@aiwg/cli 2026.7.21 → 2026.7.24

package/dist/src/cli/handlers/use.js

@@ -576,7 +576,7 @@ function printSessionReloadNotice(provider) {
  *
  * @implements #609
  */
-async function countDeployedArtifacts(target, paths) {
+async function countDeployedArtifacts(target, paths, provider) {
     const countMd = async (dir) => {
         if (!dir)
             return 0;
@@ -633,13 +633,11 @@ async function countDeployedArtifacts(target, paths) {
         }
     };
     // Kernel skills deploy to the platform-native skills dir (always-loaded
-    // set) while standard skills sequester under <provider>/.aiwg/skills (the
-    // index-driven discovery tier). Both contribute to the deployed surface,
-    // so both must be counted (#1228). Derive the kernel path by stripping
-    // the `.aiwg/` segment from the standard path.
-    const kernelSkillsPath = paths.skills
-        ? paths.skills.replace(/(^|\/)\.aiwg\/skills?$/, '$1skills')
-        : '';
+    // set) while standard skills may sequester under <provider>/.aiwg/skills.
+    // Count the provider-declared kernel path directly; deriving it by stripping
+    // `.aiwg/` from the standard path produced `.codex/skills` instead of
+    // Codex's native `.agents/skills` path (#766).
+    const kernelSkillsPath = provider ? getProviderKernelSkillsPath(provider) : '';
     return {
         agents: await countMd(paths.agents),
         commands: await countMd(paths.commands),
@@ -785,6 +783,117 @@ async function countBundleSourceArtifacts(bundlePath) {
         rules: await countMd('rules'),
     };
 }
+async function fileExists(filePath) {
+    try {
+        await fs.access(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function resolveDeployPath(target, deployPath) {
+    return path.isAbsolute(deployPath) ? deployPath : path.join(target, deployPath);
+}
+async function listBundleMdStems(bundlePath, subdir) {
+    try {
+        const entries = await fs.readdir(path.join(bundlePath, subdir));
+        return entries
+            .filter(entry => entry.endsWith('.md'))
+            .map(entry => path.basename(entry, '.md'));
+    }
+    catch {
+        return [];
+    }
+}
+async function countDeployedBundleFiles(bundlePath, subdir, target, deployPath, extensions) {
+    if (!deployPath)
+        return 0;
+    const stems = await listBundleMdStems(bundlePath, subdir);
+    if (stems.length === 0)
+        return 0;
+    const destDir = resolveDeployPath(target, deployPath);
+    let count = 0;
+    for (const stem of stems) {
+        for (const ext of extensions) {
+            if (await fileExists(path.join(destDir, `${stem}${ext}`))) {
+                count++;
+                break;
+            }
+        }
+    }
+    return count;
+}
+async function listBundleSkillNameCandidates(bundlePath) {
+    const skillsRoot = path.join(bundlePath, 'skills');
+    try {
+        const entries = await fs.readdir(skillsRoot, { withFileTypes: true });
+        const candidates = [];
+        for (const entry of entries) {
+            if (!entry.isDirectory())
+                continue;
+            const sourceName = entry.name;
+            const skillMd = path.join(skillsRoot, sourceName, 'SKILL.md');
+            let deployedName = sourceName;
+            try {
+                const content = await fs.readFile(skillMd, 'utf-8');
+                const match = content.match(/^---\s*\n([\s\S]*?)\n---/);
+                if (match) {
+                    const parsed = YAML.parse(match[1]);
+                    if (typeof parsed?.name === 'string' && parsed.name.trim()) {
+                        deployedName = parsed.name.trim();
+                    }
+                }
+            }
+            catch {
+                // Missing or invalid frontmatter still leaves the source dir name as
+                // the best deployed-name approximation for providers that copy dirs.
