@aiwg/cli 2026.10.6 → 2026.10.7

package/dist/src/cli/handlers/agentcard.js

@@ -10,6 +10,7 @@
  * @issue #1253
  */
 import { fetchAgentCard } from '../../a2a/agent-card.js';
+import { resolveSensitiveInput, sensitiveInputOptions } from '../../auth/sensitive-input.js';
 import { loadJwkSet } from '../../a2a/jws.js';
 import { AiwgError, EXIT_CODES, handlerResultFromError } from '../errors.js';
 function parseVerifyArgs(args) {
@@ -39,6 +40,9 @@ function parseVerifyArgs(args) {
     }
     const jwks = get('--jwks');
     const bearer = get('--bearer');
+    if (args.includes('--bearer') && (!bearer || bearer.startsWith('--'))) {
+        throw new AiwgError({ code: 'ERR_AGENTCARD_BEARER', message: '--bearer requires a value; prefer --bearer-stdin, --bearer-file, --bearer-store or --bearer-env.', exitCode: EXIT_CODES.USAGE });
+    }
     const skipVerify = args.includes('--skip-verify');
     const json = args.includes('--json');
     if (!jwks && !skipVerify) {
@@ -73,36 +77,49 @@ async function loadJwksFromSource(source) {
 }
 async function handleVerify(args) {
     const parsed = parseVerifyArgs(args);
+    const sources = sensitiveInputOptions(args, 'bearer');
+    const hasSource = sources.interactive || sources.stdin || sources.file !== undefined || sources.store !== undefined || sources.env !== undefined;
+    if (parsed.bearer !== undefined) {
+        console.error('Warning: --bearer is deprecated and exposes the value on argv; use --bearer-interactive, --bearer-stdin, --bearer-file, --bearer-store or --bearer-env.');
+    }
+    // No source intentionally means public/unauthenticated access, even at a TTY.
+    const bearer = hasSource
+        ? await resolveSensitiveInput(sources)
+        : parsed.bearer === undefined ? undefined : await resolveSensitiveInput({ prefix: 'bearer', env: 'LEGACY_BEARER' }, { readEnv: () => parsed.bearer });
+    const redact = (text) => bearer ? text.split(bearer).join('[REDACTED]') : text;
+    const log = (text) => console.log(redact(text));
+    const error = (text) => console.error(redact(text));
+    const jsonReplacer = (_key, value) => typeof value === 'string' ? redact(value) : value;
     const opts = {
         skipVerify: parsed.skipVerify,
     };
-    if (parsed.bearer !== undefined)
-        opts.bearer = parsed.bearer;
-    if (parsed.jwks !== undefined && !parsed.skipVerify) {
-        opts.jwks = await loadJwksFromSource(parsed.jwks);
-    }
+    if (bearer !== undefined)
+        opts.bearer = bearer;
     let verified;
     try {
+        if (parsed.jwks !== undefined && !parsed.skipVerify) {
+            opts.jwks = await loadJwksFromSource(parsed.jwks);
+        }
         verified = await fetchAgentCard(parsed.host, parsed.instance, opts);
     }
     catch (err) {
         const message = err.message;
         if (parsed.json) {
-            console.log(JSON.stringify({
+            log(JSON.stringify({
                 ok: false,
                 host: parsed.host,
                 instance: parsed.instance,
                 error: message,
-            }, null, 2));
+            }, jsonReplacer, 2));
         }
         else {
-            console.error(`AgentCard verification FAILED for ${parsed.host}/${parsed.instance}`);
-            console.error(`  ${message}`);
+            error(`AgentCard verification FAILED for ${parsed.host}/${parsed.instance}`);
+            error(`  ${message}`);
         }
         return { exitCode: EXIT_CODES.GENERAL };
     }
     if (parsed.json) {
-        console.log(JSON.stringify({
+        log(JSON.stringify({
             ok: true,
             host: parsed.host,
             instance: parsed.instance,
