@aiwg/cli 2026.10.10 → 2026.10.11

package/agentic/code/providers/model-capabilities.v1.json

@@ -4,6 +4,9 @@
   "verifiedAt": "2026-07-20",
   "providers": {
     "antigravity": {
+      "sessionEnvAllowlist": [
+        "GEMINI_API_KEY"
+      ],
       "agent": "native",
       "skill": "native",
       "globalChild": "inherited",
@@ -19,7 +22,7 @@
       "invalidPinFallback": "Provider validation/error; never assume fallback",
       "configTarget": "agy launch arguments; custom-agent model tiers are not projected from generic AIWG model ids",
       "artifactFormat": "YAML frontmatter plus Markdown; runtime --model and --effort flags",
-      "verification": "Pinned offline contract (--help/--version only); authenticated model selection was not executed",
+      "verification": "Pinned offline contract (--help/--version only); authenticated model selection was not executed. Session credential evidence: $AIWG_ROOT/docs/cli/sensitive-values.md#provider-recipient-exceptions (#3624).",
       "sourceUrl": "https://antigravity.google/docs/cli/subagents/",
       "verifiedAt": "2026-09-04",
       "workerHealthAdapter": {
@@ -154,7 +157,7 @@
               "Native MCP/client, MSP/ACP, gateway and conversation capabilities do not establish worker authority.",
               "--dangerously-skip-permissions and --remote-control are never part of the direct profile; neither was ever shipped as a new argv-prompt path.",
               "A soft-denied tool permission request (exit 0, stderr notice naming the allow-rule needed) is NOT the same as success; its exact stderr wording is not evidenced from help or changelog, so this is an open, honestly-marked detection gap rather than an invented check (tools/ralph-external/lib/antigravity-adapter.mjs ANTIGRAVITY_SOFT_DENY_RISK_NOTE).",
-              "GEMINI_API_KEY in envAllowlist is a strings-sourced GUESS, not confirmed to authenticate this CLI. Live fix-round-1 probes (D/E, no login present) show a bare run stops at \"Error: authentication required. Run 'agy' to log in, then retry.\" — this is an interactive Google-account login, not a documented env-key or OpenRouter-style flag. The manual smoke run is BLOCKED until an operator completes an interactive `agy` login on the target host.",
+              "GEMINI_API_KEY is documented at https://antigravity.google/docs/install/ (reviewed 2026-10-26): settings.json must also set modelProvider to gemini; the key alone has no effect. Earlier 1.3.3 probes only exercised missing account login. This documentation confirms the credential name, not authenticated execution or qualification of this version-bound worker profile.",
               "The 1.3.3 --effort enum (low|medium|high|xhigh|max) supersedes the stale 1.1.26-pinned three-value set in tools/providers/antigravity-transport.mjs (a separate, unedited legacy transport used by the MCP/doctor bridge, not this direct-shell profile).",
               "Flag validation happens BEFORE auth: live probe F, `agy --print=x --input-format bogus --output-format stream-json`, returned \"Error: unknown --input-format \\\"bogus\\\" (want text or stream-json)\" without reaching the auth stop, confirming --input-format is validated against exactly {text, stream-json} independent of login state.",
               "The brief reaches agy through adapter-frame: the installed buildWorkerStdinFrame hook supplies exactly one NDJSON user message and EOF. The stdin control stays unqualified pending one authenticated smoke run."
@@ -865,6 +868,9 @@
       }
     },
     "cursor": {
+      "sessionEnvAllowlist": [
+        "CURSOR_API_KEY"
+      ],
       "agent": "native",
       "skill": "unsupported",
       "globalChild": "inherited",
@@ -873,7 +879,7 @@
       "invalidPinFallback": "Plan/admin fallback may apply; record observed result",
       "configTarget": ".cursor/agents/*.md",
       "artifactFormat": "YAML frontmatter plus Markdown",
-      "verification": "Schema fixture and entitled Cursor invocation",
+      "verification": "Schema fixture and entitled Cursor invocation. Session credential evidence: $AIWG_ROOT/docs/cli/sensitive-values.md#provider-recipient-exceptions (#3624).",
       "sourceUrl": "https://cursor.com/docs/subagents",
       "verifiedAt": "2026-07-20",
       "workerHealthAdapter": {
