@aiwg/cli 2026.10.6 → 2026.10.8

package/dist/src/mcp/grok-build-config.mjs

@@ -1,8 +1,10 @@
+import { assertEnvironmentCredentialReferences } from './credentials.mjs';
 import { writeConfigAtomic } from './config-file.mjs';
 import { constants } from 'node:fs';
 import { access, lstat, readFile } from 'node:fs/promises';
 import { dirname, relative, resolve } from 'node:path';
 import { spawnSync } from 'node:child_process';
+import { helperEnvironment } from '../process/cli-command.mjs';
 import { replaceServer } from './toml-editor.mjs';
 import { tomlString as string } from './toml-string.mjs';
 
@@ -19,6 +21,7 @@ function inline(values = {}) {
 }
 
 export function renderGrokMcpServer(server) {
+  assertEnvironmentCredentialReferences(server, 'grok-build');
   if (!server?.name) throw new Error('Grok MCP server name is required');
   const lines = [`[mcp_servers.${key(server.name)}]`];
   if (server.type === 'stdio') {
@@ -144,7 +147,7 @@ export async function unmanageGrokBuildMcp(configPath, names, options = {}) {
 }
 
 function runJson(binary, args, cwd, env) {
-  const run = spawnSync(binary, args, { cwd, env, encoding: 'utf8', timeout: 30_000, killSignal: 'SIGKILL' });
+  const run = spawnSync(binary, args, { cwd, env: helperEnvironment(env), encoding: 'utf8', timeout: 30_000, killSignal: 'SIGKILL' });
   if (run.error || run.status !== 0) return { ok: false, detail: run.error?.message || run.stderr || `exit ${run.status}` };
   try { return { ok: true, value: JSON.parse(run.stdout || '{}') }; }
   catch { return { ok: false, detail: 'Grok returned malformed JSON' }; }

package/dist/src/mcp/muse-native-config.mjs

@@ -4,6 +4,7 @@ import { spawnSync } from 'node:child_process';
 import { dirname, join } from 'node:path';
 import os from 'node:os';
 import { resolveMuseXdgSkillsDir } from '../providers/muse-paths.js';
+import { helperEnvironment } from '../process/cli-command.mjs';
 
 // Mirrors tools/agents/providers/muse-hooks.mjs. src/ cannot import tools/:
 // tools/ is not part of the compiled dist/ tree.
@@ -47,7 +48,7 @@ function deepEqual(a, b) {
 
 function inspectMuseCli(env) {
   const result = spawnSync('muse', ['--version'], {
-    env,
+    env: helperEnvironment(env),
     encoding: 'utf8',
     timeout: MUSE_VERSION_TIMEOUT_MS,
     killSignal: 'SIGKILL',

package/dist/src/mcp/omp-config.mjs

@@ -1,3 +1,4 @@
+import { assertEnvironmentCredentialReferences } from './credentials.mjs';
 import { assertConfigDestination, assertNoSymlinkParents, writeConfigAtomic } from './config-file.mjs';
 import { readFile, mkdir, lstat, unlink, open } from 'node:fs/promises';
 import { dirname, parse, resolve } from 'node:path';
@@ -50,6 +51,7 @@ async function atomic(file, data, options) {
 }
 
 export function ompServerConfig(server) {
+  assertEnvironmentCredentialReferences(server, 'omp');
   const config = {};
   for (const field of ['command', 'args', 'env', 'cwd', 'url', 'headers', 'enabled', 'timeout', 'requestIdFormat', 'auth', 'oauth', 'type']) {
     if (server[field] !== undefined) config[field] = server[field];

