@aiwg/cli 2026.10.11 → 2026.10.12

package/dist/src/cli/handlers/steward-models.js

@@ -0,0 +1,167 @@
+import { access } from 'node:fs/promises';
+import { join } from 'node:path';
+import { AiwgError, EXIT_CODES } from '../errors.js';
+import { getProjectDir } from '../../config/aiwg-config.js';
+import { capabilityProviderId, normalizeProviderId, resolveActiveProvider } from '../provider-resolution.js';
+import { routeModelTier } from '../../models/router.js';
+import { buildWrapperRouteEnvelope } from '../../models/wrapper-route.js';
+import { loadProviderModelCatalog } from '../../models/provider-policy.js';
+import { CapabilityResolutionError, resolveRoutableCapability } from '../../artifacts/capability-resolver.js';
+function isModelPolicyProvider(provider) {
+    return Object.hasOwn(loadProviderModelCatalog().providers, provider);
+}
+export async function handleStewardModels(args, matrix, ctx) {
+    const flagValue = (name) => {
+        const index = args.indexOf(name);
+        if (index < 0)
+            return undefined;
+        const value = args[index + 1];
+        if (!value || value.startsWith('--'))
+            throw new AiwgError({
+                code: 'ERR_USAGE_MISSING_VALUE',
+                message: `${name} requires a value.`,
+                exitCode: EXIT_CODES.USAGE,
+            });
+        return value;
+    };
+    if (args.includes('--route')) {
+        const rawProvider = flagValue('--provider') ?? await resolveActiveProvider({
+            cwd: ctx ? getProjectDir(ctx, ctx.args) : process.cwd(),
+            detectProcess: true,
+        }).then(result => result.provider ?? undefined);
+        const provider = normalizeProviderId(rawProvider);
+        if (!provider || provider === 'generic')
+            throw new AiwgError({
+                code: 'ERR_USAGE_UNKNOWN_PROVIDER',
+                message: `Cannot compile a wrapper route for provider: ${rawProvider ?? '(undetected)'}`,
+                hint: 'Pass --provider with a supported provider id.',
+                exitCode: EXIT_CODES.USAGE,
+            });
+        if (!isModelPolicyProvider(provider))
+            throw new AiwgError({
+                code: 'ERR_USAGE_UNSUPPORTED_PROVIDER',
+                message: `Model wrapper routing is not implemented for provider: ${provider}`,
+                hint: 'Use `aiwg steward capabilities --provider pi` for current Pi capability routing; model routing is tracked separately.',
+                exitCode: EXIT_CODES.USAGE,
+            });
+        const capabilityType = flagValue('--capability-type');
+        const capability = flagValue('--capability');
+        const assignment = flagValue('--assignment');
+        if (!capabilityType || !['agent', 'skill', 'rule', 'workflow'].includes(capabilityType))
+            throw new AiwgError({
+                code: 'ERR_USAGE_MISSING_VALUE',
+                message: '--capability-type requires agent, skill, rule, or workflow.',
+                exitCode: EXIT_CODES.USAGE,
+            });
+        if (!capability || !assignment)
+            throw new AiwgError({
+                code: 'ERR_USAGE_MISSING_VALUE',
+                message: '--route requires both --capability <id> and --assignment <bounded text>.',
+                exitCode: EXIT_CODES.USAGE,
+            });
+        const capabilityProvider = capabilityProviderId(provider);
+        const providerCapabilities = capabilityProvider ? matrix.providers[capabilityProvider] : undefined;
+        const launchMechanism = providerCapabilities?.native_features.tasks
+            ? 'native-subagent'
+            : providerCapabilities?.emulation.tasks === 'aiwg-mc' ? 'aiwg-mc' : 'manual';
+        const premiumAuthorized = args.includes('--allow-premium');
+        const { collectProviderInventory } = await import('../../providers/provider-inventory.js');
+        const { resolveDynamicModelCatalog } = await import('../../models/model-discovery.js');
+        const projectDir = ctx ? getProjectDir(ctx, ctx.args) : process.cwd();
+        const requestedAiwgRoot = ctx?.frameworkRoot ?? process.cwd();
+        const aiwgRoot = await access(join(requestedAiwgRoot, 'agentic/code/providers/model-catalog.v1.json')).then(() => requestedAiwgRoot).catch(() => process.cwd());
+        const resolvedCapability = await resolveRoutableCapability(aiwgRoot, capabilityType, capability).catch(error => {
+            if (!(error instanceof CapabilityResolutionError))
+                throw error;