@@ -118,38 +135,38 @@ async function handleVerify(args) {
                 capabilities: verified.card.capabilities,
                 skills: verified.card.skills,
             },
-        }, null, 2));
+        }, jsonReplacer, 2));
     }
     else {
         const banner = parsed.skipVerify ? '(verification SKIPPED)' : 'VERIFIED';
-        console.log(`AgentCard ${banner} for ${parsed.host}/${parsed.instance}`);
-        console.log(`  name:               ${verified.card.name}`);
-        console.log(`  protocolVersion:    ${verified.card.protocolVersion}`);
-        console.log(`  url:                ${verified.card.url}`);
-        console.log(`  version:            ${verified.card.version}`);
+        log(`AgentCard ${banner} for ${parsed.host}/${parsed.instance}`);
+        log(`  name:               ${verified.card.name}`);
+        log(`  protocolVersion:    ${verified.card.protocolVersion}`);
+        log(`  url:                ${verified.card.url}`);
+        log(`  version:            ${verified.card.version}`);
         if (verified.card.preferredTransport) {
-            console.log(`  preferredTransport: ${verified.card.preferredTransport}`);
+            log(`  preferredTransport: ${verified.card.preferredTransport}`);
         }
         if (verified.kid) {
-            console.log(`  signing kid:        ${verified.kid}`);
+            log(`  signing kid:        ${verified.kid}`);
         }
-        console.log(`  verifiedAt:         ${verified.verifiedAt}`);
+        log(`  verifiedAt:         ${verified.verifiedAt}`);
         const exts = verified.card.capabilities?.extensions ?? [];
         if (exts.length > 0) {
-            console.log(`  extensions:`);
+            log(`  extensions:`);
             for (const e of exts) {
                 const tag = e.required ? '[required]' : '[optional]';
-                console.log(`    ${tag} ${e.uri}`);
+                log(`    ${tag} ${e.uri}`);
             }
         }
         const skills = verified.card.skills ?? [];
         if (skills.length > 0) {
-            console.log(`  skills (${skills.length}):`);
+            log(`  skills (${skills.length}):`);
             for (const s of skills.slice(0, 5)) {
-                console.log(`    - ${s.id}${s.name ? ' (' + s.name + ')' : ''}`);
+                log(`    - ${s.id}${s.name ? ' (' + s.name + ')' : ''}`);
             }
             if (skills.length > 5)
-                console.log(`    ... and ${skills.length - 5} more`);
+                log(`    ... and ${skills.length - 5} more`);
         }
     }
     return { exitCode: 0 };
@@ -164,7 +181,12 @@ function printUsage() {
     console.log('  --host <url>        Executor host (e.g. https://exec.test)');
     console.log('  --instance <id>     Instance id (UUIDv7)');
     console.log('  --jwks <path|url>   JWKS file path or URL (required unless --skip-verify)');
-    console.log('  --bearer <token>    Optional bearer token for the card endpoint');
+    console.log('  --bearer-interactive  Read optional bearer in a terminal without echo');
+    console.log('  --bearer-stdin        Read optional bearer from piped stdin');
+    console.log('  --bearer-file <path>  Read optional bearer from an owner-only private file');
+    console.log('  --bearer-store <name> Read optional bearer from a named OS store entry');
+    console.log('  --bearer-env <NAME>   Read optional bearer from a named shell variable');
+    console.log('  --bearer <token>      Deprecated: exposes the value on argv');
     console.log('  --skip-verify       Skip JWS verification (NOT recommended)');
     console.log('  --json              Emit JSON output');
 }

