@aiwg/cli 2026.10.7 → 2026.10.9

package/dist/src/artifacts/cli.js

@@ -24,9 +24,9 @@ import { resolveIndexWorkers } from './index-preparation.js';
 import { SUPPORTED_VIEWS } from './corpus-views/renderers.js';
 import { parseResourceSelector, readVerifiedRegularFile, } from '../resources/web-release.js';
 import { findPackageRoot } from '../cli/find-package-root.js';
-import { createResourceCredentialProvider } from '../auth/resource-credentials.js';
+import { createResourceCredentialProvider, prepareResourceCredentials } from '../auth/resource-credentials.js';
 const MAX_RESOURCE_TRUST_ROOT_BYTES = 64 * 1024;
-function webReleaseOptionsFromEnvironment() {
+function webReleaseOptionsFromEnvironment(credentialProvider = createResourceCredentialProvider(process.env)) {
     const baseUrl = process.env.AIWG_RESOURCE_BASE_URL;
     const cacheRoot = process.env.AIWG_RESOURCE_CACHE_ROOT;
     const trustRootFile = process.env.AIWG_RESOURCE_TRUST_ROOT_FILE;
@@ -44,7 +44,7 @@ function webReleaseOptionsFromEnvironment() {
         }
     }
     return {
-        credentialProvider: createResourceCredentialProvider(process.env),
+        credentialProvider,
         ...(baseUrl === undefined ? {} : { baseUrl }),
         ...(cacheRoot === undefined ? {} : { cacheRoot }),
         ...(publicKeyPem === undefined ? {} : { publicKeyPem }),
@@ -1465,6 +1465,8 @@ const DISCOVER_VALUE_FLAGS = new Set([
  * @implements #1214
  */
 async function handleDiscover(args) {
+    const credentials = await prepareResourceCredentials(args);
+    args = credentials.args;
     const { discoverCapability } = await import('./query-engine.js');
     const cwd = process.cwd();
     // Parse the positional phrase. Flags may appear before or after it — the
@@ -1526,7 +1528,7 @@ async function handleDiscover(args) {
     const offline = flags.includes('--offline');
     const webReleaseOptions = resourceSource === 'local'
         ? undefined
-        : webReleaseOptionsFromEnvironment();
+        : webReleaseOptionsFromEnvironment(credentials.credentialProvider);
     await discoverCapability(cwd, {
         phrase,
         typeFilter,
@@ -1578,6 +1580,8 @@ function showFlagValues(flags, name) {
     return values;
 }
 async function handleShow(args) {
+    const credentials = await prepareResourceCredentials(args);
+    args = credentials.args;
     const { showArtifact, showMetadata } = await import('./query-engine.js');
     const cwd = process.cwd();
     const positional = [];
@@ -1676,7 +1680,7 @@ async function handleShow(args) {
     const offline = flags.includes('--offline');
     const webReleaseOptions = resourceSource === 'local'
         ? undefined
-        : webReleaseOptionsFromEnvironment();
+        : webReleaseOptionsFromEnvironment(credentials.credentialProvider);
     const params = {
         name,
         boundRuleBodies: flags.includes('--bound-rule-bodies'),

package/dist/src/auth/config.js

@@ -1,5 +1,5 @@
-import fs from "node:fs";
 import path from "node:path";
+import { readPrivateValueFile } from "./sensitive-input.js";
 export const DEFAULT_AUTH_BASE_URL = "https://releases.aiwg.io";
 export const DEFAULT_AUTH_CLIENT_ID = "aiwg-cli";
 export const DEFAULT_AUTH_SCOPES = ["releases:read", "profile:read"];
@@ -24,14 +24,9 @@ export function authConfigFromEnvironment(env = process.env) {
         throw new Error("AIWG auth scopes are invalid");
     return { baseUrl, clientId, scopes, requestTimeoutMs: 30_000 };
 }
-export function explicitResourceToken(env = process.env) {
+export async function explicitResourceToken(env = process.env) {
     if (env.AIWG_RESOURCE_TOKEN_FILE) {
-        const pathname = path.resolve(env.AIWG_RESOURCE_TOKEN_FILE);
-        const stat = fs.lstatSync(pathname);
-        if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 0o077) !== 0) {
-            throw new Error("AIWG_RESOURCE_TOKEN_FILE must be a non-symlink regular file with mode 0600");
-        }
-        return fs.readFileSync(pathname, "utf8").trim() || null;
+        return await readPrivateValueFile(path.resolve(env.AIWG_RESOURCE_TOKEN_FILE), "AIWG_RESOURCE_TOKEN_FILE") || null;
     }
     return env.AIWG_RESOURCE_TOKEN?.trim() || null;
 }

