@aiwg/cli 2026.10.1 → 2026.10.4

package/dist/src/mcp/server.mjs

@@ -24,6 +24,7 @@ import { registerCommandRunTool } from './tools/command-run.mjs';
 import { registerInteractionTools } from './tools/interaction.mjs';
 import { parseToolsets, registerOptInToolsets, KNOWN_TOOLSETS } from './tools/subsystems.mjs';
 import { AIWG_ROOT, findProjectRoot, resolveProjectAiwgDir } from './helpers.mjs';
+import { pinContainedRoot as pinArtifactRoot, openContainedFile as openArtifact, readContainedFile, listContainedFiles, validateContainedPath } from '../utils/contained-filesystem.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
@@ -36,7 +37,7 @@ const FRAMEWORKS = {
 /**
  * Create and configure the AIWG MCP Server
  */
-export function createServer() {
+export async function createServer() {
   const server = new McpServer({
     name: 'aiwg',
     version: '1.0.0'
@@ -51,7 +52,28 @@ export function createServer() {
   //   discover, skill-list, skill-show, command-list, command-show,
   //   rule-list, rule-show, agent-show, template-list, template-show
   // ============================================
-  registerDiscoveryTools(server);
+  const corpusStore = await pinArtifactRoot(path.resolve(AIWG_ROOT));
+  registerDiscoveryTools(server, { corpusStore });
+  async function readCorpus(relative) {
+    const content = await readContainedFile(corpusStore, relative);
+    if (content === null) throw new Error('Corpus file not found');
+    return content;
+  }
+  function frameworkName(framework) {
+    validateContainedPath(framework);
+    return Object.hasOwn(FRAMEWORKS, framework) ? framework : 'sdlc-complete';
+  }
+  async function scanCorpusDirectory(relative, type) {
+    const entries = await listContainedFiles(corpusStore, `${relative}/`);
+    return entries.filter(entry => entry.path.endsWith('.md')).map(entry => {
+      const local = path.relative(relative, entry.path);
+      const name = path.basename(local, '.md');
+      return {
+        name, path: path.join(corpusStore.root, entry.path), uri: `aiwg://${type}/${name}`,
+        ...(path.dirname(local) !== '.' ? { category: local.split(path.sep)[0] } : {}),
+      };
+    });
+  }
   registerWriterProfileResources(server);
 
