@aiwg/cli 2026.10.8 → 2026.10.10

package/dist/src/cli/handlers/models.js

@@ -1,3 +1,8 @@
+import { MODELS_HELP } from './models-help.js';
+import { updateJson } from '../../models/config-writer.js';
+import { atomicConfigWrite as atomicWrite } from '../../config/worker-write.js';
+import { handleWorkerAdoptionArgs } from '../../config/worker-adoption-cli.js';
+import { resolveParallelism } from '../../config/aiwg-config.js';
 /**
  * Safe model-policy audit, resolution, and mutation commands.
  * @implements #1804
@@ -8,7 +13,7 @@ import { isDeepStrictEqual } from 'node:util';
 import path from 'node:path';
 import { glob } from 'glob';
 import { load as loadYaml } from 'js-yaml';
-import { compileModelPolicy, validateCanonicalModelPolicy, validateUserProjectModelConfig, loadProviderModelCapabilities, WorkerPolicyError, assertWorkerRoleEffort, } from '../../models/provider-policy.js';
+import { compileModelPolicy, validateCanonicalModelPolicy, loadProviderModelCapabilities, WorkerPolicyError, assertWorkerRoleEffort, } from '../../models/provider-policy.js';
 import { resolveGrokBuildRoleModel } from '../../models/grok-build-models.js';
 import { readAiwgConfig, emptyConfig } from '../../config/aiwg-config.js';
 import { ConfigLoader } from '../../models/config-loader.js';
@@ -34,22 +39,21 @@ export async function loadWorkerInputs(ctx) {
     const models = await loader.load(config.parallelism);
     const catalog = await effectiveCatalog(ctx, ctx.cwd, false, parseArgs(['resolve']));
     const registry = loadProviderModelCapabilities();
-    // Let the resolver explain the dispatch gate before requiring host qualification (#3070).
     if (!config.parallelism?.worker_dispatch) {
         return { snapshot: { config, models, modelDigests: loader.getInputDigests(), catalog,
                 registry, installations: {} }, drivers: {} };
     }
     // Explain missing policy before a recorded approval's digest check can
     // mask it. The host owner first preserves its missing-installation errors.
-    const parallelism = config.parallelism;
+    const parallelism = resolveParallelism(config.parallelism, config.providers[0]);
     const precheckPolicy = () => {
         if (!ctx.args.some(arg => arg === '--role' || arg.startsWith('--role=')))
             return;
         const request = parseWorkerCommandArgs(ctx.args.slice(1));
         const members = Object.entries(parallelism.groups ?? {})
             .filter(([id]) => !request.group || request.group === id)
-            .flatMap(([, group]) => group.members).filter(member => member.enabled !== false
-            && parallelism.clis?.[member.cli]?.enabled !== false && member.roles.includes(request.role));
+            .flatMap(([, group]) => group.members ?? []).filter(member => member.enabled !== false
+            && parallelism.clis?.[member.cli]?.enabled !== false && member.roles.includes((models.defaults.workerSelection?.roleGuidance?.[request.role]?.baseRole ?? request.role)));
         const requiresExplicit = members.length > 0 && members.every(member => {
             // Health metadata can identify the provider before an operator has
             // qualified its dispatch adapter. It grants no dispatch authority.
@@ -269,35 +273,6 @@ function print(value, json) {
     else
         console.log(JSON.stringify(value, null, 2));
 }
-async function atomicWrite(file, content) {
-    await fs.mkdir(path.dirname(file), { recursive: true });
-    const temporary = `${file}.tmp-${process.pid}`;
-    let mode = 0o600;
-    try {
-        mode = (await fs.stat(file)).mode;
-    }
-    catch { /* new file */ }
-    await fs.writeFile(temporary, content, { encoding: 'utf8', mode });
-    await fs.rename(temporary, file);
-}
-async function updateJson(file, mutate, dryRun) {
-    let value = {};
-    try {
-        value = JSON.parse(await fs.readFile(file, 'utf8'));
-    }
-    catch (error) {
-        if (error?.code !== 'ENOENT')
-            throw error;
-    }
-    mutate(value);
-    const validation = validateUserProjectModelConfig(value);
-    if (!validation.valid)
-        throw new Error(validation.diagnostics.map(item => item.message).join('; '));
-    const content = `${JSON.stringify(value, null, 2)}\n`;
-    if (!dryRun)
-        await atomicWrite(file, content);
-    return { file, beforeWrite: value, dryRun };
-}
