@aiwg/cli 2026.8.1 → 2026.8.3

package/dist/src/cli/handlers/install.js

@@ -20,6 +20,7 @@
 import path from 'path';
 import { installPackage } from '../../packages/registry.js';
 import { recordDeployment } from '../../packages/package-registry.js';
+import { marketplaceConfigDir, resolveVerificationPolicy } from '../../marketplace/exchange.js';
 import { createScriptRunner } from './script-runner.js';
 import { handlerResultFromError } from '../errors.js';
 import * as ui from '../ui.js';
@@ -59,6 +60,12 @@ export const installHandler = {
                     '  --provider <name>       Target provider (claude, copilot, cursor...)',
                     '  --target <dir>          Project directory to deploy into',
                     '  --refresh               Force re-pull even if cached',
+                    '  --ref <tag-or-sha>      Resolve this ref and lock its immutable commit',
+                    '  --package <id>          Select one wrapper when a repository contains several',
+                    '  --verify                Require a publisher signature trusted by local policy',
+                    '  --policy <name|path>    Named trust policy or JSON policy file',
+                    '  --project-local         Store registry, lock, receipts, and index under <target>/.aiwg',
+                    '  --global                Store package state in the user AIWG directory (default)',
                 ].join('\n'),
             };
         }
@@ -66,6 +73,15 @@ export const installHandler = {
         const refresh = hasFlag(ctx.args, '--refresh');
         const provider = parseFlag(ctx.args, '--provider') ?? 'claude';
         const target = parseFlag(ctx.args, '--target') ?? ctx.cwd;
+        const projectLocal = hasFlag(ctx.args, '--project-local');
+        const global = hasFlag(ctx.args, '--global');
+        if (projectLocal && global) {
+            return { exitCode: 1, message: 'Error: Choose either --project-local or --global, not both' };
+        }
+        const verify = hasFlag(ctx.args, '--verify');
+        const policyName = parseFlag(ctx.args, '--policy');
+        const scope = { projectLocal, projectDir: target };
+        const configDir = marketplaceConfigDir(scope);
         ui.blank();
         console.log(`  ${ui.brandMark()} ${ui.bold('aiwg install')}  ${ui.dimText(rawRef)}`);
         ui.rule();
@@ -75,8 +91,23 @@ export const installHandler = {
         let key;
         let type;
         let namespace;
+        let lockId;
+        let verificationStatus;
         try {
-            ({ cachePath, key, type, namespace } = await installPackage(rawRef, { refresh }));
+            const resolvedPolicy = await resolveVerificationPolicy(policyName, scope);
+            const installed = await installPackage(rawRef, {
+                refresh,
+                ref: parseFlag(ctx.args, '--ref'),
+                packageSelector: parseFlag(ctx.args, '--package'),
+                verify,
+                verificationPolicy: resolvedPolicy.policy,
+                trustStore: resolvedPolicy.trustStore,
+                configDir,
+                actor: 'local-user',
+            });
+            ({ cachePath, key, type, namespace } = installed);
+            lockId = installed.lock.lockId;
+            verificationStatus = installed.verification.status;
         }
         catch (error) {
             // Preserve AiwgError.exitCode while keeping the "Error: " prefix users
@@ -85,9 +116,12 @@ export const installHandler = {
             return { ...result, message: `Error: ${result.message}` };
         }
         ui.success(`Installed: ${key} (${type})`);
-        ui.dimText(`  Cache: ${cachePath}`);
+        ui.dim(`  Cache: ${cachePath}`);
+        ui.dim(`  Lock: ${lockId}`);
+        ui.dim(`  Verification: ${verificationStatus}`);
+        ui.dim(`  Scope: ${projectLocal ? 'project-local' : 'global'}`);
         if (namespace !== 'aiwg') {
-            ui.dimText(`  Namespace: ${namespace}`);
+            ui.dim(`  Namespace: ${namespace}`);
         }
         // Optionally deploy
         if (deploy) {
@@ -98,6 +132,10 @@ export const installHandler = {
                 '--deploy-commands',
                 '--deploy-skills',
                 '--deploy-rules',
+                // External packages do not participate in AIWG's global artifact
+                // index. Copy their complete skill payload into the target so a
+                // successful install cannot silently deploy agents/rules only.