package/dist/src/cli/handlers/auth.js

@@ -1,3 +1,4 @@
+import { namedSensitiveStore, resolveSensitiveInput, sensitiveInputOptions } from '../../auth/sensitive-input.js';
 import { AuthClient, defaultBrowserOpener } from "../../auth/client.js";
 import { authConfigFromEnvironment } from "../../auth/config.js";
 import { createCredentialStore } from "../../auth/credential-store.js";
@@ -5,6 +6,8 @@ function usage() {
     return [
         "Usage:",
         "  aiwg auth login [--device] [--device-label <label>] [--store native|file] [--allow-file-store]",
+        "  aiwg auth secret set <name> [--value-interactive | --value-stdin | --value-file <path> | --value-store <name> | --value-env <name>]",
+        "  aiwg auth secret delete <name>",
         "  aiwg auth status [--json] [--store native|file] [--allow-file-store]",
         "  aiwg auth logout [--all] [--store native|file] [--allow-file-store]",
         "",
@@ -46,9 +49,25 @@ export function createAuthHandler(dependencies = {}) {
                 return { exitCode: 0 };
             }
             const [subcommand, ...args] = ctx.args;
-            if (!["login", "status", "logout"].includes(subcommand))
+            if (!["login", "status", "logout", "secret"].includes(subcommand))
                 return { exitCode: 2, message: usage() };
             try {
+                if (subcommand === "secret") {
+                    const [operation, name, ...inputArgs] = args;
+                    if (!["set", "delete"].includes(operation) || !name || name.startsWith('--'))
+                        return { exitCode: 2, message: usage() };
+                    const store = (dependencies.secretStore ?? namedSensitiveStore)(name);
+                    if (operation === "delete")
+                        await store.deleteSecret();
+                    else {
+                        const secret = await resolveSensitiveInput({ ...sensitiveInputOptions(inputArgs), signal: ctx.signal }, {
+                            environment: dependencies.env, ...dependencies.sensitiveInput,
+                        });
+                        await store.saveSecret(secret);
+                    }
+                    console.log(operation === "delete" ? "Named sensitive value removed." : "Named sensitive value stored.");
+                    return { exitCode: 0 };
+                }
                 const storeMode = value(args, "--store") || "native";
                 if (!["native", "file"].includes(storeMode))
                     return { exitCode: 2, message: "--store must be native or file" };
@@ -119,7 +138,8 @@ export function createAuthHandler(dependencies = {}) {
                 return { exitCode: 0 };
             }
             catch (error) {
-                return { exitCode: classify(error), message: error instanceof Error ? error.message : String(error) };
+                return { exitCode: classify(error), message: subcommand === 'secret' && !/^(--value-|A sensitive value|An interactive terminal|Sensitive value store name)/.test(error instanceof Error ? error.message : '')
+                        ? 'Native sensitive value store operation failed.' : error instanceof Error ? error.message : String(error) };
             }
         },
     };

package/dist/src/cli/handlers/decision.js

@@ -1,3 +1,4 @@
+import { resolveSensitiveInput, sensitiveInputOptions } from '../../auth/sensitive-input.js';
 import { decisionPricing } from '../../decision/pricing.js';
 import { ATTRIBUTION_FIELD_PATTERN, DecisionAskUsageError, decisionCapabilities, DecisionLedgerSinceError, decisionLedgerHistory, decisionLedgerStats, evaluateRequestPath, listPatterns, livePlan, MAX_ATTRIBUTION_FIELD_LENGTH, materializeSyntheticClassificationSetup, parseDecisionLedgerSince, readDecisionContextFile, runDecisionOffloadCheckpoint, runOfflinePattern, setupJev, showPattern, syntheticClassificationSetup, validateDecisionInput, } from '../../decision/driver.js';
 function jsonResult(value, exitCode = 0) {
@@ -17,7 +18,7 @@ function usage() {
         '  validate <request|definition|ruleset|binding> <path>',
         '  evaluate --request <path> [--host-policy-module <path>]',
         '  setup synthetic-classification [--output-dir <dir>]',
-        '  setup jev [--token-stdin] [--region <r>] [--endpoint <url>] [--verify] [--remove]',
+        '  setup jev [--token-interactive | --token-stdin | --token-file <path> | --token-store <name> | --token-env <name>] [--region <r>] [--endpoint <url>] [--verify] [--remove]',
         '  ask --question "<q>" (--yes-no | --choices a,b,c | --scale 1-5) [--provider <id>] [--session <id>] [--caller <tag>] [--record-text]',
         '  history [--since <date>] [--provider <id>] [--session <id>] [--kind yes-no|choices|scale] [--status answered|fallback] [--caller <tag>|<prefix>* | --no-caller] [--json]',
         '  pricing [--refresh --model jev-X.Y.Z] [--dry-run] [--offline | --allow-snapshot] [--json]',
@@ -101,7 +102,7 @@ function takeAttributionOption(args, name, reason) {
     return value;
 }
 async function decisionSetupJev(rest) {
-    const token = rest.includes('--token-stdin') ? (await readStdin()).trim() : undefined;
+    const token = rest.includes('--remove') ? undefined : await resolveSensitiveInput(sensitiveInputOptions(rest, 'token'));
     const result = await setupJev({
         token,
         region: takeOption(rest, '--region'),