   // ============================================
@@ -70,11 +92,72 @@ export function createServer() {
   // Opt-in subsystem toolsets (#1322-#1332)
   //
   // Enabled via AIWG_MCP_TOOLSETS env or `aiwg mcp serve --toolsets=`.
-  // Known: flows, missions, memory, kb, research, activity-log, index, ralph, mc, ops, sandbox, all
+  // Known: flows, missions, memory, kb, research, activity-log, index, ralph, mc, ops, sandbox, decision, all
+  // `workers` (#2892 direct worker run/status/cancel) needs an EXPLICIT name;
+  // `all` deliberately does not reach it (src/mcp/tools/subsystems.mjs).
   // Default: none (core only — discovery + command-run)
   // ============================================
   const requested = parseToolsets(process.env.AIWG_MCP_TOOLSETS || '');
-  registerOptInToolsets(server, requested);
+  // #2892 B1: the `workers` toolset's served project root is resolved ONCE,
+  // here, at registration time — never lazily from `process.cwd()` inside
+  // the tool handler on first request. A project root that cannot be found
+  // (not running inside an AIWG project) means `workers` is simply not
+  // registered; `registerWorkerInvokeToolset` refuses rather than falling
+  // back to an implicit cwd.
+  let projectRoot;
+  try {
+    projectRoot = await findProjectRoot();
+  } catch {
+    projectRoot = undefined;
+  }
+  await registerOptInToolsets(server, requested, { projectRoot });
+
+  // Resolve operator configuration once per trusted project, then pin it.
+  // Artifact tools default to the server-start project (the launch directory),
+  // not an ancestor discovered by walking up from it: a fresh launch directory
+  // inside another marked tree (for example a stray `.aiwg` in the temp dir)
+  // must pin its own missing default at startup, never adopt the ancestor's
+  // store. Callers select other projects explicitly via `project_dir`.
+  const artifactEnv = { ...process.env };
+  const trustedProjectRoot = await fs.realpath(process.cwd());
+  const trustedArtifactRoot = await resolveProjectAiwgDir(trustedProjectRoot, { env: artifactEnv });
+  const startupStore = await pinArtifactRoot(trustedArtifactRoot, trustedProjectRoot);
+  const trustedStore = startupStore.root;
+  const projects = new Map();
+  async function trustProject(requested, store) {
+    const canonical = await fs.realpath(requested);
+    const identity = await fs.stat(requested);
+    if (!identity.isDirectory()) throw new Error('project_dir must be a real directory');
+    if (canonical !== trustedProjectRoot) {
+      const inStore = path.relative(trustedStore, canonical);
+      if (canonical.split(path.sep).includes('.aiwg') || !inStore
+        || (inStore !== '..' && !inStore.startsWith(`..${path.sep}`) && !path.isAbsolute(inStore))) {
+        throw new Error('project_dir must not select a project inside an artifact store');
+      }
+    }
+    const configured = store ? undefined : await resolveProjectAiwgDir(canonical, { env: { ...process.env } });
+    return { canonical, identity, store: store || await pinArtifactRoot(configured, canonical) };
+  }
+  const startupProject = Promise.resolve(await trustProject(trustedProjectRoot, startupStore));
+  projects.set(trustedProjectRoot, startupProject);
+  const canonicalProjects = new Map([[trustedProjectRoot, startupProject]]);
+  async function artifactRoots(explicit) {
+    const requested = explicit ? path.resolve(trustedProjectRoot, explicit) : trustedProjectRoot;
+    // Key by the supplied project path, so a replacement cannot acquire fresh trust.
+    if (!projects.has(requested)) {
+      const canonical = await fs.realpath(requested);
+      if (!canonicalProjects.has(canonical)) canonicalProjects.set(canonical, trustProject(requested));
+      projects.set(requested, canonicalProjects.get(canonical));
+    }
+    const pinned = await projects.get(requested);
+    const canonical = await fs.realpath(requested);
+    const current = await fs.stat(requested);
+    if (canonical !== pinned.canonical || !current.isDirectory()
+      || current.dev !== pinned.identity.dev || current.ino !== pinned.identity.ino) {
+      throw new Error('Project root changed since it was pinned');
+    }
+    return pinned.store;
+  }
 
   // Tool: artifact-read
   server.registerTool('artifact-read', {
@@ -82,14 +165,21 @@ export function createServer() {
     description: 'Read artifact from .aiwg/ directory',
     inputSchema: {
       path: z.string().describe('Path relative to .aiwg/ (e.g., "requirements/UC-001.md")'),
-      project_dir: z.string().optional().describe('Project directory path (defaults to auto-detected project root)')
+      project_dir: z.string().optional().describe('Real project directory outside artifact trees (defaults to server-start project; artifact store pinned on first use)')
     }
   }, async ({ path: artifactPath, project_dir }) => {
     try {
-      // Auto-find project root if not specified
-      const projectRoot = project_dir || await findProjectRoot();
-      const fullPath = path.join(await resolveProjectAiwgDir(projectRoot), artifactPath);
-      const content = await fs.readFile(fullPath, 'utf-8');
+      const store = await artifactRoots(project_dir);
+      const { handle, close } = await openArtifact(store, artifactPath);
+      let content;
+      let completed = false;
+      try {
+        content = await handle.readFile('utf-8');
+        completed = true;
+      } finally {
+        const [closed] = await Promise.allSettled([close()]);
+        if (completed && closed.status === 'rejected') throw closed.reason;
+      }
       return {
         content: [{
           type: 'text',
@@ -114,20 +204,22 @@ export function createServer() {
     inputSchema: {
       path: z.string().describe('Path relative to .aiwg/'),
       content: z.string().describe('Artifact content'),
-      project_dir: z.string().optional().describe('Project directory path (defaults to auto-detected project root)')
+      project_dir: z.string().optional().describe('Real project directory outside artifact trees (defaults to server-start project; artifact store pinned on first use)')
     }
   }, async ({ path: artifactPath, content, project_dir }) => {
     try {
-      // Auto-find project root if not specified
-      const projectRoot = project_dir || await findProjectRoot();
-      const fullPath = path.join(await resolveProjectAiwgDir(projectRoot), artifactPath);
-      const dir = path.dirname(fullPath);
-
-      // Ensure directory exists
-      await fs.mkdir(dir, { recursive: true });
-
-      // Write file
-      await fs.writeFile(fullPath, content, 'utf-8');
+      const store = await artifactRoots(project_dir);
+      const { handle, fullPath, commit, close } = await openArtifact(store, artifactPath, { write: true });
+      let completed = false;
+      try {
+        await handle.writeFile(content, 'utf-8');
+        await commit();
+        completed = true;
+      } finally {
+        // Close every owned descriptor; preserve any write/verification error.
+        const [closed] = await Promise.allSettled([close()]);
+        if (completed && closed.status === 'rejected') throw closed.reason;
+      }
 