+                '--copy-all',
                 '--provider', provider,
                 '--target', target,
                 '--namespace', namespace,
@@ -116,7 +154,7 @@ export const installHandler = {
                     projectPath: target,
                     provider,
                     deployedAt: new Date().toISOString(),
-                });
+                }, configDir);
             }
         }
         ui.blank();

package/dist/src/cli/handlers/marketplace.js

@@ -1,41 +1,39 @@
 /**
- * Marketplace Command Handler
+ * Git-native Fortemi marketplace command handler.
  *
- * Implements `aiwg marketplace <subcommand>` for discovering and listing
- * packages across all configured marketplace sources (local, ClawHub,
- * OpenClaw, etc.).
- *
- * Subcommands:
- *   search <query>    Fan-out search to all adapters, display with source attribution
- *   list              List installed marketplace packages
- *
- * Flags:
- *   --source <id>     Limit to a single adapter (e.g. clawhub, openclaw, local)
- *   --json            Emit structured JSON for programmatic use
+ * Catalog results are observations, never endorsements. Direct Git and catalog
+ * installs share the same immutable lock and local receipt pipeline.
  *
  * @implements #805
+ * @implements #2009
  */
+import fs from 'node:fs';
+import path from 'node:path';
 import { searchSkills } from '../../skills/registry.js';
-import { listInstalledPackages } from '../../packages/registry.js';
+import { installPackage, listInstalledPackages } from '../../packages/registry.js';
+import { GitAdapter } from '../../packages/adapters/git.js';
+import { inspectGitCheckout } from '../../marketplace/provenance.js';
+import { exportPortablePackage, findIndexedPackage, importPortablePackage, marketplaceConfigDir, publishLocalPackage, readCatalogEnvelope, readTrustStore, registerCatalog, removeCatalog, resolveCatalogEntry, resolveVerificationPolicy, searchCatalogs, verifyIndexedPackage, } from '../../marketplace/exchange.js';
 import * as ui from '../ui.js';
-// ── Usage string ───────────────────────────────────────────────────────────
 const USAGE = [
     'Usage:',
-    '  aiwg marketplace search <query>          Search across all marketplace sources',
+    '  aiwg marketplace add <catalog-git-url> [--ref <tag-or-sha>]',
+    '  aiwg marketplace search <query>          Search packages and signed catalogs',
+    '  aiwg marketplace info <package>           Show provenance and catalog observations',
+    '  aiwg marketplace install <url|package>    Install and lock direct Git or catalog package',
+    '  aiwg marketplace verify <package|lock>    Verify cached content and receipts offline',
+    '  aiwg marketplace export <package> --output <archive.json>',
+    '  aiwg marketplace import <archive.json> [--project-local]',
+    '  aiwg marketplace publish <source> --key <pem> --publisher <id>',
+    '  aiwg marketplace remove <catalog-id>',
     '  aiwg marketplace list                    List installed marketplace packages',
     '',
-    'Flags:',
-    '  --source <id>    Limit search to a specific source (clawhub, openclaw, local)',
-    '  --json           Output structured JSON',
-    '',
-    'Examples:',
-    '  aiwg marketplace search parallel-dispatch',
-    '  aiwg marketplace search auth --source clawhub',
-    '  aiwg marketplace search auth --json',
-    '  aiwg marketplace list',
-    '  aiwg marketplace list --json',
+    'Common flags:',
+    '  --json             Output structured JSON',
+    '  --project-local    Store/read state below the target project .aiwg directory',
+    '  --global           Store/read state in the user AIWG directory (default)',
+    '  --policy <name>    Named trust policy or JSON policy path',
 ].join('\n');
-// ── Flag helpers ───────────────────────────────────────────────────────────
 function parseFlag(args, flag) {
     const idx = args.indexOf(flag);
     if (idx === -1 || idx + 1 >= args.length)
@@ -45,124 +43,379 @@ function parseFlag(args, flag) {
 function hasFlag(args, flag) {
     return args.includes(flag);
 }
-// ── Handler ────────────────────────────────────────────────────────────────
+function scopeFromContext(ctx) {