package/dist/src/cli/handlers/effect.js

@@ -19,10 +19,8 @@
  * @see docs/contracts/effect-ledger.v1.md
  */
 import { readFile } from 'node:fs/promises';
-import { basename, resolve } from 'node:path';
-import { createSecretStore } from '../../auth/credential-store.js';
-import { readAiwgConfig } from '../../config/aiwg-config.js';
-import { CORE_EFFECT_KINDS, DEFAULT_LEDGER_KEY_SERVICE, EFFECT_EXIT_CODES, EFFECT_SUBSYSTEMS, EffectLedgerError, LEDGER_TEST_KEY_ENV, LedgerSigningKey, activeKey, containsRestrictedMaterial, createBuiltinVerifierRegistry, createTrackerVerifiers, credentialStoreKeyProvider, effectId as deriveEffectId, effectOutputJson, environmentTestKeyProvider, generateLedgerKeySecret, initLedgerKeyring, inspectLedgerLocks, isValidEffectId, ledgerLockRecoveryVerifier, lookupEffect, openEffectLedger, payloadDigest, readLedgerKeyring, reconcileEffect, recordIntent, recordOutcome, recordReconciled, recoverStaleLedgerLock, rotateKey, runVerifier, staticKeyProvider, verifyDecisionLinks, verifyLedger, writeCheckpoint, } from '../../effects/index.js';
+import { resolve } from 'node:path';
+import { CORE_EFFECT_KINDS, EFFECT_EXIT_CODES, EFFECT_SUBSYSTEMS, EffectLedgerError, LedgerSigningKey, activeKey, containsRestrictedMaterial, createBuiltinVerifierRegistry, createTrackerVerifiers, effectId as deriveEffectId, effectOutputJson, generateLedgerKeySecret, initLedgerKeyring, inspectLedgerLocks, isValidEffectId, ledgerLockRecoveryVerifier, lookupEffect, payloadDigest, readLedgerKeyring, reconcileEffect, recordIntent, recordOutcome, recordReconciled, recoverStaleLedgerLock, rotateKey, runVerifier, staticKeyProvider, verifyDecisionLinks, verifyLedger, writeCheckpoint, } from '../../effects/index.js';
 import { parseLedgerPrivateKey } from '../../effects/keys.js';
 import { JsonlOperatorDecisionStore, verifyDecisionChain } from '../../audit/operator-decision.js';
 import { readConfig, readGitRemoteUrls } from '../../tracker/project-inputs.js';
@@ -166,77 +164,7 @@ function keyValue(entry, flag) {
         throw usage(`--${flag} expects key=value`, 'invalid-key-value');
     return [entry.slice(0, eq), entry.slice(eq + 1)];
 }
-const IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9._:/@-]{0,255}$/;
-function defaultProject(projectDir) {
-    const cleaned = basename(resolve(projectDir)).replace(/[^A-Za-z0-9._:/@-]/g, '-').replace(/^[^A-Za-z0-9]+/, '');
-    return cleaned && IDENTIFIER.test(cleaned) ? cleaned : 'project';
-}
-async function hostConfig(projectDir) {
-    let config;
-    try {
-        config = await readAiwgConfig(projectDir);
-    }
-    catch {
-        throw new EffectLedgerError('usage', 'aiwg.config could not be read', 'config-unreadable');
-    }
-    const effects = config?.effects;
-    if (effects === undefined || effects === null)
-        return {};
-    if (typeof effects !== 'object' || Array.isArray(effects))
-        throw usage('aiwg.config effects must be an object', 'config-invalid');
-    return effects;
-}
-function testContext(env) {
-    return env.VITEST === 'true' || env.NODE_ENV === 'test' || env.CI === 'true' || env.CI === '1';
-}
-function keyStore(session, role) {
-    const { deps, config, account } = session;
-    if (deps.keyStore)
-        return deps.keyStore(role, account);
-    if (session.env[LEDGER_TEST_KEY_ENV] && testContext(session.env))
-        return null;
-    const provider = config.keyProvider ?? {};
-    try {
