@aiwg/cli 2026.10.5 → 2026.10.6

package/tools/agents/providers/windsurf.mjs

@@ -30,6 +30,7 @@ let fs;
 try { const gfs = _require('graceful-fs'); gfs.gracefulify(realFs); fs = realFs; } catch { fs = realFs; }
 import path from 'path';
 import {
+  withRuleDeployment,
   ensureDir,
   listMdFiles,
   listMdFilesRecursive,
@@ -234,6 +235,7 @@ export function mapModel(shorthand, modelCfg, modelsConfig) {
  * Generate AGENTS.md for Windsurf with all agents aggregated
  */
 export function generateAgentsMd(files, destPath, opts) {
+  if (opts.contextFiles === false) return;
   const { dryRun } = opts;
 
   const lines = [];
@@ -507,6 +509,7 @@ export function deploySkills(skillDirs, targetDir, opts) {
  * Deploy rules as discrete files with trigger: always_on frontmatter injected
  */
 export function deployRules(ruleFiles, targetDir, opts) {
+  if (opts.ruleDelivery) return [];
   const destDir = path.join(targetDir, paths.rules);
   ensureDir(destDir, opts.dryRun);
   cleanupOldRuleFiles(destDir, opts);
@@ -534,6 +537,10 @@ export function getFileExtension(type) {
 // ============================================================================
 
 export async function deploy(opts) {
+  return withRuleDeployment(opts, { name, paths, kernelSkillsPath }, deploySelected);
+}
+
+async function deploySelected(opts) {
   const {
     srcRoot,
     target,

package/tools/cli/workspace-status.mjs

@@ -32,6 +32,7 @@ const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 const packageRoot = path.resolve(__dirname, '../..');
 const runtimeRoot = existsSync(path.join(packageRoot, 'src')) ? 'src' : 'dist/src';
+const { readNativeSandboxWarnings } = await importImpl(import.meta.url, 'config/native-sandbox-warnings.js');
 const [{ resolveProjectAiwgDir }, { auditProjectArtifactHealth }] = await Promise.all([
   import(pathToFileURL(path.join(packageRoot, runtimeRoot, 'config/project-artifacts-runtime.mjs')).href),
   import(pathToFileURL(path.join(packageRoot, runtimeRoot, 'config/project-artifacts-health.mjs')).href),
@@ -356,6 +357,7 @@ async function buildWorkspaceStatus(projectRoot) {
   const { rulePinState } = await importImpl(import.meta.url, 'rules/pin-state.js');
   const pins = rulePinState(projectRoot, packageRoot);
   const result = {
+    nativeSandboxWarnings: await readNativeSandboxWarnings(projectRoot).catch(() => []),
     rule_pins: { rules: pins.rules, warnings: pins.warnings },
     decisionOffload: await collectDecisionOffloadReport(projectRoot),
     workspace: {
@@ -545,6 +547,7 @@ async function buildVerificationProbe(projectRoot) {
 
   return {
     schema: 'aiwg.status.probe.v1',
+    nativeSandboxWarnings: workspace.nativeSandboxWarnings,
     rule_pins: workspace.rule_pins,
     generated_at: new Date().toISOString(),
     project_root: path.resolve(projectRoot),
@@ -725,6 +728,7 @@ async function workspaceStatus(args) {
         console.log('='.repeat(60));
         console.log('');
         console.log('No .aiwg/ workspace found in this project.');
+        for (const warning of result.nativeSandboxWarnings) console.log(`Warning: ${warning.message}`);
         console.log('');
         console.log('To create a workspace:');
         console.log('  aiwg use sdlc        # Install SDLC framework');
@@ -741,6 +745,7 @@ async function workspaceStatus(args) {
     }
 
     // Text output
+    for (const warning of result.nativeSandboxWarnings) console.log(`Warning: ${warning.message}`);
     console.log('\nAIWG - Workspace Status');
     console.log('='.repeat(60));
     console.log('');

package/tools/commands/deploy-prompts-codex.mjs

@@ -27,16 +27,14 @@ const _require = createRequire(import.meta.url);
 let fs;
 try { const gfs = _require('graceful-fs'); gfs.gracefulify(realFs); fs = realFs; } catch { fs = realFs; }
 import path from 'path';
+import { fileURLToPath } from 'node:url';
 import os from 'os';
 import { getFrameworksForMode, normalizeDeploymentMode, getAddonSkillDirs, listSkillDirs, collectFrameworkArtifacts } from '../agents/providers/base.mjs';
 
