@aiwg/cli 2026.10.4 → 2026.10.6

package/dist/src/housekeeper/ipc.js

@@ -0,0 +1,84 @@
+/**
+ * Minimal JSON-RPC 2.0 client for the housekeeper daemon socket
+ * (epic #3353 slice B5).
+ *
+ * Speaks the same newline-delimited JSON framing as
+ * `tools/daemon/ipc-server.mjs` without importing `tools/` — `src/` must
+ * never import `tools/` (tools import compiled src via `importImpl`).
+ */
+import net from 'node:net';
+export async function requestDaemon(socketPath, method, options = {}) {
+    const timeoutMs = options.timeoutMs ?? 10_000;
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const fail = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            try {
+                socket.destroy();
+            }
+            catch { /* already closed */ }
+            reject(error);
+        };
+        const succeed = (value) => {
+            if (settled)
+                return;
+            settled = true;
+            try {
+                socket.end();
+            }
+            catch { /* already closed */ }
+            resolve(value);
+        };
+        const timer = setTimeout(() => {
+            fail(new Error(`Daemon request timed out: ${method} (${timeoutMs}ms)`));
+        }, timeoutMs);
+        timer.unref?.();
+        let buffer = '';
+        const socket = net.createConnection(socketPath);
+        socket.once('connect', () => {
+            socket.write(`${JSON.stringify({
+                jsonrpc: '2.0', id: 1, method, params: options.params ?? {},
+            })}\n`);
+        });
+        socket.on('data', (chunk) => {
+            buffer += chunk.toString('utf8');
+            const newline = buffer.indexOf('\n');
+            if (newline === -1)
+                return;
+            const line = buffer.slice(0, newline).trim();
+            buffer = buffer.slice(newline + 1);
+            if (!line)
+                return;
+            clearTimeout(timer);
+            let response;
+            try {
+                response = JSON.parse(line);
+            }
+            catch {
+                fail(new Error(`Daemon returned invalid JSON for ${method}`));
+                return;
+            }
+            if (response.error) {
+                fail(new Error(`Daemon error for ${method}: ${response.error.message ?? 'unknown error'}`));
+                return;
+            }
+            succeed(response.result);
+        });
+        socket.once('error', (error) => {
+            clearTimeout(timer);
+            const code = error?.code;
+            if (code === 'ENOENT' || code === 'ECONNREFUSED') {
+                fail(new Error('Daemon is not running (socket unavailable)'));
+                return;
+            }
+            fail(error);
+        });
+        socket.once('close', () => {
+            clearTimeout(timer);
+            fail(new Error(`Daemon connection closed during ${method}`));
+        });
+    });
+}
+//# sourceMappingURL=ipc.js.map