 async function effectiveCatalog(ctx, target, allowNetwork, parsed, provider) {
     const { collectProviderInventory } = await import('../../providers/provider-inventory.js');
     const { resolveDynamicModelCatalog } = await import('../../models/model-discovery.js');
@@ -350,53 +325,6 @@ function replaceFrontmatter(raw, item, tier) {
     }
     return `---\n${frontmatter}\n---\n${match[2]}`;
 }
-const MODELS_HELP = `Usage: aiwg models <subcommand> [options]
-
-Subcommands:
-  list                         List discovered agent and skill model policies
-  audit                        Compile selected policies and report diagnostics
-  resolve                      Resolve artifact policies, or a direct worker invocation
-  validate                     Validate selected artifact policies (not worker configuration)
-  sources                      Show the effective model catalog without network refresh
-  refresh                      Refresh model discovery (may access the network)
-  set-default <TIER>           Write defaults.tier to models.json
-  set --tier <TIER>            Update selected agent/skill frontmatter; requires a selector or --all
-  migrate                      Add canonical role/tier hints to legacy skills
-
-Artifact selectors and options:
-  --agent <name>  --skill <name>  --glob <pattern>  --role <role>
-  --tier <tier>  --framework <name>  --all
-  --provider <provider>         Provider for artifact compilation (default: claude)
-  --model <id>                  Explicit Grok Build model for artifact resolve
-  --target <directory>         Artifact/project root (default: current directory)
-  --scope project|user         set-default destination (default: project)
-  --dry-run                    Preview mutations without writing
-  --json                       Emit JSON
-  --drift                      Include catalog drift for sources/refresh
-  --url <url>                  Remote catalog URL for refresh
-  --help, -h                   Show this reference
-  TIER: economy | standard | premium | max-quality
-
-Direct worker resolution (plans an invocation; does not launch it):
-  aiwg models resolve --role <role> --task <class> --group <group>
-    --brief <file> --workdir <tree> --final-output <file>
-    [--transport shell|mcp] [--format json|shell] [--authorize-premium]
-  --role                       efficiency | coding | reasoning
-  --task                       Task class from defaults.workerSelection.taskClasses
-                               Built-ins: inventory, implementation, architecture, review
-  --group                      Group from parallelism.groups and the role's guidance
-  --brief                      Absolute path to the task brief
-  --workdir                    Absolute path to the worker tree
-  --final-output               Absolute path for the final result
-  --transport                  Must match group execution transport (default: shell)
-  --format                     JSON plan or POSIX shell command (default: json)
-  --json                       Alias for --format json
-  --authorize-premium          Authorize premium for this resolution only
-                               Agents require explicit human confirmation of escalation
-
-Worker groups live in .aiwg/aiwg.config; role guidance lives in project-root models.json.
-Configure both, then run aiwg doctor --probe-workers --qualify.
-See docs/getting-started/worker-dispatch.md for a complete example.`;
 async function execute(ctx, services = { load: loadWorkerInputs }) {
     if (ctx.args.length === 0 || ctx.args[0] === 'help' || ctx.args.includes('--help') || ctx.args.includes('-h')) {
         print(MODELS_HELP, false);
@@ -406,6 +334,8 @@ async function execute(ctx, services = { load: loadWorkerInputs }) {
     if (ctx.args[0] === 'resolve' && ctx.args.slice(1).some(arg => /^--(?:task|group|brief|workdir|final-output|transport|format|authorize-premium)(?:=|$)/.test(arg))) {
         return resolveDirect(ctx, services);
     }
+    if (await handleWorkerAdoptionArgs(ctx.args, ctx.cwd, 'models', ctx.signal, ctx.dryRun))
+        return { exitCode: 0 };
     const parsed = parseArgs(ctx.args);
     if (parsed.subcommand === 'resolve') {
         const supported = new Set(['agent', 'skill', 'glob', 'role', 'tier', 'framework', 'all', 'target', 'provider', 'model', 'json', 'help', 'dry-run']);

