +658,7 @@ async function projectConfigReset(key, args) {
     }
     const primary = cfg.providers[0];
     const defaults = getProviderParallelismDefaults(primary);
+    const before = structuredClone(getDottedPath(cfg, key));
     if (key === 'parallelism') {
         cfg.parallelism = {
             max_parallel_subagents: defaults.max_parallel_subagents,
@@ -517,15 +668,31 @@ async function projectConfigReset(key, args) {
         };
         await writeAiwgConfig(projectDir, cfg);
         console.log(`Reset --project parallelism to provider default (${primary ?? 'unknown'})`);
+        warnStaleParallelism(cfg, projectDir, key, before);
         return;
     }
     if (key.startsWith('parallelism.')) {
+        const workerField = key.split('.')[1];
+        if (['worker_dispatch', 'worker_mode', 'clis', 'groups', 'admission', 'budgets', 'retry', 'health', 'activation'].includes(workerField)) {
+            const parts = key.split('.').slice(1);
+            const last = parts.pop();
+            let current = cfg.parallelism;
+            for (const part of parts)
+                current = current?.[part];
+            if (current)
+                delete current[last];
+            await writeAiwgConfig(projectDir, cfg);
+            console.log(`Reset --project ${key}`);
+            warnStaleParallelism(cfg, projectDir, key, before);
+            return;
+        }
         const field = key.slice('parallelism.'.length);
         if (field in defaults) {
             cfg.parallelism = cfg.parallelism ?? {};
             cfg.parallelism[field] = defaults[field];
             await writeAiwgConfig(projectDir, cfg);
             console.log(`Reset --project ${key} to provider default (${defaults[field]})`);
+            warnStaleParallelism(cfg, projectDir, key, before);
             return;
         }
     }
@@ -539,13 +706,40 @@ async function projectConfigReset(key, args) {
 function handlePath(config) {
     console.log(config.getPath());
 }
-async function handleEdit(config) {
-    const editor = process.env.EDITOR || process.env.VISUAL || 'vi';
+/**
+ * `aiwg config edit [--print-path]` (#3062). `--print-path` is the headless
+ * equivalent: it prints the resolved config file path and exits, so scripts
+ * and agents can read/edit the file themselves (or compose with
+ * `aiwg config get`/`set`) instead of needing $EDITOR. Without a terminal
+ * and without `--print-path`, this refuses instead of spawning an editor
+ * that would hang waiting for input nobody can supply.
+ */
+async function handleEdit(config, args = []) {
     const configPath = `${config.getPath()}/config.yaml`;
+    if (args.includes('--print-path')) {
+        // Ensure the config file exists before pointing a caller at it.
+        await config.ensureDir();
+        console.log(configPath);
+        return;
+    }
+    if (!isInteractive()) {
+        throw new AiwgError({
+            code: 'ERR_NON_INTERACTIVE_EDIT',
+            message: 'aiwg config edit requires an interactive terminal to open $EDITOR/$VISUAL.',
+            hint: 'Use `aiwg config set <key> <value>` to change a value headlessly, or `aiwg config edit --print-path` to get the file path and edit it yourself.',
+            exitCode: EXIT_CODES.USAGE,
+        });
+    }
+    const editor = process.env.EDITOR || process.env.VISUAL || 'vi';
     // Ensure the config file exists before opening
     await config.ensureDir();
     const { execSync } = await import('child_process');
     try {
+        // sync-spawn: interactive editor-launch — launches $EDITOR/$VISUAL on the
+        // config file; the user interacts with it directly (see tools/testing/
+        // sync-spawn-allowlist.json). Reached only when isInteractive() is true
+        // (#3062) — the no-terminal path above refuses before spawning anything.
+        // Not a candidate for a bounded timeout.
         execSync(`${editor} "${configPath}"`, { stdio: 'inherit' });
     }
     catch (err) {
@@ -584,7 +778,7 @@ For project-level config: aiwg config show --project [--json]
     }
     // Lazy-import to keep startup cost low for unrelated subcommands.
     const { readAiwgConfig, resolveRemotes, getProjectDir } = await import('./aiwg-config.js');
-    const { spawnSync } = await import('child_process');
+    const { boundedSpawnSync } = await import('../process/bounded-child-process.mjs');
     const projectDir = getProjectDir(undefined, args);
     const cfg = await readAiwgConfig(projectDir);
     if (!cfg) {
@@ -598,7 +792,7 @@ For project-level config: aiwg config show --project [--json]
     const resolvedRemotes = resolveRemotes(cfg.remotes);
     // Resolve each declared remote name to its URL via git. Best-effort.
     function getUrl(name) {
-        const r = spawnSync('git', ['-C', projectDir, 'remote', 'get-url', name], {
+        const r = boundedSpawnSync('git', ['-C', projectDir, 'remote', 'get-url', name], 'quick', {
             encoding: 'utf-8',
             stdio: ['ignore', 'pipe', 'ignore'],
         });
@@ -691,14 +885,24 @@ For project-level config: aiwg config show --project [--json]
     console.log('');
 }
 async function handleGitignore(args) {
-    const { spawnSync } = await import('child_process');
+    const { boundedSpawnSync } = await import('../process/bounded-child-process.mjs');
     // Locate the gitignore CLI script relative to this compiled module
     // (#1228). At runtime this module lives at `dist/src/config/cli.js`,
     // so we need three `..` segments to reach the package root where
     // `tools/cli/` is shipped (see package.json `files`).
     const scriptPath = path.resolve(_scriptDir, '../../../tools/cli/config-gitignore.mjs');
-    const result = spawnSync(process.execPath, [scriptPath, ...args], { stdio: 'inherit' });
+    // Local script editing .gitignore blocks; quick tier (#3062).
+    const result = boundedSpawnSync(process.execPath, [scriptPath, ...args], 'quick', { stdio: 'inherit' });
     if (result.status !== 0) {
+        // #3062 review item 7: already correctly treats a null status
+        // (timeout/signal) as failure (`process.exit(result.status ?? 1)`
+        // below); surface the bounded helper's diagnostic too — `stdio:
+        // 'inherit'` means a normal script failure already printed its own
+        // output, but a bounded-helper timeout/kill would otherwise never be
+        // reported anywhere.
+        const { message } = exitCodeForSpawnResult(result, 'aiwg config gitignore');
+        if (message)
+            console.error(message);
         process.exit(result.status ?? 1);
     }
 }
@@ -707,8 +911,8 @@ function printUsage() {
 
