@aiwg/cli 2026.8.11 → 2026.8.12

package/dist/src/config/cli.js

@@ -140,7 +140,8 @@ async function handleSet(config, args) {
 //   aiwg config get --project remotes.primary
 //
 // Set validates enum membership for known fields (delivery.mode,
-// delivery.merge_style, delivery.force_push_policy) before writing.
+// delivery.merge_style, delivery.force_push_policy, remotes.issue_provider)
+// before writing.
 const ENUM_RULES = {
     'delivery.mode': ['direct', 'feature-branch', 'pr-required'],
     'delivery.merge_style': ['rebase-merge', 'squash', 'merge', 'fast-forward-only'],
@@ -149,6 +150,7 @@ const ENUM_RULES = {
     'delivery.signing.enforce': ['commits', 'tags', 'all'],
     'delivery.release_signing.format': ['openpgp', 'ssh', 'x509'],
     'delivery.release_signing.enforce': ['commits', 'tags', 'all'],
+    'remotes.issue_provider': ['gitea', 'github', 'local'],
     'remotes.tracker_actor.via': ['tea', 'gh', 'mcp', 'api'],
     'remotes.transport.protocol': ['ssh', 'https'],
     'repo_maintainer.tiers.local': ['collaborator', 'maintainer', 'admin'],

package/dist/src/config/gitignore.js

@@ -9,6 +9,10 @@
  */
 import * as fs from 'fs/promises';
 import * as path from 'path';
+import { execFile } from 'child_process';
+import { promisify } from 'util';
+const execFileAsync = promisify(execFile);
+const GITIGNORE_PROBE_BASENAME = '.aiwg-ignore-probe';
 // ===========================
 // Recommended Patterns
 // ===========================
@@ -62,6 +66,63 @@ export const ALL_RECOMMENDED_PATTERNS = [
 // ===========================
 // Core Functions
 // ===========================
+function isTextuallyCovered(pattern, lines) {
+    if (lines.includes(pattern))
+        return true;
+    if (lines.includes(pattern.replace(/\/$/, '')))
+        return true;
+    const parts = pattern.split('/').filter(Boolean);
+    for (let i = 1; i < parts.length; i++) {
+        const parent = parts.slice(0, i).join('/') + '/';
+        if (lines.includes(parent) || lines.includes(parent.replace(/\/$/, ''))) {
+            return true;
+        }
+    }
+    return false;
+}
+function probePath(pattern) {
+    return pattern.endsWith('/') ? `${pattern}${GITIGNORE_PROBE_BASENAME}` : pattern;
+}
+async function isGitWorktree(projectRoot) {
+    try {
+        const { stdout } = await execFileAsync('git', ['rev-parse', '--is-inside-work-tree'], {
+            cwd: projectRoot,
+            windowsHide: true,
+        });
+        return stdout.trim() === 'true';
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Resolve effective ignore coverage through Git when possible. This honors
+ * negations, .git/info/exclude, and core.excludesFile. A textual fallback keeps
+ * the helper deterministic outside Git worktrees or when Git is unavailable.
+ *
+ * @implements #2106
+ */
+async function resolveCoveredPatterns(projectRoot, patterns, lines) {
+    if (!(await isGitWorktree(projectRoot))) {
+        return new Set(patterns.filter(pattern => isTextuallyCovered(pattern, lines)));
+    }
+    const covered = await Promise.all(patterns.map(async (pattern) => {
+        try {
+            await execFileAsync('git', ['check-ignore', '--quiet', '--', probePath(pattern)], {
+                cwd: projectRoot,
+                windowsHide: true,
+            });
+            return true;
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === 1)
+                return false;
+            return isTextuallyCovered(pattern, lines);
+        }
+    }));
+    return new Set(patterns.filter((_, index) => covered[index]));
+}
 /**
  * Check which recommended patterns are missing from the project's .gitignore.
  */
@@ -77,26 +138,10 @@ export async function checkGitignore(projectRoot) {
         // File doesn't exist — all patterns are missing
     }
     const lines = content.split('\n').map(l => l.trim());
-    const isCovered = (pattern) => {
-        // Exact match
-        if (lines.includes(pattern))
-            return true;
-        // Pattern without trailing slash is also sufficient
-        if (lines.includes(pattern.replace(/\/$/, '')))
-            return true;
-        // Parent directory is ignored (covers all children)
-        const parts = pattern.split('/').filter(Boolean);
-        for (let i = 1; i < parts.length; i++) {
-            const parent = parts.slice(0, i).join('/') + '/';
-            if (lines.includes(parent) || lines.includes(parent.replace(/\/$/, ''))) {
-                return true;
-            }
-        }
-        return false;
-    };
-    const missingRuntime = AIWG_RUNTIME_PATTERNS.filter(p => !isCovered(p));
-    const missingSession = CLAUDE_SESSION_PATTERNS.filter(p => !isCovered(p));
-    const missingProvider = PROVIDER_CONVENTIONAL_PATTERNS.filter(p => !isCovered(p));
+    const covered = await resolveCoveredPatterns(projectRoot, ALL_RECOMMENDED_PATTERNS, lines);
+    const missingRuntime = AIWG_RUNTIME_PATTERNS.filter(p => !covered.has(p));
+    const missingSession = CLAUDE_SESSION_PATTERNS.filter(p => !covered.has(p));
+    const missingProvider = PROVIDER_CONVENTIONAL_PATTERNS.filter(p => !covered.has(p));
     const missing = [...missingRuntime, ...missingSession, ...missingProvider];
     return { exists, missing, missingRuntime, missingSession, missingProvider };
 }
@@ -116,10 +161,11 @@ export async function appendGitignore(projectRoot, patterns) {
         // File doesn't exist, will create
     }
     const existingLines = existing.split('\n').map(l => l.trim());
+    const covered = await resolveCoveredPatterns(projectRoot, patterns, existingLines);
     const toAdd = [];
     const alreadyPresent = [];
     for (const pattern of patterns) {
-        if (existingLines.includes(pattern) || existingLines.includes(pattern.replace(/\/$/, ''))) {
+        if (covered.has(pattern)) {
             alreadyPresent.push(pattern);
         }
         else {