+            throw new AiwgError({
+                code: error.kind === 'ambiguous'
+                    ? 'ERR_USAGE_AMBIGUOUS_CAPABILITY'
+                    : 'ERR_USAGE_UNKNOWN_CAPABILITY',
+                message: error.message,
+                hint: 'Run aiwg discover "<capability>" --json and pass an exact name or stable id.',
+                exitCode: EXIT_CODES.USAGE,
+            });
+        });
+        const catalog = await resolveDynamicModelCatalog({
+            aiwgRoot,
+            inventory: await collectProviderInventory(projectDir),
+            allowNetwork: false,
+        });
+        const baselineCatalog = loadProviderModelCatalog();
+        const effectiveCatalog = {
+            ...baselineCatalog,
+            ...catalog,
+            refreshedAt: catalog.refreshedAt ?? baselineCatalog.refreshedAt,
+            staleAfterDays: baselineCatalog.staleAfterDays,
+            providers: { ...baselineCatalog.providers, ...catalog.providers },
+        };
+        const envelope = buildWrapperRouteEnvelope({
+            provider,
+            capability: resolvedCapability,
+            assignment,
+            launchMechanism,
+            deterministic: args.includes('--deterministic'),
+            routine: args.includes('--routine'),
+            complex: args.includes('--complex'),
+            highImpact: args.includes('--high-impact'),
+            requestedPremium: args.includes('--premium'),
+            unattended: args.includes('--unattended'),
+            premiumAuthorized,
+            maxAutoTier: premiumAuthorized ? 3 : undefined,
+            catalog: effectiveCatalog,
+        });
+        if (args.includes('--json'))
+            console.log(JSON.stringify(envelope, null, 2));
+        else {
+            console.log('\n  Model wrapper route');
+            console.log(`  Provider:   ${envelope.provider}`);
+            console.log(`  Capability: ${envelope.capability.type} ${envelope.capability.name} (${envelope.capability.id})`);
+            console.log(`  Tier/role:  ${envelope.tier ?? 'deterministic'}/${envelope.role ?? 'none'}`);
+            console.log(`  Wrapper:    ${envelope.wrapper ?? 'none'}`);
+            console.log(`  Model:      ${envelope.model?.effectiveModel ?? 'inherited or no model call'} (${envelope.model?.outcome ?? 'deterministic'})`);
+            console.log(`  Launch:     ${envelope.launch.mechanism}`);
+            console.log(`  Confirmation: ${envelope.decision.requiresConfirmation ? 'required' : 'not required'}`);
+            console.log('\n  Wrapper prompt:\n');
+            console.log(envelope.launch.prompt);
+        }
+        return;
+    }
+    const tiers = Object.fromEntries(Object.entries(loadProviderModelCatalog().providers)
+        .filter(([, entry]) => entry.tiers)
+        .map(([provider, entry]) => [provider, Object.fromEntries(Object.entries(entry.tiers)
+            .map(([tier, model]) => [tier, { ...model, label: model.selection === 'user-elected' ? 'user-elected only' : tier }]))]));
+    const decision = routeModelTier({
+        deterministic: args.includes('--deterministic'),
+        routine: args.includes('--routine'),
+        complex: args.includes('--complex'),
+        highImpact: args.includes('--high-impact'),
+        requestedPremium: args.includes('--premium'),
+        unattended: args.includes('--unattended'),
+        premiumAuthorized: args.includes('--allow-premium'),
+        maxAutoTier: args.includes('--allow-premium') ? 3 : undefined,
+    });
+    if (args.includes('--json')) {
+        console.log(JSON.stringify({ decision, tiers }, null, 2));
+        return;
+    }
+    for (const [provider, ladder] of Object.entries(tiers)) {
+        for (const [tier, entry] of Object.entries(ladder))
+            console.log(`  ${provider} ${tier}: ${entry.id} (${entry.label})`);
+    }
+    console.log('\n  Model policy routing');
+    console.log(`  Default stance: cheap-first role/tier intent, compiled per provider from the effective catalog.`);
+    console.log(`  Suggested tier: ${decision.tier}${decision.modelTier ? ` (${decision.modelTier})` : ' (no model call)'}`);
+    console.log(`  Confirmation: ${decision.requiresConfirmation ? 'required' : 'not required'}`);
+    console.log(`  Summary before escalation: ${decision.summaryRequired ? 'required' : 'not required'}`);
+    console.log(`  Rationale: ${decision.rationale.join('; ')}`);
+    console.log('\n  Commands:');
+    console.log('    aiwg models sources --json        # inspect effective cache/static/remote catalog provenance');