 Subcommands:
   get <key>                       Read a user config value
-  get --project <key>             Read a project config value (default .aiwg/aiwg.config;
-                                  AIWG_ARTIFACTS_PATH may override the artifact root)
+  get --project <key>             Read a project config value or merged defaults.workerSelection
+    [--origins]                  Include model policy sources, pointers and input digests
   set <key> <value>               Write a user config value
   set --project <key> <value>     Write a project config value (validates enums)
   list                Show all user config
@@ -718,7 +922,8 @@ Subcommands:
     [--provider gitea|github|local] [--available-label NAME ...]
   reset [<key>]       Reset key or all config to defaults
   path                Print config directory path
-  edit                Open config in $EDITOR
+  edit                Open config in $EDITOR/$VISUAL (requires a terminal)
+  edit --print-path   Print the config file path instead of opening an editor
   gitignore           Show/check/fix .gitignore AIWG entries
 
 Global flags:
@@ -735,6 +940,7 @@ Examples:
   aiwg config set --project delivery.mode pr-required
   aiwg config set --project delivery.merge_style squash
   aiwg config get --project parallelism
+  aiwg config get --project defaults.workerSelection --origins
   aiwg config set --project parallelism.max_parallel_subagents 6
   aiwg config reset --project parallelism
   aiwg config validate
@@ -745,4 +951,31 @@ Examples:
   aiwg config gitignore --fix
   aiwg config gitignore --check`);
 }
+/** Same configuration owner and validation used by the rules command wrappers. */
+export async function setRuleConfigKey(cwd, source, key, raw, userConfigDir) {
+    assertSafeConfigPath(key);
+    if (source === 'project') {
+        await projectConfigSet(key, raw, ['--project', '--target', cwd], true);
+        return;
+    }
+    const { loadRulePinConfigs, rulePinConfigPath, installedRuleCapabilities, validateRulePinCapabilities } = await import('../rules/pins.mjs');
+    const { mkdir, writeFile, rename } = await import('node:fs/promises');
+    const configs = loadRulePinConfigs(cwd, undefined, userConfigDir);
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        value = raw;
+    }
+    setDottedPath(configs.user, key, value);
+    const errors = validateRulePinCapabilities(configs.user.rules, installedRuleCapabilities(configs), configs.project.rules?.pin_groups);
+    if (errors.length)
+        throw new Error(errors.join('\n'));
+    const file = rulePinConfigPath(cwd, 'user', userConfigDir);
+    await mkdir(path.dirname(file), { recursive: true });
+    const temp = `${file}.${process.pid}.tmp`;
+    await writeFile(temp, JSON.stringify(configs.user, null, 2) + '\n');
+    await rename(temp, file);
+}
 //# sourceMappingURL=cli.js.map

