@aiwg/cli 2026.10.8 → 2026.10.10

package/dist/src/storage/backends/logseq.js

@@ -32,20 +32,26 @@
  * @issue #958
  */
 import { existsSync } from 'fs';
+import { resolveSensitiveInput } from '../../auth/sensitive-input.js';
+import { credentialReferenceInput } from '../../mcp/credentials.mjs';
 import { mkdir, readFile, readdir, rm, stat, writeFile } from 'fs/promises';
 import { dirname, join, relative, resolve, sep } from 'path';
 const LOGSEQ_CONFIG_DIR = 'logseq';
 const DEFAULT_API_URL = 'http://127.0.0.1:12315/api';
 export class LogseqAdapter {
+    sensitiveInput;
     /** Absolute path to the Logseq graph root. */
     graph;
     apiUrl;
     useApi;
+    apiTokenEnv;
     apiWarned = false;
-    constructor(config) {
+    constructor(config, sensitiveInput = {}) {
+        this.sensitiveInput = sensitiveInput;
         this.graph = resolve(expandHome(config.graph));
         this.apiUrl = config.apiUrl ?? DEFAULT_API_URL;
         this.useApi = config.useApi ?? true;
+        this.apiTokenEnv = config.apiTokenEnv;
     }
     async init() {
         if (!existsSync(this.graph)) {
@@ -61,7 +67,14 @@ export class LogseqAdapter {
     async probeApi() {
         if (this.apiWarned)
             return;
-        const token = process.env['LOGSEQ_API_TOKEN'];
+        const input = credentialReferenceInput(this.apiTokenEnv ?? 'LOGSEQ_API_TOKEN', 'Logseq apiTokenEnv');
+        // Keep the optional legacy environment path, including its missing-token warning.
+        const token = input.env
+            ? (this.sensitiveInput.environment ?? process.env)[input.env]
+            : await resolveSensitiveInput(input, this.sensitiveInput);
+        if (!token && this.apiTokenEnv !== undefined) {
+            throw new Error('storage(logseq): apiTokenEnv is not set; use ENV_NAME, file:ABSOLUTE_PATH or store:NAME.');
+        }
         if (!token) {
             this.apiWarned = true;
             process.stderr.write(`storage(logseq): API requested (useApi: true) but LOGSEQ_API_TOKEN is not set.\n` +
@@ -89,7 +102,7 @@ export class LogseqAdapter {
         }
         catch {
             this.apiWarned = true;
-            process.stderr.write(`storage(logseq): API server at ${this.apiUrl} is not reachable.\n` +
+            process.stderr.write(`storage(logseq): API server is not reachable.\n` +
                 `  AIWG will continue with direct file writes against the graph.\n` +
                 `  Start Logseq with the API server enabled, or set "useApi": false to suppress.\n`);
         }

