@aiwg/cli 2026.10.10 → 2026.10.11

package/dist/src/models/model-capabilities.v1.json

@@ -4,6 +4,9 @@
   "verifiedAt": "2026-07-20",
   "providers": {
     "antigravity": {
+      "sessionEnvAllowlist": [
+        "GEMINI_API_KEY"
+      ],
       "agent": "native",
       "skill": "native",
       "globalChild": "inherited",
@@ -19,7 +22,7 @@
       "invalidPinFallback": "Provider validation/error; never assume fallback",
       "configTarget": "agy launch arguments; custom-agent model tiers are not projected from generic AIWG model ids",
       "artifactFormat": "YAML frontmatter plus Markdown; runtime --model and --effort flags",
-      "verification": "Pinned offline contract (--help/--version only); authenticated model selection was not executed",
+      "verification": "Pinned offline contract (--help/--version only); authenticated model selection was not executed. Session credential evidence: $AIWG_ROOT/docs/cli/sensitive-values.md#provider-recipient-exceptions (#3624).",
       "sourceUrl": "https://antigravity.google/docs/cli/subagents/",
       "verifiedAt": "2026-09-04",
       "workerHealthAdapter": {
@@ -154,7 +157,7 @@
               "Native MCP/client, MSP/ACP, gateway and conversation capabilities do not establish worker authority.",
               "--dangerously-skip-permissions and --remote-control are never part of the direct profile; neither was ever shipped as a new argv-prompt path.",
               "A soft-denied tool permission request (exit 0, stderr notice naming the allow-rule needed) is NOT the same as success; its exact stderr wording is not evidenced from help or changelog, so this is an open, honestly-marked detection gap rather than an invented check (tools/ralph-external/lib/antigravity-adapter.mjs ANTIGRAVITY_SOFT_DENY_RISK_NOTE).",
-              "GEMINI_API_KEY in envAllowlist is a strings-sourced GUESS, not confirmed to authenticate this CLI. Live fix-round-1 probes (D/E, no login present) show a bare run stops at \"Error: authentication required. Run 'agy' to log in, then retry.\" — this is an interactive Google-account login, not a documented env-key or OpenRouter-style flag. The manual smoke run is BLOCKED until an operator completes an interactive `agy` login on the target host.",
+              "GEMINI_API_KEY is documented at https://antigravity.google/docs/install/ (reviewed 2026-10-26): settings.json must also set modelProvider to gemini; the key alone has no effect. Earlier 1.3.3 probes only exercised missing account login. This documentation confirms the credential name, not authenticated execution or qualification of this version-bound worker profile.",
               "The 1.3.3 --effort enum (low|medium|high|xhigh|max) supersedes the stale 1.1.26-pinned three-value set in tools/providers/antigravity-transport.mjs (a separate, unedited legacy transport used by the MCP/doctor bridge, not this direct-shell profile).",
               "Flag validation happens BEFORE auth: live probe F, `agy --print=x --input-format bogus --output-format stream-json`, returned \"Error: unknown --input-format \\\"bogus\\\" (want text or stream-json)\" without reaching the auth stop, confirming --input-format is validated against exactly {text, stream-json} independent of login state.",
               "The brief reaches agy through adapter-frame: the installed buildWorkerStdinFrame hook supplies exactly one NDJSON user message and EOF. The stdin control stays unqualified pending one authenticated smoke run."
@@ -865,6 +868,9 @@
       }
     },
     "cursor": {
+      "sessionEnvAllowlist": [
+        "CURSOR_API_KEY"
+      ],
       "agent": "native",
       "skill": "unsupported",
       "globalChild": "inherited",
@@ -873,7 +879,7 @@
       "invalidPinFallback": "Plan/admin fallback may apply; record observed result",
