@aiwg/cli 2026.10.6 → 2026.10.8

package/dist/src/decision/qualification/load-staged.js

@@ -4,7 +4,9 @@ import { JevDecisionAdapter, compileJevQuestion } from '../adapters/jev.js';
 import { DecisionAdmissionRegistry } from '../admission.js';
 import { CanonicalJsonByteEstimator } from '../context-plan.js';
 import { assertContextLiveSource } from '../context-live-qualification.js';
+import { tokenCost } from '../pricing.js';
 import { admissionControllerLoadDriver, decisionLoadArrivals, compareDecisionLoadBounds, decisionLoadManifestDigest, decisionLoadPolicy, runDecisionLoadHarness, } from './load.js';
+export const DECISION_STAGED_LOAD_RESULT_VERSIONS = ['decision-load-result/v1', 'decision-load-result/v2'];
 const finite = (value) => typeof value === 'number' && Number.isFinite(value) && value >= 0;
 const positive = (value) => finite(value) && value > 0;
 const exactCommit = (value) => /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(value);
@@ -289,7 +291,9 @@ export async function runDecisionStagedLoad(options) {
                 onObservation: (arrival, attempt, admission, observation) => {
                     const receipt = inFlight.get(`${arrival.ordinal}:${attempt}`);
                     Object.assign(receipt, { settledAtMs: clock.now(), admission: structuredClone(admission), status: observation.status, reason: observation.reason,
-                        usage: observation.usage, ...(observation.httpStatus === undefined ? {} : { httpStatus: observation.httpStatus }) });
+                        usage: observation.usage, ...(observation.httpStatus === undefined ? {} : { httpStatus: observation.httpStatus }),
+                        ...(observation.actualModel ? { servedModel: observation.actualModel } : {}),
+                        ...(observation.requestId ? { requestId: observation.requestId } : {}) });
                     inFlight.delete(`${arrival.ordinal}:${attempt}`);
                     guard.observe(arrival.providerId, observation, receipt.tokens, receipt.costUsd);
                 },
@@ -335,7 +339,7 @@ export async function runDecisionStagedLoad(options) {
         host: { hostname: hostname(), cpuClass: `${cpus().length} cores; ${cpus()[0]?.model ?? 'unknown'}`, memoryGiB: totalmem() / 2 ** 30,
             networkPath: options.networkPath, node: process.version, platform: process.platform, arch: process.arch },
         pricing: options.pricing, stages, receipts, samples, profileHistory: registry.profileHistory('load-harness'), breakerTransitions: transitions,
-        usage: guard.usage, stop: guard.stop, startedAtMs: start, elapsedMs: samples.at(-1)?.atMs ?? clock.now() - start });
+        reservedUsage: guard.usage, stop: guard.stop, startedAtMs: start, elapsedMs: samples.at(-1)?.atMs ?? clock.now() - start });
 }
 /** Token-bucket debit (burst plus refill), matching the admission controller's rate semantics. */
 function bucketDebit(receipts, capacity, periodMs, amount) {
@@ -400,9 +404,9 @@ export function compareDecisionStagedLoad(record) {
                 }
         }
     }
-    atMost('budget.maxUsd.stopAtFraction', m.budget.maxUsd * m.budget.stopAtFraction, record.usage.usd);
-    atMost('budget.maxCalls', m.budget.maxCalls, record.usage.calls);
-    atMost('budget.maxTokens', m.budget.maxTokens, record.usage.tokens);
+    atMost('budget.maxUsd.stopAtFraction', m.budget.maxUsd * m.budget.stopAtFraction, record.reservedUsage.usd);
+    atMost('budget.maxCalls', m.budget.maxCalls, record.reservedUsage.calls);
+    atMost('budget.maxTokens', m.budget.maxTokens, record.reservedUsage.tokens);
     atMost('budget.maxWallClockSeconds', m.budget.maxWallClockSeconds, record.elapsedMs / 1000);
     atMost('maximumSampleGapMs', m.bounds.maximumSampleGapMs, maximum(record.samples.slice(1).map((s, i) => s.atMs - record.samples[i].atMs)));
     const endingAt = record.startedAtMs + record.elapsedMs;
@@ -440,10 +444,29 @@ export function compareDecisionStagedLoad(record) {
     atMost('stop.maximumCrossPrincipalQuotaViolations', 0, violations);
     return out;
 }
+function reportedUsage(receipts, pricing) {
+    const sum = (values) => values.reduce((total, value) => total === null || value === null ? null : total + value, 0);
+    const inputs = receipts.map(r => r.usage.inputTokens);
+    const outputs = receipts.map(r => r.usage.outputTokens);
+    const totals = receipts.map(r => r.usage.inputTokens === null || r.usage.outputTokens === null ? null : r.usage.inputTokens + r.usage.outputTokens);
+    const inputTokens = sum(inputs);
+    const outputTokens = sum(outputs);
+    // The request is pinned to the priced model; an explicitly different served model has no applicable rate.
+    const costs = receipts.map(r => r.usage.inputTokens === null || r.usage.outputTokens === null
+        || (r.servedModel !== undefined && r.servedModel !== pricing.jev_model) ? null
+        : tokenCost(r.usage, { inputPerMillionUsd: pricing.jev_input_per_mtok, outputPerMillionUsd: pricing.jev_output_per_mtok }));
+    const knownSum = (values) => values.length > 0 && values.every(v => v === null)
+        ? null : sum(values.filter(v => v !== null));