package/dist/src/storage/backends/postgres.js

@@ -1,3 +1,5 @@
+import { resolveSensitiveInput } from '../../auth/sensitive-input.js';
+import { credentialReferenceInput } from '../../mcp/credentials.mjs';
 import { createHash } from 'node:crypto';
 import { loadFeaturePackage } from '../../features/runtime.js';
 import { STORAGE_BACKEND_CONTRACT, } from '../backend-contract.js';
@@ -27,6 +29,7 @@ export class PostgresBackendError extends Error {
  */
 export class PostgresStorageBackend {
     options;
+    sensitiveInput;
     descriptor = {
         contract: STORAGE_BACKEND_CONTRACT,
         backend: 'postgres-direct',
@@ -50,8 +53,9 @@ export class PostgresStorageBackend {
     statementTimeoutMs;
     lockTimeoutMs;
     idleTransactionTimeoutMs;
-    constructor(options) {
+    constructor(options, sensitiveInput = {}) {
         this.options = options;
+        this.sensitiveInput = sensitiveInput;
         validateIdentity(options.tenant, 'tenant');
         validateIdentity(options.subsystem, 'subsystem');
         this.pool = options.pool;
@@ -69,7 +73,7 @@ export class PostgresStorageBackend {
     }
     async init() {
         if (!this.pool)
-            this.pool = await createPool(this.options);
+            this.pool = await createPool(this.options, this.sensitiveInput);
         if (this.options.schemaMode !== 'migrate') {
             const schema = await this.runQuery('SELECT schema_version FROM aiwg_storage_schema WHERE singleton = true');
             if (Number(schema.rows[0]?.schema_version) !== 1) {
@@ -187,7 +191,7 @@ export class PostgresStorageBackend {
     }
     /** Hold an exported PostgreSQL snapshot open while parallel consumers page it. */
     async openSnapshotLease() {
-        const exporter = await this.requiredPool().connect();
+        const exporter = await this.connect();
         let closed = false;
         try {
             await exporter.query('BEGIN ISOLATION LEVEL REPEATABLE READ READ ONLY');
@@ -208,8 +212,11 @@ export class PostgresStorageBackend {
                     try {
                         await exporter.query('COMMIT');
                     }
+                    catch (error) {
+                        throw classifyPostgresError(error);
+                    }
                     finally {
-                        exporter.release(false);
+                        releaseClient(exporter, false);
                     }
                 },
             };
@@ -219,7 +226,7 @@ export class PostgresStorageBackend {
                 await exporter.query('ROLLBACK');
             }
             catch { /* preserve original error */ }
-            exporter.release(true);
+            releaseClient(exporter, true);
             throw classifyPostgresError(error);
         }
     }
@@ -228,7 +235,7 @@ export class PostgresStorageBackend {
             throw new PostgresBackendError('AIWG_POSTGRES_SNAPSHOT_INVALID', 'exported snapshot identifier is malformed');
         }
         const boundedLimit = bounded(limit, 1000, 1, 10_000, 'limit');
-        const client = await this.requiredPool().connect();
+        const client = await this.connect();
         let failed = false;
         try {
             await client.query('BEGIN ISOLATION LEVEL REPEATABLE READ READ ONLY');
@@ -252,7 +259,7 @@ export class PostgresStorageBackend {
             throw classifyPostgresError(error);
         }
         finally {
-            client.release(failed);
+            releaseClient(client, failed);
         }
     }
     async changes(cursor) {
@@ -322,12 +329,17 @@ export class PostgresStorageBackend {
         });
     }
     async close() {
-        if (this.ownsPool && this.pool)
-            await this.pool.end();
+        try {
+            if (this.ownsPool && this.pool)
+                await this.pool.end();
+        }
+        catch (error) {
+            throw classifyPostgresError(error);
+        }
         this.pool = undefined;
     }
     async withTransaction(operation, isolation = 'SERIALIZABLE') {
-        const client = await this.requiredPool().connect();
+        const client = await this.connect();
         let failed = false;
         try {
             await client.query(`BEGIN ISOLATION LEVEL ${isolation}`);
@@ -347,7 +359,7 @@ export class PostgresStorageBackend {
             throw classifyPostgresError(error);
         }
         finally {
-            client.release(failed);
+            releaseClient(client, failed);
         }
     }
     assertMutationIdentity(mutation) {
@@ -356,6 +368,14 @@ export class PostgresStorageBackend {
             throw new PostgresBackendError('AIWG_POSTGRES_IDENTITY_MISMATCH', 'mutation identity is outside this backend tenant/subsystem');
         }
     }
+    async connect() {
+        try {
+            return await this.requiredPool().connect();
+        }
+        catch (error) {
+            throw classifyPostgresError(error);
+        }
+    }
     requiredPool() {
         if (!this.pool)
