@aiwg/cli 2026.10.8 → 2026.10.10

package/dist/src/cli/handlers/use.js

@@ -12,6 +12,7 @@ import { trackTemporaryDirectory } from '../../utils/temporary-directory.js';
  * @issue #33
  */
 import fs from 'fs/promises';
+import { existsSync, rmSync, rmdirSync } from 'fs';
 import path from 'path';
 import os from 'os';
 import { pathToFileURL } from 'node:url';
@@ -27,11 +28,12 @@ import { registerDeployedExtensions } from '../../extensions/deployment-registra
 import { loadCliCommandsContribution, registerCliCommands, registerHooks, } from '../cli-extension-loader.js';
 import { translateSkillsToCommands, providerNeedsCommands } from '../../plugin/skill-command-translator.js';
 import * as ui from '../ui.js';
-import { readAiwgConfig, writeAiwgConfig, updateInstalled, hashManifest, emptyConfig, getProjectDir } from '../../config/aiwg-config.js';
+import { readAiwgConfig, writeAiwgConfig, updateInstalled, hashManifest, emptyConfig, getProjectDir, getConfigPath } from '../../config/aiwg-config.js';
 import { appendGitignore } from '../../config/gitignore.js';
 import { getLogger } from '../log.js';
 import { installCockpit } from './cockpit.js';
 import { initHandler } from './init.js';
+import { selectAddonProfile } from './use-addon-profile.js';
 import { checkCollisions, formatCollisionReport, hasBlockingCollisions, } from '../../smiths/skillsmith/collision-detector.js';
 import { discoverProjectLocalBundles, } from '../../extensions/project-local-discovery.js';
 import { PROJECT_LOCAL_TYPE_TO_DIR } from '../../extensions/project-local-paths.js';
@@ -65,7 +67,7 @@ import { verifyModelWrapperDeployment } from '../../models/wrapper-deployment.js
 import { aggregateUseDeploymentResult, buildDryRunUseResult, renderUseDeploymentResult, verifyProviderDeployment, } from '../services/deployment-verification.js';
 import { finalizeProviderTransformationReceipt, providerReceiptHasLocalSources, sourceVerificationsFromSignedWebRelease, } from '../../providers/transformation-receipt-integration.js';
 import { loadResourceTrustRootFile, resolveWebRelease, } from '../../resources/web-release.js';
-import { createResourceCredentialProvider } from '../../auth/resource-credentials.js';
+import { createResourceCredentialProvider, prepareResourceCredentials } from '../../auth/resource-credentials.js';
 /**
  * Valid framework identifiers
  */
@@ -102,7 +104,7 @@ export async function resolveProviderReceiptSource(options) {
         release = await resolveWebRelease({ ...releaseOptions, selector: versionInfo.version, offline: true });
     }
     catch {
-        const credentialProvider = createResourceCredentialProvider(process.env);
+        const credentialProvider = options.credentialProvider ?? createResourceCredentialProvider(process.env);
         const token = await credentialProvider();
         // Protected production resources require the authenticated release
         // credential. A configured alternate endpoint may intentionally be public.