+    return { calls: receipts.length, inputTokens, outputTokens, tokens: inputTokens === null || outputTokens === null ? null : inputTokens + outputTokens,
+        usd: sum(costs), incompleteCalls: costs.filter(cost => cost === null).length,
+        knownSubtotal: { inputTokens: knownSum(inputs), outputTokens: knownSum(outputs), tokens: knownSum(totals), usd: knownSum(costs) } };
+}
 export function decisionStagedLoadResultRecord(input) {
     const manifest = readDecisionLoadManifest(input.manifestBytes);
     validateDecisionLoadManifestV3(manifest);
-    const payload = { ...input, schemaVersion: 'decision-load-result/v1', kind: 'load-manifest-qualified',
+    validateDecisionLoadPricing(input.pricing, manifest.model);
+    const payload = { ...input, schemaVersion: 'decision-load-result/v2', kind: 'load-manifest-qualified',
+        reportedUsage: reportedUsage(input.receipts, input.pricing),
         manifest, manifestDigest: decisionLoadManifestDigest(input.manifestBytes) };
     for (const key of ['digest', 'comparisons', 'passed', 'queueWaitDistribution', 'retries'])
         delete payload[key];
@@ -461,7 +484,7 @@ export function decisionStagedLoadResultRecord(input) {
 export function verifyDecisionStagedLoadRecord(value, sourceCommit) {
     try {
         const r = value;
-        if (!r || r.schemaVersion !== 'decision-load-result/v1' || r.kind !== 'load-manifest-qualified' || r.mode !== 'staged-provider'
+        if (!r || !DECISION_STAGED_LOAD_RESULT_VERSIONS.includes(r.schemaVersion) || r.kind !== 'load-manifest-qualified' || r.mode !== 'staged-provider'
             || r.execution !== 'live' || r.dirty !== false || !exactCommit(r.sourceCommit) || (sourceCommit !== undefined && sourceCommit !== r.sourceCommit)
             || r.stop !== null || !r.passed || !finite(r.startedAtMs) || !r.host.networkPath || !r.host.cpuClass || !positive(r.host.memoryGiB))
             return false;
@@ -512,8 +535,17 @@ export function verifyDecisionStagedLoadRecord(value, sourceCommit) {
             || !positive(receipt.tokens) || !finite(receipt.costUsd) || !finite(receipt.admittedAtMs) || receipt.settledAtMs < receipt.admittedAtMs
             || receipt.admission.decision !== 'admit' || receipt.costUsd !== price(receipt.tokens, r.pricing)))
             return false;
-        if (r.usage.calls !== r.receipts.length || r.usage.tokens !== r.receipts.reduce((sum, receipt) => sum + receipt.tokens, 0)
-            || Math.abs(r.usage.usd - r.receipts.reduce((sum, receipt) => sum + receipt.costUsd, 0)) > 1e-9)
+        const reservedUsage = r.schemaVersion === 'decision-load-result/v1' ? r.usage : r.reservedUsage;
+        if (!reservedUsage || ![reservedUsage.calls, reservedUsage.tokens, reservedUsage.usd].every(finite)
+            || reservedUsage.calls !== r.receipts.length || reservedUsage.tokens !== r.receipts.reduce((sum, receipt) => sum + receipt.tokens, 0)
+            || Math.abs(reservedUsage.usd - r.receipts.reduce((sum, receipt) => sum + receipt.costUsd, 0)) > 1e-9)
+            return false;
+        if (r.schemaVersion === 'decision-load-result/v2' && r.receipts.some(receipt => !receipt.usage
+            || ![receipt.usage.inputTokens, receipt.usage.outputTokens].every(v => v === null || (Number.isSafeInteger(v) && v >= 0))
+            || (receipt.usage.inputTokens ?? 0) + (receipt.usage.outputTokens ?? 0) > receipt.tokens
+            || (receipt.usage.costUsd !== null && (!finite(receipt.usage.costUsd) || receipt.usage.costUsd > receipt.costUsd + 1e-12))
+            || (receipt.servedModel !== undefined && (typeof receipt.servedModel !== 'string' || !receipt.servedModel))
+            || (receipt.requestId !== undefined && (typeof receipt.requestId !== 'string' || !receipt.requestId))))
             return false;
         if (!r.samples.every((sample, index) => finite(sample.atMs) && finite(sample.residentMemoryMiB) && finite(sample.heapUsedMiB)
             && finite(sample.cpuPercentOneCore) && finite(sample.active) && finite(sample.queued) && (index === 0 ? sample.atMs === 0 : sample.atMs >= r.samples[index - 1].atMs
@@ -529,7 +561,12 @@ export function verifyDecisionStagedLoadRecord(value, sourceCommit) {
             || change?.kind !== 'change' || change.profileVersion !== manifest.profileVersion || change.digest !== profileDigest(manifest.workspace, manifest.providers)
             || rollback?.kind !== 'rollback' || rollback.profileVersion !== initial.profileVersion || rollback.digest !== initial.digest)
             return false;
-        const rebuilt = decisionStagedLoadResultRecord(r);
+        const rebuilt = decisionStagedLoadResultRecord({ ...r, reservedUsage });
+        if (r.schemaVersion === 'decision-load-result/v1') {
+            const { reservedUsage: _, reportedUsage: __, digest: ___, ...legacy } = rebuilt;
+            const legacyBody = { ...legacy, schemaVersion: r.schemaVersion };
+            return rebuilt.passed && canonicalJson({ ...legacyBody, digest: decisionLoadManifestDigest(canonicalJson(legacyBody)) }) === canonicalJson(r);
+        }
         return rebuilt.passed && canonicalJson(rebuilt) === canonicalJson(r);
     }
     catch {

