@aiwg/cli 2026.10.5 → 2026.10.7

package/dist/src/housekeeper/daemon-config.js

@@ -0,0 +1,148 @@
+/**
+ * Daemon config access for `aiwg housekeeper` (epic #3353 slice B5).
+ *
+ * Mirrors the file precedence of `tools/daemon/config.mjs` (YAML, then YML,
+ * then JSON) without importing `tools/` — `src/` must never import `tools/`
+ * (tools import compiled src via `importImpl`). Only the `schedule.jobs`
+ * and `watch.paths` sections plus `daemon.profile` are read or written;
+ * every other key is preserved byte-for-byte through a YAML round-trip.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import YAML from 'yaml';
+import { parseMemoryAuditOptions } from '../memory/cli.js';
+export const HOUSEKEEPER_PROFILE = 'housekeeper';
+/**
+ * Deterministic maintenance kinds. Mirrors `MAINTENANCE_KINDS` in
+ * `tools/daemon/scheduled-task-runner.mjs` — that module owns execution;
+ * this list only validates `job register` input on the CLI side.
+ */
+export const MAINTENANCE_KINDS = Object.freeze([
+    'index.verify',
+    'index.reconcile',
+    'cache.retention',
+    'update.check',
+    'update.install',
+    'index.freshness',
+    'index.refresh',
+    'cache.prune',
+    'memory.audit',
+    'memory.recommend',
+    'memory.apply',
+]);
+/** Same argument contract for registration, daemon configuration and dispatch. */
+export function validateMemoryJobArgs(kind, args = {}) {
+    if (!kind.startsWith('memory.'))
+        return;
+    if (!['memory.audit', 'memory.recommend', 'memory.apply'].includes(kind))
+        throw new Error(`Unsupported memory kind: ${kind}`);
+    if (!args || typeof args !== 'object' || Array.isArray(args))
+        throw new Error('Memory job args must be an object');
+    const values = args;
+    const allowed = kind === 'memory.apply' ? ['plan', 'confirmedDigest', 'windows']
+        : ['scope', 'provider', ...(kind === 'memory.recommend' ? ['evidence', 'usage'] : [])];
+    for (const [key, value] of Object.entries(values)) {
+        if (!allowed.includes(key))
+            throw new Error(`Unsupported ${kind} argument: ${key}`);
+        if (key !== 'windows' && (typeof value !== 'string' || !value.trim()))
+            throw new Error(`${key} must be a non-empty string`);
+    }
+    if (kind === 'memory.apply') {
+        if (!values.plan || !values.confirmedDigest)
+            throw new Error('memory.apply requires args.plan and args.confirmedDigest for the named reviewed plan');
+    }
+    else {
+        parseMemoryAuditOptions(['scope', 'provider'].flatMap(key => values[key] === undefined ? [] : [`--${key}`, String(values[key])]));
+    }
+}
+/** Resolve the daemon config file with the same precedence as Config.load. */
+export function resolveDaemonConfigPath(cwd) {
+    const candidates = [
+        path.join(cwd, '.aiwg', 'daemon.yaml'),
+        path.join(cwd, '.aiwg', 'daemon.yml'),
+        path.join(cwd, '.aiwg', 'daemon.json'),
+    ];
+    for (const candidate of candidates) {
+        if (fs.existsSync(candidate))
+            return { path: candidate, existed: true };
+    }
+    return { path: candidates[0], existed: false };
+}
+function parseConfigFile(file) {
+    const raw = fs.readFileSync(file, 'utf8');
+    if (file.endsWith('.json')) {
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            throw new Error(`Daemon config ${file} must contain a JSON object`);
+        }
+        return parsed;
+    }
+    const parsed = YAML.parse(raw);
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error(`Daemon config ${file} must contain a mapping`);
+    }
+    return parsed;
+}
+export function loadDaemonConfig(cwd) {
+    const { path: file, existed } = resolveDaemonConfigPath(cwd);
+    if (!existed)
+        return { path: file, existed, config: {} };
+    return { path: file, existed, config: parseConfigFile(file) };
+}
+export function saveDaemonConfig(file, config) {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    const body = file.endsWith('.json')
+        ? `${JSON.stringify(config, null, 2)}\n`
+        : YAML.stringify(config);
+    const tmp = `${file}.tmp.${process.pid}`;
+    fs.writeFileSync(tmp, body);
+    fs.renameSync(tmp, file);
+}
+export function getDaemonProfile(config) {
+    const daemon = config['daemon'];
+    if (!daemon || typeof daemon !== 'object' || Array.isArray(daemon))
+        return undefined;
+    const profile = daemon['profile'];
+    return typeof profile === 'string' ? profile : undefined;
+}
+export function setDaemonProfile(config, profile) {
+    const daemon = (config['daemon'] ??= {});
+    daemon['profile'] = profile;
+}
+export function getScheduleJobs(config) {
+    const schedule = config['schedule'];
+    if (!schedule || typeof schedule !== 'object' || Array.isArray(schedule))
+        return [];
+    const jobs = schedule['jobs'];
+    return Array.isArray(jobs) ? jobs : [];
+}
+export function setScheduleJobs(config, jobs) {
+    const schedule = (config['schedule'] ??= {});
+    schedule['jobs'] = jobs;
+}
+export function scheduleEnabled(config) {
+    const schedule = config['schedule'];
+    if (!schedule || typeof schedule !== 'object' || Array.isArray(schedule))
+        return false;
+    return schedule['enabled'] !== false;
+}
+export function getWatchPaths(config) {
+    const watch = config['watch'];
+    if (!watch || typeof watch !== 'object' || Array.isArray(watch))
+        return [];
+    const paths = watch['paths'];
+    return Array.isArray(paths) ? paths : [];
+}
+export function setWatchPaths(config, entries) {
+    const watch = (config['watch'] ??= {});
+    watch['paths'] = entries;
+}
+/** Minimal housekeeper seed written when no daemon config exists yet. */
+export function seedHousekeeperConfig() {
+    return {
+        daemon: { profile: HOUSEKEEPER_PROFILE, heartbeat_interval_seconds: 30 },
+        watch: { enabled: false, paths: [] },
+        schedule: { enabled: true, jobs: [] },
+    };
+}
+//# sourceMappingURL=daemon-config.js.map

