@aiwg/cli 2026.10.7 → 2026.10.8

package/dist/src/mcp/registry.js

@@ -7,7 +7,7 @@ import { manageGrokBuildMcp } from './grok-build-config.mjs';
 import { replaceServer } from './toml-editor.mjs';
 import { resolveOmpPaths } from '../providers/omp-paths.mjs';
 import { applyJsonToolFilterPlan, claudeSettingsPath, prepareClaudePermissions, planToolFilters } from './tool-filters.mjs';
-import { assertCredentialPolicy, resolveCredentialPolicy, validateEnvReferenceName } from './credentials.mjs';
+import { assertCredentialPolicy, resolveCredentialPolicy, validateEnvReferenceName, credentialReferenceInput, validateCredentialReferences, assertEnvironmentCredentialReferences } from './credentials.mjs';
 /**
  * MCP Server Registry
  *
@@ -23,6 +23,7 @@ import { qualifyWorkerInvocationProfile, requiredWorkerControls } from '../model
 import { dirname, isAbsolute, resolve } from 'path';
 import { homedir } from 'os';
 import { resolveConfigDir } from '../config/user-config.js';
+import { resolveSensitiveInput } from '../auth/sensitive-input.js';
 // ============================================
 // Registry
 // ============================================
@@ -32,22 +33,24 @@ const DEFAULT_REGISTRY = {
     kind: 'McpServerRegistry',
     servers: {},
 };
-const ENV_REFERENCE_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
-function validateCredentialReferences(def) {
-    for (const [header, envName] of Object.entries(def.headerEnv ?? {})) {
-        if (!header.trim())
-            throw new Error('MCP header-env header name must not be empty');
-        if (!ENV_REFERENCE_NAME.test(envName)) {
-            throw new Error(`Invalid MCP header environment variable reference "${envName}"`);
-        }
-    }
-    for (const [key, envName] of Object.entries(def.envFrom ?? {})) {
-        if (!ENV_REFERENCE_NAME.test(key))
-            throw new Error(`Invalid MCP env-from variable name "${key}"`);
-        if (!ENV_REFERENCE_NAME.test(envName)) {
-            throw new Error(`Invalid MCP env-from environment variable reference "${envName}"`);
+/** Resolve references only for AIWG's in-memory transport, never for a config writer. */
+export async function resolveMcpCredentialMaps(server, dependencies = {}) {
+    const result = { env: server.env ? { ...server.env } : undefined, headers: server.headers ? { ...server.headers } : undefined };
+    for (const [field, target, flag] of [['envFrom', 'env', '--env-from'], ['headerEnv', 'headers', '--header-env']]) {
+        for (const [key, reference] of Object.entries(server[field] ?? {})) {
+            const input = credentialReferenceInput(reference, flag);
+            // Explicit locators prevent terminal prompts and implicit stdin consumption.
+            try {
+                const value = await resolveSensitiveInput({ ...input, prefix: 'value' }, dependencies);
+                result[target] = { ...result[target], [key]: value };
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : 'MCP credential input failed';
+                throw new Error(message.replace(/--value-(file|store|env)/g, (_, source) => `${flag} KEY=${source === 'env' ? 'ENV_NAME' : source === 'file' ? 'file:ABSOLUTE_PATH' : 'store:NAME'}`));
+            }
         }
     }
+    return result;
 }
 export function workerServerDigest(server) {
     const { workerQualification, description, injectedProviders, addedAt, updatedAt, ...execution } = server;
@@ -300,6 +303,7 @@ function tomlInlineTable(values) {
     return `{ ${Object.entries(values).map(([name, value]) => `${tomlKey(name)} = ${tomlString(value)}`).join(', ')} }`;
 }
 export function buildServerToml(server) {
+    assertEnvironmentCredentialReferences(server, 'codex');
     const lines = [];
     lines.push(`[mcp_servers.${tomlKey(server.name)}]`);
     if (server.type === 'stdio') {

