@aiwg/cli 2026.10.3 → 2026.10.5

package/README.md

@@ -42,7 +42,7 @@ and doctor commands remain advanced maintenance and recovery tools.
 [![npm downloads](https://img.shields.io/npm/dm/%40aiwg%2Fcli?color=CB3837&logo=npm&style=flat-square)](https://www.npmjs.com/package/@aiwg/cli)
 [![full distribution](https://img.shields.io/npm/v/aiwg/latest?label=aiwg&color=CB3837&logo=npm&style=flat-square)](https://www.npmjs.com/package/aiwg)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg?style=flat-square)](https://github.com/jmagly/aiwg/blob/main/LICENSE)
-[![Node Version](https://img.shields.io/badge/node-%E2%89%A520.0.0-brightgreen?style=flat-square&logo=node.js)](https://nodejs.org)
+[![Node Version](https://img.shields.io/badge/node-%E2%89%A524-brightgreen?style=flat-square&logo=node.js)](https://nodejs.org)
 [![TypeScript](https://img.shields.io/badge/TypeScript-5.x-blue?style=flat-square&logo=typescript)](https://www.typescriptlang.org)
 [![Signed Resources](https://img.shields.io/badge/resources-signed-00a67d?style=flat-square)](https://releases.aiwg.io/)
 
@@ -857,7 +857,7 @@ mechanism, not a separate set of AIWG instructions.
 
 ### Requirements
 
-- Node.js 20 or newer;
+- Node.js 24 or newer;
 - npm or another package manager capable of installing npm packages;
 - HTTPS access to npmjs.org for installation;
 - HTTPS access to `releases.aiwg.io` for cold web-resource reads.