@@ -1465,6 +1471,9 @@
       }
     },
     "warp": {
+      "sessionEnvAllowlist": [
+        "WARP_API_KEY"
+      ],
       "agent": "global-only",
       "skill": "unsupported",
       "globalChild": "native",
@@ -1473,7 +1482,7 @@
       "invalidPinFallback": "Profile availability dependent",
       "configTarget": "Warp agent profile or run configuration",
       "artifactFormat": "Saved profile / run control plane",
-      "verification": "Inspect active profile and run metadata",
+      "verification": "Inspect active profile and run metadata. Session credential evidence: $AIWG_ROOT/docs/cli/sensitive-values.md#provider-recipient-exceptions (#3624).",
       "sourceUrl": "https://docs.warp.dev/agent-platform/capabilities/agent-profiles-permissions",
       "verifiedAt": "2026-07-20",
       "workerHealthAdapter": {
@@ -2284,6 +2293,7 @@
       }
     },
     "windsurf": {
+      "sessionEnvAllowlist": [],
       "agent": "unsupported",
       "skill": "unsupported",
       "globalChild": "inherited",
@@ -2292,7 +2302,7 @@
       "invalidPinFallback": "No portable custom-child selector",
       "configTarget": "No supported portable artifact field",
       "artifactFormat": "Informational policy only",
-      "verification": "Assert unsupported fields are omitted",
+      "verification": "Assert unsupported fields are omitted. Session environment is explicitly empty: desktop/cloud login owns authentication; no CLI credential variable is evidenced. Coverage-only: no worker execution or qualified worker adapter. See $AIWG_ROOT/docs/cli/sensitive-values.md#provider-recipient-exceptions (#3624).",
       "sourceUrl": "https://docs.devin.ai/desktop/cascade/skills",
       "verifiedAt": "2026-07-20",
       "workerHealthCoverage": {
@@ -2312,6 +2322,22 @@
       }
     },
     "openclaw": {
+      "sessionEnvAllowlist": [
+        "OPENAI_API_KEY",
+        "ANTHROPIC_API_KEY",
+        "ANTHROPIC_OAUTH_TOKEN",
+        "GEMINI_API_KEY",
+        "GOOGLE_API_KEY",
+        "OPENROUTER_API_KEY",
+        "MISTRAL_API_KEY",
+        "XAI_API_KEY",
+        "OPENCLAW_HOME",
+        "OPENCLAW_STATE_DIR",
+        "OPENCLAW_CONFIG_PATH",
+        "OPENCLAW_GATEWAY_URL",
+        "OPENCLAW_GATEWAY_TOKEN",
+        "OPENCLAW_GATEWAY_PASSWORD"
+      ],
       "agent": "native",
       "skill": "unsupported",
       "globalChild": "native",
@@ -2320,7 +2346,7 @@
       "invalidPinFallback": "Provider/account fallback must be observed",
       "configTarget": "OpenClaw subagent configuration",
       "artifactFormat": "JSON/JSONC runtime configuration",
-      "verification": "Inspect resolved subagent metadata",
+      "verification": "Inspect resolved subagent metadata. Session credential evidence: $AIWG_ROOT/docs/cli/sensitive-values.md#provider-recipient-exceptions (#3624).",
       "sourceUrl": "https://docs.openclaw.ai/tools/subagents",
       "verifiedAt": "2026-07-20",
       "workerHealthAdapter": {
@@ -2508,6 +2534,7 @@
       }
     },
     "grokbot": {
+      "sessionEnvAllowlist": [],
       "agent": "unsupported",
       "skill": "unsupported",
       "globalChild": "informational",
@@ -2516,7 +2543,7 @@
       "invalidPinFallback": "Report unsupported; do not fabricate xAI/Grok model pins as native",
       "configTarget": "Grok Bot has no verified AIWG-owned model config path",
       "artifactFormat": "Informational only",
-      "verification": "Confirm steward models --route --provider grokbot emits unsupported/informational",
+      "verification": "Confirm steward models --route --provider grokbot emits unsupported/informational. Session environment is explicitly empty: desktop/cloud login owns authentication; no CLI credential variable is evidenced. Coverage-only: no worker execution or qualified worker adapter. See $AIWG_ROOT/docs/cli/sensitive-values.md#provider-recipient-exceptions (#3624).",
       "sourceUrl": "https://github.com/jmagly/aiwg/blob/main/docs/architecture/adr-grokbot-provider-target.md",
       "verifiedAt": "2026-09-15",
       "workerHealthCoverage": {
@@ -2536,6 +2563,10 @@
       }
     },
     "grok-build": {
+      "sessionEnvAllowlist": [
+        "XAI_API_KEY",
+        "GROK_HOME"
+      ],
       "agent": "inherited",
       "skill": "inherited",
       "globalChild": "native",
