@aiwg/cli 2026.10.3 → 2026.10.4

package/dist/src/sessions/workspace-discovery.js

@@ -1,8 +1,6 @@
-import { createReadStream } from 'node:fs';
-import { access, mkdir, readFile, realpath, rename, stat, writeFile, } from 'node:fs/promises';
+import { access, mkdir, readFile, readdir, realpath, rename, stat, writeFile, } from 'node:fs/promises';
 import { homedir, userInfo } from 'node:os';
 import { basename, dirname, join, resolve } from 'node:path';
-import { createInterface } from 'node:readline';
 import { inspectMuseNativeWorkspace } from './adapters/muse.js';
 import { readOmpSessionHeader } from './adapters/omp.js';
 import { grokbotConversationIdFromLocator } from './adapters/grokbot-locator.js';
@@ -11,7 +9,9 @@ import { SESSION_PROVIDER_IDS, SessionCoveragePreflightSchema, SessionContractEr
 import { redactSourceLocator } from './discovery.js';
 import { createSessionAdapterRegistry } from './adapter-registry.js';
 import { coveragePreflight, expectedSessionProviders } from './coverage-preflight.js';
-import { fingerprintSourceFile } from './readers.js';
+import { fingerprintSourceFile, streamJsonLines } from './readers.js';
+import { matchSessionWorkspace } from './workspace-matching.js';
+import { matchImportExclusion, nativeSessionIdFromLocator, resolveImportExclusions } from './import-exclusions.js';
 export const DISCOVERY_MANIFEST_VERSION = '1.0.0';
 const MANUAL_EXPORT_PROVIDERS = new Set([
     'copilot', 'hermes', 'opencode', 'openclaw', 'openhuman', 'grok-build',
@@ -19,13 +19,19 @@ const MANUAL_EXPORT_PROVIDERS = new Set([
 ]);
 export async function discoverWorkspaceHistories(options) {
     const registry = options.registry ?? createSessionAdapterRegistry();
+    const exclusions = resolveImportExclusions(undefined, options.exclude);
     const expectedProviders = expectedSessionProviders(options.expectedProviders ?? SESSION_PROVIDER_IDS);
     const supportedProviders = new Set(registry.list().map((adapter) => adapter.provider));
     const workspacePath = await canonicalPath(options.workspace);
     const workspaceId = workspacePath;
+    const workspacePaths = [...new Set([workspacePath, resolve(options.workspace),
+            ...(options.workspaceAliases ?? []).map((alias) => resolve(alias))])];
+    for (const alias of workspacePaths) {
+        if (await canonicalPath(alias) !== workspacePath) {
+            throw new SessionContractError('INVALID_ARGUMENT', 'workspace alias resolves to a different workspace');
+        }
+    }
     const providerHomes = providerHomeCandidates(options.providerHome, options.operatorHome);
-    const keyWithLeadingDash = workspaceKey(workspacePath, true);
-    const keyWithoutLeadingDash = workspaceKey(workspacePath, false);
     const discoverable = [
         { provider: 'deepseek-harness', roots: options.dshRoot
                 ? [resolve(options.dshRoot)] : options.providerHome
@@ -46,26 +52,23 @@ export async function discoverWorkspaceHistories(options) {
                 ? [resolve(options.grokbotRoot)] : [] },
         {
             provider: 'claude',
-            roots: providerHomes.map((providerHome) => join(providerHome, '.claude', 'projects', keyWithLeadingDash)),
+            roots: providerHomes.flatMap((providerHome) => workspacePaths.map((workspace) => join(providerHome, '.claude', 'projects', claudeProjectKey(workspace)))),
         },
         {
             provider: 'codex',
-            roots: options.codexRoot
-                ? [resolve(options.codexRoot)]
-                : options.providerHome
-                    ? [join(resolve(options.providerHome), '.codex', 'sessions')]
-                    : [],
+            roots: options.authorizedRoots || !expectedProviders.includes('codex')
+                ? [] : await codexDiscoveryRoots(options),
         },
         {
             provider: 'cursor',
-            roots: providerHomes.map((providerHome) => join(providerHome, '.cursor', 'projects', keyWithoutLeadingDash, 'agent-transcripts')),
+            roots: providerHomes.flatMap((providerHome) => workspacePaths.map((workspace) => join(providerHome, '.cursor', 'projects', workspaceKey(workspace, false), 'agent-transcripts'))),
         },
         {
             provider: 'factory',