-        if (provider.type === 'file') {
-            if (!provider.path)
-                throw new Error('missing path');
-            const pathname = resolve(session.projectDir, provider.path);
-            return createSecretStore({ useFile: true, allowFile: true, pathname: role === 'next' ? `${pathname}.next` : pathname, service: DEFAULT_LEDGER_KEY_SERVICE, account });
-        }
-        if (provider.type !== undefined && provider.type !== 'credential-store')
-            throw new Error('unknown provider');
-        return createSecretStore({ service: provider.service ?? DEFAULT_LEDGER_KEY_SERVICE, account: role === 'next' ? `${account}.next` : account });
-    }
-    catch {
-        throw new EffectLedgerError('key-unavailable', 'Effect ledger key provider is not configured correctly on this host', 'key-provider-invalid');
-    }
-}
-function keyProvider(session) {
-    const store = keyStore(session, 'current');
-    if (!store)
-        return environmentTestKeyProvider(session.env);
-    return credentialStoreKeyProvider({ account: session.account, store });
-}
-function describeKeyProvider(session) {
-    if (session.deps.keyStore)
-        return { type: 'injected', account: session.account };
-    if (session.env[LEDGER_TEST_KEY_ENV] && testContext(session.env))
-        return { type: 'environment-test-key' };
-    const provider = session.config.keyProvider ?? {};
-    if (provider.type === 'file')
-        return { type: 'file', account: session.account };
-    return { type: 'credential-store', service: provider.service ?? DEFAULT_LEDGER_KEY_SERVICE, account: session.account };
-}
-function openLedger(session, registry) {
-    const writer = session.config.writer ?? 'cli';
-    return openEffectLedger({
-        projectDir: session.projectDir, scope: session.scope, writer, keyProvider: keyProvider(session),
-        ...(session.deps.clock ? { clock: session.deps.clock } : {}),
-        ...(session.deps.sink ? { sink: session.deps.sink } : {}),
-        ...(registry ? { verifiers: registry } : {}),
-        ...(session.deps.lockTimeoutMs ? { lockTimeoutMs: session.deps.lockTimeoutMs } : {}),
-    });
-}
+import { effectSession, keyStore, describeKeyProvider, openLedger } from '../../effects/host.js';
 /**
  * The one place the CLI builds its verifier registry: the built-ins, lock
  * recovery, the tracker verifiers (#2719) and any injected extensions.
@@ -804,15 +732,7 @@ async function execute(ctx, deps) {
             throw usage('--format must be json or text', 'invalid-format');
         const projectDir = resolve(one(parsed, 'project-dir') ?? ctx.cwd ?? process.cwd());
         const subsystem = resolveSubsystem(parsed);
-        const config = await hostConfig(projectDir);
-        const tenant = config.tenant ?? 'local';
-        const project = config.project ?? defaultProject(projectDir);
-        if (!IDENTIFIER.test(tenant) || !IDENTIFIER.test(project))
-            throw usage('aiwg.config effects tenant and project must be identifiers', 'config-invalid');
-        const scope = { tenant, project, subsystem };
-        const env = deps.env ?? process.env;
-        const account = config.keyProvider?.account ?? `ledger/${tenant}/${project}/${subsystem}`;
-        const session = { projectDir, scope, config, account, deps, env };
+        const session = await effectSession(projectDir, subsystem, deps);
         let rendered;
         switch (sub) {
             case 'id':

