@aiwg/cli 2026.8.0 → 2026.8.1

package/dist/src/auth/credential-store.js

@@ -0,0 +1,141 @@
+import { spawn } from "node:child_process";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+export const defaultCommandRunner = (command, args, stdin = "") => new Promise((resolve, reject) => {
+    const child = spawn(command, args, { stdio: ["pipe", "pipe", "pipe"], windowsHide: true });
+    const stdout = [];
+    const stderr = [];
+    let outputBytes = 0;
+    const collect = (target, chunk) => {
+        outputBytes += chunk.length;
+        if (outputBytes > 1024 * 1024)
+            child.kill();
+        else
+            target.push(chunk);
+    };
+    child.stdout.on("data", (chunk) => collect(stdout, chunk));
+    child.stderr.on("data", (chunk) => collect(stderr, chunk));
+    child.once("error", reject);
+    child.once("close", (code) => resolve({
+        stdout: Buffer.concat(stdout).toString("utf8"),
+        stderr: Buffer.concat(stderr).toString("utf8"),
+        exitCode: code ?? 1,
+    }));
+    child.stdin.end(stdin);
+});
+function parseCredentials(raw) {
+    const value = JSON.parse(raw);
+    if (!value.accessToken?.startsWith("aiwg_at_") || !value.refreshToken?.startsWith("aiwg_rt_")
+        || value.tokenType !== "Bearer" || !Array.isArray(value.scope) || !value.expiresAt) {
+        throw new Error("stored AIWG credentials are invalid");
+    }
+    return value;
+}
+const SERVICE = "releases.aiwg.io";
+const ACCOUNT = "aiwg-cli";
+class NativeCredentialStore {
+    run;
+    constructor(run = defaultCommandRunner) {
+        this.run = run;
+    }
+    parse(raw) { return parseCredentials(raw.trim()); }
+}
+export class MacOsKeychainStore extends NativeCredentialStore {
+    metadata = { provider: "macos-keychain", location: `Keychain:${SERVICE}/${ACCOUNT}` };
+    async load() {
+        const result = await this.run("security", ["find-generic-password", "-a", ACCOUNT, "-s", SERVICE, "-w"]);
+        return result.exitCode === 44 ? null : result.exitCode === 0 ? this.parse(result.stdout) : Promise.reject(new Error("macOS Keychain read failed"));
+    }
+    async save(credentials) {
+        const result = await this.run("security", ["add-generic-password", "-U", "-a", ACCOUNT, "-s", SERVICE, "-w"], JSON.stringify(credentials));
+        if (result.exitCode !== 0)
+            throw new Error("macOS Keychain write failed");
+    }
+    async delete() { await this.run("security", ["delete-generic-password", "-a", ACCOUNT, "-s", SERVICE]); }
+}
+export class LinuxSecretServiceStore extends NativeCredentialStore {
+    metadata = { provider: "linux-secret-service", location: `SecretService:${SERVICE}/${ACCOUNT}` };
+    async load() {
+        const result = await this.run("secret-tool", ["lookup", "service", SERVICE, "account", ACCOUNT]);
+        return result.exitCode === 1 ? null : result.exitCode === 0 ? this.parse(result.stdout) : Promise.reject(new Error("Linux Secret Service read failed"));
+    }
+    async save(credentials) {
+        const result = await this.run("secret-tool", ["store", `--label=AIWG ${SERVICE}`, "service", SERVICE, "account", ACCOUNT], JSON.stringify(credentials));
+        if (result.exitCode !== 0)
+            throw new Error("Linux Secret Service write failed");
+    }
+    async delete() { await this.run("secret-tool", ["clear", "service", SERVICE, "account", ACCOUNT]); }
+}
+const WINDOWS_READ = "$v=New-Object Windows.Security.Credentials.PasswordVault;try{$c=$v.Retrieve('releases.aiwg.io','aiwg-cli');$c.RetrievePassword();[Console]::Out.Write($c.Password)}catch{exit 1}";
+const WINDOWS_WRITE = "$s=[Console]::In.ReadToEnd();$v=New-Object Windows.Security.Credentials.PasswordVault;$v.Add((New-Object Windows.Security.Credentials.PasswordCredential('releases.aiwg.io','aiwg-cli',$s)))";