package/dist/src/housekeeper/lifecycle.js

@@ -0,0 +1,148 @@
+/**
+ * Housekeeper daemon lifecycle helpers (epic #3353 slice B5).
+ *
+ * Mirrors the pid/lock/heartbeat/state/socket paths of
+ * `tools/daemon/daemon-main.mjs` so `aiwg housekeeper start|stop|status`
+ * serializes against the same single-instance lock: a second `start`
+ * fails clearly, and `stop` cleans up exactly the files the daemon owns.
+ * All process signalling of owned ChildProcess handles goes through
+ * `signalChild`; pid-based stop uses `process.kill` (no ChildProcess).
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { signalChild } from '../process/signal-child.mjs';
+/** Same relative layout as DaemonMain; resolved against the caller cwd. */
+export function daemonPaths(cwd, frameworkRoot) {
+    return {
+        pidFile: path.join(cwd, '.aiwg', 'daemon.pid'),
+        lockFile: path.join(cwd, '.aiwg', 'daemon', '.lock'),
+        heartbeatFile: path.join(cwd, '.aiwg', 'daemon', 'heartbeat'),
+        stateFile: path.join(cwd, '.aiwg', 'daemon', 'state.json'),
+        socketPath: path.join(cwd, '.aiwg', 'daemon', 'daemon.sock'),
+        logFile: path.join(cwd, '.aiwg', 'daemon', 'daemon.log'),
+        taskStorePath: path.join(cwd, '.aiwg', 'daemon', 'tasks.json'),
+        daemonScript: path.join(frameworkRoot, 'tools', 'daemon', 'daemon-main.mjs'),
+    };
+}
+export function readPidFile(pidFile) {
+    let raw;
+    try {
+        raw = fs.readFileSync(pidFile, 'utf8').trim();
+    }
+    catch {
+        return null;
+    }
+    const pid = Number.parseInt(raw, 10);
+    return Number.isSafeInteger(pid) && pid > 0 && String(pid) === raw ? pid : null;
+}
+export function defaultKill(pid, signal) {
+    process.kill(pid, signal);
+}
+export function isPidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        // ESRCH = no such process. Any other error (e.g. EPERM) means a
+        // process exists that we may not signal — treat as alive.
+        if (error?.code === 'ESRCH')
+            return false;
+        return true;
+    }
+}
+/**
+ * Report whether a daemon owns the pid file. A pid file pointing at a
+ * dead process is stale (safe to overwrite after cleanup); a live one
+ * blocks `start`.
+ */
+export function describeRunning(pidFile) {
+    const pid = readPidFile(pidFile);
+    if (pid === null)
+        return { running: false, pid: null, stale: false };
+    if (isPidAlive(pid))
+        return { running: true, pid, stale: false };
+    return { running: false, pid, stale: true };
+}
+export function removeLifecycleFiles(paths) {
+    for (const file of [paths.pidFile, paths.lockFile]) {
+        try {
+            fs.unlinkSync(file);
+        }
+        catch (error) {
+            if (error?.code !== 'ENOENT')
+                throw error;
+        }
+    }
+}
+const defaultSleep = (ms) => new Promise((resolve) => { setTimeout(resolve, ms); });
+/**
+ * Stop the daemon gracefully (SIGTERM, poll, then SIGKILL on timeout),
+ * then release the pid/lock files. Never throws for absent files.
+ */
+export async function stopDaemon(options) {
+    const { paths, kill = defaultKill, timeoutMs = 10_000, pollMs = 200 } = options;
+    const sleep = options.sleep ?? defaultSleep;
+    const state = describeRunning(paths.pidFile);
+    if (state.pid === null)
+        return { outcome: 'not-running' };
+    if (!state.running) {
+        removeLifecycleFiles(paths);
+        return { outcome: 'stale-cleaned', pid: state.pid };
+    }
+    const pid = state.pid;
+    try {
+        kill(pid, 'SIGTERM');
+    }
+    catch (error) {
+        if (error?.code === 'ESRCH') {
+            removeLifecycleFiles(paths);
+            return { outcome: 'stale-cleaned', pid };
+        }
+        throw error;
+    }
+    const deadline = Date.now() + timeoutMs;
+    while (isPidAlive(pid)) {
+        if (Date.now() >= deadline)
+            break;
+        await sleep(pollMs);
+    }
+    let forced = false;
+    if (isPidAlive(pid)) {
+        try {
+            kill(pid, 'SIGKILL');
+        }
+        catch (error) {
+            if (error?.code !== 'ESRCH')
+                throw error;
+        }
+        forced = true;
+        const killDeadline = Date.now() + Math.min(timeoutMs, 5000);
+        while (isPidAlive(pid) && Date.now() < killDeadline) {
+            await sleep(pollMs);
+        }
+    }
+    removeLifecycleFiles(paths);
+    return { outcome: 'stopped', pid, forced };
+}
+/** Forward a terminal signal to an owned foreground child. */
+export function forwardSignalToChild(child, signal) {
+    signalChild(child, signal);
+}
+/**
+ * Poll until `predicate` is true or the deadline passes. Returns true on
+ * success; used by `start` to wait for the pid file without fixed sleeps.
+ */
+export async function pollUntil(predicate, options = {}) {
+    const { timeoutMs = 10_000, pollMs = 200 } = options;
+    const sleep = options.sleep ?? defaultSleep;
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+        if (predicate())
+            return true;
+        if (Date.now() >= deadline)
+            return false;
+        await sleep(pollMs);
+    }
+}
+//# sourceMappingURL=lifecycle.js.map