       "configTarget": ".cursor/agents/*.md",
       "artifactFormat": "YAML frontmatter plus Markdown",
-      "verification": "Schema fixture and entitled Cursor invocation",
+      "verification": "Schema fixture and entitled Cursor invocation. Session credential evidence: $AIWG_ROOT/docs/cli/sensitive-values.md#provider-recipient-exceptions (#3624).",
       "sourceUrl": "https://cursor.com/docs/subagents",
       "verifiedAt": "2026-07-20",
       "workerHealthAdapter": {
@@ -1465,6 +1471,9 @@
       }
     },
     "warp": {
+      "sessionEnvAllowlist": [
+        "WARP_API_KEY"
+      ],
       "agent": "global-only",
       "skill": "unsupported",
       "globalChild": "native",
@@ -1473,7 +1482,7 @@
       "invalidPinFallback": "Profile availability dependent",
       "configTarget": "Warp agent profile or run configuration",
       "artifactFormat": "Saved profile / run control plane",
-      "verification": "Inspect active profile and run metadata",
+      "verification": "Inspect active profile and run metadata. Session credential evidence: $AIWG_ROOT/docs/cli/sensitive-values.md#provider-recipient-exceptions (#3624).",
       "sourceUrl": "https://docs.warp.dev/agent-platform/capabilities/agent-profiles-permissions",
       "verifiedAt": "2026-07-20",
       "workerHealthAdapter": {
@@ -2284,6 +2293,7 @@
       }
     },
     "windsurf": {
+      "sessionEnvAllowlist": [],
       "agent": "unsupported",
       "skill": "unsupported",
       "globalChild": "inherited",
@@ -2292,7 +2302,7 @@
       "invalidPinFallback": "No portable custom-child selector",
       "configTarget": "No supported portable artifact field",
       "artifactFormat": "Informational policy only",
-      "verification": "Assert unsupported fields are omitted",
+      "verification": "Assert unsupported fields are omitted. Session environment is explicitly empty: desktop/cloud login owns authentication; no CLI credential variable is evidenced. Coverage-only: no worker execution or qualified worker adapter. See $AIWG_ROOT/docs/cli/sensitive-values.md#provider-recipient-exceptions (#3624).",
       "sourceUrl": "https://docs.devin.ai/desktop/cascade/skills",
       "verifiedAt": "2026-07-20",
       "workerHealthCoverage": {
@@ -2312,6 +2322,22 @@
       }
     },
     "openclaw": {
+      "sessionEnvAllowlist": [
+        "OPENAI_API_KEY",
+        "ANTHROPIC_API_KEY",
+        "ANTHROPIC_OAUTH_TOKEN",
+        "GEMINI_API_KEY",
+        "GOOGLE_API_KEY",
+        "OPENROUTER_API_KEY",
+        "MISTRAL_API_KEY",
+        "XAI_API_KEY",
+        "OPENCLAW_HOME",
+        "OPENCLAW_STATE_DIR",
+        "OPENCLAW_CONFIG_PATH",
+        "OPENCLAW_GATEWAY_URL",
+        "OPENCLAW_GATEWAY_TOKEN",
+        "OPENCLAW_GATEWAY_PASSWORD"
+      ],
       "agent": "native",
       "skill": "unsupported",
       "globalChild": "native",
@@ -2320,7 +2346,7 @@
       "invalidPinFallback": "Provider/account fallback must be observed",
       "configTarget": "OpenClaw subagent configuration",
       "artifactFormat": "JSON/JSONC runtime configuration",
-      "verification": "Inspect resolved subagent metadata",
+      "verification": "Inspect resolved subagent metadata. Session credential evidence: $AIWG_ROOT/docs/cli/sensitive-values.md#provider-recipient-exceptions (#3624).",
       "sourceUrl": "https://docs.openclaw.ai/tools/subagents",
       "verifiedAt": "2026-07-20",
       "workerHealthAdapter": {
@@ -2508,6 +2534,7 @@
       }
     },
     "grokbot": {
+      "sessionEnvAllowlist": [],
       "agent": "unsupported",
       "skill": "unsupported",
       "globalChild": "informational",
@@ -2516,7 +2543,7 @@
       "invalidPinFallback": "Report unsupported; do not fabricate xAI/Grok model pins as native",
       "configTarget": "Grok Bot has no verified AIWG-owned model config path",