package/dist/src/mcp/registry.mjs

@@ -8,7 +8,7 @@ import { manageGrokBuildMcp } from './grok-build-config.mjs';
 import { replaceServer } from './toml-editor.mjs';
 import { resolveOmpPaths } from '../providers/omp-paths.mjs';
 import { applyJsonToolFilterPlan, claudeSettingsPath, prepareClaudePermissions, planToolFilters } from './tool-filters.mjs';
-import { assertCredentialPolicy, resolveCredentialPolicy, validateEnvReferenceName } from './credentials.mjs';
+import { assertCredentialPolicy, resolveCredentialPolicy, validateEnvReferenceName, validateCredentialReferences, assertEnvironmentCredentialReferences } from './credentials.mjs';
 /**
  * MCP Server Registry (Runtime ESM)
  *
@@ -72,23 +72,6 @@ const DEFAULT_REGISTRY = {
   servers: {},
 };
 
-const ENV_REFERENCE_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
-
-function validateCredentialReferences(def) {
-  for (const [header, envName] of Object.entries(def.headerEnv || {})) {
-    if (!header.trim()) throw new Error('MCP header-env header name must not be empty');
-    if (!ENV_REFERENCE_NAME.test(envName)) {
-      throw new Error(`Invalid MCP header environment variable reference "${envName}"`);
-    }
-  }
-  for (const [key, envName] of Object.entries(def.envFrom || {})) {
-    if (!ENV_REFERENCE_NAME.test(key)) throw new Error(`Invalid MCP env-from variable name "${key}"`);
-    if (!ENV_REFERENCE_NAME.test(envName)) {
-      throw new Error(`Invalid MCP env-from environment variable reference "${envName}"`);
-    }
-  }
-}
-
 // The typed worker dispatch boundary owns qualification. Legacy runtime edits
 // invalidate its binding without importing the TypeScript policy owner.
 export function workerServerDigest(server) {
@@ -280,6 +263,7 @@ function tomlInlineTable(values) {
 }
 
 export function buildServerToml(server) {
+  assertEnvironmentCredentialReferences(server, 'codex');
   const lines = [];
   lines.push(`[mcp_servers.${tomlKey(server.name)}]`);
 

package/dist/src/mcp/tools/agentic-sandbox.mjs

@@ -1,14 +1,14 @@
 /**
  * Governed Agentic Sandbox fleet and activity MCP surface.
  *
- * Credentials are file-backed server configuration, never tool arguments.
+ * Credentials are private-file or native-store configuration, never tool arguments.
  * Every tool in this module uses the management bearer domain; executor-plane
  * credentials are deliberately out of scope and cannot be substituted.
  *
  * @implements #2015
  */
 
-import { readFile, stat } from 'node:fs/promises';
+import { access } from 'node:fs/promises';
 import { z } from 'zod';
 import { integer, dateTime } from '../../schema/zod-validation.mjs';
 import { assertNoWorkerBinding, mcpError, mcpJson } from '../helpers.mjs';
@@ -36,17 +36,27 @@ function configuredBaseUrl(env = process.env) {
   return url.toString().replace(/\/$/, '');
 }
 