package/dist/src/decision/qualification/runner.js

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import { lstat, mkdir, readFile, rename, writeFile } from 'node:fs/promises';
 import { dirname, resolve, sep } from 'node:path';
+import { DECISION_STAGED_LOAD_RESULT_VERSIONS } from './load.js';
 import { evaluateQualification } from './gates.js';
 import { deriveGateEvidence, DERIVED_GATE_EVIDENCE, GATE_ARTIFACT_FLAGS, GATE_ARTIFACT_SCHEMAS, IMMUTABLE_SPLIT_VERSIONS, validateGateArtifact, } from './gate-evidence.js';
 import { scanQualificationPrivacy } from './privacy.js';
@@ -233,7 +234,7 @@ async function attachGateArtifacts(plan, evidence, maxBytes) {
         const temporary = `${target}.${process.pid}.${Date.now()}.tmp`;
         await writeFile(temporary, bytes, { flag: 'wx', mode: 0o600 });
         await rename(temporary, target);
-        refs[flag] = { artifact: relative, digest: digest(bytes), schemaVersion: GATE_ARTIFACT_SCHEMAS[flag] };
+        refs[flag] = { artifact: relative, digest: digest(bytes), schemaVersion: parsed.schemaVersion };
         context.accepted[flag] = parsed;
     }
     return refs;
@@ -269,8 +270,11 @@ export async function verifyQualificationGateArtifacts(manifest, artifactRoot, m
         const parsed = parseJson(bytes);
         const versionOk = flag === 'immutable-splits'
             ? IMMUTABLE_SPLIT_VERSIONS.includes(ref.schemaVersion)
-            : ref.schemaVersion === GATE_ARTIFACT_SCHEMAS[flag];
-        if (!versionOk || !validateGateArtifact(flag, parsed, context)) {
+            : flag === 'load-manifest-qualified'
+                ? DECISION_STAGED_LOAD_RESULT_VERSIONS.includes(ref.schemaVersion)
+                : ref.schemaVersion === GATE_ARTIFACT_SCHEMAS[flag];
+        if (!versionOk || (flag === 'load-manifest-qualified' && parsed?.schemaVersion !== ref.schemaVersion)
+            || !validateGateArtifact(flag, parsed, context)) {
             results.push({ flag, verified: false, reason: 'invalid-artifact' });
             continue;
         }

package/dist/src/discovery/interview.js

@@ -48,11 +48,14 @@ export function credentialReference(input, paths = { isAbsolute }) {
     else if (input.startsWith('env:') && /^[A-Za-z_][A-Za-z0-9_]*$/.test(input.slice(4))) {
         reference = { kind: 'credential-ref', source: 'env', name: input.slice(4) };
     }
+    else if (input.startsWith('store:') && /^[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(input.slice(6))) {
+        reference = { kind: 'credential-ref', source: 'store', name: input.slice(6) };
+    }
     else if (input.startsWith('file:') && paths.isAbsolute(input.slice(5))) {
         reference = { kind: 'credential-ref', source: 'file', name: input.slice(5) };
     }
     else
-        throw new Error('--credential requires <provider>=env:NAME|file:PATH|stdin (file paths must be absolute).');
+        throw new Error('--credential requires <provider>=stdin|file:PATH|store:NAME|env:NAME (file paths must be absolute).');
     assertPlanRedacted(reference);
     return reference;
 }
@@ -106,9 +109,10 @@ export function interviewQuestions(context, answers = {}) {
             const configPath = (targetRoot === project.root ? project.providerFiles.find(f => f.provider === provider && f.kind === 'config')?.path : undefined)
                 ?? (resolveProviderPathValue(getProviderDefinition(provider)?.paths.configFile ?? null, targetRoot, paths) || targetRoot);
             add('locations', 'config-dir', "Where this provider's config file lives (informational; A3 writes nothing).", configPath, [configPath], '--target <dir>', 'path', project.root, provider);
-            add('locations', 'credential-source', "Where should A4 read this provider's credential from?", null, [{ kind: 'credential-ref', source: 'env', name: credentialEnvName(provider) },
+            add('locations', 'credential-source', "Where should A4 read this provider's credential from?", null, [{ kind: 'credential-ref', source: 'stdin-at-apply', name: 'stdin' },
                 { kind: 'credential-ref', source: 'file', name: paths.join(project.root, '.credentials', provider) },
-                { kind: 'credential-ref', source: 'stdin-at-apply', name: 'stdin' }], '--credential <provider>=env:NAME|file:PATH|stdin', 'credential', project.root, provider, true);
+                { kind: 'credential-ref', source: 'store', name: provider },
+                { kind: 'credential-ref', source: 'env', name: credentialEnvName(provider) }], '--credential <provider>=stdin|file:PATH|store:NAME|env:NAME', 'credential', project.root, provider, true);
         }
     for (const project of projects) {
         const rootChoice = answers[questionId('targets', 'root', project.root)]?.value;
@@ -127,8 +131,9 @@ export function interviewQuestions(context, answers = {}) {
         const jevStatus = context.jevStatus?.[targetWorkspace];
         add('capabilities', 'jev', `Jev status: ${jevStatus ? jevStatus.enabled ? 'enabled' : 'off' : 'unknown'}; backend ${jevStatus?.backend.status ?? 'not-probed'}. Decisions are sent to an external service; a Jev account/API access and usage charges apply. Enable decision offload?`, false, ['enable', 'decline'], '--jev enable|decline|defer', 'choice', project.root, undefined, true);
         if (jev === 'enable') {
-            add('capabilities', 'credential-source', 'Where should A4 read the Jev API input from? Enter a reference only; setup/defer works without an API input.', null, [{ kind: 'credential-ref', source: 'env', name: 'JEV_API_KEY' }, { kind: 'credential-ref', source: 'file', name: paths.join(project.root, '.credentials', 'jev') },
-                { kind: 'credential-ref', source: 'stdin-at-apply', name: 'stdin' }], '--credential jev=env:NAME|file:PATH|stdin', 'credential', project.root, 'jev', true);
+            add('capabilities', 'credential-source', 'Where should A4 read the Jev API input from? Enter a reference only; setup/defer works without an API input.', null, [{ kind: 'credential-ref', source: 'stdin-at-apply', name: 'stdin' },
+                { kind: 'credential-ref', source: 'file', name: paths.join(project.root, '.credentials', 'jev') },
+                { kind: 'credential-ref', source: 'store', name: 'jev' }, { kind: 'credential-ref', source: 'env', name: 'JEV_API_KEY' }], '--credential jev=stdin|file:PATH|store:NAME|env:NAME', 'credential', project.root, 'jev', true);
             questions[questions.length - 1].questionId = questionId('locations', 'credential-source', project.root, 'jev');
             add('capabilities', 'jev-options', 'Optional Jev settings as JSON: region, endpoint, verify. Verification sends a billable request at apply.', null, [null], '--region <r> --endpoint <url> --verify', 'policy', project.root, 'jev', true);
         }