             throw new PostgresBackendError('AIWG_POSTGRES_NOT_INITIALIZED', 'call init() before using the PostgreSQL backend');
@@ -370,11 +390,18 @@ export class PostgresStorageBackend {
         }
     }
 }
-async function createPool(options) {
+async function createPool(options, sensitiveInput) {
     const envName = options.connectionStringEnv ?? 'AIWG_POSTGRES_URL';
-    const connectionString = process.env[envName];
+    const input = credentialReferenceInput(envName, 'PostgreSQL connectionStringEnv');
+    let connectionString;
+    try {
+        connectionString = input.env ? (sensitiveInput.environment ?? process.env)[input.env] : await resolveSensitiveInput(input, sensitiveInput);
+    }
+    catch (error) {
+        throw new PostgresBackendError('AIWG_POSTGRES_CREDENTIAL_UNAVAILABLE', error.message);
+    }
     if (!connectionString) {
-        throw new PostgresBackendError('AIWG_POSTGRES_CREDENTIAL_UNAVAILABLE', `PostgreSQL connection locator ${envName} is not set`);
+        throw new PostgresBackendError('AIWG_POSTGRES_CREDENTIAL_UNAVAILABLE', 'PostgreSQL connectionStringEnv is not set; use ENV_NAME (default AIWG_POSTGRES_URL), file:ABSOLUTE_PATH or store:NAME.');
     }
     if (options.ssl === undefined) {
         throw new PostgresBackendError('AIWG_POSTGRES_TLS_REQUIRED', 'PostgreSQL remote connections require explicit ssl=require or ssl=verify-full');
@@ -382,24 +409,29 @@ async function createPool(options) {
     if (options.ssl === 'disable' && !isLoopbackPostgresUrl(connectionString)) {
         throw new PostgresBackendError('AIWG_POSTGRES_TLS_REQUIRED', 'ssl=disable is limited to explicit loopback development endpoints');
     }
-    const pg = await loadFeaturePackage('pg');
-    const defaultExport = pg.default;
-    const Pool = (pg.Pool ?? defaultExport?.Pool);
-    if (!Pool)
-        throw new PostgresBackendError('AIWG_POSTGRES_DRIVER_INVALID', 'optional pg package does not export Pool');
-    const pool = new Pool({
-        connectionString,
-        max: bounded(options.maxConnections, DEFAULT_POOL_MAX, 1, 100, 'maxConnections'),
-        connectionTimeoutMillis: bounded(options.connectionTimeoutMs, DEFAULT_TIMEOUT_MS, 1, 600_000, 'connectionTimeoutMs'),
-        statement_timeout: bounded(options.statementTimeoutMs, DEFAULT_TIMEOUT_MS, 1, 600_000, 'statementTimeoutMs'),
-        application_name: options.applicationName ?? 'aiwg',
-        ssl: options.ssl === 'disable' ? false : { rejectUnauthorized: options.ssl === 'verify-full' },
-    });
-    // pg emits idle-client failures at pool scope. Registering a listener keeps
-    // server restarts from becoming uncaught process exceptions; failed clients
-    // are evicted by pg and the next backend operation reconnects normally.
-    pool.on?.('error', () => undefined);
-    return pool;
+    try {
+        const pg = await loadFeaturePackage('pg');
+        const defaultExport = pg.default;
+        const Pool = (pg.Pool ?? defaultExport?.Pool);
+        if (!Pool)
+            throw new PostgresBackendError('AIWG_POSTGRES_DRIVER_INVALID', 'optional pg package does not export Pool');
+        const pool = new Pool({
+            connectionString,
+            max: bounded(options.maxConnections, DEFAULT_POOL_MAX, 1, 100, 'maxConnections'),
+            connectionTimeoutMillis: bounded(options.connectionTimeoutMs, DEFAULT_TIMEOUT_MS, 1, 600_000, 'connectionTimeoutMs'),
+            statement_timeout: bounded(options.statementTimeoutMs, DEFAULT_TIMEOUT_MS, 1, 600_000, 'statementTimeoutMs'),
+            application_name: options.applicationName ?? 'aiwg',
+            ssl: options.ssl === 'disable' ? false : { rejectUnauthorized: options.ssl === 'verify-full' },
+        });
+        // pg emits idle-client failures at pool scope. Registering a listener keeps
+        // server restarts from becoming uncaught process exceptions; failed clients
+        // are evicted by pg and the next backend operation reconnects normally.
+        pool.on?.('error', () => undefined);
+        return pool;
+    }
+    catch (error) {
+        throw classifyPostgresError(error);
+    }
 }
 function isLoopbackPostgresUrl(connectionString) {
     try {
@@ -468,6 +500,15 @@ function classifyPostgresError(error) {
     if (['40001', '40P01', '55P03', '57014', '57P01', '57P02', '57P03', '08000', '08003', '08006', '08001'].includes(code)) {
         return new PostgresBackendError('AIWG_POSTGRES_RETRYABLE', `retryable PostgreSQL failure (${code})`, true);
     }
-    return error instanceof Error ? error : new Error(String(error));
+    // Drivers may echo the entire connection string, passwords or server detail.
+    return new PostgresBackendError('AIWG_POSTGRES_OPERATION_FAILED', 'PostgreSQL operation failed; check connectivity, credentials and server configuration.');
+}
+function releaseClient(client, failed) {
+    try {
+        client.release(failed);
+    }
+    catch (error) {
+        throw classifyPostgresError(error);
+    }
 }
 //# sourceMappingURL=postgres.js.map

