@aiwg/cli 2026.10.3 → 2026.10.4

package/dist/src/utils/temporary-directory.js

@@ -0,0 +1,36 @@
+import { rmSync } from 'node:fs';
+const directories = new Set();
+const removeAll = () => {
+    for (const directory of directories)
+        rmSync(directory, { recursive: true, force: true });
+};
+const onInterrupt = () => terminate('SIGINT', onInterrupt);
+const onTerminate = () => terminate('SIGTERM', onTerminate);
+function terminate(signal, listener) {
+    removeAll();
+    // Preserve an existing shutdown handler; otherwise restore default behavior.
+    if (process.listenerCount(signal) === 1) {
+        process.removeListener(signal, listener);
+        process.kill(process.pid, signal);
+    }
+}
+/** Own scratch through normal completion, explicit process.exit and termination.
+ * SIGKILL cannot be handled; callers should still use finally for normal errors. */
+export function trackTemporaryDirectory(directory) {
+    if (directories.size === 0) {
+        process.once('exit', removeAll);
+        process.on('SIGINT', onInterrupt);
+        process.on('SIGTERM', onTerminate);
+    }
+    directories.add(directory);
+    return () => {
+        rmSync(directory, { recursive: true, force: true });
+        directories.delete(directory);
+        if (directories.size === 0) {
+            process.removeListener('exit', removeAll);
+            process.removeListener('SIGINT', onInterrupt);
+            process.removeListener('SIGTERM', onTerminate);
+        }
+    };
+}
+//# sourceMappingURL=temporary-directory.js.map

package/dist/src/writing/example-generator.js

@@ -550,7 +550,7 @@ export class ExampleGenerator {
                 postgresql: 'PostgreSQL 15',
                 mysql: 'MySQL 8.0',
                 mongodb: 'MongoDB 6.0',
-                node: 'Node.js 20',
+                node: 'Node.js 24',
                 react: 'React 18',
                 vue: 'Vue 3',
                 angular: 'Angular 17'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwg/cli",
-  "version": "2026.10.3",
+  "version": "2026.10.4",
   "description": "Lightweight AIWG CLI for signed, versioned web-backed resources.",
   "type": "module",
   "license": "MIT",
@@ -41,6 +41,18 @@
     "dist/src/resources/web-release.d.ts",
     "dist/src/dataset/**/*.d.ts",
     "tools/_resolve-impl.mjs",
+    "tools/cli/decision-offload-report.mjs",
+    "tools/cli/workspace-status.mjs",
+    "tools/ralph-external/session-launcher.mjs",
+    "tools/ralph-external/process-monitor.mjs",
+    "tools/ralph-external/lib/session-environment.mjs",
+    "tools/ralph-external/lib/worker-isolation.mjs",
+    "tools/ralph-external/lib/systemd-client.mjs",
+    "tools/ralph-external/lib/consecutive-failure-circuit-breaker.mjs",
+    "tools/ralph-external/lib/launcher-recovery-evidence.mjs",
+    "tools/ralph-external/lib/recovery-probe.mjs",
+    "tools/ralph-external/lib/worker-overflow.mjs",
+    "tools/scripts/resource-preflight.mjs",
     "tools/ralph-external/lib/provider-adapter.mjs",
     "tools/ralph-external/lib/worker-health.mjs",
     "tools/ralph-external/lib/claude-adapter.mjs",
@@ -59,6 +71,7 @@
     "tools/providers/antigravity-transport.mjs",
     "tools/commands/deploy-prompts-codex.mjs",
     "tools/plugin/package-plugins.mjs",
+    "tools/plugin/plugin-links.mjs",
     "tools/skills/deploy-skills-codex.mjs",
     "README.md"
   ],
@@ -82,7 +95,7 @@
     "access": "public"
   },
   "engines": {
-    "node": ">=20.0.0"
+    "node": ">=24"
   },
   "dependencies": {
     "@fortemi/core": "2026.7.15",

package/schemas/models/model-catalog.v1.schema.json

@@ -292,7 +292,7 @@
           "type": "array",
           "items": { "$ref": "#/$defs/discoveredModel" }
         },
-        "errorKind": { "enum": ["authentication", "rate-limit", "timeout", "unsupported", "invalid-output", "command"] },
+        "errorKind": { "enum": ["authentication", "rate-limit", "timeout", "unsupported", "invalid-output", "environment", "command"] },
         "error": { "type": "string" },
         "policy": { "type": "object" }
       }