+    const projectLocal = hasFlag(ctx.args, '--project-local');
+    if (projectLocal && hasFlag(ctx.args, '--global'))
+        throw new Error('Choose either --project-local or --global, not both');
+    return { projectLocal, projectDir: parseFlag(ctx.args, '--target') ?? ctx.cwd };
+}
+function jsonOrMessage(jsonMode, value, message) {
+    if (jsonMode) {
+        console.log(JSON.stringify(value, null, 2));
+        return { exitCode: 0 };
+    }
+    return { exitCode: 0, message };
+}
+function failure(error) {
+    return { exitCode: 1, message: `Error: ${error instanceof Error ? error.message : String(error)}` };
+}
+function requiredArg(ctx, usage) {
+    const value = ctx.args[1];
+    return !value || value.startsWith('--') ? { exitCode: 1, message: `Error: ${usage}` } : value;
+}
 export const marketplaceHandler = {
     id: 'marketplace',
     name: 'Marketplace',
-    description: 'Search and manage marketplace packages (search, list)',
+    description: 'Federated Git marketplace with Fortemi provenance and offline verification',
     category: 'framework',
     aliases: ['market'],
     async execute(ctx) {
         const subcommand = ctx.args[0];
-        if (!subcommand) {
+        if (!subcommand)
             return { exitCode: 0, message: USAGE };
-        }
-        if (subcommand === 'search') {
+        if (subcommand === 'add')
+            return handleAdd(ctx);
+        if (subcommand === 'search')
             return handleSearch(ctx);
-        }
-        if (subcommand === 'list') {
+        if (subcommand === 'info')
+            return handleInfo(ctx);
+        if (subcommand === 'install')
+            return handleInstall(ctx);
+        if (subcommand === 'verify')
+            return handleVerify(ctx);
+        if (subcommand === 'export')
+            return handleExport(ctx);
+        if (subcommand === 'import')
+            return handleImport(ctx);
+        if (subcommand === 'publish')
+            return handlePublish(ctx);
+        if (subcommand === 'remove')
+            return handleRemove(ctx);
+        if (subcommand === 'list')
             return handleList(ctx);
-        }
-        return {
-            exitCode: 1,
-            message: `Error: Unknown subcommand '${subcommand}'\n\n${USAGE}`,
-        };
+        return { exitCode: 1, message: `Error: Unknown subcommand '${subcommand}'\n\n${USAGE}` };
     },
 };
-// ── Search ─────────────────────────────────────────────────────────────────
-async function handleSearch(ctx) {
-    // First positional arg after 'search' that isn't a flag value
-    const query = ctx.args[1];
-    if (!query || query.startsWith('--')) {
-        return {
-            exitCode: 1,
-            message: 'Error: Query required\n\nUsage: aiwg marketplace search <query>',
-        };
-    }
-    const source = parseFlag(ctx.args, '--source');
-    const jsonMode = hasFlag(ctx.args, '--json');
-    const results = await searchSkills(query, source);
-    if (jsonMode) {
-        console.log(JSON.stringify(results, null, 2));
-        return { exitCode: 0 };
+async function handleAdd(ctx) {
+    const argument = requiredArg(ctx, 'Catalog Git URL required');
+    if (typeof argument !== 'string')
+        return argument;
+    try {
+        const scope = scopeFromContext(ctx);
+        const requestedRef = parseFlag(ctx.args, '--ref') ?? 'HEAD';
+        const adapter = new GitAdapter();
+        const source = { gitUrl: argument, ref: requestedRef, label: argument };
+        const cachePath = await adapter.fetch(source, { refresh: hasFlag(ctx.args, '--refresh') });
+        const identity = await inspectGitCheckout(cachePath);
+        const candidates = [
+            path.join(cachePath, 'aiwg-marketplace-catalog.json'),
+            path.join(cachePath, '.aiwg', 'marketplace', 'catalog.json'),
+        ];
+        const catalogPath = candidates.find((candidate) => fs.existsSync(candidate));
+        if (!catalogPath)
+            throw new Error('Catalog repository has no aiwg-marketplace-catalog.json or .aiwg/marketplace/catalog.json');
+        const trustStore = await readTrustStore({ ...scope, path: parseFlag(ctx.args, '--trust-store') });
+        const record = await registerCatalog({