package/dist/src/storage/backends/postgrest.js

@@ -1,3 +1,5 @@
+import { resolveSensitiveInput } from '../../auth/sensitive-input.js';
+import { credentialReferenceInput } from '../../mcp/credentials.mjs';
 import { STORAGE_BACKEND_CONTRACT } from '../backend-contract.js';
 import { postgresBatchId, postgresPayloadDigest } from './postgres.js';
 const DEFAULT_TIMEOUT_MS = 15_000;
@@ -18,6 +20,7 @@ export class PostgrestBackendError extends Error {
 /** PostgreSQL accessMode=postgrest; not a separate storage engine. */
 export class PostgrestStorageBackend {
     options;
+    sensitiveInput;
     descriptor = {
         contract: STORAGE_BACKEND_CONTRACT,
         backend: 'postgres-postgrest',
@@ -42,8 +45,9 @@ export class PostgrestStorageBackend {
     maxResponseBytes;
     maxBatchSize;
     maxPageSize;
-    constructor(options) {
+    constructor(options, sensitiveInput = {}) {
         this.options = options;
+        this.sensitiveInput = sensitiveInput;
         this.baseUrl = normalizeBaseUrl(options.baseUrl);
         this.fetchImpl = options.fetch ?? globalThis.fetch;
         if (!this.fetchImpl)
@@ -185,7 +189,7 @@ export class PostgrestStorageBackend {
             headers['Content-Type'] = options.contentType ?? 'application/json';
         if (options.prefer)
             headers.Prefer = options.prefer;
-        const authorization = this.authorization();
+        const authorization = await this.authorization();
         if (authorization)
             headers.Authorization = authorization;
         let response;
@@ -195,8 +199,8 @@ export class PostgrestStorageBackend {
                 signal: AbortSignal.timeout(this.timeoutMs),
             });
         }
-        catch (error) {
-            throw new PostgrestBackendError('AIWG_POSTGREST_TRANSPORT_FAILED', error instanceof Error ? error.message : String(error), true);
+        catch {
+            throw new PostgrestBackendError('AIWG_POSTGREST_TRANSPORT_FAILED', 'PostgREST transport failed; check connectivity and authorization.', true);
         }
         if (response.status === 204)
             return undefined;
@@ -204,15 +208,23 @@ export class PostgrestStorageBackend {
         if (declaredLength > this.maxResponseBytes) {
             throw new PostgrestBackendError('AIWG_POSTGREST_RESPONSE_TOO_LARGE', `response exceeds ${this.maxResponseBytes} byte ceiling`);
         }
-        const responseBody = await response.text();
+        let responseBody;
+        try {
+            responseBody = await response.text();
+        }
+        catch {
+            throw new PostgrestBackendError('AIWG_POSTGREST_TRANSPORT_FAILED', 'PostgREST response could not be read.', true);
+        }
         if (Buffer.byteLength(responseBody) > this.maxResponseBytes) {
             throw new PostgrestBackendError('AIWG_POSTGREST_RESPONSE_TOO_LARGE', `response exceeds ${this.maxResponseBytes} byte ceiling`);
         }
         if (!response.ok) {
-            const databaseError = parseDatabaseError(responseBody);
+            const secrets = authorization