@@ -2544,7 +2575,7 @@
       "invalidPinFallback": "Report the unavailable alias; use the sole discovered model only when exactly one is available",
       "configTarget": "$GROK_HOME/config.toml [models] and [model.<alias>] (read-only discovery)",
       "artifactFormat": "Grok Build model alias",
-      "verification": "grok inspect --json plus bounded parsing of model fields from reported config layers",
+      "verification": "grok inspect --json plus bounded parsing of model fields from reported config layers. Session credential evidence: $AIWG_ROOT/docs/cli/sensitive-values.md#provider-recipient-exceptions (#3624).",
       "sourceUrl": "https://docs.x.ai/build/settings",
       "verifiedAt": "2026-09-21",
       "workerHealthAdapter": {
@@ -2736,6 +2767,25 @@
       }
     },
     "hermes": {
+      "sessionEnvAllowlist": [
+        "OPENAI_API_KEY",
+        "ANTHROPIC_API_KEY",
+        "ANTHROPIC_TOKEN",
+        "CLAUDE_CODE_OAUTH_TOKEN",
+        "GEMINI_API_KEY",
+        "GOOGLE_API_KEY",
+        "OPENROUTER_API_KEY",
+        "GROQ_API_KEY",
+        "MISTRAL_API_KEY",
+        "XAI_API_KEY",
+        "DEEPSEEK_API_KEY",
+        "OPENAI_BASE_URL",
+        "ANTHROPIC_BASE_URL",
+        "OPENROUTER_BASE_URL",
+        "CUSTOM_BASE_URL",
+        "HERMES_HOME",
+        "HERMES_INFERENCE_PROVIDER"
+      ],
       "agent": "global-only",
       "skill": "unsupported",
       "globalChild": "native",
@@ -2744,7 +2794,7 @@
       "invalidPinFallback": "Provider resolution is global; report actual model",
       "configTarget": "Hermes delegation configuration",
       "artifactFormat": "Global CLI/config setting",
-      "verification": "Inspect Hermes delegation configuration",
+      "verification": "Inspect Hermes delegation configuration. Session credential evidence: $AIWG_ROOT/docs/cli/sensitive-values.md#provider-recipient-exceptions (#3624).",
       "sourceUrl": "https://hermes-agent.nousresearch.com/docs/user-guide/features/delegation",
       "verifiedAt": "2026-07-20",
       "workerHealthAdapter": {
@@ -2927,6 +2977,19 @@
       }
     },
     "openhuman": {
+      "sessionEnvAllowlist": [
+        "OPENHUMAN_CORE_TOKEN",
+        "OPENHUMAN_CORE_RPC_URL",
+        "OPENHUMAN_CORE_HOST",
+        "OPENHUMAN_CORE_PORT",
+        "OPENHUMAN_WORKSPACE",
+        "OPENHUMAN_DOTENV_PATH",
+        "OPENHUMAN_KEYRING_MASTER_KEY",
+        "OPENHUMAN_KEYRING_MASTER_KEY_FILE",
+        "OPENHUMAN_APP_ENV",
+        "BACKEND_URL",
+        "OPENHUMAN_MODEL"
+      ],
       "agent": "compiled",
       "skill": "unsupported",
       "globalChild": "inherited",
@@ -2935,7 +2998,7 @@
       "invalidPinFallback": "Exact pins validate; semantic hints route dynamically",
       "configTarget": "OpenHuman agent TOML",
       "artifactFormat": "Standalone TOML agent definition",
-      "verification": "Parse against OpenHuman definition schema",
+      "verification": "Parse against OpenHuman definition schema. Session credential evidence: $AIWG_ROOT/docs/cli/sensitive-values.md#provider-recipient-exceptions (#3624).",
       "sourceUrl": "https://github.com/tinyhumansai/openhuman/blob/main/src/openhuman/agent/harness/definition.rs",
       "verifiedAt": "2026-07-20",
       "workerHealthAdapter": {
@@ -3154,6 +3217,7 @@
             "${effort}",
             "--workspace",
             "${workspace}",
+            "--trust-workspace",
             "--approval-mode",
             "never",
             "--approval-judge",
@@ -3246,8 +3310,8 @@
               },
               "trust": {
                 "support": "unqualified",
-                "mapping": "[]",
-                "evidence": "Installed muse exec --help (Muse Code 1.4.12, 2026-10-23); bounded renderer checked on operator qualification; no backend attestation."
+                "mapping": "[\"--trust-workspace\"]",
+                "evidence": "Installed muse exec --help (Muse Code 1.4.12, 2026-10-23); bounded renderer checked on operator qualification; no backend attestation. Tier 0 workspaces are conductor-prepared worker trees the conductor owns, so the profile binds --trust-workspace by default (#3685: untrusted Muse loads project_sources=0 with user skills only and empty hook admission; trusted loads project_sources=1, project skills and hooks)."