+            }
+            candidates.push([...new Set([deployedName, sourceName])]);
+        }
+        return candidates;
+    }
+    catch {
+        return [];
+    }
+}
+async function countDeployedBundleSkills(bundlePath, target, provider, paths) {
+    const skillCandidates = await listBundleSkillNameCandidates(bundlePath);
+    if (skillCandidates.length === 0)
+        return 0;
+    const candidateDirs = [
+        paths.skills,
+        getProviderKernelSkillsPath(provider),
+    ]
+        .filter(Boolean)
+        .map(dir => resolveDeployPath(target, dir));
+    const uniqueCandidateDirs = [...new Set(candidateDirs)];
+    let count = 0;
+    for (const names of skillCandidates) {
+        let found = false;
+        for (const dir of uniqueCandidateDirs) {
+            for (const name of names) {
+                if (!(await fileExists(path.join(dir, name, 'SKILL.md'))))
+                    continue;
+                count++;
+                found = true;
+                break;
+            }
+            if (found)
+                break;
+        }
+    }
+    return count;
+}
+async function countBundleDeployedArtifacts(bundlePath, target, provider) {
+    const paths = getProviderPaths(provider);
+    return {
+        agents: await countDeployedBundleFiles(bundlePath, 'agents', target, paths.agents, ['.md', '.toml']),
+        commands: await countDeployedBundleFiles(bundlePath, 'commands', target, paths.commands, ['.md']),
+        skills: await countDeployedBundleSkills(bundlePath, target, provider, paths),
+        rules: await countDeployedBundleFiles(bundlePath, 'rules', target, paths.rules, ['.md', '.mdc']),
+    };
+}
 /**
  * Deploy a single project-local bundle to one provider via deploy-agents.mjs.
  * Runs the same script and flags used for upstream addons, with the bundle
@@ -794,8 +903,8 @@ async function countBundleSourceArtifacts(bundlePath) {
  */
 async function deployOneProjectLocalBundle(opts) {
     const { bundle, ctx, frameworkRoot, provider, target, dryRun, verbose, quiet, modelArgs } = opts;
-    const counts = await countBundleSourceArtifacts(bundle.artifactPath);
-    const artifactTotal = counts.agents + counts.commands + counts.skills + counts.rules;
+    const sourceCounts = await countBundleSourceArtifacts(bundle.artifactPath);
+    const artifactTotal = sourceCounts.agents + sourceCounts.commands + sourceCounts.skills + sourceCounts.rules;
     let cliCommandCount = 0;
     try {
         const contribution = await loadCliCommandsContribution(bundle.artifactPath);
@@ -803,14 +912,14 @@ async function deployOneProjectLocalBundle(opts) {
     }
     catch (error) {
         ui.warn(`Invalid CLI contribution for project-local '${bundle.id}': ${error.message}`);
-        return { exitCode: 1, counts };
+        return { exitCode: 1, counts: sourceCounts };
     }
     if (verbose || dryRun) {
-        ui.dim(`  Artifacts: agents=${counts.agents} commands=${counts.commands} skills=${counts.skills} rules=${counts.rules} cli=${cliCommandCount}`);
+        ui.dim(`  Artifacts: agents=${sourceCounts.agents} commands=${sourceCounts.commands} skills=${sourceCounts.skills} rules=${sourceCounts.rules} cli=${cliCommandCount}`);
     }
     if (artifactTotal === 0 && cliCommandCount === 0) {
         ui.warn(`Project-local ${bundle.type} '${bundle.id}' has no deployable agents, commands, skills, rules, or CLI commands at ${bundle.artifactPath}`);