package/dist/src/housekeeper/ipc.js

@@ -0,0 +1,84 @@
+/**
+ * Minimal JSON-RPC 2.0 client for the housekeeper daemon socket
+ * (epic #3353 slice B5).
+ *
+ * Speaks the same newline-delimited JSON framing as
+ * `tools/daemon/ipc-server.mjs` without importing `tools/` — `src/` must
+ * never import `tools/` (tools import compiled src via `importImpl`).
+ */
+import net from 'node:net';
+export async function requestDaemon(socketPath, method, options = {}) {
+    const timeoutMs = options.timeoutMs ?? 10_000;
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const fail = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            try {
+                socket.destroy();
+            }
+            catch { /* already closed */ }
+            reject(error);
+        };
+        const succeed = (value) => {
+            if (settled)
+                return;
+            settled = true;
+            try {
+                socket.end();
+            }
+            catch { /* already closed */ }
+            resolve(value);
+        };
+        const timer = setTimeout(() => {
+            fail(new Error(`Daemon request timed out: ${method} (${timeoutMs}ms)`));
+        }, timeoutMs);
+        timer.unref?.();
+        let buffer = '';
+        const socket = net.createConnection(socketPath);
+        socket.once('connect', () => {
+            socket.write(`${JSON.stringify({
+                jsonrpc: '2.0', id: 1, method, params: options.params ?? {},
+            })}\n`);
+        });
+        socket.on('data', (chunk) => {
+            buffer += chunk.toString('utf8');
+            const newline = buffer.indexOf('\n');
+            if (newline === -1)
+                return;
+            const line = buffer.slice(0, newline).trim();
+            buffer = buffer.slice(newline + 1);
+            if (!line)
+                return;
+            clearTimeout(timer);
+            let response;
+            try {
+                response = JSON.parse(line);
+            }
+            catch {
+                fail(new Error(`Daemon returned invalid JSON for ${method}`));
+                return;
+            }
+            if (response.error) {
+                fail(new Error(`Daemon error for ${method}: ${response.error.message ?? 'unknown error'}`));
+                return;
+            }
+            succeed(response.result);
+        });
+        socket.once('error', (error) => {
+            clearTimeout(timer);
+            const code = error?.code;
+            if (code === 'ENOENT' || code === 'ECONNREFUSED') {
+                fail(new Error('Daemon is not running (socket unavailable)'));
+                return;
+            }
+            fail(error);
+        });
+        socket.once('close', () => {
+            clearTimeout(timer);
+            fail(new Error(`Daemon connection closed during ${method}`));
+        });
+    });
+}
+//# sourceMappingURL=ipc.js.map