               },
               "children": {
                 "support": "unqualified",
@@ -3268,13 +3332,13 @@
               "Live qualification is an open S1 blocker; installed help and synthetic/echo mechanics are not paid inference qualification.",
               "Configured-model events provide runtime-configured identity only, never backend attestation.",
               "Contributor data policy is explicit; shared policy denies contributor models and never silently selects the CLI default.",
-              "Workspace trust defaults off; only a host-qualified trust mapping may load rules/skills. Approval-mode never and approval-judge off retain the sandbox. Muse requires a qualified external boundary.",
+              "Workspace trust is bound on for conductor-prepared worker trees (the conductor owns the worktree), so project rules/skills/hooks load; only a host-qualified trust mapping may change it. Approval-mode never and approval-judge off retain the sandbox. Muse requires a qualified external boundary.",
               "Host qualification must bind an absolute output-schema mapping and include that schema in runtimeFiles.",
               "Muse JSONL strict normalization needs the shared strict-parser hook; the MCP bridge must consume the selected provider parser. MSP is not MCP.",
               "Semantic step/tool completion grammar and native session-log layout remain unavailable; unrelated logs, deltas and CPU cannot establish progress.",
               "Shared version gate: installation requires the raw trimmed banner Muse Code 1.4.4 (1.4.4-R5419.1), but semver selection requires 1.4.4-R5419.1. No normalization exists; keep unqualified until the shared owner binds raw and normalized versions.",
               "Operator qualification approves the installed direct renderer, not authenticated inference or backend model identity.",
-              "Workspace trust defaults off. Only never approval is supported. Explicit unsupported controls block dispatch.",
+              "Workspace trust is on for conductor-prepared worker trees. Only never approval is supported. Explicit unsupported controls block dispatch.",
               "Self-delegation must be explicitly allowed by policy; no native child-denial flag is assumed."
             ],
             "health": {

package/dist/src/cli/handlers/sessions.js

@@ -3,7 +3,7 @@ import { randomUUID } from 'node:crypto';
 import { basename, dirname, isAbsolute, join, resolve, } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { providerScopeWarnings } from '../../sessions/coverage-preflight.js';
-import { CLAUDE_ADAPTER_VERSION, ClaudeSessionAdapter, CODEX_ADAPTER_VERSION, CodexSessionAdapter, COPILOT_ADAPTER_VERSION, CopilotSessionAdapter, CURSOR_ADAPTER_VERSION, CursorSessionAdapter, FACTORY_ADAPTER_VERSION, FactorySessionAdapter, HERMES_ADAPTER_VERSION, HermesSessionAdapter, OPENCODE_ADAPTER_VERSION, OpenCodeSessionAdapter, OPENCLAW_ADAPTER_VERSION, OpenClawSessionAdapter, OPENHUMAN_ADAPTER_VERSION, OpenHumanSessionAdapter, GROKBOT_ADAPTER_VERSION, GROKBOT_NATIVE_REPLICA_LOCATOR_CLASS, GrokbotSessionAdapter, GROK_BUILD_ADAPTER_VERSION, GROK_BUILD_CLI_EXPORT_LOCATOR_CLASS, GrokBuildSessionAdapter, grokBuildList, grokBuildSearch, grokBuildExport, grokHeadlessSessionIdFromFile, MUSE_ADAPTER_VERSION, MuseSessionAdapter, PI_ADAPTER_VERSION, PiSessionAdapter, DEEPSEEK_HARNESS_ADAPTER_VERSION, DeepSeekHarnessSessionAdapter, OmpSessionAdapter, OMP_ADAPTER_VERSION, WARP_ADAPTER_VERSION, WarpSessionAdapter, DEVIN_DESKTOP_ADAPTER_VERSION, DevinDesktopSessionAdapter, CandidateExtractionService, GENERIC_ADAPTER_VERSION, GenericSessionInterchangeAdapter, IncrementalSessionImporter, ImportLeaseContentionError, FilesystemMemoryDestination, FilesystemPromotionDispositionCoordinator, MemoryPromotionGateway, SESSION_CONTRACT_VERSION, SessionContractError, SessionRepository, SessionSourceSchema, StructuralCandidateExtractor, resolveMemoryConsumerManifest, assertSessionProviderId, acquireImportLease, defaultDiscoveryManifestPath, discoverWorkspaceHistories, createSessionAdapterRegistry, coveragePreflight, expectedSessionProviders, deriveSessionTimeline, importDiscoveryManifest, previewDiscoveryImport, publicDiscoveryManifest, readDiscoveryManifest, redactSourceLocator, sha256, parseTimelineGap, writeDiscoveryManifest, buildSessionExportPlan, reverifySessionExportPlan, buildSessionAiwgFortemiIndexExport, recoverAiwgFortemiIndexFromFullV1Shard, embedAttachmentsInFullV1Shard, recoverEmbeddedAttachments, SESSION_EXPORT_PLAN_SCHEMA_VERSION, } from '../../sessions/index.js';
