@aiwg/cli 2026.10.6 → 2026.10.8

package/dist/src/cli/handlers/agentcard.js

@@ -10,6 +10,7 @@
  * @issue #1253
  */
 import { fetchAgentCard } from '../../a2a/agent-card.js';
+import { resolveSensitiveInput, sensitiveInputOptions } from '../../auth/sensitive-input.js';
 import { loadJwkSet } from '../../a2a/jws.js';
 import { AiwgError, EXIT_CODES, handlerResultFromError } from '../errors.js';
 function parseVerifyArgs(args) {
@@ -39,6 +40,9 @@ function parseVerifyArgs(args) {
     }
     const jwks = get('--jwks');
     const bearer = get('--bearer');
+    if (args.includes('--bearer') && (!bearer || bearer.startsWith('--'))) {
+        throw new AiwgError({ code: 'ERR_AGENTCARD_BEARER', message: '--bearer requires a value; prefer --bearer-stdin, --bearer-file, --bearer-store or --bearer-env.', exitCode: EXIT_CODES.USAGE });
+    }
     const skipVerify = args.includes('--skip-verify');
     const json = args.includes('--json');
     if (!jwks && !skipVerify) {
@@ -73,36 +77,49 @@ async function loadJwksFromSource(source) {
 }
 async function handleVerify(args) {
     const parsed = parseVerifyArgs(args);
+    const sources = sensitiveInputOptions(args, 'bearer');
+    const hasSource = sources.interactive || sources.stdin || sources.file !== undefined || sources.store !== undefined || sources.env !== undefined;
+    if (parsed.bearer !== undefined) {
+        console.error('Warning: --bearer is deprecated and exposes the value on argv; use --bearer-interactive, --bearer-stdin, --bearer-file, --bearer-store or --bearer-env.');
+    }
+    // No source intentionally means public/unauthenticated access, even at a TTY.
+    const bearer = hasSource
+        ? await resolveSensitiveInput(sources)
+        : parsed.bearer === undefined ? undefined : await resolveSensitiveInput({ prefix: 'bearer', env: 'LEGACY_BEARER' }, { readEnv: () => parsed.bearer });
+    const redact = (text) => bearer ? text.split(bearer).join('[REDACTED]') : text;
+    const log = (text) => console.log(redact(text));
+    const error = (text) => console.error(redact(text));
+    const jsonReplacer = (_key, value) => typeof value === 'string' ? redact(value) : value;
     const opts = {
         skipVerify: parsed.skipVerify,
     };
-    if (parsed.bearer !== undefined)
-        opts.bearer = parsed.bearer;
-    if (parsed.jwks !== undefined && !parsed.skipVerify) {
-        opts.jwks = await loadJwksFromSource(parsed.jwks);
-    }
+    if (bearer !== undefined)
+        opts.bearer = bearer;
     let verified;
     try {
+        if (parsed.jwks !== undefined && !parsed.skipVerify) {
+            opts.jwks = await loadJwksFromSource(parsed.jwks);
+        }
         verified = await fetchAgentCard(parsed.host, parsed.instance, opts);
     }
     catch (err) {
         const message = err.message;
         if (parsed.json) {
-            console.log(JSON.stringify({
+            log(JSON.stringify({
                 ok: false,
                 host: parsed.host,
                 instance: parsed.instance,
                 error: message,
-            }, null, 2));
+            }, jsonReplacer, 2));
         }
         else {
-            console.error(`AgentCard verification FAILED for ${parsed.host}/${parsed.instance}`);
-            console.error(`  ${message}`);
+            error(`AgentCard verification FAILED for ${parsed.host}/${parsed.instance}`);
+            error(`  ${message}`);
         }
         return { exitCode: EXIT_CODES.GENERAL };
     }
     if (parsed.json) {
-        console.log(JSON.stringify({
+        log(JSON.stringify({
             ok: true,
             host: parsed.host,
             instance: parsed.instance,
@@ -118,38 +135,38 @@ async function handleVerify(args) {
                 capabilities: verified.card.capabilities,
                 skills: verified.card.skills,
             },
-        }, null, 2));
+        }, jsonReplacer, 2));
     }
     else {
         const banner = parsed.skipVerify ? '(verification SKIPPED)' : 'VERIFIED';
-        console.log(`AgentCard ${banner} for ${parsed.host}/${parsed.instance}`);
-        console.log(`  name:               ${verified.card.name}`);
-        console.log(`  protocolVersion:    ${verified.card.protocolVersion}`);
-        console.log(`  url:                ${verified.card.url}`);
-        console.log(`  version:            ${verified.card.version}`);
+        log(`AgentCard ${banner} for ${parsed.host}/${parsed.instance}`);
+        log(`  name:               ${verified.card.name}`);
+        log(`  protocolVersion:    ${verified.card.protocolVersion}`);
+        log(`  url:                ${verified.card.url}`);
+        log(`  version:            ${verified.card.version}`);
         if (verified.card.preferredTransport) {
-            console.log(`  preferredTransport: ${verified.card.preferredTransport}`);
+            log(`  preferredTransport: ${verified.card.preferredTransport}`);
         }
         if (verified.kid) {
-            console.log(`  signing kid:        ${verified.kid}`);
+            log(`  signing kid:        ${verified.kid}`);
         }
-        console.log(`  verifiedAt:         ${verified.verifiedAt}`);
+        log(`  verifiedAt:         ${verified.verifiedAt}`);
         const exts = verified.card.capabilities?.extensions ?? [];
         if (exts.length > 0) {
-            console.log(`  extensions:`);
+            log(`  extensions:`);
             for (const e of exts) {
                 const tag = e.required ? '[required]' : '[optional]';
-                console.log(`    ${tag} ${e.uri}`);
+                log(`    ${tag} ${e.uri}`);
             }
         }
         const skills = verified.card.skills ?? [];
         if (skills.length > 0) {
-            console.log(`  skills (${skills.length}):`);
+            log(`  skills (${skills.length}):`);
             for (const s of skills.slice(0, 5)) {
-                console.log(`    - ${s.id}${s.name ? ' (' + s.name + ')' : ''}`);
+                log(`    - ${s.id}${s.name ? ' (' + s.name + ')' : ''}`);
             }
             if (skills.length > 5)
-                console.log(`    ... and ${skills.length - 5} more`);
+                log(`    ... and ${skills.length - 5} more`);
         }
     }
     return { exitCode: 0 };
@@ -164,7 +181,12 @@ function printUsage() {
     console.log('  --host <url>        Executor host (e.g. https://exec.test)');
     console.log('  --instance <id>     Instance id (UUIDv7)');
     console.log('  --jwks <path|url>   JWKS file path or URL (required unless --skip-verify)');
-    console.log('  --bearer <token>    Optional bearer token for the card endpoint');
+    console.log('  --bearer-interactive  Read optional bearer in a terminal without echo');
+    console.log('  --bearer-stdin        Read optional bearer from piped stdin');
+    console.log('  --bearer-file <path>  Read optional bearer from an owner-only private file');
+    console.log('  --bearer-store <name> Read optional bearer from a named OS store entry');
+    console.log('  --bearer-env <NAME>   Read optional bearer from a named shell variable');
+    console.log('  --bearer <token>      Deprecated: exposes the value on argv');
     console.log('  --skip-verify       Skip JWS verification (NOT recommended)');
     console.log('  --json              Emit JSON output');
 }