package/dist/src/housekeeper/lifecycle.js

@@ -0,0 +1,148 @@
+/**
+ * Housekeeper daemon lifecycle helpers (epic #3353 slice B5).
+ *
+ * Mirrors the pid/lock/heartbeat/state/socket paths of
+ * `tools/daemon/daemon-main.mjs` so `aiwg housekeeper start|stop|status`
+ * serializes against the same single-instance lock: a second `start`
+ * fails clearly, and `stop` cleans up exactly the files the daemon owns.
+ * All process signalling of owned ChildProcess handles goes through
+ * `signalChild`; pid-based stop uses `process.kill` (no ChildProcess).
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { signalChild } from '../process/signal-child.mjs';
+/** Same relative layout as DaemonMain; resolved against the caller cwd. */
+export function daemonPaths(cwd, frameworkRoot) {
+    return {
+        pidFile: path.join(cwd, '.aiwg', 'daemon.pid'),
+        lockFile: path.join(cwd, '.aiwg', 'daemon', '.lock'),
+        heartbeatFile: path.join(cwd, '.aiwg', 'daemon', 'heartbeat'),
+        stateFile: path.join(cwd, '.aiwg', 'daemon', 'state.json'),
+        socketPath: path.join(cwd, '.aiwg', 'daemon', 'daemon.sock'),
+        logFile: path.join(cwd, '.aiwg', 'daemon', 'daemon.log'),
+        taskStorePath: path.join(cwd, '.aiwg', 'daemon', 'tasks.json'),
+        daemonScript: path.join(frameworkRoot, 'tools', 'daemon', 'daemon-main.mjs'),
+    };
+}
+export function readPidFile(pidFile) {
+    let raw;
+    try {
+        raw = fs.readFileSync(pidFile, 'utf8').trim();
+    }
+    catch {
+        return null;
+    }
+    const pid = Number.parseInt(raw, 10);
+    return Number.isSafeInteger(pid) && pid > 0 && String(pid) === raw ? pid : null;
+}
+export function defaultKill(pid, signal) {
+    process.kill(pid, signal);
+}
+export function isPidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        // ESRCH = no such process. Any other error (e.g. EPERM) means a
+        // process exists that we may not signal — treat as alive.
+        if (error?.code === 'ESRCH')
+            return false;
+        return true;
+    }
+}
+/**
+ * Report whether a daemon owns the pid file. A pid file pointing at a
+ * dead process is stale (safe to overwrite after cleanup); a live one
+ * blocks `start`.
+ */
+export function describeRunning(pidFile) {
+    const pid = readPidFile(pidFile);
+    if (pid === null)
+        return { running: false, pid: null, stale: false };
+    if (isPidAlive(pid))
+        return { running: true, pid, stale: false };
+    return { running: false, pid, stale: true };
+}
+export function removeLifecycleFiles(paths) {
+    for (const file of [paths.pidFile, paths.lockFile]) {
+        try {
+            fs.unlinkSync(file);
+        }
+        catch (error) {
+            if (error?.code !== 'ENOENT')
+                throw error;
+        }
+    }
+}
+const defaultSleep = (ms) => new Promise((resolve) => { setTimeout(resolve, ms); });
+/**
+ * Stop the daemon gracefully (SIGTERM, poll, then SIGKILL on timeout),
+ * then release the pid/lock files. Never throws for absent files.
+ */
+export async function stopDaemon(options) {
+    const { paths, kill = defaultKill, timeoutMs = 10_000, pollMs = 200 } = options;
+    const sleep = options.sleep ?? defaultSleep;
+    const state = describeRunning(paths.pidFile);
+    if (state.pid === null)
+        return { outcome: 'not-running' };
+    if (!state.running) {
+        removeLifecycleFiles(paths);
+        return { outcome: 'stale-cleaned', pid: state.pid };
+    }
+    const pid = state.pid;
+    try {
+        kill(pid, 'SIGTERM');
+    }
+    catch (error) {
+        if (error?.code === 'ESRCH') {
+            removeLifecycleFiles(paths);
+            return { outcome: 'stale-cleaned', pid };
+        }
+        throw error;
+    }
+    const deadline = Date.now() + timeoutMs;
+    while (isPidAlive(pid)) {
+        if (Date.now() >= deadline)
+            break;
+        await sleep(pollMs);
+    }
+    let forced = false;
+    if (isPidAlive(pid)) {
+        try {
+            kill(pid, 'SIGKILL');
+        }
+        catch (error) {
+            if (error?.code !== 'ESRCH')
+                throw error;
+        }
+        forced = true;
+        const killDeadline = Date.now() + Math.min(timeoutMs, 5000);
+        while (isPidAlive(pid) && Date.now() < killDeadline) {
+            await sleep(pollMs);
+        }
+    }
+    removeLifecycleFiles(paths);
+    return { outcome: 'stopped', pid, forced };
+}
+/** Forward a terminal signal to an owned foreground child. */
+export function forwardSignalToChild(child, signal) {
+    signalChild(child, signal);
+}
+/**
+ * Poll until `predicate` is true or the deadline passes. Returns true on
+ * success; used by `start` to wait for the pid file without fixed sleeps.
+ */
+export async function pollUntil(predicate, options = {}) {
+    const { timeoutMs = 10_000, pollMs = 200 } = options;
+    const sleep = options.sleep ?? defaultSleep;
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+        if (predicate())
+            return true;
+        if (Date.now() >= deadline)
+            return false;
+        await sleep(pollMs);
+    }
+}
+//# sourceMappingURL=lifecycle.js.map