package/dist/src/housekeeper/platform.js

@@ -0,0 +1,35 @@
+/**
+ * Platform honesty for `aiwg housekeeper` (epic #3353 slice B5).
+ *
+ * Design-note §3 matrix in one place, with the platform injectable so
+ * tests can cover every row without running on that OS: Windows is
+ * unsupported (WSL2 follows the Linux rows); macOS install is a
+ * best-effort launchd plist (documented, not CI-tested); Linux install
+ * targets systemd user units.
+ */
+export function normalizePlatform(platform = process.platform) {
+    if (platform === 'win32')
+        return 'windows';
+    if (platform === 'darwin')
+        return 'darwin';
+    if (platform === 'linux')
+        return 'linux';
+    return 'other';
+}
+/** run-once / daemon processes: everything except Windows. */
+export function runSupported(platform = process.platform) {
+    return normalizePlatform(platform) !== 'windows';
+}
+export function runUnsupportedMessage() {
+    return 'aiwg housekeeper is not supported on Windows (no recursive fs.watch, POSIX paths assumed). Use WSL2 and follow the Linux rows.';
+}
+/** Install backends offered on a platform, in preference order. */
+export function installBackends(platform = process.platform) {
+    const normalized = normalizePlatform(platform);
+    if (normalized === 'windows')
+        return [];
+    if (normalized === 'darwin')
+        return ['launchd', 'systemd-user'];
+    return ['systemd-user', 'launchd'];
+}
+//# sourceMappingURL=platform.js.map

package/dist/src/housekeeper/status.js

@@ -0,0 +1,70 @@
+/**
+ * Housekeeper status envelope (epic #3353 slice B5).
+ *
+ * `aiwg housekeeper status --json` emits this shape: the B1 §6 contract
+ * fields (`contractVersion`/`command`/`status`/`mode`/`jobs`/`totals`) plus
+ * per-index freshness measured by the B4 adapters. The CLI builds it from
+ * live daemon IPC when a daemon answers, otherwise from local config and
+ * persisted receipts (offline mode), so ordinary `aiwg` commands keep
+ * working with no daemon running.
+ */
+export const HOUSEKEEPER_STATUS_CONTRACT_VERSION = 1;
+const RECEIPT_STATES = new Set(['ok', 'failed', 'skipped', 'deferred']);
+export function countJobTotals(jobs) {
+    const totals = {
+        jobs: jobs.length, ok: 0, failed: 0, skipped: 0, deferred: 0, never: 0,
+    };
+    for (const job of jobs) {
+        if (job.lastState === 'ok')
+            totals.ok += 1;
+        else if (job.lastState === 'failed')
+            totals.failed += 1;
+        else if (job.lastState === 'skipped')
+            totals.skipped += 1;
+        else if (job.lastState === 'deferred')
+            totals.deferred += 1;
+        else
+            totals.never += 1;
+    }
+    return totals;
+}
+export function normalizeJobState(state) {
+    return typeof state === 'string' && RECEIPT_STATES.has(state)
+        ? state
+        : 'never';
+}
+/** Assemble the envelope; every field is always present. */
+export function buildHousekeeperStatus(input) {
+    const jobs = input.jobs ?? [];
+    return {
+        contractVersion: HOUSEKEEPER_STATUS_CONTRACT_VERSION,
+        command: 'housekeeper.status',
+        status: 'ok',
+        mode: input.mode,
+        pid: input.pid ?? null,
+        uptimeSeconds: input.uptimeSeconds ?? 0,
+        jobs,
+        totals: countJobTotals(jobs),
+        freshness: input.freshness ?? [],
+        update: {
+            channel: 'stable',
+            checkOnly: true,
+            lastCheck: input.lastCheck ?? null,
+            available: input.available ?? null,
+            lastInstall: input.lastInstall ?? null,
+        },
+    };
+}
+/**
+ * Map a B4 freshness snapshot to the status entry. `unavailable` (no local
+ * deterministic probe) surfaces as `unsupported` per the B1 §6 state set.
+ */
+export function toFreshnessEntry(snapshot) {
+    return {
+        index: snapshot.name,
+        state: snapshot.status === 'unavailable' ? 'unsupported' : snapshot.status,
+        targetMs: snapshot.policy?.targetStaleAfterMs ?? null,
+        converged: snapshot.convergence?.converged ?? null,
+    };
+}
+//# sourceMappingURL=status.js.map