package/dist/src/mcp/registry.js

@@ -7,7 +7,7 @@ import { manageGrokBuildMcp } from './grok-build-config.mjs';
 import { replaceServer } from './toml-editor.mjs';
 import { resolveOmpPaths } from '../providers/omp-paths.mjs';
 import { applyJsonToolFilterPlan, claudeSettingsPath, prepareClaudePermissions, planToolFilters } from './tool-filters.mjs';
-import { assertCredentialPolicy, resolveCredentialPolicy, validateEnvReferenceName } from './credentials.mjs';
+import { assertCredentialPolicy, resolveCredentialPolicy, validateEnvReferenceName, credentialReferenceInput, validateCredentialReferences, assertEnvironmentCredentialReferences } from './credentials.mjs';
 /**
  * MCP Server Registry
  *
@@ -23,6 +23,7 @@ import { qualifyWorkerInvocationProfile, requiredWorkerControls } from '../model
 import { dirname, isAbsolute, resolve } from 'path';
 import { homedir } from 'os';
 import { resolveConfigDir } from '../config/user-config.js';
+import { resolveSensitiveInput } from '../auth/sensitive-input.js';
 // ============================================
 // Registry
 // ============================================
@@ -32,22 +33,24 @@ const DEFAULT_REGISTRY = {
     kind: 'McpServerRegistry',
     servers: {},
 };
-const ENV_REFERENCE_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
-function validateCredentialReferences(def) {
-    for (const [header, envName] of Object.entries(def.headerEnv ?? {})) {
-        if (!header.trim())
-            throw new Error('MCP header-env header name must not be empty');
-        if (!ENV_REFERENCE_NAME.test(envName)) {
-            throw new Error(`Invalid MCP header environment variable reference "${envName}"`);
-        }
-    }
-    for (const [key, envName] of Object.entries(def.envFrom ?? {})) {
-        if (!ENV_REFERENCE_NAME.test(key))
-            throw new Error(`Invalid MCP env-from variable name "${key}"`);
-        if (!ENV_REFERENCE_NAME.test(envName)) {
-            throw new Error(`Invalid MCP env-from environment variable reference "${envName}"`);
+/** Resolve references only for AIWG's in-memory transport, never for a config writer. */
+export async function resolveMcpCredentialMaps(server, dependencies = {}) {
+    const result = { env: server.env ? { ...server.env } : undefined, headers: server.headers ? { ...server.headers } : undefined };
+    for (const [field, target, flag] of [['envFrom', 'env', '--env-from'], ['headerEnv', 'headers', '--header-env']]) {
+        for (const [key, reference] of Object.entries(server[field] ?? {})) {
+            const input = credentialReferenceInput(reference, flag);
+            // Explicit locators prevent terminal prompts and implicit stdin consumption.
+            try {
+                const value = await resolveSensitiveInput({ ...input, prefix: 'value' }, dependencies);
+                result[target] = { ...result[target], [key]: value };
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : 'MCP credential input failed';
+                throw new Error(message.replace(/--value-(file|store|env)/g, (_, source) => `${flag} KEY=${source === 'env' ? 'ENV_NAME' : source === 'file' ? 'file:ABSOLUTE_PATH' : 'store:NAME'}`));
+            }
         }
     }
+    return result;
 }
 export function workerServerDigest(server) {
     const { workerQualification, description, injectedProviders, addedAt, updatedAt, ...execution } = server;
@@ -300,6 +303,7 @@ function tomlInlineTable(values) {
     return `{ ${Object.entries(values).map(([name, value]) => `${tomlKey(name)} = ${tomlString(value)}`).join(', ')} }`;
 }
 export function buildServerToml(server) {
+    assertEnvironmentCredentialReferences(server, 'codex');
     const lines = [];
     lines.push(`[mcp_servers.${tomlKey(server.name)}]`);
     if (server.type === 'stdio') {

package/dist/src/mcp/registry.mjs

@@ -8,7 +8,7 @@ import { manageGrokBuildMcp } from './grok-build-config.mjs';
 import { replaceServer } from './toml-editor.mjs';
 import { resolveOmpPaths } from '../providers/omp-paths.mjs';
 import { applyJsonToolFilterPlan, claudeSettingsPath, prepareClaudePermissions, planToolFilters } from './tool-filters.mjs';
-import { assertCredentialPolicy, resolveCredentialPolicy, validateEnvReferenceName } from './credentials.mjs';
+import { assertCredentialPolicy, resolveCredentialPolicy, validateEnvReferenceName, validateCredentialReferences, assertEnvironmentCredentialReferences } from './credentials.mjs';
 /**
  * MCP Server Registry (Runtime ESM)
  *
@@ -72,23 +72,6 @@ const DEFAULT_REGISTRY = {
   servers: {},
 };
 
-const ENV_REFERENCE_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
-
-function validateCredentialReferences(def) {
-  for (const [header, envName] of Object.entries(def.headerEnv || {})) {
-    if (!header.trim()) throw new Error('MCP header-env header name must not be empty');
-    if (!ENV_REFERENCE_NAME.test(envName)) {
-      throw new Error(`Invalid MCP header environment variable reference "${envName}"`);
-    }
-  }
-  for (const [key, envName] of Object.entries(def.envFrom || {})) {
-    if (!ENV_REFERENCE_NAME.test(key)) throw new Error(`Invalid MCP env-from variable name "${key}"`);
-    if (!ENV_REFERENCE_NAME.test(envName)) {
-      throw new Error(`Invalid MCP env-from environment variable reference "${envName}"`);
-    }
-  }
-}
-
 // The typed worker dispatch boundary owns qualification. Legacy runtime edits
 // invalidate its binding without importing the TypeScript policy owner.
 export function workerServerDigest(server) {
@@ -280,6 +263,7 @@ function tomlInlineTable(values) {
 }
 
 export function buildServerToml(server) {
+  assertEnvironmentCredentialReferences(server, 'codex');
   const lines = [];
   lines.push(`[mcp_servers.${tomlKey(server.name)}]`);
 

package/dist/src/mcp/tools/agentic-sandbox.mjs

@@ -1,14 +1,14 @@
 /**
  * Governed Agentic Sandbox fleet and activity MCP surface.
  *
- * Credentials are file-backed server configuration, never tool arguments.
+ * Credentials are private-file or native-store configuration, never tool arguments.
  * Every tool in this module uses the management bearer domain; executor-plane
  * credentials are deliberately out of scope and cannot be substituted.
  *
  * @implements #2015
  */
 