package/dist/src/cli/handlers/auth.js

@@ -1,3 +1,4 @@
+import { namedSensitiveStore, resolveSensitiveInput, sensitiveInputOptions } from '../../auth/sensitive-input.js';
 import { AuthClient, defaultBrowserOpener } from "../../auth/client.js";
 import { authConfigFromEnvironment } from "../../auth/config.js";
 import { createCredentialStore } from "../../auth/credential-store.js";
@@ -5,6 +6,8 @@ function usage() {
     return [
         "Usage:",
         "  aiwg auth login [--device] [--device-label <label>] [--store native|file] [--allow-file-store]",
+        "  aiwg auth secret set <name> [--value-interactive | --value-stdin | --value-file <path> | --value-store <name> | --value-env <name>]",
+        "  aiwg auth secret delete <name>",
         "  aiwg auth status [--json] [--store native|file] [--allow-file-store]",
         "  aiwg auth logout [--all] [--store native|file] [--allow-file-store]",
         "",
@@ -46,9 +49,25 @@ export function createAuthHandler(dependencies = {}) {
                 return { exitCode: 0 };
             }
             const [subcommand, ...args] = ctx.args;
-            if (!["login", "status", "logout"].includes(subcommand))
+            if (!["login", "status", "logout", "secret"].includes(subcommand))
                 return { exitCode: 2, message: usage() };
             try {
+                if (subcommand === "secret") {
+                    const [operation, name, ...inputArgs] = args;
+                    if (!["set", "delete"].includes(operation) || !name || name.startsWith('--'))
+                        return { exitCode: 2, message: usage() };
+                    const store = (dependencies.secretStore ?? namedSensitiveStore)(name);
+                    if (operation === "delete")
+                        await store.deleteSecret();
+                    else {
+                        const secret = await resolveSensitiveInput({ ...sensitiveInputOptions(inputArgs), signal: ctx.signal }, {
+                            environment: dependencies.env, ...dependencies.sensitiveInput,
+                        });
+                        await store.saveSecret(secret);
+                    }
+                    console.log(operation === "delete" ? "Named sensitive value removed." : "Named sensitive value stored.");
+                    return { exitCode: 0 };
+                }
                 const storeMode = value(args, "--store") || "native";
                 if (!["native", "file"].includes(storeMode))
                     return { exitCode: 2, message: "--store must be native or file" };
@@ -119,7 +138,8 @@ export function createAuthHandler(dependencies = {}) {
                 return { exitCode: 0 };
             }
             catch (error) {
-                return { exitCode: classify(error), message: error instanceof Error ? error.message : String(error) };
+                return { exitCode: classify(error), message: subcommand === 'secret' && !/^(--value-|A sensitive value|An interactive terminal|Sensitive value store name)/.test(error instanceof Error ? error.message : '')
+                        ? 'Native sensitive value store operation failed.' : error instanceof Error ? error.message : String(error) };
             }
         },
     };

