@aiwg/cli 2026.7.23 → 2026.7.25

package/dist/src/cli/handlers/use.js

@@ -576,7 +576,7 @@ function printSessionReloadNotice(provider) {
  *
  * @implements #609
  */
-async function countDeployedArtifacts(target, paths) {
+async function countDeployedArtifacts(target, paths, provider) {
     const countMd = async (dir) => {
         if (!dir)
             return 0;
@@ -633,13 +633,11 @@ async function countDeployedArtifacts(target, paths) {
         }
     };
     // Kernel skills deploy to the platform-native skills dir (always-loaded
-    // set) while standard skills sequester under <provider>/.aiwg/skills (the
-    // index-driven discovery tier). Both contribute to the deployed surface,
-    // so both must be counted (#1228). Derive the kernel path by stripping
-    // the `.aiwg/` segment from the standard path.
-    const kernelSkillsPath = paths.skills
-        ? paths.skills.replace(/(^|\/)\.aiwg\/skills?$/, '$1skills')
-        : '';
+    // set) while standard skills may sequester under <provider>/.aiwg/skills.
+    // Count the provider-declared kernel path directly; deriving it by stripping
+    // `.aiwg/` from the standard path produced `.codex/skills` instead of
+    // Codex's native `.agents/skills` path (#766).
+    const kernelSkillsPath = provider ? getProviderKernelSkillsPath(provider) : '';
     return {
         agents: await countMd(paths.agents),
         commands: await countMd(paths.commands),
@@ -785,6 +783,117 @@ async function countBundleSourceArtifacts(bundlePath) {
         rules: await countMd('rules'),
     };
 }
+async function fileExists(filePath) {
+    try {
+        await fs.access(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function resolveDeployPath(target, deployPath) {
+    return path.isAbsolute(deployPath) ? deployPath : path.join(target, deployPath);
+}
+async function listBundleMdStems(bundlePath, subdir) {
+    try {
+        const entries = await fs.readdir(path.join(bundlePath, subdir));
+        return entries
+            .filter(entry => entry.endsWith('.md'))
+            .map(entry => path.basename(entry, '.md'));
+    }
+    catch {
+        return [];
+    }
+}
+async function countDeployedBundleFiles(bundlePath, subdir, target, deployPath, extensions) {
+    if (!deployPath)
+        return 0;
+    const stems = await listBundleMdStems(bundlePath, subdir);
+    if (stems.length === 0)
+        return 0;
+    const destDir = resolveDeployPath(target, deployPath);
+    let count = 0;
+    for (const stem of stems) {
+        for (const ext of extensions) {
+            if (await fileExists(path.join(destDir, `${stem}${ext}`))) {
+                count++;
+                break;
+            }
+        }
+    }
+    return count;
+}
+async function listBundleSkillNameCandidates(bundlePath) {
+    const skillsRoot = path.join(bundlePath, 'skills');
+    try {
+        const entries = await fs.readdir(skillsRoot, { withFileTypes: true });
+        const candidates = [];
+        for (const entry of entries) {
+            if (!entry.isDirectory())
+                continue;
+            const sourceName = entry.name;
+            const skillMd = path.join(skillsRoot, sourceName, 'SKILL.md');
+            let deployedName = sourceName;
+            try {
+                const content = await fs.readFile(skillMd, 'utf-8');
+                const match = content.match(/^---\s*\n([\s\S]*?)\n---/);
+                if (match) {
+                    const parsed = YAML.parse(match[1]);
+                    if (typeof parsed?.name === 'string' && parsed.name.trim()) {
+                        deployedName = parsed.name.trim();
+                    }
+                }
+            }
+            catch {
+                // Missing or invalid frontmatter still leaves the source dir name as
+                // the best deployed-name approximation for providers that copy dirs.
+            }
+            candidates.push([...new Set([deployedName, sourceName])]);
+        }
+        return candidates;
+    }
+    catch {
+        return [];
+    }
+}
+async function countDeployedBundleSkills(bundlePath, target, provider, paths) {
+    const skillCandidates = await listBundleSkillNameCandidates(bundlePath);
+    if (skillCandidates.length === 0)
+        return 0;
+    const candidateDirs = [
+        paths.skills,
+        getProviderKernelSkillsPath(provider),
+    ]
+        .filter(Boolean)
