@aiwg/cli 2026.10.1 → 2026.10.4

package/dist/src/sessions/workspace-matching.js

@@ -0,0 +1,107 @@
+import { lstat, readFile, realpath, stat } from 'node:fs/promises';
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+export const WORKSPACE_MATCH_KINDS = ['exact', 'subfolder', 'worktree'];
+/** A nested catalog owns its subtree, even when discovery runs one workspace at a time. */
+export async function matchSessionWorkspace(cwd, workspace) {
+    try {
+        const { path: candidate, missing } = await resolveCandidate(resolve(cwd));
+        const workspacePath = await realpath(resolve(workspace));
+        const direct = encloses(workspacePath, candidate);
+        if (missing && !direct)
+            return null;
+        const physicalCatalog = await nearestCatalogBetween(candidate, direct ? workspacePath : undefined);
+        if (physicalCatalog && !encloses(physicalCatalog, workspacePath))
+            return null;
+        const mainRepository = await worktreeMainRepository(candidate).catch(() => null);
+        // A worktree also belongs to a deeper catalog around its main repository,
+        // including when both paths sit beneath the workspace being discovered.
+        if (mainRepository && encloses(workspacePath, mainRepository)
+            && await nearestCatalogBetween(mainRepository, workspacePath))
+            return null;
+        if (direct)
+            return candidate === workspacePath ? 'exact' : 'subfolder';
+        if (!mainRepository || !encloses(workspacePath, mainRepository))
+            return null;
+        return 'worktree';
+    }
+    catch {
+        // Unresolved paths or Git metadata cannot establish workspace ownership.
+        return null;
+    }
+}
+async function resolveCandidate(path) {
+    let ancestor = path;
+    const suffix = [];
+    for (;;) {
+        try {
+            // Stop at symlinks too, so realpath rejects dangling links below.
+            await lstat(ancestor);
+            break;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+            const parent = dirname(ancestor);
+            if (parent === ancestor)
+                throw error;
+            suffix.unshift(basename(ancestor));
+            ancestor = parent;
+        }
+    }
+    return { path: join(await realpath(ancestor), ...suffix), missing: suffix.length > 0 };
+}
+function encloses(parent, child) {
+    const suffix = relative(parent, child);
+    return suffix === '' || (!isAbsolute(suffix) && suffix !== '..' && !suffix.startsWith(`..${sep}`));
+}
+async function nearestCatalogBetween(candidate, stop) {
+    for (let directory = candidate; directory !== stop; directory = dirname(directory)) {
+        const catalog = await statIfPresent(join(directory, '.aiwg', 'sessions'));
+        if (catalog?.isDirectory())
+            return directory;
+        if (directory === dirname(directory))
+            break;
+    }
+    return null;
+}
+async function worktreeMainRepository(candidate) {
+    for (let directory = candidate;; directory = dirname(directory)) {
+        const marker = join(directory, '.git');
+        const details = await statIfPresent(marker);
+        if (details) {
+            // Stop at the nearest repository; a normal repository or submodule
+            // must not inherit an outer worktree's ownership.
+            if (!details.isFile())
+                return null;
+            const gitfile = /^gitdir: (.+)\s*$/.exec((await readFile(marker, 'utf8')).trim());
+            if (!gitfile)
+                return null;
+            const gitdir = await realpath(resolve(directory, gitfile[1].trim()));
+            const common = (await readFile(join(gitdir, 'commondir'), 'utf8')).trim();
+            if (!common)
+                return null;
+            const commonDir = await realpath(resolve(gitdir, common));
+            const backlink = (await readFile(join(gitdir, 'gitdir'), 'utf8')).trim();
+            if (!backlink || await realpath(resolve(gitdir, backlink)) !== await realpath(marker))
+                return null;
+            // Standard linked worktrees share the main repository's .git directory.
+            if (basename(commonDir) !== '.git' || commonDir === gitdir)
+                return null;
+            const mainRepository = dirname(commonDir);
+            return await realpath(join(mainRepository, '.git')) === commonDir ? mainRepository : null;
+        }
+        if (directory === dirname(directory))
+            return null;
+    }
+}
+async function statIfPresent(path) {
+    try {
+        return await stat(path);
+    }
+    catch (error) {
+        if (['ENOENT', 'ENOTDIR'].includes(error.code ?? ''))
+            return null;
+        throw error;
+    }
+}
+//# sourceMappingURL=workspace-matching.js.map

