@aiwg/cli 2026.10.5 → 2026.10.7

package/dist/src/issues/live.js

@@ -1,3 +1,5 @@
+import { resolveSensitiveInput } from '../auth/sensitive-input.js';
+import { isInteractive } from '../cli/env.js';
 export class LiveIssueClient {
     options;
     baseUrl;
@@ -63,24 +65,51 @@ export class LiveIssueClient {
             headers['Content-Type'] = 'application/json';
         if (this.options.token)
             headers.Authorization = `Bearer ${this.options.token}`;
-        const response = await this.fetchFn(`${this.baseUrl}${path}`, {
-            method,
-            headers,
-            body: body === undefined ? undefined : JSON.stringify(body),
-        });
-        if (!response.ok) {
-            const text = await response.text().catch(() => '');
-            throw new Error(`${this.options.provider} issue API ${method} ${path} failed: ${response.status}${text ? ` ${redactSecrets(text)}` : ''}`);
+        try {
+            const response = await this.fetchFn(`${this.baseUrl}${path}`, {
+                method,
+                headers,
+                body: body === undefined ? undefined : JSON.stringify(body),
+            });
+            if (!response.ok) {
+                const text = await response.text().catch(() => '');
+                throw new Error(`${this.options.provider} issue API ${method} ${path} failed: ${response.status}${text ? ` ${redactSecrets(text, this.options.token)}` : ''}`);
+            }
+            const result = await response.json();
+            // A server can reflect request credentials in issue fields or comments.
+            // Scrub them before they reach local storage or CLI output.
+            if (!this.options.token)
+                return result;
+            const encodedToken = JSON.stringify(this.options.token).slice(1, -1);
+            return JSON.parse(JSON.stringify(result).split(encodedToken).join('[REDACTED]'));
+        }
+        catch (error) {
+            throw new Error(redactSecrets(error instanceof Error ? error.message : 'Live issue request failed', this.options.token));
         }
-        return response.json();
     }
 }
 export function createLiveIssueClient(options) {
     return new LiveIssueClient({
         ...options,
-        token: resolveToken(options.provider, options.tokenEnv ?? process.env),
+        token: options.token ?? resolveToken(options.provider, options.tokenEnv ?? process.env),
     });
 }
+/** CLI source selection; the synchronous client factory remains available to callers. */
+export async function resolveLiveIssueToken(provider, source = {}, dependencies = {}) {
+    const environment = dependencies.environment ?? process.env;
+    const isTTY = dependencies.isTTY ?? isInteractive();
+    const selected = { ...source, prefix: 'token' };
+    const hasSource = selected.interactive || selected.stdin || selected.file !== undefined || selected.store !== undefined || selected.env !== undefined;
+    if (!hasSource) {
+        // Established behavior: use the provider variable when set, otherwise make
+        // unauthenticated requests (public repositories). Prompt only on request.
+        const names = provider === 'gitea' ? ['AIWG_GITEA_TOKEN', 'GITEA_TOKEN'] : ['AIWG_GITHUB_TOKEN', 'GITHUB_TOKEN'];
+        selected.env = names.find(name => environment[name] !== undefined);
+        if (selected.env === undefined)
+            return undefined;
+    }
+    return resolveSensitiveInput(selected, { ...dependencies, environment, isTTY });
+}
 export function resolveToken(provider, env) {
     if (provider === 'gitea')
         return env.AIWG_GITEA_TOKEN ?? env.GITEA_TOKEN;
@@ -148,7 +177,10 @@ function requireString(value, field) {
         return value;
     throw new Error(`live issue response missing ${field}`);
 }
-function redactSecrets(value) {
-    return value.replace(/(token|authorization|password|secret)["':=\s]+[^\s"',}]+/gi, '$1=[REDACTED]');
+function redactSecrets(value, token) {
+    const redacted = token ? value.split(token).join('[REDACTED]') : value;
+    return redacted
+        .replace(/Bearer\s+[^\s"',}]+/gi, 'Bearer [REDACTED]')
+        .replace(/(token|authorization|password|secret)["':=\s]+[^\s"',}]+/gi, '$1=[REDACTED]');
 }
 //# sourceMappingURL=live.js.map