package/agentic/code/providers/model-capabilities.v1.json

@@ -208,6 +208,28 @@
       }
     },
     "claude": {
+      "sessionEnvAllowlist": [
+        "ANTHROPIC_API_KEY",
+        "ANTHROPIC_AUTH_TOKEN",
+        "ANTHROPIC_BASE_URL",
+        "ANTHROPIC_MODEL",
+        "CLAUDE_CONFIG_DIR",
+        "CLAUDE_CODE_OAUTH_TOKEN",
+        "CLAUDE_CODE_DISABLE_1M_CONTEXT",
+        "CLAUDE_CODE_USE_BEDROCK",
+        "CLAUDE_CODE_USE_VERTEX",
+        "AWS_PROFILE",
+        "AWS_REGION",
+        "AWS_DEFAULT_REGION",
+        "AWS_ACCESS_KEY_ID",
+        "AWS_SECRET_ACCESS_KEY",
+        "AWS_SESSION_TOKEN",
+        "AWS_CONFIG_FILE",
+        "AWS_SHARED_CREDENTIALS_FILE",
+        "GOOGLE_APPLICATION_CREDENTIALS",
+        "ANTHROPIC_VERTEX_PROJECT_ID",
+        "CLOUD_ML_REGION"
+      ],
       "agent": "native",
       "skill": "native",
       "globalChild": "inherited",
@@ -429,6 +451,14 @@
       }
     },
     "codex": {
+      "sessionEnvAllowlist": [
+        "OPENAI_API_KEY",
+        "CODEX_API_KEY",
+        "OPENAI_BASE_URL",
+        "OPENAI_ORG_ID",
+        "OPENAI_PROJECT_ID",
+        "CODEX_HOME"
+      ],
       "agent": "native",
       "skill": "unsupported",
       "globalChild": "inherited",
@@ -452,7 +482,7 @@
         "id": "codex",
         "provider": "codex",
         "adapterVersion": "1",
-        "supportedVersions": "0.161.0",
+        "supportedVersions": ">=0.161.0 <0.200.0",
         "runtimeDriver": "installed:codex",
         "catalogAdapter": {
           "kind": "file",
@@ -513,7 +543,7 @@
         "invocationProfiles": {
           "direct-shell": {
             "transport": "shell",
-            "supportedVersions": "0.161.0",
+            "supportedVersions": ">=0.161.0 <0.200.0",
             "controls": {
               "model": {
                 "support": "unqualified",
@@ -640,6 +670,12 @@
       }
     },
     "copilot": {
+      "sessionEnvAllowlist": [
+        "COPILOT_GITHUB_TOKEN",
+        "GH_TOKEN",
+        "GITHUB_TOKEN",
+        "COPILOT_HOME"
+      ],
       "agent": "native",
       "skill": "unsupported",
       "globalChild": "inherited",
@@ -1025,6 +1061,9 @@
       }
     },
     "factory": {
+      "sessionEnvAllowlist": [
+        "FACTORY_API_KEY"
+      ],
       "agent": "native",
       "skill": "informational",
       "globalChild": "native",
@@ -1220,6 +1259,23 @@
       }
     },
     "opencode": {
+      "sessionEnvAllowlist": [
+        "OPENAI_API_KEY",
+        "ANTHROPIC_API_KEY",
+        "GEMINI_API_KEY",
+        "GOOGLE_API_KEY",
+        "OPENROUTER_API_KEY",
+        "GROQ_API_KEY",
+        "MISTRAL_API_KEY",
+        "XAI_API_KEY",
+        "DEEPSEEK_API_KEY",
+        "OPENCODE_API_KEY",
+        "OPENCODE_CONFIG",
+        "OPENCODE_CONFIG_DIR",
+        "OPENCODE_CONFIG_CONTENT",
+        "OPENCODE_SERVER_USERNAME",
+        "OPENCODE_SERVER_PASSWORD"
+      ],
       "agent": "native",
       "skill": "unsupported",
       "globalChild": "inherited",
@@ -1596,6 +1652,19 @@
       }
     },
     "omp": {
+      "sessionEnvAllowlist": [
+        "OPENAI_API_KEY",
+        "ANTHROPIC_API_KEY",
+        "GEMINI_API_KEY",
+        "GOOGLE_API_KEY",
+        "OPENROUTER_API_KEY",
+        "GROQ_API_KEY",
+        "MISTRAL_API_KEY",
+        "XAI_API_KEY",
+        "DEEPSEEK_API_KEY",
+        "PI_CONFIG_DIR",
+        "PI_CODING_AGENT_DIR"
+      ],
       "agent": "native",
       "skill": "inherited",
       "globalChild": "native",
@@ -1796,6 +1865,21 @@
       }
     },
     "pi": {
+      "sessionEnvAllowlist": [
+        "OPENAI_API_KEY",
+        "ANTHROPIC_API_KEY",
+        "GEMINI_API_KEY",
+        "GOOGLE_API_KEY",
+        "OPENROUTER_API_KEY",
+        "GROQ_API_KEY",
+        "MISTRAL_API_KEY",
+        "XAI_API_KEY",
+        "DEEPSEEK_API_KEY",
+        "PI_CODING_AGENT_DIR",
+        "PI_CODING_AGENT_SESSION_DIR",
+        "AIWG_PI_STUB_SCENARIO",
+        "AIWG_PI_STUB_RECEIPT"
+      ],
       "agent": "native",
       "skill": "inherited",
       "globalChild": "native",
@@ -1992,6 +2076,10 @@
       }
     },
     "deepseek-harness": {
+      "sessionEnvAllowlist": [
+        "DEEPSEEK_API_KEY",
+        "DSH_HOME"
+      ],
       "agent": "native",
       "skill": "inherited",
       "globalChild": "native",
@@ -3001,6 +3089,10 @@
       }
     },
     "muse": {
+      "sessionEnvAllowlist": [
+        "AIWG_MUSE_STUB_SCENARIO",
+        "AIWG_MUSE_STUB_RECEIPT"
+      ],
       "agent": "unsupported",
       "skill": "unsupported",
       "globalChild": "informational",
@@ -3027,7 +3119,7 @@
         "id": "muse",
         "provider": "muse",
         "adapterVersion": "1",
-        "supportedVersions": "1.4.4-R5419.1",
+        "supportedVersions": ">=1.4.4-R5419.1 <2.0.0",
         "runtimeDriver": "tools/ralph-external/lib/muse-adapter.mjs",
         "catalogAdapter": {
           "kind": "file",
@@ -3087,7 +3179,7 @@
         "invocationProfiles": {
           "direct-shell": {
             "transport": "shell",
-            "supportedVersions": "1.4.4-R5419.1",
+            "supportedVersions": ">=1.4.4-R5419.1 <2.0.0",
             "controls": {
               "model": {
                 "support": "unqualified",

package/bin/aiwg.mjs

@@ -30,41 +30,52 @@ import { randomUUID } from 'crypto';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 const packageRoot = path.resolve(__dirname, '..');
+process.env['AIWG_LAUNCHER_ROOT'] = packageRoot;
 