+    console.log('    aiwg models refresh --json        # refresh dynamic provider catalog where supported');
+    console.log('    aiwg models audit --provider P    # compile artifact policy and diagnostics');
+    console.log('    aiwg models resolve --provider P  # show selected provider model for matching artifacts');
+    console.log('\n  Authoring:');
+    console.log('    Agents: use model-role/model-tier; avoid exact provider IDs in source scaffolds.');
+    console.log('    Skills/commands: use commandHint.modelRole and commandHint.modelTier.');
+    return;
+}
+//# sourceMappingURL=steward-models.js.map

package/dist/src/cli/handlers/steward.js

@@ -16,22 +16,15 @@
  * @source @src/cli/router.ts
  * @issue #599 #1261 #1262
  */
-import { access } from 'node:fs/promises';
-import { join } from 'node:path';
 import { AiwgError, EXIT_CODES, handlerResultFromError } from '../errors.js';
 import { loadCapabilityMatrix, isExternalStrategy, } from '../../providers/capability-matrix.js';
 import { getProjectDir, readAiwgConfig, writeAiwgConfig } from '../../config/aiwg-config.js';
 import { auditLegacyPermissions, archiveLegacyPermissionManifests, backupConfig, normalizeProjectPermissions, } from '../../policy/authorization.js';
 import { capabilityProviderId, normalizeProviderId, resolveActiveProvider } from '../provider-resolution.js';
 import { discoverProjectLocalBundles, } from '../../extensions/project-local-discovery.js';
-import { routeModelTier } from '../../models/router.js';
-import { buildWrapperRouteEnvelope } from '../../models/wrapper-route.js';
-import { loadProviderModelCatalog, } from '../../models/provider-policy.js';
-import { CapabilityResolutionError, resolveRoutableCapability, } from '../../artifacts/capability-resolver.js';
+import { printFullMatrix, permissionsUsage, formatProvider, emulationLabel } from './steward-format.js';
+import { handleStewardModels } from './steward-models.js';
 const BASELINE_PROVIDER = 'claude-code';
-function isModelPolicyProvider(provider) {
-    return Object.hasOwn(loadProviderModelCatalog().providers, provider);
-}
 // ── Feature name normalization ────────────────────────────────────────────────
 /**
  * Accept both hyphenated (agent-teams) and underscored (agent_teams) feature
@@ -49,62 +42,6 @@ async function detectProvider(ctx) {
     return capabilityProviderId(resolution.provider);
 }
 // ── Formatters ────────────────────────────────────────────────────────────────
-const NATIVE_MARK = '✓ native';
-const EMULATED_MARK = '~ emulated';
-const EXTERNAL_MARK = '↗ external';
-const UNSUPPORTED_MARK = '- not supported';
-function emulationLabel(strategy) {
-    if (!strategy)
-        return 'none';
-    if (strategy === 'native')
-        return 'native (no fallback needed)';
-    return strategy;
-}
-function formatProvider(id, provider, matrix, meta) {
-    const lines = [];
-    lines.push(`\n  Provider: ${provider.display_name} (${id})`);
-    if (meta) {
-        lines.push(`  Project-local: yes`);
-        lines.push(`  Base adapter:   ${meta.baseAdapter}`);
-    }
-    lines.push(`  Status:   ${provider.status}`);
-    lines.push(`  Daemon:   ${provider.daemon_tier}${provider.daemon_pty_adapter ? ' (+ pty-adapter)' : ''}`);
-    lines.push(`  ${'─'.repeat(60)}`);
-    const featureKeys = Object.keys(matrix.features);
-    for (const featureId of featureKeys) {
-        const isNative = provider.native_features?.[featureId] === true;
-        const emulation = provider.emulation?.[featureId] ?? null;
-        const status = isNative
-            ? NATIVE_MARK
-            : isExternalStrategy(emulation) ? EXTERNAL_MARK : (emulation ? EMULATED_MARK : UNSUPPORTED_MARK);
-        const feat = matrix.features[featureId];
-        lines.push(`\n  ${featureId} — ${status}`);
-        if (feat?.description)
-            lines.push(`    ${feat.description}`);
-        if (isNative) {
-            if (id === 'omp' && featureId === 'mcp') {
-                lines.push('    OMP supplies the native client. AIWG persistent injection/removal is available for project and profile scope; ephemeral injection is unsupported.');
-                lines.push('    example: aiwg mcp inject --provider omp --servers local-tools');
-            }
-            else if (id === 'omp' && featureId === 'behaviors') {
-                lines.push('    AIWG bridges selected handlers through an OMP extension; no default policy is installed. Permission-request and pre-compaction enforcement are unsupported.');