package/dist/src/cli/handlers/cost-report.js

@@ -1,6 +1,7 @@
 /** OpenRouter fleet cost-report CLI handler. @issue #1187 */
 import os from 'node:os';
 import path from 'node:path';
+import { sensitiveInputOptions } from '../../auth/sensitive-input.js';
 import { FleetConfigMissingError, formatFleetSpendReport, generateFleetSpendReport, } from '../../cost/fleet-report.js';
 function option(args, name) {
     const index = args.indexOf(name);
@@ -9,10 +10,11 @@ function option(args, name) {
 }
 function usage() {
     return [
-        'Usage: aiwg cost-report (--fleet | --key <key_ref>) [--source openrouter] [--config <fleet.yaml>] [--json]',
+        'Usage: aiwg cost-report (--fleet | --key <key_ref> [--key-store <name>]) [--source openrouter] [--config <fleet.yaml>] [--json]',
         '',
         'Reads bot-to-key references from ~/.config/aiwg/fleet.yaml and credentials from',
         '~/.config/aiwg/keys/<key_ref> or AIWG_OPENROUTER_KEY_<KEY_REF>.',
+        'Use --key-store <name> for one key, or per-entry key_store references in fleet YAML.',
         '',
         'AIWG observes and correlates spend; OpenRouter enforces all key limits and caps.',
     ].join('\n');
@@ -40,6 +42,9 @@ export const costReportHandler = {
             ? path.resolve(ctx.cwd, configuredPath)
             : path.join(os.homedir(), '.config', 'aiwg', 'fleet.yaml');
         try {
+            const keyStore = sensitiveInputOptions(ctx.args, 'key').store;
+            if (keyStore !== undefined && !keyRef)
+                return { exitCode: 2, message: '--key-store requires --key <key_ref>; use per-entry key_store references for --fleet.' };
             const capValue = option(ctx.args, '--monthly-cap');
             const cap = capValue === undefined ? 0 : Number(capValue);
             if (!Number.isFinite(cap) || cap < 0)
@@ -53,6 +58,7 @@ export const costReportHandler = {
                             bot: option(ctx.args, '--bot') ?? keyRef,
                             machine: option(ctx.args, '--machine') ?? os.hostname(),
                             key_ref: keyRef,
+                            ...(keyStore !== undefined ? { key_store: keyStore } : {}),
                             monthly_cap: cap,
                         }],
                 } : {}),

