@aiwg/cli 2026.8.0 → 2026.8.2

package/dist/src/cli/handlers/marketplace.js

@@ -1,41 +1,39 @@
 /**
- * Marketplace Command Handler
+ * Git-native Fortemi marketplace command handler.
  *
- * Implements `aiwg marketplace <subcommand>` for discovering and listing
- * packages across all configured marketplace sources (local, ClawHub,
- * OpenClaw, etc.).
- *
- * Subcommands:
- *   search <query>    Fan-out search to all adapters, display with source attribution
- *   list              List installed marketplace packages
- *
- * Flags:
- *   --source <id>     Limit to a single adapter (e.g. clawhub, openclaw, local)
- *   --json            Emit structured JSON for programmatic use
+ * Catalog results are observations, never endorsements. Direct Git and catalog
+ * installs share the same immutable lock and local receipt pipeline.
  *
  * @implements #805
+ * @implements #2009
  */
+import fs from 'node:fs';
+import path from 'node:path';
 import { searchSkills } from '../../skills/registry.js';
-import { listInstalledPackages } from '../../packages/registry.js';
+import { installPackage, listInstalledPackages } from '../../packages/registry.js';
+import { GitAdapter } from '../../packages/adapters/git.js';
+import { inspectGitCheckout } from '../../marketplace/provenance.js';
+import { exportPortablePackage, findIndexedPackage, importPortablePackage, marketplaceConfigDir, publishLocalPackage, readCatalogEnvelope, readTrustStore, registerCatalog, removeCatalog, resolveCatalogEntry, resolveVerificationPolicy, searchCatalogs, verifyIndexedPackage, } from '../../marketplace/exchange.js';
 import * as ui from '../ui.js';
-// ── Usage string ───────────────────────────────────────────────────────────
 const USAGE = [
     'Usage:',
-    '  aiwg marketplace search <query>          Search across all marketplace sources',
+    '  aiwg marketplace add <catalog-git-url> [--ref <tag-or-sha>]',
+    '  aiwg marketplace search <query>          Search packages and signed catalogs',
+    '  aiwg marketplace info <package>           Show provenance and catalog observations',
+    '  aiwg marketplace install <url|package>    Install and lock direct Git or catalog package',
+    '  aiwg marketplace verify <package|lock>    Verify cached content and receipts offline',
+    '  aiwg marketplace export <package> --output <archive.json>',
+    '  aiwg marketplace import <archive.json> [--project-local]',
+    '  aiwg marketplace publish <source> --key <pem> --publisher <id>',
+    '  aiwg marketplace remove <catalog-id>',
     '  aiwg marketplace list                    List installed marketplace packages',
     '',
-    'Flags:',
-    '  --source <id>    Limit search to a specific source (clawhub, openclaw, local)',
-    '  --json           Output structured JSON',
-    '',
-    'Examples:',
-    '  aiwg marketplace search parallel-dispatch',
-    '  aiwg marketplace search auth --source clawhub',
-    '  aiwg marketplace search auth --json',
-    '  aiwg marketplace list',
-    '  aiwg marketplace list --json',
+    'Common flags:',
+    '  --json             Output structured JSON',
+    '  --project-local    Store/read state below the target project .aiwg directory',
+    '  --global           Store/read state in the user AIWG directory (default)',
+    '  --policy <name>    Named trust policy or JSON policy path',
 ].join('\n');
-// ── Flag helpers ───────────────────────────────────────────────────────────
 function parseFlag(args, flag) {
     const idx = args.indexOf(flag);
     if (idx === -1 || idx + 1 >= args.length)
@@ -45,124 +43,379 @@ function parseFlag(args, flag) {
 function hasFlag(args, flag) {
     return args.includes(flag);
 }
-// ── Handler ────────────────────────────────────────────────────────────────
+function scopeFromContext(ctx) {