       return {
         content: [{
@@ -161,12 +253,10 @@ export function createServer() {
   }, async ({ template, variables = {} }) => {
     try {
       // Determine framework and template path
+      validateContainedPath(template);
       const [framework, ...pathParts] = template.split('/');
-      const frameworkPath = FRAMEWORKS[framework] || FRAMEWORKS['sdlc-complete'];
-      const templatePath = path.join(frameworkPath, 'templates', ...pathParts);
-
-      // Read template
-      let content = await fs.readFile(templatePath, 'utf-8');
+      const relative = `agentic/code/frameworks/${frameworkName(framework)}/templates/${pathParts.join('/')}`;
+      let content = await readCorpus(relative);
 
       // Simple variable substitution
       for (const [key, value] of Object.entries(variables)) {
@@ -263,8 +353,7 @@ export function createServer() {
       mimeType: 'application/json'
     },
     async () => {
-      const promptsDir = path.join(AIWG_ROOT, 'agentic/code/addons/aiwg-utils/prompts');
-      const catalog = await scanDirectory(promptsDir, 'prompts');
+      const catalog = await scanCorpusDirectory('agentic/code/addons/aiwg-utils/prompts', 'prompts');
       return {
         contents: [{
           uri: 'aiwg://prompts/catalog',
@@ -285,10 +374,9 @@ export function createServer() {
     },
     async () => {
       const catalogs = {};
-      for (const [fw, fwPath] of Object.entries(FRAMEWORKS)) {
-        const templatesDir = path.join(fwPath, 'templates');
+      for (const fw of Object.keys(FRAMEWORKS)) {
         try {
-          catalogs[fw] = await scanDirectory(templatesDir, 'templates');
+          catalogs[fw] = await scanCorpusDirectory(`agentic/code/frameworks/${fw}/templates`, 'templates');
         } catch {
           catalogs[fw] = [];
         }
@@ -313,10 +401,9 @@ export function createServer() {
     },
     async () => {
       const catalogs = {};
-      for (const [fw, fwPath] of Object.entries(FRAMEWORKS)) {
-        const agentsDir = path.join(fwPath, 'agents');
+      for (const fw of Object.keys(FRAMEWORKS)) {
         try {
-          catalogs[fw] = await scanDirectory(agentsDir, 'agents');
+          catalogs[fw] = await scanCorpusDirectory(`agentic/code/frameworks/${fw}/agents`, 'agents');
         } catch {
           catalogs[fw] = [];
         }
@@ -339,14 +426,9 @@ export function createServer() {
       description: 'Retrieve specific AIWG prompt template'
     },
     async (uri, { category, name }) => {
-      const promptPath = path.join(
-        AIWG_ROOT,
-        'agentic/code/addons/aiwg-utils/prompts',
-        category,
-        `${name}.md`
-      );
       try {
-        const content = await fs.readFile(promptPath, 'utf-8');
+        validateContainedPath(category); validateContainedPath(name);
+        const content = await readCorpus(`agentic/code/addons/aiwg-utils/prompts/${category}/${name}.md`);
         return {
           contents: [{
             uri: uri.href,
@@ -373,14 +455,9 @@ export function createServer() {
       description: 'Retrieve specific AIWG template'
     },
     async (uri, { framework, category, name }) => {
-      const templatePath = path.join(
-        FRAMEWORKS[framework] || FRAMEWORKS['sdlc-complete'],
-        'templates',
-        category,
-        `${name}.md`
-      );
       try {
-        const content = await fs.readFile(templatePath, 'utf-8');
+        validateContainedPath(category); validateContainedPath(name);
+        const content = await readCorpus(`agentic/code/frameworks/${frameworkName(framework)}/templates/${category}/${name}.md`);
         return {
           contents: [{
             uri: uri.href,
@@ -407,13 +484,9 @@ export function createServer() {
       description: 'Retrieve specific AIWG agent definition'
     },
     async (uri, { framework, name }) => {
-      const agentPath = path.join(
-        FRAMEWORKS[framework] || FRAMEWORKS['sdlc-complete'],
-        'agents',
-        `${name}.md`
-      );
       try {
-        const content = await fs.readFile(agentPath, 'utf-8');
+        validateContainedPath(name);
+        const content = await readCorpus(`agentic/code/frameworks/${frameworkName(framework)}/agents/${name}.md`);
         return {
           contents: [{
             uri: uri.href,
@@ -579,39 +652,11 @@ If retry fails, prepare structured escalation:
 // HELPER FUNCTIONS
 // ============================================
 