       "artifactFormat": "Informational only",
-      "verification": "Confirm steward models --route --provider grokbot emits unsupported/informational",
+      "verification": "Confirm steward models --route --provider grokbot emits unsupported/informational. Session environment is explicitly empty: desktop/cloud login owns authentication; no CLI credential variable is evidenced. Coverage-only: no worker execution or qualified worker adapter. See $AIWG_ROOT/docs/cli/sensitive-values.md#provider-recipient-exceptions (#3624).",
       "sourceUrl": "https://github.com/jmagly/aiwg/blob/main/docs/architecture/adr-grokbot-provider-target.md",
       "verifiedAt": "2026-09-15",
       "workerHealthCoverage": {
@@ -2536,6 +2563,10 @@
       }
     },
     "grok-build": {
+      "sessionEnvAllowlist": [
+        "XAI_API_KEY",
+        "GROK_HOME"
+      ],
       "agent": "inherited",
       "skill": "inherited",
       "globalChild": "native",
@@ -2544,7 +2575,7 @@
       "invalidPinFallback": "Report the unavailable alias; use the sole discovered model only when exactly one is available",
       "configTarget": "$GROK_HOME/config.toml [models] and [model.<alias>] (read-only discovery)",
       "artifactFormat": "Grok Build model alias",
-      "verification": "grok inspect --json plus bounded parsing of model fields from reported config layers",
+      "verification": "grok inspect --json plus bounded parsing of model fields from reported config layers. Session credential evidence: $AIWG_ROOT/docs/cli/sensitive-values.md#provider-recipient-exceptions (#3624).",
       "sourceUrl": "https://docs.x.ai/build/settings",
       "verifiedAt": "2026-09-21",
       "workerHealthAdapter": {
@@ -2736,6 +2767,25 @@
       }
     },
     "hermes": {
+      "sessionEnvAllowlist": [
+        "OPENAI_API_KEY",
+        "ANTHROPIC_API_KEY",
+        "ANTHROPIC_TOKEN",
+        "CLAUDE_CODE_OAUTH_TOKEN",
+        "GEMINI_API_KEY",
+        "GOOGLE_API_KEY",
+        "OPENROUTER_API_KEY",
+        "GROQ_API_KEY",
+        "MISTRAL_API_KEY",
+        "XAI_API_KEY",
+        "DEEPSEEK_API_KEY",
+        "OPENAI_BASE_URL",
+        "ANTHROPIC_BASE_URL",
+        "OPENROUTER_BASE_URL",
+        "CUSTOM_BASE_URL",
+        "HERMES_HOME",
+        "HERMES_INFERENCE_PROVIDER"
+      ],
       "agent": "global-only",
       "skill": "unsupported",
       "globalChild": "native",
@@ -2744,7 +2794,7 @@
       "invalidPinFallback": "Provider resolution is global; report actual model",
       "configTarget": "Hermes delegation configuration",
       "artifactFormat": "Global CLI/config setting",
-      "verification": "Inspect Hermes delegation configuration",
+      "verification": "Inspect Hermes delegation configuration. Session credential evidence: $AIWG_ROOT/docs/cli/sensitive-values.md#provider-recipient-exceptions (#3624).",
       "sourceUrl": "https://hermes-agent.nousresearch.com/docs/user-guide/features/delegation",
       "verifiedAt": "2026-07-20",
       "workerHealthAdapter": {
@@ -2927,6 +2977,19 @@
       }
     },
     "openhuman": {
+      "sessionEnvAllowlist": [
+        "OPENHUMAN_CORE_TOKEN",
+        "OPENHUMAN_CORE_RPC_URL",
+        "OPENHUMAN_CORE_HOST",
+        "OPENHUMAN_CORE_PORT",
+        "OPENHUMAN_WORKSPACE",
+        "OPENHUMAN_DOTENV_PATH",
+        "OPENHUMAN_KEYRING_MASTER_KEY",
+        "OPENHUMAN_KEYRING_MASTER_KEY_FILE",
+        "OPENHUMAN_APP_ENV",
+        "BACKEND_URL",
+        "OPENHUMAN_MODEL"
+      ],
       "agent": "compiled",
       "skill": "unsupported",
       "globalChild": "inherited",
@@ -2935,7 +2998,7 @@
       "invalidPinFallback": "Exact pins validate; semantic hints route dynamically",
       "configTarget": "OpenHuman agent TOML",
       "artifactFormat": "Standalone TOML agent definition",