-async function managementBearer(env = process.env) {
+async function sensitiveInputModule() {
+  // Source MCP modules and the published dist tree share the compiled owner.
+  for (const location of [new URL('../../auth/sensitive-input.js', import.meta.url), new URL('../../../dist/src/auth/sensitive-input.js', import.meta.url)]) {
+    try { await access(location); } catch { continue; }
+    return import(location.href);
+  }
+  throw new Error('Sandbox credentials require the compiled AIWG auth module, which this installation is missing. Run `aiwg doctor` to repair the installation.');
+}
+
+async function managementBearer(env = process.env, readStore) {
   const tokenFile = String(env.AIWG_SANDBOX_MANAGEMENT_TOKEN_FILE ?? '').trim();
-  if (!tokenFile) throw new Error('AIWG_SANDBOX_MANAGEMENT_TOKEN_FILE is required for the sandbox toolset');
-  const metadata = await stat(tokenFile);
-  if (!metadata.isFile()) throw new Error('sandbox management token path is not a regular file');
-  if (process.platform !== 'win32' && (metadata.mode & 0o077) !== 0) {
-    throw new Error('sandbox management token file must not be accessible by group or other users');
+  const tokenStore = String(env.AIWG_SANDBOX_MANAGEMENT_TOKEN_STORE ?? '').trim();
+  if (!tokenFile && !tokenStore) {
+    throw new Error('Sandbox management bearer requires AIWG_SANDBOX_MANAGEMENT_TOKEN_FILE or AIWG_SANDBOX_MANAGEMENT_TOKEN_STORE.');
   }
-  const token = String(await readFile(tokenFile, 'utf8')).trim();
-  if (!token || /[\r\n]/.test(token)) throw new Error('sandbox management token file must contain one non-empty bearer token');
-  return token;
+  const { readPrivateValueFile, resolveSensitiveInput } = await sensitiveInputModule();
+  return resolveSensitiveInput(tokenFile ? { prefix: 'token', file: tokenFile } : { prefix: 'token', store: tokenStore }, {
+    isTTY: false,
+    readFile: (pathname) => readPrivateValueFile(pathname, 'AIWG_SANDBOX_MANAGEMENT_TOKEN_FILE'),
+    ...(readStore ? { readStore } : {}),
+  });
 }
 
 function containsRestricted(value) {
@@ -138,32 +148,40 @@ function typedResult(body, status, validate) {
 }
 
 export class AgenticSandboxMcpClient {
-  constructor({ env = process.env, fetch = globalThis.fetch.bind(globalThis) } = {}) {
+  constructor({ env = process.env, fetch = globalThis.fetch.bind(globalThis), readStore } = {}) {
     this.env = env;
     this.fetch = fetch;
+    this.readStore = readStore;
   }
 
   async request(path, { method = 'GET', body, headers = {}, validate = (value) => safeResponse(value) } = {}) {
     assertNoWorkerBinding(body, 'mcp');
     const baseUrl = configuredBaseUrl(this.env);
-    const token = await managementBearer(this.env);
-    const response = await this.fetch(`${baseUrl}${path}`, {
-      method,
-      headers: { accept: 'application/json', authorization: `Bearer ${token}`, ...(body === undefined ? {} : { 'content-type': 'application/json' }), ...headers },
-      ...(body === undefined ? {} : { body: JSON.stringify(body) }),
-    });
-    let parsed;
-    try {
-      parsed = await response.json();
-    } catch {
-      if (response.status === 404 || response.status === 405) parsed = {};
-      else return mcpError(`sandbox returned non-JSON HTTP ${response.status}`);
-    }
+    const token = await managementBearer(this.env, this.readStore);
+    const redact = (text) => String(text).split(token).join('[REDACTED]');
     try {
-      assertNoWorkerBinding(parsed, 'mcp');
-      return typedResult(parsed, response.status, validate);
+      const response = await this.fetch(`${baseUrl}${path}`, {
+        method,
+        headers: { accept: 'application/json', authorization: `Bearer ${token}`, ...(body === undefined ? {} : { 'content-type': 'application/json' }), ...headers },
+        ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+      });
+      let parsed;
+      try {
+        const value = await response.json();
+        // Upstream errors and metadata can reflect the authorization header.
+        parsed = JSON.parse(JSON.stringify(value).split(JSON.stringify(token).slice(1, -1)).join('[REDACTED]'));
+      } catch {
+        if (response.status === 404 || response.status === 405) parsed = {};
+        else return mcpError(`sandbox returned non-JSON HTTP ${response.status}`);
+      }
+      try {
+        assertNoWorkerBinding(parsed, 'mcp');
+        return typedResult(parsed, response.status, validate);
+      } catch (error) {
+        return mcpError(`${error.code ?? 'sandbox_malformed_response'}: ${error.message}`);
+      }
     } catch (error) {
-      return mcpError(`${error.code ?? 'sandbox_malformed_response'}: ${error.message}`);
+      throw new Error(redact(error instanceof Error ? error.message : 'Sandbox management request failed'));
     }
   }
 }