package/dist/src/auth/resource-credentials.js

@@ -1,12 +1,19 @@
 import { explicitResourceToken } from "./config.js";
 import { createCredentialStore } from "./credential-store.js";
+import { resolveSensitiveInput, sensitiveInputOptions } from "./sensitive-input.js";
 /**
  * Resolve credentials for protected release downloads. Explicit compatibility
  * inputs take precedence over interactive-login credentials.
  */
-export function createResourceCredentialProvider(env = process.env, store) {
+export function createResourceCredentialProvider(env = process.env, store, source = {}, dependencies = {}) {
+    const hasSource = source.interactive || source.stdin || source.file !== undefined || source.store !== undefined || source.env !== undefined;
+    // A command may fetch several manifests and bodies. Never consume stdin or
+    // ask for the same explicit credential more than once, including on failure.
+    let resolvedSource;
     return async () => {
-        const explicit = explicitResourceToken(env);
+        if (hasSource)
+            return resolvedSource ??= resolveSensitiveInput({ ...source, prefix: 'resource-token' }, { ...dependencies, environment: env });
+        const explicit = await explicitResourceToken(env);
         if (explicit)
             return explicit;
         const selected = store ?? createCredentialStore();
@@ -22,4 +29,30 @@ export function createResourceCredentialProvider(env = process.env, store) {
         }
     };
 }
+/** Parse once before command-specific positional parsing or helper forwarding. */
+export async function prepareResourceCredentials(args, env = process.env, store, dependencies = {}) {
+    const source = sensitiveInputOptions(args, 'resource-token');
+    const remaining = [];
+    const valueFlags = ['--resource-token-file', '--resource-token-store', '--resource-token-env'];
+    for (let index = 0; index < args.length; index++) {
+        const token = args[index];
+        if (token === '--') {
+            remaining.push(...args.slice(index));
+            break;
+        }
+        if (valueFlags.includes(token)) {
+            index++;
+            continue;
+        }
+        if (valueFlags.some(flag => token.startsWith(`${flag}=`)) ||
+            token === '--resource-token-stdin' || token === '--resource-token-interactive')
+            continue;
+        remaining.push(token);
+    }
+    const credentialProvider = createResourceCredentialProvider(env, store, source, dependencies);
+    if (source.interactive || source.stdin || source.file !== undefined || source.store !== undefined || source.env !== undefined) {
+        await credentialProvider();
+    }
+    return { args: remaining, credentialProvider, omitEnv: ['AIWG_RESOURCE_TOKEN', ...(source.env ? [source.env] : [])] };
+}
 //# sourceMappingURL=resource-credentials.js.map

