@aiwg/cli 2026.10.9 → 2026.10.11

package/dist/src/mcp/tools/worker-invoke.mjs

@@ -12,8 +12,7 @@
  *   - #2890 ProviderAdapter.parseWorkerFinal + assembleWorkerResult
  *     (tools/ralph-external/lib/provider-adapter.mjs, mission-protocol/codecs.ts)
  *
- * This module is the FIRST MCP-side consumer of that pipeline end-to-end,
- * without a shell/CLI round trip and without Mission/MC state. It is
+ * This bridge runs without a shell/CLI round trip or Mission/MC state. It is
  * intentionally conservative where the pipeline cannot yet produce a fully
  * attested identity: verification is always left `pending` here (never
  * self-accepted) — a separate verifier is required before a direct result is
@@ -157,6 +156,7 @@
  * @issues #2892, #2896 (review reference, not reused as-is)
  */
 
+import { workerFailureDiagnostics } from './worker-failure-diagnostics.mjs';
 import { signalChild } from '../../process/signal-child.mjs';
 import { z } from 'zod';
 
@@ -178,6 +178,13 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 import { mcpError, mcpJson } from '../helpers.mjs';
 import { buildShellStopControl, waitForUnitTermination } from './worker-shell-control.mjs';
 import { launchPreparedShellWorker, sweepWorkerStdin } from './worker-stdin-runtime.mjs';
+// NOTE: no static import of ../../config/worker-context.js here. That
+// module is TypeScript: a literal relative import resolves under vitest
+// but throws ERR_MODULE_NOT_FOUND under raw node (e.g. `node
+// src/mcp/cli.mjs`, which test/unit/mcp exercises directly). The
+// request-time loader below resolves it through importImpl (dist when
+// built, source otherwise), so merely loading this bridge never touches
+// it. See tools/_resolve-impl.mjs (#3062).
 
 const execFileAsync = promisify(execFile);
 
@@ -642,6 +649,64 @@ function describeGateFailures(failures) {
   return `worker dispatch gate blocked: ${failures.map(f => `${f.signal} (${f.reason})`).join('; ')}`;
 }
 
+/** Request-time loader for the TypeScript worker-context module (see the
+ * import note above): resolved through importImpl so production uses the
+ * compiled `dist` tree while a checkout falls back to source. Cached for
+ * the process lifetime; only request paths that actually ensure worker
+ * context ever trigger the load. */
+let cachedWorkerContextModule = null;
+async function loadWorkerContextModule() {
+  if (!cachedWorkerContextModule) cachedWorkerContextModule = await importImpl('config/worker-context.js');
+  return cachedWorkerContextModule;
+}
+
+/** Map the worker CLI to its provider and ensure its bootstrap is present
+ * in the worker workdir (#3685 round 2). Deploys the resolved union set
+ * (config providers plus orchestration CLIs) in one pass when the worker
+ * provider's bootstrap is missing; an unmappable CLI refuses with the
+ * typed diagnostic, since no deploy could target it. */
+async function ensureWorkerContextForInvocation({ invocation, config }) {
+  const { ensureWorkerContextBootstrap, mapCliToProviderId, resolveWorkerContextProvidersFromConfig, WorkerContextBootstrapError } =
+    await loadWorkerContextModule();
+  const cli = invocation?.selected?.cli;
+  const mapped = mapCliToProviderId(cli, config?.parallelism);
+  if (!('provider' in mapped) || !mapped.provider) {
+    throw new WorkerContextBootstrapError(
+      `cannot ensure worker context: CLI '${cli}' maps to no AIWG provider (${mapped.skipped ?? 'unmapped'})`,
+      `configure parallelism.clis.${cli} with a providers:<id> adapter, or dispatch a CLI whose adapter maps to a known provider`,
+      { workdir: invocation?.cwd },
+    );
+  }
+  let providers = [mapped.provider];
+  try {
+    providers = [...new Set([...resolveWorkerContextProvidersFromConfig(config).providers, mapped.provider])];
+  } catch {
+    providers = [mapped.provider];
+  }
+  return ensureWorkerContextBootstrap({ workdir: invocation?.cwd, provider: mapped.provider, providers });
+}
+
+/** Refuse a failed bootstrap ensure as a typed blocked diagnostic that
+ * names the remedy — never a bare string the operator cannot act on.
+ * `code`/`remedy`/`provider`/`workdir` survive on any error object that
+ * carries them (the tools-side ensure throws a duck-typed refusal, not
+ * necessarily this module's class instance); only genuinely bare failures
+ * fall back to the generic code and remedy. */
+function toWorkerContextDiagnostic(error) {
+  const fields = (error !== null && typeof error === 'object') ? error : {};
+  // Duck-typed on purpose: the worker-context module loads lazily (see
+  // above), so no class identity is available at module scope. Every
+  // refusal path sets `code`/`remedy` on the thrown object instead.
+  const code = (typeof fields.code === 'string' && fields.code ? fields.code : 'OG_WORKER_CONTEXT_UNAVAILABLE');
+  const remedy = (typeof fields.remedy === 'string' && fields.remedy ? fields.remedy
+    : 'ensure the worker CLI maps to a known AIWG provider and the aiwg CLI is installed (AIWG_BIN), then retry the run');
+  return { code,
+    message: error instanceof Error ? error.message : String(error?.message ?? error),
+    remedy,
+    ...(fields.provider !== undefined ? { provider: fields.provider } : {}),
+    ...(fields.workdir !== undefined ? { workdir: fields.workdir } : {}) };
+}
+
 // Audited observer; refresh the historical baseline graph after rebase.
 const waitForUnitTerminationBaseline = waitForUnitTermination;
 export { waitForUnitTerminationBaseline as __testOnlyWaitForUnitTerminationBaseline };
@@ -758,6 +823,7 @@ export class ChildProcessTransport {
     // cap since a long-lived connection could otherwise grow it unbounded.
     this._rawResponses = new Map();
     this._buffer = undefined;
+    this._bufferBytes = 0;
   }
 