package/schemas/models/provider-model-capabilities.v1.schema.json

@@ -37,6 +37,12 @@
           "verifiedAt"
         ],
         "properties": {
+          "sessionEnvAllowlist": {
+            "description": "Exact provider auth/config names for legacy full agent sessions, in addition to the launcher's base environment. Independent of worker invocation allowlists.",
+            "type": "array",
+            "items": { "type": "string", "pattern": "^[A-Za-z_][A-Za-z0-9_]*$" },
+            "uniqueItems": true
+          },
           "agent": {
             "$ref": "#/$defs/control"
           },

package/tools/_resolve-impl.mjs

@@ -20,7 +20,7 @@ function findPackageRoot(callerUrl) {
     dir = parent;
   }
 
-  throw new Error(`Could not locate AIWG package root from ${callerUrl}`);
+  throw Object.assign(new Error(`Could not locate AIWG package root from ${callerUrl}`), { code: 'AIWG_PACKAGE_ROOT_MISSING' });
 }
 
 function candidatesFor(root, relativeFromSrc, base) {
@@ -59,10 +59,10 @@ function resolveCandidate(root, relativeFromSrc, base) {
  * `importImpl(import.meta.url, '<module-path-relative-to-src>')` instead of
  * a literal relative import, so it finds `dist/src/` when installed and
  * `src/` in a checkout. `test/integration/tools-packed-relative-imports.test.ts`
- * guards this for every relative import already known to resolve.
+ * guards this for every shipped relative import without exceptions.
  *
  * Directories `package.json`'s `files` excludes from the npm package
- * (`tools/benchmarks/`, `tools/ci/`, `tools/contrib/`, `tools/docker/`,
+ * (`tools/benchmarks/`, `tools/ci/`, `tools/contrib/`,
  * `tools/eval/`, `tools/lint/` other than its listed exceptions,
  * `tools/manifest/` other than its listed exception, `tools/qualification/`,
  * and `tools/release/`) are maintainer/CI-only: they never run from an
@@ -74,17 +74,15 @@ function resolveCandidate(root, relativeFromSrc, base) {
  * shipped ever referenced them (#3062 B/C finding 2) — removing them
  * also trims install size (#3075).
  *
- * `.ts` files directly under `tools/**` that remain shipped (e.g. under
- * `tools/decision/`, `tools/experiments/`) are a separate, still-open
- * case: they are only ever run via `tsx` through an `npm run` script in a
- * checkout (there is no compile step that makes them directly
- * `node`-executable), so they also keep literal `src/**` imports — there
- * is no installed-package code path that reaches them to break. This is
- * pre-existing, documented debt (see the baseline in
- * `test/integration/tools-packed-relative-imports.test.ts`), not a
- * recommendation to add more of it: a new shipped `.ts` tool should
- * resolve through `importImpl` like everything else unless it has the
- * same checkout-only justification.
+ * Decision study/replay scripts, experiments, OMP conformance probes, the
+ * desktop issuer qualification, and repository testing scripts are also
+ * excluded: they require checkout fixtures, development dependencies, or
+ * unshipped application code and have no installed CLI callers. Keep those
+ * scripts in the repository rather than adapting them for installation.
+ *
+ * `tools/docker/container-manager.mjs` and `Dockerfile.daemon` are shipped
+ * exceptions to the Docker directory exclusion: `aiwg daemon start --docker`
+ * needs both. The manager uses this resolver for its implementation import.
  */
 export function resolveImpl(callerUrl, relativeFromSrc) {
   const root = findPackageRoot(callerUrl);
@@ -104,7 +102,7 @@ export function resolveImpl(callerUrl, relativeFromSrc) {
   const attempted = order
     .flatMap((base) => candidatesFor(root, relativeFromSrc, base))
     .join(', ');
-  throw new Error(`Could not resolve ${relativeFromSrc}; attempted: ${attempted}`);
+  throw Object.assign(new Error(`Could not resolve ${relativeFromSrc}; attempted: ${attempted}`), { code: 'AIWG_IMPLEMENTATION_MISSING' });
 }
 