+            ...scope,
+            catalogPath,
+            source: identity.canonicalRemote,
+            requestedRef: source.ref ?? requestedRef,
+            resolvedCommit: identity.resolvedCommit,
+            cachePath,
+            trustStore,
+        });
+        return jsonOrMessage(hasFlag(ctx.args, '--json'), record, `Added verified catalog ${record.catalogId} at ${record.resolvedCommit}`);
     }
-    ui.blank();
-    console.log(`  ${ui.brandMark()} ${ui.bold(`Marketplace Search: "${query}"`)}`);
-    if (source) {
-        ui.dim(`  Source: ${source}`);
+    catch (error) {
+        return failure(error);
     }
-    ui.rule();
-    if (results.length === 0) {
-        ui.dim('  No results found.');
+}
+async function handleSearch(ctx) {
+    const argument = requiredArg(ctx, 'Query required\n\nUsage: aiwg marketplace search <query>');
+    if (typeof argument !== 'string')
+        return argument;
+    try {
+        const source = parseFlag(ctx.args, '--source');
+        const scope = scopeFromContext(ctx);
+        const [skillResults, catalogResults] = await Promise.all([
+            !source || !source.startsWith('catalog:') ? searchSkills(argument, source) : Promise.resolve([]),
+            searchCatalogs(argument, scope),
+        ]);
+        const filteredCatalogs = source?.startsWith('catalog:')
+            ? catalogResults.filter((result) => result.catalogId === source.slice('catalog:'.length))
+            : source ? [] : catalogResults;
+        const results = [
+            ...skillResults,
+            ...filteredCatalogs.map((entry) => ({
+                name: `${entry.identity}@${entry.version}`,
+                description: entry.description,
+                source: `catalog:${entry.catalogId}`,
+                package: entry.identity,
+                provenanceCompleteness: entry.provenanceCompleteness,
+                verificationStatus: entry.verificationStatus,
+                observation: entry.observation,
+            })),
+        ];
+        if (hasFlag(ctx.args, '--json')) {
+            console.log(JSON.stringify(results, null, 2));
+            return { exitCode: 0 };
+        }
         ui.blank();
-        ui.dim('  Try a broader query or a different source.');
+        console.log(`  ${ui.brandMark()} ${ui.bold(`Marketplace Search: "${argument}"`)}`);
+        if (source)
+            ui.dim(`  Source: ${source}`);
+        ui.rule();
+        if (results.length === 0) {
+            ui.dim('  No results found.');
+            ui.blank();
+            return { exitCode: 0 };
+        }
+        const nameWidth = Math.max(12, ...results.map((result) => result.name.length));
+        const sourceWidth = Math.max(8, ...results.map((result) => result.source.length));
+        const pkgWidth = Math.max(10, ...results.map((result) => (result.package ?? '').length));
+        const header = ['Name'.padEnd(nameWidth), 'Source'.padEnd(sourceWidth), 'Package'.padEnd(pkgWidth), 'Description'].join('  ');
+        ui.dim(`  ${header}`);
+        ui.dim(`  ${'─'.repeat(header.length)}`);
+        for (const result of results) {
+            console.log(`  ${[
+                result.name.padEnd(nameWidth),
+                result.source.padEnd(sourceWidth),
+                (result.package ?? '').padEnd(pkgWidth),
+                result.description.length > 60 ? `${result.description.slice(0, 57)}...` : result.description,
+            ].join('  ')}`);
+        }
         ui.blank();
+        ui.dim(`  ${results.length} result${results.length === 1 ? '' : 's'}; catalog inclusion is not an endorsement`);
         return { exitCode: 0 };
     }
-    // Column widths
-    const nameWidth = Math.max(12, ...results.map((r) => r.name.length));
-    const sourceWidth = Math.max(8, ...results.map((r) => r.source.length));
-    const pkgWidth = Math.max(10, ...results.map((r) => (r.package ?? '').length));
-    const header = [
-        'Name'.padEnd(nameWidth),
-        'Source'.padEnd(sourceWidth),
-        'Package'.padEnd(pkgWidth),
-        'Description',
-    ].join('  ');
-    ui.dim(`  ${header}`);
-    ui.dim(`  ${'─'.repeat(header.length)}`);
-    for (const r of results) {