-            }
-            else if (id === 'omp' && (featureId === 'tasks' || featureId === 'agent_teams')) {
-                lines.push('    OMP native leaf tasks use AIWG workspace admission limits and verified child results; nested requests share the same scheduler.');
-                lines.push('    example: aiwg team run --provider omp --body-file tasks.json');
-            }
-            else if (feat?.native_example)
-                lines.push(`    example: ${feat.native_example}`);
-        }
-        else if (isExternalStrategy(emulation)) {
-            lines.push(`    trigger: system cron, systemd timer, or CI; AIWG does not own the clock`);
-        }
-        else if (emulation) {
-            lines.push(`    fallback: ${emulationLabel(emulation)}`);
-        }
-    }
-    return lines.join('\n');
-}
 async function findProjectLocalProvider(projectDir, requestedProvider) {
     const discovery = await discoverProjectLocalBundles(projectDir);
     const requested = requestedProvider.trim().toLowerCase();
@@ -156,47 +93,6 @@ async function resolveStewardProvider(matrix, requestedProvider, ctx) {
         },
     };
 }
-function printFullMatrix(matrix) {
-    const { providers, features } = matrix;
-    const providerIds = Object.keys(providers);
-    const featureIds = Object.keys(features);
-    console.log(`\n  Provider Capability Matrix (v${matrix.version})`);
-    console.log(`  ✓ = native   ~ = AIWG emulation   - = not supported\n`);
-    const featureColW = 20;
-    const provColW = 14;
-    const header = '  ' + 'Feature'.padEnd(featureColW) + providerIds.map(p => p.padEnd(provColW)).join('');
-    console.log(header);
-    console.log('  ' + '─'.repeat(featureColW + providerIds.length * provColW));
-    for (const featureId of featureIds) {
-        const feat = features[featureId];
-        let row = '  ' + featureId.padEnd(featureColW);
-        for (const providerId of providerIds) {
-            const provider = providers[providerId];
-            const isNative = provider?.native_features?.[featureId] === true;
-            const emulation = provider?.emulation?.[featureId] ?? null;
-            const mark = isNative ? '✓' : (emulation ? '~' : '-');
-            row += mark.padEnd(provColW);
-        }
-        console.log(row);
-        if (feat?.description) {
-            console.log('  ' + ' '.repeat(featureColW) + feat.description);
-        }
-        console.log('');
-    }
-}
-// ── Main execution ─────────────────────────────────────────────────────────────
-function permissionsUsage() {
-    return `
-  aiwg steward permissions — authorization model audit and normalization
-
-  Usage:
-    aiwg steward permissions audit                 Find normalized-model errors and legacy grants
-    aiwg steward permissions migrate --dry-run     Preview legacy permission normalization
-    aiwg steward permissions migrate --apply       Back up and atomically normalize config
-
-  Reads .aiwg/aiwg.config authorization block. Migration backs up before writing.
-`;
-}
 async function handleSteward(args, ctx) {
     const subcommand = args[0];
     if (!subcommand || subcommand === '--help' || subcommand === 'help') {
@@ -214,6 +110,7 @@ async function handleSteward(args, ctx) {
     aiwg steward models --route --capability-type <agent|skill|rule|workflow>
       --capability <id> --assignment <text> [--provider <name>] [--json]
                                                   Emit a capability-bound wrapper launch envelope
+    aiwg steward authorization                    Bounded HITL policy: inspect/validate/preview/enable/revoke
     aiwg steward permissions audit                Find normalized-model errors and legacy grants
     aiwg steward permissions migrate --dry-run    Preview legacy permission normalization
     aiwg steward permissions migrate --apply      Back up and atomically normalize config
@@ -242,6 +139,11 @@ async function handleSteward(args, ctx) {
         console.log(JSON.stringify(args.includes('--json') ? { decisionOffload } : decisionOffload, null, 2));
         return;
     }
+    if (subcommand === 'authorization') {
+        const { authorizationCli } = await import('../../config/authorization-cli.js');
+        await authorizationCli(args.slice(1), ctx?.cwd);
+        return;
+    }
     if (subcommand === 'permissions') {
         const operation = args[1];
         // `<namespace> --help` must reach the same usage block bare invocation prints (#2533).