package/dist/src/cli/handlers/decision.js

@@ -1,11 +1,12 @@
+import { resolveSensitiveInput, sensitiveInputOptions } from '../../auth/sensitive-input.js';
 import { decisionPricing } from '../../decision/pricing.js';
-import { ATTRIBUTION_FIELD_PATTERN, DecisionAskUsageError, decisionCapabilities, DecisionLedgerSinceError, decisionLedgerHistory, decisionLedgerStats, evaluateRequestPath, listPatterns, livePlan, MAX_ATTRIBUTION_FIELD_LENGTH, materializeSyntheticClassificationSetup, parseDecisionLedgerSince, readDecisionContextFile, runDecisionOffloadCheckpoint, runOfflinePattern, setupJev, showPattern, syntheticClassificationSetup, validateDecisionInput, } from '../../decision/driver.js';
+import { ATTRIBUTION_FIELD_PATTERN, DecisionAskUsageError, decisionCapabilities, DecisionLedgerSinceError, decisionLedgerHistory, decisionLedgerStats, rotateDecisionLedger, parseDecisionLedgerRetention, evaluateRequestPath, listPatterns, livePlan, MAX_ATTRIBUTION_FIELD_LENGTH, materializeSyntheticClassificationSetup, parseDecisionLedgerSince, readDecisionContextFile, runDecisionOffloadCheckpoint, runOfflinePattern, setupJev, showPattern, syntheticClassificationSetup, validateDecisionInput, } from '../../decision/driver.js';
 function jsonResult(value, exitCode = 0) {
     return { exitCode, message: JSON.stringify(value, null, 2), rawOutput: true };
 }
 function usage() {
     return [
-        'Usage: aiwg decision <capabilities|status|patterns|validate|evaluate|setup|history|stats|pricing> [options]',
+        'Usage: aiwg decision <capabilities|status|patterns|validate|evaluate|setup|history|stats|rotate|pricing> [options]',
         '       aiwg decision ask --question "<q>" (--yes-no | --choices a,b,c | --scale 1-5) [--context <text> | --context-file <path> | --context-stdin] [--threshold 0.8] [--timeout-ms 15000] [--passes N] [--escalation-passes N] [--provider <id>] [--session <id>] [--caller <tag>] [--record-text] [--json]',
         '',
         'Commands:',
@@ -17,11 +18,12 @@ function usage() {
         '  validate <request|definition|ruleset|binding> <path>',
         '  evaluate --request <path> [--host-policy-module <path>]',
         '  setup synthetic-classification [--output-dir <dir>]',
-        '  setup jev [--token-stdin] [--region <r>] [--endpoint <url>] [--verify] [--remove]',
+        '  setup jev [--token-interactive | --token-stdin | --token-file <path> | --token-store <name> | --token-env <name>] [--region <r>] [--endpoint <url>] [--verify] [--remove]',
         '  ask --question "<q>" (--yes-no | --choices a,b,c | --scale 1-5) [--provider <id>] [--session <id>] [--caller <tag>] [--record-text]',
-        '  history [--since <date>] [--provider <id>] [--session <id>] [--kind yes-no|choices|scale] [--status answered|fallback] [--caller <tag>|<prefix>* | --no-caller] [--json]',
+        '  history [--since <date>] [--provider <id>] [--session <id>] [--kind yes-no|choices|scale] [--status answered|fallback] [--caller <tag>|<prefix>* | --no-caller] [--include-archives] [--json]',
         '  pricing [--refresh --model jev-X.Y.Z] [--dry-run] [--offline | --allow-snapshot] [--json]',
-        '  stats [--since <date>] [--provider <id>] [--session <id>] [--kind yes-no|choices|scale] [--status answered|fallback] [--caller <tag>|<prefix>* | --no-caller] [--group-by provider|session|kind|caller|passes|escalation] [--json]',
+        '  stats [--since <date>] [--provider <id>] [--session <id>] [--kind yes-no|choices|scale] [--status answered|fallback] [--caller <tag>|<prefix>* | --no-caller] [--group-by provider|session|kind|caller|passes|escalation] [--include-archives] [--json]',
+        '  rotate [--keep-last <Nd|N> | --all] [--to <path>] [--json]',
         '',
         'Notes:',
         '  Every COMPLETED `ask` call (CLI and MCP) appends one record to the decision',
@@ -41,9 +43,13 @@ function usage() {
         `  --session and --caller must match ${ATTRIBUTION_FIELD_PATTERN.source} (<= ${MAX_ATTRIBUTION_FIELD_LENGTH} characters).`,
         '  `history`/`stats` accept `--caller <tag>` (exact), `--caller \'<prefix>*\'` (prefix; the only wildcard), or `--no-caller` (records with no tag; not combinable with `--caller`).',