package/dist/src/cli/handlers/cost-report.js

@@ -1,6 +1,7 @@
 /** OpenRouter fleet cost-report CLI handler. @issue #1187 */
 import os from 'node:os';
 import path from 'node:path';
+import { sensitiveInputOptions } from '../../auth/sensitive-input.js';
 import { FleetConfigMissingError, formatFleetSpendReport, generateFleetSpendReport, } from '../../cost/fleet-report.js';
 function option(args, name) {
     const index = args.indexOf(name);
@@ -9,10 +10,11 @@ function option(args, name) {
 }
 function usage() {
     return [
-        'Usage: aiwg cost-report (--fleet | --key <key_ref>) [--source openrouter] [--config <fleet.yaml>] [--json]',
+        'Usage: aiwg cost-report (--fleet | --key <key_ref> [--key-store <name>]) [--source openrouter] [--config <fleet.yaml>] [--json]',
         '',
         'Reads bot-to-key references from ~/.config/aiwg/fleet.yaml and credentials from',
         '~/.config/aiwg/keys/<key_ref> or AIWG_OPENROUTER_KEY_<KEY_REF>.',
+        'Use --key-store <name> for one key, or per-entry key_store references in fleet YAML.',
         '',
         'AIWG observes and correlates spend; OpenRouter enforces all key limits and caps.',
     ].join('\n');
@@ -40,6 +42,9 @@ export const costReportHandler = {
             ? path.resolve(ctx.cwd, configuredPath)
             : path.join(os.homedir(), '.config', 'aiwg', 'fleet.yaml');
         try {
+            const keyStore = sensitiveInputOptions(ctx.args, 'key').store;
+            if (keyStore !== undefined && !keyRef)
+                return { exitCode: 2, message: '--key-store requires --key <key_ref>; use per-entry key_store references for --fleet.' };
             const capValue = option(ctx.args, '--monthly-cap');
             const cap = capValue === undefined ? 0 : Number(capValue);
             if (!Number.isFinite(cap) || cap < 0)
@@ -53,6 +58,7 @@ export const costReportHandler = {
                             bot: option(ctx.args, '--bot') ?? keyRef,
                             machine: option(ctx.args, '--machine') ?? os.hostname(),
                             key_ref: keyRef,
+                            ...(keyStore !== undefined ? { key_store: keyStore } : {}),
                             monthly_cap: cap,
                         }],
                 } : {}),