package/dist/src/models/grok-build-models.js

@@ -83,6 +83,13 @@ export function parseGrokBuildModelConfig(text, scope) {
                 parsed.projectModelFields = true;
             continue;
         }
+        // Presence only: never retain the command or endpoint in discovery output.
+        if ((table === 'auth' || table === 'grok_com_config') && key === 'auth_provider_command') {
+            parsed.hasExternalAuthProvider = Boolean(unquote(value)?.trim());
+        }
+        if (table === 'endpoints' && ['models_base_url', 'models_list_url', 'models_endpoint'].includes(key)) {
+            parsed.hasCustomModelsEndpoint ||= Boolean(unquote(value)?.trim());
+        }
         if (table === 'models') {
             if (key === 'default')
                 parsed.defaultModel = unquote(value);
@@ -299,6 +306,19 @@ export async function discoverGrokBuildModels(options = {}) {
     const discovered = inspectModels(report, validationDiagnostics);
     const parsedByLayer = await Promise.all(layers.map(layer => layer.role === 'env_overlay'
         && layer.path.includes('(inline)') ? parseEnvOverlay(env) : readLayer(layer)));
+    // Reviewed upstream 2bdd1d6a: external auth plus a custom models endpoint
+    // discards [model.*] and ordinary allowed_models. Inspect has no effective
+    // catalog, so config reconstruction cannot establish selectable aliases.
+    // Conservatively withhold discovery when any active layer names this setup;
+    // do not execute the auth provider or fetch its endpoint to fill the gap.
+    const externalAuth = Boolean(env.GROK_AUTH_PROVIDER_COMMAND?.trim())
+        || parsedByLayer.some(layer => layer?.hasExternalAuthProvider);
+    const customEndpoint = Boolean(env.GROK_MODELS_BASE_URL?.trim() || env.GROK_MODELS_LIST_URL?.trim())
+        || parsedByLayer.some(layer => layer?.hasCustomModelsEndpoint);
+    if (externalAuth && customEndpoint) {
+        return { ...base, ...(runtimeVersion ? { runtimeVersion } : {}), errorKind: 'invalid-output',
+            error: 'Grok Build external auth with a custom models endpoint requires its runtime catalog; config model aliases and ordinary allowed_models are ignored upstream. Automatic discovery is deferred for this configuration.' };
+    }
     let requirementsDefault;
     let requirementsAllowed;
     for (let i = 0; i < layers.length; i++) {

package/dist/src/providers/provider-definitions.js

@@ -687,9 +687,9 @@ const BUILT_IN_SEEDS = [
             source: 'https://github.com/xai-org/grok-build',
             version: '1.0.38',
             // Reviewed public tree (docs + inspect schema), not an all-zero placeholder.
-            revision: '4247f661689354b831191f11eeeac8424993fe3d',
+            revision: '2bdd1d6a6369de0e8c68132ea4539e9abd9e14a8',
             runtime: 'Grok Build CLI',
-            lastVerified: '2026-09-20',
+            lastVerified: '2026-10-26',
         },
         surfaces: {
             primary: 'grok-build',

package/dist/src/serve/shared-host-scheduler.js

@@ -233,7 +233,10 @@ export class FileAdmissionStore {
             const file = openSync(this.path, constants.O_RDONLY | constants.O_NOFOLLOW);
             try {
                 const stat = fstatSync(file);
-                if (!stat.isFile() || stat.nlink !== 1 || (stat.mode & 0o077) !== 0 || stat.uid !== process.getuid?.() || stat.size > 16 * 1024 * 1024)
+                // nlink is 0 when a writer atomically renamed a new snapshot over the
+                // file after this reader opened it; the open descriptor is still a
+                // complete earlier snapshot. Only extra hard links are refused.
+                if (!stat.isFile() || stat.nlink > 1 || (stat.mode & 0o077) !== 0 || stat.uid !== process.getuid?.() || stat.size > 16 * 1024 * 1024)
                     throw new Error('host authority must be a private bounded regular file');
                 return JSON.parse(readFileSync(file, 'utf8'));
             }