package/dist/src/housekeeper/units.js

@@ -0,0 +1,114 @@
+/**
+ * Autostart unit renderers for `aiwg housekeeper install` (epic #3353 B5).
+ *
+ * Platform matrix (design note §3): Linux + systemd is documented;
+ * Linux without systemd and macOS fall back to foreground `start` or an
+ * external timer calling `run-once`; Windows is unsupported (WSL2 follows
+ * the Linux rows). Units are pure strings here so `--dry-run` can print
+ * them without writing and tests can assert content with an injected
+ * platform. This module never enables anything: enabling is an explicit
+ * operator step printed by the handler, never performed implicitly.
+ */
+import os from 'node:os';
+import path from 'node:path';
+export const HOUSEKEEPER_SERVICE_NAME = 'aiwg-housekeeper.service';
+export const HOUSEKEEPER_TIMER_NAME = 'aiwg-housekeeper.timer';
+export const HOUSEKEEPER_LAUNCHD_LABEL = 'dev.aiwg.housekeeper';
+export function renderSystemdService(ctx) {
+    const node = ctx.nodeBin ?? process.execPath;
+    const runOnce = ctx.jobId
+        ? `${quote(ctx.aiwgBin)} housekeeper run-once --job ${quote(ctx.jobId)}`
+        : `${quote(ctx.aiwgBin)} housekeeper run-once`;
+    return [
+        '[Unit]',
+        'Description=AIWG housekeeper (deterministic maintenance, oneshot for timer)',
+        'Documentation=https://github.com/jmagly/aiwg',
+        '',
+        '[Service]',
+        'Type=oneshot',
+        `WorkingDirectory=${ctx.cwd}`,
+        `ExecStart=${node} ${runOnce}`,
+        'NoNewPrivileges=true',
+        '',
+        '[Install]',
+        'WantedBy=default.target',
+        '',
+    ].join('\n');
+}
+export function renderSystemdTimer(options = {}) {
+    return [
+        '[Unit]',
+        'Description=AIWG housekeeper periodic run (calls aiwg housekeeper run-once)',
+        '',
+        '[Timer]',
+        `OnCalendar=${options.calendar ?? 'hourly'}`,
+        'Persistent=true',
+        `Unit=${HOUSEKEEPER_SERVICE_NAME}`,
+        '',
+        '[Install]',
+        'WantedBy=timers.target',
+        '',
+    ].join('\n');
+}
+/**
+ * Best-effort macOS plist (design note §3: documented, not CI-tested —
+ * there is no macOS runner). Runs `run-once` on a calendar interval.
+ */
+export function renderLaunchdPlist(ctx, options = {}) {
+    const node = ctx.nodeBin ?? process.execPath;
+    const args = ctx.jobId
+        ? [ctx.aiwgBin, 'housekeeper', 'run-once', '--job', ctx.jobId]
+        : [ctx.aiwgBin, 'housekeeper', 'run-once'];
+    const argsXml = [node, ...args].map((arg) => `    <string>${xmlEscape(arg)}</string>`).join('\n');
+    return [
+        '<?xml version="1.0" encoding="UTF-8"?>',
+        '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+        '<plist version="1.0">',
+        '<dict>',
+        '  <key>Label</key>',
+        `  <string>${HOUSEKEEPER_LAUNCHD_LABEL}</string>`,
+        '  <key>ProgramArguments</key>',
+        '  <array>',
+        argsXml,
+        '  </array>',
+        '  <key>WorkingDirectory</key>',
+        `  <string>${xmlEscape(ctx.cwd)}</string>`,
+        '  <key>StartInterval</key>',
+        `  <integer>${options.intervalSeconds ?? 3600}</integer>`,
+        '  <key>RunAtLoad</key>',
+        '  <false/>',
+        '</dict>',
+        '</plist>',
+        '',
+    ].join('\n');
+}
+/** Default `aiwg` entry point under a framework root (overridable in tests). */
+export function defaultAiwgBin(frameworkRoot) {
+    return path.join(frameworkRoot, 'bin', 'aiwg.mjs');
+}
+/** XDG user systemd directory (`~/.config/systemd/user` by default). */
+export function systemdUserDir(home = os.homedir()) {
+    const base = process.env['XDG_CONFIG_HOME'] || path.join(home, '.config');
+    return path.join(base, 'systemd', 'user');
+}
+/** macOS user agent directory. */
+export function launchdAgentDir(home = os.homedir()) {
+    return path.join(home, 'Library', 'LaunchAgents');
+}
+export function backendForPlatform(platform) {
+    if (platform === 'win32')
+        return 'unsupported';
+    if (platform === 'darwin')
+        return 'launchd';
+    return 'systemd-user';
+}
+function quote(value) {
+    return /[\s"']/.test(value) ? `"${value.replace(/"/g, '\\"')}"` : value;
+}
+function xmlEscape(value) {
+    return value
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;');
+}
+//# sourceMappingURL=units.js.map