package/dist/src/cli/handlers/decision.js

@@ -1,12 +1,12 @@
 import { resolveSensitiveInput, sensitiveInputOptions } from '../../auth/sensitive-input.js';
 import { decisionPricing } from '../../decision/pricing.js';
-import { ATTRIBUTION_FIELD_PATTERN, DecisionAskUsageError, decisionCapabilities, DecisionLedgerSinceError, decisionLedgerHistory, decisionLedgerStats, evaluateRequestPath, listPatterns, livePlan, MAX_ATTRIBUTION_FIELD_LENGTH, materializeSyntheticClassificationSetup, parseDecisionLedgerSince, readDecisionContextFile, runDecisionOffloadCheckpoint, runOfflinePattern, setupJev, showPattern, syntheticClassificationSetup, validateDecisionInput, } from '../../decision/driver.js';
+import { ATTRIBUTION_FIELD_PATTERN, DecisionAskUsageError, decisionCapabilities, DecisionLedgerSinceError, decisionLedgerHistory, decisionLedgerStats, rotateDecisionLedger, parseDecisionLedgerRetention, evaluateRequestPath, listPatterns, livePlan, MAX_ATTRIBUTION_FIELD_LENGTH, materializeSyntheticClassificationSetup, parseDecisionLedgerSince, readDecisionContextFile, runDecisionOffloadCheckpoint, runOfflinePattern, setupJev, showPattern, syntheticClassificationSetup, validateDecisionInput, } from '../../decision/driver.js';
 function jsonResult(value, exitCode = 0) {
     return { exitCode, message: JSON.stringify(value, null, 2), rawOutput: true };
 }
 function usage() {
     return [
-        'Usage: aiwg decision <capabilities|status|patterns|validate|evaluate|setup|history|stats|pricing> [options]',
+        'Usage: aiwg decision <capabilities|status|patterns|validate|evaluate|setup|history|stats|rotate|pricing> [options]',
         '       aiwg decision ask --question "<q>" (--yes-no | --choices a,b,c | --scale 1-5) [--context <text> | --context-file <path> | --context-stdin] [--threshold 0.8] [--timeout-ms 15000] [--passes N] [--escalation-passes N] [--provider <id>] [--session <id>] [--caller <tag>] [--record-text] [--json]',
         '',
         'Commands:',
@@ -20,9 +20,10 @@ function usage() {
         '  setup synthetic-classification [--output-dir <dir>]',
         '  setup jev [--token-interactive | --token-stdin | --token-file <path> | --token-store <name> | --token-env <name>] [--region <r>] [--endpoint <url>] [--verify] [--remove]',
         '  ask --question "<q>" (--yes-no | --choices a,b,c | --scale 1-5) [--provider <id>] [--session <id>] [--caller <tag>] [--record-text]',
-        '  history [--since <date>] [--provider <id>] [--session <id>] [--kind yes-no|choices|scale] [--status answered|fallback] [--caller <tag>|<prefix>* | --no-caller] [--json]',
+        '  history [--since <date>] [--provider <id>] [--session <id>] [--kind yes-no|choices|scale] [--status answered|fallback] [--caller <tag>|<prefix>* | --no-caller] [--include-archives] [--json]',
         '  pricing [--refresh --model jev-X.Y.Z] [--dry-run] [--offline | --allow-snapshot] [--json]',
-        '  stats [--since <date>] [--provider <id>] [--session <id>] [--kind yes-no|choices|scale] [--status answered|fallback] [--caller <tag>|<prefix>* | --no-caller] [--group-by provider|session|kind|caller|passes|escalation] [--json]',
+        '  stats [--since <date>] [--provider <id>] [--session <id>] [--kind yes-no|choices|scale] [--status answered|fallback] [--caller <tag>|<prefix>* | --no-caller] [--group-by provider|session|kind|caller|passes|escalation] [--include-archives] [--json]',
+        '  rotate [--keep-last <Nd|N> | --all] [--to <path>] [--json]',
         '',
         'Notes:',
         '  Every COMPLETED `ask` call (CLI and MCP) appends one record to the decision',
@@ -42,9 +43,13 @@ function usage() {
         `  --session and --caller must match ${ATTRIBUTION_FIELD_PATTERN.source} (<= ${MAX_ATTRIBUTION_FIELD_LENGTH} characters).`,