-      "verification": "Parse against OpenHuman definition schema",
+      "verification": "Parse against OpenHuman definition schema. Session credential evidence: $AIWG_ROOT/docs/cli/sensitive-values.md#provider-recipient-exceptions (#3624).",
       "sourceUrl": "https://github.com/tinyhumansai/openhuman/blob/main/src/openhuman/agent/harness/definition.rs",
       "verifiedAt": "2026-07-20",
       "workerHealthAdapter": {
@@ -3154,6 +3217,7 @@
             "${effort}",
             "--workspace",
             "${workspace}",
+            "--trust-workspace",
             "--approval-mode",
             "never",
             "--approval-judge",
@@ -3246,8 +3310,8 @@
               },
               "trust": {
                 "support": "unqualified",
-                "mapping": "[]",
-                "evidence": "Installed muse exec --help (Muse Code 1.4.12, 2026-10-23); bounded renderer checked on operator qualification; no backend attestation."
+                "mapping": "[\"--trust-workspace\"]",
+                "evidence": "Installed muse exec --help (Muse Code 1.4.12, 2026-10-23); bounded renderer checked on operator qualification; no backend attestation. Tier 0 workspaces are conductor-prepared worker trees the conductor owns, so the profile binds --trust-workspace by default (#3685: untrusted Muse loads project_sources=0 with user skills only and empty hook admission; trusted loads project_sources=1, project skills and hooks)."
               },
               "children": {
                 "support": "unqualified",
@@ -3268,13 +3332,13 @@
               "Live qualification is an open S1 blocker; installed help and synthetic/echo mechanics are not paid inference qualification.",
               "Configured-model events provide runtime-configured identity only, never backend attestation.",
               "Contributor data policy is explicit; shared policy denies contributor models and never silently selects the CLI default.",
-              "Workspace trust defaults off; only a host-qualified trust mapping may load rules/skills. Approval-mode never and approval-judge off retain the sandbox. Muse requires a qualified external boundary.",
+              "Workspace trust is bound on for conductor-prepared worker trees (the conductor owns the worktree), so project rules/skills/hooks load; only a host-qualified trust mapping may change it. Approval-mode never and approval-judge off retain the sandbox. Muse requires a qualified external boundary.",
               "Host qualification must bind an absolute output-schema mapping and include that schema in runtimeFiles.",
               "Muse JSONL strict normalization needs the shared strict-parser hook; the MCP bridge must consume the selected provider parser. MSP is not MCP.",
               "Semantic step/tool completion grammar and native session-log layout remain unavailable; unrelated logs, deltas and CPU cannot establish progress.",
               "Shared version gate: installation requires the raw trimmed banner Muse Code 1.4.4 (1.4.4-R5419.1), but semver selection requires 1.4.4-R5419.1. No normalization exists; keep unqualified until the shared owner binds raw and normalized versions.",
               "Operator qualification approves the installed direct renderer, not authenticated inference or backend model identity.",
-              "Workspace trust defaults off. Only never approval is supported. Explicit unsupported controls block dispatch.",
+              "Workspace trust is on for conductor-prepared worker trees. Only never approval is supported. Explicit unsupported controls block dispatch.",
               "Self-delegation must be explicitly allowed by policy; no native child-denial flag is assumed."
             ],
             "health": {