package/dist/src/housekeeper/platform.js

@@ -0,0 +1,35 @@
+/**
+ * Platform honesty for `aiwg housekeeper` (epic #3353 slice B5).
+ *
+ * Design-note §3 matrix in one place, with the platform injectable so
+ * tests can cover every row without running on that OS: Windows is
+ * unsupported (WSL2 follows the Linux rows); macOS install is a
+ * best-effort launchd plist (documented, not CI-tested); Linux install
+ * targets systemd user units.
+ */
+export function normalizePlatform(platform = process.platform) {
+    if (platform === 'win32')
+        return 'windows';
+    if (platform === 'darwin')
+        return 'darwin';
+    if (platform === 'linux')
+        return 'linux';
+    return 'other';
+}
+/** run-once / daemon processes: everything except Windows. */
+export function runSupported(platform = process.platform) {
+    return normalizePlatform(platform) !== 'windows';
+}
+export function runUnsupportedMessage() {
+    return 'aiwg housekeeper is not supported on Windows (no recursive fs.watch, POSIX paths assumed). Use WSL2 and follow the Linux rows.';
+}
+/** Install backends offered on a platform, in preference order. */
+export function installBackends(platform = process.platform) {
+    const normalized = normalizePlatform(platform);
+    if (normalized === 'windows')
+        return [];
+    if (normalized === 'darwin')
+        return ['launchd', 'systemd-user'];
+    return ['systemd-user', 'launchd'];
+}
+//# sourceMappingURL=platform.js.map