package/dist/src/jobs/flow.js

@@ -2,6 +2,7 @@ import { promises as fs } from 'node:fs';
 import path from 'node:path';
 import { load as loadYaml } from 'js-yaml';
 import { z } from 'zod';
+import { integer, url } from '../schema/zod-validation.mjs';
 import { JOB_API_VERSION, JOB_KIND } from './types.js';
 const relativeFile = z.string().min(1).refine(value => {
     if (path.isAbsolute(value))
@@ -12,51 +13,51 @@ const relativeFile = z.string().min(1).refine(value => {
 const absolutePath = z.string().min(1)
     .refine(path.isAbsolute, 'must be an absolute path')
     .refine(value => path.resolve(value) !== path.parse(path.resolve(value)).root, 'must not be a filesystem root');
-const httpsOrigin = z.string().url().refine(value => new URL(value).protocol === 'https:', 'must use https');
+const httpsOrigin = url().refine(value => new URL(value).protocol === 'https:', 'must use https');
 const accountName = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_.@:-]{0,127}$/u);
-export const externalJobFlowSchema = z.object({
+export const externalJobFlowSchema = z.strictObject({
     apiVersion: z.literal(JOB_API_VERSION),
     kind: z.literal(JOB_KIND),
-    metadata: z.object({
+    metadata: z.strictObject({
         name: z.string().regex(/^[a-z][a-z0-9-]{0,62}$/u),
         revision: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u),
-    }).strict(),
-    spec: z.object({
-        trigger: z.object({ type: z.literal('external') }).strict(),
-        executor: z.object({
+    }),
+    spec: z.strictObject({
+        trigger: z.strictObject({ type: z.literal('external') }),
+        executor: z.strictObject({
             provider: z.literal('codex'),
             mode: z.literal('exec'),
             workspace: absolutePath,
             prompt: relativeFile,
             resultSchema: relativeFile,
             binary: absolutePath,
-        }).strict(),
-        workItem: z.object({
+        }),
+        workItem: z.strictObject({
             provider: z.literal('gitea'),
-            baseUrl: z.string().url().refine(value => new URL(value).protocol === 'https:', 'must use https'),
+            baseUrl: url().refine(value => new URL(value).protocol === 'https:', 'must use https'),
             repository: z.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/u),
             tokenFile: absolutePath,
             eligibleLabels: z.array(z.string().min(1)).min(1),
-            claimTtlSeconds: z.number().int().min(30).max(86400).optional(),
-            claimSettleMs: z.number().int().min(100).max(30000).optional(),
-        }).strict(),
-        approval: z.object({
+            claimTtlSeconds: integer().min(30).max(86400).optional(),
+            claimSettleMs: integer().min(100).max(30000).optional(),
+        }),
+        approval: z.strictObject({
             required: z.boolean().optional(),
             label: z.string().min(1).optional(),
-        }).strict().optional(),
-        security: z.object({
+        }).optional(),
+        security: z.strictObject({
             allowedOrigins: z.array(httpsOrigin).min(1),
             allowedAccounts: z.array(accountName).min(1),
             approvedAttachmentRoots: z.array(absolutePath),
             sensitiveValueFiles: z.array(absolutePath).optional(),
-        }).strict(),
-        completion: z.object({
+        }),
+        completion: z.strictObject({
             require: z.array(z.enum([
                 'external-result-url', 'issue-comment', 'idempotency-key', 'verification',
             ])).min(1),
-        }).strict(),
-    }).strict(),
-}).strict().superRefine((flow, ctx) => {
+        }),
+    }),
+}).superRefine((flow, ctx) => {
     const workspace = path.resolve(flow.spec.executor.workspace);
     const within = (candidate) => {
         const relative = path.relative(workspace, path.resolve(candidate));