-/**
- * Scan directory for files
- */
-async function scanDirectory(dir, type) {
-  const results = [];
-  try {
-    const entries = await fs.readdir(dir, { withFileTypes: true });
-    for (const entry of entries) {
-      if (entry.isDirectory()) {
-        const subResults = await scanDirectory(path.join(dir, entry.name), type);
-        results.push(...subResults.map(r => ({
-          ...r,
-          category: entry.name
-        })));
-      } else if (entry.isFile() && entry.name.endsWith('.md')) {
-        results.push({
-          name: entry.name.replace('.md', ''),
-          path: path.join(dir, entry.name),
-          uri: `aiwg://${type}/${entry.name.replace('.md', '')}`
-        });
-      }
-    }
-  } catch {
-    // Directory doesn't exist
-  }
-  return results;
-}
-
 /**
  * Start the MCP server with stdio transport
  */
 export async function startServer() {
-  const server = createServer();
+  const server = await createServer();
   const transport = new StdioServerTransport();
 
   console.error('[AIWG MCP] Starting server...');

package/dist/src/mcp/test-simple.mjs

@@ -6,6 +6,7 @@
  * Tests the server by spawning it and sending JSON-RPC messages via stdio.
  */
 
+import { signalChild } from '../process/signal-child.mjs';
 import { spawn } from 'child_process';
 import { fileURLToPath } from 'url';
 import path from 'path';
@@ -254,7 +255,7 @@ async function main() {
   });
 
   // Cleanup
-  server.kill();
+  signalChild(server);
 
   // Summary
   console.log('');

package/dist/src/mcp/toml-editor.d.mts

@@ -0,0 +1,4 @@
+export function replaceServer(text: string, name: string, section: string): {
+  text: string;
+  alreadyPresent: boolean;
+};

package/dist/src/mcp/toml-string.d.mts

@@ -0,0 +1 @@
+export function tomlString(value: unknown): string;

package/dist/src/mcp/toml-string.mjs

@@ -0,0 +1,9 @@
+/** Encode a complete TOML basic string using valid Unicode scalar values. */
+export function tomlString(value) {
+  if (typeof value !== 'string' || [...value].some(char => {
+    const point = char.codePointAt(0);
+    return point >= 0xd800 && point <= 0xdfff;
+  })) throw new Error('TOML values must be strings containing valid Unicode scalar values');
+  // JSON escapes align with TOML basic strings except DEL must also be escaped.
+  return JSON.stringify(value).replace(/\u007f/g, '\\u007f');
+}