package/dist/src/storage/backends/fortemi.js

@@ -37,6 +37,7 @@
  * @issue #972
  */
 import { createHash } from 'node:crypto';
+import { debuglog } from 'node:util';
 const FORTEMI_QUERY_LIMIT = 50;
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function schemaProperties(tool) {
@@ -371,8 +372,8 @@ export class FortemiAdapter {
  * Implemented as a lazy import so tests that inject a stub never load
  * the SDK or touch the registry.
  */
-export const createDefaultMcpClient = async (serverName, registryOverride, environment = process.env) => {
-    const { McpServerRegistry } = await import('../../mcp/registry.js');
+export const createDefaultMcpClient = async (serverName, registryOverride, environment = process.env, sensitiveInput = {}) => {
+    const { McpServerRegistry, resolveMcpCredentialMaps } = await import('../../mcp/registry.js');
     const registry = registryOverride ?? new McpServerRegistry();
     const server = await registry.get(serverName);
     if (!server) {
@@ -381,60 +382,117 @@ export const createDefaultMcpClient = async (serverName, registryOverride, envir
     }
     // Lazy imports keep unit tests that inject a stub isolated from transports.
     const { Client } = await import('@modelcontextprotocol/sdk/client/index.js');
-    let transport;
-    if (server.type === 'stdio') {
-        const { StdioClientTransport } = await import('@modelcontextprotocol/sdk/client/stdio.js');
-        transport = new StdioClientTransport({
-            command: server.command ?? '',
-            args: server.args ?? [],
-            env: server.env,
-        });
+    const hasNewReferences = [...Object.values(server.headerEnv ?? {}), ...Object.values(server.envFrom ?? {})]
+        .some(reference => /^(?:file|store):/.test(reference));
+    // Keep legacy header/environment behavior unchanged. New locators are resolved
+    // only at connection time and never fed back to the registry or config writers.
+    if (hasNewReferences && server.type === 'stdio' && debuglog('child_process').enabled) {
+        throw new Error('MCP file/store stdio credentials require NODE_DEBUG child_process logging to be disabled.');
     }
-    else {
-        if (!server.url) {
-            throw new Error(`storage(fortemi): MCP server "${serverName}" has no URL`);
+    const resolved = hasNewReferences
+        ? await resolveMcpCredentialMaps(server, { ...sensitiveInput, environment })
+        : undefined;
+    const secrets = resolved ? [
+        ...Object.keys(server.envFrom ?? {}).map(key => resolved.env?.[key]),
+        ...Object.keys(server.headerEnv ?? {}).map(key => resolved.headers?.[key]),
+    ].filter((value) => Boolean(value)).sort((a, b) => b.length - a.length) : [];
+    const redact = (text) => secrets.reduce((text, secret) => text.split(secret).join('[REDACTED]'), text);
+    const protect = async (operation) => {
+        try {
+            return await operation();
         }
-        const url = validateRemoteMcpUrl(server.url);
-        const headers = resolveMcpRequestHeaders(server, environment);
-        if (server.type === 'http') {
-            const { StreamableHTTPClientTransport } = await import('@modelcontextprotocol/sdk/client/streamableHttp.js');
-            transport = new StreamableHTTPClientTransport(url, {
-                requestInit: { headers },
-            });
+        catch (error) {
+            throw new Error(redact(error instanceof Error ? error.message : 'MCP transport failed'));
         }
-        else if (server.type === 'sse') {
-            const { SSEClientTransport } = await import('@modelcontextprotocol/sdk/client/sse.js');
-            transport = new SSEClientTransport(url, {
-                requestInit: { headers },
-                eventSourceInit: {
-                    fetch: async (input, init) => {
-                        const merged = new Headers(init?.headers);
-                        for (const [name, value] of Object.entries(headers))
-                            merged.set(name, value);
-                        return fetch(input, { ...init, headers: merged });
-                    },
-                },
+    };
+    const protectResult = (value) => {
+        if (typeof value === 'string')
+            return redact(value);
+        if (Array.isArray(value))
+            return value.map(protectResult);
+        if (value && typeof value === 'object')
+            return Object.fromEntries(Object.entries(value).map(([key, value]) => [redact(key), protectResult(value)]));
+        return value;
+    };
+    try {
+        let transport;
+        if (server.type === 'stdio') {