@@ -478,148 +380,8 @@ async function handleSteward(args, ctx) {
         }
         return;
     }
-    if (subcommand === 'models' || subcommand === 'model-routing') {
-        const flagValue = (name) => {
-            const index = args.indexOf(name);
-            if (index < 0)
-                return undefined;
-            const value = args[index + 1];
-            if (!value || value.startsWith('--'))
-                throw new AiwgError({
-                    code: 'ERR_USAGE_MISSING_VALUE',
-                    message: `${name} requires a value.`,
-                    exitCode: EXIT_CODES.USAGE,
-                });
-            return value;
-        };
-        if (args.includes('--route')) {
-            const rawProvider = flagValue('--provider') ?? await resolveActiveProvider({
-                cwd: ctx ? getProjectDir(ctx, ctx.args) : process.cwd(),
-                detectProcess: true,
-            }).then(result => result.provider ?? undefined);
-            const provider = normalizeProviderId(rawProvider);
-            if (!provider || provider === 'generic')
-                throw new AiwgError({
-                    code: 'ERR_USAGE_UNKNOWN_PROVIDER',
-                    message: `Cannot compile a wrapper route for provider: ${rawProvider ?? '(undetected)'}`,
-                    hint: 'Pass --provider with a supported provider id.',
-                    exitCode: EXIT_CODES.USAGE,
-                });
-            if (!isModelPolicyProvider(provider))
-                throw new AiwgError({
-                    code: 'ERR_USAGE_UNSUPPORTED_PROVIDER',
-                    message: `Model wrapper routing is not implemented for provider: ${provider}`,
-                    hint: 'Use `aiwg steward capabilities --provider pi` for current Pi capability routing; model routing is tracked separately.',
-                    exitCode: EXIT_CODES.USAGE,
-                });
-            const capabilityType = flagValue('--capability-type');
-            const capability = flagValue('--capability');
-            const assignment = flagValue('--assignment');
-            if (!capabilityType || !['agent', 'skill', 'rule', 'workflow'].includes(capabilityType))
-                throw new AiwgError({
-                    code: 'ERR_USAGE_MISSING_VALUE',
-                    message: '--capability-type requires agent, skill, rule, or workflow.',
-                    exitCode: EXIT_CODES.USAGE,
-                });
-            if (!capability || !assignment)
-                throw new AiwgError({
-                    code: 'ERR_USAGE_MISSING_VALUE',
-                    message: '--route requires both --capability <id> and --assignment <bounded text>.',
-                    exitCode: EXIT_CODES.USAGE,
-                });
-            const capabilityProvider = capabilityProviderId(provider);
-            const providerCapabilities = capabilityProvider ? matrix.providers[capabilityProvider] : undefined;
-            const launchMechanism = providerCapabilities?.native_features.tasks
-                ? 'native-subagent'
-                : providerCapabilities?.emulation.tasks === 'aiwg-mc' ? 'aiwg-mc' : 'manual';
-            const premiumAuthorized = args.includes('--allow-premium');
-            const { collectProviderInventory } = await import('../../providers/provider-inventory.js');
-            const { resolveDynamicModelCatalog } = await import('../../models/model-discovery.js');
-            const projectDir = ctx ? getProjectDir(ctx, ctx.args) : process.cwd();
-            const requestedAiwgRoot = ctx?.frameworkRoot ?? process.cwd();
-            const aiwgRoot = await access(join(requestedAiwgRoot, 'agentic/code/providers/model-catalog.v1.json')).then(() => requestedAiwgRoot).catch(() => process.cwd());
-            const resolvedCapability = await resolveRoutableCapability(aiwgRoot, capabilityType, capability).catch(error => {
-                if (!(error instanceof CapabilityResolutionError))
-                    throw error;
-                throw new AiwgError({
-                    code: error.kind === 'ambiguous'
-                        ? 'ERR_USAGE_AMBIGUOUS_CAPABILITY'
-                        : 'ERR_USAGE_UNKNOWN_CAPABILITY',
-                    message: error.message,
-                    hint: 'Run aiwg discover "<capability>" --json and pass an exact name or stable id.',
-                    exitCode: EXIT_CODES.USAGE,
-                });
-            });
-            const catalog = await resolveDynamicModelCatalog({
-                aiwgRoot,