package/dist/src/models/provider-policy.js

@@ -424,6 +424,13 @@ export function assertOperatorWorkerNativeArgv(adapter, argv, selected, permissi
             throw new Error('Muse direct worker approval requires never');
         requirePair('--approval-mode', 'never');
         requirePair('--approval-judge', 'off');
+        // #3685: Tier 0 Muse workers run in conductor-prepared worker trees, so
+        // project context must load. An argv without exactly one
+        // --trust-workspace would run with project_sources=0 (no project
+        // rules/skills/hooks) and is refused rather than silently degraded.
+        if (args.filter(token => token === '--trust-workspace').length !== 1) {
+            throw new Error('Requested native worker control is absent or ambiguous: --trust-workspace');
+        }
         if (args.includes('--disable-sandbox') !== (sandbox === 'external')) {
             throw new Error('Requested native worker sandbox control does not match');
         }

package/dist/src/policy/authorization.js

@@ -170,13 +170,41 @@ const LEGACY_MANIFESTS = [
     '.aiwg/ops/security/repo-access.manifest.yaml',
     '.aiwg/security/repo-access.manifest.yaml',
 ];
+/**
+ * Factory delivery defaults written by `aiwg init`/`aiwg use`
+ * (emptyConfig in src/config/aiwg-config.ts). Kept as a literal here —
+ * rather than importing the config module — because aiwg-config already
+ * imports this module for authorization validation, so a value import
+ * would be a cycle. A unit test pins this literal against
+ * emptyConfig().delivery (#3635).
+ */
+const DEFAULT_DELIVERY_POLICY = {
+    mode: 'pr-required',
+    default_branch: 'main',
+    require_ci_green: true,
+    auto_close_issues: true,
+    issue_comment_on_cycle: true,
+    force_push_policy: 'never',
+};
+/** True when the delivery block is exactly what the tool writes for a fresh project. */
+export function isDefaultDeliveryPolicy(delivery) {
+    if (!delivery || typeof delivery !== 'object')
+        return false;
+    const actual = delivery;
+    const actualKeys = Object.keys(actual);
+    return actualKeys.length === Object.keys(DEFAULT_DELIVERY_POLICY).length
+        && actualKeys.every((key) => actual[key] === DEFAULT_DELIVERY_POLICY[key]);
+}
 export async function auditLegacyPermissions(projectDir, config) {
     const out = validateAuthorization(config?.authorization);
     if (!config?.authorization && config?.repos?.some(repo => repo.allowed?.length))
         out.push({ severity: 'warning', code: 'legacy-repos-allowed', source: '.aiwg/aiwg.config', message: 'repos[].allowed should be normalized into authorization roles and assignments.' });
     if (!config?.authorization && Object.keys(config?.repo_maintainer?.tiers ?? {}).length)
         out.push({ severity: 'warning', code: 'legacy-maintainer-tiers', source: '.aiwg/aiwg.config', message: 'repo_maintainer.tiers should be represented by normalized role assignments.' });
-    if (!config?.authorization && config?.delivery)
+    // Tool-written delivery defaults are not operator legacy input: a fresh
+    // `aiwg use` must not produce something that needs migration (#3635).
+    // Operator-edited delivery (any key added, removed, or changed) still flags.
+    if (!config?.authorization && config?.delivery && !isDefaultDeliveryPolicy(config.delivery))
         out.push({ severity: 'warning', code: 'legacy-delivery-policy', source: '.aiwg/aiwg.config', message: 'delivery and signing operations should be normalized into scoped role assignments.' });
     for (const path of LEGACY_MANIFESTS) {
         try {

package/dist/src/process/aiwg-probe-command.d.mts

@@ -0,0 +1,15 @@
+export interface AiwgProbeCommand {
+  file: string;
+  prefix: string[];
+  via: 'aiwg-bin' | 'entrypoint' | 'package' | 'path';
+}
+
+export function resolveAiwgProbeCommand(options?: {
+  env?: NodeJS.ProcessEnv;
+  argv1?: string | undefined;
+  execPath?: string;
+  cwd?: string;
+  packageRoot?: string | null;
+}): AiwgProbeCommand;
+
+export function probeNotOnPathDetail(): string;

package/dist/src/process/aiwg-probe-command.mjs

@@ -0,0 +1,37 @@
+// Resolves the aiwg invocation for doctor's discovery self-probes so they
+// run the current entrypoint instead of failing when aiwg is not on PATH.
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+
+export function resolveAiwgProbeCommand({
+  env = process.env,
+  argv1 = process.argv[1],
+  execPath = process.execPath,
+  cwd = process.cwd(),
+  packageRoot = null,
+} = {}) {
+  const override = env?.AIWG_BIN;
+  if (typeof override === 'string' && override.length > 0) {
+    return { file: override, prefix: [], via: 'aiwg-bin' };
+  }
+  const entry = typeof argv1 === 'string' && argv1.length > 0
+    ? (path.isAbsolute(argv1) ? argv1 : path.resolve(cwd, argv1))
+    : null;
+  // Only the aiwg launcher itself is a usable entrypoint; doctor also runs as
+  // `node tools/cli/doctor.mjs`, where argv[1] is doctor, not aiwg.
+  const isLauncher = entry && ['aiwg', 'aiwg.mjs'].includes(path.basename(entry));
+  if (entry && isLauncher && existsSync(entry)) {
+    return { file: execPath, prefix: [entry], via: 'entrypoint' };
+  }
+  if (typeof packageRoot === 'string' && packageRoot.length > 0) {
+    const bin = path.join(packageRoot, 'bin', 'aiwg.mjs');
+    if (existsSync(bin)) {
+      return { file: execPath, prefix: [bin], via: 'package' };
+    }
+  }
+  return { file: 'aiwg', prefix: [], via: 'path' };
+}
+
+export function probeNotOnPathDetail() {
+  return 'aiwg not on PATH (spawn ENOENT) — add the npm global bin to PATH or invoke doctor via the install entrypoint';
+}