+                ? [authorization, authorization.trim(), authorization.trim().replace(/^\S+\s+/, '')].filter(Boolean) : [];
+            const databaseError = parseDatabaseError(responseBody, secrets);
             const retryable = response.status === 408 || response.status === 425 || response.status === 429 ||
                 response.status >= 500 || isRetryableDatabaseCode(databaseError.databaseCode);
-            const exposedCode = databaseError.message?.startsWith('AIWG_')
+            const exposedCode = /^AIWG_[A-Z0-9_]+$/.test(databaseError.message ?? '')
                 ? databaseError.message
                 : retryable ? 'AIWG_POSTGREST_RETRYABLE' : 'AIWG_POSTGREST_REQUEST_FAILED';
             throw new PostgrestBackendError(exposedCode, `PostgREST request failed with HTTP ${response.status}${databaseError.databaseCode ? ` (database ${databaseError.databaseCode})` : ''}`, retryable, parseRetryAfter(response.headers.get('retry-after')));
@@ -224,12 +236,19 @@ export class PostgrestStorageBackend {
             throw new PostgrestBackendError('AIWG_POSTGREST_RESPONSE_INVALID', 'PostgREST returned invalid JSON');
         }
     }
-    authorization() {
+    async authorization() {
         if (!this.options.authorizationEnv)
             return undefined;
-        const value = process.env[this.options.authorizationEnv];
+        const input = credentialReferenceInput(this.options.authorizationEnv, 'PostgREST authorizationEnv');
+        let value;
+        try {
+            value = input.env ? (this.sensitiveInput.environment ?? process.env)[input.env] : await resolveSensitiveInput(input, this.sensitiveInput);
+        }
+        catch (error) {
+            throw new PostgrestBackendError('AIWG_POSTGREST_CREDENTIAL_UNAVAILABLE', error.message);
+        }
         if (!value)
-            throw new PostgrestBackendError('AIWG_POSTGREST_CREDENTIAL_UNAVAILABLE', `authorization locator ${this.options.authorizationEnv} is not set`);
+            throw new PostgrestBackendError('AIWG_POSTGREST_CREDENTIAL_UNAVAILABLE', 'PostgREST authorizationEnv is not set; use ENV_NAME, file:ABSOLUTE_PATH or store:NAME.');
         return value;
     }
     assertMutationIdentity(mutation) {
@@ -294,12 +313,17 @@ function parseCsv(input) {
     }
     return { header, rows: output };
 }
-function parseDatabaseError(body) {
+function parseDatabaseError(body, secrets) {
     try {
         const parsed = JSON.parse(body);
+        // Decode JSON escapes before redaction: encoded echoes must not become codes.
+        const redact = (value) => typeof value === 'string'
+            ? secrets.reduce((text, secret) => text.split(secret).join('[REDACTED]'), value) : undefined;
+        const databaseCode = redact(parsed.code);
+        const message = redact(parsed.message);
         return {
-            ...(typeof parsed.code === 'string' ? { databaseCode: parsed.code } : {}),
-            ...(typeof parsed.message === 'string' ? { message: parsed.message } : {}),
+            ...(databaseCode && /^[A-Z0-9]{5}$/.test(databaseCode) ? { databaseCode } : {}),
+            ...(message ? { message } : {}),
         };
     }
     catch {