-import { readFile, stat } from 'node:fs/promises';
+import { access } from 'node:fs/promises';
 import { z } from 'zod';
 import { integer, dateTime } from '../../schema/zod-validation.mjs';
 import { assertNoWorkerBinding, mcpError, mcpJson } from '../helpers.mjs';
@@ -36,17 +36,27 @@ function configuredBaseUrl(env = process.env) {
   return url.toString().replace(/\/$/, '');
 }
 
-async function managementBearer(env = process.env) {
+async function sensitiveInputModule() {
+  // Source MCP modules and the published dist tree share the compiled owner.
+  for (const location of [new URL('../../auth/sensitive-input.js', import.meta.url), new URL('../../../dist/src/auth/sensitive-input.js', import.meta.url)]) {
+    try { await access(location); } catch { continue; }
+    return import(location.href);
+  }
+  throw new Error('Sandbox credentials require the compiled AIWG auth module, which this installation is missing. Run `aiwg doctor` to repair the installation.');
+}
+
+async function managementBearer(env = process.env, readStore) {
   const tokenFile = String(env.AIWG_SANDBOX_MANAGEMENT_TOKEN_FILE ?? '').trim();
-  if (!tokenFile) throw new Error('AIWG_SANDBOX_MANAGEMENT_TOKEN_FILE is required for the sandbox toolset');
-  const metadata = await stat(tokenFile);
-  if (!metadata.isFile()) throw new Error('sandbox management token path is not a regular file');
-  if (process.platform !== 'win32' && (metadata.mode & 0o077) !== 0) {
-    throw new Error('sandbox management token file must not be accessible by group or other users');
+  const tokenStore = String(env.AIWG_SANDBOX_MANAGEMENT_TOKEN_STORE ?? '').trim();
+  if (!tokenFile && !tokenStore) {
+    throw new Error('Sandbox management bearer requires AIWG_SANDBOX_MANAGEMENT_TOKEN_FILE or AIWG_SANDBOX_MANAGEMENT_TOKEN_STORE.');
   }
-  const token = String(await readFile(tokenFile, 'utf8')).trim();
-  if (!token || /[\r\n]/.test(token)) throw new Error('sandbox management token file must contain one non-empty bearer token');
-  return token;
+  const { readPrivateValueFile, resolveSensitiveInput } = await sensitiveInputModule();
+  return resolveSensitiveInput(tokenFile ? { prefix: 'token', file: tokenFile } : { prefix: 'token', store: tokenStore }, {
+    isTTY: false,
+    readFile: (pathname) => readPrivateValueFile(pathname, 'AIWG_SANDBOX_MANAGEMENT_TOKEN_FILE'),
+    ...(readStore ? { readStore } : {}),
+  });
 }
 
 function containsRestricted(value) {
@@ -138,32 +148,40 @@ function typedResult(body, status, validate) {
 }
 
 export class AgenticSandboxMcpClient {
-  constructor({ env = process.env, fetch = globalThis.fetch.bind(globalThis) } = {}) {
+  constructor({ env = process.env, fetch = globalThis.fetch.bind(globalThis), readStore } = {}) {
     this.env = env;
     this.fetch = fetch;
+    this.readStore = readStore;
   }
 