+    const projectLocal = hasFlag(ctx.args, '--project-local');
+    if (projectLocal && hasFlag(ctx.args, '--global'))
+        throw new Error('Choose either --project-local or --global, not both');
+    return { projectLocal, projectDir: parseFlag(ctx.args, '--target') ?? ctx.cwd };
+}
+function jsonOrMessage(jsonMode, value, message) {
+    if (jsonMode) {
+        console.log(JSON.stringify(value, null, 2));
+        return { exitCode: 0 };
+    }
+    return { exitCode: 0, message };
+}
+function failure(error) {
+    return { exitCode: 1, message: `Error: ${error instanceof Error ? error.message : String(error)}` };
+}
+function requiredArg(ctx, usage) {
+    const value = ctx.args[1];
+    return !value || value.startsWith('--') ? { exitCode: 1, message: `Error: ${usage}` } : value;
+}
 export const marketplaceHandler = {
     id: 'marketplace',
     name: 'Marketplace',
-    description: 'Search and manage marketplace packages (search, list)',
+    description: 'Federated Git marketplace with Fortemi provenance and offline verification',
     category: 'framework',
     aliases: ['market'],
     async execute(ctx) {
         const subcommand = ctx.args[0];
-        if (!subcommand) {
+        if (!subcommand)
             return { exitCode: 0, message: USAGE };
-        }
-        if (subcommand === 'search') {
+        if (subcommand === 'add')
+            return handleAdd(ctx);
+        if (subcommand === 'search')
             return handleSearch(ctx);
-        }
-        if (subcommand === 'list') {
+        if (subcommand === 'info')
+            return handleInfo(ctx);
+        if (subcommand === 'install')
+            return handleInstall(ctx);
+        if (subcommand === 'verify')
+            return handleVerify(ctx);
+        if (subcommand === 'export')
+            return handleExport(ctx);
+        if (subcommand === 'import')
+            return handleImport(ctx);
+        if (subcommand === 'publish')
+            return handlePublish(ctx);
+        if (subcommand === 'remove')
+            return handleRemove(ctx);
+        if (subcommand === 'list')
             return handleList(ctx);
-        }
-        return {
-            exitCode: 1,
-            message: `Error: Unknown subcommand '${subcommand}'\n\n${USAGE}`,
-        };
+        return { exitCode: 1, message: `Error: Unknown subcommand '${subcommand}'\n\n${USAGE}` };
     },
 };
-// ── Search ─────────────────────────────────────────────────────────────────
-async function handleSearch(ctx) {
-    // First positional arg after 'search' that isn't a flag value
-    const query = ctx.args[1];
-    if (!query || query.startsWith('--')) {
-        return {
-            exitCode: 1,
-            message: 'Error: Query required\n\nUsage: aiwg marketplace search <query>',
-        };
-    }
-    const source = parseFlag(ctx.args, '--source');
-    const jsonMode = hasFlag(ctx.args, '--json');
-    const results = await searchSkills(query, source);
-    if (jsonMode) {
-        console.log(JSON.stringify(results, null, 2));
-        return { exitCode: 0 };
+async function handleAdd(ctx) {
+    const argument = requiredArg(ctx, 'Catalog Git URL required');
+    if (typeof argument !== 'string')
+        return argument;
+    try {
+        const scope = scopeFromContext(ctx);
+        const requestedRef = parseFlag(ctx.args, '--ref') ?? 'HEAD';
+        const adapter = new GitAdapter();
+        const source = { gitUrl: argument, ref: requestedRef, label: argument };
+        const cachePath = await adapter.fetch(source, { refresh: hasFlag(ctx.args, '--refresh') });
+        const identity = await inspectGitCheckout(cachePath);
+        const candidates = [
+            path.join(cachePath, 'aiwg-marketplace-catalog.json'),
