@aiwg/cli 2026.8.0 → 2026.8.1

package/dist/src/sessions/promotion.js

@@ -12,7 +12,7 @@ export class MemoryPromotionGateway {
             throw new SessionContractError('MALFORMED_SOURCE', 'candidate version does not exist');
         }
         const existing = this.store.getPromotionReceipt(input.candidateId, input.version, input.destination.consumer);
-        if (candidate.reviewState !== 'accepted' && !(candidate.reviewState === 'promoted' && existing)) {
+        if (candidate.reviewState !== 'accepted' && candidate.reviewState !== 'promoted') {
             throw new SessionContractError('OPERATION_NOT_AUTHORIZED', 'promotion requires an accepted exact candidate version');
         }
         const security = candidateSecurity(candidate);
@@ -165,7 +165,7 @@ export class FilesystemPromotionDispositionCoordinator {
             if (!decision) {
                 throw new SessionContractError('OPERATION_NOT_AUTHORIZED', 'every promoted artifact requires an explicit disposition');
             }
-            this.authorizedPath(dependent.destinationRef);
+            this.authorizedDispositionRef(dependent.destinationRef);
             return {
                 dependentId: dependent.dependentId,
                 destinationRef: dependent.destinationRef,
@@ -194,6 +194,12 @@ export class FilesystemPromotionDispositionCoordinator {
         for (const effect of journal.effects) {
             if (effect.outcome !== 'pending')
                 continue;
+            const lineMemory = this.lineMemoryRef(effect.destinationRef);
+            if (lineMemory) {
+                effect.outcome = this.applyLineMemoryDisposition(lineMemory.metadataPath, lineMemory.handle, purge.operationId, effect);
+                this.writeJournal(journalPath, journal);
+                continue;
+            }
             const target = this.authorizedPath(effect.destinationRef);
             const marker = dispositionMarker(purge.operationId, effect);
             if (effect.action === 'delete') {
@@ -252,6 +258,65 @@ export class FilesystemPromotionDispositionCoordinator {
         }
         return target;
     }
+    authorizedDispositionRef(destinationRef) {
+        if (this.lineMemoryRef(destinationRef))
+            return;
+        this.authorizedPath(destinationRef);
+    }
+    lineMemoryRef(destinationRef) {
+        const separator = destinationRef.lastIndexOf('#');
+        if (separator < 1)
+            return null;
+        const metadataRef = destinationRef.slice(0, separator);
+        const handle = destinationRef.slice(separator + 1);
+        if (!/^lm_[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(handle)) {
+            return null;
+        }
+        return { metadataPath: this.authorizedPath(metadataRef), handle };
+    }
+    applyLineMemoryDisposition(metadataPath, handle, operationId, effect) {
+        if (!existsSync(metadataPath))
+            return 'already-applied';
+        const metadata = JSON.parse(readFileSync(metadataPath, 'utf8'));
+        if (metadata.schemaVersion !== 'aiwg.line-memory.v1' || !metadata.entries) {
+            throw new SessionContractError('IMPORT_CONFLICT', 'line-memory metadata schema is invalid');
+        }
+        const entry = metadata.entries[handle];
+        if (!entry)
+            return 'already-applied';
+        const priorOperation = entry.disposition?.operationId;
+        if (priorOperation === operationId)
+            return 'already-applied';
+        const memoryRef = metadata.store?.memoryPath ?? '.aiwg/memory/line-memory.txt';
+        const memoryPath = this.authorizedPath(memoryRef);
+        const lines = existsSync(memoryPath)
+            ? readFileSync(memoryPath, 'utf8').split(/\r?\n/).filter(Boolean)
+            : [];
+        const removesActiveFact = ['delete', 'revoke', 'supersede'].includes(effect.action);
+        const nextLines = removesActiveFact
+            ? removeFirstExact(lines, entry.value)
+            : lines;
+        if (effect.action === 'delete')
+            delete metadata.entries[handle];
+        else {
+            entry.status = effect.action === 'revoke' ? 'revoked'
+                : effect.action === 'supersede' ? 'superseded'
+                    : effect.action === 'origin_unavailable' ? 'origin-unavailable'
+                        : 'active';
+            entry.updatedAt = new Date().toISOString();
+            entry.disposition = {
+                operationId,
+                action: effect.action,
+                effect: effect.effect,
+                originAvailable: effect.action !== 'origin_unavailable',
+            };
+        }
+        if (removesActiveFact) {
+            this.atomicWrite(memoryPath, nextLines.length ? `${nextLines.join('\n')}\n` : '');
+        }
+        this.atomicWrite(metadataPath, `${JSON.stringify(metadata, null, 2)}\n`);
+        return 'applied';
+    }
     journalPath(operationId) {
         return resolve(this.journalRoot, `${operationId.replace(':', '-')}.json`);
     }
@@ -290,6 +355,12 @@ function requireJournalFiles(root) {
         .sort()
         .map((name) => resolve(root, name));
 }
+function removeFirstExact(lines, value) {
+    const index = lines.indexOf(value);
+    return index < 0
+        ? [...lines]
+        : lines.filter((_, candidate) => candidate !== index);
+}
 export function resolveMemoryConsumerManifest(projectRoot, consumer) {
     const safeConsumer = assertConsumerId(consumer);
     const candidates = [