+import { CLAUDE_ADAPTER_VERSION, ClaudeSessionAdapter, CODEX_ADAPTER_VERSION, CodexSessionAdapter, COPILOT_ADAPTER_VERSION, CopilotSessionAdapter, CURSOR_ADAPTER_VERSION, CursorSessionAdapter, FACTORY_ADAPTER_VERSION, FactorySessionAdapter, HERMES_ADAPTER_VERSION, HermesSessionAdapter, OPENCODE_ADAPTER_VERSION, OpenCodeSessionAdapter, OPENCLAW_ADAPTER_VERSION, OpenClawSessionAdapter, OPENHUMAN_ADAPTER_VERSION, OpenHumanSessionAdapter, GROKBOT_ADAPTER_VERSION, GROKBOT_NATIVE_REPLICA_LOCATOR_CLASS, GrokbotSessionAdapter, GROK_BUILD_ADAPTER_VERSION, GROK_BUILD_CLI_EXPORT_LOCATOR_CLASS, GrokBuildSessionAdapter, grokBuildList, grokBuildSearch, grokBuildExport, grokHeadlessSessionIdFromFile, MUSE_ADAPTER_VERSION, MuseSessionAdapter, PI_ADAPTER_VERSION, PiSessionAdapter, DEEPSEEK_HARNESS_ADAPTER_VERSION, DeepSeekHarnessSessionAdapter, OmpSessionAdapter, OMP_ADAPTER_VERSION, WARP_ADAPTER_VERSION, WarpSessionAdapter, DEVIN_DESKTOP_ADAPTER_VERSION, DevinDesktopSessionAdapter, CandidateExtractionService, GENERIC_ADAPTER_VERSION, GenericSessionInterchangeAdapter, IncrementalSessionImporter, ImportLeaseContentionError, FilesystemMemoryDestination, FilesystemPromotionDispositionCoordinator, MemoryPromotionGateway, SESSION_CONTRACT_VERSION, SessionContractError, SessionRepository, SessionSourceSchema, StructuralCandidateExtractor, resolveMemoryConsumerManifest, assertSessionProviderId, acquireImportLease, countUniqueSessionsAcrossCatalogs, defaultDiscoveryManifestPath, defaultHostCatalogPath, HOST_CATALOG_WORKSPACE_ID, indexIdentitiesBySessionId, manifestNeedsHostCatalog, mergeCrossCatalogRows, mergeSessionLists, resolveHostReferences, summarizeSessionAnalyticsFacts, discoverWorkspaceHistories, createSessionAdapterRegistry, coveragePreflight, expectedSessionProviders, deriveSessionTimeline, importDiscoveryManifest, previewDiscoveryImport, publicDiscoveryManifest, readDiscoveryManifest, redactSourceLocator, sha256, parseTimelineGap, writeDiscoveryManifest, buildSessionExportPlan, reverifySessionExportPlan, buildSessionAiwgFortemiIndexExport, recoverAiwgFortemiIndexFromFullV1Shard, embedAttachmentsInFullV1Shard, recoverEmbeddedAttachments, SESSION_EXPORT_PLAN_SCHEMA_VERSION, } from '../../sessions/index.js';
 import { resolveImportExclusions } from '../../sessions/import-exclusions.js';
 import { resolveImportLimits } from '../../sessions/import-limits.js';
 import { classifyGrokbotBlobName } from '../../sessions/adapters/grokbot-locator.js';
@@ -227,18 +227,35 @@ async function executeCommand(ctx, args) {
                     limit,
                     cursor,
                 });
+                // Account-scoped sessions live once in the host catalog; the
+                // workspace holds references (#3232). Read through them on the
+                // opening page so the workspace lists its referenced sessions.
+                // Cursor pages continue the local snapshot. Totals dedupe legacy
+                // copied rows against references, counting each session once.
+                const hostView = cursor
+                    ? null
+                    : readHostReferencedSessions(repository, { provider, tag: args.values.get('--tag') });
+                const items = hostView && hostView.sessions.length > 0
+                    ? mergeSessionLists(result.items, hostView.sessions).slice(0, limit)
+                    : result.items;
+                const total = hostView && hostView.references.length > 0
+                    ? countUniqueSessionsAcrossCatalogs([{
+                            identities: repository.listSessionIdentities(workspaceId),
+                            references: hostView.resolvedReferences,
+                        }])
+                    : result.total;
                 const coverage = {
                     ...repository.getCoverage(workspaceId),
                     catalogScope: catalogScope(ctx, args, repository, workspaceId),
                 };
                 const response = {
-                    items: result.items,
+                    items,
                     page: {
                         limit,
                         cursor: cursor ?? null,
                         nextCursor: result.nextCursor,
                         snapshotRowid: result.snapshotRowid,
-                        total: result.total,
+                        total,
                     },
                     coverage,
                 };
@@ -314,10 +331,15 @@ async function executeCommand(ctx, args) {
                 const session = matches[0];
                 if (!session)
                     throw new CliError('SESSION_NOT_FOUND', `session not found: ${id}${scope.hint ? `; ${scope.hint}` : ''}`, EXIT.unavailable, { catalogScope: scope });
+                // Image references resolve against the blob store: available blobs
+                // report their reference, missing ones an explicit unavailable
+                // state. Bytes stay out of the response; fetch by digest (#3265).