-        return { exitCode: 1, counts };
+        return { exitCode: 1, counts: sourceCounts };
     }
     let exitCode = 0;
     if (artifactTotal > 0) {
@@ -868,8 +977,9 @@ async function deployOneProjectLocalBundle(opts) {
             exitCode = 1;
         }
     }
-    // Approximate counts from the bundle's source dirs (deploy-agents.mjs is
-    // idempotent and copies file-for-file from these dirs)
+    const counts = exitCode === 0 && !dryRun
+        ? await countBundleDeployedArtifacts(bundle.artifactPath, target, provider)
+        : sourceCounts;
     void ctx;
     return { exitCode, counts };
 }
@@ -1865,7 +1975,7 @@ export class UseHandler {
                             provider: providerName,
                             cwd: target,
                         });
-                        const counts = await countDeployedArtifacts(target, paths);
+                        const counts = await countDeployedArtifacts(target, paths, providerName);
                         if (quiet) {
                             ui.blank();
                             if (counts.agents > 0)
@@ -2548,7 +2658,7 @@ export class UseHandler {
         if (quiet) {
             // Count deployed artifacts
             const paths = getProviderPaths(provider);
-            counts = await countDeployedArtifacts(target, paths);
+            counts = await countDeployedArtifacts(target, paths, provider);
             if (counts.agents > 0)
                 ui.deployCount('Agents', counts.agents);
             if (counts.commands > 0)

package/dist/src/config/aiwg-config.js

@@ -12,9 +12,10 @@ import { readFile, writeFile, mkdir, access, readdir, rename, unlink } from 'fs/
 import { createHash, randomBytes } from 'crypto';
 import { resolve, join, isAbsolute } from 'path';
 import { normalizeNamedCaptures } from '../artifacts/index-builder.js';
-import { getProviderDefinition, PROVIDER_IDS, resolveProviderPathValue, } from '../providers/provider-definitions.js';
+import { getProviderDefinition, getProviderKernelSkillPath, PROVIDER_IDS, resolveProviderPathValue, } from '../providers/provider-definitions.js';
 import { validateAuthorization, } from '../policy/authorization.js';
 import { projectAiwgPath, resolveProjectAiwgDir } from './project-artifacts.js';
+import { defaultThreatAssessmentConfig, validateThreatAssessmentConfig, } from '../security/threat-assessment-config.js';
 const CONFIG_FILENAME = 'aiwg.config';
 /**
  * Operations that a workspace may authorize for one member repository.
@@ -633,6 +634,9 @@ export function emptyConfig(providers = ['claude']) {
         providers,
         installed: {},
         scripts: {},
+        security: {
+            threatAssessment: defaultThreatAssessmentConfig(),
+        },
         delivery: {
             mode: 'pr-required',
             default_branch: 'main',
@@ -711,12 +715,20 @@ export async function readAiwgConfig(projectDir) {
     if (authorizationErrors.length > 0) {
         throw new Error(`Invalid .aiwg/aiwg.config:\n${authorizationErrors.map(item => item.message).join('\n')}`);
     }
+    const threatAssessmentErrors = validateThreatAssessmentConfig(parsed.security?.threatAssessment);
+    if (threatAssessmentErrors.length > 0) {
+        throw new Error(`Invalid .aiwg/aiwg.config:\n${threatAssessmentErrors.join('\n')}`);
+    }
     return parsed;
 }
 /**
  * Write aiwg.config, creating the resolved AIWG artifact directory if needed.