@@ -1697,6 +1699,7 @@ function createUseScriptRunner(frameworkRoot) {
     const runner = createScriptRunner(frameworkRoot);
     return {
         async run(script, args, options = {}) {
+            options = { ...options, omitEnv: useDeployment?.resourceCredentials?.omitEnv ?? ['AIWG_RESOURCE_TOKEN'] };
             if (script === 'tools/agents/deploy-agents.mjs')
                 args = useDeploymentArgs(args);
             if (!usePreviewActions)
@@ -2472,6 +2475,9 @@ Bundles:
   <addon> | <extension>     Any installed addon or extension name
 
 Options:
+  --resource-token-stdin | --resource-token-file <path> | --resource-token-store <name>
+  --resource-token-env <NAME> | --resource-token-interactive
+                            Select the optional protected release bearer
   --provider <name>         Target provider (default: .aiwg/aiwg.config providers)
   --target <dir>            Deploy into <dir> instead of the current directory
   --scope project|user      Deploy to the project (default) or the user scope
@@ -2543,11 +2549,22 @@ export class UseHandler {
         return { exitCode: 0, message: USE_HELP, rawOutput: true };
     }
     async execute(ctx) {
+        let resourceCredentials = useDeployment?.resourceCredentials;
+        try {
+            if (!resourceCredentials) {
+                resourceCredentials = await prepareResourceCredentials(ctx.args);
+                ctx = { ...ctx, args: resourceCredentials.args };
+            }
+        }
+        catch (error) {
+            return { exitCode: 2, message: error instanceof Error ? error.message : String(error) };
+        }
         const invalidOption = validateUseOptions(ctx.args, this.preparedProviderContinuations);
         if (invalidOption)
             return { exitCode: 2, message: invalidOption };
         const previousDeployment = useDeployment;
         useDeployment = {
+            resourceCredentials,
             version: previousDeployment?.version ?? resolveDeployVersion(ctx.frameworkRoot || await getFrameworkRoot()),
             skipContextFiles: previousDeployment?.skipContextFiles || ctx.args.includes('--no-context-files'),
             contextFiles: previousDeployment?.contextFiles ?? [],
@@ -2672,7 +2689,7 @@ export class UseHandler {
         }
         let coreResult;
         try {
-            coreResult = await this.executeCore({ ...ctx, args: coreArgs });
+            coreResult = await this.executeCore({ ...ctx, args: coreArgs }, providers);
         }
         catch (error) {
             coreResult = { exitCode: 1, message: error instanceof Error ? error.message : String(error) };
@@ -2730,7 +2747,7 @@ export class UseHandler {
                             scope: effectiveScope,
                             requestedBundles: [requestedBundle],
                         };
-                        const sourceResolution = await resolveProviderReceiptSource(receiptOptions);
+                        const sourceResolution = await resolveProviderReceiptSource({ ...receiptOptions, credentialProvider: useDeployment?.resourceCredentials?.credentialProvider });
                         await finalizeProviderTransformationReceipt({ ...receiptOptions, ...sourceResolution });
                     }
                     catch (error) {
@@ -2807,7 +2824,7 @@ export class UseHandler {
             message: [coreResult.message, rendered, ...(previewActions ? [...previewActions].sort() : [])].filter(Boolean).join('\n'),
         };
     }
-    async executeCore(ctx) {
+    async executeCore(ctx, resolvedProviders) {
         const explicitTarget = firstUsePositional(ctx.args);
         if (ctx.args.includes('--workspace-signals')) {
             const signalArgs = ctx.args.filter((a) => a !== '--workspace-signals');
@@ -2974,6 +2991,13 @@ export class UseHandler {
             || remainingArgs.includes('--yes')
             || remainingArgs.includes('-y')
             || remainingArgs.includes('--non-interactive');
+        // An auto-created config is removed again if the target turns out to be unknown,
+        // so a mistyped `aiwg use <name>` leaves the project untouched.
+        let autoCreatedConfig = null;
+        if (!config && !_isDryRun) {
+            const configPath = getConfigPath(projectDir);
+            autoCreatedConfig = { path: configPath, controlDirExisted: existsSync(path.dirname(configPath)) };
+        }
         if (!config) {
             if (_providersValue) {
                 // --providers shorthand: write config without wizard
@@ -3291,6 +3315,15 @@ export class UseHandler {
                     message: totalFailed > 0 ? `${totalFailed} project-local deploy(s) failed` : '',
                 };
             }
+            if (autoCreatedConfig) {
+                rmSync(autoCreatedConfig.path, { force: true });
+                if (!autoCreatedConfig.controlDirExisted) {
+                    try {
+                        rmdirSync(path.dirname(autoCreatedConfig.path));
+                    }
+                    catch { /* not empty or already gone */ }
+                }
+            }
             return {
                 exitCode: 1,