+        .map(dir => resolveDeployPath(target, dir));
+    const uniqueCandidateDirs = [...new Set(candidateDirs)];
+    let count = 0;
+    for (const names of skillCandidates) {
+        let found = false;
+        for (const dir of uniqueCandidateDirs) {
+            for (const name of names) {
+                if (!(await fileExists(path.join(dir, name, 'SKILL.md'))))
+                    continue;
+                count++;
+                found = true;
+                break;
+            }
+            if (found)
+                break;
+        }
+    }
+    return count;
+}
+async function countBundleDeployedArtifacts(bundlePath, target, provider) {
+    const paths = getProviderPaths(provider);
+    return {
+        agents: await countDeployedBundleFiles(bundlePath, 'agents', target, paths.agents, ['.md', '.toml']),
+        commands: await countDeployedBundleFiles(bundlePath, 'commands', target, paths.commands, ['.md']),
+        skills: await countDeployedBundleSkills(bundlePath, target, provider, paths),
+        rules: await countDeployedBundleFiles(bundlePath, 'rules', target, paths.rules, ['.md', '.mdc']),
+    };
+}
 /**
  * Deploy a single project-local bundle to one provider via deploy-agents.mjs.
  * Runs the same script and flags used for upstream addons, with the bundle
@@ -794,8 +903,8 @@ async function countBundleSourceArtifacts(bundlePath) {
  */
 async function deployOneProjectLocalBundle(opts) {
     const { bundle, ctx, frameworkRoot, provider, target, dryRun, verbose, quiet, modelArgs } = opts;
-    const counts = await countBundleSourceArtifacts(bundle.artifactPath);
-    const artifactTotal = counts.agents + counts.commands + counts.skills + counts.rules;
+    const sourceCounts = await countBundleSourceArtifacts(bundle.artifactPath);
+    const artifactTotal = sourceCounts.agents + sourceCounts.commands + sourceCounts.skills + sourceCounts.rules;
     let cliCommandCount = 0;
     try {
         const contribution = await loadCliCommandsContribution(bundle.artifactPath);
@@ -803,14 +912,14 @@ async function deployOneProjectLocalBundle(opts) {
     }
     catch (error) {
         ui.warn(`Invalid CLI contribution for project-local '${bundle.id}': ${error.message}`);
-        return { exitCode: 1, counts };
+        return { exitCode: 1, counts: sourceCounts };
     }
     if (verbose || dryRun) {
-        ui.dim(`  Artifacts: agents=${counts.agents} commands=${counts.commands} skills=${counts.skills} rules=${counts.rules} cli=${cliCommandCount}`);
+        ui.dim(`  Artifacts: agents=${sourceCounts.agents} commands=${sourceCounts.commands} skills=${sourceCounts.skills} rules=${sourceCounts.rules} cli=${cliCommandCount}`);
     }
     if (artifactTotal === 0 && cliCommandCount === 0) {
         ui.warn(`Project-local ${bundle.type} '${bundle.id}' has no deployable agents, commands, skills, rules, or CLI commands at ${bundle.artifactPath}`);
-        return { exitCode: 1, counts };
+        return { exitCode: 1, counts: sourceCounts };
     }
     let exitCode = 0;
     if (artifactTotal > 0) {
@@ -868,8 +977,9 @@ async function deployOneProjectLocalBundle(opts) {
             exitCode = 1;
         }
     }
-    // Approximate counts from the bundle's source dirs (deploy-agents.mjs is
-    // idempotent and copies file-for-file from these dirs)
+    const counts = exitCode === 0 && !dryRun
+        ? await countBundleDeployedArtifacts(bundle.artifactPath, target, provider)
+        : sourceCounts;
     void ctx;
     return { exitCode, counts };
 }
@@ -1865,7 +1975,7 @@ export class UseHandler {
                             provider: providerName,
                             cwd: target,
                         });
-                        const counts = await countDeployedArtifacts(target, paths);
+                        const counts = await countDeployedArtifacts(target, paths, providerName);
                         if (quiet) {
                             ui.blank();
                             if (counts.agents > 0)
@@ -2548,7 +2658,7 @@ export class UseHandler {
         if (quiet) {
             // Count deployed artifacts
             const paths = getProviderPaths(provider);
-            counts = await countDeployedArtifacts(target, paths);
+            counts = await countDeployedArtifacts(target, paths, provider);
             if (counts.agents > 0)
                 ui.deployCount('Agents', counts.agents);
             if (counts.commands > 0)