  */
 export async function writeAiwgConfig(projectDir, config) {
+    const threatAssessmentErrors = validateThreatAssessmentConfig(config.security?.threatAssessment);
+    if (threatAssessmentErrors.length > 0) {
+        throw new Error(`Invalid .aiwg/aiwg.config:\n${threatAssessmentErrors.join('\n')}`);
+    }
     const dir = resolveProjectAiwgDir(projectDir);
     await mkdir(dir, { recursive: true });
     const filePath = join(dir, CONFIG_FILENAME);
@@ -823,6 +835,7 @@ function getProviderDeployDirs(provider, projectDir) {
     return {
         agents: resolveProviderPathValue(artifacts.agents, projectDir),
         skills: resolveProviderPathValue(artifacts.skills, projectDir),
+        kernelSkills: resolveProviderPathValue(getProviderKernelSkillPath(provider), projectDir),
         commands: resolveProviderPathValue(artifacts.commands, projectDir),
         rules: resolveProviderPathValue(artifacts.rules, projectDir),
     };
@@ -865,7 +878,10 @@ export async function populateDeployedTo(config, projectDir) {
         const counts = {
             agents: await countDeployedInDir(projectDir, dirs.agents, 'md'),
             commands: await countDeployedInDir(projectDir, dirs.commands, 'md'),
-            skills: await countDeployedInDir(projectDir, dirs.skills, 'dirs'),
+            skills: (await countDeployedInDir(projectDir, dirs.skills, 'dirs')) +
+                (dirs.kernelSkills && dirs.kernelSkills !== dirs.skills
+                    ? await countDeployedInDir(projectDir, dirs.kernelSkills, 'dirs')
+                    : 0),
             rules: await countDeployedInDir(projectDir, dirs.rules, 'md'),
         };
         // Only populate if at least one artifact type is present

package/dist/src/config/cli.js

@@ -152,6 +152,7 @@ const ENUM_RULES = {
     'remotes.tracker_actor.via': ['tea', 'gh', 'mcp', 'api'],
     'remotes.transport.protocol': ['ssh', 'https'],
     'repo_maintainer.tiers.local': ['collaborator', 'maintainer', 'admin'],
+    'security.threatAssessment.mode': ['off', 'audit', 'enforce'],
 };
 const BOOLEAN_FIELDS = new Set([
     'delivery.delete_branch_on_merge',
@@ -214,15 +215,17 @@ async function projectConfigSet(key, raw, args) {
     }
     // Coerce booleans for known boolean fields
     let value = raw;
-    if (/^externalLinks\.[^.]+$/.test(key)) {
+    if (/^externalLinks\.[^.]+$/.test(key) || key === 'security.threatAssessment') {
         try {
             value = JSON.parse(raw);
         }
         catch {
             throw new AiwgError({
                 code: 'ERR_INVALID_VALUE',
-                message: `${key} must be a JSON object containing label and url`,
-                hint: `Try: aiwg config set --project ${key} '{"label":"Project docs","url":"https://example.com/docs"}'`,
+                message: `${key} must be a valid JSON object`,
+                hint: key === 'security.threatAssessment'
+                    ? `Try: aiwg config set --project ${key} '{"schemaVersion":"1","mode":"audit","defaultProfile":"balanced"}'`
+                    : `Try: aiwg config set --project ${key} '{"label":"Project docs","url":"https://example.com/docs"}'`,
                 exitCode: EXIT_CODES.USAGE,
             });
         }
@@ -285,6 +288,16 @@ async function projectConfigSet(key, raw, args) {
             exitCode: EXIT_CODES.USAGE,
         });
     }
+    const { validateThreatAssessmentConfig } = await import('../security/threat-assessment-config.js');
+    const threatErrors = validateThreatAssessmentConfig(cfg.security?.threatAssessment);
+    if (threatErrors.length > 0) {
+        throw new AiwgError({
+            code: 'ERR_INVALID_VALUE',
+            message: `Invalid threat-assessment configuration: ${threatErrors.join('; ')}`,
+            hint: 'Use a built-in profile or correct the referenced profile, rule pack, threshold, or regex.',
+            exitCode: EXIT_CODES.USAGE,
+        });
+    }
     await writeAiwgConfig(projectDir, cfg);
     console.log(`Set --project ${key} = ${raw}`);
 }

package/dist/src/extensions/commands/definitions.js