-const CODEX_PROMPTS_DIR = path.join(os.homedir(), '.codex', 'prompts');
-
-function parseArgs() {
-  const args = process.argv.slice(2);
+function parseArgs(args, homeDir) {
   const cfg = {
     source: null,
-    target: CODEX_PROMPTS_DIR,
+    target: path.join(homeDir, '.codex', 'prompts'),
     mode: 'all',
     dryRun: false,
     force: false,
@@ -265,8 +263,8 @@ function getCommandDirectories(srcRoot, mode) {
   return dirs;
 }
 
-(async function main() {
-  const cfg = parseArgs();
+export async function main(args = process.argv.slice(2), internal = {}) {
+  const cfg = parseArgs(args, internal.homeDir || os.homedir());
   const { source, target, mode, dryRun, force, prefix } = cfg;
 
   // Resolve source directory
@@ -333,4 +331,9 @@ function getCommandDirectories(srcRoot, mode) {
     console.log(`\nRestart Codex to load new prompts.`);
     console.log(`Use prompts with: /prompts:${prefix}-<command-name>`);
   }
-})();
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try { await main(); }
+  catch (error) { console.error(error.message); process.exitCode = 1; }
+}

package/tools/ralph-external/lib/codex-adapter.mjs

@@ -75,7 +75,7 @@ const MODEL_MAP = {
  */
 export const CODEX_SUPPORTED_VERSIONS = Object.freeze(['0.161.0']);
 export const CODEX_DIRECT_EFFORT_VALUES = Object.freeze(['minimal', 'low', 'medium', 'high', 'xhigh']);
-export const CODEX_DIRECT_SANDBOX_MODES = Object.freeze(['read-only', 'workspace-write']);
+export const CODEX_DIRECT_SANDBOX_MODES = Object.freeze(['read-only', 'workspace-write', 'external']);
 /** Non-prompting execution only: a requested `on-request` is refused. */
 export const CODEX_DIRECT_APPROVAL_POLICIES = Object.freeze(['never']);
 /** Brief transport for the direct profile: piped stdin, never argv. */
@@ -195,6 +195,10 @@ export class CodexAdapter extends ProviderAdapter {
     };
   }
 
+  // Worker envNames come from the recorded installation environment, filtered
+  // through both registry allowlists. PATH must survive env -i so Codex can
+  // find the host's AppArmor-approved bwrap and system shell tools.
+
   /**
    * Driver-owned argv after the binary for the version-bound direct-shell
    * profile. Every control is explicit: `--ignore-user-config` (user
@@ -252,7 +256,7 @@ export class CodexAdapter extends ProviderAdapter {
       '--ignore-user-config',
       '-m', model,
       '-c', `model_reasoning_effort=${JSON.stringify(effort)}`,
-      '-s', sandbox,
+      '-s', sandbox === 'external' ? 'danger-full-access' : sandbox,
       '-C', cwd,
       '-c', `approval_policy=${JSON.stringify(approval)}`,
       '--skip-git-repo-check',

package/tools/ralph-external/lib/muse-adapter.mjs

@@ -162,12 +162,15 @@ export class MuseAdapter extends ProviderAdapter {
     }
     let schema;
     try { schema = JSON.parse(profile.controls.structuredOutput.mapping); } catch { /* unavailable mapping blocks */ }
-    if (!Array.isArray(schema) || schema.length !== 2 || schema[0] !== '--output-schema'
-      || typeof schema[1] !== 'string' || !path.isAbsolute(schema[1]) || schema[1].includes('\0') || schema[1].split(path.sep).includes('..')) {
+    const directText = profile.controls.structuredOutput.mapping === '[]'
+      && profile.controls.structuredOutput.support === 'unqualified';
+    if (!directText && (!Array.isArray(schema) || schema.length !== 2 || schema[0] !== '--output-schema'
+      || typeof schema[1] !== 'string' || !path.isAbsolute(schema[1]) || schema[1].includes('\0') || schema[1].split(path.sep).includes('..'))) {
       throw new Error('Muse requires a host-bound output-schema control mapping');
     }
     if (!permissions || !['read-only', 'workspace-write', 'external'].includes(permissions.sandbox)
       || !Number.isSafeInteger(health?.maxSteps) || health.maxSteps < 1) throw new Error('Muse requires bounded steps and sandbox authority');
+    if ((permissions.approval ?? 'never') !== 'never') throw new Error('Muse direct worker approval requires never');
     // Trust is a host-owned, qualification-bound control, like the schema.
     // Brief contents and CLI defaults cannot opt into workspace instructions.
     let trust;
@@ -179,6 +182,7 @@ export class MuseAdapter extends ProviderAdapter {
       '--workspace', cwd, ...trust, '--approval-mode', 'never', '--approval-judge', 'off', '--max-model-steps', String(health.maxSteps),
       ...schema, '--prompt-file', briefPath];
     if (permissions.sandbox === 'read-only') args.push('--disable-write', '--disable-shell');
+    if (permissions.sandbox === 'external') args.push('--disable-sandbox');
     return args;
   }
 