         '  `history`/`stats` accept `--caller <tag>` (exact), `--caller \'<prefix>*\'` (prefix; the only wildcard), or `--no-caller` (records with no tag; not combinable with `--caller`).',
         '  `history`/`stats` reject unknown flags and positional arguments with exit 2.',
-        '  The ledger has no built-in retention: it grows without bound and the',
-        '  operator may truncate or delete it at any time; readers tolerate a missing',
-        '  file. The ledger trusts only the local filesystem under the project',
+        '  `rotate` keeps the last 90 days by default; --keep-last accepts days or a',
+        '  positive count. Rotating everything requires --all. Malformed lines stay',
+        '  inline unless --all is used. Archives are private .jsonl files beneath',
+        '  archive/decision/ in the resolved artifact root; --to must stay there.',
+        '  `history`/`stats` optionally read archives with --include-archives, offline.',
+        '  Appenders, rotation and readers share one cross-process lock.',
+        '  The ledger trusts only the local filesystem under the project',
         '  artifact root, owned by the same user running aiwg — it is not a defense',
         '  against a hostile process already running as that user.',
     ].join('\n');
@@ -207,7 +212,7 @@ function parseGroupBy(value) {
     return value;
 }
 const HISTORY_VALUE_FLAGS = ['--since', '--provider', '--session', '--kind', '--status', '--caller'];
-const HISTORY_BOOL_FLAGS = ['--json', '--no-caller'];
+const HISTORY_BOOL_FLAGS = ['--json', '--no-caller', '--include-archives'];
 const STATS_VALUE_FLAGS = [...HISTORY_VALUE_FLAGS, '--group-by'];
 const STATS_BOOL_FLAGS = HISTORY_BOOL_FLAGS;
 /**
@@ -269,6 +274,7 @@ function parseLedgerFilters(args) {
         kind: parseKindFilter(takeOption(args, '--kind')),
         status: parseStatusFilter(takeOption(args, '--status')),
         ...parseCallerFilter(args),
+        ...(args.includes('--include-archives') ? { includeArchives: true } : {}),
     };
 }
 /** One header line stating the caller filter, shown only when one is set. */
@@ -323,6 +329,23 @@ async function decisionStats(ctx) {
     ]);
     return { exitCode: 0, message: [...header, ...lines].join('\n'), rawOutput: true };
 }
+async function decisionRotate(ctx) {
+    const args = ctx.args.slice(1);
+    assertLedgerArgs(args, ['--keep-last', '--to'], ['--all', '--json']);
+    const keepLast = args.includes('--keep-last') ? takeRequiredOption(args, '--keep-last') : undefined;
+    const all = args.includes('--all');
+    try {
+        parseDecisionLedgerRetention(keepLast, all);
+    }
+    catch (error) {
+        throw new DecisionAskUsageError('invalid-retention', error instanceof Error ? error.message : String(error));
+    }
+    const result = await rotateDecisionLedger({ projectRoot: ctx.cwd, keepLast, all,
+        to: args.includes('--to') ? takeRequiredOption(args, '--to') : undefined });
+    if (args.includes('--json'))
+        return jsonResult(result);
+    return { exitCode: 0, rawOutput: true, message: `Archived ${result.archived} line(s)${result.archivePath ? ` to ${result.archivePath}` : ''}; retained ${result.retained} line(s) inline (${result.malformed} malformed).` };
+}
 async function executeDecision(ctx) {
     const [command, subcommand, ...rest] = ctx.args;
     const options = { cwd: ctx.cwd, frameworkRoot: ctx.frameworkRoot, env: process.env };
@@ -335,6 +358,8 @@ async function executeDecision(ctx) {
             return await decisionAsk(ctx);
         if (command === 'history')
             return await decisionHistory(ctx);
+        if (command === 'rotate')
+            return await decisionRotate(ctx);
         if (command === 'pricing') {
             const args = ctx.args.slice(1);
             assertLedgerArgs(args, ['--model'], ['--refresh', '--dry-run', '--offline', '--allow-snapshot', '--json']);