+            path.join(cachePath, '.aiwg', 'marketplace', 'catalog.json'),
+        ];
+        const catalogPath = candidates.find((candidate) => fs.existsSync(candidate));
+        if (!catalogPath)
+            throw new Error('Catalog repository has no aiwg-marketplace-catalog.json or .aiwg/marketplace/catalog.json');
+        const trustStore = await readTrustStore({ ...scope, path: parseFlag(ctx.args, '--trust-store') });
+        const record = await registerCatalog({
+            ...scope,
+            catalogPath,
+            source: identity.canonicalRemote,
+            requestedRef: source.ref ?? requestedRef,
+            resolvedCommit: identity.resolvedCommit,
+            cachePath,
+            trustStore,
+        });
+        return jsonOrMessage(hasFlag(ctx.args, '--json'), record, `Added verified catalog ${record.catalogId} at ${record.resolvedCommit}`);
     }
-    ui.blank();
-    console.log(`  ${ui.brandMark()} ${ui.bold(`Marketplace Search: "${query}"`)}`);
-    if (source) {
-        ui.dim(`  Source: ${source}`);
+    catch (error) {
+        return failure(error);
     }
-    ui.rule();
-    if (results.length === 0) {
-        ui.dim('  No results found.');
+}
+async function handleSearch(ctx) {
+    const argument = requiredArg(ctx, 'Query required\n\nUsage: aiwg marketplace search <query>');
+    if (typeof argument !== 'string')
+        return argument;
+    try {
+        const source = parseFlag(ctx.args, '--source');
+        const scope = scopeFromContext(ctx);
+        const [skillResults, catalogResults] = await Promise.all([
+            !source || !source.startsWith('catalog:') ? searchSkills(argument, source) : Promise.resolve([]),
+            searchCatalogs(argument, scope),
+        ]);
+        const filteredCatalogs = source?.startsWith('catalog:')
+            ? catalogResults.filter((result) => result.catalogId === source.slice('catalog:'.length))
+            : source ? [] : catalogResults;
+        const results = [
+            ...skillResults,
+            ...filteredCatalogs.map((entry) => ({
+                name: `${entry.identity}@${entry.version}`,
+                description: entry.description,
+                source: `catalog:${entry.catalogId}`,
+                package: entry.identity,
+                provenanceCompleteness: entry.provenanceCompleteness,
+                verificationStatus: entry.verificationStatus,
+                observation: entry.observation,
+            })),
+        ];
+        if (hasFlag(ctx.args, '--json')) {
+            console.log(JSON.stringify(results, null, 2));
+            return { exitCode: 0 };
+        }
         ui.blank();
-        ui.dim('  Try a broader query or a different source.');
+        console.log(`  ${ui.brandMark()} ${ui.bold(`Marketplace Search: "${argument}"`)}`);
+        if (source)
+            ui.dim(`  Source: ${source}`);
+        ui.rule();
+        if (results.length === 0) {
+            ui.dim('  No results found.');
+            ui.blank();
+            return { exitCode: 0 };
+        }
+        const nameWidth = Math.max(12, ...results.map((result) => result.name.length));
+        const sourceWidth = Math.max(8, ...results.map((result) => result.source.length));
+        const pkgWidth = Math.max(10, ...results.map((result) => (result.package ?? '').length));
+        const header = ['Name'.padEnd(nameWidth), 'Source'.padEnd(sourceWidth), 'Package'.padEnd(pkgWidth), 'Description'].join('  ');
+        ui.dim(`  ${header}`);
+        ui.dim(`  ${'─'.repeat(header.length)}`);
+        for (const result of results) {
+            console.log(`  ${[
+                result.name.padEnd(nameWidth),
+                result.source.padEnd(sourceWidth),
+                (result.package ?? '').padEnd(pkgWidth),