@@ -361,4 +365,10 @@ export class MuseAdapter extends ProviderAdapter {
 
 registerProvider('muse', () => new MuseAdapter());
 
+/** Installed worker module contract; legacy registration above remains supported. */
+export const interfaceVersion = 1;
+export function register(factory) {
+  factory('muse', () => new MuseAdapter());
+}
+
 export default MuseAdapter;

package/tools/ralph-external/lib/worker-health.mjs

@@ -123,7 +123,7 @@ export function createWorkerHealthObserver(options = {}) {
   const replayedKeys = new Set();
   const events = [];
   const gaps = [];
-  let sequence = 0, generation = 0, steps = null, total = 0, lastCheck = started, maxGap = 0;
+  let sequence = 0, generation = options.observerGeneration ?? 0, steps = null, total = 0, lastCheck = started, maxGap = 0;
   let observed = null, activity = null, progress = null, heartbeat = null, handshakeAt = null, stalledAt = null;
   let state = 'launching', handshake = 'unobserved', confidence = 'unobserved', reasonCode = 'AWAITING_HANDSHAKE';
   let termination = 'running', transitionCount = 0, live = null, disconnected = false, finalized = false;

package/tools/ralph-external/lib/worker-isolation.mjs

@@ -1,8 +1,10 @@
 /**
  * Worker process isolation for Tier 0 direct dispatch (FR-OG-108, #2954).
  *
- * Direct workers must never share the conductor's cgroup: on the titan host
- * an oomd kill of one shared cgroup took the conductor session with it.
+ * Direct workers default to a separate cgroup: on the titan host an oomd
+ * kill of one shared cgroup took the conductor session with it. Explicit
+ * native-sandbox policy instead uses an owned process group and the CLI's
+ * sandbox, without a cgroup memory limit or descendant kill scope.
  * This module builds `systemd-run --user` launch arguments (own unit or
  * scope with `MemoryMax` and `MemorySwapMax=0`, PATH/HOME passthrough,
  * stdin `/dev/null`) and, where no systemd user manager exists, returns an
@@ -40,6 +42,50 @@ import { buildSystemdClientEnv, resolveSystemdClient, resolveSystemdRun, CONNECT
 