package/dist/src/skills/adapters/clawhub.js

@@ -11,7 +11,8 @@
  * @see https://clawhub.ai
  * @see https://docs.openclaw.ai/tools/clawhub
  */
-import { execSync } from 'child_process';
+import { boundedExecFileSync } from '../../process/bounded-child-process.mjs';
+import { cliCommand } from '../../process/cli-command.mjs';
 import fs from 'fs';
 import path from 'path';
 import { getProviderDefinition, resolveProviderPathValue, } from '../../providers/provider-definitions.js';
@@ -47,7 +48,8 @@ async function clawHubFetch(endpoint) {
  */
 function runClawHub(args) {
     try {
-        return execSync(`clawhub ${args}`, {
+        const [file, argv] = cliCommand('clawhub', args);
+        return boundedExecFileSync(file, argv, 'quick', {
             encoding: 'utf-8',
             timeout: 30000,
             stdio: ['pipe', 'pipe', 'pipe'],
@@ -65,7 +67,7 @@ export class ClawHubAdapter {
         if (this.available !== null)
             return this.available;
         // Check CLI
-        const cliAvailable = runClawHub('--version 2>/dev/null') !== null;
+        const cliAvailable = runClawHub(['--version']) !== null;
         if (cliAvailable) {
             this.available = true;
             return true;
@@ -89,7 +91,7 @@ export class ClawHubAdapter {
             }));
         }
         // Try CLI
-        const cliOutput = runClawHub(`search "${query}" --json 2>/dev/null`);
+        const cliOutput = runClawHub(['search', query, '--json']);
         if (cliOutput) {
             try {
                 const parsed = JSON.parse(cliOutput);
@@ -127,7 +129,7 @@ export class ClawHubAdapter {
             };
         }
         // Try CLI
-        const cliOutput = runClawHub(`info "${name}" --json 2>/dev/null`);
+        const cliOutput = runClawHub(['info', name, '--json']);
         if (cliOutput) {
             try {
                 const parsed = JSON.parse(cliOutput);
@@ -162,7 +164,7 @@ export class ClawHubAdapter {
             }));
         }
         // Try CLI
-        const cliOutput = runClawHub('list --json 2>/dev/null');
+        const cliOutput = runClawHub(['list', '--json']);
         if (cliOutput) {
             try {
                 const parsed = JSON.parse(cliOutput);
@@ -195,7 +197,7 @@ export class ClawHubAdapter {
             targetDir = resolveSkillFallbackPath(target, options.projectDir, name);
         }
         // Try CLI install (downloads to a temp location, then we copy)
-        const cliResult = runClawHub(`install "${name}" --output "${targetDir}" 2>/dev/null`);
+        const cliResult = runClawHub(['install', name, '--output', targetDir]);
         if (cliResult !== null)
             return;
         // Try API download
@@ -240,7 +242,7 @@ export class ClawHubAdapter {
             }
         }
         // Try CLI publish
-        const cliResult = runClawHub(`publish "${packageDir}" 2>/dev/null`);
+        const cliResult = runClawHub(['publish', packageDir]);
         if (cliResult !== null)
             return;
         throw new Error('ClawHub publish requires the clawhub CLI. ' +

package/dist/src/skills/adapters/openclaw.js

@@ -8,7 +8,8 @@
  * @implements #539
  * @see https://docs.openclaw.ai
  */
-import { execSync } from 'child_process';
+import { boundedExecFileSync } from '../../process/bounded-child-process.mjs';
+import { cliCommand } from '../../process/cli-command.mjs';
 import fs from 'fs';
 import path from 'path';
 import { getProviderDefinition, resolveProviderPathValue, } from '../../providers/provider-definitions.js';
@@ -26,7 +27,8 @@ function resolveSkillFallbackPath(target, projectDir, name) {
  */
 function runOpenClaw(args) {
     try {
-        return execSync(`openclaw ${args}`, {
+        const [file, argv] = cliCommand('openclaw', args);
+        return boundedExecFileSync(file, argv, 'quick', {
             encoding: 'utf-8',
             timeout: 30000,
             stdio: ['pipe', 'pipe', 'pipe'],
@@ -142,7 +144,8 @@ export class OpenClawAdapter {
         if (fs.existsSync(openclawDir))
             return true;
         try {
-            execSync('openclaw --version 2>/dev/null', { encoding: 'utf-8' });
+            const [file, args] = cliCommand('openclaw', ['--version']);
+            boundedExecFileSync(file, args, 'quick', { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'ignore'] });
             return true;
         }
         catch {
@@ -153,7 +156,7 @@ export class OpenClawAdapter {
         if (this.cachedSkills)
             return this.cachedSkills;
         // Try openclaw CLI with JSON output first
-        const jsonOutput = runOpenClaw('skills list --json 2>/dev/null');
+        const jsonOutput = runOpenClaw(['skills', 'list', '--json']);
         if (jsonOutput) {
             try {
                 const parsed = JSON.parse(jsonOutput);
@@ -178,7 +181,7 @@ export class OpenClawAdapter {
     }
     async search(query) {
         // Try CLI delegation first
-        const cliOutput = runOpenClaw(`skills search "${query}" --json 2>/dev/null`);
+        const cliOutput = runOpenClaw(['skills', 'search', query, '--json']);
         if (cliOutput) {
             try {
                 const parsed = JSON.parse(cliOutput);
@@ -207,7 +210,7 @@ export class OpenClawAdapter {
         const skillMdPath = skillDir ? path.join(skillDir, 'SKILL.md') : '';
         if (!skillMdPath || !fs.existsSync(skillMdPath)) {
             // Try CLI
-            const cliOutput = runOpenClaw(`skills info "${name}" --json 2>/dev/null`);
+            const cliOutput = runOpenClaw(['skills', 'info', name, '--json']);
             if (cliOutput) {
                 try {
                     const parsed = JSON.parse(cliOutput);
@@ -268,7 +271,7 @@ export class OpenClawAdapter {
     }
     async install(name, options) {
         // Try openclaw CLI install first
-        const cliResult = runOpenClaw(`skills install "${name}" 2>/dev/null`);
+        const cliResult = runOpenClaw(['skills', 'install', name]);
         if (cliResult !== null) {
             // CLI handled it — if target is different from openclaw, copy to target
             if (options.target && options.target !== 'openclaw') {