package/dist/src/storage/config.js

@@ -14,6 +14,7 @@
  * @issue #953
  */
 import { existsSync } from 'fs';
+import { credentialReferenceInput } from '../mcp/credentials.mjs';
 import { readFile } from 'fs/promises';
 import { resolve, isAbsolute, join } from 'path';
 import { homedir } from 'os';
@@ -171,8 +172,12 @@ function validateBackendConfig(raw, source) {
             requireString(obj, 'vault', source);
             return obj;
         case 'logseq':
-            rejectUnknownKeys(obj, ['type', 'graph', 'apiUrl', 'useApi'], source, 'backend');
+            rejectUnknownKeys(obj, ['type', 'graph', 'apiUrl', 'apiTokenEnv', 'useApi'], source, 'backend');
             requireString(obj, 'graph', source);
+            if (obj['apiTokenEnv'] !== undefined) {
+                requireString(obj, 'apiTokenEnv', source);
+                credentialReferenceInput(obj['apiTokenEnv'], 'Logseq apiTokenEnv');
+            }
             return obj;
         case 'notion': {
             rejectUnknownKeys(obj, ['type', 'parent', 'externalIdProperty'], source, 'backend');

package/dist/src/uhp/config.js

@@ -100,6 +100,10 @@ export function validateUhpConfig(config) {
         if (!profile.credential || profile.credential.source !== 'env' || !/^[A-Z_][A-Z0-9_]*$/.test(profile.credential.name ?? '')) {
             errors.push(`${where}.credential: must be an env secret reference with an uppercase variable name`);
         }
+        if (profile.credential && typeof profile.credential === 'object'
+            && Object.keys(profile.credential).some(key => key !== 'source' && key !== 'name')) {
+            errors.push(`${where}.credential: must contain only source and name; inline credentials are forbidden`);
+        }
         if (profile.defaultHarness !== undefined && !OBJECT_ID.test(profile.defaultHarness))
             errors.push(`${where}.defaultHarness: malformed UHP harness id`);
         if (profile.defaultModel !== undefined && !MODEL_ID.test(profile.defaultModel))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwg/cli",
-  "version": "2026.10.8",
+  "version": "2026.10.10",
   "description": "Lightweight AIWG CLI for signed, versioned web-backed resources.",
   "type": "module",
   "license": "MIT",
@@ -49,7 +49,11 @@
     "tools/ralph-external/session-launcher.mjs",
     "tools/ralph-external/process-monitor.mjs",
     "tools/ralph-external/lib/session-environment.mjs",
+    "tools/ralph-external/lib/worker-inputs.mjs",
+    "tools/ralph-external/lib/worker-final.mjs",
+    "tools/ralph-external/lib/worker-launch-cli.mjs",
     "tools/ralph-external/lib/worker-isolation.mjs",
+    "tools/ralph-external/lib/worker-native-sandbox.mjs",
     "tools/ralph-external/lib/systemd-client.mjs",
     "tools/ralph-external/lib/consecutive-failure-circuit-breaker.mjs",
     "tools/ralph-external/lib/launcher-recovery-evidence.mjs",
@@ -57,7 +61,11 @@
     "tools/ralph-external/lib/worker-overflow.mjs",
     "tools/scripts/resource-preflight.mjs",
     "tools/ralph-external/lib/provider-adapter.mjs",
+    "tools/ralph-external/lib/strict-worker-json.mjs",
+    "tools/ralph-external/lib/session-attempt.mjs",
+    "tools/ralph-external/lib/managed-worker-attempt.mjs",
     "tools/ralph-external/lib/worker-health.mjs",
+    "tools/ralph-external/lib/worker-artifacts.mjs",
     "tools/ralph-external/lib/claude-adapter.mjs",
     "tools/ralph-external/lib/codex-adapter.mjs",
     "tools/ralph-external/lib/opencode-adapter.mjs",