-            roots: providerHomes.flatMap((providerHome) => [
-                join(providerHome, '.factory', 'projects', keyWithLeadingDash),
-                join(providerHome, '.factory', 'sessions', keyWithLeadingDash),
-            ]),
+            roots: providerHomes.flatMap((providerHome) => workspacePaths.flatMap((workspace) => [
+                join(providerHome, '.factory', 'projects', workspaceKey(workspace, true)),
+                join(providerHome, '.factory', 'sessions', workspaceKey(workspace, true)),
+            ])),
         },
         {
             // Pi stores every working directory's sessions in its own
@@ -79,9 +82,10 @@ export async function discoverWorkspaceHistories(options) {
             provider: 'pi',
             roots: (process.env.PI_CODING_AGENT_SESSION_DIR
                 ? [resolve(process.env.PI_CODING_AGENT_SESSION_DIR)]
-                : providerHomes.map((providerHome) => join(providerHome, '.pi', 'agent', 'sessions'))).map((sessionsRoot) => join(sessionsRoot, `--${keyWithoutLeadingDash}--`)),
+                : providerHomes.map((providerHome) => join(providerHome, '.pi', 'agent', 'sessions'))).flatMap((sessionsRoot) => workspacePaths.map((workspace) => join(sessionsRoot, `--${workspaceKey(workspace, false)}--`))),
         },
     ];
+    const authorizedRoots = { ...options.authorizedRoots };
     const reports = new Map();
     const candidates = [];
     const seen = new Set();
@@ -92,9 +96,27 @@ export async function discoverWorkspaceHistories(options) {
         if (adapter.disposition === 'unsupported' || !adapter.supportedOperations.includes('discover'))
             continue;
         const availableRoots = [];
-        for (const root of entry.roots) {
-            if (await pathExists(root))
-                availableRoots.push(await canonicalPath(root));
+        const rootCounts = new Map();
+        for (const root of options.authorizedRoots ? options.authorizedRoots[entry.provider] ?? [] : entry.roots) {
+            if (await pathExists(root)) {
+                const canonical = await canonicalPath(root);
+                if (options.authorizedRoots && canonical !== root) {
+                    throw new SessionContractError('INVALID_ARGUMENT', 'previously authorized provider root changed; rediscover with explicit authorization');
+                }
+                if (!availableRoots.includes(canonical)) {
+                    availableRoots.push(canonical);
+                    rootCounts.set(canonical, {
+                        root: redactSourceLocator(canonical), rootId: sha256(canonical),
+                        status: 'checked', sourceCount: 0, duplicateCount: 0,
+                    });
+                }
+            }
+            else {
+                rootCounts.set(root, {
+                    root: redactSourceLocator(root), rootId: sha256(root),
+                    status: 'unavailable', sourceCount: 0, duplicateCount: 0,
+                });
+            }
         }
         if (availableRoots.length === 0) {
             const codexNeedsAuthorization = (entry.provider === 'codex' || entry.provider === 'omp'
@@ -106,15 +128,44 @@ export async function discoverWorkspaceHistories(options) {
                 : 'PROVIDER_ROOT_UNAVAILABLE', codexNeedsAuthorization
                 ? `Pass --${entry.provider === 'deepseek-harness' ? 'dsh' : entry.provider}-root with an explicitly authorized sessions root.`
                 : `No authorized ${entry.provider} workspace history root was found.`));
+            if (entry.provider === 'codex')
+                reports.get(entry.provider).rootCounts = [...rootCounts.values()];
             continue;
         }
+        authorizedRoots[entry.provider] = availableRoots;
         const scope = {
             workspaceId,
             allowedRoots: availableRoots,
         };
         const providerSources = [];
+        let matchedBySubfolder = 0;
+        let matchedByWorktree = 0;
         const museSourceInspections = [];
         for await (const descriptor of adapter.discover(scope)) {
+            const known = options.knownSources?.find(source => source.provider === descriptor.provider && source.locator === descriptor.locator);