package/dist/src/lint/rule-activation.js

@@ -1,5 +1,8 @@
+/** Activation checks within the existing lint runner, not a delivery selector. */
+import fs from 'node:fs';
+import path from 'node:path';
 import { loadLocalCapabilityEntries, resolveRuleBindingTarget } from '../artifacts/query-engine.js';
-import { parseRuleFrontmatter, RULE_BINDING_TYPES } from '../rules/activation.mjs';
+import { parseRuleFrontmatter, RULE_BINDING_TYPES, coreBodyPath, validateCoreBody } from '../rules/activation.mjs';
 export const ruleActivationRuleset = {
     id: 'rule-activation', name: 'Rule activation', framework: 'core', version: '1.0.0',
     description: 'Validate rule and behavior activation contracts and exact indexed bindings',
@@ -10,17 +13,29 @@ export const ruleActivationRuleset = {
             checks: [{ type: 'rule-activation' }],
         }],
 };
-export function lintRuleActivation(content, file, projectRoot, entries) {
-    // Generated structural indexes are not authored rules.
-    if (/^(?:RULES-INDEX|RULES-ONDEMAND)\.md$/.test(file.split('/').pop()))
+export function lintRuleActivation(content, file, projectRoot, entries, absolutePath) {
+    // Directory documentation and generated indexes are not authored rules.
+    if (/^(?:README|RULES-INDEX|RULES-ONDEMAND)\.md$/.test(file.split('/').pop()))
         return [];
+    // <rule>.core.md is a delivery body (#3450), validated through its owning rule.
+    if (/\.core\.md$/.test(file))
+        return [];
+    const shipped = /(?:^|\/)agentic\/code\//.test((absolutePath ?? path.resolve(projectRoot, file)).replaceAll('\\', '/'));
     const result = parseRuleFrontmatter(content);
     const diagnostics = result.diagnostics.map(item => ({
         ruleId: 'rules/activation', ruleName: 'Rule activation contract',
-        file, severity: item.severity, message: item.message,
+        file, severity: item.code === 'missing-activation' && shipped ? 'error' : item.severity, message: item.message,
     }));
     if (!result.rule)
         return diagnostics;
+    if (result.rule.activation === 'core') {
+        const body = coreBodyPath(absolutePath ?? (path.isAbsolute(file) ? file : path.resolve(projectRoot, file)));
+        const problems = fs.existsSync(body)
+            ? validateCoreBody(fs.readFileSync(body, 'utf8').trim(), path.basename(body))
+            : [`${path.basename(body)}: activation core requires a compact body file beside the rule`];
+        for (const message of problems)
+            diagnostics.push({ ruleId: 'rules/activation', ruleName: 'Rule activation contract', file, severity: 'error', message });
+    }
     const bindings = result.rule.bound_to;
     if (!Object.values(bindings).some(list => list.length > 0))
         return diagnostics;

package/dist/src/lint/runner.js

@@ -563,7 +563,7 @@ async function runRule(rule, targetDir, allFiles, referenceIndex, projectRoot, a
             if (check.type === 'id-unique')
                 continue; // Already handled
             if (check.type === 'rule-activation') {
-                diagnostics.push(...lintRuleActivation(content, file, projectRoot, artifactEntries));
+                diagnostics.push(...lintRuleActivation(content, file, projectRoot, artifactEntries, absPath));
                 continue;
             }
             const checkDiagnostics = runCheck(check, content, frontmatter, file, targetDir, allFiles, referenceIndex, projectRoot);