package/dist/src/skills/importer.js

@@ -178,6 +178,7 @@ function runGit(args, options = {}) {
         maxBuffer: options.maxBuffer ?? 16 * 1024 * 1024,
         stdio: ['ignore', 'pipe', 'pipe'],
         timeout: 120_000,
+        killSignal: 'SIGKILL',
     });
     if (result.error) {
         if (result.error.code === 'ETIMEDOUT') {

package/dist/src/smiths/context-pipeline/aiwg-md.js

@@ -17,6 +17,8 @@
 import { promises as fs } from 'node:fs';
 import * as path from 'node:path';
 import { projectControlPath } from '../../config/project-artifacts.js';
+import { buildClaudeHookBlock, CLAUDE_HOOK_START, CLAUDE_HOOK_END } from './claude-hook.js';
+import { dominantLineEnding, withLineEnding } from './line-endings.js';
 import { buildParallelismSection, replaceOrAppendParallelismBlock } from './parallelism-section.js';
 import { buildContextFinalizationBlock, replaceOrAppendFinalizationBlock } from './finalization.js';
 import { buildExternalLinksSection, replaceOrAppendExternalLinksBlock, } from './external-links-section.js';
@@ -55,6 +57,15 @@ export async function buildAiwgMdContent(projectPath, stagedClaudeMdContent) {
     if (claudeMdContent) {
         // Insert the AIWG signature comment as the second line.
         // Top line is typically `# AIWG` or `# Project` heading; preserve it.
+        // Regenerate may mirror CLAUDE.md before its hook updater runs. Normalize
+        // that managed block here too so legacy duplicate policy never reaches
+        // AIWG.md, even on the first refresh. Operator content stays untouched.
+        const start = claudeMdContent.indexOf(CLAUDE_HOOK_START);
+        const end = claudeMdContent.indexOf(CLAUDE_HOOK_END, start);
+        if (start >= 0 && end >= start) {
+            const hook = withLineEnding(buildClaudeHookBlock(), dominantLineEnding(claudeMdContent));
+            claudeMdContent = claudeMdContent.slice(0, start) + hook + claudeMdContent.slice(end + CLAUDE_HOOK_END.length);
+        }
         const lines = claudeMdContent.split('\n');
         // #1268: strip `@AIWG.md` self-include directives. CLAUDE.md uses
         // `@AIWG.md` to pull in the framework context; AIWG.md IS that framework