   async request(path, { method = 'GET', body, headers = {}, validate = (value) => safeResponse(value) } = {}) {
     assertNoWorkerBinding(body, 'mcp');
     const baseUrl = configuredBaseUrl(this.env);
-    const token = await managementBearer(this.env);
-    const response = await this.fetch(`${baseUrl}${path}`, {
-      method,
-      headers: { accept: 'application/json', authorization: `Bearer ${token}`, ...(body === undefined ? {} : { 'content-type': 'application/json' }), ...headers },
-      ...(body === undefined ? {} : { body: JSON.stringify(body) }),
-    });
-    let parsed;
-    try {
-      parsed = await response.json();
-    } catch {
-      if (response.status === 404 || response.status === 405) parsed = {};
-      else return mcpError(`sandbox returned non-JSON HTTP ${response.status}`);
-    }
+    const token = await managementBearer(this.env, this.readStore);
+    const redact = (text) => String(text).split(token).join('[REDACTED]');
     try {
-      assertNoWorkerBinding(parsed, 'mcp');
-      return typedResult(parsed, response.status, validate);
+      const response = await this.fetch(`${baseUrl}${path}`, {
+        method,
+        headers: { accept: 'application/json', authorization: `Bearer ${token}`, ...(body === undefined ? {} : { 'content-type': 'application/json' }), ...headers },
+        ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+      });
+      let parsed;
+      try {
+        const value = await response.json();
+        // Upstream errors and metadata can reflect the authorization header.
+        parsed = JSON.parse(JSON.stringify(value).split(JSON.stringify(token).slice(1, -1)).join('[REDACTED]'));
+      } catch {
+        if (response.status === 404 || response.status === 405) parsed = {};
+        else return mcpError(`sandbox returned non-JSON HTTP ${response.status}`);
+      }
+      try {
+        assertNoWorkerBinding(parsed, 'mcp');
+        return typedResult(parsed, response.status, validate);
+      } catch (error) {
+        return mcpError(`${error.code ?? 'sandbox_malformed_response'}: ${error.message}`);
+      }
     } catch (error) {
-      return mcpError(`${error.code ?? 'sandbox_malformed_response'}: ${error.message}`);
+      throw new Error(redact(error instanceof Error ? error.message : 'Sandbox management request failed'));
     }
   }
 }

package/dist/src/mcp/tools/worker-invoke.mjs

@@ -2707,6 +2707,9 @@ export async function registerWorkerInvokeToolset(server, options = {}) {
   }
 
   async function status(input) {
+    const { projectRecoveryStatus, mergeRecoveryStatuses } = await importImpl('mission-protocol/worker-status.js');
+    const recoveryStatus = breaker => projectRecoveryStatus(typeof breaker?.recoveryStatus === 'function'
+      ? { ...breaker.recoveryStatus(), observedAt: now().toISOString() } : null, 'live');
     if (!input.invocation_id) {
       // #2915 round 8 (D4): ordinary status, read-only, no id — lists every
       // invocation this server currently tracks as a `dispatched` reservation
@@ -2725,11 +2728,19 @@ export async function registerWorkerInvokeToolset(server, options = {}) {
         .filter(scope => scope.state === 'operator-intervention')
         .map(scope => ({ scopeId: scope.scopeKey, reason: scope.operatorReason,
           resetInstruction: { operation: 'reset_recovery_scope', scope_id: scope.scopeKey } })));
-      return { unresolvedReservations, interventionScopes };
+      const recovery = mergeRecoveryStatuses([...breakers].map((breaker, index) => {
+        const status = recoveryStatus(breaker);
+        if (breakers.size > 1) {
+          for (const scope of status.scopes) scope.owner = `owner-${index + 1}`;
+          for (const transition of status.transitions) transition.owner = `owner-${index + 1}`;
+        }
+        return status;
+      }));
+      return { unresolvedReservations, interventionScopes, recovery };
     }
     const entry = registry.get(input.invocation_id);
     if (!entry) throw new Error('Unknown invocation_id');
-    return publicStatus(entry, healthHook);
+    return { ...publicStatus(entry, healthHook), recovery: recoveryStatus(entry.recoveryBreaker ?? registry.recoveryOwner) };
   }
 
   /**

package/dist/src/memory/project-registry.js

@@ -10,6 +10,7 @@ import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import path from 'node:path';
 import { boundedExecFileSync } from '../process/bounded-child-process.mjs';
+import { helperEnvironment } from '../process/cli-command.mjs';
 import { projectAiwgPath, resolveProjectAiwgDir } from '../config/project-artifacts.js';
 export function projectMemoryHome() {
     const override = process.env.AIWG_PROJECT_MEMORY_HOME;
@@ -248,7 +249,7 @@ function sanitizeProjectId(id) {
 }
 function discoverGitRemotes(cwd) {
     try {
-        const stdout = boundedExecFileSync('git', ['remote', '-v'], 'quick', { cwd, encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] });
+        const stdout = boundedExecFileSync('git', ['remote', '-v'], 'quick', { cwd, env: helperEnvironment(), encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] });
         const remotes = stdout
             .split('\n')
             .map((line) => line.trim().split(/\s+/)[1])