package/dist/src/marketplace/exchange.js

@@ -9,6 +9,7 @@ import { access, chmod, mkdir, mkdtemp, readFile, rename, rm, writeFile, } from
 import { existsSync } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { resolveSensitiveInput } from '../auth/sensitive-input.js';
 import { setPackageEntry } from '../packages/package-registry.js';
 import { discoverInstallablePackage } from '../packages/package-discovery.js';
 import { parseTrustRoot, sha256 as artifactSha256, } from '../security/artifact-trust.js';
@@ -236,7 +237,13 @@ export async function verifyIndexedPackage(options) {
     });
     return { verification, receipt, entry };
 }
-export async function publishLocalPackage(options) {
+export async function publishLocalPackage(options, sensitiveDependencies = {}) {
+    const privateKey = await resolveSensitiveInput({
+        ...options.keyInput,
+        prefix: 'key',
+        file: options.keyInput?.file ?? options.privateKeyPath,
+        multiline: true,
+    }, sensitiveDependencies);
     const sourceDir = path.resolve(options.sourceDir);
     const discovered = await discoverInstallablePackage(sourceDir, options.packageSelector);
     const unsigned = await createProvenanceEnvelope({
@@ -248,12 +255,17 @@ export async function publishLocalPackage(options) {
         publisher: options.publisher,
         sequence: options.sequence,
     });
-    const privateKey = await readFile(path.resolve(options.privateKeyPath), 'utf8');
     const publicKey = options.publicKeyPath ? await readFile(path.resolve(options.publicKeyPath), 'utf8') : undefined;
-    const envelope = signProvenanceEnvelope(unsigned, privateKey, {
-        keyId: options.keyId,
-        publicKeyPem: publicKey,
-    });
+    let envelope;
+    try {
+        envelope = signProvenanceEnvelope(unsigned, privateKey, {
+            keyId: options.keyId,
+            publicKeyPem: publicKey,
+        });
+    }
+    catch {
+        throw new Error('Marketplace signing failed; check the Ed25519 private key and public-key options.');
+    }
     const lock = createPackageLock(envelope, envelope.publication.publishedAt);
     const fortemi = await buildFortemiEnvelopeShard(envelope);
     const receipt = createOperationReceipt({

package/dist/src/marketplace/provenance.js

@@ -8,6 +8,7 @@
  * @implements #2009
  */
 import { execFile } from 'node:child_process';
+import { helperEnvironment } from '../process/cli-command.mjs';
 import { createHash, createPrivateKey, createPublicKey, sign as cryptoSign, verify as cryptoVerify, } from 'node:crypto';
 import { lstat, readFile, readdir } from 'node:fs/promises';
 import path from 'node:path';
@@ -157,7 +158,7 @@ async function git(cwd, args) {
         cwd,
         encoding: 'utf8',
         timeout: 120_000,
-        env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
+        env: { ...helperEnvironment(), GIT_TERMINAL_PROMPT: '0' },
     });
     return stdout.trim();
 }
@@ -166,7 +167,7 @@ async function gitBytes(cwd, args) {
         cwd,
         encoding: 'buffer',
         timeout: 120_000,
-        env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
+        env: { ...helperEnvironment(), GIT_TERMINAL_PROMPT: '0' },
     });
     return stdout;
 }