+            const nativeSessionId = known?.nativeSessionId ?? descriptor.nativeSessionId ?? nativeSessionIdFromLocator(descriptor);
+            const exclusion = matchImportExclusion({ ...descriptor, nativeSessionId }, exclusions);
+            if (exclusion) {
+                const locator = resolve(descriptor.locator);
+                const authorizedRoot = scope.allowedRoots.find(root => locator === root || locator.startsWith(`${root}/`));
+                if (!authorizedRoot)
+                    continue;
+                const key = `excluded\0${entry.provider}\0${locator}`;
+                if (seen.has(key))
+                    continue;
+                seen.add(key);
+                const source = {
+                    sourceId: known?.sourceId ?? sha256(key), provider: entry.provider,
+                    locator, redactedLocator: redactSourceLocator(locator), locatorClass: descriptor.locatorClass,
+                    authorizedRoot, modifiedAt: '', sizeBytes: 0, digest: '', nativeSessionId,
+                    status: 'excluded', exclusion,
+                };
+                rootCounts.get(authorizedRoot).sourceCount += 1;
+                providerSources.push(source);
+                candidates.push(source);
+                continue;
+            }
+            let workspaceMatch = null;
             if (entry.provider === 'muse') {
                 const inspection = await inspectMuseNativeWorkspace({
                     ...descriptor,
@@ -124,31 +175,54 @@ export async function discoverWorkspaceHistories(options) {
                 museSourceInspections.push({
                     sourceKey: sha256(['muse-workspace-inspection-v1', descriptor.locator].join('\0')),
                     redactedLocator: redactSourceLocator(descriptor.locator),
+                    nativeSessionId: basename(dirname(descriptor.locator)),
                     ...inspection,
                 });
                 if (inspection.outcome !== 'matched')
                     continue;
+                workspaceMatch = inspection.matchKind ?? null;
             }
             const locator = await canonicalPath(descriptor.locator);
-            if (entry.provider === 'codex'
-                && !await codexSourceMatchesWorkspace(locator, workspacePath))
-                continue;
+            if (entry.provider === 'codex') {
+                workspaceMatch = await codexSourceWorkspaceMatch(locator, workspacePath);
+                if (!workspaceMatch)
+                    continue;
+            }
             const ompHeader = entry.provider === 'omp' ? await readOmpSessionHeader({ ...descriptor, sourceId: 'discovery', authorizedScope: scope }) : undefined;
-            if (ompHeader && resolve(ompHeader.cwd) !== workspacePath)
-                continue;
+            if (ompHeader) {
+                workspaceMatch = await matchSessionWorkspace(ompHeader.cwd, workspacePath);
+                if (!workspaceMatch)
+                    continue;
+            }
             const details = await stat(locator);
             const authorizedRoot = scope.allowedRoots.find((root) => locator === root || locator.startsWith(`${root}/`));
             if (!authorizedRoot)
                 continue;
+            if (entry.provider === 'claude'
+                && !await claudeSourceMatchesWorkspace(locator, workspacePath))
+                continue;
             const fingerprint = await fingerprintSourceFile({
                 selectedPath: locator,
                 allowedRoots: [authorizedRoot],
             });
-            const dedupeKey = `${entry.provider}\0${fingerprint.digest}\0${fingerprint.size}`;
-            if (seen.has(dedupeKey))
+            const rolloutId = entry.provider === 'codex' && descriptor.locatorClass === 'codex-rollout-jsonl'
+                ? await codexRolloutId(locator) : undefined;
+            const dedupeKey = rolloutId
+                ? `codex\0rollout\0${rolloutId}`
+                : `${entry.provider}\0${fingerprint.digest}\0${fingerprint.size}`;
+            const rootCount = rootCounts.get(authorizedRoot);
+            if (seen.has(dedupeKey)) {
+                rootCount.duplicateCount += 1;
                 continue;
+            }
             seen.add(dedupeKey);
+            if (workspaceMatch === 'subfolder')