+const WINDOWS_DELETE = "$v=New-Object Windows.Security.Credentials.PasswordVault;try{$c=$v.Retrieve('releases.aiwg.io','aiwg-cli');$v.Remove($c)}catch{}";
+export class WindowsCredentialManagerStore extends NativeCredentialStore {
+    metadata = { provider: "windows-credential-manager", location: `CredentialManager:${SERVICE}/${ACCOUNT}` };
+    execute(script, stdin = "") { return this.run("powershell.exe", ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script], stdin); }
+    async load() { const result = await this.execute(WINDOWS_READ); return result.exitCode === 1 ? null : result.exitCode === 0 ? this.parse(result.stdout) : Promise.reject(new Error("Windows Credential Manager read failed")); }
+    async save(credentials) { if ((await this.execute(WINDOWS_WRITE, JSON.stringify(credentials))).exitCode !== 0)
+        throw new Error("Windows Credential Manager write failed"); }
+    async delete() { await this.execute(WINDOWS_DELETE); }
+}
+export class FileCredentialStore {
+    pathname;
+    explicitlyAllowed;
+    metadata;
+    constructor(pathname, explicitlyAllowed) {
+        this.pathname = pathname;
+        this.explicitlyAllowed = explicitlyAllowed;
+        this.pathname = path.resolve(pathname);
+        this.metadata = { provider: "file", location: this.pathname };
+    }
+    assertAllowed() { if (!this.explicitlyAllowed)
+        throw new Error("credential file fallback requires --allow-file-store or AIWG_AUTH_ALLOW_FILE_STORE=1"); }
+    async load() {
+        this.assertAllowed();
+        try {
+            const stat = await fs.lstat(this.pathname);
+            if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 0o077) !== 0)
+                throw new Error("credential file must be a non-symlink mode-0600 regular file");
+            return parseCredentials(await fs.readFile(this.pathname, "utf8"));
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return null;
+            throw error;
+        }
+    }
+    async save(credentials) {
+        this.assertAllowed();
+        await fs.mkdir(path.dirname(this.pathname), { recursive: true, mode: 0o700 });
+        const temporary = `${this.pathname}.${process.pid}.tmp`;
+        await fs.writeFile(temporary, `${JSON.stringify(credentials)}\n`, { mode: 0o600, flag: "wx" });
+        await fs.rename(temporary, this.pathname);
+        await fs.chmod(this.pathname, 0o600);
+    }
+    async delete() { this.assertAllowed(); await fs.unlink(this.pathname).catch((error) => { if (error.code !== "ENOENT")
+        throw error; }); }
+}
+export class MemoryCredentialStore {
+    metadata = { provider: "memory", location: "injected-memory-store" };
+    value = null;
+    async load() { return this.value ? structuredClone(this.value) : null; }
+    async save(value) { this.value = structuredClone(value); }
+    async delete() { this.value = null; }
+}
+export function defaultCredentialFile() {
+    const root = process.env.XDG_CONFIG_HOME || (process.platform === "win32" ? process.env.APPDATA : undefined) || path.join(os.homedir(), ".config");
+    return path.join(root, "aiwg", "credentials", "resource-auth.json");
+}
+export function createCredentialStore(options = {}) {
+    if (options.useFile)
+        return new FileCredentialStore(options.pathname || defaultCredentialFile(), options.allowFile === true);
+    const platform = options.platform || process.platform;
+    if (platform === "darwin")
+        return new MacOsKeychainStore(options.runner);
+    if (platform === "win32")
+        return new WindowsCredentialManagerStore(options.runner);
+    if (platform === "linux")
+        return new LinuxSecretServiceStore(options.runner);
+    throw new Error("no native credential store is available; explicitly opt in to the mode-0600 file fallback");
+}
+//# sourceMappingURL=credential-store.js.map