package/dist/src/cli/handlers/diagnose.js

@@ -40,9 +40,22 @@ export const diagnoseHandler = {
     description: 'Produce a shareable support bundle (logs + env + config) for bug reports',
     category: 'maintenance',
     aliases: [],
+    async help() {
+        return { exitCode: 0, message: [
+                'Usage: aiwg diagnose [--stdout] [--include-secrets]',
+                '',
+                '--stdout          Print the bundle as JSON instead of writing a tarball.',
+                '--include-secrets Disable sanitization. Output contains secrets; review it before sharing.',
+            ].join('\n') };
+    },
     async execute(ctx) {
+        if (ctx.args.includes('--help') || ctx.args.includes('-h'))
+            return diagnoseHandler.help(ctx);
         const stdoutMode = ctx.args.includes('--stdout');
         const includeSecrets = ctx.args.includes('--include-secrets');
+        if (includeSecrets) {
+            process.stderr.write('Warning: --include-secrets output contains secrets. Review it before sharing.\n');
+        }
         const cwd = getProjectDir(ctx, ctx.args);
         const log = getLogger('cli:diagnose');
         const span = log.span('diagnose', { stdoutMode, includeSecrets });

package/dist/src/cli/handlers/local-executor.js

@@ -21,9 +21,22 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
 import { createHash, randomUUID } from 'crypto';
 import { pathToFileURL } from 'node:url';
 import { projectAiwgPath } from '../../config/project-artifacts.js';
+import { resolveSensitiveInput, sensitiveInputOptions } from '../../auth/sensitive-input.js';
 const DEFAULT_PORT = 8200;
 const DEFAULT_BIND = '127.0.0.1';
 const DEFAULT_AIWG_SERVE = 'http://127.0.0.1:7337';
+/** Optional input: no source keeps registration/cache behavior, even at a terminal. */
+export async function resolveLocalExecutorToken(args, dependencies = {}) {
+    const source = sensitiveInputOptions(args, 'token');
+    const environment = dependencies.environment ?? process.env;
+    const explicit = source.interactive || source.stdin || source.file !== undefined || source.store !== undefined || source.env !== undefined;
+    if (!explicit) {
+        if (!environment.AIWG_EXECUTOR_TOKEN)
+            return undefined;
+        source.env = 'AIWG_EXECUTOR_TOKEN';
+    }
+    return resolveSensitiveInput(source, { ...dependencies, environment });
+}
 /**
  * Resolve or generate-once the executor identity.
  * Written to `.aiwg/local-executor/identity.json` so restarts reuse the same
@@ -122,6 +135,14 @@ export const localExecutorServeHandler = {
         // The subcommand is: `aiwg local-executor serve [flags]`
         // ctx.args[0] === 'serve' (consumed by router) or flags directly
         const flagArgs = ctx.args[0] === 'serve' ? ctx.args.slice(1) : ctx.args;
+        let preexistingToken;
+        try {
+            preexistingToken = await resolveLocalExecutorToken(flagArgs);
+        }
+        catch (error) {
+            return { exitCode: 1, message: error.message };
+        }
+        const redact = (message) => preexistingToken ? message.split(preexistingToken).join('[REDACTED]') : message;
         const opts = parseLocalExecutorArgs(flagArgs);
         warnIfNonLoopback(opts.bind);
         // ── Dynamic imports (same pattern as serve.ts) ──────────────────────────
@@ -138,7 +159,7 @@ export const localExecutorServeHandler = {
         }
         catch (err) {
             return {
-                message: `Failed to load executor-shim: ${err.message}`,
+                message: `Failed to load executor-shim: ${redact(err.message)}`,
                 exitCode: 1,
             };
         }
@@ -148,7 +169,7 @@ export const localExecutorServeHandler = {
         }
         catch (err) {
             return {
-                message: `Failed to load DaemonSupervisor: ${err.message}`,
+                message: `Failed to load DaemonSupervisor: ${redact(err.message)}`,
                 exitCode: 1,
             };
         }
@@ -208,7 +229,7 @@ export const localExecutorServeHandler = {
             restBase,
             wsBase,
             aiwgServeUrl: opts.aiwgServe,
-            token: process.env['AIWG_EXECUTOR_TOKEN'],
+            token: preexistingToken,
             tokenPath: projectAiwgPath(process.cwd(), 'local-executor', 'tokens', `${createHash('sha256').update(`${opts.aiwgServe}\0${opts.executorId}`).digest('hex')}.json`),
         });
         // Register with aiwg-serve
@@ -218,7 +239,7 @@ export const localExecutorServeHandler = {
         }
         catch (err) {
             return {
-                message: `Failed to register with aiwg-serve at ${opts.aiwgServe}: ${err.message}\n` +
+                message: `Failed to register with aiwg-serve at ${opts.aiwgServe}: ${redact(err.message)}\n` +
                     'Is aiwg serve running? Start it with: aiwg serve --no-open',
                 exitCode: 1,
             };
@@ -235,7 +256,7 @@ export const localExecutorServeHandler = {
         catch (err) {
             await shim.deregister();
             return {
-                message: `Failed to start executor server: ${err.message}`,
+                message: `Failed to start executor server: ${redact(err.message).split(token).join('[REDACTED]')}`,
                 exitCode: 1,
             };
         }
@@ -304,9 +325,15 @@ export const localExecutorHandler = {
                 '  --aiwg-serve <url>      Registration target (default: http://127.0.0.1:7337)\n' +
                 '  --max-concurrency <n>   Max concurrent missions (default: 4)\n' +
                 '  --executor-id <uuid>    Override stable executor ID\n' +
+                '  --token-interactive     Read optional existing bearer without echo\n' +
+                '  --token-stdin           Read optional existing bearer from stdin\n' +
+                '  --token-file <path>     Read optional existing bearer from a private file\n' +
+                '  --token-store <name>    Read optional existing bearer from the OS store\n' +
+                '  --token-env <NAME>      Read optional existing bearer from a named variable\n' +
                 '\n' +
                 'Environment:\n' +
-                '  AIWG_SERVE_ENDPOINT     Override --aiwg-serve default\n');
+                '  AIWG_SERVE_ENDPOINT     Override --aiwg-serve default\n' +
+                '  AIWG_EXECUTOR_TOKEN     Optional preexisting executor bearer\n');
             return { exitCode: 0 };
         }
         return {