package/dist/src/cli/handlers/resource-versions.js

@@ -3,13 +3,14 @@ import { loadResourceTrustRootFile, readVerifiedRegularFile, resolveWebRelease,
 import { getProjectDir } from "../../config/aiwg-config.js";
 import { cleanWebResourceCache } from "../../resources/cache-cleanup.js";
 import { writeWebResourceLock } from "../../resources/lockfile.js";
-import { createResourceCredentialProvider } from "../../auth/resource-credentials.js";
+import { createResourceCredentialProvider, prepareResourceCredentials } from "../../auth/resource-credentials.js";
 const MAX_RESOURCE_MANIFEST_BYTES = 4 * 1024 * 1024;
 const DEFAULT_CHANNELS = ["stable", "latest", "canary", "main"];
 function usage() {
     return [
         "Usage: aiwg versions <list|resolve|show|clean-cache> [selector] [--json] [--pretty] [--offline]",
         "",
+        "Protected releases: --resource-token-stdin, --resource-token-file <path>, --resource-token-store <name>, --resource-token-env <NAME>, --resource-token-interactive",
         "Examples:",
         "  aiwg versions list --json",
         "  aiwg versions resolve stable --json",
@@ -75,7 +76,7 @@ function parseArgs(args) {
         channels,
     };
 }
-function webReleaseOptionsFromEnvironment() {
+function webReleaseOptionsFromEnvironment(credentialProvider = createResourceCredentialProvider(process.env)) {
     const baseUrl = process.env.AIWG_RESOURCE_BASE_URL;
     const cacheRoot = process.env.AIWG_RESOURCE_CACHE_ROOT;
     const trustRootFile = process.env.AIWG_RESOURCE_TRUST_ROOT_FILE;
@@ -83,7 +84,7 @@ function webReleaseOptionsFromEnvironment() {
         ? undefined
         : loadResourceTrustRootFile(path.resolve(trustRootFile));
     return {
-        credentialProvider: createResourceCredentialProvider(process.env),
+        credentialProvider,
         ...(baseUrl === undefined ? {} : { baseUrl }),
         ...(cacheRoot === undefined ? {} : { cacheRoot }),
         ...(publicKeyPem === undefined ? {} : { publicKeyPem }),
@@ -168,14 +169,16 @@ export const versionsHandler = {
             return { exitCode: 0 };
         }
         let parsed;
+        let credentials;
         try {
-            parsed = parseArgs(ctx.args);
+            credentials = await prepareResourceCredentials(ctx.args);
+            parsed = parseArgs(credentials.args);
         }
         catch (error) {
             return { exitCode: 2, message: error instanceof Error ? error.message : String(error) };
         }
         try {
-            const baseOptions = webReleaseOptionsFromEnvironment();
+            const baseOptions = webReleaseOptionsFromEnvironment(credentials.credentialProvider);
             if (parsed.subcommand === "clean-cache") {
                 const result = cleanWebResourceCache(getProjectDir(ctx, ctx.args), {
                     cacheRoot: process.env.AIWG_RESOURCE_CACHE_ROOT,

package/dist/src/cli/handlers/script-runner.js

@@ -57,10 +57,13 @@ export class DefaultScriptRunner {
             const stdio = options.capture
                 ? ['pipe', options.stdoutFd ?? 'pipe', 'pipe']
                 : 'inherit';
+            const environment = { ...process.env, ...options.env };
+            for (const name of options.omitEnv ?? [])
+                delete environment[name];
             const child = spawn('node', [fullPath, ...args], {
                 stdio,
                 cwd: options.cwd || process.cwd(),
-                env: { ...process.env, ...options.env },
+                env: environment,
             });
             // Always drain captured pipes, even after the diagnostic cap is reached.
             // stdout is not part of HandlerResult; discard it. Retain only the first
@@ -146,10 +149,13 @@ export class DefaultScriptRunner {
     async runDeployment(fullPath, args, options) {
         const previousConsole = globalThis.console;
         const previousRoot = process.env.AIWG_ROOT;
+        const omitted = new Map((options.omitEnv ?? []).map(name => [name, process.env[name]]));
         const stderrLimit = 1024 * 1024;
         const diagnostics = [];
         let diagnosticBytes = 0;
         try {
+            for (const name of omitted.keys())
+                delete process.env[name];
             if (options.env?.AIWG_ROOT !== undefined)
                 process.env.AIWG_ROOT = options.env.AIWG_ROOT;
             if (options.capture) {
@@ -187,6 +193,12 @@ export class DefaultScriptRunner {
         }
         finally {
             globalThis.console = previousConsole;
+            for (const [name, value] of omitted) {
+                if (value === undefined)
+                    delete process.env[name];
+                else
+                    process.env[name] = value;
+            }
             if (previousRoot === undefined)
                 delete process.env.AIWG_ROOT;
             else