   async start() {
@@ -769,7 +835,7 @@ export class ChildProcessTransport {
       try {
         // Check each frame BEFORE concatenation or UTF-8 decoding.
         let offset = 0;
-        let frameBytes = this._buffer?.length ?? 0;
+        let frameBytes = this._bufferBytes;
         while (offset < chunk.length) {
           const newline = chunk.indexOf(10, offset);
           const end = newline === -1 ? chunk.length : newline;
@@ -782,8 +848,7 @@ export class ChildProcessTransport {
           frameBytes = 0;
           offset = newline + 1;
         }
-        this._buffer = this._buffer ? Buffer.concat([this._buffer, chunk]) : chunk;
-        this._drain();
+        this._drain(chunk);
       } catch (error) { this.onerror?.(error); }
     });
     child.stdout?.on('error', error => this.onerror?.(error));
@@ -799,6 +864,7 @@ export class ChildProcessTransport {
     if (this._closed) return;
     this._closed = true;
     this._buffer = undefined;
+    this._bufferBytes = 0;
     this._rawResponses.clear();
     this.onclose?.();
   }
@@ -807,6 +873,7 @@ export class ChildProcessTransport {
     if (this._failure) return;
     this._failure = Object.assign(new Error(code), { code });
     this._buffer = undefined;
+    this._bufferBytes = 0;
     this._rawResponses.clear();
     // Start stopping before pipe closure can exit the leader; onclose rejects
     // pending SDK requests immediately while termination proof is awaited.
@@ -825,14 +892,26 @@ export class ChildProcessTransport {
   // (own-property-preserving, retained in `_rawResponses` — see
   // constructor doc) and once through the SDK's own `JSONRPCMessageSchema`
   // (routed to `onmessage`, unchanged behavior for the Client/Protocol).
-  _drain() {
-    while (this._buffer) {
-      const index = this._buffer.indexOf('\n');
-      if (index === -1) return;
-      const line = this._buffer.toString('utf8', 0, index).replace(/\r$/, '');
-      this._buffer = this._buffer.subarray(index + 1);
+  _drain(chunk) {
+    // Retain fragments without copying or rescanning the growing partial
+    // frame on every pipe read. Join once, only when a newline arrives.
+    let offset = 0;
+    while (offset < chunk.length) {
+      const newline = chunk.indexOf(10, offset);
+      const end = newline === -1 ? chunk.length : newline;
+      if (end > offset) {
+        (this._buffer ??= []).push(chunk.subarray(offset, end));
+        this._bufferBytes += end - offset;
+      }
+      if (newline === -1) return;
+      const frame = this._buffer?.length === 1
+        ? this._buffer[0] : Buffer.concat(this._buffer ?? [], this._bufferBytes);
+      const line = frame.toString('utf8').replace(/\r$/, '');
+      this._buffer = undefined;
+      this._bufferBytes = 0;
       this._handleLine(line);
-      if (this._buffer?.length === 0) this._buffer = undefined;
+      if (this._closed || this._failure) return;
+      offset = newline + 1;
     }
   }
 
