@aiwg/cli 2026.10.5 → 2026.10.7

package/dist/src/cli/handlers/index.js

@@ -20,6 +20,7 @@ import { prefillCardsHandler, contributeStartHandler, validateMetadataHandler, d
 import { skillLintHandler } from './skill-lint.js';
 import { addAgentHandler, addCommandHandler, addSkillHandler, addBehaviorHandler, addTemplateHandler, scaffoldAddonHandler, scaffoldExtensionHandler, scaffoldFrameworkHandler, scaffoldingHandlers, } from './scaffolding.js';
 import { behaviorHandler, daemonInitHandler, daemonHandlers, } from './daemon.js';
+import { housekeeperHandler, housekeeperHandlers, } from './housekeeper.js';
 import { ralphHandler, ralphStatusHandler, ralphAbortHandler, ralphResumeHandler, ralphAttachHandler, ralphExternalHandler, ralphMemoryHandler, ralphConfigHandler, ralphHandlers, } from './ralph.js';
 import { mcpHandler, catalogHandler, listHandler, removeHandler, promoteHandler, newBundleHandler, quickrefHandler, newProjectHandler, installPluginHandler, uninstallPluginHandler, pluginStatusHandler, packagePluginHandler, packageAllPluginsHandler, indexHandler, corpusHandler, discoverHandler, showHandler, featuresHandler, skillsHandler, configHandler, opsHandler, storageHandler, activityLogHandler, kbHandler, memoryHandler, reflectionsHandler, provenanceHandler, researchStoreHandler, researchQueryHandler, chunkHandler, fanoutHandler, rlmPrepHandler, rlmSearchHandler, rlmStatusCliHandler, rlmCacheHandler, subcommandHandlers, } from './subcommands.js';
 import { runtimeInfoHandler } from './runtime-info.js';
@@ -97,7 +98,7 @@ installPluginHandler, uninstallPluginHandler, pluginStatusHandler, packagePlugin
 // Scaffolding
 addAgentHandler, addCommandHandler, addSkillHandler, addBehaviorHandler, addTemplateHandler, scaffoldAddonHandler, scaffoldExtensionHandler, scaffoldFrameworkHandler, 
 // Daemon
-behaviorHandler, daemonInitHandler, 
+behaviorHandler, daemonInitHandler, housekeeperHandler, 
 // Ralph
 ralphHandler, ralphStatusHandler, ralphAbortHandler, ralphResumeHandler, ralphAttachHandler, ralphExternalHandler, ralphMemoryHandler, ralphConfigHandler, 
 // Mission Control
@@ -123,7 +124,7 @@ repoAccessHandler,
 // Lint
 lintHandler, };
 // Re-export handler arrays
-export { workspaceHandlers, utilityHandlers, scaffoldingHandlers, ralphHandlers, subcommandHandlers, mcHandlers, missionHandlers, teamHandlers, stewardHandlers, regenerateHandlers, workspaceContextHandlers, artifactsHandlers, effectHandlers, daemonHandlers, sandboxHandlers, repoAccessHandlers, };
+export { workspaceHandlers, utilityHandlers, scaffoldingHandlers, housekeeperHandlers, ralphHandlers, subcommandHandlers, mcHandlers, missionHandlers, teamHandlers, stewardHandlers, regenerateHandlers, workspaceContextHandlers, artifactsHandlers, effectHandlers, daemonHandlers, sandboxHandlers, repoAccessHandlers, };
 /**
  * All registered command handlers
  *
@@ -222,6 +223,7 @@ export const allHandlers = [
     bestPracticesAuditHandler,
     // Daemon
     ...daemonHandlers,
+    ...housekeeperHandlers,
     // Config
     configHandler,
     executionModeHandler,