+                const events = repository.listEvents(session.sessionId, session.workspaceId)
+                    .map((event) => ({ ...event, images: repository.resolveEventImages(event) }));
                 return ok(command, {
                     session,
                     tags: repository.listTags(session.sessionId, session.workspaceId),
-                    events: repository.listEvents(session.sessionId, session.workspaceId),
+                    events,
                     catalogScope: catalogScope(ctx, args, repository, session.workspaceId),
                 });
             }
@@ -326,7 +348,8 @@ async function executeCommand(ctx, args) {
                 const { workspaceId } = readAuthorizationContext(ctx, args, command, repository);
                 const providerInput = args.values.get('--provider');
                 const provider = providerInput ? assertSessionProviderId(providerInput) : undefined;
-                const result = repository.search({
+                const limit = boundedInteger(args.values.get('--limit'), 50, 1, 500, '--limit');
+                const searchOptions = {
                     query,
                     workspaceId,
                     providers: provider ? [provider] : undefined,
@@ -341,13 +364,24 @@ async function executeCommand(ctx, args) {
                     sensitivity: args.values.get('--sensitivity'),
                     extractionState: args.values.get('--extraction-state'),
                     controlEvents: controlEventMode(args.values.get('--control-events')),
-                    limit: boundedInteger(args.values.get('--limit'), 50, 1, 500, '--limit'),
+                    limit,
                     cursor: args.values.get('--cursor'),
-                });
+                };
+                const result = repository.search(searchOptions);
+                // Read through host references on the opening page so workspace
+                // search finds referenced account-scoped sessions. Each session
+                // counts once: host hits for sessions already present locally
+                // (legacy copied rows) are dropped by provider + native session.
+                const hostRead = searchOptions.cursor
+                    ? null
+                    : searchHostReferencedSessions(repository, searchOptions, provider);
+                const items = hostRead && hostRead.hits.length > 0
+                    ? mergeCrossCatalogRows(result.items, hostRead.hits, indexIdentitiesBySessionId(repository.listSessionIdentities(workspaceId)), indexIdentitiesBySessionId(hostRead.hostIdentities), (hit) => [hit.provider, hit.eventId].join(' ')).slice(0, limit)
+                    : result.items;
                 return ok(command, {
-                    items: result.items,
+                    items,
                     catalogScope: catalogScope(ctx, args, repository, workspaceId),
-                    page: { limit: boundedInteger(args.values.get('--limit'), 50, 1, 500, '--limit'),
+                    page: { limit,
                         nextCursor: result.nextCursor },
                 });
             }
@@ -355,14 +389,22 @@ async function executeCommand(ctx, args) {
                 const view = requiredPositional(args, 0, 'analytics view');
                 const { workspaceId } = readAuthorizationContext(ctx, args, command, repository);
                 const query = analyticsQuery(args, workspaceId);
+                // Host references resolve to facts stored under the host catalog;
+                // each session counts once by provider + native session id. Without
+                // references the single-catalog path below is unchanged.
+                const mergedFacts = readWorkspaceAnalyticsFacts(repository, query);
                 if (view === 'summary') {
                     return ok(command, {
                         view,
-                        summary: repository.analyticsSummary(query),
+                        summary: mergedFacts
+                            ? summarizeSessionAnalyticsFacts(mergedFacts, workspaceId)
+                            : repository.analyticsSummary(query),
                     });
                 }
                 const categories = analyticsCategories(view);
-                const items = repository.listAnalyticsFacts({ ...query, categories });
+                const items = mergedFacts
+                    ? mergedFacts.filter((fact) => categories.includes(fact.category))
+                    : repository.listAnalyticsFacts({ ...query, categories });
                 return ok(command, {
                     analyticsVersion: '1.0.0',
                     view,
@@ -1075,7 +1117,10 @@ async function exportBuild(ctx, args, repository, command) {
         ...output,
         bytesEmbedded: includeBytes && outputBytesByRegistrationId.has(output.registrationId),
     }));
-    const index = buildSessionAiwgFortemiIndexExport(plan.workspaceId, sessions, eventsBySessionId, outputs, catalogTagsBySessionId);
+    const index = buildSessionAiwgFortemiIndexExport(plan.workspaceId, sessions, eventsBySessionId, outputs, catalogTagsBySessionId, 
+    // Resolve image references against the live catalog: available blobs
+    // export as references, missing ones as explicit unavailable (#3265).