@@ -905,6 +984,7 @@ export class ChildProcessTransport {
       try { signalChild(child, 'SIGKILL'); } catch { /* already gone */ }
     }
     this._buffer = undefined;
+    this._bufferBytes = 0;
   }
 }
 
@@ -1745,6 +1825,24 @@ export async function registerWorkerInvokeToolset(server, options = {}) {
     }
     const { root, snapshot, drivers, invocation } = prefix;
 
+    // #3685 round 2: the worker CLI's AIWG bootstrap must be present in
+    // the worker workdir before dispatch — a context-free worker would run
+    // with no project rules/skills/hooks. Present: no-op. Missing: exactly
+    // one `aiwg use all` pass into the workdir (never elsewhere). A failed
+    // ensure refuses as `blocked` with the typed diagnostic (never a
+    // launch). Default on; `ensureWorkerContext: false` skips (synthetic
+    // tests), a function value replaces the ensure.
+    if (options.ensureWorkerContext !== false) {
+      try {
+        const ensure = typeof options.ensureWorkerContext === 'function'
+          ? options.ensureWorkerContext
+          : ensureWorkerContextForInvocation;
+        await ensure({ invocation, config: snapshot.config });
+      } catch (error) {
+        return markTerminal({ status: 'blocked', termination: 'confirmed', diagnostics: [toWorkerContextDiagnostic(error)] });
+      }
+    }
+
     // =========================================================================
     // #2915 round 8 (D6): ONE decision, immediately after the prefix, from
     // the launcher's own pure eligibility predicate,
@@ -1901,7 +1999,7 @@ export async function registerWorkerInvokeToolset(server, options = {}) {
           // diagnostic below. A duplicate-key/planted-marker probe showed
           // this exact kind of path can otherwise reflect attacker/worker-
           // controlled input text straight back out to the caller.
-          return markTerminal({ status: 'blocked', termination: 'confirmed', diagnostics: [typeof error?.code === 'string' ? error.code : 'OG_BRIEF_NOT_STRUCTURED'] });
+          return markTerminal({ status: 'blocked', termination: 'confirmed', diagnostics: workerFailureDiagnostics(error, 'workerDirectBrief', 'OG_BRIEF_NOT_STRUCTURED') });
         }
         mcpBriefDigest = `sha256:${createHash('sha256').update(briefBytes).digest('hex')}`;
       }
@@ -2022,7 +2120,7 @@ export async function registerWorkerInvokeToolset(server, options = {}) {
         // parser error message, which can echo attacker/worker-controlled
         // input text back out (a duplicate-key probe reflected a planted
         // marker through this exact path before the fix).
-        return registry.markTerminal(entry.invocationId, { status: 'failed', termination: 'confirmed', diagnostics: [typeof error?.code === 'string' ? error.code : 'OG_WORKER_FINAL_INVALID'] });
+        return registry.markTerminal(entry.invocationId, { status: 'failed', termination: 'confirmed', diagnostics: workerFailureDiagnostics(error, 'workerClaims', 'OG_WORKER_FINAL_INVALID') });
       }
       const assembled = await tryAssembleDirectResult({ request, invocation, observation, claims, root,
         briefDigest: mcpBriefDigest, requireStructuredBrief: invocation.transport === 'mcp' });
@@ -2228,7 +2326,7 @@ export async function registerWorkerInvokeToolset(server, options = {}) {
           // #2915 review 6 (finding 4): zero workers dispatched — same
           // proven-never-dispatched settlement as above.
           settleRecovery({ kind: 'uncertain', confirmedStop: true });
-          return markTerminal({ status: 'blocked', termination: 'confirmed', diagnostics: [typeof error?.code === 'string' ? error.code : 'OG_BRIEF_NOT_STRUCTURED'] });
+          return markTerminal({ status: 'blocked', termination: 'confirmed', diagnostics: workerFailureDiagnostics(error, 'workerDirectBrief', 'OG_BRIEF_NOT_STRUCTURED') });
         }
         mcpBriefDigest = `sha256:${createHash('sha256').update(briefBytes).digest('hex')}`;
       }
@@ -2590,7 +2688,7 @@ export async function registerWorkerInvokeToolset(server, options = {}) {
         // parser error message, which can echo attacker/worker-controlled
         // input text back out (a duplicate-key probe reflected a planted
         // marker through this exact path before the fix).
-        return registry.markTerminal(entry.invocationId, { status: 'failed', termination: 'confirmed', diagnostics: [typeof error?.code === 'string' ? error.code : 'OG_WORKER_FINAL_INVALID'] });
+        return registry.markTerminal(entry.invocationId, { status: 'failed', termination: 'confirmed', diagnostics: workerFailureDiagnostics(error, 'workerClaims', 'OG_WORKER_FINAL_INVALID') });
       }
       const assembled = await tryAssembleDirectResult({ request, invocation, observation, claims, root,
         briefDigest: mcpBriefDigest, requireStructuredBrief: invocation.transport === 'mcp' });