+                matchedBySubfolder += 1;
+            if (workspaceMatch === 'worktree')
+                matchedByWorktree += 1;
+            rootCount.sourceCount += 1;
             const source = sourceFromDescriptor(descriptor, locator, authorizedRoot, details, fingerprint.digest);
+            source.nativeSessionId = rolloutId ?? ompHeader?.id ?? nativeSessionId;
             if (ompHeader)
                 source.sourceId = sha256(['omp-native-source-v1', workspaceId, ompHeader.id].join('\0'));
             if (entry.provider === 'grokbot') {
@@ -168,13 +242,17 @@ export async function discoverWorkspaceHistories(options) {
         const incompleteMuseInspection = museSourceInspections.some((inspection) => inspection.outcome === 'inconclusive');
         const report = providerReport(entry.provider, incompleteMuseInspection ? 'not-checked' : 'checked', 'discoverable', providerSources, incompleteMuseInspection ? 'MUSE_SOURCE_INSPECTION_INCOMPLETE'
             : providerSources.length === 0 ? 'NO_WORKSPACE_SOURCES' : null, incompleteMuseInspection
-            ? 'Review museSourceInspections; authorize a supported Muse export for unresolved sources before claiming workspace coverage.'
+            ? 'Review unattributed museSourceInspections and their limit name/value; authorize a supported Muse export for unresolved sources before claiming workspace coverage.'
             : providerSources.length === 0
                 ? `The ${entry.provider} root was checked, but no source matched the authorized workspace.`
                 : null);
         if (entry.provider === 'muse') {
             report.museSourceInspections = museSourceInspections.sort((a, b) => a.sourceKey.localeCompare(b.sourceKey));
         }
+        report.matchedBySubfolder = matchedBySubfolder;
+        report.matchedByWorktree = matchedByWorktree;
+        if (entry.provider === 'codex')
+            report.rootCounts = [...rootCounts.values()];
         reports.set(entry.provider, report);
     }
     for (const provider of expectedProviders) {
@@ -203,6 +281,7 @@ export async function discoverWorkspaceHistories(options) {
         schemaVersion: DISCOVERY_MANIFEST_VERSION,
         workspaceId,
         preflight,
+        authorizedRoots,
         sources: sources.map((source) => ({
             sourceId: source.sourceId,
             provider: source.provider,
@@ -211,11 +290,16 @@ export async function discoverWorkspaceHistories(options) {
             modifiedAt: source.modifiedAt,
             sizeBytes: source.sizeBytes,
             digest: source.digest,
+            ...(source.nativeSessionId ? { nativeSessionId: source.nativeSessionId } : {}),
+            ...(source.status ? { status: source.status, exclusion: source.exclusion } : {}),
         })),
         providers: providers.map((provider) => ({
             provider: provider.provider,
             status: provider.status,
             reasonCode: provider.reasonCode,
+            ...(provider.matchedBySubfolder !== undefined ? { matchedBySubfolder: provider.matchedBySubfolder } : {}),
+            ...(provider.matchedByWorktree !== undefined ? { matchedByWorktree: provider.matchedByWorktree } : {}),
+            ...(provider.rootCounts ? { rootCounts: provider.rootCounts } : {}),
             ...(provider.museSourceInspections ? { museSourceInspections: provider.museSourceInspections } : {}),
         })),
     };
@@ -226,6 +310,7 @@ export async function discoverWorkspaceHistories(options) {
         workspaceId,
         workspacePath,
         preflight,
+        authorizedRoots,
         providers,
         sources,
     };
@@ -272,6 +357,9 @@ export function publicDiscoveryManifest(manifest) {
         totals: {
             providers: manifest.providers.length,
             sources: manifest.sources.length,
+            excluded: manifest.sources.filter(source => source.status === 'excluded').length,
+            matchedBySubfolder: manifest.providers.reduce((sum, provider) => sum + (provider.matchedBySubfolder ?? 0), 0),
+            matchedByWorktree: manifest.providers.reduce((sum, provider) => sum + (provider.matchedByWorktree ?? 0), 0),
         },
     };
 }
@@ -291,12 +379,14 @@ function sourceFromDescriptor(descriptor, locator, authorizedRoot, details, dige
