@aiwg/cli 2026.7.21 → 2026.7.24

package/README.md

@@ -10,10 +10,15 @@ AIWG skills and agents use this CLI to perform common operations with
 predictable, structured calls instead of spending context on shell discovery,
 filesystem traversal, command reconstruction, and repeated tool output.
 
-```bash
-npm install --global @aiwg/cli
+New to AIWG? Install the full `aiwg` package and let the agentic installer
+connect the complete system. `@aiwg/cli` is the smaller execution layer for
+agents, CI, and web-backed installations.
 
-aiwg doctor
+```text
+Install or repair AIWG for this project by following
+https://raw.githubusercontent.com/jmagly/aiwg/main/setup.aiwg.yaml
+Explain the plan before changing anything, preserve my existing work, and ask
+me only for choices you cannot safely determine.
 ```
 
 [![npm version](https://img.shields.io/npm/v/%40aiwg%2Fcli/latest?label=%40aiwg%2Fcli&color=CB3837&logo=npm&style=flat-square)](https://www.npmjs.com/package/@aiwg/cli)
@@ -209,6 +214,12 @@ execution layer and can obtain resources from the signed web release. Choose
 `aiwg` when local authoring, the full bundled corpus, or completely cold
 offline operation is required.
 
+For a first installation, an uncertain environment, or a machine with an old
+or broken AIWG setup, use the full `aiwg` package and the
+[agentic installer manifest](https://raw.githubusercontent.com/jmagly/aiwg/main/setup.aiwg.yaml).
+The flow detects development checkouts and preserves development mode unless
+the user explicitly approves switching to the published package.
+
 Both CLI packages expose the same `aiwg` executable name. Install one globally
 at a time unless you deliberately manage separate npm prefixes.
 

package/dist/src/api/index.d.ts

@@ -8,4 +8,5 @@
 export { run } from '../cli/router.js';
 export * from '../resources/index.js';
 export * from '../sessions/index.js';
+export * from '../security/threat-assessment-config.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/api/index.js

@@ -8,4 +8,5 @@
 export { run } from '../cli/router.js';
 export * from '../resources/index.js';
 export * from '../sessions/index.js';
+export * from '../security/threat-assessment-config.js';
 //# sourceMappingURL=index.js.map

package/dist/src/artifacts/browser-export.js

@@ -326,6 +326,8 @@ export function recordTypeForEntry(entry, schemaVersion) {
             return "aiwg.command";
         case "rule":
             return "aiwg.rule";
+        case "schema":
+            return "aiwg.schema";
         case "behavior":
             return "aiwg.behavior";
         case "flow":

package/dist/src/artifacts/index-builder.js

@@ -132,6 +132,36 @@ function extractSummary(data, body) {
     const lines = body.split('\n').filter(l => l.trim() && !l.startsWith('#'));
     return lines.slice(0, 5).join(' ').slice(0, 500).trim();
 }
+function parseSchemaDoc(content, relativePath) {
+    if (!/\.(json|ya?ml)$/i.test(relativePath))
+        return null;
+    let parsed;
+    try {
+        parsed = /\.json$/i.test(relativePath) ? JSON.parse(content) : loadYaml(content);
+    }
+    catch {
+        return null;
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+        return null;
+    const schema = parsed;
+    const title = typeof schema.title === 'string' && schema.title.trim()
+        ? schema.title.trim()
+        : undefined;
+    const id = typeof schema.$id === 'string' && schema.$id.trim()
+        ? schema.$id.trim()
+        : undefined;
+    const description = typeof schema.description === 'string' && schema.description.trim()
+        ? schema.description.trim().slice(0, 240)
+        : undefined;
+    const filename = path.basename(relativePath, path.extname(relativePath)).replace(/\.schema$/i, '');
+    return {
+        title: title ?? filename,
+        name: filename,
+        capability: description ?? (id ? `Schema definition for ${title ?? filename}` : undefined),
+        searchTerms: [id, title, filename, 'schema'].filter((term) => Boolean(term)),
+    };
+}
 /**
  * Determine SDLC phase from file path
  */
@@ -150,8 +180,6 @@ function inferPhase(filePath) {
  * always lands as `type: 'skill'` regardless of frontmatter.
  */
 function inferType(data, filePath) {
-    if (typeof data.type === 'string')
-        return data.type;
     // Normalize separators so matchers are cross-platform.
     const normalized = filePath.replace(/\\/g, '/');
     const basename = path.basename(filePath, path.extname(filePath)).toLowerCase();
@@ -179,7 +207,8 @@ function inferType(data, filePath) {
     const skipBasenames = new Set(['readme', 'rules-index', 'index']);
     const isMarkdown = /\.md$/i.test(filePath);
     const isTemplateAsset = TEMPLATE_INDEX_EXTENSIONS.some(ext => normalized.endsWith(ext));
-    if (!skipBasenames.has(basename) && (isMarkdown || isTemplateAsset)) {
+    const isSchemaAsset = /\.(json|ya?ml|md)$/i.test(filePath);
+    if (!skipBasenames.has(basename) && (isMarkdown || isTemplateAsset || isSchemaAsset)) {
         // Look at directory segments only (exclude the file itself).
         for (let i = segments.length - 2; i >= 0; i--) {
             const seg = segments[i];
@@ -215,6 +244,10 @@ function inferType(data, filePath) {
                     if (isMarkdown)
                         return 'rule';
                     break;
+                case 'schemas':
+                    if (isSchemaAsset)
+                        return 'schema';
+                    break;
                 case 'templates':
                     return 'template';
                 case 'behaviors':
@@ -228,6 +261,8 @@ function inferType(data, filePath) {