         '  `history`/`stats` reject unknown flags and positional arguments with exit 2.',
-        '  The ledger has no built-in retention: it grows without bound and the',
-        '  operator may truncate or delete it at any time; readers tolerate a missing',
-        '  file. The ledger trusts only the local filesystem under the project',
+        '  `rotate` keeps the last 90 days by default; --keep-last accepts days or a',
+        '  positive count. Rotating everything requires --all. Malformed lines stay',
+        '  inline unless --all is used. Archives are private .jsonl files beneath',
+        '  archive/decision/ in the resolved artifact root; --to must stay there.',
+        '  `history`/`stats` optionally read archives with --include-archives, offline.',
+        '  Appenders, rotation and readers share one cross-process lock.',
+        '  The ledger trusts only the local filesystem under the project',
         '  artifact root, owned by the same user running aiwg — it is not a defense',
         '  against a hostile process already running as that user.',
     ].join('\n');
@@ -101,7 +107,7 @@ function takeAttributionOption(args, name, reason) {
     return value;
 }
 async function decisionSetupJev(rest) {
-    const token = rest.includes('--token-stdin') ? (await readStdin()).trim() : undefined;
+    const token = rest.includes('--remove') ? undefined : await resolveSensitiveInput(sensitiveInputOptions(rest, 'token'));
     const result = await setupJev({
         token,
         region: takeOption(rest, '--region'),
@@ -206,7 +212,7 @@ function parseGroupBy(value) {
     return value;
 }
 const HISTORY_VALUE_FLAGS = ['--since', '--provider', '--session', '--kind', '--status', '--caller'];
-const HISTORY_BOOL_FLAGS = ['--json', '--no-caller'];
+const HISTORY_BOOL_FLAGS = ['--json', '--no-caller', '--include-archives'];
 const STATS_VALUE_FLAGS = [...HISTORY_VALUE_FLAGS, '--group-by'];
 const STATS_BOOL_FLAGS = HISTORY_BOOL_FLAGS;
 /**
@@ -268,6 +274,7 @@ function parseLedgerFilters(args) {
         kind: parseKindFilter(takeOption(args, '--kind')),
         status: parseStatusFilter(takeOption(args, '--status')),
         ...parseCallerFilter(args),
+        ...(args.includes('--include-archives') ? { includeArchives: true } : {}),
     };
 }
 /** One header line stating the caller filter, shown only when one is set. */
@@ -322,6 +329,23 @@ async function decisionStats(ctx) {
     ]);
     return { exitCode: 0, message: [...header, ...lines].join('\n'), rawOutput: true };
 }
+async function decisionRotate(ctx) {
+    const args = ctx.args.slice(1);
+    assertLedgerArgs(args, ['--keep-last', '--to'], ['--all', '--json']);
+    const keepLast = args.includes('--keep-last') ? takeRequiredOption(args, '--keep-last') : undefined;
+    const all = args.includes('--all');
+    try {
+        parseDecisionLedgerRetention(keepLast, all);
+    }
+    catch (error) {
+        throw new DecisionAskUsageError('invalid-retention', error instanceof Error ? error.message : String(error));
+    }
+    const result = await rotateDecisionLedger({ projectRoot: ctx.cwd, keepLast, all,
+        to: args.includes('--to') ? takeRequiredOption(args, '--to') : undefined });
+    if (args.includes('--json'))
+        return jsonResult(result);
+    return { exitCode: 0, rawOutput: true, message: `Archived ${result.archived} line(s)${result.archivePath ? ` to ${result.archivePath}` : ''}; retained ${result.retained} line(s) inline (${result.malformed} malformed).` };
+}
 async function executeDecision(ctx) {
     const [command, subcommand, ...rest] = ctx.args;
     const options = { cwd: ctx.cwd, frameworkRoot: ctx.frameworkRoot, env: process.env };
@@ -334,6 +358,8 @@ async function executeDecision(ctx) {
             return await decisionAsk(ctx);
         if (command === 'history')
             return await decisionHistory(ctx);
+        if (command === 'rotate')
+            return await decisionRotate(ctx);
         if (command === 'pricing') {
             const args = ctx.args.slice(1);
             assertLedgerArgs(args, ['--model'], ['--refresh', '--dry-run', '--offline', '--allow-snapshot', '--json']);