package/dist/src/cli/handlers/resource-versions.js

@@ -3,13 +3,14 @@ import { loadResourceTrustRootFile, readVerifiedRegularFile, resolveWebRelease,
 import { getProjectDir } from "../../config/aiwg-config.js";
 import { cleanWebResourceCache } from "../../resources/cache-cleanup.js";
 import { writeWebResourceLock } from "../../resources/lockfile.js";
-import { createResourceCredentialProvider } from "../../auth/resource-credentials.js";
+import { createResourceCredentialProvider, prepareResourceCredentials } from "../../auth/resource-credentials.js";
 const MAX_RESOURCE_MANIFEST_BYTES = 4 * 1024 * 1024;
 const DEFAULT_CHANNELS = ["stable", "latest", "canary", "main"];
 function usage() {
     return [
         "Usage: aiwg versions <list|resolve|show|clean-cache> [selector] [--json] [--pretty] [--offline]",
         "",
+        "Protected releases: --resource-token-stdin, --resource-token-file <path>, --resource-token-store <name>, --resource-token-env <NAME>, --resource-token-interactive",
         "Examples:",
         "  aiwg versions list --json",
         "  aiwg versions resolve stable --json",
@@ -75,7 +76,7 @@ function parseArgs(args) {
         channels,
     };
 }
-function webReleaseOptionsFromEnvironment() {
+function webReleaseOptionsFromEnvironment(credentialProvider = createResourceCredentialProvider(process.env)) {
     const baseUrl = process.env.AIWG_RESOURCE_BASE_URL;
     const cacheRoot = process.env.AIWG_RESOURCE_CACHE_ROOT;
     const trustRootFile = process.env.AIWG_RESOURCE_TRUST_ROOT_FILE;
@@ -83,7 +84,7 @@ function webReleaseOptionsFromEnvironment() {
         ? undefined
         : loadResourceTrustRootFile(path.resolve(trustRootFile));
     return {
-        credentialProvider: createResourceCredentialProvider(process.env),
+        credentialProvider,
         ...(baseUrl === undefined ? {} : { baseUrl }),
         ...(cacheRoot === undefined ? {} : { cacheRoot }),
         ...(publicKeyPem === undefined ? {} : { publicKeyPem }),
@@ -168,14 +169,16 @@ export const versionsHandler = {
             return { exitCode: 0 };
         }
         let parsed;
+        let credentials;
         try {
-            parsed = parseArgs(ctx.args);
+            credentials = await prepareResourceCredentials(ctx.args);
+            parsed = parseArgs(credentials.args);
         }
         catch (error) {
             return { exitCode: 2, message: error instanceof Error ? error.message : String(error) };
         }
         try {
-            const baseOptions = webReleaseOptionsFromEnvironment();
+            const baseOptions = webReleaseOptionsFromEnvironment(credentials.credentialProvider);
             if (parsed.subcommand === "clean-cache") {
                 const result = cleanWebResourceCache(getProjectDir(ctx, ctx.args), {
                     cacheRoot: process.env.AIWG_RESOURCE_CACHE_ROOT,

package/dist/src/cli/handlers/script-runner.js

@@ -57,10 +57,13 @@ export class DefaultScriptRunner {
             const stdio = options.capture
                 ? ['pipe', options.stdoutFd ?? 'pipe', 'pipe']
                 : 'inherit';
+            const environment = { ...process.env, ...options.env };
+            for (const name of options.omitEnv ?? [])
+                delete environment[name];
             const child = spawn('node', [fullPath, ...args], {
                 stdio,
                 cwd: options.cwd || process.cwd(),
-                env: { ...process.env, ...options.env },
+                env: environment,
             });
             // Always drain captured pipes, even after the diagnostic cap is reached.
             // stdout is not part of HandlerResult; discard it. Retain only the first
@@ -146,10 +149,13 @@ export class DefaultScriptRunner {
     async runDeployment(fullPath, args, options) {
         const previousConsole = globalThis.console;
         const previousRoot = process.env.AIWG_ROOT;
+        const omitted = new Map((options.omitEnv ?? []).map(name => [name, process.env[name]]));
         const stderrLimit = 1024 * 1024;
         const diagnostics = [];
         let diagnosticBytes = 0;
         try {
+            for (const name of omitted.keys())
+                delete process.env[name];
             if (options.env?.AIWG_ROOT !== undefined)
                 process.env.AIWG_ROOT = options.env.AIWG_ROOT;
             if (options.capture) {
@@ -187,6 +193,12 @@ export class DefaultScriptRunner {
         }
         finally {
             globalThis.console = previousConsole;
+            for (const [name, value] of omitted) {
+                if (value === undefined)
+                    delete process.env[name];
+                else
+                    process.env[name] = value;
+            }
             if (previousRoot === undefined)
                 delete process.env.AIWG_ROOT;
             else