-        const row = [
-            r.name.padEnd(nameWidth),
-            r.source.padEnd(sourceWidth),
-            (r.package ?? '').padEnd(pkgWidth),
-            r.description.length > 60 ? r.description.slice(0, 57) + '...' : r.description,
-        ].join('  ');
-        console.log(`  ${row}`);
-    }
-    ui.blank();
-    ui.dim(`  ${results.length} result${results.length !== 1 ? 's' : ''}`);
-    ui.blank();
-    return { exitCode: 0 };
-}
-// ── List ───────────────────────────────────────────────────────────────────
-async function handleList(ctx) {
-    const jsonMode = hasFlag(ctx.args, '--json');
-    const packages = await listInstalledPackages();
-    if (jsonMode) {
-        console.log(JSON.stringify(packages, null, 2));
-        return { exitCode: 0 };
+    catch (error) {
+        return failure(error);
+    }
+}
+async function handleInfo(ctx) {
+    const argument = requiredArg(ctx, 'Package query required');
+    if (typeof argument !== 'string')
+        return argument;
+    try {
+        const scope = scopeFromContext(ctx);
+        const installed = await findIndexedPackage(argument, scope);
+        const catalogs = (await searchCatalogs(argument, scope)).filter((entry) => entry.identity === argument || `${entry.identity}@${entry.version}` === argument || entry.lockId === argument);
+        if (!installed && catalogs.length === 0)
+            return { exitCode: 1, message: `Error: Marketplace package '${argument}' was not found` };
+        const result = {
+            query: argument,
+            installed: installed ? {
+                lock: installed.lock,
+                verificationStatus: installed.verificationStatus,
+                installedAt: installed.installedAt,
+                catalogs: installed.catalogs,
+            } : null,
+            catalogObservations: catalogs,
+            endorsement: false,
+        };
+        return jsonOrMessage(hasFlag(ctx.args, '--json'), result, [
+            `Package: ${argument}`,
+            `Installed: ${installed ? 'yes' : 'no'}`,
+            ...(installed ? [`Lock: ${installed.lock.lockId}`, `Verification: ${installed.verificationStatus}`] : []),
+            `Catalog observations: ${catalogs.length} (not endorsements)`,
+            ...catalogs.map((entry) => `  ${entry.catalogId}: ${entry.provenanceCompleteness}% provenance, ${entry.verificationStatus}`),
+        ].join('\n'));
     }
-    ui.blank();
-    console.log(`  ${ui.brandMark()} ${ui.bold('Installed Marketplace Packages')}`);
-    ui.rule();
-    if (packages.length === 0) {
-        ui.dim('  No packages installed.');
+    catch (error) {
+        return failure(error);
+    }
+}
+function looksLikeGitUrl(value) {
+    return /^(?:https?:\/\/|ssh:\/\/|git@)/.test(value);
+}
+async function handleInstall(ctx) {
+    const argument = requiredArg(ctx, 'Git URL or catalog package required');
+    if (typeof argument !== 'string')
+        return argument;
+    try {
+        const scope = scopeFromContext(ctx);
+        const configDir = marketplaceConfigDir(scope);
+        const resolvedPolicy = await resolveVerificationPolicy(parseFlag(ctx.args, '--policy'), scope);
+        let rawRef = argument;
+        let expectedEnvelope;
+        let expectedLockId;
+        let catalogId;
+        let ref = parseFlag(ctx.args, '--ref');
+        if (!looksLikeGitUrl(argument)) {
+            const catalog = await resolveCatalogEntry(argument, scope);
+            expectedEnvelope = await readCatalogEnvelope(catalog, scope);
+            rawRef = catalog.canonicalRemote;
+            expectedLockId = catalog.lockId;
+            catalogId = catalog.catalogId;
+            ref = catalog.resolvedCommit;
+        }
+        const installed = await installPackage(rawRef, {
+            configDir,
+            ref,
+            packageSelector: parseFlag(ctx.args, '--package'),
+            refresh: hasFlag(ctx.args, '--refresh'),
+            verify: hasFlag(ctx.args, '--verify'),
+            verificationPolicy: resolvedPolicy.policy,
+            trustStore: resolvedPolicy.trustStore,
+            expectedEnvelope,
+            expectedLockId,
+            catalogId,
+            actor: 'local-user',