package/dist/src/mission-protocol/worker-status.js

@@ -1,2 +1,92 @@
-export {};
+const recoveryStates = new Set(['closed', 'open', 'half-open', 'canary-ready', 'canary', 'operator-intervention']);
+const recoveryScopes = new Set(['invocation', 'model', 'installation', 'quota', 'provider', 'host']);
+const recoveryReasons = new Set(['NOT_FOUND', 'SPAWN_REFUSED', 'AUTH', 'RATE_LIMIT', 'NETWORK',
+    'RESOURCE', 'SANDBOX', 'MODEL', 'UNKNOWN']);
+const objectRecord = (value) => value !== null
+    && typeof value === 'object' && !Array.isArray(value) ? value : null;
+const finiteClock = (value) => typeof value === 'number' && Number.isFinite(value)
+    && Math.abs(value) <= Number.MAX_SAFE_INTEGER ? value : null;
+/** Read-only projection of the existing breaker owner. Only fixed reason codes
+ * and scope identities survive; worker captures, actions and diagnostics do not.
+ * Clock values are converted with the owner's persisted wall-clock anchor,
+ * never with the reader's clock (which may belong to another process/boot). */
+export function projectRecoveryStatus(value, source = 'recorded') {
+    const record = objectRecord(value);
+    const observedAtMs = finiteClock(record?.observedAtMs);
+    const wall = typeof record?.observedAt === 'string' ? Date.parse(record.observedAt) : NaN;
+    const observedAt = Number.isFinite(wall) ? new Date(wall).toISOString() : null;
+    const at = (clock) => {
+        if (clock === null || observedAtMs === null || observedAt === null)
+            return null;
+        const mapped = wall + clock - observedAtMs;
+        return Number.isFinite(mapped) && Math.abs(mapped) <= 8.64e15 ? new Date(mapped).toISOString() : null;
+    };
+    const identity = (item) => {
+        if (!recoveryScopes.has(item.scope) || typeof item.scopeKey !== 'string'
+            || !/^[\p{L}\p{N}_.:/@+~%\-]{1,256}$/u.test(item.scopeKey)
+            || !item.scopeKey.startsWith(`${String(item.scope)}:`))
+            return null;
+        return { scopeKey: item.scopeKey, scope: item.scope };
+    };
+    const reasons = (value) => Array.isArray(value)
+        ? [...new Set(value.slice(0, 32).filter(reason => recoveryReasons.has(reason)))] : [];
+    const rawScopes = Array.isArray(record?.scopes) ? record.scopes : [];
+    const rawTransitions = Array.isArray(record?.transitions) ? record.transitions : [];
+    const scopes = [];
+    for (const raw of rawScopes.slice(0, 32)) {
+        const item = objectRecord(raw), id = item && identity(item);
+        if (!item || !id || !recoveryStates.has(item.state))
+            continue;
+        const nextEligibleAtMs = finiteClock(item.nextEligibleAtMs);
+        scopes.push({ ...id, state: item.state, reasons: reasons(item.reasons),
+            nextEligibleAtMs, nextEligibleAt: at(nextEligibleAtMs), canaryInFlight: item.canaryInFlight === true });
+    }
+    const transitions = [];
+    for (const raw of rawTransitions.slice(-32)) {
+        const item = objectRecord(raw), id = item && identity(item);
+        const clock = finiteClock(item?.atMs);
+        if (!item || !id || clock === null || !recoveryStates.has(item.from) || !recoveryStates.has(item.to))
+            continue;
+        const nextEligibleAtMs = finiteClock(item.nextEligibleAtMs);
+        transitions.push({ ...id, from: item.from, to: item.to,
+            reasons: reasons(item.reasons), atMs: clock, at: at(clock), nextEligibleAtMs, nextEligibleAt: at(nextEligibleAtMs) });
+    }
+    const omittedScopeCount = typeof record?.omittedScopeCount === 'number'
+        && Number.isSafeInteger(record.omittedScopeCount) && record.omittedScopeCount >= 0 ? record.omittedScopeCount : 0;
+    return { source: record ? source : 'unavailable', observedAt, observedAtMs, scopes, transitions,
+        omittedScopeCount: omittedScopeCount + Math.max(0, rawScopes.length - 32),
+        truncated: record?.truncated === true || omittedScopeCount > 0 || rawScopes.length > 32 || rawTransitions.length > 32 };
+}
+/** Merge independently owned observations without letting one owner's close
+ * hide another owner's active scope. Callers first select the latest record
+ * for each owner; owner labels are supplied from validated launcher identity. */
+export function mergeRecoveryStatuses(statuses) {
+    const available = statuses.filter(status => status.source !== 'unavailable');
+    const latest = available.reduce((last, status) => !last
+        || Date.parse(status.observedAt ?? '') >= Date.parse(last.observedAt ?? '') ? status : last, null);
+    if (!latest)
+        return projectRecoveryStatus(null);
+    const allScopes = available.flatMap(status => status.scopes);
+    const scopes = allScopes.filter(scope => scope.state !== 'closed').concat(allScopes.filter(scope => scope.state === 'closed'));
+    const transitions = available.flatMap(status => status.transitions).sort((a, b) => (a.at ? Date.parse(a.at) : a.atMs) - (b.at ? Date.parse(b.at) : b.atMs));
+    const omittedScopeCount = available.reduce((count, status) => count + status.omittedScopeCount, 0) + Math.max(0, scopes.length - 32);
+    return { source: latest.source, observedAt: latest.observedAt, observedAtMs: latest.observedAtMs,
+        scopes: scopes.slice(0, 32), transitions: transitions.slice(-32), omittedScopeCount,
+        truncated: available.some(status => status.truncated) || omittedScopeCount > 0 || transitions.length > 32 };
+}
+/** Mechanical correction records carry fixed codes and invocation identities. */
+export function projectStartupCorrection(value) {
+    const record = objectRecord(value);
+    const safeId = (value) => typeof value === 'string'
+        && /^[\p{L}\p{N}_.:/@+~%\-]{1,256}$/u.test(value);
+    if (!record || record.action !== 'refresh-executable-binding' || record.reasonCode !== 'NOT_FOUND'
+        || !['applied', 'stopped'].includes(String(record.state)) || !safeId(record.previousInvocationId))
+        return null;
+    const stopCodes = new Set(['ATTEMPT_LIMIT', 'CANCELLED', 'DEADLINE', 'UNCHANGED_EXECUTABLE', 'QUALIFICATION_REFUSED',
+        'BINDING_CHANGED', 'RETRY_REFUSED', 'RETRY_FAILED']);
+    return { action: 'refresh-executable-binding', reasonCode: 'NOT_FOUND', state: record.state,
+        previousInvocationId: record.previousInvocationId,
+        ...(typeof record.stopCode === 'string' && stopCodes.has(record.stopCode) ? { stopCode: record.stopCode } : {}),
+        ...(safeId(record.retryInvocationId) ? { retryInvocationId: record.retryInvocationId } : {}) };
+}
 //# sourceMappingURL=worker-status.js.map