package/dist/src/config/aiwg-config.js

@@ -12,7 +12,7 @@ import { readFile, writeFile, mkdir, access, readdir, rename, unlink } from 'fs/
 import { createHash, randomBytes } from 'crypto';
 import { resolve, join, isAbsolute } from 'path';
 import { normalizeNamedCaptures } from '../artifacts/index-builder.js';
-import { getProviderDefinition, PROVIDER_IDS, resolveProviderPathValue, } from '../providers/provider-definitions.js';
+import { getProviderDefinition, getProviderKernelSkillPath, PROVIDER_IDS, resolveProviderPathValue, } from '../providers/provider-definitions.js';
 import { validateAuthorization, } from '../policy/authorization.js';
 import { projectAiwgPath, resolveProjectAiwgDir } from './project-artifacts.js';
 import { defaultThreatAssessmentConfig, validateThreatAssessmentConfig, } from '../security/threat-assessment-config.js';
@@ -835,6 +835,7 @@ function getProviderDeployDirs(provider, projectDir) {
     return {
         agents: resolveProviderPathValue(artifacts.agents, projectDir),
         skills: resolveProviderPathValue(artifacts.skills, projectDir),
+        kernelSkills: resolveProviderPathValue(getProviderKernelSkillPath(provider), projectDir),
         commands: resolveProviderPathValue(artifacts.commands, projectDir),
         rules: resolveProviderPathValue(artifacts.rules, projectDir),
     };
@@ -877,7 +878,10 @@ export async function populateDeployedTo(config, projectDir) {
         const counts = {
             agents: await countDeployedInDir(projectDir, dirs.agents, 'md'),
             commands: await countDeployedInDir(projectDir, dirs.commands, 'md'),
-            skills: await countDeployedInDir(projectDir, dirs.skills, 'dirs'),
+            skills: (await countDeployedInDir(projectDir, dirs.skills, 'dirs')) +
+                (dirs.kernelSkills && dirs.kernelSkills !== dirs.skills
+                    ? await countDeployedInDir(projectDir, dirs.kernelSkills, 'dirs')
+                    : 0),
             rules: await countDeployedInDir(projectDir, dirs.rules, 'md'),
         };
         // Only populate if at least one artifact type is present

package/dist/src/extensions/commands/definitions.js

@@ -593,6 +593,102 @@ export const setupCommand = {
         },
     },
 };
+export const setupGenerateCommand = {
+    id: 'setup-generate',
+    type: 'skill',
+    name: 'Setup Generate',
+    description: 'Generate starter setup.aiwg.io/v1 SetupManifest assets for agentic installer automation',
+    version: '1.0.0',
+    capabilities: ['cli', 'project', 'setup', 'setup-manifest', 'agentic-installer', 'generation', 'automation'],
+    keywords: ['setup-generate', 'setup generate', 'SetupManifest', 'setup.aiwg.io/v1', 'agentic-installer', 'manifest generation', 'starter manifest'],
+    category: 'project',
+    platforms: {
+        claude: 'full',
+        generic: 'full',
+    },
+    deployment: {
+        pathTemplate: '.{platform}/commands/{id}.md',
+        core: true,
+    },
+    metadata: {
+        type: 'skill',
+        triggerPhrases: [
+            'generate setup manifest',
+            'create setup.manifest.yaml',
+            'setup-generate',
+            'scaffold installer manifest',
+        ],
+        commandHint: {
+            template: 'utility',
+            argumentHint: '[--output <path>] [--name <name>] [--type user|developer|ci] [--platform <os>] [--force] [--json]',
+            allowedTools: ['Read', 'Write', 'Bash'],
+        },
+    },
+};
+export const setupValidateCommand = {
+    id: 'setup-validate',
+    type: 'skill',
+    name: 'Setup Validate',
+    description: 'Validate setup.aiwg.io/v1 SetupManifest files against the canonical schema and installer consistency checks',
+    version: '1.0.0',
+    capabilities: ['cli', 'project', 'setup', 'setup-manifest', 'agentic-installer', 'validation', 'schema'],
+    keywords: ['setup-validate', 'setup validate', 'SetupManifest', 'setup.aiwg.io/v1', 'agentic-installer', 'manifest validation', 'schema validation', 'installer consistency'],
+    category: 'project',
+    platforms: {
+        claude: 'full',
+        generic: 'full',
+    },
+    deployment: {
+        pathTemplate: '.{platform}/commands/{id}.md',
+        core: true,
+    },
+    metadata: {
+        type: 'skill',
+        triggerPhrases: [
+            'validate setup manifest',
+            'check setup.manifest.yaml',
+            'setup-validate',
+            'lint installer manifest',
+        ],
+        commandHint: {
+            template: 'utility',
+            argumentHint: '[manifest-path] [--manifest <path>] [--strict] [--fix] [--json]',
+            allowedTools: ['Read', 'Bash'],
+        },
+    },
+};
+export const setupRunCommand = {
+    id: 'setup-run',
+    type: 'skill',
+    name: 'Setup Run',
+    description: 'Validate and execute setup.aiwg.io/v1 SetupManifest files with installer safety gates',
+    version: '1.0.0',
+    capabilities: ['cli', 'project', 'setup', 'setup-manifest', 'agentic-installer', 'installer', 'dry-run'],
+    keywords: ['setup-run', 'setup run', 'SetupManifest', 'setup.aiwg.io/v1', 'agentic-installer', 'installer runner', 'dry run', 'recovery', 'params'],
+    category: 'project',
+    platforms: {
+        claude: 'full',
+        generic: 'full',
+    },
+    deployment: {
+        pathTemplate: '.{platform}/commands/{id}.md',
+        core: true,
+    },
+    metadata: {
+        type: 'skill',
+        triggerPhrases: [
+            'run setup manifest',
+            'execute installer manifest',
+            'setup-run',
+            'run dev setup',
+        ],
+        commandHint: {
+            template: 'utility',
+            argumentHint: '[manifest-path] [--manifest <path>] [--dry-run] [--platform <os>] [--params-file <path>] [--param KEY=VALUE] [--step <id>] [--skip <ids>] [--yes]',
+            allowedTools: ['Read', 'Bash'],
+        },
+    },
+};
 export const issueCommand = {
     id: 'issue',
     type: 'skill',
@@ -3362,6 +3458,9 @@ export const commandDefinitions = [
     newCommand,
     initCommand,
     setupCommand,
+    setupGenerateCommand,
+    setupValidateCommand,
+    setupRunCommand,
     issueCommand,
     issueAuditCommand,
     addressIssuesCommand,