-                inventory: await collectProviderInventory(projectDir),
-                allowNetwork: false,
-            });
-            const baselineCatalog = loadProviderModelCatalog();
-            const effectiveCatalog = {
-                ...baselineCatalog,
-                ...catalog,
-                refreshedAt: catalog.refreshedAt ?? baselineCatalog.refreshedAt,
-                staleAfterDays: baselineCatalog.staleAfterDays,
-                providers: { ...baselineCatalog.providers, ...catalog.providers },
-            };
-            const envelope = buildWrapperRouteEnvelope({
-                provider,
-                capability: resolvedCapability,
-                assignment,
-                launchMechanism,
-                deterministic: args.includes('--deterministic'),
-                routine: args.includes('--routine'),
-                complex: args.includes('--complex'),
-                highImpact: args.includes('--high-impact'),
-                requestedPremium: args.includes('--premium'),
-                unattended: args.includes('--unattended'),
-                premiumAuthorized,
-                maxAutoTier: premiumAuthorized ? 3 : undefined,
-                catalog: effectiveCatalog,
-            });
-            if (args.includes('--json'))
-                console.log(JSON.stringify(envelope, null, 2));
-            else {
-                console.log('\n  Model wrapper route');
-                console.log(`  Provider:   ${envelope.provider}`);
-                console.log(`  Capability: ${envelope.capability.type} ${envelope.capability.name} (${envelope.capability.id})`);
-                console.log(`  Tier/role:  ${envelope.tier ?? 'deterministic'}/${envelope.role ?? 'none'}`);
-                console.log(`  Wrapper:    ${envelope.wrapper ?? 'none'}`);
-                console.log(`  Model:      ${envelope.model?.effectiveModel ?? 'inherited or no model call'} (${envelope.model?.outcome ?? 'deterministic'})`);
-                console.log(`  Launch:     ${envelope.launch.mechanism}`);
-                console.log(`  Confirmation: ${envelope.decision.requiresConfirmation ? 'required' : 'not required'}`);
-                console.log('\n  Wrapper prompt:\n');
-                console.log(envelope.launch.prompt);
-            }
-            return;
-        }
-        const decision = routeModelTier({
-            deterministic: args.includes('--deterministic'),
-            routine: args.includes('--routine'),
-            complex: args.includes('--complex'),
-            highImpact: args.includes('--high-impact'),
-            requestedPremium: args.includes('--premium'),
-            unattended: args.includes('--unattended'),
-            premiumAuthorized: args.includes('--allow-premium'),
-            maxAutoTier: args.includes('--allow-premium') ? 3 : undefined,
-        });
-        console.log('\n  Model policy routing');
-        console.log(`  Default stance: cheap-first role/tier intent, compiled per provider from the effective catalog.`);
-        console.log(`  Suggested tier: ${decision.tier}${decision.modelTier ? ` (${decision.modelTier})` : ' (no model call)'}`);
-        console.log(`  Confirmation: ${decision.requiresConfirmation ? 'required' : 'not required'}`);
-        console.log(`  Summary before escalation: ${decision.summaryRequired ? 'required' : 'not required'}`);
-        console.log(`  Rationale: ${decision.rationale.join('; ')}`);
-        console.log('\n  Commands:');
-        console.log('    aiwg models sources --json        # inspect effective cache/static/remote catalog provenance');
-        console.log('    aiwg models refresh --json        # refresh dynamic provider catalog where supported');
-        console.log('    aiwg models audit --provider P    # compile artifact policy and diagnostics');
-        console.log('    aiwg models resolve --provider P  # show selected provider model for matching artifacts');
-        console.log('\n  Authoring:');
-        console.log('    Agents: use model-role/model-tier; avoid exact provider IDs in source scaffolds.');
-        console.log('    Skills/commands: use commandHint.modelRole and commandHint.modelTier.');
-        return;
-    }
+    if (subcommand === 'models' || subcommand === 'model-routing')
+        return handleStewardModels(args, matrix, ctx);
     throw new AiwgError({
         code: 'ERR_USAGE_UNKNOWN_SUBCOMMAND',
         message: `Unknown steward subcommand: ${subcommand}`,
@@ -640,6 +402,10 @@ export const stewardHandler = {
     // sub-namespace help reachable, without executing anything (#2533).