package/dist/src/models/grok-build-models.js

@@ -83,6 +83,13 @@ export function parseGrokBuildModelConfig(text, scope) {
                 parsed.projectModelFields = true;
             continue;
         }
+        // Presence only: never retain the command or endpoint in discovery output.
+        if ((table === 'auth' || table === 'grok_com_config') && key === 'auth_provider_command') {
+            parsed.hasExternalAuthProvider = Boolean(unquote(value)?.trim());
+        }
+        if (table === 'endpoints' && ['models_base_url', 'models_list_url', 'models_endpoint'].includes(key)) {
+            parsed.hasCustomModelsEndpoint ||= Boolean(unquote(value)?.trim());
+        }
         if (table === 'models') {
             if (key === 'default')
                 parsed.defaultModel = unquote(value);
@@ -299,6 +306,19 @@ export async function discoverGrokBuildModels(options = {}) {
     const discovered = inspectModels(report, validationDiagnostics);
     const parsedByLayer = await Promise.all(layers.map(layer => layer.role === 'env_overlay'
         && layer.path.includes('(inline)') ? parseEnvOverlay(env) : readLayer(layer)));
+    // Reviewed upstream 2bdd1d6a: external auth plus a custom models endpoint
+    // discards [model.*] and ordinary allowed_models. Inspect has no effective
+    // catalog, so config reconstruction cannot establish selectable aliases.
+    // Conservatively withhold discovery when any active layer names this setup;
+    // do not execute the auth provider or fetch its endpoint to fill the gap.
+    const externalAuth = Boolean(env.GROK_AUTH_PROVIDER_COMMAND?.trim())
+        || parsedByLayer.some(layer => layer?.hasExternalAuthProvider);
+    const customEndpoint = Boolean(env.GROK_MODELS_BASE_URL?.trim() || env.GROK_MODELS_LIST_URL?.trim())
+        || parsedByLayer.some(layer => layer?.hasCustomModelsEndpoint);
+    if (externalAuth && customEndpoint) {
+        return { ...base, ...(runtimeVersion ? { runtimeVersion } : {}), errorKind: 'invalid-output',
+            error: 'Grok Build external auth with a custom models endpoint requires its runtime catalog; config model aliases and ordinary allowed_models are ignored upstream. Automatic discovery is deferred for this configuration.' };
+    }
     let requirementsDefault;
     let requirementsAllowed;
     for (let i = 0; i < layers.length; i++) {

package/dist/src/models/worker-installation.d.mts

@@ -11,7 +11,7 @@ export function loadRecordedWorkerInstallations(input: {
   storeDigest?: string;
   /** Request validation after store presence, before recorded policy/adapter checks. */
   precheckPolicy?: () => void;
-}): Promise<{ registry: ProviderModelCapabilityRegistry; installations: Record<string, WorkerResolutionBinding>; drivers: Record<string, WorkerInvocationDriver>; observations: Record<string, import('./model-discovery.js').ProviderModelDiscovery> }>;
+}): Promise<{ registry: ProviderModelCapabilityRegistry; installations: Record<string, WorkerResolutionBinding>; drivers: Record<string, WorkerInvocationDriver>; observations: Record<string, import('./model-discovery.js').ProviderModelDiscovery>; qualificationFailures?: Record<string, string> }>;
 
 export function hasProvider(name: string): boolean;
 

package/dist/src/models/worker-installation.mjs

@@ -824,6 +824,40 @@ export async function prepareWorkerInstallationStore({ workerWritableRoots, appl
   return assertTrustedStore(installationStorePath(), workerWritableRoots, true, apply);
 }
 