                 message: `Error: Unknown target '${framework}'\nFrameworks: ${VALID_FRAMEWORKS.join(', ')}\n\n'all' deploys the kernel surface (kernel skills, kernel and core rules, behaviors).\nFor a single addon, run 'aiwg list' to see available addons.\nFor extensions (sys, net, it, sec, stream, dev), see $AIWG_ROOT/agentic/code/extensions/.\nFor project-local artifacts, run 'aiwg list --project-local'.\nRun 'aiwg help' for usage information.`,
@@ -3301,7 +3334,8 @@ export class UseHandler {
         if (isAddon || isExtension) {
             const providerIdx = remainingArgs.findIndex(a => a === '--provider' || a === '--platform');
             const explicitAddonProvider = providerIdx >= 0 && remainingArgs[providerIdx + 1] ? remainingArgs[providerIdx + 1] : null;
-            const provider = resolveBuiltInProviderForUse(explicitAddonProvider ?? (config?.providers?.[0] ?? 'claude')).provider;
+            const providers = resolvedProviders ?? [...new Set(configuredGlobalProviders(remainingArgs, config)
+                    .map(provider => resolveBuiltInProviderForUse(provider).provider))];
             const targetIdx = remainingArgs.findIndex(a => a === '--target');
             const target = targetIdx >= 0 && remainingArgs[targetIdx + 1] ? remainingArgs[targetIdx + 1] : process.cwd();
             const dryRunAddon = remainingArgs.includes('--dry-run');
@@ -3314,264 +3348,206 @@ export class UseHandler {
             catch (error) {
                 return { exitCode: 1, message: `Error: ${error instanceof Error ? error.message : String(error)}` };
             }
-            if (addonScope === 'user' && !USER_SCOPE_PATHS[provider]) {
-                return {
-                    exitCode: 1,
-                    message: `--scope user not supported for provider '${provider}' — see docs/customization/user-scope-deployment.md for the supported list`,
-                };
-            }
-            const runner = createUseScriptRunner(frameworkRoot);
-            const addonBaseArgs = ['--deploy-commands', '--deploy-skills', '--deploy-rules'];
-            if (remainingArgs.includes('--allow-over-budget'))
-                addonBaseArgs.push('--allow-over-budget');
-            if (addonScope === 'user')
-                addonBaseArgs.push('--scope', 'user');
-            // An explicitly selected upstream addon must be self-contained in the
-            // project. Unlike a full framework deploy, its standard skills cannot be
-            // left index-only: the user asked to install this specific bundle and
-            // its supporting scripts must travel with the skill directory.
-            addonBaseArgs.push('--copy-all');
-            addonBaseArgs.push(...modelDeployArgs);
-            if (provider)
-                addonBaseArgs.push('--provider', provider);
-            if (target)
-                addonBaseArgs.push('--target', target);
-            // Forward --copy-all (#1219) so addon-only deploys also honor it.
-            if ((remainingArgs.includes('--copy-all') || remainingArgs.includes('--copy-standard-skills'))
-                && !addonBaseArgs.includes('--copy-all')) {
-                addonBaseArgs.push('--copy-all');
-            }
-            if (dryRunAddon)
-                addonBaseArgs.push('--dry-run');
-            if (remainingArgs.includes('--force'))
-                addonBaseArgs.push('--force');
             const kind = isExtension ? 'extension' : 'addon';
-            const activationOrder = isAddon
-                ? await resolveRequiredAddonActivationOrder(frameworkRoot, framework)
-                : [framework];
-            const requiredAddons = activationOrder.slice(0, -1);
-            for (const dependency of requiredAddons) {
+            const addonSource = isExtension
+                ? extensionPath(frameworkRoot, framework)
+                : addonPath(frameworkRoot, framework);
+            // Deploy, reconcile, and record exactly the provider set verification checks.
+            for (const provider of providers) {
+                if (addonScope === 'user' && !USER_SCOPE_PATHS[provider]) {
+                    return {
+                        exitCode: 1,
+                        message: `--scope user not supported for provider '${provider}' — see docs/customization/user-scope-deployment.md for the supported list`,
+                    };
+                }
+                const runner = createUseScriptRunner(frameworkRoot);
+                const addonBaseArgs = ['--deploy-commands', '--deploy-skills', '--deploy-rules'];
+                if (remainingArgs.includes('--allow-over-budget'))
+                    addonBaseArgs.push('--allow-over-budget');
+                if (addonScope === 'user')
+                    addonBaseArgs.push('--scope', 'user');
+                // An explicitly selected upstream addon must be self-contained in the
+                // project. Unlike a full framework deploy, its standard skills cannot be
+                // left index-only: the user asked to install this specific bundle and
+                // its supporting scripts must travel with the skill directory.
+                addonBaseArgs.push('--copy-all');
+                addonBaseArgs.push(...modelDeployArgs);
+                if (provider)
+                    addonBaseArgs.push('--provider', provider);
+                if (target)
+                    addonBaseArgs.push('--target', target);
+                // Forward --copy-all (#1219) so addon-only deploys also honor it.