package/dist/src/auth/resource-credentials.js

@@ -0,0 +1,25 @@
+import { explicitResourceToken } from "./config.js";
+import { createCredentialStore } from "./credential-store.js";
+/**
+ * Resolve credentials for protected release downloads. Explicit compatibility
+ * inputs take precedence over interactive-login credentials.
+ */
+export function createResourceCredentialProvider(env = process.env, store) {
+    return async () => {
+        const explicit = explicitResourceToken(env);
+        if (explicit)
+            return explicit;
+        const selected = store ?? createCredentialStore();
+        try {
+            return (await selected.load())?.accessToken ?? null;
+        }
+        catch (error) {
+            // A workstation without the platform keychain helper must retain access
+            // to public releases. Invalid/corrupt stored credentials still fail loud.
+            if (error.code === "ENOENT")
+                return null;
+            throw error;
+        }
+    };
+}
+//# sourceMappingURL=resource-credentials.js.map

package/dist/src/auth/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/channel/manager.mjs

@@ -99,10 +99,10 @@ const DEFAULT_CONFIG = {
  * Get the package root directory.
  *
  * Walks up from this file's directory looking for the nearest package.json
- * that names "aiwg". This works whether this module runs from its source
- * location (`src/channel/manager.mjs`) or from its compiled-build copy
- * (`dist/src/channel/manager.mjs`), both of which have package.json at
- * the repo root.
+ * that names either the full `aiwg` distribution or the lightweight
+ * `@aiwg/cli` distribution. This works whether this module runs from its
+ * source location (`src/channel/manager.mjs`) or from its compiled-build copy
+ * (`dist/src/channel/manager.mjs`).
  *
  * The walk is bounded to 10 levels as a safety cap.
  *
@@ -115,7 +115,7 @@ export function getPackageRoot() {
     if (existsSync(pkg)) {
       try {
         const content = JSON.parse(readFileSync(pkg, 'utf8'));
-        if (content.name === 'aiwg') return dir;
+        if (content.name === 'aiwg' || content.name === '@aiwg/cli') return dir;
       } catch {
         // keep walking
       }