+        });
+        const result = {
+            package: installed.key,
+            version: installed.envelope.package.version,
+            lockId: installed.lock.lockId,
+            resolvedCommit: installed.lock.resolvedCommit,
+            verificationStatus: installed.verification.status,
+            scope: scope.projectLocal ? 'project-local' : 'global',
+            catalog: catalogId ?? null,
+        };
+        return jsonOrMessage(hasFlag(ctx.args, '--json'), result, `Installed ${result.package}@${result.version}\nLock: ${result.lockId}\nVerification: ${result.verificationStatus}`);
+    }
+    catch (error) {
+        return failure(error);
+    }
+}
+async function handleVerify(ctx) {
+    const argument = requiredArg(ctx, 'Package or lock query required');
+    if (typeof argument !== 'string')
+        return argument;
+    try {
+        const scope = scopeFromContext(ctx);
+        const resolved = await resolveVerificationPolicy(parseFlag(ctx.args, '--policy'), scope);
+        const result = await verifyIndexedPackage({
+            ...scope,
+            query: argument,
+            policy: resolved.policy,
+            trustStore: resolved.trustStore,
+            requireSignature: hasFlag(ctx.args, '--require-signature'),
+            actor: 'local-user',
+        });
+        if (!result.verification.ok)
+            return { exitCode: 1, message: `Verification failed: ${result.verification.errors.join('; ')}` };
+        return jsonOrMessage(hasFlag(ctx.args, '--json'), result.verification, `Verified ${result.entry.lock.identity}@${result.entry.lock.version} offline\nStatus: ${result.verification.status}\nLock: ${result.entry.lock.lockId}`);
+    }
+    catch (error) {
+        return failure(error);
+    }
+}
+async function handleExport(ctx) {
+    const argument = requiredArg(ctx, 'Package query required');
+    if (typeof argument !== 'string')
+        return argument;
+    const output = parseFlag(ctx.args, '--output');
+    if (!output)
+        return { exitCode: 1, message: 'Error: Usage: aiwg marketplace export <package> --output <archive.json>' };
+    try {
+        const result = await exportPortablePackage({ ...scopeFromContext(ctx), query: argument, output, actor: 'local-user' });
+        return jsonOrMessage(hasFlag(ctx.args, '--json'), { output: result.output, lockId: result.bundle.lock.lockId, receiptId: result.receipt.receiptId }, `Exported ${result.bundle.lock.identity}@${result.bundle.lock.version} to ${result.output}`);
+    }
+    catch (error) {
+        return failure(error);
+    }
+}
+async function handleImport(ctx) {
+    const argument = requiredArg(ctx, 'Portable archive path required');
+    if (typeof argument !== 'string')
+        return argument;
+    try {
+        const scope = scopeFromContext(ctx);
+        const resolved = await resolveVerificationPolicy(parseFlag(ctx.args, '--policy'), scope);
+        const result = await importPortablePackage({
+            ...scope,
+            input: argument,
+            verify: hasFlag(ctx.args, '--verify'),
+            policy: resolved.policy,
+            trustStore: resolved.trustStore,
+            actor: 'local-user',
+        });
+        return jsonOrMessage(hasFlag(ctx.args, '--json'), { lock: result.entry.lock, verification: result.verification, receipt: result.receipt }, `Imported ${result.entry.lock.identity}@${result.entry.lock.version}\nLock: ${result.entry.lock.lockId}\nVerification: ${result.verification.status}`);
+    }
+    catch (error) {
+        return failure(error);
+    }
+}
+async function handlePublish(ctx) {
+    const argument = requiredArg(ctx, 'Package source directory required');
+    if (typeof argument !== 'string')
+        return argument;
+    const privateKeyPath = parseFlag(ctx.args, '--key');
+    const publisher = parseFlag(ctx.args, '--publisher');
+    if (!privateKeyPath || !publisher) {
+        return { exitCode: 1, message: 'Error: Usage: aiwg marketplace publish <source> --key <ed25519.pem> --publisher <id> [--output <dir>]' };
+    }
+    try {
+        const outputDir = parseFlag(ctx.args, '--output') ?? path.join(path.resolve(argument), '.aiwg', 'marketplace');