package/dist/src/smiths/context-pipeline/claude-hook.js

@@ -26,29 +26,14 @@ import { dominantLineEnding, withLineEnding } from './line-endings.js';
 import { assertSafeContextFile } from './context-file-safety.js';
 export const CLAUDE_HOOK_START = '<!-- AIWG:claude-md-hook:start -->';
 export const CLAUDE_HOOK_END = '<!-- AIWG:claude-md-hook:end -->';
-function buildClaudeArtifactOutputPolicy(policy = {}) {
-    const providerNative = policy.provider_native ?? 'explicit-only';
-    const design = policy.destinations?.['claude-code.design'];
-    const designEnabled = design?.enabled !== false && design?.use_when !== 'disabled';
-    return [
-        '## AIWG artifact output policy',
-        '',
-        `- Canonical durable artifacts: AIWG artifact store (policy: ${policy.canonical ?? 'aiwg'}).`,
-        `- Provider-native presentation/export: ${providerNative}.`,
-        `- Claude Design: ${designEnabled ? 'available only when explicitly selected by the resolved policy or requested by the user' : 'disabled by project policy'}.`,
-        '- Never substitute, relocate, or omit the canonical AIWG plan/review artifact because Claude adds or changes a provider default.',
-        '- When both canonical and presentation outputs are selected, write the canonical artifact first; treat Design as a derived export and record provenance linking it to the canonical source of truth.',
-        '- Unknown provider-native destinations fail safe with a diagnostic. Higher-authority project policy overrides user preferences; explicit task selection overrides provider defaults only within the project policy ceiling.',
-    ];
-}
-export function buildClaudeHookBlock(policy = {}) {
+export function buildClaudeHookBlock(_policy = {}) {
     return [
         CLAUDE_HOOK_START,
         '',
         buildProviderBootstrapBlock('claude'),
         '@.aiwg/aiwg.config',
         '',
-        ...buildClaudeArtifactOutputPolicy(policy),
+        'Artifact destination authority: `aiwg show rule artifact-output-policy` (kernel).',
         '',
         '<!--',
         '  This block is managed by `aiwg regenerate` and `aiwg use`.',
@@ -72,15 +57,7 @@ export async function ensureClaudeMdHook(projectPath, opts = {}) {
         action: 'skipped',
         warnings: [],
     };
-    let policy = {};
-    try {
-        const config = JSON.parse(await fs.readFile(path.join(projectPath, '.aiwg', 'aiwg.config'), 'utf8'));
-        policy = config.artifact_outputs ?? {};
-    }
-    catch {
-        // Missing/legacy/temporarily malformed config receives the safe default.
-    }
-    let block = buildClaudeHookBlock(policy);
+    let block = buildClaudeHookBlock();
     // Case 1: CLAUDE.md does not exist — create a minimal one with just the block.
     let existing;
     try {

package/dist/src/smiths/context-pipeline/finalization.js

@@ -2,7 +2,7 @@
  * Context-finalization pass for generated provider context files.
  *
  * Templates provide the stable structure; this pass stitches in current
- * workspace facts from `.aiwg/aiwg.config` and the discover-first protocol so
+ * workspace facts from `.aiwg/aiwg.config` and rule authority pointers so
  * provider context files do not remain template-only (#1365).
  */
 import { promises as fs } from 'node:fs';
@@ -10,6 +10,7 @@ import * as path from 'node:path';
 import { projectAiwgPath, projectControlPath, resolveProjectAiwgDir, } from '../../config/project-artifacts.js';
 import { renderTrackerProtocol, resolveTrackerAuthority } from '../../tracker/capability-protocol.js';
 import { readConfig, readGitRemoteUrls } from '../../tracker/project-inputs.js';
+import { DECISION_COMPACT_ANCHOR, inspectDecisionOffloadActivation } from '../../decision/offload-activation.js';
 import { buildExternalLinksSection, replaceOrAppendExternalLinksBlock, } from './external-links-section.js';
 export const FINALIZATION_START = '<!-- aiwg-context-finalization:START -->';
 export const FINALIZATION_END = '<!-- aiwg-context-finalization:END -->';
@@ -52,6 +53,7 @@ export async function buildContextFinalizationBlock(projectPath, documentPath =
         }
     }
     const trackerAuthority = resolveTrackerAuthority(config, remoteUrls);
+    const decision = await inspectDecisionOffloadActivation({ cwd: projectPath });
     const lines = [
         FINALIZATION_START,
         '## Context Finalization',
@@ -65,11 +67,9 @@ export async function buildContextFinalizationBlock(projectPath, documentPath =
         `- Recorded deployments: ${formatList([...providerDeployments].sort())}`,
         `- Normalized project context: \`${normalizedAiwgMdPath}\``,
         '',
-        '### Discover-First Protocol',
+        '### Capability Routing',
         '',
-        'Classify every user turn FIRST: is it a **new directive** or a continuation? When a message names or references an AIWG command/capability — even as pasted content like an `address-issues` tracker table, an issue list, or a `flow-*` name — treat it as a new directive and ACT: run `aiwg discover "<the need>"`, fetch with `aiwg show <type> <name>`, and invoke it. Do NOT ask "what would you like me to do with these?" when the action is implied — a pasted `address-issues #1234` table means run the address-issues workflow on those issues.',
-        '',
-        'Also run `aiwg discover` before declining an AIWG request as out of scope or inventing a workflow from memory. The CLI ranks AIWG capabilities across the installed corpus and rebuilds the index from `$AIWG_ROOT` automatically, so a "no matches" for a command you know is deployed is a bug — not a signal it is absent. Commands AIWG deploys to your provider command directory (`.opencode/command/`, `.claude/commands/`, `~/.codex/prompts/`, …) ARE discoverable this way; fetch them with `aiwg show command <name>`. This prevents decline-without-search failures, ask-instead-of-act on new directives, and hallucinated skill or agent names. Full rule: `agentic/code/addons/aiwg-utils/rules/skill-discovery.md`.',
+        'Routing authority: `aiwg show rule skill-discovery` (kernel); capability phrases: `aiwg show skill aiwg-utils-quickref`.',
         '',
         '### Engagement Verification',
         '',
@@ -84,6 +84,7 @@ export async function buildContextFinalizationBlock(projectPath, documentPath =
         `- ${normalizedAiwgMdLabel} is the normalized project-local context entry point.`,
         '- Root `AIWG.md` is the generated cross-provider companion loaded through `AGENTS.md` and provider twins.',
         `- \`AGENTS.md\`, \`WARP.md\`, \`.hermes.md\`, and \`.github/copilot-instructions.md\` are provider-facing bridges, not replacements for ${normalizedAiwgMdLabel}.`,
+        ...(decision.shouldAnchor ? ['', '## Compact Instructions', '', DECISION_COMPACT_ANCHOR] : []),
         FINALIZATION_END,
         '',
     ];