     };
 }
 function providerReport(provider, status, disposition, sources, reasonCode, remediation) {
-    const timestamps = sources.map((source) => source.modifiedAt).sort();
+    const timestamps = sources.map((source) => source.modifiedAt).filter(Boolean).sort();
     return {
         provider,
         status,
         disposition,
         sourceCount: sources.length,
+        matchedBySubfolder: 0,
+        matchedByWorktree: 0,
         dateRange: {
             earliest: timestamps.at(0) ?? null,
             latest: timestamps.at(-1) ?? null,
@@ -311,6 +401,7 @@ async function rediscoverManifestIdentity(manifest) {
         schemaVersion: manifest.schemaVersion,
         workspaceId: manifest.workspaceId,
         ...(manifest.preflight ? { preflight: manifest.preflight } : {}),
+        ...(manifest.authorizedRoots ? { authorizedRoots: manifest.authorizedRoots } : {}),
         sources: manifest.sources.map((source) => ({
             sourceId: source.sourceId,
             provider: source.provider,
@@ -319,47 +410,84 @@ async function rediscoverManifestIdentity(manifest) {
             modifiedAt: source.modifiedAt,
             sizeBytes: source.sizeBytes,
             digest: source.digest,
+            ...(source.nativeSessionId ? { nativeSessionId: source.nativeSessionId } : {}),
+            ...(source.status ? { status: source.status, exclusion: source.exclusion } : {}),
         })),
         providers: manifest.providers.map((provider) => ({
             provider: provider.provider,
             status: provider.status,
             reasonCode: provider.reasonCode,
+            ...(provider.matchedBySubfolder !== undefined ? { matchedBySubfolder: provider.matchedBySubfolder } : {}),
+            ...(provider.matchedByWorktree !== undefined ? { matchedByWorktree: provider.matchedByWorktree } : {}),
+            ...(provider.rootCounts ? { rootCounts: provider.rootCounts } : {}),
             ...(provider.museSourceInspections ? { museSourceInspections: provider.museSourceInspections } : {}),
         })),
     };
     return sha256(JSON.stringify(identity));
 }
-async function codexSourceMatchesWorkspace(locator, workspacePath) {
-    const input = createReadStream(locator, { encoding: 'utf8' });
-    const lines = createInterface({ input, crlfDelay: Infinity });
-    let count = 0;
+async function codexDiscoveryRoots(options) {
+    const explicit = [...(options.codexRoots ?? []), ...(options.codexRoot ? [options.codexRoot] : [])];
+    if (explicit.length > 0)
+        return [...new Set(explicit.map((root) => resolve(root)))];
+    // Shared stores require the same explicit provider-home authorization as the default root.
+    if (!options.providerHome)
+        return [];
+    const codexHome = join(resolve(options.providerHome), '.codex');
+    const roots = [join(codexHome, 'sessions')];
+    if (process.env.CODEX_HOME)
+        roots.push(resolve(process.env.CODEX_HOME, 'sessions'));
     try {
-        for await (const line of lines) {
-            if (++count > 50)
-                break;
-            let value;
-            try {
-                value = JSON.parse(line);
-            }
-            catch {
-                continue;
-            }
-            const cwd = codexWorkspaceField(value);
-            if (!cwd)
-                continue;
-            try {
-                return await canonicalPath(cwd) === workspacePath;
-            }
-            catch {
-                return resolve(cwd) === workspacePath;
+        const roles = await readdir(join(codexHome, 'roles-runtime'), { withFileTypes: true });
+        for (const role of roles.sort((a, b) => a.name.localeCompare(b.name))) {
+            if (role.isDirectory() || role.isSymbolicLink()) {
+                roots.push(join(codexHome, 'roles-runtime', role.name, '.codex', 'sessions'));
             }
         }
-        return false;
     }
-    finally {
-        lines.close();
-        input.destroy();
+    catch (error) {
+        if (!['ENOENT', 'ENOTDIR'].includes(error.code ?? ''))
+            throw error;
     }
+    return [...new Set(roots)];
+}
+async function codexRolloutId(locator) {
+    let count = 0;
+    for await (const { line } of streamJsonLines(locator)) {