 const UNIT_SAFE = /[^A-Za-z0-9:_.@-]/g;
 const transportBootstrapVariables = ['NODE_OPTIONS', 'NODE_PATH', 'LD_PRELOAD', 'LD_LIBRARY_PATH', 'LD_AUDIT', 'LD_DEBUG', 'LD_DEBUG_OUTPUT'];
+const nativeSandboxProbes = new Map();
+let nativeSandboxProbeSequence = 0;
+export const NATIVE_SANDBOX_UNAVAILABLE = 'OG_NATIVE_SANDBOX_UNAVAILABLE';
+
+export function workerNeedsNativeNamespaces(adapter, permissions = {}, platform = process.platform) {
+  return platform === 'linux' && adapter?.provider === 'codex'
+    && (permissions.transport ?? 'shell') === 'shell'
+    && ['read-only', 'workspace-write'].includes(permissions.sandbox ?? 'workspace-write');
+}
+
+export function nativeSandboxFailure(text) {
+  return /loopback: Failed RTM_NEWADDR: Operation not permitted|uid_map[^\n]*Operation not permitted/i.test(text);
+}
+
+export function nativeSandboxProbeMessage(result) {
+  return `${NATIVE_SANDBOX_UNAVAILABLE}: Native sandbox unavailable: restricted unprivileged user namespaces inside systemd user units (host AppArmor policy may restrict userns). Probe: ${String(result.detail ?? 'failed').replace(/[\x00-\x1f\x7f]/g, ' ').slice(0, 512)}. Select parallelism.groups.<group>.execution.launchMode="native-sandbox" with a verified enforcing CLI sandbox, or configure a host AppArmor allowance for the systemd worker launch path.`;
+}
+
+/** No inference: exercise user/network namespaces through the worker's unit and client environment path. */
+export function probeWorkerNativeSandbox({ spawn = spawnSync, env = process.env, envNames = ['PATH', 'HOME'], cwd,
+  cache = spawn === spawnSync ? nativeSandboxProbes : undefined } = {}) {
+  const key = JSON.stringify([cwd, [...envNames].sort()]);
+  if (cache?.has(key)) return cache.get(key);
+  let result;
+  try {
+    const managerEnvNames = resolveManagerEnvNames({ spawn });
+    const command = process.execPath;
+    const args = [fileURLToPath(import.meta.url), '--worker-environment', JSON.stringify(unitEnvironmentNames(envNames)),
+      '--', '/usr/bin/unshare', '--user', '--map-root-user', '--net', '/usr/bin/true'];
+    const argv = buildWorkerIsolationArgs({ unit: proposeWorkerUnitName(`sandbox-probe-${process.pid}-${++nativeSandboxProbeSequence}`),
+      command, args, cwd, env, envNames, managerEnvNames, memoryMaxGb: 0.25, attached: true,
+      extraProperties: ['RuntimeMaxSec=5s', 'TimeoutStopSec=1s'] });
+    const observed = spawn(resolveSystemdRun(), ['--collect', ...argv.slice(1)], {
+      encoding: 'utf8', timeout: 8000, maxBuffer: 4096, env: buildSystemdClientEnv({ env, envNames }) });
+    result = observed.status === 0 && !observed.error ? { ok: true, mode: 'systemd-unit' }
+      : { ok: false, mode: 'systemd-unit', code: NATIVE_SANDBOX_UNAVAILABLE,
+        detail: String(observed.error?.message ?? (String(observed.stderr ?? '').trim() || `exit ${observed.status}`)).replace(/[\x00-\x1f\x7f]/g, ' ').slice(0, 512) };
+  } catch (error) {
+    result = { ok: false, mode: 'systemd-unit', code: NATIVE_SANDBOX_UNAVAILABLE,
+      detail: String(error.message).replace(/[\x00-\x1f\x7f]/g, ' ').slice(0, 512) };
+  }
+  cache?.set(key, result);
+  return result;
+}
 
 /** Derive a unit-safe `aiwg-worker-<name>-<epoch>` unit name. */
 export function proposeWorkerUnitName(name, nowSeconds = Math.floor(Date.now() / 1000)) {
@@ -340,6 +386,7 @@ export function launchIsolatedWorker({
   config,
   allowDegraded = false,
   isolation,
+  workerGroup,
   kind = 'unit',
   attached = false,
   spawn = spawnSync,
@@ -368,6 +415,15 @@ export function launchIsolatedWorker({
     return { launched: false, blocked: true, failures: resolvedGate.failures ?? [], gate: resolvedGate };
   }
   const detected = isolation ?? detectWorkerIsolation({ spawn });
+  const nativeSandbox = detected.mode === 'native-sandbox';
+  if (nativeSandbox) {
+    const execution = config?.parallelism?.groups?.[workerGroup]?.execution;
+    if (execution?.launchMode !== 'native-sandbox' || !['read-only', 'workspace-write'].includes(execution.sandbox)
+      || (execution.transport ?? 'shell') !== 'shell' || !attached || !ownedGroup) {
+      throw Object.assign(new Error('native-sandbox requires policy opt-in and an owned attached process group with an enforcing native sandbox'),
+        { code: 'OG_POLICY_RELAXATION' });
+    }
+  }
   if (detected.mode === 'degraded' && !allowDegraded) {
     return {
       launched: false,
@@ -376,7 +432,7 @@ export function launchIsolatedWorker({
       gate: resolvedGate,
     };
   }
-  if (detected.mode === 'degraded') {
+  if (detected.mode === 'degraded' || nativeSandbox) {
     assertAbsolute('worker binary', command);
     if (cwd !== undefined) assertAbsolute('working directory', cwd);
     if (stdinPath !== undefined) assertAbsolute('stdin brief', stdinPath);
@@ -385,7 +441,7 @@ export function launchIsolatedWorker({
     if (!Array.isArray(args) || args.some(token => typeof token !== 'string' || token.includes('\0'))) {
       throw new Error('Worker isolation argv must be NUL-free strings');
     }
-    // Degraded mode has no systemd unit to confine the environment, so this
+    // Process-group modes have no systemd unit to confine the environment, so this
     // module builds the allowlisted environment itself and passes it as the
     // child's *entire* environment (the `env` option replaces, never merges
     // with, the current process environment) — the functional equivalent of
@@ -441,12 +497,12 @@ export function launchIsolatedWorker({
       }
       const result = _runDispatchCommit(onDispatchCommit, () => {
         const child = spawnAsync(launchCommand, launchArgs, launchOptions);
-        onSpawnAttempt?.({ mode: 'degraded', child, pid: child.pid });
+        onSpawnAttempt?.({ mode: detected.mode, child, pid: child.pid });
         const outcome = {
           launched: Number.isInteger(child.pid) && child.pid > 0,
-          mode: 'degraded', child, pid: child.pid,
+          mode: detected.mode, child, pid: child.pid,
           ...(attached ? { transportSupervisor: true } : {}),
-          diagnostic: `launched without resource confinement: ${detected.reason}`,
+          diagnostic: nativeSandbox ? 'Native CLI sandbox boundary; no cgroup resource confinement' : `launched without resource confinement: ${detected.reason}`,
           gate: resolvedGate,
         };
         // Preserve launch errors even when callers attach listeners later.
@@ -661,8 +717,8 @@ export function runWorkerTransport({ command, args, environment, record,
 }
 