package/dist/src/cli/handlers/effect.js

@@ -19,10 +19,8 @@
  * @see docs/contracts/effect-ledger.v1.md
  */
 import { readFile } from 'node:fs/promises';
-import { basename, resolve } from 'node:path';
-import { createSecretStore } from '../../auth/credential-store.js';
-import { readAiwgConfig } from '../../config/aiwg-config.js';
-import { CORE_EFFECT_KINDS, DEFAULT_LEDGER_KEY_SERVICE, EFFECT_EXIT_CODES, EFFECT_SUBSYSTEMS, EffectLedgerError, LEDGER_TEST_KEY_ENV, LedgerSigningKey, activeKey, containsRestrictedMaterial, createBuiltinVerifierRegistry, createTrackerVerifiers, credentialStoreKeyProvider, effectId as deriveEffectId, effectOutputJson, environmentTestKeyProvider, generateLedgerKeySecret, initLedgerKeyring, inspectLedgerLocks, isValidEffectId, ledgerLockRecoveryVerifier, lookupEffect, openEffectLedger, payloadDigest, readLedgerKeyring, reconcileEffect, recordIntent, recordOutcome, recordReconciled, recoverStaleLedgerLock, rotateKey, runVerifier, staticKeyProvider, verifyDecisionLinks, verifyLedger, writeCheckpoint, } from '../../effects/index.js';
+import { resolve } from 'node:path';
+import { CORE_EFFECT_KINDS, EFFECT_EXIT_CODES, EFFECT_SUBSYSTEMS, EffectLedgerError, LedgerSigningKey, activeKey, containsRestrictedMaterial, createBuiltinVerifierRegistry, createTrackerVerifiers, effectId as deriveEffectId, effectOutputJson, generateLedgerKeySecret, initLedgerKeyring, inspectLedgerLocks, isValidEffectId, ledgerLockRecoveryVerifier, lookupEffect, payloadDigest, readLedgerKeyring, reconcileEffect, recordIntent, recordOutcome, recordReconciled, recoverStaleLedgerLock, rotateKey, runVerifier, staticKeyProvider, verifyDecisionLinks, verifyLedger, writeCheckpoint, } from '../../effects/index.js';
 import { parseLedgerPrivateKey } from '../../effects/keys.js';
 import { JsonlOperatorDecisionStore, verifyDecisionChain } from '../../audit/operator-decision.js';
 import { readConfig, readGitRemoteUrls } from '../../tracker/project-inputs.js';
@@ -166,77 +164,7 @@ function keyValue(entry, flag) {
         throw usage(`--${flag} expects key=value`, 'invalid-key-value');
     return [entry.slice(0, eq), entry.slice(eq + 1)];
 }
-const IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9._:/@-]{0,255}$/;
-function defaultProject(projectDir) {
-    const cleaned = basename(resolve(projectDir)).replace(/[^A-Za-z0-9._:/@-]/g, '-').replace(/^[^A-Za-z0-9]+/, '');
-    return cleaned && IDENTIFIER.test(cleaned) ? cleaned : 'project';
-}
-async function hostConfig(projectDir) {
-    let config;
-    try {
-        config = await readAiwgConfig(projectDir);
-    }
-    catch {
-        throw new EffectLedgerError('usage', 'aiwg.config could not be read', 'config-unreadable');
-    }
-    const effects = config?.effects;
-    if (effects === undefined || effects === null)
-        return {};
-    if (typeof effects !== 'object' || Array.isArray(effects))
-        throw usage('aiwg.config effects must be an object', 'config-invalid');
-    return effects;
-}
-function testContext(env) {
-    return env.VITEST === 'true' || env.NODE_ENV === 'test' || env.CI === 'true' || env.CI === '1';
-}
-function keyStore(session, role) {
-    const { deps, config, account } = session;
-    if (deps.keyStore)
-        return deps.keyStore(role, account);
-    if (session.env[LEDGER_TEST_KEY_ENV] && testContext(session.env))
-        return null;
-    const provider = config.keyProvider ?? {};
-    try {
-        if (provider.type === 'file') {
-            if (!provider.path)
-                throw new Error('missing path');
-            const pathname = resolve(session.projectDir, provider.path);
-            return createSecretStore({ useFile: true, allowFile: true, pathname: role === 'next' ? `${pathname}.next` : pathname, service: DEFAULT_LEDGER_KEY_SERVICE, account });
-        }
-        if (provider.type !== undefined && provider.type !== 'credential-store')
-            throw new Error('unknown provider');
-        return createSecretStore({ service: provider.service ?? DEFAULT_LEDGER_KEY_SERVICE, account: role === 'next' ? `${account}.next` : account });
-    }
-    catch {
-        throw new EffectLedgerError('key-unavailable', 'Effect ledger key provider is not configured correctly on this host', 'key-provider-invalid');
-    }
-}
-function keyProvider(session) {
-    const store = keyStore(session, 'current');
-    if (!store)
-        return environmentTestKeyProvider(session.env);
-    return credentialStoreKeyProvider({ account: session.account, store });
-}
-function describeKeyProvider(session) {
-    if (session.deps.keyStore)
-        return { type: 'injected', account: session.account };
-    if (session.env[LEDGER_TEST_KEY_ENV] && testContext(session.env))
-        return { type: 'environment-test-key' };
-    const provider = session.config.keyProvider ?? {};
-    if (provider.type === 'file')
-        return { type: 'file', account: session.account };
-    return { type: 'credential-store', service: provider.service ?? DEFAULT_LEDGER_KEY_SERVICE, account: session.account };
-}
-function openLedger(session, registry) {
-    const writer = session.config.writer ?? 'cli';
-    return openEffectLedger({
-        projectDir: session.projectDir, scope: session.scope, writer, keyProvider: keyProvider(session),
-        ...(session.deps.clock ? { clock: session.deps.clock } : {}),
-        ...(session.deps.sink ? { sink: session.deps.sink } : {}),
-        ...(registry ? { verifiers: registry } : {}),
-        ...(session.deps.lockTimeoutMs ? { lockTimeoutMs: session.deps.lockTimeoutMs } : {}),
-    });
-}
+import { effectSession, keyStore, describeKeyProvider, openLedger } from '../../effects/host.js';
 /**
  * The one place the CLI builds its verifier registry: the built-ins, lock
  * recovery, the tracker verifiers (#2719) and any injected extensions.
@@ -804,15 +732,7 @@ async function execute(ctx, deps) {
             throw usage('--format must be json or text', 'invalid-format');
         const projectDir = resolve(one(parsed, 'project-dir') ?? ctx.cwd ?? process.cwd());
         const subsystem = resolveSubsystem(parsed);
-        const config = await hostConfig(projectDir);
-        const tenant = config.tenant ?? 'local';
-        const project = config.project ?? defaultProject(projectDir);
-        if (!IDENTIFIER.test(tenant) || !IDENTIFIER.test(project))
-            throw usage('aiwg.config effects tenant and project must be identifiers', 'config-invalid');
-        const scope = { tenant, project, subsystem };
-        const env = deps.env ?? process.env;
-        const account = config.keyProvider?.account ?? `ledger/${tenant}/${project}/${subsystem}`;
-        const session = { projectDir, scope, config, account, deps, env };
+        const session = await effectSession(projectDir, subsystem, deps);
         let rendered;
         switch (sub) {
             case 'id':