package/dist/src/cli/handlers/auth.js

@@ -0,0 +1,125 @@
+import { AuthClient, defaultBrowserOpener } from "../../auth/client.js";
+import { authConfigFromEnvironment } from "../../auth/config.js";
+import { createCredentialStore } from "../../auth/credential-store.js";
+function usage() {
+    return [
+        "Usage:",
+        "  aiwg auth login [--device] [--device-label <label>] [--store native|file] [--allow-file-store]",
+        "  aiwg auth status [--json] [--store native|file] [--allow-file-store]",
+        "  aiwg auth logout [--all] [--store native|file] [--allow-file-store]",
+        "",
+        "Exit codes: 0 success; 2 invalid usage; 3 not authenticated; 4 authorization denied/expired; 5 credential store unavailable; 6 network/protocol failure.",
+    ].join("\n");
+}
+function value(args, flag) {
+    const index = args.indexOf(flag);
+    if (index < 0)
+        return undefined;
+    const result = args[index + 1];
+    if (!result || result.startsWith("--"))
+        throw new Error(`${flag} requires a value`);
+    return result;
+}
+function classify(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (message === "not_authenticated")
+        return 3;
+    if (/access_denied|expired_token|authorization canceled/.test(message))
+        return 4;
+    if (/credential|Keychain|Secret Service|Credential Manager/.test(message))
+        return 5;
+    return 6;
+}
+export function createAuthHandler(dependencies = {}) {
+    return {
+        id: "auth",
+        name: "Authentication",
+        description: "Log in, inspect access, and log out of paid AIWG web resources",
+        category: "maintenance",
+        aliases: [],
+        async execute(ctx) {
+            if (!ctx.args.length || ["help", "--help", "-h"].includes(ctx.args[0])) {
+                console.log(usage());
+                return { exitCode: 0 };
+            }
+            const [subcommand, ...args] = ctx.args;
+            if (!["login", "status", "logout"].includes(subcommand))
+                return { exitCode: 2, message: usage() };
+            try {
+                const storeMode = value(args, "--store") || "native";
+                if (!["native", "file"].includes(storeMode))
+                    return { exitCode: 2, message: "--store must be native or file" };
+                const allowFile = args.includes("--allow-file-store") || dependencies.env?.AIWG_AUTH_ALLOW_FILE_STORE === "1" || process.env.AIWG_AUTH_ALLOW_FILE_STORE === "1";
+                const store = dependencies.store || createCredentialStore({
+                    platform: dependencies.platform,
+                    useFile: storeMode === "file",
+                    allowFile,
+                    runner: dependencies.runner,
+                });
+                if (store.metadata.provider === "file")
+                    console.error("Warning: using explicitly opted-in mode-0600 credential file fallback.");
+                const config = dependencies.config || authConfigFromEnvironment(dependencies.env);
+                const client = new AuthClient(config, store, dependencies.fetcher, dependencies.openBrowser, dependencies.now);
+                if (subcommand === "login") {
+                    const deviceLabel = value(args, "--device-label");
+                    if (args.includes("--device")) {
+                        await client.loginDevice({
+                            signal: ctx.signal,
+                            deviceLabel,
+                            onCode(info) {
+                                console.log(`Open: ${String(info.verification_uri)}`);
+                                console.log(`Code: ${String(info.user_code)}`);
+                            },
+                        });
+                    }
+                    else {
+                        await client.loginBrowser({ signal: ctx.signal, deviceLabel });
+                    }
+                    console.log(`Authenticated. Credentials stored in ${store.metadata.location}.`);
+                    return { exitCode: 0 };
+                }
+                if (subcommand === "status") {
+                    const { profile, credentials } = await client.status(ctx.signal);
+                    const output = {
+                        authenticated: true,
+                        subject: profile.sub,
+                        account: profile.email || null,
+                        organization: profile.organization_id || null,
+                        scopes: profile.scope?.split(/\s+/).filter(Boolean) || credentials.scope,
+                        plan: profile.plan || null,
+                        accessReason: profile.access_reason || null,
+                        accessValidUntil: profile.access_valid_until || credentials.expiresAt,
+                        credentialStore: store.metadata,
+                    };
+                    if (args.includes("--json"))
+                        console.log(JSON.stringify(output));
+                    else {
+                        console.log(`subject: ${output.subject}`);
+                        console.log(`account: ${output.account || "(not supplied)"}`);
+                        console.log(`organization: ${output.organization || "(none)"}`);
+                        console.log(`scopes: ${output.scopes.join(" ")}`);
+                        console.log(`plan: ${output.plan || "(none)"}`);
+                        console.log(`access_reason: ${output.accessReason || "(unknown)"}`);
+                        console.log(`access_valid_until: ${output.accessValidUntil}`);
+                        console.log(`credential_location: ${store.metadata.location}`);
+                    }
+                    return { exitCode: 0 };
+                }
+                if (args.includes("--all")) {
+                    const opener = dependencies.openBrowser || defaultBrowserOpener;
+                    await opener(`${config.baseUrl}/account/security?revoke=all`);
+                }
+                await client.logout(ctx.signal);
+                console.log(args.includes("--all")
+                    ? "Local credentials removed. Complete revoke-all in the opened account security page."
+                    : "Logged out and removed local credentials.");
+                return { exitCode: 0 };
+            }
+            catch (error) {
+                return { exitCode: classify(error), message: error instanceof Error ? error.message : String(error) };
+            }
+        },
+    };
+}
+export const authHandler = createAuthHandler();
+//# sourceMappingURL=auth.js.map

package/dist/src/cli/handlers/help.js

@@ -81,6 +81,7 @@ function displayHelp() {
         ['discover "<phrase>"', 'Find skills/agents/commands/rules by capability'],
         ['show <type> <name>', 'Stream the body of an indexed artifact'],
         ['versions <list|resolve|show>', 'Browse and resolve signed AIWG web resource releases'],
+        ['auth <login|status|logout>', 'Authenticate for paid AIWG web resources'],
         ['index <subcommand>', 'Manage the artifact index (build/query/discover/deps/stats)'],
         ['artifacts move --to <path>', 'Move/rename the project AIWG artifact root and reindex'],
     ]);