package/dist/src/config/workspace.js

@@ -119,14 +119,21 @@ async function resolveEndpoint(repoPath, remote, providerHint) {
                 : 'unknown',
     };
 }
+function trackerProviderHint(remotes, fallback) {
+    const configured = remotes.issue_provider;
+    if (configured === 'gitea' || configured === 'github')
+        return configured;
+    return fallback;
+}
 async function resolveMember(entry, workspaceRoot) {
     const memberPath = resolveFrom(workspaceRoot, entry.path);
     const configPath = getConfigPath(memberPath);
     const config = await readAiwgConfig(memberPath);
     const remotes = resolveRemotes(config?.remotes);
+    const issueProviderHint = trackerProviderHint(remotes, entry.provider);
     const [primary, issueTracker, ci] = await Promise.all([
         resolveEndpoint(memberPath, remotes.primary, entry.provider),
-        resolveEndpoint(memberPath, remotes.issue_tracker, entry.provider),
+        resolveEndpoint(memberPath, remotes.issue_tracker, issueProviderHint),
         resolveEndpoint(memberPath, remotes.ci, entry.provider),
     ]);
     const drift = [];

package/dist/src/extensions/commands/definitions.js

@@ -2478,6 +2478,24 @@ export const evidenceCommand = {
         },
     },
 };
+export const artifactVerifyCommand = {
+    id: 'verify',
+    type: 'command',
+    name: 'Artifact Verification',
+    description: 'Verify cross-asset DSSE provenance and manage versioned trust roots',
+    version: '1.0.0',
+    capabilities: ['cli', 'security', 'dsse', 'sigstore', 'provenance', 'trust-policy'],
+    keywords: ['verify', 'artifact', 'attestation', 'dsse', 'sigstore', 'trust-root', 'revocation'],
+    category: 'utility',
+    platforms: { claude: 'full', generic: 'full' },
+    deployment: { pathTemplate: '.{platform}/commands/{id}.md', core: true },
+    metadata: {
+        type: 'command',
+        template: 'utility',
+        argumentHint: '<artifact> --attestation <path> --policy <root.json> [--offline] [--json] | trust <bootstrap|update|status>',
+        allowedTools: ['Read', 'Bash'],
+    },
+};
 export const costReportCommand = {
     id: 'cost-report',
     type: 'skill',
@@ -3614,6 +3632,7 @@ export const commandDefinitions = [
     teamCommand,
     // Metrics (4)
     evidenceCommand,
+    artifactVerifyCommand,
     costReportCommand,
     costHistoryCommand,
     metricsTokensCommand,