+                result.description.length > 60 ? `${result.description.slice(0, 57)}...` : result.description,
+            ].join('  ')}`);
+        }
         ui.blank();
+        ui.dim(`  ${results.length} result${results.length === 1 ? '' : 's'}; catalog inclusion is not an endorsement`);
         return { exitCode: 0 };
     }
-    // Column widths
-    const nameWidth = Math.max(12, ...results.map((r) => r.name.length));
-    const sourceWidth = Math.max(8, ...results.map((r) => r.source.length));
-    const pkgWidth = Math.max(10, ...results.map((r) => (r.package ?? '').length));
-    const header = [
-        'Name'.padEnd(nameWidth),
-        'Source'.padEnd(sourceWidth),
-        'Package'.padEnd(pkgWidth),
-        'Description',
-    ].join('  ');
-    ui.dim(`  ${header}`);
-    ui.dim(`  ${'─'.repeat(header.length)}`);
-    for (const r of results) {
-        const row = [
-            r.name.padEnd(nameWidth),
-            r.source.padEnd(sourceWidth),
-            (r.package ?? '').padEnd(pkgWidth),
-            r.description.length > 60 ? r.description.slice(0, 57) + '...' : r.description,
-        ].join('  ');
-        console.log(`  ${row}`);
-    }
-    ui.blank();
-    ui.dim(`  ${results.length} result${results.length !== 1 ? 's' : ''}`);
-    ui.blank();
-    return { exitCode: 0 };
-}
-// ── List ───────────────────────────────────────────────────────────────────
-async function handleList(ctx) {
-    const jsonMode = hasFlag(ctx.args, '--json');
-    const packages = await listInstalledPackages();
-    if (jsonMode) {
-        console.log(JSON.stringify(packages, null, 2));
-        return { exitCode: 0 };
+    catch (error) {
+        return failure(error);
+    }
+}
+async function handleInfo(ctx) {
+    const argument = requiredArg(ctx, 'Package query required');
+    if (typeof argument !== 'string')
+        return argument;
+    try {
+        const scope = scopeFromContext(ctx);
+        const installed = await findIndexedPackage(argument, scope);
+        const catalogs = (await searchCatalogs(argument, scope)).filter((entry) => entry.identity === argument || `${entry.identity}@${entry.version}` === argument || entry.lockId === argument);
+        if (!installed && catalogs.length === 0)
+            return { exitCode: 1, message: `Error: Marketplace package '${argument}' was not found` };
+        const result = {
+            query: argument,
+            installed: installed ? {
+                lock: installed.lock,
+                verificationStatus: installed.verificationStatus,
+                installedAt: installed.installedAt,
+                catalogs: installed.catalogs,
+            } : null,
+            catalogObservations: catalogs,
+            endorsement: false,
+        };
+        return jsonOrMessage(hasFlag(ctx.args, '--json'), result, [
+            `Package: ${argument}`,
+            `Installed: ${installed ? 'yes' : 'no'}`,
+            ...(installed ? [`Lock: ${installed.lock.lockId}`, `Verification: ${installed.verificationStatus}`] : []),
+            `Catalog observations: ${catalogs.length} (not endorsements)`,
+            ...catalogs.map((entry) => `  ${entry.catalogId}: ${entry.provenanceCompleteness}% provenance, ${entry.verificationStatus}`),
+        ].join('\n'));
     }
-    ui.blank();
-    console.log(`  ${ui.brandMark()} ${ui.bold('Installed Marketplace Packages')}`);
-    ui.rule();
-    if (packages.length === 0) {
-        ui.dim('  No packages installed.');
+    catch (error) {
+        return failure(error);
+    }
+}
+function looksLikeGitUrl(value) {
+    return /^(?:https?:\/\/|ssh:\/\/|git@)/.test(value);
+}
+async function handleInstall(ctx) {
+    const argument = requiredArg(ctx, 'Git URL or catalog package required');
+    if (typeof argument !== 'string')