+                if ((remainingArgs.includes('--copy-all') || remainingArgs.includes('--copy-standard-skills'))
+                    && !addonBaseArgs.includes('--copy-all')) {
+                    addonBaseArgs.push('--copy-all');
+                }
+                if (dryRunAddon)
+                    addonBaseArgs.push('--dry-run');
+                if (remainingArgs.includes('--force'))
+                    addonBaseArgs.push('--force');
+                const activationOrder = isAddon
+                    ? await resolveRequiredAddonActivationOrder(frameworkRoot, framework)
+                    : [framework];
+                const requiredAddons = activationOrder.slice(0, -1);
+                for (const dependency of requiredAddons) {
+                    ui.blank();
+                    ui.header(`  Deploying required ${dependency} addon...`);
+                    const dependencySource = addonPath(frameworkRoot, dependency);
+                    const dependencyResult = await runner.run('tools/agents/deploy-agents.mjs', [
+                        '--quiet', '--source', dependencySource,
+                        ...addonBaseArgs,
+                    ], { capture: true });
+                    if (dependencyResult.exitCode !== 0) {
+                        return {
+                            ...dependencyResult,
+                            message: dependencyResult.message
+                                || `Failed to deploy required addon '${dependency}'`,
+                        };
+                    }
+                    if (!dryRunAddon) {
+                        try {
+                            await reconcileDeployedSkillAssets(dependencySource, target, provider, { strictReferences: false, force: remainingArgs.includes('--force') });
+                        }
+                        catch (error) {
+                            return {
+                                exitCode: 1,
+                                message: `Required addon '${dependency}' skill asset deployment failed: ${error instanceof Error ? error.message : String(error)}`,
+                            };
+                        }
+                    }
+                    try {
+                        await registerSourceCliCommands({
+                            source: dependencySource,
+                            target,
+                            provider,
+                            dryRun: dryRunAddon,
+                            fallbackDescription: `${dependency} addon commands`,
+                        });
+                    }
+                    catch (error) {
+                        return {
+                            exitCode: 1,
+                            message: `Failed to register required addon '${dependency}' CLI commands: ${error instanceof Error ? error.message : String(error)}`,
+                        };
+                    }
+                    ui.success(dryRunAddon
+                        ? `Required ${dependency} addon activation previewed`
+                        : `Required ${dependency} addon deployed`);
+                }
                 ui.blank();
-                ui.header(`  Deploying required ${dependency} addon...`);
-                const dependencySource = addonPath(frameworkRoot, dependency);
-                const dependencyResult = await runner.run('tools/agents/deploy-agents.mjs', [
-                    '--quiet', '--source', dependencySource,
+                ui.header(`  Deploying ${framework} ${kind}...`);
+                const addonResult = await runner.run('tools/agents/deploy-agents.mjs', [
+                    '--quiet', '--source', addonSource,
                     ...addonBaseArgs,
                 ], { capture: true });
-                if (dependencyResult.exitCode !== 0) {
-                    return {
-                        ...dependencyResult,
-                        message: dependencyResult.message
-                            || `Failed to deploy required addon '${dependency}'`,
-                    };
+                if (addonResult.exitCode !== 0) {
+                    return addonResult;
                 }
                 if (!dryRunAddon) {
                     try {
-                        await reconcileDeployedSkillAssets(dependencySource, target, provider, { strictReferences: false, force: remainingArgs.includes('--force') });
+                        await reconcileDeployedSkillAssets(addonSource, target, provider, { strictReferences: false, force: remainingArgs.includes('--force') });
                     }
                     catch (error) {
                         return {
                             exitCode: 1,
-                            message: `Required addon '${dependency}' skill asset deployment failed: ${error instanceof Error ? error.message : String(error)}`,
+                            message: `${kind} '${framework}' skill asset deployment failed: ${error instanceof Error ? error.message : String(error)}`,
                         };
                     }
                 }
+                if (!dryRunAddon && provider === 'omp' && (detectScope(remainingArgs) === 'user' || remainingArgs.includes('--user'))) {
+                    try {
+                        await deployOmpUserSource({ frameworkRoot, source: addonSource, target, bundle: framework, copyAll: true });
+                    }
+                    catch (error) {
+                        return { exitCode: 1, message: `OMP user deployment failed: ${error instanceof Error ? error.message : String(error)}` };
+                    }
+                }
+                // Register only artifacts actually written by a confirmed deployment.