package/dist/src/cli/handlers/use-addon-profile.js

@@ -0,0 +1,72 @@
+// Select and persist an optional bundled addon memory profile.
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import * as ui from '../ui.js';
+export async function selectAddonProfile(options) {
+    const { addonSource, framework, target, args, dryRunAddon, bulkIntent, signal } = options;
+    try {
+        const profileManifestPath = path.join(addonSource, 'manifest.json');
+        const profileManifestContent = await fs.readFile(profileManifestPath, 'utf-8');
+        const profileManifest = JSON.parse(profileManifestContent);
+        const topology = profileManifest.memory?.topology;
+        const templates = profileManifest.templates;
+        if (topology && templates && templates.length > 1) {
+            const profileIdx = args.findIndex(a => a === '--profile');
+            let selectedProfile;
+            if (profileIdx >= 0 && args[profileIdx + 1]) {
+                // Explicit --profile flag
+                selectedProfile = args[profileIdx + 1];
+                const templateFile = templates.find((t) => t.replace('.md', '') === selectedProfile || t === selectedProfile);
+                if (!templateFile) {
+                    ui.warn(`Unknown profile "${selectedProfile}". Available: ${templates.map((t) => t.replace('.md', '')).join(', ')}`);
+                    selectedProfile = undefined;
+                }
+            }
+            else if (bulkIntent || !process.stdin.isTTY) {
+                // Bulk/automation or non-TTY: silently pick 'generic' default.
+                // The profile picker is annoying during `aiwg use all`.
+                selectedProfile = 'generic';
+            }
+            else if (process.stdin.isTTY) {
+                // Interactive profile selection via the shared `listSelect` helper
+                // (POC for spike #926). One call renders the option list, handles
+                // number-or-name matching, threads `signal` for Ctrl-C
+                // cancellation, and resolves to the fallback on timeout or empty
+                // input. The hand-rolled parse-and-branch that used to live here
+                // is now a one-liner.
+                const { createPromptInterface, listSelect } = await import('../prompt-utils.js');
+                ui.blank();
+                ui.header('  Select a topology profile:');
+                const templateNames = templates.map((t) => t.replace('.md', ''));
+                const options = templateNames.map((name) => ({
+                    label: name === 'generic' ? `${name} (default)` : name,
+                    value: name,
+                }));
+                const rl = createPromptInterface();
+                try {
+                    selectedProfile = await listSelect(rl, '  Enter number or name [generic]: ', options, 'generic', signal);
+                }
+                finally {
+                    rl.close();
+                }
+            }
+            // Write profile config to project namespace
+            if (selectedProfile && !dryRunAddon) {
+                const namespace = topology.namespace || `.aiwg/${framework}`;
+                const configDir = path.join(target, namespace);
+                await fs.mkdir(configDir, { recursive: true });
+                const profileConfig = {
+                    profile: selectedProfile,
+                    pageTemplate: `templates/${selectedProfile}.md`,
+                    selectedAt: new Date().toISOString(),
+                };
+                await fs.writeFile(path.join(configDir, 'config.json'), JSON.stringify(profileConfig, null, 2) + '\n');
+                ui.success(`Profile "${selectedProfile}" selected → ${namespace}/config.json`);
+            }
+        }
+    }
+    catch {
+        // Profile selection is optional — don't fail deployment
+    }
+}
+//# sourceMappingURL=use-addon-profile.js.map