-function readPackageVersion() {
+function readPackageVersion(root = packageRoot) {
   try {
-    const pkg = JSON.parse(readFileSync(path.join(packageRoot, 'package.json'), 'utf8'));
+    const pkg = JSON.parse(readFileSync(path.join(root, 'package.json'), 'utf8'));
     return typeof pkg.version === 'string' ? pkg.version : '(unknown)';
   } catch {
     return '(unknown)';
   }
 }
 
-function detectVersionChannel(version) {
-  if (version.includes('-rc.')) return 'rc';
-  if (version.includes('-beta.')) return 'beta';
-  if (version.includes('-alpha.')) return 'alpha';
-  if (version.includes('-nightly.')) return 'nightly';
+function readVersionConfig() {
   try {
     const legacyDir = path.join(os.homedir(), '.aiwg');
     const xdgDir = path.join(os.homedir(), '.config', 'aiwg');
     const configDir = process.env.AIWG_CONFIG
       ? path.resolve(process.env.AIWG_CONFIG)
       : existsSync(legacyDir) ? legacyDir : existsSync(xdgDir) ? xdgDir : legacyDir;
+    let config = {};
+    try {
+      config = JSON.parse(readFileSync(path.join(configDir, 'channel.json'), 'utf8'));
+    } catch { /* Legacy config is optional. */ }
     const installationFile = path.join(configDir, 'installation.json');
     if (existsSync(installationFile)) {
       const installation = JSON.parse(readFileSync(installationFile, 'utf8'));
-      if (installation?.runMode === 'development') return 'dev';
-      if (typeof installation?.channel === 'string') return installation.channel;
+      return {
+        ...config,
+        devMode: installation?.runMode === 'development',
+        channel: installation?.channel,
+        edgePath: installation?.edgePath ?? config.edgePath,
+      };
     }
-    const raw = readFileSync(path.join(configDir, 'channel.json'), 'utf8');
-    const cfg = JSON.parse(raw);
-    if (cfg?.devMode) return 'dev';
-    if (typeof cfg?.channel === 'string') return cfg.channel;
+    return config;
   } catch {
     // Default below.
   }
-  return 'stable';
+  return {};
+}
+
+function detectVersionChannel(version, config) {
+  if (config.devMode) return 'dev';
+  if (version.includes('-rc.')) return 'rc';
+  if (version.includes('-beta.')) return 'beta';
+  if (version.includes('-alpha.')) return 'alpha';
+  if (version.includes('-nightly.')) return 'nightly';
+  return config.channel || 'stable';
 }
 
 function maybeHandleFastVersion(args) {
@@ -72,8 +83,15 @@ function maybeHandleFastVersion(args) {
   if (args[0] !== '--version' && args[0] !== '-version') return false;
 
   const version = readPackageVersion();
-  const channel = detectVersionChannel(version);
+  const config = readVersionConfig();
+  const channel = detectVersionChannel(version, config);
+  const runtimePath = config.devMode && config.edgePath ? config.edgePath : packageRoot;
   console.log(`  aiwg  ${version}  [${channel}]`);
+  if (config.devMode) {
+    console.log(`    launcher: ${version}`);
+    console.log(`    runtime: ${readPackageVersion(runtimePath)}`);
+    console.log(`    runtime path: ${runtimePath}`);
+  }
   console.log(`    path: ${packageRoot}`);
   return true;
 }
@@ -240,7 +258,13 @@ maybeWarnUnbuiltDist();
 
 // Propagate the strict no-write contract through helpers that may resolve
 // installation/channel state before the command context exists.
-if (process.argv.slice(2).includes('--dry-run')) {
+function isReadOnlyReport(args) {
+  return (args[0] === 'rules' && ['inventory', 'list'].includes(args[1]))
+    || (['doctor', '-doctor', '--doctor'].includes(args[0]) && args.includes('--decision-offload'))
+    || (args[0] === 'steward' && args[1] === 'decision-offload');
+}
+const readOnlyReport = isReadOnlyReport(process.argv.slice(2));
+if (process.argv.slice(2).includes('--dry-run') || readOnlyReport) {
   process.env['AIWG_CLI_DRY_RUN'] = '1';
 }
 