+        return argument;
+    try {
+        const scope = scopeFromContext(ctx);
+        const configDir = marketplaceConfigDir(scope);
+        const resolvedPolicy = await resolveVerificationPolicy(parseFlag(ctx.args, '--policy'), scope);
+        let rawRef = argument;
+        let expectedEnvelope;
+        let expectedLockId;
+        let catalogId;
+        let ref = parseFlag(ctx.args, '--ref');
+        if (!looksLikeGitUrl(argument)) {
+            const catalog = await resolveCatalogEntry(argument, scope);
+            expectedEnvelope = await readCatalogEnvelope(catalog, scope);
+            rawRef = catalog.canonicalRemote;
+            expectedLockId = catalog.lockId;
+            catalogId = catalog.catalogId;
+            ref = catalog.resolvedCommit;
+        }
+        const installed = await installPackage(rawRef, {
+            configDir,
+            ref,
+            packageSelector: parseFlag(ctx.args, '--package'),
+            refresh: hasFlag(ctx.args, '--refresh'),
+            verify: hasFlag(ctx.args, '--verify'),
+            verificationPolicy: resolvedPolicy.policy,
+            trustStore: resolvedPolicy.trustStore,
+            expectedEnvelope,
+            expectedLockId,
+            catalogId,
+            actor: 'local-user',
+        });
+        const result = {
+            package: installed.key,
+            version: installed.envelope.package.version,
+            lockId: installed.lock.lockId,
+            resolvedCommit: installed.lock.resolvedCommit,
+            verificationStatus: installed.verification.status,
+            scope: scope.projectLocal ? 'project-local' : 'global',
+            catalog: catalogId ?? null,
+        };
+        return jsonOrMessage(hasFlag(ctx.args, '--json'), result, `Installed ${result.package}@${result.version}\nLock: ${result.lockId}\nVerification: ${result.verificationStatus}`);
+    }
+    catch (error) {
+        return failure(error);
+    }
+}
+async function handleVerify(ctx) {
+    const argument = requiredArg(ctx, 'Package or lock query required');
+    if (typeof argument !== 'string')
+        return argument;
+    try {
+        const scope = scopeFromContext(ctx);
+        const resolved = await resolveVerificationPolicy(parseFlag(ctx.args, '--policy'), scope);
+        const result = await verifyIndexedPackage({
+            ...scope,
+            query: argument,
+            policy: resolved.policy,
+            trustStore: resolved.trustStore,
+            requireSignature: hasFlag(ctx.args, '--require-signature'),
+            actor: 'local-user',
+        });
+        if (!result.verification.ok)
+            return { exitCode: 1, message: `Verification failed: ${result.verification.errors.join('; ')}` };
+        return jsonOrMessage(hasFlag(ctx.args, '--json'), result.verification, `Verified ${result.entry.lock.identity}@${result.entry.lock.version} offline\nStatus: ${result.verification.status}\nLock: ${result.entry.lock.lockId}`);
+    }
+    catch (error) {
+        return failure(error);
+    }
+}
+async function handleExport(ctx) {
+    const argument = requiredArg(ctx, 'Package query required');
+    if (typeof argument !== 'string')
+        return argument;
+    const output = parseFlag(ctx.args, '--output');
+    if (!output)
+        return { exitCode: 1, message: 'Error: Usage: aiwg marketplace export <package> --output <archive.json>' };
+    try {
+        const result = await exportPortablePackage({ ...scopeFromContext(ctx), query: argument, output, actor: 'local-user' });
+        return jsonOrMessage(hasFlag(ctx.args, '--json'), { output: result.output, lockId: result.bundle.lock.lockId, receiptId: result.receipt.receiptId }, `Exported ${result.bundle.lock.identity}@${result.bundle.lock.version} to ${result.output}`);