package/dist/src/cli/handlers/init.js

@@ -35,7 +35,10 @@ import { ensureWorkspaceContext } from '../../smiths/context-pipeline/workspace-
 import { detectInstalledWorkerClis, evaluateWorkerDispatchOffer, workerDispatchOfferQuestion, workerDispatchOfferHintWithArg, parseWorkerDispatchArg, } from '../../models/worker-dispatch-offer.js';
 import { EXIT_CODES } from '../errors.js';
 import { isInteractive } from '../env.js';
+import { parseGuidedSetupFlags, runGuidedSetup } from './guided-setup.js';
 import { requireFlagValue, collectFlagValues, parseBooleanFlagValue, parseListFlagValue, parseKeyValueEntry, MissingFlagValueError, } from '../flag-parsing.js';
+/** Default project scripts installed by init and merged by guided setup apply. */
+export const DEFAULT_SCRIPTS = { deploy: 'aiwg use all', doctor: 'aiwg doctor', sync: 'aiwg sync' };
 const PROVIDER_LABELS = {
     antigravity: 'Google Antigravity .agents/',
     claude: 'Claude Code       .claude/',
@@ -104,7 +107,7 @@ function renderWorkerDispatchHintIfApplicable(parallelism, setup) {
     if (offer.shouldOffer)
         ui.dim(`  ${workerDispatchOfferHintWithArg(offer.detected)}`);
 }
-function parseInitArgInputs(args) {
+export function parseInitArgInputs(args) {
     // #3062 second review, finding 4: `precedence: 'first'` matches this
     // command's pre-existing (and, for `--providers`/`--default-scripts`/
     // `--script`/`--custom-scripts`, only) convention — see
@@ -181,6 +184,27 @@ export const initHandler = {
     description: 'Initialise the baseline .aiwg/aiwg.config for an agent-led project setup',
     category: 'project',
     aliases: [],
+    async help() {
+        return { exitCode: 0, rawOutput: true, message: `Usage: aiwg init [options]
+
+  --scope project|user            Record a guided setup plan (no config writes)
+  --intent code|docs|ops|mixed     Workspace usage intent
+  --jev enable|decline|defer     Optional external decision service (default off)
+  --region <r> --endpoint <url> --verify --remove --token-stdin  Existing Jev options
+  --credential <provider>=stdin|file:PATH|store:NAME|env:NAME  Credential reference only
+  --providers <list>              Provider IDs
+  --default-scripts true|false    Include default scripts
+  --custom-scripts true|false     Include custom scripts
+  --script <name>=<command>       Custom script (repeatable)
+  --worker-dispatch enable|decline  Worker dispatch choice
+  --force                        Re-enter existing settings
+  --non-interactive, --yes        Disable prompts
+  --dry-run                      Preview without saving
+
+The new --scope, --intent or --credential flags select guided planning.
+Progress resumes from the workspace's saved plan. Apply is a separate step.
+` };
+    },
     async execute(ctx) {
         const force = ctx.args.includes('--force');
         // `--non-interactive`/`--yes` are this command's own explicit flags for
@@ -204,13 +228,22 @@ export const initHandler = {
         let defaultScriptsArg;
         let customScriptsArg;
         let scriptPairs;
+        let guidedFlags;
         try {
+            guidedFlags = parseGuidedSetupFlags(ctx.args, 'init');
             ({ workerDispatchArg, providersArg, defaultScriptsArg, customScriptsArg, scriptPairs } = parseInitArgInputs(ctx.args));
         }
         catch (err) {
             const message = err instanceof MissingFlagValueError ? `${err.message}.` : err instanceof Error ? err.message : String(err);
             return { exitCode: EXIT_CODES.USAGE, message };
         }
+        if (guidedFlags.enabled) {
+            const hasScripts = defaultScriptsArg !== undefined || customScriptsArg !== undefined || Object.keys(scriptPairs).length > 0;
+            return runGuidedSetup(ctx, guidedFlags, { providers: providersArg, workerDispatch: workerDispatchArg,
+                ...(hasScripts ? { scripts: { defaultScripts: defaultScriptsArg ?? true,
+                        customScripts: customScriptsArg ?? Object.keys(scriptPairs).length > 0, scripts: scriptPairs } } : {}),
+            }, !nonInteractive, projectDir);
+        }
         ui.blank();
         console.log(`  ${ui.brandMark()} ${ui.bold('AIWG Baseline Config')}`);
         ui.rule();
@@ -277,7 +310,6 @@ export const initHandler = {
         let providers;
         let scripts = {};
         let workerDispatchDecision;
-        const DEFAULT_SCRIPTS = { deploy: 'aiwg use all', doctor: 'aiwg doctor', sync: 'aiwg sync' };
         if (nonInteractive) {
             // Non-interactive: an explicit `--providers`/`--default-scripts`
             // answers the corresponding wizard input directly (review item 10);
@@ -382,12 +414,15 @@ export const initHandler = {
         await writeAiwgConfig(projectDir, config);
         if (workerDispatchDecision?.kind === 'enable')
             ui.info('Next: aiwg doctor --probe-workers --qualify.');
-        const normalizedAiwgMdPath = await writeNormalizedAiwgMd(projectDir);
-        const workspace = await ensureWorkspaceContext(projectDir);
+        const skipContext = ctx.args.includes('--no-context-files');
+        const normalizedAiwgMdPath = skipContext ? null : await writeNormalizedAiwgMd(projectDir);
+        const workspace = skipContext ? null : await ensureWorkspaceContext(projectDir);
         ui.blank();
         ui.success(`Created ${getConfigPath(projectDir)}`);
-        ui.success(`Created ${normalizedAiwgMdPath}`);
-        ui.success(`${workspace.action === 'created' ? 'Created' : 'Preserved'} WORKSPACE.md`);
+        if (normalizedAiwgMdPath)
+            ui.success(`Created ${normalizedAiwgMdPath}`);
+        if (workspace)
+            ui.success(`${workspace.action === 'created' ? 'Created' : 'Preserved'} WORKSPACE.md`);
         ui.success(`Providers: ${providers.join(', ')}`);
         if (Object.keys(scripts).length > 0) {
             ui.success(`Scripts: ${Object.keys(scripts).join(', ')}`);