+        const sequenceText = parseFlag(ctx.args, '--sequence');
+        const sequence = sequenceText === undefined ? undefined : Number(sequenceText);
+        if (sequence !== undefined && (!Number.isSafeInteger(sequence) || sequence < 1))
+            throw new Error('--sequence must be a positive integer');
+        const published = await publishLocalPackage({
+            sourceDir: argument,
+            outputDir,
+            privateKeyPath,
+            publicKeyPath: parseFlag(ctx.args, '--public-key'),
+            keyId: parseFlag(ctx.args, '--key-id'),
+            publisher,
+            requestedRef: parseFlag(ctx.args, '--ref'),
+            packageSelector: parseFlag(ctx.args, '--package'),
+            sequence,
+            actor: publisher,
+        });
+        return jsonOrMessage(hasFlag(ctx.args, '--json'), published, `Published signed envelope ${published.lock.lockId}\nEnvelope: ${published.envelopePath}\nFortemi: ${published.shardPath}`);
+    }
+    catch (error) {
+        return failure(error);
+    }
+}
+async function handleRemove(ctx) {
+    const argument = requiredArg(ctx, 'Catalog ID required');
+    if (typeof argument !== 'string')
+        return argument;
+    try {
+        const removed = await removeCatalog(argument, scopeFromContext(ctx));
+        return {
+            exitCode: removed ? 0 : 1,
+            message: removed
+                ? `Removed catalog ${argument}; existing immutable package locks remain valid`
+                : `Catalog '${argument}' was not registered`,
+        };
+    }
+    catch (error) {
+        return failure(error);
+    }
+}
+async function handleList(ctx) {
+    try {
+        const scope = scopeFromContext(ctx);
+        const packages = await listInstalledPackages(marketplaceConfigDir(scope));
+        if (hasFlag(ctx.args, '--json')) {
+            console.log(JSON.stringify(packages, null, 2));
+            return { exitCode: 0 };
+        }
         ui.blank();
-        ui.dim('  Install a package: aiwg install owner/name');
+        console.log(`  ${ui.brandMark()} ${ui.bold('Installed Marketplace Packages')}`);
+        ui.rule();
+        if (packages.length === 0) {
+            ui.dim('  No packages installed.');
+            ui.blank();
+            return { exitCode: 0 };
+        }
+        const keyWidth = Math.max(12, ...packages.map((pkg) => pkg.key.length));
+        const versionWidth = Math.max(7, ...packages.map((pkg) => pkg.version.length));
+        const header = ['Package'.padEnd(keyWidth), 'Version'.padEnd(versionWidth), 'Type', 'Verification'].join('  ');
+        ui.dim(`  ${header}`);
+        ui.dim(`  ${'─'.repeat(header.length)}`);
+        for (const pkg of packages) {
+            console.log(`  ${[pkg.key.padEnd(keyWidth), pkg.version.padEnd(versionWidth), pkg.type, pkg.verificationStatus ?? 'legacy'].join('  ')}`);
+        }
         ui.blank();
+        ui.dim(`  ${packages.length} package${packages.length === 1 ? '' : 's'} installed`);
         return { exitCode: 0 };
     }
-    const keyWidth = Math.max(12, ...packages.map((p) => p.key.length));
-    const versionWidth = Math.max(7, ...packages.map((p) => p.version.length));
-    const header = [
-        'Package'.padEnd(keyWidth),
-        'Version'.padEnd(versionWidth),
-        'Type',
-    ].join('  ');
-    ui.dim(`  ${header}`);
-    ui.dim(`  ${'─'.repeat(header.length)}`);
-    for (const pkg of packages) {
-        const row = [
-            pkg.key.padEnd(keyWidth),
-            pkg.version.padEnd(versionWidth),
-            pkg.type,
-        ].join('  ');
-        console.log(`  ${row}`);
-    }
-    ui.blank();
-    ui.dim(`  ${packages.length} package${packages.length !== 1 ? 's' : ''} installed`);
-    ui.blank();
-    return { exitCode: 0 };
+    catch (error) {
+        return failure(error);
+    }
 }
 //# sourceMappingURL=marketplace.js.map

package/dist/src/cli/handlers/subcommands.js

@@ -1062,6 +1062,7 @@ export const installPluginHandler = {
         const runner = createScriptRunner(frameworkRoot);
         return runner.run("tools/plugin/plugin-installer-cli.mjs", ctx.args, {
             cwd: ctx.cwd,
+            env: { AIWG_ROOT: frameworkRoot },
         });
     },
 };