+    }
+    catch (error) {
+        return failure(error);
+    }
+}
+async function handleImport(ctx) {
+    const argument = requiredArg(ctx, 'Portable archive path required');
+    if (typeof argument !== 'string')
+        return argument;
+    try {
+        const scope = scopeFromContext(ctx);
+        const resolved = await resolveVerificationPolicy(parseFlag(ctx.args, '--policy'), scope);
+        const result = await importPortablePackage({
+            ...scope,
+            input: argument,
+            verify: hasFlag(ctx.args, '--verify'),
+            policy: resolved.policy,
+            trustStore: resolved.trustStore,
+            actor: 'local-user',
+        });
+        return jsonOrMessage(hasFlag(ctx.args, '--json'), { lock: result.entry.lock, verification: result.verification, receipt: result.receipt }, `Imported ${result.entry.lock.identity}@${result.entry.lock.version}\nLock: ${result.entry.lock.lockId}\nVerification: ${result.verification.status}`);
+    }
+    catch (error) {
+        return failure(error);
+    }
+}
+async function handlePublish(ctx) {
+    const argument = requiredArg(ctx, 'Package source directory required');
+    if (typeof argument !== 'string')
+        return argument;
+    const privateKeyPath = parseFlag(ctx.args, '--key');
+    const publisher = parseFlag(ctx.args, '--publisher');
+    if (!privateKeyPath || !publisher) {
+        return { exitCode: 1, message: 'Error: Usage: aiwg marketplace publish <source> --key <ed25519.pem> --publisher <id> [--output <dir>]' };
+    }
+    try {
+        const outputDir = parseFlag(ctx.args, '--output') ?? path.join(path.resolve(argument), '.aiwg', 'marketplace');
+        const sequenceText = parseFlag(ctx.args, '--sequence');
+        const sequence = sequenceText === undefined ? undefined : Number(sequenceText);
+        if (sequence !== undefined && (!Number.isSafeInteger(sequence) || sequence < 1))
+            throw new Error('--sequence must be a positive integer');
+        const published = await publishLocalPackage({
+            sourceDir: argument,
+            outputDir,
+            privateKeyPath,
+            publicKeyPath: parseFlag(ctx.args, '--public-key'),
+            keyId: parseFlag(ctx.args, '--key-id'),
+            publisher,
+            requestedRef: parseFlag(ctx.args, '--ref'),
+            packageSelector: parseFlag(ctx.args, '--package'),
+            sequence,
+            actor: publisher,
+        });
+        return jsonOrMessage(hasFlag(ctx.args, '--json'), published, `Published signed envelope ${published.lock.lockId}\nEnvelope: ${published.envelopePath}\nFortemi: ${published.shardPath}`);
+    }
+    catch (error) {
+        return failure(error);
+    }
+}
+async function handleRemove(ctx) {
+    const argument = requiredArg(ctx, 'Catalog ID required');
+    if (typeof argument !== 'string')
+        return argument;
+    try {
+        const removed = await removeCatalog(argument, scopeFromContext(ctx));
+        return {
+            exitCode: removed ? 0 : 1,
+            message: removed
+                ? `Removed catalog ${argument}; existing immutable package locks remain valid`
+                : `Catalog '${argument}' was not registered`,
+        };
+    }
+    catch (error) {
+        return failure(error);
+    }
+}
+async function handleList(ctx) {
+    try {
+        const scope = scopeFromContext(ctx);
+        const packages = await listInstalledPackages(marketplaceConfigDir(scope));
+        if (hasFlag(ctx.args, '--json')) {
+            console.log(JSON.stringify(packages, null, 2));
+            return { exitCode: 0 };
+        }
         ui.blank();
-        ui.dim('  Install a package: aiwg install owner/name');
+        console.log(`  ${ui.brandMark()} ${ui.bold('Installed Marketplace Packages')}`);