+        if (++count > 50)
+            break;
+        let value;
+        try {
+            value = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        const record = asObject(value);
+        const id = asObject(record.payload).id;
+        if (record.type === 'session_meta' && typeof id === 'string' && id.length > 0)
+            return id;
+    }
+    return /([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\.jsonl$/i
+        .exec(basename(locator))?.[1];
+}
+async function codexSourceWorkspaceMatch(locator, workspacePath) {
+    let count = 0;
+    for await (const { line } of streamJsonLines(locator)) {
+        if (++count > 50)
+            break;
+        let value;
+        try {
+            value = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        const cwd = codexWorkspaceField(value);
+        if (!cwd)
+            continue;
+        return await matchSessionWorkspace(cwd, workspacePath);
+    }
+    return null;
 }
 function codexWorkspaceField(value) {
     const root = asObject(value);
@@ -384,6 +512,43 @@ function asObject(value) {
 async function canonicalPath(path) {
     return realpath(resolve(path));
 }
+async function claudeSourceMatchesWorkspace(locator, workspacePath) {
+    let count = 0;
+    for await (const { line } of streamJsonLines(locator, { end: 1024 * 1024 - 1 })) {
+        if (++count > 50)
+            break;
+        let value;
+        try {
+            value = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        const cwd = asObject(value).cwd;
+        if (typeof cwd !== 'string' || cwd.length === 0)
+            continue;
+        try {
+            return await canonicalPath(cwd) === workspacePath;
+        }
+        catch {
+            return resolve(cwd) === workspacePath;
+        }
+    }
+    // Older transcripts without cwd still use the selected project folder.
+    return true;
+}
+export function claudeProjectKey(path) {
+    // Claude Code 2.1.302 replaces each character, then caps keys at 200
+    // characters with a base-36 suffix from the original path's 32-bit hash.
+    const key = path.replace(/[^A-Za-z0-9-]/g, '-');
+    if (key.length <= 200)
+        return key;
+    let hash = 0;
+    for (let index = 0; index < path.length; index += 1) {
+        hash = ((hash << 5) - hash + path.charCodeAt(index)) | 0;
+    }
+    return `${key.slice(0, 200)}-${Math.abs(hash).toString(36)}`;
+}
 function workspaceKey(path, retainLeadingSeparator) {
     const normalized = path.replace(/\\/g, '/');
     const input = retainLeadingSeparator ? normalized : normalized.replace(/^\/+/, '');

package/dist/src/sessions/workspace-matching.js

@@ -0,0 +1,107 @@
+import { lstat, readFile, realpath, stat } from 'node:fs/promises';
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+export const WORKSPACE_MATCH_KINDS = ['exact', 'subfolder', 'worktree'];
+/** A nested catalog owns its subtree, even when discovery runs one workspace at a time. */
+export async function matchSessionWorkspace(cwd, workspace) {
+    try {
+        const { path: candidate, missing } = await resolveCandidate(resolve(cwd));
+        const workspacePath = await realpath(resolve(workspace));
+        const direct = encloses(workspacePath, candidate);
+        if (missing && !direct)
+            return null;
+        const physicalCatalog = await nearestCatalogBetween(candidate, direct ? workspacePath : undefined);
+        if (physicalCatalog && !encloses(physicalCatalog, workspacePath))
+            return null;
+        const mainRepository = await worktreeMainRepository(candidate).catch(() => null);
+        // A worktree also belongs to a deeper catalog around its main repository,
+        // including when both paths sit beneath the workspace being discovered.
+        if (mainRepository && encloses(workspacePath, mainRepository)
+            && await nearestCatalogBetween(mainRepository, workspacePath))
+            return null;
+        if (direct)
+            return candidate === workspacePath ? 'exact' : 'subfolder';
+        if (!mainRepository || !encloses(workspacePath, mainRepository))
+            return null;
+        return 'worktree';
+    }
+    catch {
+        // Unresolved paths or Git metadata cannot establish workspace ownership.