package/dist/src/config/decision-config.js

@@ -0,0 +1,106 @@
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+import { parseYamlSimple } from './user-config.js';
+import { resolveUserConfigDir } from './user-config-dir.mjs';
+export function validateDecisionConfig(value) {
+    if (value === undefined)
+        return [];
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return ['decision must be an object'];
+    const errors = [];
+    const { enabled, ask, offload_report: report } = value;
+    if (enabled !== undefined && typeof enabled !== 'boolean')
+        errors.push('decision.enabled must be a boolean');
+    if (report !== undefined) {
+        if (!report || typeof report !== 'object' || Array.isArray(report))
+            errors.push('decision.offload_report must be an object');
+        else {
+            for (const key of ['window_hours', 'minimum_eligible', 'repeated_fallbacks']) {
+                const configured = report[key];
+                if (configured !== undefined && (!Number.isSafeInteger(configured) || configured < (key === 'minimum_eligible' ? 0 : 1))) {
+                    errors.push(`decision.offload_report.${key} must be a ${key === 'minimum_eligible' ? 'non-negative' : 'positive'} safe integer`);
+                }
+            }
+            if (report.minimum_attempt_rate !== undefined && (typeof report.minimum_attempt_rate !== 'number'
+                || !Number.isFinite(report.minimum_attempt_rate) || report.minimum_attempt_rate < 0 || report.minimum_attempt_rate > 1)) {
+                errors.push('decision.offload_report.minimum_attempt_rate must be a probability from 0 to 1');
+            }
+            for (const key of Object.keys(report))
+                if (!['window_hours', 'minimum_eligible', 'minimum_attempt_rate', 'repeated_fallbacks'].includes(key)) {
+                    errors.push(`unknown decision.offload_report.${key}`);
+                }
+        }
+    }
+    if (ask === undefined)
+        return errors;
+    if (!ask || typeof ask !== 'object' || Array.isArray(ask))
+        return [...errors, 'decision.ask must be an object'];
+    const sampling = [];
+    for (const key of ['passes', 'escalation_passes']) {
+        if (ask[key] !== undefined && (!Number.isSafeInteger(ask[key]) || ask[key] <= 0)) {
+            sampling.push(`decision.ask.${key} must be a positive safe integer`);
+        }
+    }
+    if (!sampling.length && ask.escalation_passes !== undefined && ask.escalation_passes < (ask.passes ?? 5)) {
+        sampling.push('decision.ask.escalation_passes must be >= decision.ask.passes');
+    }
+    for (const key of ['min_agreement', 'agreement_confidence_floor']) {
+        if (ask[key] !== undefined && (typeof ask[key] !== 'number' || !Number.isFinite(ask[key]) || ask[key] < 0 || ask[key] > 1)) {
+            sampling.push(`decision.ask.${key} must be a probability from 0 to 1`);
+        }
+    }
+    for (const section of ['cost', 'savings']) {
+        const settings = ask[section];
+        if (settings === undefined)
+            continue;
+        if (!settings || typeof settings !== 'object' || Array.isArray(settings)) {
+            sampling.push(`decision.ask.${section} must be an object`);
+            continue;
+        }
+        const allowed = section === 'cost' ? ['llm_per_mtok', 'jev_per_mtok'] : ['caller_model_class', 'reasoning_tokens', 'output_tokens'];
+        for (const [key, value] of Object.entries(settings)) {
+            if (!allowed.includes(key))
+                sampling.push(`unknown decision.ask.${section}.${key}`);
+            else if (key === 'caller_model_class') {
+                if (value !== 'standard' && value !== 'reasoning')
+                    sampling.push('decision.ask.savings.caller_model_class must be standard or reasoning');
+            }
+            else if (typeof value !== 'number' || !Number.isFinite(value) || value < 0 || value > 1_000_000
+                || (section === 'savings' && !Number.isSafeInteger(value))) {
+                sampling.push(`decision.ask.${section}.${key} must be a non-negative ${section === 'savings' ? 'integer' : 'number'} <= 1000000`);
+            }
+        }
+    }
+    return [...errors, ...sampling];
+}
+function readEnabled(filePath, yaml = false) {
+    let content;
+    try {
+        content = readFileSync(filePath, 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw error;
+    }
+    const config = (yaml ? parseYamlSimple(content) : JSON.parse(content));
+    const errors = validateDecisionConfig(config.decision);
+    if (errors.length)
+        throw new Error(`${filePath}: ${errors.join('; ')}`);
+    return config.decision?.enabled;
+}
+/** Resolve only enablement; never read credentials or probe a backend. */
+export function resolveDecisionEnablement(options = {}) {
+    const env = options.env ?? process.env;
+    if (env.AIWG_DECISION_ENABLED === '0' || env.AIWG_DECISION_ENABLED === '1') {
+        return { enabled: env.AIWG_DECISION_ENABLED === '1', source: 'env' };
+    }
+    const project = readEnabled(path.join(options.cwd ?? process.cwd(), '.aiwg', 'aiwg.config'));
+    if (project !== undefined)
+        return { enabled: project, source: 'project' };
+    const user = readEnabled(path.join(resolveUserConfigDir({ env, homeDir: options.homeDir }), 'config.yaml'), true);
+    if (user !== undefined)
+        return { enabled: user, source: 'user' };
+    return { enabled: false, source: 'default' };
+}
+//# sourceMappingURL=decision-config.js.map

package/dist/src/config/dispatch-thresholds-runtime.d.mts

@@ -0,0 +1,8 @@
+import type { DispatchHostThresholds } from './aiwg-config.js';
+
+export const DEFAULT_DISPATCH_HOST_THRESHOLDS: Readonly<Required<Omit<DispatchHostThresholds, 'max_workers'>>>;
+export function resolveDispatchHostThresholds(
+  buildDispatch?: DispatchHostThresholds,
+  admissionHostResources?: DispatchHostThresholds,
+  overlay?: DispatchHostThresholds,
+): Required<Omit<DispatchHostThresholds, 'max_workers'>> & Pick<DispatchHostThresholds, 'max_workers'>;