+// Use the existing delivery ledger's host-selected keyring, never public keys
+// supplied by a registration. PAE separates this authority from effect records.
+const qualificationPayloadType = 'application/vnd.aiwg.worker-installation-qualification+json';
+const requalifyMessage = 'Re-run aiwg doctor --probe-workers --qualify. Existing unsigned approvals require deliberate one-time requalification.';
+const keyRecoveryMessage = 'Worker qualification signing trust is unavailable. Check effects.keyProvider in aiwg.config, unlock or restore the existing effect-ledger key, and run aiwg effect keys init if its keyring is not initialized; then re-run aiwg doctor --probe-workers --qualify.';
+
+async function qualificationTrust(cwd, scope) {
+  const { effectSession, openLedger } = await import('../effects/host.js');
+  const { openEffectLedger, readLedgerKeyring } = await import('../effects/ledger.js');
+  const ledger = scope ? openEffectLedger({ projectDir: cwd, scope, writer: 'cli' }) : openLedger(await effectSession(cwd));
+  const keyring = await readLedgerKeyring(ledger);
+  if (!keyring) throw new Error(keyRecoveryMessage);
+  return { ledger, keyring };
+}
+
+async function qualificationPayload(record, signedAt, projectDir, scope) {
+  const { canonicalJson } = await import('../security/artifact-trust.js');
+  const { signature: _signature, ...body } = record;
+  return Buffer.from(canonicalJson({ record: JSON.parse(JSON.stringify(body)), signedAt, projectDir, scope }), 'utf8');
+}
+
+async function qualificationSignatureFailure(record, trust) {
+  if (!record.signature) return 'signature-missing';
+  const { keyid, sig, signedAt, projectDir, scope } = record.signature;
+  if (typeof keyid !== 'string' || typeof sig !== 'string' || typeof signedAt !== 'string'
+    || typeof projectDir !== 'string' || !path.isAbsolute(projectDir) || !scope) return 'signature-invalid';
+  let keyring;
+  try { ({ keyring } = await trust(projectDir, scope)); } catch { return 'signature-trust-unavailable'; }
+  const { checkSignature } = await import('../effects/keyring.js');
+  const result = checkSignature(keyring, keyid, sig, qualificationPayloadType,
+    await qualificationPayload(record, signedAt, projectDir, scope), signedAt);
+  return result === 'ok' ? null : result === 'signature-invalid' ? result : `signature-${result}`;
+}
+
 async function readInstallationStore(filename, expectedDigest) {
   try {
     const bytes = await readInstalledFile(filename);
@@ -864,6 +898,7 @@ export async function inspectRecordedWorkerQualifications({ cwd, policy, paralle
         || (configured.executable && await realpath(configured.executable) !== await realpath(installation.executable))) continue;
       const proof = adapter.invocationProfiles?.[binding.profile]?.installationQualification;
       if (!proof || ['scopeDigest', 'fixtureDigest', 'verifiedAt', 'evidenceRef'].some(key => proof[key] !== installation.evidence?.[key])) continue;
+      if (await qualificationSignatureFailure(record, () => qualificationTrust(cwd))) continue;
       await assertWorkerInstallationEvidence({ ...installation, adapter, now: Date.now(), policy }, proof.scopeDigest);
       results.push({ cli, provider: adapter.provider });
     } catch { /* Malformed, expired or unbound evidence is not qualification. */ }
@@ -879,6 +914,15 @@ export async function recordWorkerInstallation(instance, options) {
   const installation = structuredClone(options.installation);
   const result = await qualifyWorkerInstallation(instance, { ...installation, now: Date.now() });
   if (result.status !== 'ENABLED') return result;
+  let signingKey, keyring, signingProjectDir;
+  try {
+    signingProjectDir = await realpath(options.projectDir ?? installation.cwd);
+    const trust = await qualificationTrust(signingProjectDir);
+    keyring = trust.keyring;
+    signingKey = await trust.ledger.signingKey();
+    const { activeKey } = await import('../effects/keyring.js');
+    if (activeKey(keyring).keyid !== signingKey.keyid) throw new Error('inactive key');
+  } catch { return { status: 'DISABLED', reason: keyRecoveryMessage }; }
   const adapter = structuredClone(installation.adapter);
   adapter.invocationProfiles[installation.profile].installationQualification = {
     scopeDigest: result.scopeDigest, fixtureDigest: result.fixtureDigest,
@@ -913,6 +957,14 @@ export async function recordWorkerInstallation(instance, options) {