+        ui.rule();
+        if (packages.length === 0) {
+            ui.dim('  No packages installed.');
+            ui.blank();
+            return { exitCode: 0 };
+        }
+        const keyWidth = Math.max(12, ...packages.map((pkg) => pkg.key.length));
+        const versionWidth = Math.max(7, ...packages.map((pkg) => pkg.version.length));
+        const header = ['Package'.padEnd(keyWidth), 'Version'.padEnd(versionWidth), 'Type', 'Verification'].join('  ');
+        ui.dim(`  ${header}`);
+        ui.dim(`  ${'─'.repeat(header.length)}`);
+        for (const pkg of packages) {
+            console.log(`  ${[pkg.key.padEnd(keyWidth), pkg.version.padEnd(versionWidth), pkg.type, pkg.verificationStatus ?? 'legacy'].join('  ')}`);
+        }
         ui.blank();
+        ui.dim(`  ${packages.length} package${packages.length === 1 ? '' : 's'} installed`);
         return { exitCode: 0 };
     }
-    const keyWidth = Math.max(12, ...packages.map((p) => p.key.length));
-    const versionWidth = Math.max(7, ...packages.map((p) => p.version.length));
-    const header = [
-        'Package'.padEnd(keyWidth),
-        'Version'.padEnd(versionWidth),
-        'Type',
-    ].join('  ');
-    ui.dim(`  ${header}`);
-    ui.dim(`  ${'─'.repeat(header.length)}`);
-    for (const pkg of packages) {
-        const row = [
-            pkg.key.padEnd(keyWidth),
-            pkg.version.padEnd(versionWidth),
-            pkg.type,
-        ].join('  ');
-        console.log(`  ${row}`);
-    }
-    ui.blank();
-    ui.dim(`  ${packages.length} package${packages.length !== 1 ? 's' : ''} installed`);
-    ui.blank();
-    return { exitCode: 0 };
+    catch (error) {
+        return failure(error);
+    }
 }
 //# sourceMappingURL=marketplace.js.map

package/dist/src/cli/handlers/resource-versions.js

@@ -3,6 +3,7 @@ import { loadResourceTrustRootFile, readVerifiedRegularFile, resolveWebRelease,
 import { getProjectDir } from "../../config/aiwg-config.js";
 import { cleanWebResourceCache } from "../../resources/cache-cleanup.js";
 import { writeWebResourceLock } from "../../resources/lockfile.js";
+import { createResourceCredentialProvider } from "../../auth/resource-credentials.js";
 const MAX_RESOURCE_MANIFEST_BYTES = 4 * 1024 * 1024;
 const DEFAULT_CHANNELS = ["stable", "latest", "canary", "main"];
 function usage() {
@@ -82,6 +83,7 @@ function webReleaseOptionsFromEnvironment() {
         ? undefined
         : loadResourceTrustRootFile(path.resolve(trustRootFile));
     return {
+        credentialProvider: createResourceCredentialProvider(process.env),
         ...(baseUrl === undefined ? {} : { baseUrl }),
         ...(cacheRoot === undefined ? {} : { cacheRoot }),
         ...(publicKeyPem === undefined ? {} : { publicKeyPem }),

package/dist/src/cli/handlers/sessions.js

@@ -1,7 +1,22 @@
 import { existsSync, mkdirSync, realpathSync, statSync, } from 'node:fs';
 import { dirname, isAbsolute, resolve, } from 'node:path';
+import { pathToFileURL } from 'node:url';
 import { CLAUDE_ADAPTER_VERSION, ClaudeSessionAdapter, CODEX_ADAPTER_VERSION, CodexSessionAdapter, COPILOT_ADAPTER_VERSION, CopilotSessionAdapter, CURSOR_ADAPTER_VERSION, CursorSessionAdapter, FACTORY_ADAPTER_VERSION, FactorySessionAdapter, HERMES_ADAPTER_VERSION, HermesSessionAdapter, OPENCODE_ADAPTER_VERSION, OpenCodeSessionAdapter, OPENCLAW_ADAPTER_VERSION, OpenClawSessionAdapter, OPENHUMAN_ADAPTER_VERSION, OpenHumanSessionAdapter, WARP_ADAPTER_VERSION, WarpSessionAdapter, DEVIN_DESKTOP_ADAPTER_VERSION, DevinDesktopSessionAdapter, CandidateExtractionService, GENERIC_ADAPTER_VERSION, GenericSessionInterchangeAdapter, IncrementalSessionImporter, ImportLeaseContentionError, FilesystemMemoryDestination, FilesystemPromotionDispositionCoordinator, MemoryPromotionGateway, SESSION_CONTRACT_VERSION, SESSION_PROVIDER_IDS, SessionContractError, SessionRepository, SessionSourceSchema, StructuralCandidateExtractor, resolveMemoryConsumerManifest, assertSessionProviderId, acquireImportLease, defaultDiscoveryManifestPath, discoverWorkspaceHistories, deriveSessionTimeline, importDiscoveryManifest, previewDiscoveryImport, publicDiscoveryManifest, readDiscoveryManifest, redactSourceLocator, sha256, parseTimelineGap, writeDiscoveryManifest, } from '../../sessions/index.js';