package/dist/src/discovery/plan-apply.js

@@ -11,9 +11,10 @@
  *
  * Credential values are resolved only at apply time and are never stored on
  * the plan, in receipts, or in rendered output. Only the reference
- * (`env:NAME`, `file:PATH`, `stdin`) is ever rendered or persisted.
+ * (`env:NAME`, `file:PATH`, `store:NAME`, `stdin`) is ever rendered or persisted.
  */
 import { relative, resolve, sep, isAbsolute, join } from 'node:path';
+import { resolveSensitiveInput } from '../auth/sensitive-input.js';
 import { revalidateSetupPlan, remainingPlanActions } from './plan-store.js';
 import { questionId } from './interview.js';
 /** Apply order for plan actions. Dependencies flow config -> verify -> deploy -> register. */
@@ -393,37 +394,32 @@ function formatFactValue(value) {
 }
 /** Resolve a credential reference to its value. The value must stay in memory only. */
 export async function resolveCredential(reference, provider, io) {
-    // Every message below is receipt-persisted, so wording stays hyphenated:
-    // the plan redaction gate rejects `credential <value>` phrasing.
-    if (reference.source === 'env') {
-        const value = io.readEnv(reference.name);
-        if (!value) {
-            return { ok: false, message: `Credential-source env:${reference.name} for ${provider} is not set; export it or re-answer locations.credential-source.` };
-        }
+    try {
+        const terminal = reference.source === 'stdin-at-apply' && io.promptCredential !== undefined;
+        const value = await resolveSensitiveInput({
+            prefix: 'credential',
+            ...(reference.source === 'env' ? { env: reference.name } : {}),
+            ...(reference.source === 'file' ? { file: reference.name } : {}),
+            ...(reference.source === 'store' ? { store: reference.name } : {}),
+            ...(reference.source === 'stdin-at-apply' ? terminal ? { interactive: true } : { stdin: true } : {}),
+        }, {
+            readEnv: io.readEnv,
+            readFile: io.readCredentialFile,
+            ...(io.readCredentialStore ? { readStore: async (name) => (await io.readCredentialStore(name)) ?? null } : {}),
+            // An absent reader explicitly refuses headless stdin; never access the
+            // process stream behind an injected apply boundary.
+            readStdin: io.readStdinCredential ?? (async () => ''),
+            isTTY: terminal,
+            ...(io.promptCredential ? { prompt: async () => (await io.promptCredential(`Enter ${provider} API input (kept out of the setup plan): `)) ?? '' } : {}),
+        });
         return { ok: true, value };
     }
-    if (reference.source === 'file') {
-        try {
-            const value = (await io.readCredentialFile(reference.name)).trim();
-            if (!value)
-                return { ok: false, message: `Credential-file ${reference.name} for ${provider} is empty; fix the file or re-answer locations.credential-source.` };
-            return { ok: true, value };
-        }
-        catch {
-            return { ok: false, message: `Credential-file ${reference.name} for ${provider} is unreadable; fix the path or re-answer locations.credential-source.` };
-        }
-    }
-    if (io.readStdinCredential) {
-        const value = (await io.readStdinCredential()).trim();
-        return value ? { ok: true, value } : { ok: false, message: `No stdin-at-apply input for ${provider}; retry with env:/file:.` };
-    }
-    if (!io.promptCredential) {
-        return { ok: false, message: `Stdin-at-apply input for ${provider} needs an interactive terminal; re-run interactively or re-answer with env:/file:.` };
+    catch {
+        // Source failures can contain arbitrary external text. Receipts persist
+        // only the locator and supported alternatives, never the raw failure.
+        const source = reference.source === 'stdin-at-apply' ? 'Stdin-at-apply' : `Credential-source ${reference.source}:${reference.name}`;
+        return { ok: false, message: `${source} for ${provider} is unavailable; use --credential ${provider}=stdin|file:PATH|store:NAME|env:NAME (stdin prompts at a terminal).` };
     }
-    const value = await io.promptCredential(`Enter ${provider} API input (kept out of the setup plan): `);
-    if (!value)
-        return { ok: false, message: `No stdin-at-apply input given for ${provider}; the action stays eligible for a later run.` };
-    return { ok: true, value };
 }
 function receiptFor(plan, action, status, message, now) {
     const next = { ...plan, updatedAt: now, receipts: plan.receipts.map(receipt => ({ ...receipt, actions: { ...receipt.actions } })) };
@@ -449,7 +445,7 @@ async function executePlanAction(plan, action, io, advisoryNote) {
             if (!remove) {
                 reference = credentialReferenceFor(plan, action.workspace, 'jev');
                 if (!reference) {
-                    return { status: 'skipped', message: 'Jev setup deferred: choose --credential jev=env:NAME|file:PATH|stdin.' };
+                    return { status: 'skipped', message: 'Jev setup deferred: choose --credential jev=stdin|file:PATH|store:NAME|env:NAME.' };
                 }
                 const resolved = await resolveCredential(reference, 'jev', io);
                 if (!resolved.ok) {