package/dist/src/mcp/adapters/codex-runtime.js

@@ -14,11 +14,13 @@
  *
  * @implements #892
  */
+import { readPrivateValueFile } from '../../auth/sensitive-input.js';
 import { signalChild } from '../../process/signal-child.mjs';
-import { readFile, mkdir, symlink, access, readdir, chmod, lstat, open } from 'fs/promises';
+import { helperEnvironment, HELPER_ENV_ALLOWLIST, DESKTOP_HELPER_ENV_ALLOWLIST } from '../../process/cli-command.mjs';
+import { readFile, mkdir, symlink, access, readdir, chmod } from 'fs/promises';
 import { join } from 'path';
 import { homedir } from 'os';
-import { existsSync, constants } from 'fs';
+import { existsSync } from 'fs';
 import { spawn, spawnSync } from 'child_process';
 import { boundedSpawnSync, resolveSyncProcessTimeoutMs } from '../../process/bounded-child-process.mjs';
 import { isInteractive } from '../../cli/env.js';
@@ -228,73 +230,9 @@ function envWithoutSecretValue(base, envVarName, secretValue) {
     }
     return result;
 }
-/**
- * Read an API key from a private file (#3062 go/no-go review, blocker 1C):
- * `--api-key-file <path>` reads the key from disk instead of an
- * environment variable, so a file that does not meet the same bar the
- * decision ledger's own file writer enforces
- * (`src/decision/ledger.ts`'s `openLedgerFileForAppend`) is refused rather
- * than silently trusted. This mirrors that check for a read instead of a
- * write — there is no already-exported helper at this layer to reuse (the
- * ledger's checks are private to that module and tied to its own
- * create-if-missing write path), so this re-implements the same checks for
- * a read: never follow a symlink; the open file descriptor must resolve to
- * a regular file with exactly one hard link; and, on POSIX, must be owned
- * by the current user with no group/other permission bits. The file's
- * contents are returned trimmed; no error message here ever includes them.
- */
+/** Backward-compatible MCP export; the validation is shared by all input commands. */
 async function readApiKeyFromFile(filePath) {
-    try {
-        const pre = await lstat(filePath);
-        if (pre.isSymbolicLink()) {
-            throw new Error(`--api-key-file: "${filePath}" is a symlink; refusing to follow it.`);
-        }
-    }
-    catch (error) {
-        if (error.code === 'ENOENT') {
-            throw new Error(`--api-key-file: "${filePath}" does not exist.`);
-        }
-        if (error instanceof Error && error.message.startsWith('--api-key-file:'))
-            throw error;
-        throw new Error(`--api-key-file: cannot stat "${filePath}": ${error.message}`);
-    }
-    const hasNoFollow = typeof constants.O_NOFOLLOW === 'number';
-    const flags = constants.O_RDONLY | (hasNoFollow ? constants.O_NOFOLLOW : 0);
-    let handle;
-    try {
-        handle = await open(filePath, flags);
-    }
-    catch (error) {
-        const code = error.code;
-        if (code === 'ELOOP')
-            throw new Error(`--api-key-file: "${filePath}" is a symlink; refusing to follow it.`);
-        if (code === 'ENOENT')
-            throw new Error(`--api-key-file: "${filePath}" does not exist.`);
-        throw new Error(`--api-key-file: cannot open "${filePath}": ${error.message}`);
-    }
-    try {
-        const stat = await handle.stat();
-        if (!stat.isFile()) {
-            throw new Error(`--api-key-file: "${filePath}" is not a regular file.`);
-        }
-        if (stat.nlink !== 1) {
-            throw new Error(`--api-key-file: "${filePath}" has more than one hard link; refusing to read it.`);
-        }
-        if (process.platform !== 'win32') {
-            const uid = typeof process.getuid === 'function' ? process.getuid() : null;
-            if (uid !== null && stat.uid !== uid) {
-                throw new Error(`--api-key-file: "${filePath}" is not owned by the current user.`);
-            }
-            if ((stat.mode & 0o077) !== 0) {
-                throw new Error(`--api-key-file: "${filePath}" must not be readable or writable by group or other ` +
-                    '(chmod 600 it).');
-            }
-        }
-        return (await handle.readFile({ encoding: 'utf-8' })).trim();
-    }
-    finally {
-        await handle.close();
-    }
+    return readPrivateValueFile(filePath, '--api-key-file');
 }
 /**
  * Async, credential-safe launch of `codex login --with-api-key` (#3062
@@ -320,17 +258,37 @@ function spawnCodexLoginWithApiKey(apiKey, env) {
     return new Promise((resolve) => {
         const child = spawn('codex', ['login', '--with-api-key'], {
             env,
-            stdio: ['pipe', 'inherit', 'inherit'],
+            stdio: ['pipe', 'pipe', 'pipe'],
         });
         let settled = false;
         let timer;
+        const stdout = [];
+        const stderr = [];