package/dist/src/marketplace/artifact-attestation.js

@@ -0,0 +1,195 @@
+import { createArtifactAttestation, serializeArtifactAttestation, } from '../security/artifact-attestation.js';
+import { verifyArtifact, } from '../security/artifact-verifier.js';
+import { canonicalJson as artifactCanonicalJson, parseTrustRoot, sha256 as artifactSha256, } from '../security/artifact-trust.js';
+import { canonicalJson, createPackageLock, verifyProvenanceEnvelope, } from './provenance.js';
+export const MARKETPLACE_ENVELOPE_SUBJECT = 'aiwg-marketplace-envelope.json';
+export function serializeMarketplaceEnvelope(envelope) {
+    return Buffer.from(`${canonicalJson(envelope)}\n`, 'utf8');
+}
+export function marketplaceArtifactScope(envelope) {
+    return {
+        assetType: 'marketplace-envelope',
+        namespace: envelope.package.namespace,
+        channel: `marketplace:${envelope.package.name}`,
+    };
+}
+function requiredMaterialNames(materials) {
+    const names = new Set(materials.map(material => material.name));
+    for (const required of ['lock', 'inventory', 'git-tree', 'fortemi-shard', 'receipt', 'sbom', 'license']) {
+        if (!names.has(required))
+            throw new Error(`Marketplace attestation requires '${required}' material`);
+    }
+}
+export function createMarketplaceArtifactAttestation(options) {
+    requiredMaterialNames(options.materials);
+    const scope = marketplaceArtifactScope(options.envelope);
+    const envelopeBytes = serializeMarketplaceEnvelope(options.envelope);
+    const provenanceBytes = Buffer.from(artifactCanonicalJson(options.envelope.provenance), 'utf8');
+    const dependencies = options.envelope.package.dependencies
+        .filter(dependency => !dependency.optional)
+        .map(dependency => {
+        if (!dependency.lockId)
+            throw new Error(`Required dependency '${dependency.identity}' has no immutable lockId`);
+        return {
+            name: dependency.identity,
+            uri: `aiwg:marketplace-lock:${dependency.lockId}`,
+            mediaType: 'application/vnd.aiwg.marketplace-lock.v1+json',
+            digest: { sha256: dependency.lockId.replace(/^sha256:/, '') },
+        };
+    });
+    const attestation = createArtifactAttestation({
+        artifact: {
+            name: MARKETPLACE_ENVELOPE_SUBJECT,
+            bytes: envelopeBytes,
+            mediaType: 'application/vnd.aiwg.marketplace-envelope.v1+json',
+        },
+        assetType: scope.assetType,
+        publisher: {
+            id: options.publisherIdentity ?? options.envelope.publisher.id,
+            namespace: scope.namespace,
+            role: 'marketplace-publisher',
+        },
+        publication: {
+            version: options.envelope.package.version,
+            channel: scope.channel,
+            sequence: options.envelope.publication.sequence,
+            sourceUri: options.envelope.source.canonicalRemote,
+        },
+        issuedAt: options.issuedAt ?? options.envelope.publication.publishedAt,
+        expiresAt: options.expiresAt,
+        derivation: {
+            builder: options.builder,
+            materials: options.materials.map(material => ({
+                name: material.name,
+                uri: material.uri,
+                ...(material.mediaType ? { mediaType: material.mediaType } : {}),
+                digest: { sha256: artifactSha256(material.bytes) },
+            })),
+            reproducible: true,
+        },
+        provenanceGraph: {
+            standard: 'W3C-PROV',
+            uri: 'aiwg:marketplace-provenance:w3c-prov',
+            sha256: artifactSha256(provenanceBytes),
+        },
+        dependencies,
+        privateKey: options.privateKey,
+    });
+    return { attestation, materials: options.materials };
+}
+export function serializeMarketplaceAttestation(evidence) {
+    return serializeArtifactAttestation(evidence.attestation);
+}
+function signedMarketplacePolicy(root) {
+    return root.signed.policy.marketplace ?? {
+        evidenceMode: 'marketplace-only',
+        legacySignatureMigrationGate: false,
+        recursiveDependencies: 'if-present',
+    };
+}
+export async function verifyMarketplaceEvidence(options) {
+    const authenticatedRoot = options.artifact ? parseTrustRoot(options.artifact.rootBytes) : undefined;
+    const signedPolicy = authenticatedRoot ? signedMarketplacePolicy(authenticatedRoot) : {
+        evidenceMode: 'marketplace-only',
+        legacySignatureMigrationGate: false,
+        recursiveDependencies: 'if-present',
+    };
+    const legacyRequired = signedPolicy.evidenceMode !== 'cross-asset-required'