package/dist/src/housekeeper/status.js

@@ -0,0 +1,70 @@
+/**
+ * Housekeeper status envelope (epic #3353 slice B5).
+ *
+ * `aiwg housekeeper status --json` emits this shape: the B1 §6 contract
+ * fields (`contractVersion`/`command`/`status`/`mode`/`jobs`/`totals`) plus
+ * per-index freshness measured by the B4 adapters. The CLI builds it from
+ * live daemon IPC when a daemon answers, otherwise from local config and
+ * persisted receipts (offline mode), so ordinary `aiwg` commands keep
+ * working with no daemon running.
+ */
+export const HOUSEKEEPER_STATUS_CONTRACT_VERSION = 1;
+const RECEIPT_STATES = new Set(['ok', 'failed', 'skipped', 'deferred']);
+export function countJobTotals(jobs) {
+    const totals = {
+        jobs: jobs.length, ok: 0, failed: 0, skipped: 0, deferred: 0, never: 0,
+    };
+    for (const job of jobs) {
+        if (job.lastState === 'ok')
+            totals.ok += 1;
+        else if (job.lastState === 'failed')
+            totals.failed += 1;
+        else if (job.lastState === 'skipped')
+            totals.skipped += 1;
+        else if (job.lastState === 'deferred')
+            totals.deferred += 1;
+        else
+            totals.never += 1;
+    }
+    return totals;
+}
+export function normalizeJobState(state) {
+    return typeof state === 'string' && RECEIPT_STATES.has(state)
+        ? state
+        : 'never';
+}
+/** Assemble the envelope; every field is always present. */
+export function buildHousekeeperStatus(input) {
+    const jobs = input.jobs ?? [];
+    return {
+        contractVersion: HOUSEKEEPER_STATUS_CONTRACT_VERSION,
+        command: 'housekeeper.status',
+        status: 'ok',
+        mode: input.mode,
+        pid: input.pid ?? null,
+        uptimeSeconds: input.uptimeSeconds ?? 0,
+        jobs,
+        totals: countJobTotals(jobs),
+        freshness: input.freshness ?? [],
+        update: {
+            channel: 'stable',
+            checkOnly: true,
+            lastCheck: input.lastCheck ?? null,
+            available: input.available ?? null,
+            lastInstall: input.lastInstall ?? null,
+        },
+    };
+}
+/**
+ * Map a B4 freshness snapshot to the status entry. `unavailable` (no local
+ * deterministic probe) surfaces as `unsupported` per the B1 §6 state set.
+ */
+export function toFreshnessEntry(snapshot) {
+    return {
+        index: snapshot.name,
+        state: snapshot.status === 'unavailable' ? 'unsupported' : snapshot.status,
+        targetMs: snapshot.policy?.targetStaleAfterMs ?? null,
+        converged: snapshot.convergence?.converged ?? null,
+    };
+}
+//# sourceMappingURL=status.js.map