package/dist/src/cli/handlers/index.js

@@ -13,6 +13,7 @@ export { createScriptRunner, DefaultScriptRunner } from './script-runner.js';
 // Import all handlers
 import { helpHandler } from './help.js';
 import { versionHandler } from './version.js';
+import { authHandler } from './auth.js';
 import { useHandler } from './use.js';
 import { statusHandler, wizardHandler, migrateWorkspaceHandler, rollbackWorkspaceHandler, workspaceHandlers, } from './workspace.js';
 import { prefillCardsHandler, contributeStartHandler, validateMetadataHandler, doctorHandler, updateHandler, utilityHandlers, } from './utilities.js';
@@ -61,7 +62,7 @@ import { jobHandler } from './job.js';
 // Re-export individual handlers
 export { 
 // Maintenance
-helpHandler, versionHandler, doctorHandler, updateHandler, refreshHandler, regenerateHandler, workspaceContextHandler, 
+helpHandler, versionHandler, authHandler, doctorHandler, updateHandler, refreshHandler, regenerateHandler, workspaceContextHandler, 
 // Framework management
 useHandler, listHandler, removeHandler, promoteHandler, installHandler, packagesHandler, marketplaceHandler, initHandler, setupHandler, setupGenerateHandler, setupRunHandler, setupValidateHandler, issueHandler, issueAuditHandler, runHandler, jobHandler, 
 // Project
@@ -115,6 +116,7 @@ export const allHandlers = [
     // Maintenance (shown first in help)
     helpHandler,
     versionHandler,
+    authHandler,
     doctorHandler,
     updateHandler,
     refreshHandler,

package/dist/src/cli/handlers/resource-versions.js

@@ -3,6 +3,7 @@ import { loadResourceTrustRootFile, readVerifiedRegularFile, resolveWebRelease,
 import { getProjectDir } from "../../config/aiwg-config.js";
 import { cleanWebResourceCache } from "../../resources/cache-cleanup.js";
 import { writeWebResourceLock } from "../../resources/lockfile.js";
+import { createResourceCredentialProvider } from "../../auth/resource-credentials.js";
 const MAX_RESOURCE_MANIFEST_BYTES = 4 * 1024 * 1024;
 const DEFAULT_CHANNELS = ["stable", "latest", "canary", "main"];
 function usage() {
@@ -82,6 +83,7 @@ function webReleaseOptionsFromEnvironment() {
         ? undefined
         : loadResourceTrustRootFile(path.resolve(trustRootFile));
     return {
+        credentialProvider: createResourceCredentialProvider(process.env),
         ...(baseUrl === undefined ? {} : { baseUrl }),
         ...(cacheRoot === undefined ? {} : { cacheRoot }),
         ...(publicKeyPem === undefined ? {} : { publicKeyPem }),