package/dist/src/mission-protocol/codecs.js

@@ -1,3 +1,4 @@
+import { workerSemanticErrors, contractValidationPointer } from './worker-contract-diagnostics.js';
 import { createHash } from 'node:crypto';
 import { readFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
@@ -300,7 +301,7 @@ function loadWorkerValidators() {
         const validators = new Map();
         for (const definition of WORKER_DEFINITIONS)
             validators.set(definition, ajv.compile({ $ref: `${schema.$id}#/$defs/${definition}` }));
-        cachedWorkerValidators = { schemaId: schema.$id, bundleDigest: workerBundleDigestFor(schema), validators };
+        cachedWorkerValidators = { schema, schemaId: schema.$id, bundleDigest: workerBundleDigestFor(schema), validators };
     }
     return cachedWorkerValidators;
 }
@@ -327,43 +328,9 @@ export function workerContractSchemaId() {
 // 05 §5.1: complete JSON payloads are bounded independently of field limits.
 export const WORKER_MAX_JSON_BYTES = 262_144;
 export const WORKER_MAX_NESTING_DEPTH = 16;
-function workerSemanticErrors(value) {
-    const ancestors = new Set();
-    function visit(node, depth) {
-        if (!node || typeof node !== 'object')
-            return undefined;
-        if (depth > WORKER_MAX_NESTING_DEPTH)
-            return `JSON nesting depth exceeds ${WORKER_MAX_NESTING_DEPTH}`;
-        if (ancestors.has(node))
-            return 'Worker JSON must not contain cycles';
-        ancestors.add(node);
-        for (const child of Object.values(node)) {
-            const error = visit(child, depth + 1);
-            if (error)
-                return error;
-        }
-        ancestors.delete(node);
-        return undefined;
-    }
-    // Root object/array is depth 1; scalar leaves do not add a nesting level.
-    const depthError = visit(value, 1);
-    if (depthError)
-        return [depthError];
-    try {
-        const bytes = JSON.stringify(value);
-        if (bytes === undefined)
-            return ['Worker payload must be JSON serializable'];
-        if (Buffer.byteLength(bytes, 'utf8') > WORKER_MAX_JSON_BYTES)
-            return [`Serialized UTF-8 JSON exceeds ${WORKER_MAX_JSON_BYTES} bytes`];
-    }
-    catch {
-        return ['Worker payload must be JSON serializable'];
-    }
-    return [];
-}
 /** Validate a worker payload against its bundled definition. Closed shapes reject unknown fields. */
 export function validateWorkerPayload(definition, value) {
-    const semanticErrors = workerSemanticErrors(value);
+    const semanticErrors = workerSemanticErrors(value, WORKER_MAX_JSON_BYTES, WORKER_MAX_NESTING_DEPTH);
     if (semanticErrors.length)
         return { valid: false, errors: semanticErrors };
     const validate = loadWorkerValidators().validators.get(definition);
@@ -392,8 +359,11 @@ export function validateWorkerPayload(definition, value) {
 }
 export function assertValidWorkerPayload(definition, value) {
     const { valid, errors } = validateWorkerPayload(definition, value);
-    if (!valid)
-        throw new WorkerContractError('OG_CONTRACT_INVALID', `Invalid ${definition}: ${errors.join('; ') || 'shape mismatch'}.`);
+    if (!valid) {
+        const { schema, validators } = loadWorkerValidators();
+        throw Object.assign(new WorkerContractError('OG_CONTRACT_INVALID', `Invalid ${definition}: ${errors.join('; ') || 'shape mismatch'}.`), { pointer: contractValidationPointer(definition, workerSemanticErrors(value, WORKER_MAX_JSON_BYTES, WORKER_MAX_NESTING_DEPTH).length
+                ? null : validators.get(definition)?.errors, schema) });
+    }
 }
 /** The producer is supplied by trusted calling code, never read from payload data. */
 export function decodeWorkerProducedPayload(definition, producer, value) {