package/dist/src/cli/handlers/guided-setup.js

@@ -56,7 +56,7 @@ export function parseGuidedSetupFlags(args, command) {
         const separator = raw.indexOf('=');
         const provider = raw.slice(0, separator) === 'jev' ? 'jev' : normalizeProviderDefinitionId(raw.slice(0, separator));
         if (separator < 1 || !provider || provider === 'generic')
-            throw new Error('--credential requires a known <provider>=env:NAME|file:PATH|stdin.');
+            throw new Error('--credential requires a known <provider>=stdin|file:PATH|store:NAME|env:NAME.');
         credentials[provider] = credentialReference(raw.slice(separator + 1));
     }
     if (tokenStdin) {

package/dist/src/cli/handlers/init.js

@@ -191,7 +191,7 @@ export const initHandler = {
   --intent code|docs|ops|mixed     Workspace usage intent
   --jev enable|decline|defer     Optional external decision service (default off)
   --region <r> --endpoint <url> --verify --remove --token-stdin  Existing Jev options
-  --credential <provider>=env:NAME|file:PATH|stdin  Credential reference only
+  --credential <provider>=stdin|file:PATH|store:NAME|env:NAME  Credential reference only
   --providers <list>              Provider IDs
   --default-scripts true|false    Include default scripts
   --custom-scripts true|false     Include custom scripts