package/dist/src/housekeeper/units.js

@@ -0,0 +1,114 @@
+/**
+ * Autostart unit renderers for `aiwg housekeeper install` (epic #3353 B5).
+ *
+ * Platform matrix (design note §3): Linux + systemd is documented;
+ * Linux without systemd and macOS fall back to foreground `start` or an
+ * external timer calling `run-once`; Windows is unsupported (WSL2 follows
+ * the Linux rows). Units are pure strings here so `--dry-run` can print
+ * them without writing and tests can assert content with an injected
+ * platform. This module never enables anything: enabling is an explicit
+ * operator step printed by the handler, never performed implicitly.
+ */
+import os from 'node:os';
+import path from 'node:path';
+export const HOUSEKEEPER_SERVICE_NAME = 'aiwg-housekeeper.service';
+export const HOUSEKEEPER_TIMER_NAME = 'aiwg-housekeeper.timer';
+export const HOUSEKEEPER_LAUNCHD_LABEL = 'dev.aiwg.housekeeper';
+export function renderSystemdService(ctx) {
+    const node = ctx.nodeBin ?? process.execPath;
+    const runOnce = ctx.jobId
+        ? `${quote(ctx.aiwgBin)} housekeeper run-once --job ${quote(ctx.jobId)}`
+        : `${quote(ctx.aiwgBin)} housekeeper run-once`;
+    return [
+        '[Unit]',
+        'Description=AIWG housekeeper (deterministic maintenance, oneshot for timer)',
+        'Documentation=https://github.com/jmagly/aiwg',
+        '',
+        '[Service]',
+        'Type=oneshot',
+        `WorkingDirectory=${ctx.cwd}`,
+        `ExecStart=${node} ${runOnce}`,
+        'NoNewPrivileges=true',
+        '',
+        '[Install]',
+        'WantedBy=default.target',
+        '',
+    ].join('\n');
+}
+export function renderSystemdTimer(options = {}) {
+    return [
+        '[Unit]',
+        'Description=AIWG housekeeper periodic run (calls aiwg housekeeper run-once)',
+        '',
+        '[Timer]',
+        `OnCalendar=${options.calendar ?? 'hourly'}`,
+        'Persistent=true',
+        `Unit=${HOUSEKEEPER_SERVICE_NAME}`,
+        '',
+        '[Install]',
+        'WantedBy=timers.target',
+        '',
+    ].join('\n');
+}
+/**
+ * Best-effort macOS plist (design note §3: documented, not CI-tested —
+ * there is no macOS runner). Runs `run-once` on a calendar interval.
+ */
+export function renderLaunchdPlist(ctx, options = {}) {
+    const node = ctx.nodeBin ?? process.execPath;
+    const args = ctx.jobId
+        ? [ctx.aiwgBin, 'housekeeper', 'run-once', '--job', ctx.jobId]
+        : [ctx.aiwgBin, 'housekeeper', 'run-once'];
+    const argsXml = [node, ...args].map((arg) => `    <string>${xmlEscape(arg)}</string>`).join('\n');
+    return [
+        '<?xml version="1.0" encoding="UTF-8"?>',
+        '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+        '<plist version="1.0">',
+        '<dict>',
+        '  <key>Label</key>',
+        `  <string>${HOUSEKEEPER_LAUNCHD_LABEL}</string>`,
+        '  <key>ProgramArguments</key>',
+        '  <array>',
+        argsXml,
+        '  </array>',
+        '  <key>WorkingDirectory</key>',
+        `  <string>${xmlEscape(ctx.cwd)}</string>`,
+        '  <key>StartInterval</key>',
+        `  <integer>${options.intervalSeconds ?? 3600}</integer>`,
+        '  <key>RunAtLoad</key>',
+        '  <false/>',
+        '</dict>',
+        '</plist>',
+        '',
+    ].join('\n');
+}
+/** Default `aiwg` entry point under a framework root (overridable in tests). */
+export function defaultAiwgBin(frameworkRoot) {
+    return path.join(frameworkRoot, 'bin', 'aiwg.mjs');
+}
+/** XDG user systemd directory (`~/.config/systemd/user` by default). */
+export function systemdUserDir(home = os.homedir()) {
+    const base = process.env['XDG_CONFIG_HOME'] || path.join(home, '.config');
+    return path.join(base, 'systemd', 'user');
+}
+/** macOS user agent directory. */
+export function launchdAgentDir(home = os.homedir()) {
+    return path.join(home, 'Library', 'LaunchAgents');
+}
+export function backendForPlatform(platform) {
+    if (platform === 'win32')
+        return 'unsupported';
+    if (platform === 'darwin')
+        return 'launchd';
+    return 'systemd-user';
+}
+function quote(value) {
+    return /[\s"']/.test(value) ? `"${value.replace(/"/g, '\\"')}"` : value;
+}
+function xmlEscape(value) {
+    return value
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;');
+}
+//# sourceMappingURL=units.js.map