+        return null;
+    }
+}
+async function resolveCandidate(path) {
+    let ancestor = path;
+    const suffix = [];
+    for (;;) {
+        try {
+            // Stop at symlinks too, so realpath rejects dangling links below.
+            await lstat(ancestor);
+            break;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+            const parent = dirname(ancestor);
+            if (parent === ancestor)
+                throw error;
+            suffix.unshift(basename(ancestor));
+            ancestor = parent;
+        }
+    }
+    return { path: join(await realpath(ancestor), ...suffix), missing: suffix.length > 0 };
+}
+function encloses(parent, child) {
+    const suffix = relative(parent, child);
+    return suffix === '' || (!isAbsolute(suffix) && suffix !== '..' && !suffix.startsWith(`..${sep}`));
+}
+async function nearestCatalogBetween(candidate, stop) {
+    for (let directory = candidate; directory !== stop; directory = dirname(directory)) {
+        const catalog = await statIfPresent(join(directory, '.aiwg', 'sessions'));
+        if (catalog?.isDirectory())
+            return directory;
+        if (directory === dirname(directory))
+            break;
+    }
+    return null;
+}
+async function worktreeMainRepository(candidate) {
+    for (let directory = candidate;; directory = dirname(directory)) {
+        const marker = join(directory, '.git');
+        const details = await statIfPresent(marker);
+        if (details) {
+            // Stop at the nearest repository; a normal repository or submodule
+            // must not inherit an outer worktree's ownership.
+            if (!details.isFile())
+                return null;
+            const gitfile = /^gitdir: (.+)\s*$/.exec((await readFile(marker, 'utf8')).trim());
+            if (!gitfile)
+                return null;
+            const gitdir = await realpath(resolve(directory, gitfile[1].trim()));
+            const common = (await readFile(join(gitdir, 'commondir'), 'utf8')).trim();
+            if (!common)
+                return null;
+            const commonDir = await realpath(resolve(gitdir, common));
+            const backlink = (await readFile(join(gitdir, 'gitdir'), 'utf8')).trim();
+            if (!backlink || await realpath(resolve(gitdir, backlink)) !== await realpath(marker))
+                return null;
+            // Standard linked worktrees share the main repository's .git directory.
+            if (basename(commonDir) !== '.git' || commonDir === gitdir)
+                return null;
+            const mainRepository = dirname(commonDir);
+            return await realpath(join(mainRepository, '.git')) === commonDir ? mainRepository : null;
+        }
+        if (directory === dirname(directory))
+            return null;
+    }
+}
+async function statIfPresent(path) {
+    try {
+        return await stat(path);
+    }
+    catch (error) {
+        if (['ENOENT', 'ENOTDIR'].includes(error.code ?? ''))
+            return null;
+        throw error;
+    }
+}
+//# sourceMappingURL=workspace-matching.js.map

package/dist/src/skills/importer.js

@@ -178,6 +178,7 @@ function runGit(args, options = {}) {
         maxBuffer: options.maxBuffer ?? 16 * 1024 * 1024,
         stdio: ['ignore', 'pipe', 'pipe'],
         timeout: 120_000,
+        killSignal: 'SIGKILL',
     });
     if (result.error) {
         if (result.error.code === 'ETIMEDOUT') {

package/dist/src/smiths/context-pipeline/aiwg-md.js

@@ -17,6 +17,8 @@
 import { promises as fs } from 'node:fs';
 import * as path from 'node:path';
 import { projectControlPath } from '../../config/project-artifacts.js';
+import { buildClaudeHookBlock, CLAUDE_HOOK_START, CLAUDE_HOOK_END } from './claude-hook.js';
+import { dominantLineEnding, withLineEnding } from './line-endings.js';
 import { buildParallelismSection, replaceOrAppendParallelismBlock } from './parallelism-section.js';
 import { buildContextFinalizationBlock, replaceOrAppendFinalizationBlock } from './finalization.js';
 import { buildExternalLinksSection, replaceOrAppendExternalLinksBlock, } from './external-links-section.js';
@@ -55,6 +57,15 @@ export async function buildAiwgMdContent(projectPath, stagedClaudeMdContent) {
     if (claudeMdContent) {
         // Insert the AIWG signature comment as the second line.