@@ -332,7 +356,10 @@ async function runUpdateNotifierBootstrap() {
 }
 
 const cliArgs = process.argv.slice(2);
-if (isCredentialHandlingCommand(cliArgs)) {
+const indexRefresh = cliArgs[0] === 'index' && cliArgs[1] === 'refresh';
+if (indexRefresh || readOnlyReport) {
+  trace(`notifier:skip (${indexRefresh ? 'index refresh' : 'read-only report'})`);
+} else if (isCredentialHandlingCommand(cliArgs)) {
   trace('notifier:skip (credential-handling command)');
 } else {
   await runUpdateNotifierBootstrap();
@@ -441,7 +468,7 @@ async function applyVerbosityFromArgs(args, routerPath) {
       setInvocationId(invocationId);
       // One-shot prune of old JSONL files on startup. Bounded work; safe to
       // call on every invocation because the work is a single directory list.
-      pruneOldLogs();
+      if (!readOnlyReport) pruneOldLogs();
     }
   } catch {
     // If the logger isn't importable yet (fresh clone without dist/), the
@@ -463,6 +490,7 @@ const RECOVERY_SAFE_COMMANDS = new Set([
 const RECOVERY_SAFE_INDEX_SUBCOMMANDS = new Set(['query', 'deps', 'stats']);
 
 function isRecoverySafeCommand(args) {
+  if (isReadOnlyReport(args)) return true;
   const command = args.find((arg) => !arg.startsWith('-'));
   if (!command) return false;
   if (RECOVERY_SAFE_COMMANDS.has(command)) return true;
@@ -512,8 +540,8 @@ async function main() {
       console.error(`  Or switch back: aiwg --use-stable`);
       process.exit(1);
     }
-    const { assertCanonicalInstallation } = await import(pathToFileURL(identityPath).href);
-    const readOnlyPreview = args.includes('--dry-run');
+    const { assertCanonicalInstallation, formatInstallationDiagnostic } = await import(pathToFileURL(identityPath).href);
+    const readOnlyPreview = args.includes('--dry-run') || indexRefresh || readOnlyReport;
     try {
       assertCanonicalInstallation({
         actualRoot: activePackageRoot,
@@ -532,12 +560,7 @@ async function main() {
         drift,
       });
       process.stderr.write(
-        `aiwg: warning: installation identity drift detected; \`${args[0]}\` is read-only and continues, ` +
-        'but update, refresh, and deployment stay blocked until the identity is repaired.\n' +
-        drift.map((item) => `- ${item}\n`).join('') +
-        'Inspect: aiwg installation show\n' +
-        'Adopt this installation: aiwg installation adopt\n' +
-        'Switch deliberately: aiwg installation switch --root <path> --method <npm|web|source> [--manager <absolute-path>]\n',
+        `aiwg: warning: ${formatInstallationDiagnostic(error.status, { readOnlyCommand: args[0] })}\n`,
       );
     }
   }
@@ -545,7 +568,7 @@ async function main() {
   // Wire up the logger level from -v/-vv/--quiet/AIWG_LOG_LEVEL before any
   // handler runs, and stamp the top-level invocation ID so the logger can
   // tag every record with it.
-  await applyVerbosityFromArgs(args, routerPath);
+  if (!indexRefresh) await applyVerbosityFromArgs(args, routerPath);
 
   // Top-level cancellation controller. SIGINT / SIGTERM flip it, long-running
   // handlers plumb ctx.signal through fetches and loops so Ctrl-C cancels