package/dist/src/cli/handlers/install.js

@@ -18,6 +18,7 @@
  * @implements #804
  */
 import path from 'path';
+import { sensitiveInputOptions } from '../../auth/sensitive-input.js';
 import { installPackage } from '../../packages/registry.js';
 import { recordDeployment } from '../../packages/package-registry.js';
 import { marketplaceConfigDir, resolveVerificationPolicy } from '../../marketplace/exchange.js';
@@ -59,6 +60,7 @@ export const installHandler = {
                     '  --deploy                Deploy immediately after install',
                     '  --provider <name>       Target provider (claude, copilot, cursor...)',
                     '  --target <dir>          Project directory to deploy into',
+                    '  --token-interactive | --token-stdin | --token-file <path> | --token-store <name> | --token-env <name>',
                     '  --refresh               Force re-pull even if cached',
                     '  --ref <tag-or-sha>      Resolve this ref and lock its immutable commit',
                     '  --package <id>          Select one wrapper when a repository contains several',
@@ -69,6 +71,9 @@ export const installHandler = {
                 ].join('\n'),
             };
         }
+        if (/^https?:\/\/[^/]*@/.test(rawRef)) {
+            return { exitCode: 1, message: 'Credentials in Git URLs are refused; use --token-stdin, --token-file, --token-store or --token-env.' };
+        }
         const deploy = hasFlag(ctx.args, '--deploy');
         const refresh = hasFlag(ctx.args, '--refresh');
         const provider = parseFlag(ctx.args, '--provider') ?? 'claude';
@@ -97,6 +102,7 @@ export const installHandler = {
             const resolvedPolicy = await resolveVerificationPolicy(policyName, scope);
             const installed = await installPackage(rawRef, {
                 refresh,
+                tokenInput: sensitiveInputOptions(ctx.args, 'token'),
                 ref: parseFlag(ctx.args, '--ref'),
                 packageSelector: parseFlag(ctx.args, '--package'),
                 verify,

package/dist/src/cli/handlers/local-executor.js

@@ -18,7 +18,7 @@
  */
 import path from 'path';
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
-import { randomUUID } from 'crypto';
+import { createHash, randomUUID } from 'crypto';
 import { pathToFileURL } from 'node:url';
 import { projectAiwgPath } from '../../config/project-artifacts.js';
 const DEFAULT_PORT = 8200;
@@ -27,7 +27,7 @@ const DEFAULT_AIWG_SERVE = 'http://127.0.0.1:7337';
 /**
  * Resolve or generate-once the executor identity.
  * Written to `.aiwg/local-executor/identity.json` so restarts reuse the same
- * UUID (token reclaim via identity store on the aiwg-serve side).
+ * UUID. The shim separately persists its bearer token to authenticate restarts.
  */
 function resolveExecutorId(override) {
     if (override)
@@ -103,7 +103,7 @@ function warnIfNonLoopback(bind) {
         console.warn('[local-executor] WARNING: binding on non-loopback interface ' + bind + '.\n' +
             '  This executor has isolation:none — agent code runs in the host process.\n' +
             '  Ensure this interface is not reachable by untrusted parties.\n' +
-            '  The executor token will be rotated by aiwg-serve on first non-loopback register.');
+            '  Keep the persisted executor bearer token private.');
     }
 }
 /**
@@ -208,6 +208,8 @@ export const localExecutorServeHandler = {
             restBase,
             wsBase,
             aiwgServeUrl: opts.aiwgServe,
+            token: process.env['AIWG_EXECUTOR_TOKEN'],
+            tokenPath: projectAiwgPath(process.cwd(), 'local-executor', 'tokens', `${createHash('sha256').update(`${opts.aiwgServe}\0${opts.executorId}`).digest('hex')}.json`),
         });
         // Register with aiwg-serve
         let token;