package/dist/src/mission-protocol/worker-contract-diagnostics.js

@@ -0,0 +1,62 @@
+export function workerSemanticErrors(value, maxBytes, maxDepth) {
+    const ancestors = new Set();
+    function visit(node, depth) {
+        if (!node || typeof node !== 'object')
+            return undefined;
+        if (depth > maxDepth)
+            return `JSON nesting depth exceeds ${maxDepth}`;
+        if (ancestors.has(node))
+            return 'Worker JSON must not contain cycles';
+        ancestors.add(node);
+        for (const child of Object.values(node)) {
+            const error = visit(child, depth + 1);
+            if (error)
+                return error;
+        }
+        ancestors.delete(node);
+        return undefined;
+    }
+    // Root object/array is depth 1; scalar leaves do not add a nesting level.
+    const depthError = visit(value, 1);
+    if (depthError)
+        return [depthError];
+    try {
+        const bytes = JSON.stringify(value);
+        if (bytes === undefined)
+            return ['Worker payload must be JSON serializable'];
+        if (Buffer.byteLength(bytes, 'utf8') > maxBytes)
+            return [`Serialized UTF-8 JSON exceeds ${maxBytes} bytes`];
+    }
+    catch {
+        return ['Worker payload must be JSON serializable'];
+    }
+    return [];
+}
+export function contractValidationPointer(definition, errors, schema) {
+    const names = new Set();
+    function visit(node) {
+        if (!node || typeof node !== 'object')
+            return;
+        const record = node;
+        if (record.properties && typeof record.properties === 'object') {
+            for (const name of Object.keys(record.properties))
+                names.add(name);
+        }
+        for (const value of Object.values(record))
+            visit(value);
+    }
+    visit(schema);
+    const error = errors?.[0];
+    const parts = (error?.instancePath ?? '').split('/').slice(1);
+    if (error?.keyword === 'required')
+        parts.push(String(error.params.missingProperty));
+    const safe = [definition];
+    for (const part of parts) {
+        const name = part.replace(/~1/g, '/').replace(/~0/g, '~');
+        if (!names.has(name) && !/^(0|[1-9][0-9]{0,8})$/.test(name))
+            break;
+        safe.push(part);
+    }
+    return `/${safe.join('/')}`;
+}
+//# sourceMappingURL=worker-contract-diagnostics.js.map

package/dist/src/mission-protocol/worker-invocation-types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=worker-invocation-types.js.map

package/dist/src/models/conductor-data-policy.d.mts

@@ -0,0 +1,8 @@
+// Types for the portable conductor input guard.
+import type { WorkerSelectionPolicy } from './types.js';
+import type { ParallelismConfig } from '../config/aiwg-config.js';
+export const LOCAL_ONLY_PATH_PATTERN: string;
+export function validLocalOnlyPath(value: unknown): boolean;
+export function collectLocalOnlyPaths(policy?: WorkerSelectionPolicy, parallelism?: ParallelismConfig): string[];
+export function conductorToolDenial(event: { tool_name?: string; tool_input?: Record<string, unknown>; cwd?: string }, root: string, paths: string[]): string | null;
+export function runConductorDataHook(root: string, paths: string[]): void;