package/dist/src/sessions/adapters/grokbot.js

@@ -152,6 +152,13 @@ export class GrokbotSessionAdapter {
      * rename-swap), not appended to. See the class-level doc comment.
      */
     sourceContinuity = 'snapshot';
+    /**
+     * Account scope (#3232): conversations carry no workspace identity, so
+     * every workspace authorizing the same `--grokbot-root` would otherwise
+     * import the same conversations. The importer routes account-scoped
+     * sources to the host catalog once; workspace catalogs keep a reference.
+     */
+    scopeClass = 'account';
     interchange;
     constructor(limits, maxFiles = 10_000) {
         this.limits = limits;

package/dist/src/sessions/batch-import.js

@@ -6,6 +6,7 @@ import { coveragePreflight, sessionRuntimeIdentity } from './coverage-preflight.
 import { SESSION_CONTRACT_VERSION, SessionContractError, schemaIssueDetail, SessionSourceSchema, sha256, stableSessionId, stableEventId, } from './contracts.js';
 import { BATCH_IMPORT_VERSION, coverageFromBatchRun, } from './batch-contracts.js';
 import { IncrementalSessionImporter, SessionImportFailure } from './importer.js';
+import { HOST_CATALOG_WORKSPACE_ID, isAccountScopedAdapter, publishHostRoutedBatch, } from './host-catalog.js';
 import { matchImportExclusion, resolveImportExclusions } from './import-exclusions.js';
 import { resolveImportLimits } from './import-limits.js';
 import { fingerprintSourceFile } from './readers.js';
@@ -45,6 +46,7 @@ export async function importDiscoveryManifest(options) {
     run.completedAt = null;
     options.repository.saveBatchImportRun(run);
     injectFault(options, run, 'run-saved');
+    const hostRoutedSourceIds = [];
     for (const manifestSource of options.manifest.sources) {
         const disposition = run.sources.find((candidate) => candidate.sourceId === manifestSource.sourceId);
         if (!disposition) {
@@ -76,23 +78,33 @@ export async function importDiscoveryManifest(options) {
         persistProgress(options.repository, run, now());
         try {
             await assertManifestSourceUnchanged(manifestSource);
+            const adapter = adapterFor(manifestSource.provider, limits);
+            // Account-scoped providers (Grok Bot) are imported once into the
+            // host catalog; the workspace catalog records a reference (#3232).
+            // Any adapter declaring account scope follows this route.
+            const hostRouted = options.hostRepository !== undefined
+                && options.hostCatalogPath !== undefined
+                && isAccountScopedAdapter(adapter);
+            const targetRepository = hostRouted ? options.hostRepository : options.repository;
+            const importWorkspaceId = hostRouted ? HOST_CATALOG_WORKSPACE_ID : options.manifest.workspaceId;
+            if (hostRouted)
+                hostRoutedSourceIds.push(manifestSource.sourceId);
             const selectedSource = {
                 provider: manifestSource.provider,
                 locator: manifestSource.locator,
                 locatorClass: manifestSource.locatorClass,
                 sourceId: manifestSource.sourceId,
                 authorizedScope: {
-                    workspaceId: options.manifest.workspaceId,
+                    workspaceId: importWorkspaceId,
                     allowedRoots: [manifestSource.authorizedRoot],
                 },
             };
-            const adapter = adapterFor(manifestSource.provider, limits);
             const source = await sessionSource(selectedSource, adapter);
-            const receipts = await new IncrementalSessionImporter(options.repository).import({
+            const receipts = await new IncrementalSessionImporter(targetRepository).import({
                 source,
                 selectedSource,
                 adapter,
-                workspaceId: options.manifest.workspaceId,
+                workspaceId: importWorkspaceId,
                 policyVersion: '1.0.0',
                 batchRunId: run.runId,
                 publish: false,
@@ -101,7 +113,7 @@ export async function importDiscoveryManifest(options) {
                 limits,
             });
             await assertManifestSourceUnchanged(manifestSource);
-            const totals = options.repository.sourceImportTotals(manifestSource.sourceId, run.runId);
+            const totals = targetRepository.sourceImportTotals(manifestSource.sourceId, run.runId);
             disposition.sessionsAccepted = totals.sessions;
             disposition.eventsAccepted = totals.events;
             disposition.status = receipts.length > 0
@@ -134,6 +146,18 @@ export async function importDiscoveryManifest(options) {
         .map((source) => source.sourceId);
     injectFault(options, run, 'before-publication');
     options.repository.commitStagedBatch(run.runId, publishable);
+    if (options.hostRepository && options.hostCatalogPath && hostRoutedSourceIds.length > 0) {
+        const acceptedHost = run.sources
+            .filter((source) => hostRoutedSourceIds.includes(source.sourceId) && isAccepted(source.status))
+            .map((source) => source.sourceId);
+        publishHostRoutedBatch({
+            hostRepository: options.hostRepository,
+            workspaceRepository: options.repository,
+            batchRunId: run.runId,
+            sourceIds: acceptedHost,
+            hostCatalogPath: options.hostCatalogPath,
+        });
+    }
     injectFault(options, run, 'after-publication');
     run.status = pending ? 'interrupted' : rejected || acquisitionIncomplete ? 'partial' : 'complete';
     run.updatedAt = now().toISOString();
@@ -360,8 +384,12 @@ async function rebuildFromCatalog(options) {
     let staged;
     try {
         staged = new SessionRepository(join(stagingDirectory, 'staging.sqlite'));
+        // The staged rebuild transfers normalized rows (not host references) into
+        // the destination, so account-scoped sources rebuild locally here as
+        // before; the destination's own host routing applies on its next import.
         const receipt = await importDiscoveryManifest({ ...options, manifest, repository: staged,
-            carryForward: undefined, fault: undefined });
+            carryForward: undefined, fault: undefined,
+            hostRepository: undefined, hostCatalogPath: undefined });
         const identities = new Set();
         const destinationCodex = new Map(catalogSessions(options.repository, workspaceId)
             .filter(session => session.provider === 'codex').map(session => [session.nativeSessionId, session.sourceId]));