 const JSON_CONTRACT_VERSION = '1.0.0';
+async function createLineMemoryPromotionDestination(projectRoot, manifestPath) {
+    const modulePath = resolve(dirname(manifestPath), 'commands', 'line-memory.mjs');
+    if (!existsSync(modulePath)) {
+        throw new SessionContractError('UNSUPPORTED_OPERATION', 'line-memory promotion adapter is missing from the installed addon');
+    }
+    const loaded = await import(pathToFileURL(modulePath).href);
+    if (!loaded.LineMemoryPromotionDestination) {
+        throw new SessionContractError('UNSUPPORTED_OPERATION', 'line-memory addon does not export its promotion adapter');
+    }
+    return new loaded.LineMemoryPromotionDestination({
+        projectRoot,
+        consumer: 'line-memory',
+    });
+}
 const EXIT = {
     ok: 0, usage: 2, unsupported: 3, unavailable: 4, contract: 5, storage: 6,
     locked: 7, coverage: 8,
@@ -406,11 +421,14 @@ async function executeCommand(ctx, args) {
                 const candidateId = requiredPositional(args, 0, 'candidate-id');
                 const version = boundedInteger(requiredPositional(args, 1, 'version'), 1, 1, Number.MAX_SAFE_INTEGER, 'version');
                 const consumer = requiredValue(args, '--consumer');
-                const destination = new FilesystemMemoryDestination({
-                    projectRoot: ctx.cwd,
-                    consumer,
-                    manifestPath: resolveMemoryConsumerManifest(ctx.cwd, consumer),
-                });
+                const manifestPath = resolveMemoryConsumerManifest(ctx.cwd, consumer);
+                const destination = consumer === 'line-memory'
+                    ? await createLineMemoryPromotionDestination(ctx.cwd, manifestPath)
+                    : new FilesystemMemoryDestination({
+                        projectRoot: ctx.cwd,
+                        consumer,
+                        manifestPath,
+                    });
                 const scopedPromotionStore = {
                     getCandidate: (id, candidateVersion) => repository.getCandidate(id, candidateVersion, workspaceId),
                     getPromotionReceipt: (id, candidateVersion, namedConsumer) => repository.getCandidate(id, candidateVersion, workspaceId)

package/dist/src/cli/handlers/subcommands.js

@@ -1147,9 +1147,18 @@ export const packagePluginHandler = {
                 message: "Error: plugin name is required.\n\nRun `aiwg package-plugin --help` for usage.",
             };
         }
+        const positionalSource = positional && (positional.includes('/') || positional.includes('\\'))
+            ? positional
+            : undefined;
         const normalizedArgs = hasExplicitPlugin
             ? ctx.args
-            : ["--plugin", positional, ...ctx.args.slice(1)];
+            : positionalSource
+                ? [
+                    "--plugin", path.basename(path.resolve(ctx.cwd, positionalSource)),
+                    "--source", positionalSource,
+                    ...ctx.args.slice(1),
+                ]
+                : ["--plugin", positional, ...ctx.args.slice(1)];
         const frameworkRoot = await getFrameworkRoot();
         const runner = createScriptRunner(frameworkRoot);
         return runner.run("tools/plugin/package-plugins.mjs", normalizedArgs, {