 export async function importImpl(callerUrl, relativeFromSrc) {

package/tools/agents/deploy-agents.mjs

@@ -19,7 +19,9 @@
  *   --deploy-rules           Deploy rules in addition to agents
  *   --commands-only          Deploy only commands (skip agents)
  *   --skills-only            Deploy only skills (skip agents)
- *   --rules-only             Deploy only rules (skip agents)
+ *   --strict                 Fail startup budget overruns before deployment promotion
+  --report-only            Warn on startup budget overruns (migration default; CI remains strict)
+  --rules-only             Deploy only rules (skip agents)
  *   --dry-run                Show what would be deployed without writing
  *   --force                  Overwrite existing files
  *   --provider <name>        Target provider: antigravity (agy), claude (default), openai, codex, cursor, opencode, copilot, factory, grokbot, grok-build, muse, pi, omp, deepseek-harness (dsh), warp, devin, hermes, openhuman, or openclaw
@@ -189,7 +191,7 @@ function uniquePaths(paths) {
   return [...new Set(paths.filter(Boolean))];
 }
 
-function collectMirrorSkillDirs(srcRoot, mode) {
+export function collectMirrorSkillDirs(srcRoot, mode, providerName) {
   const dirs = [];
 
   const directSkillsDir = path.join(srcRoot, 'skills');
@@ -208,7 +210,14 @@ function collectMirrorSkillDirs(srcRoot, mode) {
     });
     dirs.push(...artifacts.skills);
 
-    if (mode === 'all') {
+    // Pi's provider collector already deploys all eligible addon skills for
+    // every root framework mode. Mirror the command-shaped addon skills in
+    // that same root pass so `aiwg use` does not need to repeat the entire
+    // deployment once per addon merely to produce these wrappers. Keep addon
+    // skills after framework skills: this preserves the existing per-addon
+    // winner when a framework and addon expose the same command name.
+    if (mode === 'all'
+      || (providerName === 'pi' && ['general', 'sdlc', 'both'].includes(mode))) {
       dirs.push(...getAddonSkillDirs(srcRoot));
     }
   }
@@ -294,7 +303,7 @@ function mirrorSkillsAsCommands(provider, target, srcRoot, opts) {
   const targetDir = resolveCommandMirrorDir(provider, target);
   if (!targetDir) return 0;
 
-  const skillDirs = collectMirrorSkillDirs(srcRoot, opts.mode)
+  const skillDirs = collectMirrorSkillDirs(srcRoot, opts.mode, provider.name)
     .filter((dir) => shouldMirrorCommandSkill(provider.name, path.basename(dir)));
 
   if (skillDirs.length === 0) return 0;
@@ -497,6 +506,8 @@ export function parseArgs(args = process.argv.slice(2)) {
     commandsOnly: false,
     skillsOnly: false,
     rulesOnly: false,
+    strict: false,
+    reportOnly: true,
     kernelOnly: false,
     filter: null,           // Glob pattern for agent names
     filterRole: null,       // Filter by role: reasoning|coding|efficiency
@@ -548,6 +559,9 @@ export function parseArgs(args = process.argv.slice(2)) {
     else if (a === '--commands-only') cfg.commandsOnly = true;
     else if (a === '--skills-only') cfg.skillsOnly = true;
     else if (a === '--rules-only') cfg.rulesOnly = true;
+    else if (a === '--strict') { cfg.strict = true; cfg.reportOnly = false; }
+    else if (a === '--allow-over-budget') cfg.allowOverBudget = true;
+    else if (a === '--report-only') cfg.reportOnly = true;
     else if (a === '--kernel-only') cfg.kernelOnly = true;
     else if (a === '--deploy-behaviors') cfg.deployBehaviors = true;
     else if (a === '--filter' && args[i + 1]) cfg.filter = args[++i];
@@ -932,8 +946,8 @@ async function promptCommandsMigration(cfg, provider, targetDir) {
 // Main Entry Point
 // ============================================================================
 
-export async function main() {
-  const cfg = parseArgs();
+export async function main(args = process.argv.slice(2), internal = {}) {
+  const cfg = parseArgs(args);
 