+    (event) => repository.resolveEventImages(event));
     // aiwgFortemiIndexToKnowledgeShardWithReport targets the declared
     // full-v1/2.0.0 archive contract and validates losslessness -- unlike the
     // plain aiwgFortemiIndexToKnowledgeShard (core-v1), which silently embeds
@@ -1355,18 +1400,33 @@ async function importDiscovered(ctx, args) {
             ...(carryPath ? { carryForward: redactSourceLocator(carryPath) } : {}),
         });
     }
-    const lease = await acquireImportLease(databasePath(ctx, args), sha256(['discovered-import', manifest.manifestId, manifest.workspaceId].join('\0')), {
-        waitMs: boundedInteger(args.values.get('--lock-wait-ms'), 5_000, 0, 300_000, '--lock-wait-ms'),
-    });
+    const waitMs = boundedInteger(args.values.get('--lock-wait-ms'), 5_000, 0, 300_000, '--lock-wait-ms');
+    const lease = await acquireImportLease(databasePath(ctx, args), sha256(['discovered-import', manifest.manifestId, manifest.workspaceId].join('\0')), { waitMs });
+    let hostLease;
     try {
         const previous = carryPath ? new SessionRepository(carryPath, { readonly: true }) : undefined;
         let repository;
+        let hostRepository;
         try {
             repository = openRepository(ctx, args);
+            // Account-scoped providers (Grok Bot) import once into the host
+            // catalog; the workspace catalog records a reference (#3232). The
+            // host catalog is only opened when the manifest actually holds an
+            // account-scoped source.
+            const hostCatalogPath = defaultHostCatalogPath();
+            if (manifestNeedsHostCatalog(manifest.sources)) {
+                mkdirSync(dirname(hostCatalogPath), { recursive: true, mode: 0o700 });
+                // The workspace lease does not cover the shared host catalog; serialize
+                // host writers the same way the hourly refresh does.
+                hostLease = await acquireImportLease(hostCatalogPath, `host-import-${process.pid}`, { waitMs });
+                hostRepository = new SessionRepository(hostCatalogPath);
+            }
             const interruptedRuns = repository.interruptRunningBatchImports();
             const receipt = await importDiscoveryManifest({
                 manifest,
                 repository,
+                hostRepository,
+                hostCatalogPath,
                 carryForward: previous,
                 limits,
                 exclude,
@@ -1388,10 +1448,12 @@ async function importDiscovered(ctx, args) {
         }
         finally {
             repository?.close();
+            hostRepository?.close();
             previous?.close();
         }
     }
     finally {
+        await hostLease?.release();
         await lease.release();
     }
 }
@@ -1718,6 +1780,127 @@ function catalogScope(ctx, args, repository, workspaceId) {
             : null,
     };
 }
+/**
+ * Host-catalog read-through for account-scoped sessions (#3232). The
+ * workspace catalog holds references instead of copies; each reference
+ * records its host catalog path. Every referenced catalog opens read-only
+ * and closes before returning. Unreadable catalogs contribute nothing, so
+ * local rows still list when the host catalog is missing.
+ */
+function eachReferencedHostCatalog(repository, provider, read) {
+    const references = repository.listHostSessionReferences()
+        .filter((reference) => !provider || reference.provider === provider);
+    if (references.length === 0)
+        return [];
+    const byCatalog = new Map();
+    for (const reference of references) {
+        const group = byCatalog.get(reference.hostCatalog);
+        if (group)
+            group.push(reference);
+        else
+            byCatalog.set(reference.hostCatalog, [reference]);
+    }
+    const reads = [];
+    for (const [catalogPath, group] of byCatalog) {
+        let host;
+        try {
+            host = new SessionRepository(catalogPath, { readonly: true });
+        }
+        catch {
+            continue;
+        }
+        try {
+            reads.push({ references: group, value: read(host, group) });
+        }
+        finally {
+            host.close();
+        }
+    }
+    return reads;
+}
+function readHostReferencedSessions(repository, filters) {
+    const reads = eachReferencedHostCatalog(repository, filters.provider, (host, group) => {
+        const page = host.listSessions({
+            provider: filters.provider,
+            workspaceId: HOST_CATALOG_WORKSPACE_ID,
+            limit: group.length,
+        });
+        const sessions = resolveHostReferences(group, page.items)
+            .filter((session) => !filters.tag || host.listTags(session.sessionId).includes(filters.tag));
+        const resolvedSourceIds = new Set(sessions.map((session) => session.sourceId));
+        return {
+            sessions,
+            resolvedReferences: group.filter((reference) => resolvedSourceIds.has(reference.sourceId)),
+        };
+    });
+    return {
+        references: reads.flatMap((read) => read.references),
+        resolvedReferences: reads.flatMap((read) => read.value.resolvedReferences),
+        sessions: reads.flatMap((read) => read.value.sessions),
+    };
+}
+function searchHostReferencedSessions(repository, searchOptions, provider) {
+    const reads = eachReferencedHostCatalog(repository, provider, (host) => {
+        const result = host.search({
+            ...searchOptions,
+            workspaceId: HOST_CATALOG_WORKSPACE_ID,
+            cursor: undefined,
+        });
+        return {
+            hits: result.items,
+            hostIdentities: host.listSessionIdentities(HOST_CATALOG_WORKSPACE_ID),
+        };
+    });
+    return {
+        hits: reads.flatMap((read) => read.value.hits),
+        hostIdentities: reads.flatMap((read) => read.value.hostIdentities),
+    };
+}
+function readHostReferencedAnalyticsFacts(repository, query) {
+    // query.sessionId is a workspace-local internal id; host rows carry host
+    // stable ids, so resolve it to a provider + native session key first.