+        || !signedPolicy.legacySignatureMigrationGate;
+    const marketplace = await verifyProvenanceEnvelope({
+        envelope: options.envelope,
+        contentRoot: options.contentRoot,
+        checkoutPath: options.checkoutPath,
+        trustStore: options.trustStore,
+        installedLocks: options.installedLocks,
+        at: options.artifact?.now ? new Date(options.artifact.now) : undefined,
+        policy: legacyRequired
+            ? {
+                requireSignature: true,
+                allowIntegrityOnly: false,
+                requireDependencyLocks: signedPolicy.recursiveDependencies === 'required',
+                ...options.marketplacePolicy,
+            }
+            : {
+                requireDependencyLocks: signedPolicy.recursiveDependencies === 'required',
+                ...options.marketplacePolicy,
+            },
+    });
+    const errors = marketplace.ok ? [] : marketplace.errors.map(error => `marketplace: ${error}`);
+    let crossAsset;
+    const crossRequired = signedPolicy.evidenceMode !== 'marketplace-only';
+    if (options.artifact) {
+        const scope = marketplaceArtifactScope(options.envelope);
+        crossAsset = await verifyArtifact({
+            artifactBytes: serializeMarketplaceEnvelope(options.envelope),
+            artifactName: MARKETPLACE_ENVELOPE_SUBJECT,
+            attestation: options.artifact.evidence.attestation,
+            rootBytes: options.artifact.rootBytes,
+            state: options.artifact.state,
+            materials: new Map(options.artifact.evidence.materials.map(material => [material.uri, material.bytes])),
+            expectedScope: scope,
+            offline: options.artifact.offline,
+            now: options.artifact.now,
+        });
+        if (crossAsset.status !== 'verified')
+            errors.push(`cross-asset: ${crossAsset.status}`);
+    }
+    else if (crossRequired) {
+        errors.push('cross-asset: required evidence is unavailable');
+    }
+    if (legacyRequired && marketplace.status !== 'verified')
+        errors.push('marketplace: a trusted legacy publisher signature remains mandatory');
+    if (crossAsset?.status === 'verified' && marketplace.signer && options.trustStore) {
+        const legacyKey = options.trustStore.keys.find(key => key.keyId === marketplace.signer);
+        if (!legacyKey?.artifactIdentityId || !crossAsset.identities.includes(legacyKey.artifactIdentityId)) {
+            errors.push('trust-parity: marketplace and cross-asset verification resolved different publisher authorities');
+        }
+    }
+    return {
+        ok: errors.length === 0,
+        status: errors.length === 0 ? 'verified' : 'failed',
+        marketplace,
+        ...(crossAsset ? { crossAsset } : {}),
+        errors: [...new Set(errors)],
+    };
+}
+export async function verifyMarketplaceDependencyClosure(options) {
+    const errors = [];
+    const verified = new Set();
+    const active = new Set();
+    const visit = async (envelope) => {
+        const lock = createPackageLock(envelope, envelope.publication.publishedAt);
+        if (verified.has(lock.lockId))
+            return;
+        if (active.has(lock.lockId)) {
+            errors.push(`dependency cycle detected at ${lock.lockId}`);
+            return;
+        }
+        active.add(lock.lockId);
+        if (!await options.verify(envelope))
+            errors.push(`dependency evidence failed for ${lock.lockId}`);
+        for (const dependency of envelope.package.dependencies.filter(item => !item.optional)) {
+            if (!dependency.lockId) {
+                if (options.required)
+                    errors.push(`required dependency '${dependency.identity}' has no immutable lockId`);
+                continue;
+            }
+            const child = options.packages.get(dependency.lockId);
+            if (!child) {
+                errors.push(`required dependency '${dependency.identity}' is unavailable at ${dependency.lockId}`);
+                continue;
+            }
+            const actual = createPackageLock(child, child.publication.publishedAt).lockId;
+            if (actual !== dependency.lockId) {
+                errors.push(`dependency substitution for '${dependency.identity}': expected ${dependency.lockId}, got ${actual}`);
+                continue;
+            }
+            await visit(child);
+        }
+        active.delete(lock.lockId);
+        verified.add(lock.lockId);
+    };
+    await visit(options.root);
+    return { ok: errors.length === 0, errors, verifiedLocks: [...verified].sort() };
+}
+//# sourceMappingURL=artifact-attestation.js.map