package/dist/src/sessions/contracts.js

@@ -103,6 +103,19 @@ export const SessionSourceSchema = z.object({
     authorizedAt: dateTime({ offset: true }),
     extensions: NativeExtensionsSchema.prefault({}),
 });
+/**
+ * Content-addressed reference to a tool-output image whose bytes live in
+ * the catalog blob store instead of inline in the event (#3265). The
+ * persisted shape's schema is this zod contract (session events have no
+ * JSON-schema file; see `lint:schemas`).
+ */
+export const SessionImageRefSchema = z.object({
+    digest: DigestSchema,
+    mediaType: z.string().min(1),
+    byteLength: integer().nonnegative(),
+    locatorClass: z.string().min(1).optional(),
+    offset: integer().nonnegative().optional(),
+});
 export const SessionEventSchema = z.object({
     contractVersion: z.literal(SESSION_CONTRACT_VERSION),
     eventId: z.string().min(1),
@@ -130,6 +143,12 @@ export const SessionEventSchema = z.object({
     originRule: z.string().min(1).default('legacy:unknown'),
     originClassifierVersion: VersionSchema.default('1.0.0'),
     searchableText: z.string(),
+    /**
+     * Image references extracted from inline payloads at import. Optional so
+     * pre-#3265 catalog rows (inline bytes, field absent) still parse; readers
+     * must tolerate `undefined` as "no references".
+     */
+    imageRefs: z.array(SessionImageRefSchema).optional(),
     digest: DigestSchema,
     rawReference: z.object({
         locatorClass: z.string().min(1),