+    let sessionKey = null;
+    if (query.sessionId) {
+        const session = repository.getSession(query.sessionId, query.workspaceId);
+        if (!session)
+            return { facts: [], hostIdentities: [] };
+        sessionKey = `${session.provider} ${session.nativeSessionId}`;
+    }
+    const reads = eachReferencedHostCatalog(repository, query.provider, (host, group) => {
+        const wanted = new Set(group.map((reference) => `${reference.provider} ${reference.nativeSessionId}`));
+        const identities = host.listSessionIdentities(HOST_CATALOG_WORKSPACE_ID);
+        const hostSessionIds = new Set(identities
+            .filter((identity) => wanted.has(`${identity.provider} ${identity.nativeSessionId}`))
+            .map((identity) => identity.sessionId));
+        const { sessionId: _localSessionId, ...hostQuery } = query;
+        const facts = host.listAnalyticsFacts({ ...hostQuery, workspaceId: HOST_CATALOG_WORKSPACE_ID })
+            .filter((fact) => hostSessionIds.has(fact.sessionId)
+            && (!sessionKey || `${fact.provider} ${hostSessionKey(fact.sessionId, identities)}` === sessionKey));
+        return { facts, identities };
+    });
+    return {
+        facts: reads.flatMap((read) => read.value.facts),
+        hostIdentities: reads.flatMap((read) => read.value.identities),
+    };
+}
+function hostSessionKey(sessionId, identities) {
+    return identities.find((identity) => identity.sessionId === sessionId)?.nativeSessionId ?? null;
+}
+/**
+ * Workspace analytics facts with host references resolved. Returns null
+ * when the workspace holds no references so callers keep the exact
+ * single-catalog query path (SQL limit/filter semantics unchanged).
+ */
+function readWorkspaceAnalyticsFacts(repository, query) {
+    const references = repository.listHostSessionReferences()
+        .filter((reference) => !query.provider || reference.provider === query.provider);
+    if (references.length === 0)
+        return null;
+    const hostRead = readHostReferencedAnalyticsFacts(repository, query);
+    if (hostRead.facts.length === 0)
+        return null;
+    return mergeCrossCatalogRows(repository.listAnalyticsFacts(query), hostRead.facts, indexIdentitiesBySessionId(repository.listSessionIdentities(query.workspaceId)), indexIdentitiesBySessionId(hostRead.hostIdentities), (fact) => `${fact.provider} ${fact.factId}`);
+}
 async function configuredImportLimits(ctx, args, workspace) {
     const selectedWorkspace = workspace ?? (args.values.has('--workspace')
         ? resolve(ctx.cwd, args.values.get('--workspace')) : ctx.cwd);

package/dist/src/cli/handlers/use.js

@@ -29,7 +29,7 @@ import { loadCliCommandsContribution, registerCliCommands, registerHooks, } from
 import { translateSkillsToCommands, providerNeedsCommands } from '../../plugin/skill-command-translator.js';
 import * as ui from '../ui.js';
 import { readAiwgConfig, writeAiwgConfig, updateInstalled, hashManifest, emptyConfig, getProjectDir, getConfigPath } from '../../config/aiwg-config.js';
-import { appendGitignore } from '../../config/gitignore.js';
+import { AIWG_RUNTIME_PATTERNS, appendGitignore } from '../../config/gitignore.js';
 import { getLogger } from '../log.js';
 import { installCockpit } from './cockpit.js';
 import { initHandler } from './init.js';
@@ -501,11 +501,19 @@ function getProviderKernelSkillsPath(provider) {
 const PROVIDER_GENERATED_GITIGNORE_PATTERNS = {
     codex: ['.codex/', '.agents/'],
 };
-async function ensureProviderGeneratedDirsIgnored(projectRoot, provider, opts) {
+/**
+ * Patterns `aiwg use` ensures in the project's .gitignore on every deploy:
+ * the AIWG runtime subdirs doctor expects, plus any provider-generated dirs.
+ * Append-only via appendGitignore — operator content is never rewritten (#3635).
+ */
+export function gitignorePatternsForDeploy(provider) {
+    return [...AIWG_RUNTIME_PATTERNS, ...(PROVIDER_GENERATED_GITIGNORE_PATTERNS[provider] ?? [])];
+}
+export async function ensureProviderGeneratedDirsIgnored(projectRoot, provider, opts) {
     if (opts.dryRun)
         return;
-    const patterns = PROVIDER_GENERATED_GITIGNORE_PATTERNS[provider];
-    if (!patterns || patterns.length === 0)
+    const patterns = gitignorePatternsForDeploy(provider);
+    if (patterns.length === 0)
         return;
     try {
         const result = await appendGitignore(projectRoot, patterns);