package/dist/src/discovery/plan-validation.js

@@ -7,7 +7,7 @@ const timestamp = dateTime({ offset: true });
 const observation = z.enum(['yes', 'no', 'unknown']);
 export const planIdSchema = text.max(120).regex(/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/);
 const referenceSchema = z.strictObject({
-    kind: z.literal('credential-ref'), source: z.enum(['env', 'file', 'stdin-at-apply']), name: text,
+    kind: z.literal('credential-ref'), source: z.enum(['env', 'file', 'store', 'stdin-at-apply']), name: text,
 });
 const valueSchema = z.lazy(() => z.union([
     z.string(), z.number().finite(), z.boolean(), z.null(), z.array(valueSchema), z.record(z.string(), valueSchema),
@@ -57,7 +57,7 @@ const planSchema = z.strictObject({
     inventory: inventorySchema,
 });
 const sensitiveKey = /(?:password|passwd|token|secret|api[_-]?key|credential|authorization|cookie|private[_-]?key|connection[_-]?string)/i;
-const secretError = () => new Error('Setup plan contains secret-looking material; use a credential-ref (env, file, or stdin-at-apply).');
+const secretError = () => new Error('Setup plan contains secret-looking material; use a credential-ref (env, file, store, or stdin-at-apply).');
 /** Scan the exact JSON snapshot, including keys and free-form evidence/messages. Never echo rejected values. */
 export function assertPlanRedacted(input) {
     let nodes = 0;