package/dist/src/sessions/coverage-preflight.js

@@ -139,7 +139,13 @@ export function reconcileCoveragePreflight(preflight, sources) {
             return entry;
         const selected = sources.filter((source) => source.provider === entry.provider);
         const imported = selected.length === entry.sourceCount && selected.length > 0
-            && selected.every((source) => source.status === 'excluded' || (accepted.has(source.status) && source.eventsAccepted > 0));
+            // duplicate/previously-committed sources were acquired by an earlier
+            // run, so zero new events still counts as imported. A host-routed
+            // second workspace import lands here: the host copy already exists
+            // and the workspace only records references (#3232). A freshly
+            // committed source with zero events stays incomplete.
+            && selected.every((source) => source.status === 'excluded' || (accepted.has(source.status)
+                && (source.eventsAccepted > 0 || source.status !== 'committed')));
         return {
             ...entry,
             disposition: !imported ? 'import-incomplete'

package/dist/src/sessions/fortemi-export-mapping.js

@@ -75,7 +75,16 @@ export function sessionToAiwgFortemiRecord(session, catalogTags = []) {
         updated_at: updatedAt,
     };
 }
-export function sessionEventToAiwgFortemiRecord(session, event) {
+/**
+ * Map one catalog event. `images` carries the event's image references
+ * resolved against the blob store when the caller can provide them
+ * (export build passes `repository.resolveEventImages`); omitted means
+ * "not resolved", never "no images" -- the placeholder text in `text` is
+ * always present regardless (#3265). Bytes are never embedded here, only
+ * the reference plus its availability, so a consumer knows whether the
+ * digest is fetchable from the catalog or gone.
+ */
+export function sessionEventToAiwgFortemiRecord(session, event, images = []) {
     const locator = sessionEventRecordLocator(session, event);
     const parentLocator = sessionRecordLocator(session);
     const updatedAt = event.occurredAt ?? new Date(0).toISOString();
@@ -110,6 +119,16 @@ export function sessionEventToAiwgFortemiRecord(session, event) {
                 nativeId: event.nativeId,
                 sequence: event.sequence,
                 toolCallId: event.toolCallId,
+                ...(images.length > 0
+                    ? {
+                        images: images.map((image) => ({
+                            digest: image.digest,
+                            mediaType: image.mediaType,
+                            byteLength: image.byteLength,
+                            status: image.status,
+                        })),
+                    }
+                    : {}),
             },
         }];
     const tags = [
@@ -117,6 +136,10 @@ export function sessionEventToAiwgFortemiRecord(session, event) {
         ...(event.role ? [tag('role', event.role)] : []),
         ...(event.toolName ? [tag('tool', event.toolName)] : []),
         ...(event.entities ?? []).map((entity) => tag('entity', entity)),
+        ...images.map((image) => tag('image', image.digest)),
+        ...images
+            .filter((image) => image.status === 'unavailable')
+            .map((image) => tag('image-unavailable', image.digest)),
     ];
     return {
         schema_version: SESSION_EXPORT_RECORD_SCHEMA_VERSION,
@@ -275,13 +298,20 @@ function exportManifestRecord(repoRef, generatedAt) {
  * session catalog's workspace id, not a git repo -- the field is repurposed
  * honestly rather than left to imply something untrue).
  */
-export function buildSessionAiwgFortemiIndexExport(repoRef, sessions, eventsBySessionId, outputs = [], catalogTagsBySessionId = new Map()) {
+export function buildSessionAiwgFortemiIndexExport(repoRef, sessions, eventsBySessionId, outputs = [], catalogTagsBySessionId = new Map(), 
+/**
+ * Resolve image references per event when the caller's catalog is at
+ * hand (`(event) => repository.resolveEventImages(event)`). Absent means
+ * references stay unresolved in the records, never that images are
+ * missing -- availability is only asserted when actually resolved (#3265).
+ */
+imageResolution) {
     const generatedAt = new Date().toISOString();
     const items = [exportManifestRecord(repoRef, generatedAt)];
     for (const session of sessions) {
         items.push(sessionToAiwgFortemiRecord(session, catalogTagsBySessionId.get(session.sessionId) ?? []));
         for (const event of eventsBySessionId.get(session.sessionId) ?? []) {
-            items.push(sessionEventToAiwgFortemiRecord(session, event));
+            items.push(sessionEventToAiwgFortemiRecord(session, event, imageResolution?.(event) ?? []));
         }
         for (const output of outputs.filter((entry) => entry.sessionId === session.sessionId)) {
             items.push(sessionOutputToAiwgFortemiRecord(session, output));