package/dist/src/models/conductor-data-policy.mjs

@@ -0,0 +1,190 @@
+// Refuse conductor references, glob reads and ancestor searches of declared local-only inputs.
+import { realpathSync, readFileSync, statSync } from 'node:fs';
+import { resolve, dirname, relative, isAbsolute, sep, matchesGlob, basename } from 'node:path';
+
+// Literal project-relative files or directory subtrees; no globs, traversal or rule syntax.
+export const LOCAL_ONLY_PATH_PATTERN = '^(?!.*(?:^|/)\\.{1,2}(?:/|$))[A-Za-z0-9_.@+,-]+(?:/[A-Za-z0-9_.@+,-]+)*$(?![\\s\\S])';
+export const validLocalOnlyPath = value => typeof value === 'string' && new RegExp(LOCAL_ONLY_PATH_PATTERN).test(value);
+
+export function collectLocalOnlyPaths(policy, parallelism) {
+  const policies = [policy?.dataPolicy, ...Object.values(policy?.dataClasses ?? {}),
+    ...Object.values(parallelism?.groupTemplates ?? {}).map(group => group.dataPolicy),
+    ...Object.values(parallelism?.groups ?? {}).map(group => group.dataPolicy)];
+  const paths = policies.flatMap(data => data?.localOnlyPaths ?? []);
+  if (!paths.every(validLocalOnlyPath)) throw new Error('Invalid dataPolicy.localOnlyPaths: expected literal project-relative paths');
+  return [...new Set(paths)].sort();
+}
+
+// Resolve existing symlink ancestors without opening file contents (also handles absent leaves).
+function canonical(file) {
+  try { return realpathSync(file); } catch {
+    const parent = dirname(file);
+    return parent === file ? file : resolve(canonical(parent), relative(parent, file));
+  }
+}
+const contains = (base, file) => relative(base, file) === ''
+  || (!relative(base, file).startsWith('..' + sep) && relative(base, file) !== '..' && !isAbsolute(relative(base, file)));
+
+// Retain quoting for glob characters, but never execute shell expansions or substitutions.
+const literalPattern = value => value.replace(/[*?\[\]{}()!+@]/g, char => char === ']' ? ']' : `[${char}]`);
+function shellCommands(command) {
+  const commands = [];
+  let words = [], value = '', pattern = '', glob = false, quote = null;
+  const word = () => {
+    if (value) words.push({ value, pattern, glob });
+    value = ''; pattern = ''; glob = false;
+  };
+  const end = () => { word(); if (words.length) commands.push(words); words = []; };
+  const append = (char, active) => {
+    value += char;
+    pattern += active ? char : literalPattern(char);
+    glob ||= active && /[*?[]/.test(char);
+  };
+  for (let index = 0; index < command.length; index++) {
+    const char = command[index];
+    if (char === '\\' && quote !== "'" && index + 1 < command.length
+      && (quote !== '"' || /["\\$`\n]/.test(command[index + 1]))) {
+      const next = command[++index];
+      if (next !== '\n') append(next, false);
+    } else if (quote) {
+      if (char === quote) quote = null;
+      else append(char, false);
+    } else if (char === "'" || char === '"') quote = char;
+    else if (/[;&|<>()`\n]/.test(char)) end();
+    else if (/\s/.test(char)) word();
+    else append(char, true);
+  }
+  end();
+  return commands;
+}
+
+function globComponents(token, cwd) {
+  const values = token.value.split('/'), patterns = token.pattern.split('/');
+  const parts = isAbsolute(token.value) ? [] : cwd.split('/').filter(Boolean)
+    .map(value => ({ value, pattern: literalPattern(value) }));
+  for (let index = 0; index < values.length; index++) {
+    const value = values[index];
+    if (!value || value === '.') continue;
+    if (value === '..') parts.pop();
+    else parts.push({ value, pattern: patterns[index] });
+  }
+  return parts;
+}
+
+function globOverlaps(parts, file, subtree) {
+  const names = file.split(sep).filter(Boolean), memo = new Map();
+  const match = (index, depth) => {
+    const key = `${index}:${depth}`;
+    if (memo.has(key)) return memo.get(key);
+    let result;
+    // A matched ancestor is conservative: readers can subsequently traverse it.
+    if (index === parts.length) result = true;
+    else if (depth === names.length) result = subtree || parts.slice(index).every(part => part === '**');
+    else if (parts[index] === '**') result = match(index + 1, depth)
+      || (!names[depth].startsWith('.') && match(index, depth + 1));
+    else result = matchesGlob(names[depth], parts[index]) && match(index + 1, depth + 1);
+    memo.set(key, result);
+    return result;
+  };
+  return match(0, 0);
+}
+
+function globReferences(token, cwd, protectedPaths) {
+  if (!token.glob) return false;
+  const parts = globComponents(token, cwd);
+  const firstGlob = parts.findIndex(part => /[*?[]/.test(part.pattern));
+  const prefix = firstGlob < 0 ? parts.length : firstGlob;
+  const canonicalPrefix = canonical(resolve(sep, ...parts.slice(0, prefix).map(part => part.value)));