   // Resolve source directory (default to repo root relative to this script)
   const __filename = fileURLToPath(import.meta.url);
@@ -1033,6 +1047,9 @@ export async function main() {
     commandsOnly: cfg.commandsOnly,
     skillsOnly: cfg.skillsOnly || cfg.kernelOnly,
     rulesOnly: cfg.rulesOnly,
+    strict: cfg.strict,
+    reportOnly: cfg.reportOnly,
+    allowOverBudget: cfg.allowOverBudget === true,
     kernelOnly: cfg.kernelOnly,
     filter: cfg.filter,
     filterRole: cfg.filterRole,
@@ -1056,31 +1073,41 @@ export async function main() {
     deployVersion: cfg.deployVersion || getDeployVersion(srcRoot),
     deploySource: cfg.deploySource || 'bundled',
   };
+  const { isRuleDeploymentPreparationActive } = await import('./providers/rule-delivery.mjs');
+  const preparationActive = isRuleDeploymentPreparationActive();
 
   // Commands → Skills migration: prompt then delete the commands directory
   // so stale command files don't create duplicates in the provider TUI.
-  if (!cfg.dryRun && !cfg.skipCommandsMigration) {
-    const doMigrate = await promptCommandsMigration(cfg, provider, cfg.target);
-    if (doMigrate) {
+  if (!preparationActive && !internal.finalizeOnly) {
+    if (!cfg.dryRun && !cfg.skipCommandsMigration) {
+      const doMigrate = await promptCommandsMigration(cfg, provider, cfg.target);
+      if (doMigrate) {
+        const commandsRelPath = provider.paths?.commands;
+        if (commandsRelPath) {
+          migrateCommandsDirectory(path.join(cfg.target, commandsRelPath), opts);
+        }
+      } else {
+        // User said no — flip the flag so the provider knows to emit the duplicate warning
+        opts.skipCommandsMigration = true;
+      }
+    } else if (cfg.skipCommandsMigration) {
+      // Flag was passed explicitly — emit the duplicate warning now via a dry migration call
       const commandsRelPath = provider.paths?.commands;
-      if (commandsRelPath) {
+      if (commandsRelPath && !provider.capabilities?.homeDirectoryDeploy) {
         migrateCommandsDirectory(path.join(cfg.target, commandsRelPath), opts);
       }
-    } else {
-      // User said no — flip the flag so the provider knows to emit the duplicate warning
-      opts.skipCommandsMigration = true;
-    }
-  } else if (cfg.skipCommandsMigration) {
-    // Flag was passed explicitly — emit the duplicate warning now via a dry migration call
-    const commandsRelPath = provider.paths?.commands;
-    if (commandsRelPath && !provider.capabilities?.homeDirectoryDeploy) {
-      migrateCommandsDirectory(path.join(cfg.target, commandsRelPath), opts);
     }
   }
 
+  // Concurrent deployment runs this parent-owned preflight before any child
+  // snapshots its inputs. Migration can remove a provider command tree, so it
+  // must remain on the same side of the transaction boundary as serial deploy.
+  if (internal.preflightOnly) return;
+
   // Delegate to provider
   try {
-    await provider.deploy(opts);
+    if (!internal.finalizeOnly) await provider.deploy(opts);
+    if (preparationActive) return;
 
     const mirroredCommandCount = mirrorSkillsAsCommands(provider, cfg.target, srcRoot, opts);
     if (mirroredCommandCount > 0 && !cfg.quiet) {
@@ -1091,7 +1118,7 @@ export async function main() {
     // or removed (the flat-file analogue of the skills holistic prune). #1627.
     pruneStaleAiwgArtifacts(provider, cfg.target, srcRoot, opts, cfg.source);
 
-    if (!opts.commandsOnly && !opts.skillsOnly && !opts.rulesOnly) {
+    if (!['claude', 'codex', 'cursor', 'hermes', 'warp', 'openclaw'].includes(provider.name) && !opts.commandsOnly && !opts.skillsOnly && !opts.rulesOnly) {
       const behaviorDirs = collectBehaviorDirs(srcRoot);
       const behaviorCount = deployEmulatedBehaviors(behaviorDirs, provider.name, cfg.target, opts);
       if (behaviorCount > 0 && !cfg.quiet) {
@@ -1106,6 +1133,7 @@ export async function main() {
 
     if (!cfg.quiet) console.log(`\n=== Deployment complete ===\n`);
   } catch (err) {
+    if (preparationActive || internal.finalizeOnly) throw err;
     console.error(`\nDeployment failed:`, err.message);
     if (cfg.dryRun) {
       console.error('(dry-run mode - no files were modified)');