         // Top line is typically `# AIWG` or `# Project` heading; preserve it.
+        // Regenerate may mirror CLAUDE.md before its hook updater runs. Normalize
+        // that managed block here too so legacy duplicate policy never reaches
+        // AIWG.md, even on the first refresh. Operator content stays untouched.
+        const start = claudeMdContent.indexOf(CLAUDE_HOOK_START);
+        const end = claudeMdContent.indexOf(CLAUDE_HOOK_END, start);
+        if (start >= 0 && end >= start) {
+            const hook = withLineEnding(buildClaudeHookBlock(), dominantLineEnding(claudeMdContent));
+            claudeMdContent = claudeMdContent.slice(0, start) + hook + claudeMdContent.slice(end + CLAUDE_HOOK_END.length);
+        }
         const lines = claudeMdContent.split('\n');
         // #1268: strip `@AIWG.md` self-include directives. CLAUDE.md uses
         // `@AIWG.md` to pull in the framework context; AIWG.md IS that framework

package/dist/src/smiths/context-pipeline/claude-hook.js

@@ -26,29 +26,14 @@ import { dominantLineEnding, withLineEnding } from './line-endings.js';
 import { assertSafeContextFile } from './context-file-safety.js';
 export const CLAUDE_HOOK_START = '<!-- AIWG:claude-md-hook:start -->';
 export const CLAUDE_HOOK_END = '<!-- AIWG:claude-md-hook:end -->';
-function buildClaudeArtifactOutputPolicy(policy = {}) {
-    const providerNative = policy.provider_native ?? 'explicit-only';
-    const design = policy.destinations?.['claude-code.design'];
-    const designEnabled = design?.enabled !== false && design?.use_when !== 'disabled';
-    return [
-        '## AIWG artifact output policy',
-        '',
-        `- Canonical durable artifacts: AIWG artifact store (policy: ${policy.canonical ?? 'aiwg'}).`,
-        `- Provider-native presentation/export: ${providerNative}.`,
-        `- Claude Design: ${designEnabled ? 'available only when explicitly selected by the resolved policy or requested by the user' : 'disabled by project policy'}.`,
-        '- Never substitute, relocate, or omit the canonical AIWG plan/review artifact because Claude adds or changes a provider default.',
-        '- When both canonical and presentation outputs are selected, write the canonical artifact first; treat Design as a derived export and record provenance linking it to the canonical source of truth.',
-        '- Unknown provider-native destinations fail safe with a diagnostic. Higher-authority project policy overrides user preferences; explicit task selection overrides provider defaults only within the project policy ceiling.',
-    ];
-}
-export function buildClaudeHookBlock(policy = {}) {
+export function buildClaudeHookBlock(_policy = {}) {
     return [
         CLAUDE_HOOK_START,
         '',
         buildProviderBootstrapBlock('claude'),
         '@.aiwg/aiwg.config',
         '',
-        ...buildClaudeArtifactOutputPolicy(policy),
+        'Artifact destination authority: `aiwg show rule artifact-output-policy` (kernel).',
         '',
         '<!--',
         '  This block is managed by `aiwg regenerate` and `aiwg use`.',
@@ -72,15 +57,7 @@ export async function ensureClaudeMdHook(projectPath, opts = {}) {
         action: 'skipped',
         warnings: [],
     };
-    let policy = {};
-    try {
-        const config = JSON.parse(await fs.readFile(path.join(projectPath, '.aiwg', 'aiwg.config'), 'utf8'));
-        policy = config.artifact_outputs ?? {};
-    }
-    catch {
-        // Missing/legacy/temporarily malformed config receives the safe default.
-    }
-    let block = buildClaudeHookBlock(policy);
+    let block = buildClaudeHookBlock();
     // Case 1: CLAUDE.md does not exist — create a minimal one with just the block.
     let existing;
     try {