package/dist/src/effects/host.js

@@ -0,0 +1,91 @@
+/** Shared host configuration for the effect ledger and its signing consumers. */
+import { basename, resolve } from 'node:path';
+import { createSecretStore } from '../auth/credential-store.js';
+import { readAiwgConfig } from '../config/aiwg-config.js';
+import { DEFAULT_LEDGER_KEY_SERVICE, LEDGER_TEST_KEY_ENV, credentialStoreKeyProvider, environmentTestKeyProvider } from './keys.js';
+import { EffectLedgerError, usageError as usage } from './errors.js';
+import { openEffectLedger } from './ledger.js';
+const IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9._:/@-]{0,255}$/;
+function defaultProject(projectDir) {
+    const cleaned = basename(resolve(projectDir)).replace(/[^A-Za-z0-9._:/@-]/g, '-').replace(/^[^A-Za-z0-9]+/, '');
+    return cleaned && IDENTIFIER.test(cleaned) ? cleaned : 'project';
+}
+async function hostConfig(projectDir) {
+    let config;
+    try {
+        config = await readAiwgConfig(projectDir);
+    }
+    catch {
+        throw new EffectLedgerError('usage', 'aiwg.config could not be read', 'config-unreadable');
+    }
+    const effects = config?.effects;
+    if (effects === undefined || effects === null)
+        return {};
+    if (typeof effects !== 'object' || Array.isArray(effects))
+        throw usage('aiwg.config effects must be an object', 'config-invalid');
+    return effects;
+}
+function testContext(env) {
+    return env.VITEST === 'true' || env.NODE_ENV === 'test' || env.CI === 'true' || env.CI === '1';
+}
+export function keyStore(session, role) {
+    const { deps, config, account } = session;
+    if (deps.keyStore)
+        return deps.keyStore(role, account);
+    if (session.env[LEDGER_TEST_KEY_ENV] && testContext(session.env))
+        return null;
+    const provider = config.keyProvider ?? {};
+    try {
+        if (provider.type === 'file') {
+            if (!provider.path)
+                throw new Error('missing path');
+            const pathname = resolve(session.projectDir, provider.path);
+            return createSecretStore({ useFile: true, allowFile: true, pathname: role === 'next' ? `${pathname}.next` : pathname, service: DEFAULT_LEDGER_KEY_SERVICE, account });
+        }
+        if (provider.type !== undefined && provider.type !== 'credential-store')
+            throw new Error('unknown provider');
+        return createSecretStore({ service: provider.service ?? DEFAULT_LEDGER_KEY_SERVICE, account: role === 'next' ? `${account}.next` : account });
+    }
+    catch {
+        throw new EffectLedgerError('key-unavailable', 'Effect ledger key provider is not configured correctly on this host', 'key-provider-invalid');
+    }
+}
+export function keyProvider(session) {
+    const store = keyStore(session, 'current');
+    if (!store)
+        return environmentTestKeyProvider(session.env);
+    return credentialStoreKeyProvider({ account: session.account, store });
+}
+export function describeKeyProvider(session) {
+    if (session.deps.keyStore)
+        return { type: 'injected', account: session.account };
+    if (session.env[LEDGER_TEST_KEY_ENV] && testContext(session.env))
+        return { type: 'environment-test-key' };
+    const provider = session.config.keyProvider ?? {};
+    if (provider.type === 'file')
+        return { type: 'file', account: session.account };
+    return { type: 'credential-store', service: provider.service ?? DEFAULT_LEDGER_KEY_SERVICE, account: session.account };
+}
+export function openLedger(session, registry) {
+    const writer = session.config.writer ?? 'cli';
+    return openEffectLedger({
+        projectDir: session.projectDir, scope: session.scope, writer, keyProvider: keyProvider(session),
+        ...(session.deps.clock ? { clock: session.deps.clock } : {}),
+        ...(session.deps.sink ? { sink: session.deps.sink } : {}),
+        ...(registry ? { verifiers: registry } : {}),
+        ...(session.deps.lockTimeoutMs ? { lockTimeoutMs: session.deps.lockTimeoutMs } : {}),
+    });
+}
+/** Resolve the same host scope and key provider for CLI and qualification evidence. */
+export async function effectSession(projectDir, subsystem = 'delivery', deps = {}) {
+    const config = await hostConfig(projectDir);
+    const tenant = config.tenant ?? 'local';
+    const project = config.project ?? defaultProject(projectDir);
+    if (!IDENTIFIER.test(tenant) || !IDENTIFIER.test(project))
+        throw usage('aiwg.config effects tenant and project must be identifiers', 'config-invalid');
+    const scope = { tenant, project, subsystem };
+    const env = deps.env ?? process.env;
+    const account = config.keyProvider?.account ?? `ledger/${tenant}/${project}/${subsystem}`;
+    return { projectDir, scope, config, account, deps, env };
+}
+//# sourceMappingURL=host.js.map

package/dist/src/extensions/commands/definitions.js

@@ -687,7 +687,7 @@ export const initCommand = {
         triggerPhrases: ['init project', 'setup project config', 'configure providers'],
         commandHint: {
             template: 'utility',
-            argumentHint: '[--scope project|user] [--intent code|docs|ops|mixed] [--credential <provider>=env:NAME|file:PATH|stdin] [--jev enable|decline|defer]',
+            argumentHint: '[--scope project|user] [--intent code|docs|ops|mixed] [--credential <provider>=stdin|file:PATH|store:NAME|env:NAME] [--jev enable|decline|defer]',
             allowedTools: ['Read', 'Write'],
         },
     },
@@ -719,7 +719,7 @@ export const setupCommand = {
         ],
         commandHint: {
             template: 'utility',
-            argumentHint: 'project [--yes] [--dry-run] [--review] [--apply] [--plan <id>] [--target <dir>] [--scope project|user] [--workspace <root>] [--monorepo root|package] [--package <root>] [--scan-roots <dir>] [--intent code|docs|ops|mixed] [--credential <provider>=env:NAME|file:PATH|stdin] [--jev enable|decline|defer]',
+            argumentHint: 'project [--yes] [--dry-run] [--review] [--apply] [--plan <id>] [--target <dir>] [--scope project|user] [--workspace <root>] [--monorepo root|package] [--package <root>] [--scan-roots <dir>] [--intent code|docs|ops|mixed] [--credential <provider>=stdin|file:PATH|store:NAME|env:NAME] [--jev enable|decline|defer]',
             allowedTools: ['Read', 'Write', 'Bash'],
         },
     },

package/dist/src/extensions/project-local-gitignore.js

@@ -21,6 +21,7 @@
 import { readFile, writeFile, access } from 'fs/promises';
 import { join } from 'path';
 import { execFile } from 'child_process';
+import { helperEnvironment } from '../process/cli-command.mjs';
 import { promisify } from 'util';
 const execFileP = promisify(execFile);
 /**
@@ -166,6 +167,7 @@ export async function checkBundleManifestIgnored(projectDir, manifestRelPath) {
         // 1 if not ignored, 128 on error. We want a tristate.
         await execFileP('git', ['check-ignore', '-q', manifestRelPath], {
             cwd: projectDir,
+            env: helperEnvironment(),
         });
         // exit 0 → ignored
         return true;