package/dist/src/jobs/flow.js

@@ -2,6 +2,7 @@ import { promises as fs } from 'node:fs';
 import path from 'node:path';
 import { load as loadYaml } from 'js-yaml';
 import { z } from 'zod';
+import { integer, url } from '../schema/zod-validation.mjs';
 import { JOB_API_VERSION, JOB_KIND } from './types.js';
 const relativeFile = z.string().min(1).refine(value => {
     if (path.isAbsolute(value))
@@ -12,51 +13,51 @@ const relativeFile = z.string().min(1).refine(value => {
 const absolutePath = z.string().min(1)
     .refine(path.isAbsolute, 'must be an absolute path')
     .refine(value => path.resolve(value) !== path.parse(path.resolve(value)).root, 'must not be a filesystem root');
-const httpsOrigin = z.string().url().refine(value => new URL(value).protocol === 'https:', 'must use https');
+const httpsOrigin = url().refine(value => new URL(value).protocol === 'https:', 'must use https');
 const accountName = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_.@:-]{0,127}$/u);
-export const externalJobFlowSchema = z.object({
+export const externalJobFlowSchema = z.strictObject({
     apiVersion: z.literal(JOB_API_VERSION),
     kind: z.literal(JOB_KIND),
-    metadata: z.object({
+    metadata: z.strictObject({
         name: z.string().regex(/^[a-z][a-z0-9-]{0,62}$/u),
         revision: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u),
-    }).strict(),
-    spec: z.object({
-        trigger: z.object({ type: z.literal('external') }).strict(),
-        executor: z.object({
+    }),
+    spec: z.strictObject({
+        trigger: z.strictObject({ type: z.literal('external') }),
+        executor: z.strictObject({
             provider: z.literal('codex'),
             mode: z.literal('exec'),
             workspace: absolutePath,
             prompt: relativeFile,
             resultSchema: relativeFile,
             binary: absolutePath,
-        }).strict(),
-        workItem: z.object({
+        }),
+        workItem: z.strictObject({
             provider: z.literal('gitea'),
-            baseUrl: z.string().url().refine(value => new URL(value).protocol === 'https:', 'must use https'),
+            baseUrl: url().refine(value => new URL(value).protocol === 'https:', 'must use https'),
             repository: z.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/u),
             tokenFile: absolutePath,
             eligibleLabels: z.array(z.string().min(1)).min(1),
-            claimTtlSeconds: z.number().int().min(30).max(86400).optional(),
-            claimSettleMs: z.number().int().min(100).max(30000).optional(),
-        }).strict(),
-        approval: z.object({
+            claimTtlSeconds: integer().min(30).max(86400).optional(),
+            claimSettleMs: integer().min(100).max(30000).optional(),
+        }),
+        approval: z.strictObject({
             required: z.boolean().optional(),
             label: z.string().min(1).optional(),
-        }).strict().optional(),
-        security: z.object({
+        }).optional(),
+        security: z.strictObject({
             allowedOrigins: z.array(httpsOrigin).min(1),
             allowedAccounts: z.array(accountName).min(1),
             approvedAttachmentRoots: z.array(absolutePath),
             sensitiveValueFiles: z.array(absolutePath).optional(),
-        }).strict(),
-        completion: z.object({
+        }),
+        completion: z.strictObject({
             require: z.array(z.enum([
                 'external-result-url', 'issue-comment', 'idempotency-key', 'verification',
             ])).min(1),
-        }).strict(),
-    }).strict(),
-}).strict().superRefine((flow, ctx) => {
+        }),
+    }),
+}).superRefine((flow, ctx) => {
     const workspace = path.resolve(flow.spec.executor.workspace);
     const within = (candidate) => {
         const relative = path.relative(workspace, path.resolve(candidate));