package/dist/src/agents/grounding/knowledge-base.js

@@ -108,7 +108,11 @@ export class KnowledgeStore {
             .slice(0, limit);
     }
     /**
-     * Verify a claim against domain knowledge
+     * Verify literal support against the top three retrieved knowledge entries.
+     * Only a whole-entry statement match establishes support; direct copular
+     * negation vetoes it. Other wording abstains, including paraphrases and
+     * multi-sentence passages. This is not a general semantic entailment judge
+     * or a check that the stored knowledge is itself true.
      */
     verifyClaim(claim, domain) {
         const fragments = this.search(claim, { domain, limit: 3 });
@@ -118,17 +122,31 @@ export class KnowledgeStore {
                 verified: false,
                 confidence: 0,
                 sources: [],
+                evidence: [],
                 correction: 'No relevant knowledge found in knowledge base',
             };
         }
-        // Simple verification: check if top fragments support or contradict
-        const topFragment = fragments[0];
-        const confidence = Math.min(topFragment.relevance_score, 1.0);
+        // Relevance selects candidates; only their content can establish support.
+        const evidence = fragments.map((fragment) => ({
+            source: fragment.source,
+            entry_id: fragment.metadata?.id,
+            content: fragment.content,
+            relation: compareStatements(claim, fragment.content),
+        }));
+        const contradictions = evidence.filter((item) => item.relation === 'contradicts');
+        const verified = contradictions.length === 0
+            && evidence.some((item) => item.relation === 'supports');
         return {
             claim,
-            verified: confidence > 0.3,
-            confidence,
+            verified,
+            confidence: verified ? 1 : 0,
             sources: fragments.map((f) => f.source),
+            evidence,
+            ...(!verified && {
+                correction: contradictions.length > 0
+                    ? `Conflicting knowledge: ${contradictions.map((item) => item.content).join(' | ')}`
+                    : 'Relevant knowledge was retrieved, but explicit support was not established',
+            }),
         };
     }
     listDomains() {
@@ -144,6 +162,36 @@ export class KnowledgeStore {
 // ============================================================================
 // Helpers
 // ============================================================================
+function normalizeStatement(text) {
+    // Preserve case, numbers and internal punctuation: they can change meaning.
+    return text.trim().replace(/\s+/g, ' ').replace(/\.$/, '');
+}
+function compareStatements(claim, content) {
+    const statement = normalizeStatement(claim);
+    const evidence = normalizeStatement(content);
+    if (!statement || !evidence)
+        return 'unknown';
+    // Do not extract assertions from questions, quotations or multi-sentence text.
+    if ([statement, evidence].some((text) => /[?!;"“”]|\.(?:\s|$)/.test(text)))
+        return 'unknown';
+    if (statement === evidence)
+        return 'supports';
+    // A deliberately limited conflict rule: the same whole statement with a
+    // single "not" following is/are/was/were. Never infer support by dropping
+    // negation, and abstain on complex negation (e.g. "not only" or "not always").
+    const affirmative = (text) => {
+        if (/[.!?;:\n]/.test(text))
+            return undefined;
+        const match = text.match(/^(.+?\b(?:is|are|was|were)) not (.+)$/);
+        if (!match || /\b(?:not|only|just|always|necessarily)\b/.test(match[2]))
+            return undefined;
+        return `${match[1]} ${match[2]}`;
+    };
+    if (affirmative(statement) === evidence || affirmative(evidence) === statement) {
+        return 'contradicts';
+    }
+    return 'unknown';
+}
 function calculateRelevance(entry, queryTerms) {
     const searchable = [
         entry.topic,

package/dist/src/artifacts/browser-export.js

@@ -455,6 +455,12 @@ function recordForEntry(cwd, entry, graphName, dependencyGraph, privacy, schemaV
                             ? { aiwg_search_terms: uniqueSorted(entry.searchTerms) }
                             : {}),
                         ...(entry.script ? { aiwg_script: entry.script } : {}),
+                        ...(entry.activation ? { activation: entry.activation } : {}),
+                        ...(entry.bound_to ? { bound_to: entry.bound_to } : {}),
+                        ...(entry.ruleEnforcement ? { enforcement: entry.ruleEnforcement } : {}),
+                        ...(entry.rulePaths ? { paths: entry.rulePaths } : {}),
+                        ...(entry.governedPaths ? { aiwg_governed_paths: entry.governedPaths } : {}),
+                        ...(entry.ruleSummary !== undefined ? { summary: entry.ruleSummary } : {}),
                     },
                 },
             }

package/dist/src/artifacts/checksum-manifest.js

@@ -58,6 +58,7 @@ export function writeManifest(indexDir, manifest) {
         version: 1,
         generated: new Date().toISOString(),
         entries: manifest.entries,
+        ...(manifest.receipt ? { receipt: manifest.receipt } : {}),
     };
     fs.writeFileSync(tmpPath, JSON.stringify(payload, null, 2), 'utf-8');
     fs.renameSync(tmpPath, manifestPath);