@aiwg/cli 2026.10.5 → 2026.10.7

package/dist/src/mcp/tools/worker-invoke.mjs

@@ -159,6 +159,13 @@
 
 import { signalChild } from '../../process/signal-child.mjs';
 import { z } from 'zod';
+
+// Keep accepting existing UUID-shaped identifiers regardless of version bits.
+const invocationUuid = () => z.string().check(ctx => {
+  if (!/^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/.test(ctx.value)) {
+    ctx.issues.push({ code: 'invalid_format', format: 'uuid', input: ctx.value, message: 'Invalid uuid' });
+  }
+}).meta({ format: 'uuid' });
 import { createHash, randomUUID } from 'node:crypto';
 import {
   realpath, readlink as fsReadlink, open as fsOpen, lstat, unlink,
@@ -1532,12 +1539,12 @@ function publicStatus(entry, healthHook) {
 // Tool registration.
 // ===========================================================================
 
-const inputSchema = z.object({
+const inputSchema = z.strictObject({
   // #2915 round 8 (D4): `reconcile_stopped` is an explicit operator-
   // authorized reconciliation operation on this SAME handler (never a
   // mailbox file, never a new breaker) — see `reconcileStopped` below.
   operation: z.enum(['run', 'status', 'cancel', 'reconcile_stopped', 'reset_recovery_scope']),
-  invocation_id: z.string().uuid().optional(),
+  invocation_id: invocationUuid().optional(),
   scope_id: z.string().min(1).max(512).optional(),
   request_id: z.string().min(1).max(128).regex(/^[a-zA-Z0-9_.:-]+$/).optional(),
   role: z.enum(['efficiency', 'coding', 'reasoning']).optional(),
@@ -1553,8 +1560,8 @@ const inputSchema = z.object({
   // configuration exists yet for the MCP shell-launch path — see
   // session-launcher.mjs `verifyRetryPredecessor`, which the CLI entry
   // point already uses). Omission is unrelated work, as always.
-  retry_of: z.string().uuid().optional(),
-}).strict();
+  retry_of: invocationUuid().optional(),
+});
 
 /**
  * #2892 B1: `options.projectRoot` is REQUIRED — the caller (`server.mjs`,
@@ -1726,6 +1733,12 @@ export async function registerWorkerInvokeToolset(server, options = {}) {
       if (plan.invocation?.readiness !== 'launchable') {
         return markTerminal({ status: 'blocked', termination: 'confirmed', diagnostics: plan.diagnostics ?? [] });
       }
+      if (plan.invocation.isolation === 'native-sandbox') {
+        return markTerminal({ status: 'blocked', termination: 'confirmed', diagnostics: [{
+          code: 'OG_POLICY_RELAXATION', pointer: '/worker/isolation',
+          message: 'MCP worker-invoke run does not support pinned native-sandbox isolation',
+        }] });
+      }
       prefix = { root, snapshot, drivers, invocation: plan.invocation };
     } catch (error) {
       return markTerminal({ status: 'blocked', termination: 'confirmed', diagnostics: [error.message] });
@@ -2694,6 +2707,9 @@ export async function registerWorkerInvokeToolset(server, options = {}) {
   }
 
   async function status(input) {
+    const { projectRecoveryStatus, mergeRecoveryStatuses } = await importImpl('mission-protocol/worker-status.js');
+    const recoveryStatus = breaker => projectRecoveryStatus(typeof breaker?.recoveryStatus === 'function'
+      ? { ...breaker.recoveryStatus(), observedAt: now().toISOString() } : null, 'live');
     if (!input.invocation_id) {
       // #2915 round 8 (D4): ordinary status, read-only, no id — lists every
       // invocation this server currently tracks as a `dispatched` reservation
@@ -2712,11 +2728,19 @@ export async function registerWorkerInvokeToolset(server, options = {}) {
         .filter(scope => scope.state === 'operator-intervention')
         .map(scope => ({ scopeId: scope.scopeKey, reason: scope.operatorReason,
           resetInstruction: { operation: 'reset_recovery_scope', scope_id: scope.scopeKey } })));
-      return { unresolvedReservations, interventionScopes };
+      const recovery = mergeRecoveryStatuses([...breakers].map((breaker, index) => {
+        const status = recoveryStatus(breaker);
+        if (breakers.size > 1) {
+          for (const scope of status.scopes) scope.owner = `owner-${index + 1}`;
+          for (const transition of status.transitions) transition.owner = `owner-${index + 1}`;
+        }
+        return status;
+      }));
+      return { unresolvedReservations, interventionScopes, recovery };
     }
     const entry = registry.get(input.invocation_id);
     if (!entry) throw new Error('Unknown invocation_id');
-    return publicStatus(entry, healthHook);
+    return { ...publicStatus(entry, healthHook), recovery: recoveryStatus(entry.recoveryBreaker ?? registry.recoveryOwner) };
   }
 
   /**

package/dist/src/mcp/tools/writer-profiles.mjs

@@ -32,7 +32,7 @@ export function registerWriterProfileResources(server, options = {}) {
   server.registerResource('writer-profile', new ResourceTemplate('aiwg://writer-profiles/{scope}/{id}', { list: undefined }), {
     title: 'Shared Writer Profile', description: 'Explicit scoped read using profile sharing approvals; private exports are unavailable through this resource.', mimeType: 'application/json',
   }, async (uri, variables) => {
-    const selection = z.object({ scope: z.enum(['project', 'user']), id: z.string().regex(/^[a-z0-9][a-z0-9.-]{0,79}$/) }).strict().parse(variables);
+    const selection = z.strictObject({ scope: z.enum(['project', 'user']), id: z.string().regex(/^[a-z0-9][a-z0-9.-]{0,79}$/) }).parse(variables);
     const cwd = await projectRoot(); const { WriterProfileStore, exportWriterProfile } = await api();
     const profile = await new WriterProfileStore({ cwd, scope: selection.scope }).read(selection.id);
     return { contents: [{ uri: uri.href, mimeType: 'application/json', text: JSON.stringify(exportWriterProfile(profile, 'shared')) }] };