package/dist/src/serve/sandbox-registry.js

@@ -241,6 +241,35 @@ export function normalizeSandboxEvent(raw) {
  * Matches the sandbox's 5 s retry interval — suppressess flicker on rapid restarts.
  */
 const DEBOUNCE_MS = 5_000;
+function safeTrustRef(value) {
+    const ref = typeof value === 'string' ? value.trim() : '';
+    if (!ref)
+        return undefined;
+    if (/-----BEGIN|PRIVATE KEY|TOKEN|SECRET|PASSWORD|[\r\n]/i.test(ref))
+        return '[redacted]';
+    return ref.slice(0, 160);
+}
+function sanitizeTrustPosture(posture) {
+    if (!posture || typeof posture !== 'object')
+        return undefined;
+    const status = ['secure', 'degraded', 'disabled', 'unknown'].includes(String(posture.status))
+        ? posture.status
+        : 'unknown';
+    return {
+        status,
+        mode: safeTrustRef(posture.mode),
+        ca_provider_ref: safeTrustRef(posture.ca_provider_ref),
+        trust_bundle_ref: safeTrustRef(posture.trust_bundle_ref),
+        client_identity_ref: safeTrustRef(posture.client_identity_ref),
+        rotation_state: safeTrustRef(posture.rotation_state),
+        expires_at: safeTrustRef(posture.expires_at),
+        trust_bundle_fresh: posture.trust_bundle_fresh,
+        missing_required_material: Array.isArray(posture.missing_required_material)
+            ? posture.missing_required_material.map((item) => safeTrustRef(item)).filter((item) => Boolean(item))
+            : undefined,
+        recovery: safeTrustRef(posture.recovery),
+    };
+}
 export class SandboxRegistry {
     sandboxes = new Map();
     hitlRequests = new Map();
@@ -336,6 +365,9 @@ export class SandboxRegistry {
                     if (req.ws_capabilities) {
                         existing.wsCapabilities = req.ws_capabilities;
                     }
+                    if (req.trust_posture) {
+                        existing.trustPosture = sanitizeTrustPosture(req.trust_posture);
+                    }
                     this.lastRegistrationTime.set(instanceId, now);
                     return { sandbox_id: existingId, token: existing.token };
                 }
@@ -370,6 +402,7 @@ export class SandboxRegistry {
             agents: new Map(),
             sandboxInventory,
             wsCapabilities: req.ws_capabilities,
+            trustPosture: sanitizeTrustPosture(req.trust_posture),
         };
         this.sandboxes.set(id, registration);
         if (instanceId) {
@@ -825,6 +858,7 @@ function toSummary(s) {
         agents: [...s.agents.values()],
         sandboxInventory: s.sandboxInventory,
         wsCapabilities: s.wsCapabilities,
+        trustPosture: s.trustPosture,
     };
 }
 // Singleton instance

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwg/cli",
-  "version": "2026.7.23",
+  "version": "2026.7.25",
   "description": "Lightweight AIWG CLI for signed, versioned web-backed resources.",
   "type": "module",
   "license": "MIT",