+        let outputBytes = 0;
+        // Buffer through close so a credential split between chunks cannot escape
+        // redaction. The combined cap bounds both memory and forwarded diagnostics.
+        const collect = (target, chunk) => {
+            if (settled)
+                return;
+            const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+            outputBytes += buffer.length;
+            if (outputBytes > 1024 * 1024) {
+                settle({ status: null, signal: 'SIGKILL', error: new Error('codex login output exceeded the 1 MiB limit.') });
+                return;
+            }
+            target.push(buffer);
+        };
+        const onStdout = (chunk) => collect(stdout, chunk);
+        const onStderr = (chunk) => collect(stderr, chunk);
+        child.stdout?.on('data', onStdout);
+        child.stderr?.on('data', onStderr);
         // #3062 go/no-go review, blocker 2: stdin error, write completion,
-        // child 'error', child 'exit', and the deadline all funnel through this
+        // child 'error', child 'close', and the deadline all funnel through this
         // one function, which settles exactly once, always clears the timer and
         // removes every listener this call added, and kills the child if it is
         // still alive on a failing settlement (a running process on the
         // timeout path; a process that may still be running on an unexpected
-        // stdin-write error). The 'exit' path never reaches the kill — by the
+        // stdin-write error). The 'close' path never reaches the kill — by the
         // time that event fires the child has already exited.
         const settle = (result) => {
             if (settled)
@@ -340,13 +298,23 @@ function spawnCodexLoginWithApiKey(apiKey, env) {
                 clearTimeout(timer);
             child.stdin?.removeListener('error', onStdinError);
             child.removeListener('error', onChildError);
-            child.removeListener('exit', onExit);
+            child.removeListener('close', onClose);
+            child.stdout?.removeListener('data', onStdout);
+            child.stderr?.removeListener('data', onStderr);
+            child.stdout?.destroy();
+            child.stderr?.destroy();
             if (result.error && child.exitCode === null && child.signalCode === null) {
                 try {
                     signalChild(child, 'SIGKILL');
                 }
                 catch { /* already gone */ }
             }
+            // On a failed/oversized stream, suppress buffered fragments entirely:
+            // the missing remainder might contain the rest of a credential.
+            if (!result.error) {
+                process.stdout.write(Buffer.concat(stdout).toString('utf8').split(apiKey).join('[redacted]'));
+                process.stderr.write(Buffer.concat(stderr).toString('utf8').split(apiKey).join('[redacted]'));
+            }
             resolve(result);
         };
         timer = setTimeout(() => {
@@ -358,15 +326,15 @@ function spawnCodexLoginWithApiKey(apiKey, env) {
         }, boundMs);
         const onChildError = (err) => settle({ status: null, signal: null, error: err });
         child.on('error', onChildError);
-        const onExit = (code, signal) => settle({ status: code, signal });
-        child.on('exit', onExit);
+        const onClose = (code, signal) => settle({ status: code, signal });
+        child.on('close', onClose);
         // A child that exits (or closes its read end) before reading stdin
         // raises EPIPE/ECONNRESET on the *stdin stream*, not on the child
         // object — `child.on('error', ...)` above never sees it, so without
         // this listener it is an unhandled 'error' event, which Node turns into
         // an uncaught exception. Installed before the write/end below, per the
         // review. EPIPE/ECONNRESET specifically mean "the child already went
-        // away"; the already-firing (or about-to-fire) 'exit' event carries the
+        // away"; the already-firing (or about-to-fire) 'close' event carries the
         // real, non-secret result, so this swallows exactly those two codes and
         // lets settle() happen there instead. Anything else is a genuine,
         // unexpected stdin failure and is itself the settling error.
@@ -413,7 +381,9 @@ export async function loginInProfile(profile, options = {}) {
     await ensureRuntimeHome(profile);
     const rtHome = runtimeHomePath(profile);
     const env = {
-        ...process.env,
+        ...helperEnvironment(process.env, [
+            ...HELPER_ENV_ALLOWLIST, ...DESKTOP_HELPER_ENV_ALLOWLIST, 'NODE_EXTRA_CA_CERTS',
+        ]),
         HOME: rtHome,
         CODEX_HOME: rtHome,
         AIWG_CONFIG: resolveUserConfigDir(),