package/dist/src/issues/cli.js

@@ -12,7 +12,8 @@ import path from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { getFrameworkRoot } from '../channel/manager.mjs';
 import { readAiwgConfig } from '../config/aiwg-config.js';
-import { LocalIssueProviderCore, buildExternalIssueSnapshotFromLocal, buildLocalIssueConflictReport, createLiveIssueClient, localIssueRoot, parseCommentIdMappings, parseExternalIssueSnapshot, } from './index.js';
+import { sensitiveInputOptions } from '../auth/sensitive-input.js';
+import { LocalIssueProviderCore, buildExternalIssueSnapshotFromLocal, buildLocalIssueConflictReport, createLiveIssueClient, resolveLiveIssueToken, localIssueRoot, parseCommentIdMappings, parseExternalIssueSnapshot, } from './index.js';
 export async function main(args, cwd = process.cwd()) {
     const parsed = parseArgs(args);
     const subcommand = parsed.positional[0];
@@ -218,7 +219,7 @@ async function handleImport(issues, args) {
     if (from !== "gitea" && from !== "github")
         throw new Error("Usage: aiwg issue import --from gitea|github (--snapshot-file path | --live --repo owner/name --external-id N)");
     const snapshot = args.flags.has("live")
-        ? await createLiveIssueClient({ provider: from, repo: requiredStringFlag(args, "repo"), apiUrl: stringFlag(args, "api-url") }).importIssue(requiredStringFlag(args, "external-id"))
+        ? await (await liveClient(args, from)).importIssue(requiredStringFlag(args, "external-id"))
         : parseExternalIssueSnapshot(JSON.parse(await readRequiredFile(args, "snapshot-file")));
     if (from !== snapshot.provider)
         throw new Error(`snapshot provider ${snapshot.provider} does not match --from ${from}`);
@@ -249,7 +250,7 @@ async function handleExport(issues, rest, args) {
         await writeOptionalOutput(args, snapshot);
         return;
     }
-    const client = createLiveIssueClient({ provider, repo: requiredStringFlag(args, "repo"), apiUrl: stringFlag(args, "api-url") });
+    const client = await liveClient(args, provider);
     if (snapshot.external_id && !args.flags.has("force")) {
         const remote = await client.fetchIssue(snapshot.external_id);
         const report = buildLocalIssueConflictReport(issue, remote);
@@ -314,6 +315,11 @@ async function handleIndex(issues, rest, args) {
     const index = await issues.rebuildIssueIndex({ force: args.flags.has('force') });
     printJsonOrText(args, index, `Local issue index ready (${index.issues.length} issues)`);
 }
+async function liveClient(args, provider) {
+    const repo = requiredStringFlag(args, 'repo');
+    const token = await resolveLiveIssueToken(provider, sensitiveInputOptions(args.raw, 'token'));
+    return createLiveIssueClient({ provider, repo, apiUrl: stringFlag(args, 'api-url'), token });
+}
 function requiredStringFlag(args, flag) {
     const value = stringFlag(args, flag);
     if (!value)
@@ -381,7 +387,7 @@ function parseArgs(args) {
             flags.set(rawKey, true);
         }
     }
-    return { positional, flags };
+    return { raw: args, positional, flags };
 }
 function stringFlag(args, name) {
     const value = args.flags.get(name);
@@ -402,10 +408,15 @@ function printUsage() {
   aiwg issue show <KEY> [--comments last:10|all]
   aiwg issue import --from gitea|github --snapshot-file path [--json]
   aiwg issue export <KEY> --to gitea|github [--out path]
+  aiwg issue import --from gitea|github --live --repo owner/name --external-id N [token source]
+  aiwg issue export <KEY> --to gitea|github --live --repo owner/name [token source]
   aiwg issue sync conflicts <KEY> --snapshot-file path [--out path]
   aiwg issue sync map-comments <KEY> --map-file path [--json]
   aiwg issue comment <KEY> --body "..." [--author name]
   aiwg issue close <KEY> [--reason "..."]
-  aiwg issue index rebuild [--force]`);
+  aiwg issue index rebuild [--force]
+
+Live token sources: --token-interactive, --token-stdin, --token-file <path>,
+  --token-store <name>, --token-env <NAME> (see docs/cli/sensitive-values.md).`);
 }
 //# sourceMappingURL=cli.js.map