+  const patterns = [parts.map(part => part.pattern), [
+    ...canonicalPrefix.split(sep).filter(Boolean).map(literalPattern),
+    ...parts.slice(prefix).map(part => part.pattern),
+  ]];
+  return protectedPaths.some(file => {
+    let subtree = true;
+    try { subtree = statSync(file).isDirectory(); } catch { /* Absent declarations still protect future subtrees. */ }
+    return patterns.some(pattern => globOverlaps(pattern, file, subtree));
+  });
+}
+
+// Recognize common recursive readers; option values and search patterns are not path operands.
+function recursiveRoots(words) {
+  const index = words.findIndex(word => ['rg', 'grep', 'find'].includes(basename(word.value)));
+  if (index < 0) return [];
+  const name = basename(words[index].value), args = words.slice(index + 1).map(word => word.value);
+  if (name === 'grep' && !args.some(arg => /^-[^-]*[rR]/.test(arg)
+    || ['--recursive', '--dereference-recursive'].includes(arg))) return [];
+  if (name === 'find') {
+    const roots = [];
+    for (const arg of args) {
+      if (['-H', '-L', '-P'].includes(arg) && !roots.length) continue;
+      if (/^[-(!]/.test(arg)) break;
+      roots.push(arg);
+    }
+    return roots.length ? roots : ['.'];
+  }
+  const valueOptions = new Set(['-e', '--regexp', '-f', '--file', '-g', '--glob', '--iglob',
+    '-t', '--type', '-T', '--type-not', '-m', '--max-count', '-A', '-B', '-C', '--after-context',
+    '--before-context', '--context', '--include', '--exclude', '--exclude-dir', '--encoding', '-j', '--threads']);
+  let needsPattern = !args.includes('--files'), options = true;
+  const roots = [];
+  for (let cursor = 0; cursor < args.length; cursor++) {
+    const arg = args[cursor];
+    if (options && arg === '--') { options = false; continue; }
+    if (options && arg.startsWith('-') && arg !== '-') {
+      if (/^(?:-[ef].+|--(?:regexp|file)=)/.test(arg)) needsPattern = false;
+      if (valueOptions.has(arg)) {
+        if (['-e', '--regexp', '-f', '--file'].includes(arg)) needsPattern = false;
+        cursor++;
+      }
+      continue;
+    }
+    if (needsPattern) needsPattern = false;
+    else roots.push(arg);
+  }
+  return roots.length ? roots : ['.'];
+}
+
+export function conductorToolDenial(event, root, paths) {
+  const input = event.tool_input ?? {};
+  const cwd = typeof event.cwd === 'string' && isAbsolute(event.cwd) ? event.cwd : root;
+  const protectedPaths = paths.flatMap(file => [resolve(root, file), canonical(resolve(root, file))]);
+  const denied = candidate => {
+    if (typeof candidate !== 'string' || !candidate) return false;
+    const file = resolve(cwd, candidate);
+    return protectedPaths.some(base => contains(base, file) || contains(base, canonical(file)));
+  };
+  if ([input.file_path, input.path].some(denied)) return 'AIWG: local-only task input is unavailable to this conductor';
+  if (typeof input.command === 'string') {
+    // Covers literal/quoted paths, compound commands and common redirections. This is
+    // deliberately conservative, not a shell interpreter or a filesystem sandbox.
+    const command = input.command;
+    const tokens = command.match(/[^\s"'`;&|<>()]+/g) ?? [];
+    if (paths.some(file => command.includes(file)) || tokens.some(token => denied(token) || denied(token.split('=').at(-1)))) {
+      return 'AIWG: command references a local-only task input';
+    }
+    const commands = shellCommands(command);
+    if (commands.flat().some(token => globReferences(token, cwd, protectedPaths))
+      || commands.some(words => recursiveRoots(words).some(candidate => {
+        const ancestor = resolve(cwd, candidate);
+        return protectedPaths.some(file => contains(ancestor, file) || contains(canonical(ancestor), file));
+      }))) return 'AIWG: command may read a local-only task input through a glob or ancestor search';
+  }
+  return null;
+}
+
+export function runConductorDataHook(root, paths) {
+  try {
+    const raw = readFileSync(0, 'utf8');
+    if (Buffer.byteLength(raw) > 1024 * 1024) throw new Error('oversized event');
+    const event = JSON.parse(raw);
+    if (!event || typeof event !== 'object' || typeof event.tool_name !== 'string'
+      || !event.tool_input || typeof event.tool_input !== 'object') throw new Error('invalid event');
+    const reason = conductorToolDenial(event, root, paths);
+    if (reason) process.stdout.write(JSON.stringify({ hookSpecificOutput: {
+      hookEventName: 'PreToolUse', permissionDecision: 'deny', permissionDecisionReason: reason,
+    } }) + '\n');
+  } catch {
+    process.stderr.write('AIWG local-only guard: refusing malformed tool event\n');
+    process.exitCode = 2;
+  }
+}