package/dist/src/cli/handlers/marketplace.js

@@ -9,6 +9,7 @@
  */
 import fs from 'node:fs';
 import path from 'node:path';
+import { sensitiveInputOptions } from '../../auth/sensitive-input.js';
 import { searchSkills } from '../../skills/registry.js';
 import { installPackage, listInstalledPackages } from '../../packages/registry.js';
 import { GitAdapter } from '../../packages/adapters/git.js';
@@ -24,7 +25,7 @@ const USAGE = [
     '  aiwg marketplace verify <package|lock>    Verify cached content and receipts offline',
     '  aiwg marketplace export <package> --output <archive.json>',
     '  aiwg marketplace import <archive.json> [--project-local]',
-    '  aiwg marketplace publish <source> --key <pem> --publisher <id>',
+    '  aiwg marketplace publish <source> --publisher <id> [--key-file <pem> | --key-stdin]',
     '  aiwg marketplace remove <catalog-id>',
     '  aiwg marketplace list                    List installed marketplace packages',
     '',
@@ -33,6 +34,11 @@ const USAGE = [
     '  --project-local    Store/read state below the target project .aiwg directory',
     '  --global           Store/read state in the user AIWG directory (default)',
     '  --policy <name>    Named trust policy or JSON policy path',
+    'Git fetch token sources:',
+    '  --token-interactive | --token-stdin | --token-file <path> | --token-store <name> | --token-env <name>',
+    'Publish key sources (multiline PEM):',
+    '  --key-interactive | --key-stdin | --key-file <path> | --key-store <name> | --key-env <name>',
+    '  --key <path>       Compatibility alias for --key-file (private file required)',
 ].join('\n');
 function parseFlag(args, flag) {
     const idx = args.indexOf(flag);
@@ -105,7 +111,10 @@ async function handleAdd(ctx) {
         const requestedRef = parseFlag(ctx.args, '--ref') ?? 'HEAD';
         const adapter = new GitAdapter();
         const source = { gitUrl: argument, ref: requestedRef, label: argument };
-        const cachePath = await adapter.fetch(source, { refresh: hasFlag(ctx.args, '--refresh') });
+        const cachePath = await adapter.fetch(source, {
+            refresh: hasFlag(ctx.args, '--refresh'),
+            tokenInput: sensitiveInputOptions(ctx.args, 'token'),
+        });
         const identity = await inspectGitCheckout(cachePath);
         const candidates = [
             path.join(cachePath, 'aiwg-marketplace-catalog.json'),
@@ -251,6 +260,7 @@ async function handleInstall(ctx) {
         }
         const installed = await installPackage(rawRef, {
             configDir,
+            tokenInput: sensitiveInputOptions(ctx.args, 'token'),
             ref,
             packageSelector: parseFlag(ctx.args, '--package'),
             refresh: hasFlag(ctx.args, '--refresh'),
@@ -342,8 +352,8 @@ async function handlePublish(ctx) {
         return argument;
     const privateKeyPath = parseFlag(ctx.args, '--key');
     const publisher = parseFlag(ctx.args, '--publisher');
-    if (!privateKeyPath || !publisher) {
-        return { exitCode: 1, message: 'Error: Usage: aiwg marketplace publish <source> --key <ed25519.pem> --publisher <id> [--output <dir>]' };
+    if (!publisher) {
+        return { exitCode: 1, message: 'Error: Usage: aiwg marketplace publish <source> [--key-file <ed25519.pem> | --key-stdin] --publisher <id> [--output <dir>]' };
     }
     try {
         const outputDir = parseFlag(ctx.args, '--output') ?? path.join(path.resolve(argument), '.aiwg', 'marketplace');
@@ -355,6 +365,7 @@ async function handlePublish(ctx) {
             sourceDir: argument,
             outputDir,
             privateKeyPath,
+            keyInput: sensitiveInputOptions(ctx.args, 'key'),
             publicKeyPath: parseFlag(ctx.args, '--public-key'),
             keyId: parseFlag(ctx.args, '--key-id'),
             publisher,