             }
         }
     }
+    if (typeof data.type === 'string')
+        return data.type;
     // Legacy SDLC artifact heuristics (existing behavior preserved).
     if (basename.startsWith('uc-') || basename.includes('use-case'))
         return 'use-case';
@@ -864,11 +899,12 @@ export async function buildIndex(cwd, options = {}) {
             const inferredType = inferType(data, relativePath);
             const physicalType = inferType({ ...data, type: undefined }, relativePath);
             const runbook = flow ? null : parseRunbookDoc(data, body, relativePath);
-            const title = flow?.name ?? extractTitle(data, body);
+            const schemaDoc = inferredType === 'schema' ? parseSchemaDoc(content, relativePath) : null;
+            const title = flow?.name ?? schemaDoc?.title ?? extractTitle(data, body);
             const phase = typeof data.phase === 'string' ? data.phase : inferPhase(relativePath);
             const type = flow?.type ?? (runbook ? 'runbook' : inferredType);
             const tags = flow ? flow.tags : (Array.isArray(data.tags) ? data.tags.map(String) : []);
-            const summary = flow?.description ?? runbook?.capability ?? extractSummary(data, body);
+            const summary = flow?.description ?? schemaDoc?.capability ?? runbook?.capability ?? extractSummary(data, body);
             const dependencies = extractMentions(content);
             // Discovery metadata (#1214, #1540, #1792) — meaningful for operational
             // AIWG artifact kinds. Kept undefined on document types so the index file
@@ -877,10 +913,10 @@ export async function buildIndex(cwd, options = {}) {
             // Declarative processes have no trigger phrases — they rely on their
             // capability and structure-aware search terms.
             const triggers = isDiscoverable && !flow ? extractTriggers(body, data) : undefined;
-            const capability = flow?.capability ?? runbook?.capability ?? (isDiscoverable ? extractCapability(data, body) : undefined);
+            const capability = flow?.capability ?? schemaDoc?.capability ?? runbook?.capability ?? (isDiscoverable ? extractCapability(data, body) : undefined);
             const kind = flow?.kind ?? runbook?.kind;
             const sourceType = runbook && physicalType !== 'runbook' ? physicalType : undefined;
-            const searchTerms = flow?.searchTerms ?? runbook?.searchTerms;
+            const searchTerms = flow?.searchTerms ?? schemaDoc?.searchTerms ?? runbook?.searchTerms;
             const kernel = data.kernel === true || data.kernel === 'true' ? true : undefined;
             // Script entrypoint metadata is meaningful for skills only (#1227).
             const script = type === 'skill' ? extractSkillScript(data) : undefined;
@@ -889,7 +925,7 @@ export async function buildIndex(cwd, options = {}) {
             // Canonical short name (#1233) — used by the scorer to floor exact-name
             // queries to 1.0 so hyphenated kernel-skill names like `aiwg-doctor`
             // remain searchable even when the rendered title strips the hyphen.
-            const name = flow ? flow.name : (isDiscoverable ? extractCanonicalName(data, relativePath) : undefined);
+            const name = flow ? flow.name : schemaDoc?.name ?? (isDiscoverable ? extractCanonicalName(data, relativePath) : undefined);
             entry = {
                 path: relativePath,
                 type,

package/dist/src/artifacts/query-engine.js

@@ -174,7 +174,7 @@ const SCORE_STOPWORDS = new Set([
     'handle', 'handles', 'handling',
     // AIWG meta-type nouns — zero discriminating signal in a discover query
     'aiwg', 'skill', 'skills', 'agent', 'agents', 'command', 'commands',
-    'rule', 'rules', 'flow', 'flows', 'workflow', 'workflows',
+    'rule', 'rules', 'schema', 'schemas', 'flow', 'flows', 'workflow', 'workflows',
 ]);
 /**
  * Tokenize a query phrase into lowercased keywords for multi-word

package/dist/src/artifacts/types.js

@@ -24,6 +24,7 @@ export const OPERATIONAL_DISCOVERY_TYPES = [
     'agent',
     'command',
     'rule',
+    'schema',
     'flow',
     'runbook',
     'template',

package/dist/src/cli/handlers/index.js

@@ -38,6 +38,7 @@ import { packagesHandler } from './packages.js';
 import { marketplaceHandler } from './marketplace.js';
 import { initHandler } from './init.js';
 import { setupHandler } from './setup.js';
+import { setupGenerateHandler, setupRunHandler, setupValidateHandler } from './setup-manifest.js';
 import { runHandler } from './run.js';
 import { stewardHandler, stewardHandlers } from './steward.js';
 import { serveHandler } from './serve.js';
@@ -61,7 +62,7 @@ export {
 // Maintenance
 helpHandler, versionHandler, doctorHandler, updateHandler, refreshHandler, regenerateHandler, workspaceContextHandler, 
 // Framework management
-useHandler, listHandler, removeHandler, promoteHandler, installHandler, packagesHandler, marketplaceHandler, initHandler, setupHandler, issueHandler, issueAuditHandler, runHandler, 
+useHandler, listHandler, removeHandler, promoteHandler, installHandler, packagesHandler, marketplaceHandler, initHandler, setupHandler, setupGenerateHandler, setupRunHandler, setupValidateHandler, issueHandler, issueAuditHandler, runHandler, 
 // Project
 newBundleHandler, quickrefHandler, newProjectHandler, sessionHandler, sessionsHandler, 
 // Workspace
@@ -132,6 +133,9 @@ export const allHandlers = [
     newProjectHandler,
     initHandler,
     setupHandler,
+    setupGenerateHandler,
+    setupRunHandler,
+    setupValidateHandler,
     issueHandler,
     issueAuditHandler,
     runHandler,