package/dist/src/cli/handlers/guided-setup.js

@@ -56,7 +56,7 @@ export function parseGuidedSetupFlags(args, command) {
         const separator = raw.indexOf('=');
         const provider = raw.slice(0, separator) === 'jev' ? 'jev' : normalizeProviderDefinitionId(raw.slice(0, separator));
         if (separator < 1 || !provider || provider === 'generic')
-            throw new Error('--credential requires a known <provider>=env:NAME|file:PATH|stdin.');
+            throw new Error('--credential requires a known <provider>=stdin|file:PATH|store:NAME|env:NAME.');
         credentials[provider] = credentialReference(raw.slice(separator + 1));
     }
     if (tokenStdin) {

package/dist/src/cli/handlers/init.js

@@ -191,7 +191,7 @@ export const initHandler = {
   --intent code|docs|ops|mixed     Workspace usage intent
   --jev enable|decline|defer     Optional external decision service (default off)
   --region <r> --endpoint <url> --verify --remove --token-stdin  Existing Jev options
-  --credential <provider>=env:NAME|file:PATH|stdin  Credential reference only
+  --credential <provider>=stdin|file:PATH|store:NAME|env:NAME  Credential reference only
   --providers <list>              Provider IDs
   --default-scripts true|false    Include default scripts
   --custom-scripts true|false     Include custom scripts

package/dist/src/cli/handlers/install.js

@@ -18,6 +18,7 @@
  * @implements #804
  */
 import path from 'path';
+import { sensitiveInputOptions } from '../../auth/sensitive-input.js';
 import { installPackage } from '../../packages/registry.js';
 import { recordDeployment } from '../../packages/package-registry.js';
 import { marketplaceConfigDir, resolveVerificationPolicy } from '../../marketplace/exchange.js';
@@ -59,6 +60,7 @@ export const installHandler = {
                     '  --deploy                Deploy immediately after install',
                     '  --provider <name>       Target provider (claude, copilot, cursor...)',
                     '  --target <dir>          Project directory to deploy into',
+                    '  --token-interactive | --token-stdin | --token-file <path> | --token-store <name> | --token-env <name>',
                     '  --refresh               Force re-pull even if cached',
                     '  --ref <tag-or-sha>      Resolve this ref and lock its immutable commit',
                     '  --package <id>          Select one wrapper when a repository contains several',
@@ -69,6 +71,9 @@ export const installHandler = {
                 ].join('\n'),
             };
         }
+        if (/^https?:\/\/[^/]*@/.test(rawRef)) {
+            return { exitCode: 1, message: 'Credentials in Git URLs are refused; use --token-stdin, --token-file, --token-store or --token-env.' };
+        }
         const deploy = hasFlag(ctx.args, '--deploy');
         const refresh = hasFlag(ctx.args, '--refresh');
         const provider = parseFlag(ctx.args, '--provider') ?? 'claude';
@@ -97,6 +102,7 @@ export const installHandler = {
             const resolvedPolicy = await resolveVerificationPolicy(policyName, scope);
             const installed = await installPackage(rawRef, {
                 refresh,
+                tokenInput: sensitiveInputOptions(ctx.args, 'token'),
                 ref: parseFlag(ctx.args, '--ref'),
                 packageSelector: parseFlag(ctx.args, '--package'),
                 verify,