     async help(ctx) {
         const positional = ctx.args.filter((arg) => !arg.startsWith('-'));
+        if (positional[0] === 'authorization') {
+            const { authorizationUsage } = await import('../../config/authorization-cli.js');
+            return { exitCode: 0, message: authorizationUsage, rawOutput: true };
+        }
         if (positional[0] === 'permissions') {
             return { exitCode: 0, message: permissionsUsage(), rawOutput: true };
         }

package/dist/src/cli/handlers/use-bundle-counts.js

@@ -0,0 +1,61 @@
+// Count bundle artifacts from native files and activation-selected rule receipts.
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+export async function countDeployedBundleRules(bundlePath, target, deployPath) {
+    if (!deployPath)
+        return 0;
+    const destination = path.resolve(target, deployPath);
+    let selected = [];
+    try {
+        const receipt = JSON.parse(await fs.readFile(path.join(destination, '.aiwg-manifest.json'), 'utf8'));
+        selected = Array.isArray(receipt.ruleSources) ? receipt.ruleSources : [];
+    }
+    catch { /* Legacy deployments have only native files. */ }
+    let sources;
+    try {
+        sources = (await fs.readdir(path.join(bundlePath, 'rules'))).filter(name => name.endsWith('.md'));
+    }
+    catch {
+        return 0;
+    }
+    let count = 0;
+    for (const name of sources) {
+        if (selected.includes(path.resolve(bundlePath, 'rules', name))) {
+            count++;
+            continue;
+        }
+        for (const extension of ['.md', '.mdc']) {
+            try {
+                await fs.access(path.join(destination, path.basename(name, '.md') + extension));
+                count++;
+                break;
+            }
+            catch { /* A catalog-only, unselected rule is not deployed. */ }
+        }
+    }
+    return count;
+}
+export async function countDeployedBundleFiles(bundlePath, subdir, target, deployPath, extensions) {
+    if (!deployPath)
+        return 0;
+    let names;
+    try {
+        names = (await fs.readdir(path.join(bundlePath, subdir))).filter(name => name.endsWith('.md'));
+    }
+    catch {
+        return 0;
+    }
+    let count = 0;
+    for (const name of names) {
+        for (const extension of extensions) {
+            try {
+                await fs.access(path.join(path.resolve(target, deployPath), path.basename(name, '.md') + extension));
+                count++;
+                break;
+            }
+            catch { /* Only count artifacts actually written by this bundle. */ }
+        }
+    }
+    return count;
+}
+//# sourceMappingURL=use-bundle-counts.js.map

package/dist/src/cli/handlers/use.js

@@ -64,6 +64,7 @@ const PREPARABLE_BUILTIN_PROVIDERS = new Set(['claude', 'codex', 'cursor', 'herm
 // Distinct from agentsmith (which creates subagent personas).