+                if (!dryRunAddon) {
+                    try {
+                        const registry = getRegistry();
+                        const paths = getProviderPaths(provider);
+                        await registerDeployedExtensions(registry, {
+                            agentsPath: paths.agents,
+                            skillsPath: paths.skills,
+                            commandsPath: paths.commands,
+                            rulesPath: paths.rules,
+                            behaviorsPath: paths.behaviors,
+                            provider,
+                            cwd: target,
+                        });
+                        ui.success('Extension registration complete');
+                    }
+                    catch (error) {
+                        ui.warn(`Failed to register extensions: ${error instanceof Error ? error.message : String(error)}`);
+                    }
+                }
+                // Register CLI commands if addon declares them
                 try {
                     await registerSourceCliCommands({
-                        source: dependencySource,
+                        source: addonSource,
                         target,
                         provider,
                         dryRun: dryRunAddon,
-                        fallbackDescription: `${dependency} addon commands`,
+                        fallbackDescription: `${framework} addon commands`,
                     });
                 }
                 catch (error) {
                     return {
                         exitCode: 1,
-                        message: `Failed to register required addon '${dependency}' CLI commands: ${error instanceof Error ? error.message : String(error)}`,
-                    };
-                }
-                ui.success(dryRunAddon
-                    ? `Required ${dependency} addon activation previewed`
-                    : `Required ${dependency} addon deployed`);
-            }
-            ui.blank();
-            ui.header(`  Deploying ${framework} ${kind}...`);
-            const addonSource = isExtension
-                ? extensionPath(frameworkRoot, framework)
-                : addonPath(frameworkRoot, framework);
-            const addonResult = await runner.run('tools/agents/deploy-agents.mjs', [
-                '--quiet', '--source', addonSource,
-                ...addonBaseArgs,
-            ], { capture: true });
-            if (addonResult.exitCode !== 0) {
-                return addonResult;
-            }
-            if (!dryRunAddon) {
-                try {
-                    await reconcileDeployedSkillAssets(addonSource, target, provider, { strictReferences: false, force: remainingArgs.includes('--force') });
-                }
-                catch (error) {
-                    return {
-                        exitCode: 1,
-                        message: `${kind} '${framework}' skill asset deployment failed: ${error instanceof Error ? error.message : String(error)}`,
+                        message: `Failed to register CLI commands: ${error instanceof Error ? error.message : String(error)}`,
                     };
                 }
-            }
-            if (!dryRunAddon && provider === 'omp' && (detectScope(remainingArgs) === 'user' || remainingArgs.includes('--user'))) {
-                try {
-                    await deployOmpUserSource({ frameworkRoot, source: addonSource, target, bundle: framework, copyAll: true });
-                }
-                catch (error) {
-                    return { exitCode: 1, message: `OMP user deployment failed: ${error instanceof Error ? error.message : String(error)}` };
-                }
-            }
-            // Register only artifacts actually written by a confirmed deployment.
-            if (!dryRunAddon) {
-                try {
-                    const registry = getRegistry();
-                    const paths = getProviderPaths(provider);
-                    await registerDeployedExtensions(registry, {
-                        agentsPath: paths.agents,
-                        skillsPath: paths.skills,
-                        commandsPath: paths.commands,
-                        rulesPath: paths.rules,
-                        behaviorsPath: paths.behaviors,
-                        provider,
-                        cwd: target,
-                    });
-                    ui.success('Extension registration complete');
-                }
-                catch (error) {
-                    ui.warn(`Failed to register extensions: ${error instanceof Error ? error.message : String(error)}`);
-                }
-            }
-            // Register CLI commands if addon declares them
-            try {
-                await registerSourceCliCommands({
-                    source: addonSource,
-                    target,
-                    provider,
-                    dryRun: dryRunAddon,
-                    fallbackDescription: `${framework} addon commands`,
-                });
-            }
-            catch (error) {
-                return {
-                    exitCode: 1,
-                    message: `Failed to register CLI commands: ${error instanceof Error ? error.message : String(error)}`,
-                };
-            }
-            if (!dryRunAddon && (provider === 'openclaw' || (provider === 'grokbot' && addonScope === 'user'))) {
-                try {
-                    await recordNativeAddonDeploy(addonSource, target, provider, framework);
-                }
-                catch (error) {
-                    return { exitCode: 1, message: `Addon user registry update failed: ${error instanceof Error ? error.message : String(error)}` };
-                }
-            }
-            // Persist the same lifecycle record frameworks and project-local bundles
-            // receive so status, refresh, doctor, and remove can account for this
-            // upstream addon and every provider artifact it actually deployed.