@@ -593,6 +593,102 @@ export const setupCommand = {
         },
     },
 };
+export const setupGenerateCommand = {
+    id: 'setup-generate',
+    type: 'skill',
+    name: 'Setup Generate',
+    description: 'Generate starter setup.aiwg.io/v1 SetupManifest assets for agentic installer automation',
+    version: '1.0.0',
+    capabilities: ['cli', 'project', 'setup', 'setup-manifest', 'agentic-installer', 'generation', 'automation'],
+    keywords: ['setup-generate', 'setup generate', 'SetupManifest', 'setup.aiwg.io/v1', 'agentic-installer', 'manifest generation', 'starter manifest'],
+    category: 'project',
+    platforms: {
+        claude: 'full',
+        generic: 'full',
+    },
+    deployment: {
+        pathTemplate: '.{platform}/commands/{id}.md',
+        core: true,
+    },
+    metadata: {
+        type: 'skill',
+        triggerPhrases: [
+            'generate setup manifest',
+            'create setup.manifest.yaml',
+            'setup-generate',
+            'scaffold installer manifest',
+        ],
+        commandHint: {
+            template: 'utility',
+            argumentHint: '[--output <path>] [--name <name>] [--type user|developer|ci] [--platform <os>] [--force] [--json]',
+            allowedTools: ['Read', 'Write', 'Bash'],
+        },
+    },
+};
+export const setupValidateCommand = {
+    id: 'setup-validate',
+    type: 'skill',
+    name: 'Setup Validate',
+    description: 'Validate setup.aiwg.io/v1 SetupManifest files against the canonical schema and installer consistency checks',
+    version: '1.0.0',
+    capabilities: ['cli', 'project', 'setup', 'setup-manifest', 'agentic-installer', 'validation', 'schema'],
+    keywords: ['setup-validate', 'setup validate', 'SetupManifest', 'setup.aiwg.io/v1', 'agentic-installer', 'manifest validation', 'schema validation', 'installer consistency'],
+    category: 'project',
+    platforms: {
+        claude: 'full',
+        generic: 'full',
+    },
+    deployment: {
+        pathTemplate: '.{platform}/commands/{id}.md',
+        core: true,
+    },
+    metadata: {
+        type: 'skill',
+        triggerPhrases: [
+            'validate setup manifest',
+            'check setup.manifest.yaml',
+            'setup-validate',
+            'lint installer manifest',
+        ],
+        commandHint: {
+            template: 'utility',
+            argumentHint: '[manifest-path] [--manifest <path>] [--strict] [--fix] [--json]',
+            allowedTools: ['Read', 'Bash'],
+        },
+    },
+};
+export const setupRunCommand = {
+    id: 'setup-run',
+    type: 'skill',
+    name: 'Setup Run',
+    description: 'Validate and execute setup.aiwg.io/v1 SetupManifest files with installer safety gates',
+    version: '1.0.0',
+    capabilities: ['cli', 'project', 'setup', 'setup-manifest', 'agentic-installer', 'installer', 'dry-run'],
+    keywords: ['setup-run', 'setup run', 'SetupManifest', 'setup.aiwg.io/v1', 'agentic-installer', 'installer runner', 'dry run', 'recovery', 'params'],
+    category: 'project',
+    platforms: {
+        claude: 'full',
+        generic: 'full',
+    },
+    deployment: {
+        pathTemplate: '.{platform}/commands/{id}.md',
+        core: true,
+    },
+    metadata: {
+        type: 'skill',
+        triggerPhrases: [
+            'run setup manifest',
+            'execute installer manifest',
+            'setup-run',
+            'run dev setup',
+        ],
+        commandHint: {
+            template: 'utility',
+            argumentHint: '[manifest-path] [--manifest <path>] [--dry-run] [--platform <os>] [--params-file <path>] [--param KEY=VALUE] [--step <id>] [--skip <ids>] [--yes]',
+            allowedTools: ['Read', 'Bash'],
+        },
+    },
+};
 export const issueCommand = {
     id: 'issue',
     type: 'skill',
@@ -3362,6 +3458,9 @@ export const commandDefinitions = [
     newCommand,
     initCommand,
     setupCommand,
+    setupGenerateCommand,
+    setupValidateCommand,
+    setupRunCommand,
     issueCommand,
     issueAuditCommand,
     addressIssuesCommand,