package/dist/src/issues/live.js

@@ -1,3 +1,5 @@
+import { resolveSensitiveInput } from '../auth/sensitive-input.js';
+import { isInteractive } from '../cli/env.js';
 export class LiveIssueClient {
     options;
     baseUrl;
@@ -63,24 +65,51 @@ export class LiveIssueClient {
             headers['Content-Type'] = 'application/json';
         if (this.options.token)
             headers.Authorization = `Bearer ${this.options.token}`;
-        const response = await this.fetchFn(`${this.baseUrl}${path}`, {
-            method,
-            headers,
-            body: body === undefined ? undefined : JSON.stringify(body),
-        });
-        if (!response.ok) {
-            const text = await response.text().catch(() => '');
-            throw new Error(`${this.options.provider} issue API ${method} ${path} failed: ${response.status}${text ? ` ${redactSecrets(text)}` : ''}`);
+        try {
+            const response = await this.fetchFn(`${this.baseUrl}${path}`, {
+                method,
+                headers,
+                body: body === undefined ? undefined : JSON.stringify(body),
+            });
+            if (!response.ok) {
+                const text = await response.text().catch(() => '');
+                throw new Error(`${this.options.provider} issue API ${method} ${path} failed: ${response.status}${text ? ` ${redactSecrets(text, this.options.token)}` : ''}`);
+            }
+            const result = await response.json();
+            // A server can reflect request credentials in issue fields or comments.
+            // Scrub them before they reach local storage or CLI output.
+            if (!this.options.token)
+                return result;
+            const encodedToken = JSON.stringify(this.options.token).slice(1, -1);
+            return JSON.parse(JSON.stringify(result).split(encodedToken).join('[REDACTED]'));
+        }
+        catch (error) {
+            throw new Error(redactSecrets(error instanceof Error ? error.message : 'Live issue request failed', this.options.token));
         }
-        return response.json();
     }
 }
 export function createLiveIssueClient(options) {
     return new LiveIssueClient({
         ...options,
-        token: resolveToken(options.provider, options.tokenEnv ?? process.env),
+        token: options.token ?? resolveToken(options.provider, options.tokenEnv ?? process.env),
     });
 }
+/** CLI source selection; the synchronous client factory remains available to callers. */
+export async function resolveLiveIssueToken(provider, source = {}, dependencies = {}) {
+    const environment = dependencies.environment ?? process.env;
+    const isTTY = dependencies.isTTY ?? isInteractive();
+    const selected = { ...source, prefix: 'token' };
+    const hasSource = selected.interactive || selected.stdin || selected.file !== undefined || selected.store !== undefined || selected.env !== undefined;
+    if (!hasSource) {
+        // Established behavior: use the provider variable when set, otherwise make
+        // unauthenticated requests (public repositories). Prompt only on request.
+        const names = provider === 'gitea' ? ['AIWG_GITEA_TOKEN', 'GITEA_TOKEN'] : ['AIWG_GITHUB_TOKEN', 'GITHUB_TOKEN'];
+        selected.env = names.find(name => environment[name] !== undefined);
+        if (selected.env === undefined)
+            return undefined;
+    }
+    return resolveSensitiveInput(selected, { ...dependencies, environment, isTTY });
+}
 export function resolveToken(provider, env) {
     if (provider === 'gitea')
         return env.AIWG_GITEA_TOKEN ?? env.GITEA_TOKEN;
@@ -148,7 +177,10 @@ function requireString(value, field) {
         return value;
     throw new Error(`live issue response missing ${field}`);
 }
-function redactSecrets(value) {
-    return value.replace(/(token|authorization|password|secret)["':=\s]+[^\s"',}]+/gi, '$1=[REDACTED]');
+function redactSecrets(value, token) {
+    const redacted = token ? value.split(token).join('[REDACTED]') : value;
+    return redacted
+        .replace(/Bearer\s+[^\s"',}]+/gi, 'Bearer [REDACTED]')
+        .replace(/(token|authorization|password|secret)["':=\s]+[^\s"',}]+/gi, '$1=[REDACTED]');
 }
 //# sourceMappingURL=live.js.map

package/dist/src/marketplace/exchange.js

@@ -9,6 +9,7 @@ import { access, chmod, mkdir, mkdtemp, readFile, rename, rm, writeFile, } from
 import { existsSync } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { resolveSensitiveInput } from '../auth/sensitive-input.js';
 import { setPackageEntry } from '../packages/package-registry.js';
 import { discoverInstallablePackage } from '../packages/package-discovery.js';
 import { parseTrustRoot, sha256 as artifactSha256, } from '../security/artifact-trust.js';
@@ -236,7 +237,13 @@ export async function verifyIndexedPackage(options) {
     });
     return { verification, receipt, entry };
 }
-export async function publishLocalPackage(options) {
+export async function publishLocalPackage(options, sensitiveDependencies = {}) {
+    const privateKey = await resolveSensitiveInput({
+        ...options.keyInput,
+        prefix: 'key',
+        file: options.keyInput?.file ?? options.privateKeyPath,
+        multiline: true,
+    }, sensitiveDependencies);
     const sourceDir = path.resolve(options.sourceDir);
     const discovered = await discoverInstallablePackage(sourceDir, options.packageSelector);
     const unsigned = await createProvenanceEnvelope({
@@ -248,12 +255,17 @@ export async function publishLocalPackage(options) {
         publisher: options.publisher,
         sequence: options.sequence,
     });
-    const privateKey = await readFile(path.resolve(options.privateKeyPath), 'utf8');
     const publicKey = options.publicKeyPath ? await readFile(path.resolve(options.publicKeyPath), 'utf8') : undefined;
-    const envelope = signProvenanceEnvelope(unsigned, privateKey, {
-        keyId: options.keyId,
-        publicKeyPem: publicKey,
-    });
+    let envelope;
+    try {
+        envelope = signProvenanceEnvelope(unsigned, privateKey, {
+            keyId: options.keyId,
+            publicKeyPem: publicKey,
+        });
+    }
+    catch {
+        throw new Error('Marketplace signing failed; check the Ed25519 private key and public-key options.');
+    }
     const lock = createPackageLock(envelope, envelope.publication.publishedAt);
     const fortemi = await buildFortemiEnvelopeShard(envelope);
     const receipt = createOperationReceipt({