package/schemas/mission-v1.schema.json

@@ -1643,6 +1643,7 @@
       "type": "object",
       "additionalProperties": false,
       "properties": {
+        "invocationId": { "type": "string", "pattern": "^[a-z0-9][a-z0-9-]{0,51}(?![\\s\\S])" },
         "isolation": {
           "enum": ["systemd-unit", "native-sandbox"]
         },
@@ -1703,28 +1704,24 @@
           ]
         },
         "artifacts": {
-          "type": "array",
-          "maxItems": 16,
+          "type": "array", "maxItems": 16,
+          "contains": { "type": "object", "required": ["location"], "properties": { "location": { "const": "workspace-relative" } } },
+          "minContains": 0, "maxContains": 1,
           "items": {
-            "type": "object",
-            "additionalProperties": false,
+            "type": "object", "additionalProperties": false,
             "properties": {
-              "name": {
-                "type": "string",
-                "pattern": "^[A-Za-z0-9][A-Za-z0-9_-]{0,63}(?![\\s\\S])"
-              },
-              "content": {
-                "type": "string",
-                "maxLength": 1048576
-              },
-              "location": {
-                "const": "run-directory"
-              }
+              "name": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9_-]{0,63}(?![\\s\\S])" },
+              "content": { "type": "string", "maxLength": 1048576 },
+              "location": { "enum": ["run-directory", "workspace-relative"] },
+              "prefix": { "type": "string", "minLength": 1, "maxLength": 256 },
+              "relativePath": { "type": "string", "minLength": 1, "maxLength": 4096 }
             },
-            "required": [
-              "name",
-              "content"
-            ]
+            "required": ["name", "content"],
+            "allOf": [{
+              "if": { "required": ["location"], "properties": { "location": { "const": "workspace-relative" } } },
+              "then": { "required": ["prefix", "relativePath"] },
+              "else": { "not": { "anyOf": [{ "required": ["prefix"] }, { "required": ["relativePath"] }] } }
+            }]
           }
         },
         "briefPath": {
@@ -1871,6 +1868,10 @@
         "controlEvidence"
       ],
       "allOf": [
+        {
+          "if": { "required": ["artifacts"], "properties": { "artifacts": { "type": "array", "contains": { "type": "object", "required": ["location"], "properties": { "location": { "const": "workspace-relative" } } } } } },
+          "then": { "required": ["invocationId"], "properties": { "transport": { "const": "shell" } } }
+        },
         {
           "if": {
             "properties": {

package/schemas/models/model-config-compatibility.v1.schema.json

@@ -184,6 +184,13 @@
       "type": "object",
       "additionalProperties": false,
       "properties": {
+        "baseRole": {
+          "enum": [
+            "efficiency",
+            "coding",
+            "reasoning"
+          ]
+        },
         "groups": {
           "type": "array",
           "items": {
@@ -248,6 +255,15 @@
       "type": "object",
       "additionalProperties": false,
       "properties": {
+        "localOnlyPaths": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "pattern": "^(?!.*(?:^|/)\\.{1,2}(?:/|$))[A-Za-z0-9_.@+,-]+(?:/[A-Za-z0-9_.@+,-]+)*$(?![\\s\\S])"
+          },
+          "description": "Literal project-relative local-only files or directory subtrees; deployed conductor guards have limited shell coverage."
+        },
         "allowedProcessing": {
           "type": "array",
           "items": {