package/dist/src/mcp/toml-strip-mcp.d.mts

@@ -0,0 +1 @@
+export function stripMcpServers(text: string): string;

package/dist/src/mcp/toml-strip-mcp.mjs

@@ -0,0 +1,135 @@
+import { parseTOML } from 'toml-eslint-parser';
+
+/** Remove the root MCP subtree without interpreting strings as TOML structure. */
+export function stripMcpServers(text) {
+  const fail = () => { throw new Error('Refusing to copy base Codex config: cannot safely classify TOML (malformed or unterminated structure)'); };
+  // Reuse the existing persistent-editor validator (no new dependency). The
+  // scanner below owns subtree removal; validation also catches ambiguous
+  // scalar syntax and duplicate definitions, beyond balanced delimiters.
+  try { parseTOML(text, { tomlVersion: '1.1.0' }); } catch { fail(); }
+  // A key path may use bare, literal, or escaped basic quoted components.
+  const keyPath = source => {
+    const parts = [];
+    let rest = source.trim();
+    while (rest) {
+      const match = /^(?:([A-Za-z0-9_-]+)|'([^'\r\n]*)'|"((?:[^"\\\r\n]|\\(?:[btnfr"\\]|u[\da-fA-F]{4}|U[\da-fA-F]{8}))*)")/.exec(rest);
+      if (!match) fail();
+      let key = match[1] ?? match[2];
+      if (key === undefined) {
+        key = match[3].replace(/\\(u[\da-fA-F]{4}|U[\da-fA-F]{8}|[btnfr"\\])/g, (_, escape) => {
+          if (escape[0] === 'u' || escape[0] === 'U') {
+            const code = Number.parseInt(escape.slice(1), 16);
+            if (code > 0x10ffff || (code >= 0xd800 && code <= 0xdfff)) fail();
+            return String.fromCodePoint(code);
+          }
+          return { b: '\b', t: '\t', n: '\n', f: '\f', r: '\r', '"': '"', '\\': '\\' }[escape];
+        });
+      }
+      parts.push(key);
+      rest = rest.slice(match[0].length).trim();
+      if (!rest) break;
+      if (!rest.startsWith('.')) fail();
+      rest = rest.slice(1).trim();
+      if (!rest) fail();
+    }
+    if (!parts.length) fail();
+    return parts;
+  };
+
+  let table = [];
+  let quote = null;
+  let multiline = false;
+  const brackets = [];
+  let record = '';
+  let drop = false;
+  const kept = [];
+  for (const line of text.split(/(?<=\n)/)) {
+    let start = 0;
+    if (!record) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith('#')) {
+        if (table[0] !== 'mcp_servers') kept.push(line);
+        continue;
+      }
+      if (trimmed.startsWith('[')) {
+        // Header strings are single-line key components; scan their quotes so
+        // a bracket or hash inside a quoted name cannot terminate the header.
+        let headerQuote = null;
+        let end = line.length;
+        for (let i = 0; i < line.length; i++) {
+          const char = line[i];
+          if (headerQuote) {
+            if (headerQuote === '"' && char === '\\') { i++; continue; }
+            if (char === headerQuote) headerQuote = null;
+          } else if (char === '"' || char === "'") headerQuote = char;
+          else if (char === '#') { end = i; break; }
+        }
+        if (headerQuote) fail();
+        const header = line.slice(0, end).trim();
+        const array = header.startsWith('[[');
+        const width = array ? 2 : 1;
+        if (!header.endsWith(array ? ']]' : ']')) fail();
+        table = keyPath(header.slice(width, -width));
+        if (table[0] !== 'mcp_servers') kept.push(line);
+        continue;
+      }
+      let keyQuote = null;
+      let equals = -1;
+      for (let i = 0; i < line.length; i++) {
+        const char = line[i];
+        if (keyQuote) {
+          if (keyQuote === '"' && char === '\\') { i++; continue; }
+          if (char === keyQuote) keyQuote = null;
+        } else if (char === '"' || char === "'") keyQuote = char;
+        else if (char === '=') { equals = i; break; }
+        else if (char === '#') break;
+      }
+      if (equals < 0 || keyQuote) fail();
+      const key = keyPath(line.slice(0, equals));
+      drop = table[0] === 'mcp_servers' || (table.length === 0 && key[0] === 'mcp_servers');
+      start = equals + 1;
+      if (!line.slice(start).split('#')[0].trim()) fail();
+    }
+    record += line;
+    for (let i = start; i < line.length; i++) {
+      const char = line[i];
+      if (quote) {
+        if (quote === '"' && char === '\\') {
+          // A backslash escapes the next character (including a multiline
+          // continuation); it cannot conceal a closing delimiter.
+          if (i + 1 >= line.length) fail();
+          i++;
+          continue;
+        }
+        if (char === quote) {
+          if (!multiline) quote = null;
+          else if (line.slice(i, i + 3) === quote.repeat(3)) {
+            let run = 3;
+            while (line[i + run] === quote) run++;
+            if (run > 5) fail();
+            i += run - 1;
+            quote = null;
+            multiline = false;
+          }
+        } else if (!multiline && (char === '\n' || char === '\r')) fail();
+        continue;
+      }
+      if (char === '#') break;
+      if (char === '"' || char === "'") {
+        quote = char;
+        multiline = line.slice(i, i + 3) === char.repeat(3);
+        if (multiline) i += 2;
+      } else if (char === '[' || char === '{') brackets.push(char);
+      else if (char === ']' || char === '}') {
+        if (brackets.pop() !== (char === ']' ? '[' : '{')) fail();
+      } else if (char === '=' && !brackets.includes('{')) fail();
+    }
+    if (quote && !multiline) fail();
+    if (!quote && brackets.length === 0) {
+      if (!drop) kept.push(record);
+      record = '';
+    }
+  }
+  if (quote || brackets.length || record) fail();
+  return kept.join('');
+}