 import { generate as generateContextFiles, discoverDeployedArtifacts, } from '../../smiths/context-pipeline/index.js';
 import { verifyModelWrapperDeployment } from '../../models/wrapper-deployment.js';
+import { countDeployedBundleFiles, countDeployedBundleRules } from './use-bundle-counts.js';
 import { aggregateUseDeploymentResult, buildDryRunUseResult, renderUseDeploymentResult, verifyProviderDeployment, } from '../services/deployment-verification.js';
 import { finalizeProviderTransformationReceipt, providerReceiptHasLocalSources, sourceVerificationsFromSignedWebRelease, } from '../../providers/transformation-receipt-integration.js';
 import { loadResourceTrustRootFile, resolveWebRelease, } from '../../resources/web-release.js';
@@ -1028,24 +1029,6 @@ async function listBundleMdStems(bundlePath, subdir) {
         return [];
     }
 }
-async function countDeployedBundleFiles(bundlePath, subdir, target, deployPath, extensions) {
-    if (!deployPath)
-        return 0;
-    const stems = await listBundleMdStems(bundlePath, subdir);
-    if (stems.length === 0)
-        return 0;
-    const destDir = resolveDeployPath(target, deployPath);
-    let count = 0;
-    for (const stem of stems) {
-        for (const ext of extensions) {
-            if (await fileExists(path.join(destDir, `${stem}${ext}`))) {
-                count++;
-                break;
-            }
-        }
-    }
-    return count;
-}
 async function listBundleSkillNameCandidates(bundlePath) {
     const skillsRoot = path.join(bundlePath, 'skills');
     try {
@@ -1107,7 +1090,7 @@ async function countBundleDeployedArtifacts(bundlePath, target, provider) {
         agents: await countDeployedBundleFiles(bundlePath, 'agents', target, paths.agents, ['.md', '.toml']),
         commands: await countDeployedBundleFiles(bundlePath, 'commands', target, paths.commands, ['.md']),
         skills: await countDeployedBundleSkills(bundlePath, target, provider),
-        rules: await countDeployedBundleFiles(bundlePath, 'rules', target, paths.rules, ['.md', '.mdc']),
+        rules: await countDeployedBundleRules(bundlePath, target, paths.rules),
     };
 }
 const SKILL_SUPPORT_REFERENCE = /(?:^|[\s`('"\[])((?:templates|references|scripts|assets)\/[A-Za-z0-9._@/+\-]+)(?=$|[\s`)'"\],:;])/gm;
@@ -3521,11 +3504,10 @@ export class UseHandler {
                     try {
                         const manifestPath = path.join(addonSource, 'manifest.json');
                         const manifest = JSON.parse(await fs.readFile(manifestPath, 'utf8'));
-                        // Provider rule aggregation may rename many source rules into one
-                        // managed index. Record this addon's contributed artifact counts,
-                        // matching framework registry semantics, rather than trying to
-                        // attribute shared aggregate filenames after deployment.
-                        const counts = await countBundleSourceArtifacts(addonSource);
+                        // Record only artifacts actually written for this provider. Bridge-only
+                        // providers (e.g. project-scope grokbot) write zero native files,
+                        // so source-manifest counts would leave phantom registry entries.
+                        const counts = await countBundleDeployedArtifacts(addonSource, target, provider);
                         const updated = updateInstalled(config, framework, provider, counts, {
                             version: manifest.version ?? (await getVersionInfo()).version,
                             source: 'bundled',

package/dist/src/cli/handlers/utilities.js

@@ -13,6 +13,7 @@ import fs from 'fs';
 import fsp from 'fs/promises';
 import path from 'path';
 import { createScriptRunner } from './script-runner.js';
+import { DOCTOR_HELP } from './doctor-help.js';
 import { getFrameworkRoot } from '../../channel/manager.mjs';
 import { updateInstallation } from '../../update/service.mjs';
 import { useHandler as useFrameworkHandler } from './use.js';
@@ -494,30 +495,6 @@ async function runUserScopeDoctor(verbose) {
         message: lines.join('\n') + '\n',
     };
 }
-const DOCTOR_HELP = `aiwg doctor — check AIWG installation health
-
-Usage:
-  aiwg doctor [options]
-  aiwg -doctor [options]
-  aiwg --doctor [options]
-
-Options:
-  --deployment          Verify configured provider deployments
-  --provider <name>     Limit deployment verification to one provider
-  --bundle <name>       Limit deployment verification to one bundle
-  --scope <scope>       Verification scope: project or user
-  --user                Alias for --scope user
-  --qualify             With --probe-workers, record installation and configured model/role approval
-  --yes                 Confirm worker qualification without a terminal
-  --dry-run             With --probe-workers, preview qualification without writes
-  --cli NAME            Limit worker probes/qualification to one configured CLI
-  --decision-offload    Show offline advisory decision readiness and adoption report
-  --probe-workers       Run bounded worker CLI version probes (default: config-only, no subprocess)
-  --project-local       Include project-local artifact diagnostics
-  --json                Emit machine-readable output (with --probe-workers: one worker-probe record per CLI; with --deployment: deployment verification; with --decision-offload: offline snapshot)
-  --verbose, -v         Include verbose diagnostics
-  --help, -h            Show this help
-`;
 /**
  * Handler for doctor command
  *