package/dist/src/cli/handlers/use.js

@@ -65,7 +65,7 @@ import { verifyModelWrapperDeployment } from '../../models/wrapper-deployment.js
 import { aggregateUseDeploymentResult, buildDryRunUseResult, renderUseDeploymentResult, verifyProviderDeployment, } from '../services/deployment-verification.js';
 import { finalizeProviderTransformationReceipt, providerReceiptHasLocalSources, sourceVerificationsFromSignedWebRelease, } from '../../providers/transformation-receipt-integration.js';
 import { loadResourceTrustRootFile, resolveWebRelease, } from '../../resources/web-release.js';
-import { createResourceCredentialProvider } from '../../auth/resource-credentials.js';
+import { createResourceCredentialProvider, prepareResourceCredentials } from '../../auth/resource-credentials.js';
 /**
  * Valid framework identifiers
  */
@@ -102,7 +102,7 @@ export async function resolveProviderReceiptSource(options) {
         release = await resolveWebRelease({ ...releaseOptions, selector: versionInfo.version, offline: true });
     }
     catch {
-        const credentialProvider = createResourceCredentialProvider(process.env);
+        const credentialProvider = options.credentialProvider ?? createResourceCredentialProvider(process.env);
         const token = await credentialProvider();
         // Protected production resources require the authenticated release
         // credential. A configured alternate endpoint may intentionally be public.
@@ -1697,6 +1697,7 @@ function createUseScriptRunner(frameworkRoot) {
     const runner = createScriptRunner(frameworkRoot);
     return {
         async run(script, args, options = {}) {
+            options = { ...options, omitEnv: useDeployment?.resourceCredentials?.omitEnv ?? ['AIWG_RESOURCE_TOKEN'] };
             if (script === 'tools/agents/deploy-agents.mjs')
                 args = useDeploymentArgs(args);
             if (!usePreviewActions)
@@ -2472,6 +2473,9 @@ Bundles:
   <addon> | <extension>     Any installed addon or extension name
 
 Options:
+  --resource-token-stdin | --resource-token-file <path> | --resource-token-store <name>
+  --resource-token-env <NAME> | --resource-token-interactive
+                            Select the optional protected release bearer
   --provider <name>         Target provider (default: .aiwg/aiwg.config providers)
   --target <dir>            Deploy into <dir> instead of the current directory
   --scope project|user      Deploy to the project (default) or the user scope
@@ -2543,11 +2547,22 @@ export class UseHandler {
         return { exitCode: 0, message: USE_HELP, rawOutput: true };
     }
     async execute(ctx) {
+        let resourceCredentials = useDeployment?.resourceCredentials;
+        try {
+            if (!resourceCredentials) {
+                resourceCredentials = await prepareResourceCredentials(ctx.args);
+                ctx = { ...ctx, args: resourceCredentials.args };
+            }
+        }
+        catch (error) {
+            return { exitCode: 2, message: error instanceof Error ? error.message : String(error) };
+        }
         const invalidOption = validateUseOptions(ctx.args, this.preparedProviderContinuations);
         if (invalidOption)
             return { exitCode: 2, message: invalidOption };
         const previousDeployment = useDeployment;
         useDeployment = {
+            resourceCredentials,
             version: previousDeployment?.version ?? resolveDeployVersion(ctx.frameworkRoot || await getFrameworkRoot()),
             skipContextFiles: previousDeployment?.skipContextFiles || ctx.args.includes('--no-context-files'),
             contextFiles: previousDeployment?.contextFiles ?? [],
@@ -2730,7 +2745,7 @@ export class UseHandler {
                             scope: effectiveScope,
                             requestedBundles: [requestedBundle],
                         };
-                        const sourceResolution = await resolveProviderReceiptSource(receiptOptions);
+                        const sourceResolution = await resolveProviderReceiptSource({ ...receiptOptions, credentialProvider: useDeployment?.resourceCredentials?.credentialProvider });
                         await finalizeProviderTransformationReceipt({ ...receiptOptions, ...sourceResolution });
                     }
                     catch (error) {