package/dist/src/smiths/context-pipeline/generator.js

@@ -199,7 +199,24 @@ export async function isOverwriteSafe(filePath) {
  *
  * Per ADR-4 §4 atomic write requirement; on failure no partial state is persisted.
  */
-async function atomicWrite(filePath, content) {
+async function atomicWrite(filePath, content, provider) {
+    // Rule delivery owns this block. Context regeneration runs after deployment
+    // and must retain the selected kernel even when rebuilding the adapter.
+    const existing = await fs.readFile(filePath, 'utf8').catch(() => '');
+    for (const owner of ['rule-startup', 'hermes-context', 'hermes-routing', 'warp-context']) {
+        if (content.includes(`<!-- AIWG:${owner}:start -->`))
+            continue;
+        const managed = existing.match(new RegExp(`<!-- AIWG:${owner}:start -->[\\s\\S]*?<!-- AIWG:${owner}:end -->`));
+        if (managed)
+            content = `${content.trimEnd()}\n\n${managed[0]}\n`;
+    }
+    const bytes = Buffer.byteLength(content, 'utf8');
+    if (provider === 'codex' && path.basename(filePath) === 'AGENTS.md' && bytes >= 32768) {
+        throw new Error('Codex AGENTS.md exceeds its 32 KB hard cap');
+    }
+    if (provider === 'hermes' && ['AGENTS.md', '.hermes.md'].includes(path.basename(filePath)) && content.length > 19000) {
+        throw new Error(`Hermes ${path.basename(filePath)} exceeds hard cap of 19000 characters`);
+    }
     const dir = path.dirname(filePath);
     const tmp = path.join(dir, `.${path.basename(filePath)}.tmp.${process.pid}`);
     await fs.mkdir(dir, { recursive: true });
@@ -212,6 +229,7 @@ async function atomicWrite(filePath, content) {
         await fs.unlink(tmp).catch(() => undefined);
         throw err;
     }
+    return bytes;
 }
 /**
  * Per-provider twin-file names for AGENTS.md emission per ADR-1 §4.
@@ -303,7 +321,7 @@ async function writeTwinFiles(provider, projectPath, agentsMdContent, opts, resu
                     throw err;
             }
         }
-        await atomicWrite(twinPath, twinContent);
+        await atomicWrite(twinPath, twinContent, provider);
         result.twinPaths.push(twinPath);
     }
 }
@@ -408,9 +426,8 @@ export async function generate(opts) {
         // write, and as the twin content downstream.
         const built = await buildAgentsMd(opts);
         if (canWrite) {
-            await atomicWrite(agentsMdPath, built.content);
+            result.agentsMdBytes = await atomicWrite(agentsMdPath, built.content, opts.provider);
             result.agentsMdPath = agentsMdPath;
-            result.agentsMdBytes = Buffer.byteLength(built.content, 'utf8');
             result.warnings.push(...built.warnings);
             if (built.splitOccurred) {
                 await writeSpilloverBlock(opts.projectPath, built.spilloverContent, result);