package/dist/src/mcp/tool-filters.d.mts

@@ -0,0 +1,46 @@
+import type { ConfigWrite } from './config-file.mjs';
+
+export interface ToolFilters {
+  deny: string[];
+  allow: string[];
+}
+
+export interface ToolFilterPlan {
+  serverFields: Record<string, Record<string, unknown>>;
+  tomlLines: Record<string, string[]>;
+  topLevel: { tools?: Record<string, boolean> };
+  claudePermissions: { deny: string[]; allow: string[] } | null;
+  warnings: string[];
+}
+
+export function resolveToolFilters(
+  profile: { providerOverrides?: Record<string, { toolDeny?: string[]; toolAllow?: string[] }> } | undefined,
+  provider: string,
+): ToolFilters;
+export function hasToolFilters(filters: ToolFilters | undefined | null): boolean;
+export function parseToolPattern(pattern: string): { server: string; tool: string } | null;
+export function planToolFilters(provider: string, serverNames: string[], filters: ToolFilters): ToolFilterPlan;
+export function applyJsonToolFilterPlan(
+  config: Record<string, unknown>,
+  serversKey: string,
+  plan: ToolFilterPlan,
+): Record<string, unknown>;
+export function claudeSettingsPath(projectDir?: string, scope?: 'user' | 'project'): string;
+export interface ClaudePermissionOptions {
+  dryRun?: boolean;
+  userScope?: boolean;
+  projectRoot?: string;
+  managedDir?: string;
+  sidecar?: boolean;
+  mcpPath?: string;
+}
+export function prepareClaudePermissions(
+  settingsPath: string,
+  permissions: { deny: string[]; allow: string[] },
+  options?: ClaudePermissionOptions,
+): Promise<{ merged: Record<string, unknown>; active: boolean; warnings: string[]; writes: ConfigWrite[]; commit(): Promise<void> }>;
+export function mergeClaudePermissions(
+  settingsPath: string,
+  permissions: { deny: string[]; allow: string[] },
+  options?: ClaudePermissionOptions,
+): Promise<Record<string, unknown>>;