package/dist/src/lint/rule-activation.js

@@ -1,5 +1,8 @@
+/** Activation checks within the existing lint runner, not a delivery selector. */
+import fs from 'node:fs';
+import path from 'node:path';
 import { loadLocalCapabilityEntries, resolveRuleBindingTarget } from '../artifacts/query-engine.js';
-import { parseRuleFrontmatter, RULE_BINDING_TYPES } from '../rules/activation.mjs';
+import { parseRuleFrontmatter, RULE_BINDING_TYPES, coreBodyPath, validateCoreBody } from '../rules/activation.mjs';
 export const ruleActivationRuleset = {
     id: 'rule-activation', name: 'Rule activation', framework: 'core', version: '1.0.0',
     description: 'Validate rule and behavior activation contracts and exact indexed bindings',
@@ -10,17 +13,29 @@ export const ruleActivationRuleset = {
             checks: [{ type: 'rule-activation' }],
         }],
 };
-export function lintRuleActivation(content, file, projectRoot, entries) {
-    // Generated structural indexes are not authored rules.
-    if (/^(?:RULES-INDEX|RULES-ONDEMAND)\.md$/.test(file.split('/').pop()))
+export function lintRuleActivation(content, file, projectRoot, entries, absolutePath) {
+    // Directory documentation and generated indexes are not authored rules.
+    if (/^(?:README|RULES-INDEX|RULES-ONDEMAND)\.md$/.test(file.split('/').pop()))
         return [];
+    // <rule>.core.md is a delivery body (#3450), validated through its owning rule.
+    if (/\.core\.md$/.test(file))
+        return [];
+    const shipped = /(?:^|\/)agentic\/code\//.test((absolutePath ?? path.resolve(projectRoot, file)).replaceAll('\\', '/'));
     const result = parseRuleFrontmatter(content);
     const diagnostics = result.diagnostics.map(item => ({
         ruleId: 'rules/activation', ruleName: 'Rule activation contract',
-        file, severity: item.severity, message: item.message,
+        file, severity: item.code === 'missing-activation' && shipped ? 'error' : item.severity, message: item.message,
     }));
     if (!result.rule)
         return diagnostics;
+    if (result.rule.activation === 'core') {
+        const body = coreBodyPath(absolutePath ?? (path.isAbsolute(file) ? file : path.resolve(projectRoot, file)));
+        const problems = fs.existsSync(body)
+            ? validateCoreBody(fs.readFileSync(body, 'utf8').trim(), path.basename(body))
+            : [`${path.basename(body)}: activation core requires a compact body file beside the rule`];
+        for (const message of problems)
+            diagnostics.push({ ruleId: 'rules/activation', ruleName: 'Rule activation contract', file, severity: 'error', message });
+    }
     const bindings = result.rule.bound_to;
     if (!Object.values(bindings).some(list => list.length > 0))
         return diagnostics;