package/dist/src/cli/handlers/install.js

@@ -18,6 +18,7 @@
  * @implements #804
  */
 import path from 'path';
+import { sensitiveInputOptions } from '../../auth/sensitive-input.js';
 import { installPackage } from '../../packages/registry.js';
 import { recordDeployment } from '../../packages/package-registry.js';
 import { marketplaceConfigDir, resolveVerificationPolicy } from '../../marketplace/exchange.js';
@@ -59,6 +60,7 @@ export const installHandler = {
                     '  --deploy                Deploy immediately after install',
                     '  --provider <name>       Target provider (claude, copilot, cursor...)',
                     '  --target <dir>          Project directory to deploy into',
+                    '  --token-interactive | --token-stdin | --token-file <path> | --token-store <name> | --token-env <name>',
                     '  --refresh               Force re-pull even if cached',
                     '  --ref <tag-or-sha>      Resolve this ref and lock its immutable commit',
                     '  --package <id>          Select one wrapper when a repository contains several',
@@ -69,6 +71,9 @@ export const installHandler = {
                 ].join('\n'),
             };
         }
+        if (/^https?:\/\/[^/]*@/.test(rawRef)) {
+            return { exitCode: 1, message: 'Credentials in Git URLs are refused; use --token-stdin, --token-file, --token-store or --token-env.' };
+        }
         const deploy = hasFlag(ctx.args, '--deploy');
         const refresh = hasFlag(ctx.args, '--refresh');
         const provider = parseFlag(ctx.args, '--provider') ?? 'claude';
@@ -97,6 +102,7 @@ export const installHandler = {
             const resolvedPolicy = await resolveVerificationPolicy(policyName, scope);
             const installed = await installPackage(rawRef, {
                 refresh,
+                tokenInput: sensitiveInputOptions(ctx.args, 'token'),
                 ref: parseFlag(ctx.args, '--ref'),
                 packageSelector: parseFlag(ctx.args, '--package'),
                 verify,

package/dist/src/cli/handlers/marketplace.js

@@ -9,6 +9,7 @@
  */
 import fs from 'node:fs';
 import path from 'node:path';
+import { sensitiveInputOptions } from '../../auth/sensitive-input.js';
 import { searchSkills } from '../../skills/registry.js';
 import { installPackage, listInstalledPackages } from '../../packages/registry.js';
 import { GitAdapter } from '../../packages/adapters/git.js';
@@ -24,7 +25,7 @@ const USAGE = [
     '  aiwg marketplace verify <package|lock>    Verify cached content and receipts offline',
     '  aiwg marketplace export <package> --output <archive.json>',
     '  aiwg marketplace import <archive.json> [--project-local]',
-    '  aiwg marketplace publish <source> --key <pem> --publisher <id>',
+    '  aiwg marketplace publish <source> --publisher <id> [--key-file <pem> | --key-stdin]',
     '  aiwg marketplace remove <catalog-id>',
     '  aiwg marketplace list                    List installed marketplace packages',
     '',
@@ -33,6 +34,11 @@ const USAGE = [
     '  --project-local    Store/read state below the target project .aiwg directory',
     '  --global           Store/read state in the user AIWG directory (default)',
     '  --policy <name>    Named trust policy or JSON policy path',
+    'Git fetch token sources:',
+    '  --token-interactive | --token-stdin | --token-file <path> | --token-store <name> | --token-env <name>',
+    'Publish key sources (multiline PEM):',
+    '  --key-interactive | --key-stdin | --key-file <path> | --key-store <name> | --key-env <name>',
+    '  --key <path>       Compatibility alias for --key-file (private file required)',
 ].join('\n');
 function parseFlag(args, flag) {
     const idx = args.indexOf(flag);
@@ -105,7 +111,10 @@ async function handleAdd(ctx) {
         const requestedRef = parseFlag(ctx.args, '--ref') ?? 'HEAD';
         const adapter = new GitAdapter();
         const source = { gitUrl: argument, ref: requestedRef, label: argument };
-        const cachePath = await adapter.fetch(source, { refresh: hasFlag(ctx.args, '--refresh') });
+        const cachePath = await adapter.fetch(source, {
+            refresh: hasFlag(ctx.args, '--refresh'),
+            tokenInput: sensitiveInputOptions(ctx.args, 'token'),
+        });
         const identity = await inspectGitCheckout(cachePath);
         const candidates = [
             path.join(cachePath, 'aiwg-marketplace-catalog.json'),
@@ -251,6 +260,7 @@ async function handleInstall(ctx) {
         }
         const installed = await installPackage(rawRef, {
             configDir,
+            tokenInput: sensitiveInputOptions(ctx.args, 'token'),
             ref,
             packageSelector: parseFlag(ctx.args, '--package'),
             refresh: hasFlag(ctx.args, '--refresh'),
@@ -342,8 +352,8 @@ async function handlePublish(ctx) {
         return argument;
     const privateKeyPath = parseFlag(ctx.args, '--key');
     const publisher = parseFlag(ctx.args, '--publisher');
-    if (!privateKeyPath || !publisher) {
-        return { exitCode: 1, message: 'Error: Usage: aiwg marketplace publish <source> --key <ed25519.pem> --publisher <id> [--output <dir>]' };
+    if (!publisher) {
+        return { exitCode: 1, message: 'Error: Usage: aiwg marketplace publish <source> [--key-file <ed25519.pem> | --key-stdin] --publisher <id> [--output <dir>]' };
     }
     try {
         const outputDir = parseFlag(ctx.args, '--output') ?? path.join(path.resolve(argument), '.aiwg', 'marketplace');
@@ -355,6 +365,7 @@ async function handlePublish(ctx) {
             sourceDir: argument,
             outputDir,
             privateKeyPath,
+            keyInput: sensitiveInputOptions(ctx.args, 'key'),
             publicKeyPath: parseFlag(ctx.args, '--public-key'),
             keyId: parseFlag(ctx.args, '--key-id'),
             publisher,