package/dist/src/models/config-loader.js

@@ -1,3 +1,4 @@
+import { workerDispatchBlocked, isWorkerMaintenance, workerRecoveryDiagnostic } from '../config/worker-write.js';
 /**
  * Model Configuration Loader
  * Loads and merges model configurations from multiple sources with proper precedence
@@ -11,17 +12,20 @@ import { fileURLToPath } from 'node:url';
 import { homedir } from 'os';
 import { existsSync } from 'fs';
 import { findPackageRoot } from '../cli/find-package-root.js';
-import { workerConfigDigest, validateWorkerGroupReferences } from '../config/aiwg-config.js';
+import { getConfigPath, validateParallelismConfig, workerConfigDigest, validateWorkerGroupReferences } from '../config/aiwg-config.js';
 import { DEFAULT_WORKER_SELECTION, WorkerRoleEffortError, mergeWorkerSelection, WorkerSelectionPolicySchema, validateUserProjectModelConfig } from './provider-policy.js';
+import { expandWorkerGroupTemplates, mergeGroupWorkerPolicy } from '../config/worker-group-templates.js';
 /**
  * Loads and merges model configurations
  */
 export class ConfigLoader {
+    options;
     cache = null;
     cacheDigest = null;
     inputDigests = null;
     locations;
     constructor(projectPath, options) {
+        this.options = options;
         const aiwgHome = options?.aiwgHome || process.env.AIWG_HOME
             || findPackageRoot(dirname(fileURLToPath(import.meta.url)));
         if (!aiwgHome)
@@ -38,10 +42,17 @@ export class ConfigLoader {
      * Precedence: project > user > AIWG default
      */
     async load(parallelism) {
+        if (!isWorkerMaintenance() && workerDispatchBlocked(dirname(this.locations.projectConfig))) {
+            throw new Error(workerRecoveryDiagnostic(dirname(this.locations.projectConfig)));
+        }
+        const expansion = expandWorkerGroupTemplates(parallelism, getConfigPath(dirname(this.locations.projectConfig)));
+        const errors = validateParallelismConfig(parallelism);
+        if (errors.length)
+            throw new Error(errors.join('; '));
         // Load all configs
         const aiwgDefault = await this.loadAiwgDefault();
         const userConfig = await this.loadUserConfig();
-        const projectConfig = await this.loadProjectConfig();
+        const projectConfig = this.options?.workerCandidate ? this.options.workerCandidate.projectModels : await this.loadProjectConfig();
         const digest = workerConfigDigest([aiwgDefault, userConfig, projectConfig, parallelism]);
         if (this.cache && this.cacheDigest === digest)
             return this.cache;
@@ -64,7 +75,7 @@ export class ConfigLoader {
             if (result.diagnostics.length)
                 throw new Error(result.diagnostics.map(d => `${d.code}: ${d.pointer}: ${d.message}; origins=${JSON.stringify(d.origins ?? [])}`).join('; '));
             merged.defaults.workerSelection = result.policy;
-            merged.workerPolicyOrigins = result.origins;
+            merged.workerPolicyOrigins = { ...result.origins, ...expansion.origins };
         }
         if (parallelism?.worker_dispatch) {
             // Exact wrapper pins remain explainable alongside worker restrictions.
@@ -83,6 +94,11 @@ export class ConfigLoader {
                     });
                 }
             }
+            for (const group of Object.values(expansion.parallelism?.groups ?? {})) {
+                const narrowed = mergeGroupWorkerPolicy(merged.defaults.workerSelection, group);
+                if (narrowed.diagnostics.length)
+                    throw new Error(narrowed.diagnostics.map(d => `${d.code}: ${d.message}`).join('; '));
+            }
             const errors = validateWorkerGroupReferences(parallelism, merged.defaults.workerSelection);
             if (errors.length)
                 throw new Error(errors.join('; '));