package/tools/agents/providers/claude-post-deploy.mjs

@@ -0,0 +1,35 @@
+// Apply project settings and context after provider file deployment.
+import fs from 'node:fs';
+import path from 'node:path';
+import { initializeFrameworkWorkspace, ensureDir } from './base.mjs';
+import { deployHookFile } from './claude.mjs';
+import { deployConductorDataGuard } from './conductor-data-guard.mjs';
+
+export async function postDeploy(targetDir, opts) {
+  initializeFrameworkWorkspace(targetDir, opts.mode, opts.dryRun, opts.srcRoot);
+  await deployConductorDataGuard(targetDir, 'claude', opts);
+
+  // Claude-specific post-deployment (settings.json, etc.)
+  const claudeDir = path.join(targetDir, '.claude');
+  const settingsPath = path.join(claudeDir, 'settings.json');
+
+  // If settings.json doesn't exist, create a minimal one
+  if (!fs.existsSync(settingsPath) && !opts.dryRun) {
+    ensureDir(claudeDir);
+    const settings = {
+      version: '1.0',
+      created: new Date().toISOString(),
+      aiwg: {
+        enabled: true,
+        mode: opts.mode || 'all'
+      }
+    };
+    fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2), 'utf8');
+    console.log('Created .claude/settings.json');
+  }
+
+  // Hook file architecture: write AIWG.md and wire @AIWG.md into CLAUDE.md
+  if (opts.srcRoot && opts.contextFiles !== false) {
+    deployHookFile(targetDir, opts);
+  }
+}

package/tools/agents/providers/claude.mjs

@@ -1,3 +1,5 @@
+import { postDeploy } from './claude-post-deploy.mjs';
+export { postDeploy };
 import { importImpl } from '../../_resolve-impl.mjs';
 /**
  * Claude Code Provider
@@ -43,7 +45,6 @@ import {
   pruneStaleAiwgSkills,
   computeAllKernelNames,
   parseFrontmatter,
-  initializeFrameworkWorkspace,
   filterAgentFiles,
   getAddonAgentFiles,
   getAddonCommandFiles,
@@ -395,34 +396,6 @@ export function createAgentsMd(target, srcRoot, dryRun) {
 // Post-Deployment
 // ============================================================================
 
-export async function postDeploy(targetDir, opts) {
-  // Initialize framework workspace structure
-  initializeFrameworkWorkspace(targetDir, opts.mode, opts.dryRun, opts.srcRoot);
-
-  // Claude-specific post-deployment (settings.json, etc.)
-  const claudeDir = path.join(targetDir, '.claude');
-  const settingsPath = path.join(claudeDir, 'settings.json');
-
-  // If settings.json doesn't exist, create a minimal one
-  if (!fs.existsSync(settingsPath) && !opts.dryRun) {
-    ensureDir(claudeDir);
-    const settings = {
-      version: '1.0',
-      created: new Date().toISOString(),
-      aiwg: {
-        enabled: true,
-        mode: opts.mode || 'all'
-      }
-    };
-    fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2), 'utf8');
-    console.log('Created .claude/settings.json');
-  }
-
-  // Hook file architecture: write AIWG.md and wire @AIWG.md into CLAUDE.md
-  if (opts.srcRoot && opts.contextFiles !== false) {
-    deployHookFile(targetDir, opts);
-  }
-}
 
 /**
  * Deploy the AIWG.md hook file and add @AIWG.md directive to CLAUDE.md.
@@ -444,7 +417,7 @@ function interpolateHookTokens(content, counts, targetDir) {
   });
 }
 
-function deployHookFile(targetDir, opts) {
+export function deployHookFile(targetDir, opts) {
   const { srcRoot, dryRun, counts } = opts;
   const templatePath = path.join(srcRoot, 'agentic', 'code', 'frameworks', 'sdlc-complete', 'templates', 'project', 'AIWG.md');
   const hookDest = path.join(targetDir, 'AIWG.md');

package/tools/agents/providers/codex-post-deploy.mjs

@@ -0,0 +1,13 @@
+// Apply project settings and context after provider file deployment.
+import { initializeFrameworkWorkspace } from './base.mjs';
+import { createAgentsMd } from './codex.mjs';
+import { deployConductorDataGuard } from './conductor-data-guard.mjs';
+
+export async function postDeploy(targetDir, opts) {
+  initializeFrameworkWorkspace(targetDir, opts.mode, opts.dryRun, opts.srcRoot);
+  await deployConductorDataGuard(targetDir, 'codex', opts);
+
+  if (opts.createAgentsMd) {
+    if (opts.contextFiles !== false) createAgentsMd(targetDir, opts.srcRoot, opts.dryRun);
+  }
+}