package/dist/src/lint/runner.js

@@ -563,7 +563,7 @@ async function runRule(rule, targetDir, allFiles, referenceIndex, projectRoot, a
             if (check.type === 'id-unique')
                 continue; // Already handled
             if (check.type === 'rule-activation') {
-                diagnostics.push(...lintRuleActivation(content, file, projectRoot, artifactEntries));
+                diagnostics.push(...lintRuleActivation(content, file, projectRoot, artifactEntries, absPath));
                 continue;
             }
             const checkDiagnostics = runCheck(check, content, frontmatter, file, targetDir, allFiles, referenceIndex, projectRoot);

package/dist/src/mcp/cli.mjs

@@ -8,6 +8,7 @@
 
 import { startServer, createServer } from './server.mjs';
 import { assertConfigDestination, assertConfigObject, assertProjectCredentials, isPathInsideDir, classifyMcpDestination, projectCredentialRemedy, writeConfigAtomic, writeConfigTransaction } from './config-file.mjs';
+import { replaceServer } from './toml-editor.mjs';
 import fs from 'fs/promises';
 import path from 'path';
 import os from 'os';
@@ -335,16 +336,14 @@ enabled_tools = [
           if (error.code !== 'ENOENT') throw error;
         }
 
-        // Check if AIWG MCP already configured
-        if (existing.includes('[mcp_servers.aiwg]')) {
+        // Parse before deciding whether to write, including already configured files.
+        const edited = replaceServer(existing, 'aiwg', tomlContent.trim());
+        if (edited.alreadyPresent) {
           console.log('AIWG MCP already configured in ~/.codex/config.toml');
           return true;
         }
 
-        // Append TOML config
-        const updated = existing.trimEnd() + '\n' + tomlContent.trim() + '\n';
-
-        await writeConfigAtomic(configPath, updated, { userScope: true });
+        await writeConfigAtomic(configPath, edited.text, { userScope: true });
         console.log(`MCP configuration appended to: ${configPath}`);
         console.log(`\nTo use AIWG MCP server with Codex:`);
         console.log(`  1. Restart Codex CLI`);

package/dist/src/mcp/config-file.mjs

@@ -187,11 +187,15 @@ export async function writeConfigAtomic(file, content, { userScope = false, proj
   if (rejectSymlinkParents) await assertNoSymlinkParents(file, symlinkRoot);
   const info = await assertConfigDestination(file, projectRoot);
   const mode = restoreMode ?? (userScope ? 0o600 : info ? info.mode & 0o7777 : newFileMode ?? 0o666);
-  await mkdir(dirname(file), { recursive: true });
+  // Restrict newly created parents for private settings, ownership and output files.
+  // Recursive mkdir leaves every existing directory's permissions unchanged.
+  await mkdir(dirname(file), { recursive: true, mode: (mode & 0o077) === 0 ? 0o700 : undefined });
   const temporary = `${file}.${randomUUID()}.tmp`;
   let handle;
+  let created = false;
   try {
     handle = await open(temporary, 'wx', mode);
+    created = true;
     await handle.writeFile(content, 'utf-8');
     if (userScope || info || restoreMode !== undefined || newFileMode !== undefined) await handle.chmod(mode);
     await handle.sync();
@@ -204,7 +208,7 @@ export async function writeConfigAtomic(file, content, { userScope = false, proj
     try {
       if (handle) await handle.close();
     } finally {
-      await unlink(temporary).catch(() => {});
+      if (created) await unlink(temporary).catch(() => {});
     }
   }
 }