package/dist/src/cli/handlers/local-executor.js

@@ -21,9 +21,22 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
 import { createHash, randomUUID } from 'crypto';
 import { pathToFileURL } from 'node:url';
 import { projectAiwgPath } from '../../config/project-artifacts.js';
+import { resolveSensitiveInput, sensitiveInputOptions } from '../../auth/sensitive-input.js';
 const DEFAULT_PORT = 8200;
 const DEFAULT_BIND = '127.0.0.1';
 const DEFAULT_AIWG_SERVE = 'http://127.0.0.1:7337';
+/** Optional input: no source keeps registration/cache behavior, even at a terminal. */
+export async function resolveLocalExecutorToken(args, dependencies = {}) {
+    const source = sensitiveInputOptions(args, 'token');
+    const environment = dependencies.environment ?? process.env;
+    const explicit = source.interactive || source.stdin || source.file !== undefined || source.store !== undefined || source.env !== undefined;
+    if (!explicit) {
+        if (!environment.AIWG_EXECUTOR_TOKEN)
+            return undefined;
+        source.env = 'AIWG_EXECUTOR_TOKEN';
+    }
+    return resolveSensitiveInput(source, { ...dependencies, environment });
+}
 /**
  * Resolve or generate-once the executor identity.
  * Written to `.aiwg/local-executor/identity.json` so restarts reuse the same
@@ -122,6 +135,14 @@ export const localExecutorServeHandler = {
         // The subcommand is: `aiwg local-executor serve [flags]`
         // ctx.args[0] === 'serve' (consumed by router) or flags directly
         const flagArgs = ctx.args[0] === 'serve' ? ctx.args.slice(1) : ctx.args;
+        let preexistingToken;
+        try {
+            preexistingToken = await resolveLocalExecutorToken(flagArgs);
+        }
+        catch (error) {
+            return { exitCode: 1, message: error.message };
+        }
+        const redact = (message) => preexistingToken ? message.split(preexistingToken).join('[REDACTED]') : message;
         const opts = parseLocalExecutorArgs(flagArgs);
         warnIfNonLoopback(opts.bind);
         // ── Dynamic imports (same pattern as serve.ts) ──────────────────────────
@@ -138,7 +159,7 @@ export const localExecutorServeHandler = {
         }
         catch (err) {
             return {
-                message: `Failed to load executor-shim: ${err.message}`,
+                message: `Failed to load executor-shim: ${redact(err.message)}`,
                 exitCode: 1,
             };
         }
@@ -148,7 +169,7 @@ export const localExecutorServeHandler = {
         }
         catch (err) {
             return {
-                message: `Failed to load DaemonSupervisor: ${err.message}`,
+                message: `Failed to load DaemonSupervisor: ${redact(err.message)}`,
                 exitCode: 1,
             };
         }
@@ -208,7 +229,7 @@ export const localExecutorServeHandler = {
             restBase,
             wsBase,
             aiwgServeUrl: opts.aiwgServe,
-            token: process.env['AIWG_EXECUTOR_TOKEN'],
+            token: preexistingToken,
             tokenPath: projectAiwgPath(process.cwd(), 'local-executor', 'tokens', `${createHash('sha256').update(`${opts.aiwgServe}\0${opts.executorId}`).digest('hex')}.json`),
         });
         // Register with aiwg-serve
@@ -218,7 +239,7 @@ export const localExecutorServeHandler = {
         }
         catch (err) {
             return {
-                message: `Failed to register with aiwg-serve at ${opts.aiwgServe}: ${err.message}\n` +
+                message: `Failed to register with aiwg-serve at ${opts.aiwgServe}: ${redact(err.message)}\n` +
                     'Is aiwg serve running? Start it with: aiwg serve --no-open',
                 exitCode: 1,
             };
@@ -235,7 +256,7 @@ export const localExecutorServeHandler = {
         catch (err) {
             await shim.deregister();
             return {
-                message: `Failed to start executor server: ${err.message}`,
+                message: `Failed to start executor server: ${redact(err.message).split(token).join('[REDACTED]')}`,
                 exitCode: 1,
             };
         }
@@ -304,9 +325,15 @@ export const localExecutorHandler = {
                 '  --aiwg-serve <url>      Registration target (default: http://127.0.0.1:7337)\n' +
                 '  --max-concurrency <n>   Max concurrent missions (default: 4)\n' +
                 '  --executor-id <uuid>    Override stable executor ID\n' +
+                '  --token-interactive     Read optional existing bearer without echo\n' +
+                '  --token-stdin           Read optional existing bearer from stdin\n' +
+                '  --token-file <path>     Read optional existing bearer from a private file\n' +
+                '  --token-store <name>    Read optional existing bearer from the OS store\n' +
+                '  --token-env <NAME>      Read optional existing bearer from a named variable\n' +
                 '\n' +
                 'Environment:\n' +
-                '  AIWG_SERVE_ENDPOINT     Override --aiwg-serve default\n');
+                '  AIWG_SERVE_ENDPOINT     Override --aiwg-serve default\n' +
+                '  AIWG_EXECUTOR_TOKEN     Optional preexisting executor bearer\n');
             return { exitCode: 0 };
         }
         return {