-            if (!dryRunAddon && config) {
-                try {
-                    const manifestPath = path.join(addonSource, 'manifest.json');
-                    const manifest = JSON.parse(await fs.readFile(manifestPath, 'utf8'));
-                    // Provider rule aggregation may rename many source rules into one
-                    // managed index. Record this addon's contributed artifact counts,
-                    // matching framework registry semantics, rather than trying to
-                    // attribute shared aggregate filenames after deployment.
-                    const counts = await countBundleSourceArtifacts(addonSource);
-                    const updated = updateInstalled(config, framework, provider, counts, {
-                        version: manifest.version ?? (await getVersionInfo()).version,
-                        source: 'bundled',
-                        manifestHash: await hashManifest(manifestPath),
-                        asPrimary: Boolean(explicitAddonProvider),
-                    });
-                    await writeAiwgConfig(projectDir, updated);
-                    config = updated;
-                }
-                catch (error) {
-                    ui.warn(`Addon registry update failed for '${framework}': ${error instanceof Error ? error.message : String(error)}`);
-                }
-            }
-            // Profile picker for addons with memory topology and multiple templates
-            try {
-                const profileManifestPath = path.join(addonSource, 'manifest.json');
-                const profileManifestContent = await fs.readFile(profileManifestPath, 'utf-8');
-                const profileManifest = JSON.parse(profileManifestContent);
-                const topology = profileManifest.memory?.topology;
-                const templates = profileManifest.templates;
-                if (topology && templates && templates.length > 1) {
-                    const profileIdx = remainingArgs.findIndex(a => a === '--profile');
-                    let selectedProfile;
-                    if (profileIdx >= 0 && remainingArgs[profileIdx + 1]) {
-                        // Explicit --profile flag
-                        selectedProfile = remainingArgs[profileIdx + 1];
-                        const templateFile = templates.find((t) => t.replace('.md', '') === selectedProfile || t === selectedProfile);
-                        if (!templateFile) {
-                            ui.warn(`Unknown profile "${selectedProfile}". Available: ${templates.map((t) => t.replace('.md', '')).join(', ')}`);
-                            selectedProfile = undefined;
-                        }
+                if (!dryRunAddon && (provider === 'openclaw' || (provider === 'grokbot' && addonScope === 'user'))) {
+                    try {
+                        await recordNativeAddonDeploy(addonSource, target, provider, framework);
                     }
-                    else if (_isBulkIntent || !process.stdin.isTTY) {
-                        // Bulk/automation or non-TTY: silently pick 'generic' default.
-                        // The profile picker is annoying during `aiwg use all`.
-                        selectedProfile = 'generic';
+                    catch (error) {
+                        return { exitCode: 1, message: `Addon user registry update failed: ${error instanceof Error ? error.message : String(error)}` };
                     }
-                    else if (process.stdin.isTTY) {
-                        // Interactive profile selection via the shared `listSelect` helper
-                        // (POC for spike #926). One call renders the option list, handles
-                        // number-or-name matching, threads `ctx.signal` for Ctrl-C
-                        // cancellation, and resolves to the fallback on timeout or empty
-                        // input. The hand-rolled parse-and-branch that used to live here
-                        // is now a one-liner.
-                        const { createPromptInterface, listSelect } = await import('../prompt-utils.js');
-                        ui.blank();
-                        ui.header('  Select a topology profile:');
-                        const templateNames = templates.map((t) => t.replace('.md', ''));
-                        const options = templateNames.map((name) => ({
-                            label: name === 'generic' ? `${name} (default)` : name,
-                            value: name,
-                        }));
-                        const rl = createPromptInterface();
-                        try {
-                            selectedProfile = await listSelect(rl, '  Enter number or name [generic]: ', options, 'generic', ctx.signal);
-                        }
-                        finally {
-                            rl.close();
-                        }
+                }
+                // Persist the same lifecycle record frameworks and project-local bundles
+                // receive so status, refresh, doctor, and remove can account for this
+                // upstream addon and every provider artifact it actually deployed.