+            const { StdioClientTransport } = await import('@modelcontextprotocol/sdk/client/stdio.js');
+            transport = new StdioClientTransport({
+                command: server.command ?? '',
+                args: server.args ?? [],
+                env: resolved?.env ?? server.env,
+                ...(hasNewReferences ? { stderr: 'pipe' } : {}),
             });
         }
         else {
-            throw new Error(`storage(fortemi): unsupported MCP transport "${String(server.type)}"`);
+            if (!server.url) {
+                throw new Error(`storage(fortemi): MCP server "${serverName}" has no URL`);
+            }
+            const url = validateRemoteMcpUrl(server.url);
+            const headers = resolved?.headers ?? resolveMcpRequestHeaders(server, environment);
+            if (resolved) {
+                for (const header of Object.keys(server.headerEnv ?? {})) {
+                    if (header.toLowerCase() === 'authorization')
+                        headers[header] = `Bearer ${headers[header]}`;
+                }
+            }
+            if (server.type === 'http') {
+                const { StreamableHTTPClientTransport } = await import('@modelcontextprotocol/sdk/client/streamableHttp.js');
+                transport = new StreamableHTTPClientTransport(url, {
+                    requestInit: { headers },
+                });
+            }
+            else if (server.type === 'sse') {
+                const { SSEClientTransport } = await import('@modelcontextprotocol/sdk/client/sse.js');
+                transport = new SSEClientTransport(url, {
+                    requestInit: { headers },
+                    eventSourceInit: {
+                        fetch: async (input, init) => {
+                            const merged = new Headers(init?.headers);
+                            for (const [name, value] of Object.entries(headers))
+                                merged.set(name, value);
+                            return fetch(input, { ...init, headers: merged });
+                        },
+                    },
+                });
+            }
+            else {
+                throw new Error(`storage(fortemi): unsupported MCP transport "${String(server.type)}"`);
+            }
         }
+        const client = new Client({ name: 'aiwg-storage-fortemi-adapter', version: '1.0.0' }, { capabilities: {} });
+        if (hasNewReferences && server.type === 'stdio') {
+            // The recipient's stderr can contain credentials. Drain without forwarding.
+            transport.stderr?.on('data', () => { });
+        }
+        if (hasNewReferences)
+            await protect(() => client.connect(transport));
+        else
+            await client.connect(transport);
+        return {
+            async callTool(name, args) {
+                const call = async () => unwrapMcpToolResult(await client.callTool({ name, arguments: args }));
+                return hasNewReferences ? protectResult(await protect(call)) : call();
+            },
+            async listTools() {
+                return hasNewReferences ? protectResult(await protect(() => client.listTools())) : client.listTools();
+            },
+            serverVersion() {
+                return hasNewReferences ? protectResult(client.getServerVersion()) : client.getServerVersion();
+            },
+            async close() {
+                if (hasNewReferences)
+                    await protect(() => client.close());
+                else
+                    await client.close();
+            },
+        };
+    }
+    catch (error) {
+        if (!hasNewReferences)
+            throw error;
+        throw new Error(redact(error instanceof Error ? error.message : 'MCP transport failed'));
     }
-    const client = new Client({ name: 'aiwg-storage-fortemi-adapter', version: '1.0.0' }, { capabilities: {} });
-    await client.connect(transport);
-    return {
-        async callTool(name, args) {
-            return unwrapMcpToolResult(await client.callTool({ name, arguments: args }));
-        },
-        async listTools() {
-            return client.listTools();
-        },
-        serverVersion() {
-            return client.getServerVersion();
-        },
-        async close() {
-            await client.close();
-        },
-    };
 };
 //# sourceMappingURL=fortemi.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwg/cli",
-  "version": "2026.10.7",
+  "version": "2026.10.8",
   "description": "Lightweight AIWG CLI for signed, versioned web-backed resources.",
   "type": "module",
   "license": "MIT",