package/dist/src/sessions/repository.js

@@ -1219,7 +1219,8 @@ export class SessionRepository {
             if (existing)
                 return { ...existing, duplicate: true };
             const candidate = this.getCandidate(receipt.candidateId, receipt.candidateVersion);
-            if (!candidate || candidate.reviewState !== 'accepted') {
+            if (!candidate
+                || (candidate.reviewState !== 'accepted' && candidate.reviewState !== 'promoted')) {
                 throw new SessionContractError('OPERATION_NOT_AUTHORIZED', 'promotion requires an accepted exact candidate version');
             }
             const evidenceIds = [...new Set(candidate.evidence.map((item) => item.eventId))].sort();

package/dist/src/update/notifier.mjs

@@ -157,6 +157,16 @@ function readCurrentVersion(packageRoot) {
   }
 }
 
+/**
+ * Return true when a cached check belongs to the package currently handling
+ * the command. A global launcher can dispatch into a newer development
+ * checkout, so cache age alone is not sufficient.
+ */
+export function cacheMatchesPackage(cache, packageRoot) {
+  const currentVersion = readCurrentVersion(packageRoot);
+  return !!(currentVersion && cache?.current === currentVersion);
+}
+
 /**
  * Run the actual update check and write the cache file. Invoked by the
  * spawned background child via `node src/update/notifier.mjs --check`.
@@ -183,7 +193,7 @@ export function scheduleBackgroundCheck(packageRoot) {
   if (isDisabled()) return;
 
   const cache = readCache();
-  if (cache?.lastCheckAt) {
+  if (cacheMatchesPackage(cache, packageRoot) && cache?.lastCheckAt) {
     const age = Date.now() - new Date(cache.lastCheckAt).getTime();
     if (age < CHECK_INTERVAL_MS) return; // recent enough — skip
   }
@@ -213,9 +223,10 @@ export function scheduleBackgroundCheck(packageRoot) {
  * is interactive, print a single-line notice to stderr. Never prompts.
  * Safe to call unconditionally from `bin/aiwg.mjs` — gated by isDisabled().
  */
-export function maybePrintNotice() {
+export function maybePrintNotice(packageRoot) {
   if (isDisabled()) return;
   const cache = readCache();
+  if (!cacheMatchesPackage(cache, packageRoot)) return;
   if (!cache?.hasUpdate || !cache.current || !cache.latest) return;
   // One-line, non-intrusive. Users who want to update run `aiwg update`.
   const msg = `aiwg: update available ${cache.current} → ${cache.latest} (run: aiwg update)`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwg/cli",
-  "version": "2026.8.0",
+  "version": "2026.8.1",
   "description": "Lightweight AIWG CLI for signed, versioned web-backed resources.",
   "type": "module",
   "license": "MIT",
@@ -25,12 +25,19 @@
   "files": [
     "LICENSE",
     "bin/",
+    "agentic/code/providers/",
     "dist/src/",
     "!dist/**/*.d.ts",
     "!dist/**/*.map",
     "dist/src/api/index.d.ts",
     "dist/src/resources/index.d.ts",
     "dist/src/resources/web-release.d.ts",
+    "tools/_resolve-impl.mjs",
+    "tools/agents/deploy-agents.mjs",
+    "tools/agents/providers/",
+    "tools/commands/deploy-prompts-codex.mjs",
+    "tools/plugin/package-plugins.mjs",
+    "tools/skills/deploy-skills-codex.mjs",
     "README.md"
   ],
   "repository": {

package/tools/_resolve-impl.mjs

@@ -0,0 +1,74 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, extname, join, resolve } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+function findPackageRoot(callerUrl) {
+  let dir = dirname(fileURLToPath(callerUrl));
+  for (let i = 0; i < 12; i += 1) {
+    const pkgPath = join(dir, 'package.json');
+    if (existsSync(pkgPath)) {
+      try {
+        const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
+        if (pkg.name === 'aiwg' || pkg.name === '@aiwg/cli') return dir;
+      } catch {
+        // Keep walking.
+      }
+    }
+
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+
+  throw new Error(`Could not locate AIWG package root from ${callerUrl}`);
+}
+
+function candidatesFor(root, relativeFromSrc, base) {
+  const primary = resolve(root, base, relativeFromSrc);
+  const candidates = [primary];
+
+  if (base === 'src' && extname(primary) === '.js') {
+    candidates.push(primary.slice(0, -3) + '.ts');
+  }
+
+  return candidates;
+}
+
+function resolveCandidate(root, relativeFromSrc, base) {
+  for (const candidate of candidatesFor(root, relativeFromSrc, base)) {
+    if (existsSync(candidate)) return candidate;
+  }
+  return null;
+}
+
+/**
+ * Resolve a module that may live under compiled dist/src/ or source src/.
+ *
+ * Prefers dist/src/ when present. Set AIWG_RESOLVE_IMPL_FROM=dist or src to
+ * force a side during CI/package-layout checks.
+ */
+export function resolveImpl(callerUrl, relativeFromSrc) {
+  const root = findPackageRoot(callerUrl);
+  const forced = process.env.AIWG_RESOLVE_IMPL_FROM;
+
+  const order = forced === 'src'
+    ? ['src']
+    : forced === 'dist'
+      ? ['dist/src']
+      : ['dist/src', 'src'];
+
+  for (const base of order) {
+    const candidate = resolveCandidate(root, relativeFromSrc, base);
+    if (candidate) return candidate;
+  }
+
+  const attempted = order
+    .flatMap((base) => candidatesFor(root, relativeFromSrc, base))
+    .join(', ');
+  throw new Error(`Could not resolve ${relativeFromSrc}; attempted: ${attempted}`);
+}
+
+export async function importImpl(callerUrl, relativeFromSrc) {
+  const modulePath = resolveImpl(callerUrl, relativeFromSrc);
+  return import(pathToFileURL(modulePath).href);
+}