+                if (!dryRunAddon && config) {
+                    try {
+                        const manifestPath = path.join(addonSource, 'manifest.json');
+                        const manifest = JSON.parse(await fs.readFile(manifestPath, 'utf8'));
+                        // Provider rule aggregation may rename many source rules into one
+                        // managed index. Record this addon's contributed artifact counts,
+                        // matching framework registry semantics, rather than trying to
+                        // attribute shared aggregate filenames after deployment.
+                        const counts = await countBundleSourceArtifacts(addonSource);
+                        const updated = updateInstalled(config, framework, provider, counts, {
+                            version: manifest.version ?? (await getVersionInfo()).version,
+                            source: 'bundled',
+                            manifestHash: await hashManifest(manifestPath),
+                            asPrimary: Boolean(explicitAddonProvider),
+                        });
+                        await writeAiwgConfig(projectDir, updated);
+                        config = updated;
                     }
-                    // Write profile config to project namespace
-                    if (selectedProfile && !dryRunAddon) {
-                        const namespace = topology.namespace || `.aiwg/${framework}`;
-                        const configDir = path.join(target, namespace);
-                        await fs.mkdir(configDir, { recursive: true });
-                        const profileConfig = {
-                            profile: selectedProfile,
-                            pageTemplate: `templates/${selectedProfile}.md`,
-                            selectedAt: new Date().toISOString(),
-                        };
-                        await fs.writeFile(path.join(configDir, 'config.json'), JSON.stringify(profileConfig, null, 2) + '\n');
-                        ui.success(`Profile "${selectedProfile}" selected → ${namespace}/config.json`);
+                    catch (error) {
+                        ui.warn(`Addon registry update failed for '${framework}': ${error instanceof Error ? error.message : String(error)}`);
                     }
                 }
+                if (framework === 'aiwg-utils' && !['pi', 'omp'].includes(provider) && !remainingArgs.includes('--dry-run')) {
+                    const wrapperValidation = await validateDeployedModelWrappers({
+                        provider: normalizeProviderDefinitionId(provider) ?? provider,
+                        target,
+                        frameworkRoot,
+                        modelDeployArgs,
+                        filtered: remainingArgs.includes('--filter') || remainingArgs.includes('--filter-role'),
+                        verbose: remainingArgs.includes('--verbose') || remainingArgs.includes('-v'),
+                    });
+                    if (wrapperValidation)
+                        return wrapperValidation;
+                }
             }
-            catch {
-                // Profile selection is optional — don't fail deployment
-            }
-            if (framework === 'aiwg-utils' && !['pi', 'omp'].includes(provider) && !remainingArgs.includes('--dry-run')) {
-                const wrapperValidation = await validateDeployedModelWrappers({
-                    provider: normalizeProviderDefinitionId(provider) ?? provider,
-                    target,
-                    frameworkRoot,
-                    modelDeployArgs,
-                    filtered: remainingArgs.includes('--filter') || remainingArgs.includes('--filter-role'),
-                    verbose: remainingArgs.includes('--verbose') || remainingArgs.includes('-v'),
-                });
-                if (wrapperValidation)
-                    return wrapperValidation;
-            }
+            await selectAddonProfile({
+                addonSource, framework, target, args: remainingArgs,
+                dryRunAddon, bulkIntent: _isBulkIntent, signal: ctx.signal,
+            });
             ui.blank();
             ui.success(dryRunAddon
                 ? `${framework} addon activation preview complete`

package/dist/src/cli/ui.js

@@ -44,6 +44,7 @@ export function success(msg) {
     console.log(isTTY ? chalk.hex(SUCCESS_HEX)(`  ✓ ${msg}`) : `  OK ${msg}`);
 }
 export function error(msg) {
+    msg = msg.trimStart();
     console.error(isTTY ? chalk.red(`  ✗ ${msg}`) : `  ERROR ${msg}`);
 }
 export function warn(msg) {