package/dist/src/issues/cli.js

@@ -12,7 +12,8 @@ import path from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { getFrameworkRoot } from '../channel/manager.mjs';
 import { readAiwgConfig } from '../config/aiwg-config.js';
-import { LocalIssueProviderCore, buildExternalIssueSnapshotFromLocal, buildLocalIssueConflictReport, createLiveIssueClient, localIssueRoot, parseCommentIdMappings, parseExternalIssueSnapshot, } from './index.js';
+import { sensitiveInputOptions } from '../auth/sensitive-input.js';
+import { LocalIssueProviderCore, buildExternalIssueSnapshotFromLocal, buildLocalIssueConflictReport, createLiveIssueClient, resolveLiveIssueToken, localIssueRoot, parseCommentIdMappings, parseExternalIssueSnapshot, } from './index.js';
 export async function main(args, cwd = process.cwd()) {
     const parsed = parseArgs(args);
     const subcommand = parsed.positional[0];
@@ -218,7 +219,7 @@ async function handleImport(issues, args) {
     if (from !== "gitea" && from !== "github")
         throw new Error("Usage: aiwg issue import --from gitea|github (--snapshot-file path | --live --repo owner/name --external-id N)");
     const snapshot = args.flags.has("live")
-        ? await createLiveIssueClient({ provider: from, repo: requiredStringFlag(args, "repo"), apiUrl: stringFlag(args, "api-url") }).importIssue(requiredStringFlag(args, "external-id"))
+        ? await (await liveClient(args, from)).importIssue(requiredStringFlag(args, "external-id"))
         : parseExternalIssueSnapshot(JSON.parse(await readRequiredFile(args, "snapshot-file")));
     if (from !== snapshot.provider)
         throw new Error(`snapshot provider ${snapshot.provider} does not match --from ${from}`);
@@ -249,7 +250,7 @@ async function handleExport(issues, rest, args) {
         await writeOptionalOutput(args, snapshot);
         return;
     }
-    const client = createLiveIssueClient({ provider, repo: requiredStringFlag(args, "repo"), apiUrl: stringFlag(args, "api-url") });
+    const client = await liveClient(args, provider);
     if (snapshot.external_id && !args.flags.has("force")) {
         const remote = await client.fetchIssue(snapshot.external_id);
         const report = buildLocalIssueConflictReport(issue, remote);
@@ -314,6 +315,11 @@ async function handleIndex(issues, rest, args) {
     const index = await issues.rebuildIssueIndex({ force: args.flags.has('force') });
     printJsonOrText(args, index, `Local issue index ready (${index.issues.length} issues)`);
 }
+async function liveClient(args, provider) {
+    const repo = requiredStringFlag(args, 'repo');
+    const token = await resolveLiveIssueToken(provider, sensitiveInputOptions(args.raw, 'token'));
+    return createLiveIssueClient({ provider, repo, apiUrl: stringFlag(args, 'api-url'), token });
+}
 function requiredStringFlag(args, flag) {
     const value = stringFlag(args, flag);
     if (!value)
@@ -381,7 +387,7 @@ function parseArgs(args) {
             flags.set(rawKey, true);
         }
     }
-    return { positional, flags };
+    return { raw: args, positional, flags };
 }
 function stringFlag(args, name) {
     const value = args.flags.get(name);
@@ -402,10 +408,15 @@ function printUsage() {
   aiwg issue show <KEY> [--comments last:10|all]
   aiwg issue import --from gitea|github --snapshot-file path [--json]
   aiwg issue export <KEY> --to gitea|github [--out path]
+  aiwg issue import --from gitea|github --live --repo owner/name --external-id N [token source]
+  aiwg issue export <KEY> --to gitea|github --live --repo owner/name [token source]
   aiwg issue sync conflicts <KEY> --snapshot-file path [--out path]
   aiwg issue sync map-comments <KEY> --map-file path [--json]
   aiwg issue comment <KEY> --body "..." [--author name]
   aiwg issue close <KEY> [--reason "..."]
-  aiwg issue index rebuild [--force]`);
+  aiwg issue index rebuild [--force]
+
+Live token sources: --token-interactive, --token-stdin, --token-file <path>,
+  --token-store <name>, --token-env <NAME> (see docs/cli/sensitive-values.md).`);
 }
 //# sourceMappingURL=cli.js.map