package/dist/src/cli/handlers/sessions.js

@@ -1,7 +1,22 @@
 import { existsSync, mkdirSync, realpathSync, statSync, } from 'node:fs';
 import { dirname, isAbsolute, resolve, } from 'node:path';
+import { pathToFileURL } from 'node:url';
 import { CLAUDE_ADAPTER_VERSION, ClaudeSessionAdapter, CODEX_ADAPTER_VERSION, CodexSessionAdapter, COPILOT_ADAPTER_VERSION, CopilotSessionAdapter, CURSOR_ADAPTER_VERSION, CursorSessionAdapter, FACTORY_ADAPTER_VERSION, FactorySessionAdapter, HERMES_ADAPTER_VERSION, HermesSessionAdapter, OPENCODE_ADAPTER_VERSION, OpenCodeSessionAdapter, OPENCLAW_ADAPTER_VERSION, OpenClawSessionAdapter, OPENHUMAN_ADAPTER_VERSION, OpenHumanSessionAdapter, WARP_ADAPTER_VERSION, WarpSessionAdapter, DEVIN_DESKTOP_ADAPTER_VERSION, DevinDesktopSessionAdapter, CandidateExtractionService, GENERIC_ADAPTER_VERSION, GenericSessionInterchangeAdapter, IncrementalSessionImporter, ImportLeaseContentionError, FilesystemMemoryDestination, FilesystemPromotionDispositionCoordinator, MemoryPromotionGateway, SESSION_CONTRACT_VERSION, SESSION_PROVIDER_IDS, SessionContractError, SessionRepository, SessionSourceSchema, StructuralCandidateExtractor, resolveMemoryConsumerManifest, assertSessionProviderId, acquireImportLease, defaultDiscoveryManifestPath, discoverWorkspaceHistories, deriveSessionTimeline, importDiscoveryManifest, previewDiscoveryImport, publicDiscoveryManifest, readDiscoveryManifest, redactSourceLocator, sha256, parseTimelineGap, writeDiscoveryManifest, } from '../../sessions/index.js';
 const JSON_CONTRACT_VERSION = '1.0.0';
+async function createLineMemoryPromotionDestination(projectRoot, manifestPath) {
+    const modulePath = resolve(dirname(manifestPath), 'commands', 'line-memory.mjs');
+    if (!existsSync(modulePath)) {
+        throw new SessionContractError('UNSUPPORTED_OPERATION', 'line-memory promotion adapter is missing from the installed addon');
+    }
+    const loaded = await import(pathToFileURL(modulePath).href);
+    if (!loaded.LineMemoryPromotionDestination) {
+        throw new SessionContractError('UNSUPPORTED_OPERATION', 'line-memory addon does not export its promotion adapter');
+    }
+    return new loaded.LineMemoryPromotionDestination({
+        projectRoot,
+        consumer: 'line-memory',
+    });
+}
 const EXIT = {
     ok: 0, usage: 2, unsupported: 3, unavailable: 4, contract: 5, storage: 6,
     locked: 7, coverage: 8,
@@ -406,11 +421,14 @@ async function executeCommand(ctx, args) {
                 const candidateId = requiredPositional(args, 0, 'candidate-id');
                 const version = boundedInteger(requiredPositional(args, 1, 'version'), 1, 1, Number.MAX_SAFE_INTEGER, 'version');
                 const consumer = requiredValue(args, '--consumer');
-                const destination = new FilesystemMemoryDestination({
-                    projectRoot: ctx.cwd,
-                    consumer,
-                    manifestPath: resolveMemoryConsumerManifest(ctx.cwd, consumer),
-                });
+                const manifestPath = resolveMemoryConsumerManifest(ctx.cwd, consumer);
+                const destination = consumer === 'line-memory'
+                    ? await createLineMemoryPromotionDestination(ctx.cwd, manifestPath)
+                    : new FilesystemMemoryDestination({
+                        projectRoot: ctx.cwd,
+                        consumer,
+                        manifestPath,
+                    });
                 const scopedPromotionStore = {
                     getCandidate: (id, candidateVersion) => repository.getCandidate(id, candidateVersion, workspaceId),
                     getPromotionReceipt: (id, candidateVersion, namedConsumer) => repository.getCandidate(id, candidateVersion, workspaceId)

package/dist/src/cli/handlers/subcommands.js

@@ -1147,9 +1147,18 @@ export const packagePluginHandler = {
                 message: "Error: plugin name is required.\n\nRun `aiwg package-plugin --help` for usage.",
             };
         }
+        const positionalSource = positional && (positional.includes('/') || positional.includes('\\'))
+            ? positional
+            : undefined;
         const normalizedArgs = hasExplicitPlugin
             ? ctx.args
-            : ["--plugin", positional, ...ctx.args.slice(1)];
+            : positionalSource
+                ? [
+                    "--plugin", path.basename(path.resolve(ctx.cwd, positionalSource)),
+                    "--source", positionalSource,
+                    ...ctx.args.slice(1),
+                ]
+                : ["--plugin", positional, ...ctx.args.slice(1)];
         const frameworkRoot = await getFrameworkRoot();
         const runner = createScriptRunner(frameworkRoot);
         return runner.run("tools/plugin/package-plugins.mjs", normalizedArgs, {