package/dist/src/cli/handlers/setup.js

@@ -1,4 +1,7 @@
 import { boundedSpawnSync } from '../../process/bounded-child-process.mjs';
+import { helperEnvironment, HELPER_ENV_ALLOWLIST } from '../../process/cli-command.mjs';
+import { readPrivateValueFile } from '../../auth/sensitive-input.js';
+import { setupJev } from '../../decision/driver.js';
 import { existsSync } from 'fs';
 import { emptyConfig, FORCE_PUSH_POLICY_ALIAS_NOTE, normalizeForcePushPolicy as normalizeForcePushPolicyShared, getConfigPath, getProjectDir, readAiwgConfig, resolveRemoteProvider, VALID_PROVIDERS, writeAiwgConfig, } from '../../config/aiwg-config.js';
 import { AiwgError, EXIT_CODES } from '../errors.js';
@@ -133,6 +136,7 @@ export function parseSetupProjectOptions(ctx) {
 }
 export function detectGitRemotes(projectDir) {
     const result = boundedSpawnSync('git', ['-C', projectDir, 'remote', '-v'], 'quick', {
+        env: helperEnvironment(),
         encoding: 'utf-8',
         stdio: ['ignore', 'pipe', 'ignore'],
     });
@@ -156,6 +160,7 @@ export function detectGitRemotes(projectDir) {
 }
 function detectDefaultBranch(projectDir) {
     const symbolic = boundedSpawnSync('git', ['-C', projectDir, 'symbolic-ref', '--quiet', '--short', 'refs/remotes/origin/HEAD'], 'quick', {
+        env: helperEnvironment(),
         encoding: 'utf-8',
         stdio: ['ignore', 'pipe', 'ignore'],
     });
@@ -163,6 +168,7 @@ function detectDefaultBranch(projectDir) {
     if (symbolic.status === 0 && fromOrigin)
         return fromOrigin;
     const branch = boundedSpawnSync('git', ['-C', projectDir, 'branch', '--show-current'], 'quick', {
+        env: helperEnvironment(),
         encoding: 'utf-8',
         stdio: ['ignore', 'pipe', 'ignore'],
     });
@@ -170,6 +176,7 @@ function detectDefaultBranch(projectDir) {
 }
 function gitConfig(projectDir, key) {
     const result = boundedSpawnSync('git', ['-C', projectDir, 'config', '--get', key], 'quick', {
+        env: helperEnvironment(),
         encoding: 'utf-8',
         stdio: ['ignore', 'pipe', 'ignore'],
     });
@@ -656,7 +663,7 @@ function defaultGuidedApplyIO(plan, fresh, ctx, projectDir, frameworkRoot, canPr
                     chunks.push(Buffer.from(chunk));
                 return Buffer.concat(chunks).toString('utf8');
             } } : {}),
-        readCredentialFile: async (path) => readFile(path, 'utf8'),
+        readCredentialFile: async (path) => readPrivateValueFile(path, '--credential'),
         // stdin-at-apply prompts for the value without echoing it anywhere: the
         // label names the consumer only, and the value never reaches output.
         ...(canPrompt ? { promptCredential: async (label) => {
@@ -674,26 +681,20 @@ function defaultGuidedApplyIO(plan, fresh, ctx, projectDir, frameworkRoot, canPr
             await writeSetupPlan(projectDir, next);
         },
         owners: {
-            configureJev: async ({ action, token, options, credential }) => {
+            configureJev: async ({ action, token, options }) => {
                 if (options != null)
                     validateJevOptions(options);
                 const settings = (options ?? {});
-                const args = ['decision', 'setup', 'jev', ...(settings.remove === true ? ['--remove'] : ['--token-stdin']),
-                    ...(typeof settings.region === 'string' ? ['--region', settings.region] : []),
-                    ...(typeof settings.endpoint === 'string' ? ['--endpoint', settings.endpoint] : []),
-                    ...(settings.verify === true ? ['--verify'] : [])];
-                const environment = { ...process.env };
-                delete environment.JEV_API_KEY;
-                delete environment.AIWG_DECISION_JEV_API_KEY;
-                if (credential?.source === 'env')
-                    delete environment[credential.name];
-                const child = boundedSpawnSync(process.execPath, [join(frameworkRoot, 'bin', 'aiwg.mjs'), ...args], 'network', {
-                    cwd: action.workspace, env: environment, input: token ? `${token}\n` : '', encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'],
-                    maxBuffer: 1024 * 1024,
-                });
-                if (child.error || child.status !== 0)
-                    throw new Error('Jev setup failed.');
-                if (settings.verify === true && settings.remove !== true && JSON.parse(child.stdout).verified !== true) {
+                // Invoke the existing owner directly. spawnSync's input option is
+                // rendered by NODE_DEBUG=child_process before the child can read it.
+                const result = await setupJev({
+                    token,
+                    ...(typeof settings.region === 'string' ? { region: settings.region } : {}),
+                    ...(typeof settings.endpoint === 'string' ? { endpoint: settings.endpoint } : {}),
+                    verify: settings.verify === true,
+                    remove: settings.remove === true,
+                }, { env: process.env, cwd: action.workspace });
+                if (settings.verify === true && settings.remove !== true && result.verified !== true) {
                     throw new Error('Jev verification incomplete.');
                 }
             },
@@ -711,7 +712,10 @@ function defaultGuidedApplyIO(plan, fresh, ctx, projectDir, frameworkRoot, canPr
                 await writeAiwgConfig(action.workspace, next);
                 const child = boundedSpawnSync(process.execPath, [join(frameworkRoot, 'bin', 'aiwg.mjs'),
                     'doctor', '--probe-workers', '--qualify', '--yes', '--json'], 'long', {
-                    cwd: action.workspace, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: 1024 * 1024,
+                    cwd: action.workspace, env: helperEnvironment(process.env, [...HELPER_ENV_ALLOWLIST,
+                        'AIWG_ROOT', 'AIWG_HOME', 'AIWG_CONFIG', 'XDG_CONFIG_HOME', 'XDG_DATA_HOME',
+                        'AIWG_ARTIFACTS_PATH', 'AIWG_PROJECT_ARTIFACTS_PATH', 'AIWG_PROJECT_AIWG_DIR',
+                        'AIWG_PROJECT_MEMORY_HOME', 'NO_UPDATE_NOTIFIER', 'NO_COLOR', 'CI']), encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: 1024 * 1024,
                 });
                 if (child.error || child.status !== 0)
                     throw new Error('Worker qualification failed.');
@@ -813,7 +817,7 @@ Options:
   --intent code|docs|ops|mixed     Workspace usage intent
   --jev enable|decline|defer     Optional external decision service (default off)
   --region <r> --endpoint <url> --verify --remove --token-stdin  Existing Jev options
-  --credential <provider>=env:NAME|file:PATH|stdin  Credential reference only
+  --credential <provider>=stdin|file:PATH|store:NAME|env:NAME  Credential reference only
   --yes                           Confirm writes without prompting
   --dry-run                       Preview the setup plan
   --review                        Render the saved guided plan per workspace/provider (writes nothing)