 // Private attached transport entry, never a public CLI or legacy Ralph route.
-// The systemd unit owns this supervisor and its worker; cgroup exit evidence
-// includes descendants. Only the actual worker receives the allowed values.
+// The unit or launcher-owned process group owns this supervisor and worker.
+// Only unit cgroup exit evidence covers descendants. The worker receives only allowed values.
 if (process.argv[1] === fileURLToPath(import.meta.url) && process.argv[2] === '--worker-environment') {
   process.umask(0o077);
   const names = JSON.parse(process.argv[3]);

package/tools/ralph-external/process-monitor.mjs

@@ -843,7 +843,10 @@ async function captureSizes(directory) {
 /** Readers never create a monitor, walk a worktree or execute a subprocess. */
 export async function sampleWorkerStatus(options, memory = new Map()) {
   const now = options.now?.() ?? Date.now(), sampledAt = new Date(now).toISOString();
-  const began = monotonicMs();
+  // Use one monotonic source for worker age and the sampling budget. Injected
+  // lifecycle traces must not expire because the host descheduled their I/O.
+  const monotonicNow = options.monotonicNow ?? monotonicMs;
+  const began = monotonicNow();
   const report = { version: 1, sampledAt, scope: 'direct-conductor', observerCoverage: 'unobserved',
     workers: [], breakers: [], nextCheckAt: null, complete: true, findings: [], exitCode: 0 };
   let root;
@@ -853,10 +856,10 @@ export async function sampleWorkerStatus(options, memory = new Map()) {
       : await boundedEntries(root, STATUS_LIMITS.directories);
     report.complete = listing.complete;
     if (!listing.complete) { report.findings.push('SELECTION_LIMIT: narrow --runs-root'); report.exitCode = 2; }
-    const sampleTime = options.monotonicNow?.() ?? monotonicMs();
+    const sampleTime = monotonicNow();
     const bootId = options.bootId ?? (() => { try { return readFileSync('/proc/sys/kernel/random/boot_id', 'utf8').trim(); } catch { return null; } })();
     for (const entry of listing.entries) {
-      if (monotonicMs() - began >= STATUS_LIMITS.sampleMs) {
+      if (monotonicNow() - began >= STATUS_LIMITS.sampleMs) {
         report.complete = false; report.findings.push('SAMPLE_BUDGET: narrow selection'); if (report.exitCode !== 1) report.exitCode = 2; break;
       }
       let directory;
@@ -894,7 +897,7 @@ export async function sampleWorkerStatus(options, memory = new Map()) {
             row.findings.push(code); report.findings.push(`${row.invocationId}: ${code}`);
           }
         }
-        if (monotonicMs() - began >= STATUS_LIMITS.sampleMs) {
+        if (monotonicNow() - began >= STATUS_LIMITS.sampleMs) {
           report.complete = false; report.findings.push('SAMPLE_OVERRUN: observation unavailable; narrow selection');
           row.health.coverage = 'degraded'; row.health.unavailableSignals.push('observer-continuity'); row.nextAction = 'RESTORE_OBSERVATION';
         }