       installation: { ...installation, environmentNames, versionProbe: { rawBanner: result.rawVersionBanner, version: result.cliVersion } },
       ...(options.mcpSchemas ? { mcpSchemas: structuredClone(options.mcpSchemas) } : {}),
       ...(options.mcpProfile ? { mcpProfile: structuredClone(options.mcpProfile) } : {}) };
+    const signedAt = new Date().toISOString();
+    try {
+      const payload = await qualificationPayload(record, signedAt, signingProjectDir, keyring.scope);
+      const sig = signingKey.signPae(qualificationPayloadType, payload);
+      const { checkSignature } = await import('../effects/keyring.js');
+      if (checkSignature(keyring, signingKey.keyid, sig, qualificationPayloadType, payload, signedAt) !== 'ok') throw new Error('invalid signature');
+      record.signature = { keyid: signingKey.keyid, sig, signedAt, projectDir: signingProjectDir, scope: keyring.scope };
+    } catch { return { status: 'DISABLED', reason: keyRecoveryMessage }; }
     const retained = [];
     for (const entry of stored.registrations) {
       const workspace = typeof entry.installation?.cwd === 'string'
@@ -944,7 +996,8 @@ export async function loadRecordedWorkerInstallations({ registry, cwd, policy, p
   // Underlying errors can contain probe output, environment values or paths.
   const rejections = [];
   const fail = () => new WorkerPolicyError('OG_ADAPTER_UNQUALIFIED',
-    `Trusted installation qualification is required (${[...new Set(rejections.map(row => row.reason))].join(', ')})`,
+    `Trusted installation qualification is required (${[...new Set(rejections.map(row => row.reason))].join(', ')})${rejections.some(row => row.reason.startsWith('signature-'))
+      ? `. ${rejections.some(row => row.reason === 'signature-trust-unavailable') ? keyRecoveryMessage : requalifyMessage}` : ''}`,
     { rejections });
   let reason = 'store-binding';
   let filename;
@@ -968,6 +1021,7 @@ export async function loadRecordedWorkerInstallations({ registry, cwd, policy, p
   const installations = {};
   const drivers = {};
   const observations = {};
+  const qualificationFailures = Object.create(null);
   const resolvedRegistry = structuredClone(registry);
   const requestedWorkspace = await realpath(cwd);
   const workspaces = await Promise.all(stored.registrations.map(async record => {
@@ -990,6 +1044,11 @@ export async function loadRecordedWorkerInstallations({ registry, cwd, policy, p
       if (!/^[a-z][a-z0-9-]{0,62}$/.test(cli)) throw fail();
       if (counts.get(JSON.stringify([cli, workspaces[registration]])) !== 1) throw fail();
       if (selected.get(cli) !== registration) continue;
+      // A conductor-pinned store digest also binds the original config source.
+      // Framing from a worker cwd must never read that cwd's configuration.
+      reason = await qualificationSignatureFailure(record, (projectDir, scope) => storePath === undefined
+        ? qualificationTrust(cwd) : qualificationTrust(projectDir, scope));
+      if (reason) throw fail();
       const installation = { ...record.installation, adapter, now: Date.now(), environment: {} };
       reason = 'environment-name';
       if (record.installation.environment && Object.keys(record.installation.environment).length) throw fail();
@@ -1106,13 +1165,15 @@ export async function loadRecordedWorkerInstallations({ registry, cwd, policy, p
       Object.assign(resolvedRegistry, candidateRegistry);
     } catch (error) {
       // One rejected installation cannot grant authority or hide qualified peers.
-      rejections.push({ registration, reason: reason === 'module-registration' && error?.code === 'WORKER_ADAPTER_CONFLICT'
-        ? 'adapter-conflict' : reason });
+      const failureReason = reason === 'module-registration' && error?.code === 'WORKER_ADAPTER_CONFLICT'
+        ? 'adapter-conflict' : reason;
+      rejections.push({ registration, reason: failureReason });
+      if (typeof record?.cli === 'string' && /^[a-z][a-z0-9-]{0,62}$/.test(record.cli)) qualificationFailures[record.cli] = failureReason;
     }
   }
   if (!Object.keys(installations).length) {
     if (!rejections.length) rejections.push({ registration: null, reason: 'no-records' });
     throw fail();
   }
-  return { registry: resolvedRegistry, installations, drivers, observations };
+  return { registry: resolvedRegistry, installations, drivers, observations, qualificationFailures };
 }