@aiwg/cli 2026.8.11 → 2026.8.13

package/dist/src/providers/provider-definitions.js

@@ -1,6 +1,7 @@
 import { z } from 'zod';
 import { homedir } from 'os';
 import { join } from 'path';
+import { resolveHermesHomePath } from './hermes-home.js';
 import { getProviderCapabilities, } from './capability-matrix.js';
 const ArtifactPathsSchema = z.object({
     agents: z.string().nullable(),
@@ -464,7 +465,7 @@ const BUILT_IN_SEEDS = [
         id: 'hermes',
         aliases: [],
         builtIn: true,
-        surfaces: { primary: 'hermes', compatibility: [], precedence: ['AGENTS.md', '.hermes.md', '~/.hermes/skills/'], related: [] },
+        surfaces: { primary: 'hermes', compatibility: [], precedence: ['.hermes.md', 'AGENTS.md', resolveHermesHomePath('skills')], related: [] },
         detection: {
             env: [],
             process: ['hermes'],
@@ -474,18 +475,18 @@ const BUILT_IN_SEEDS = [
             artifacts: {
                 agents: null,
                 commands: null,
-                skills: '~/.hermes/.aiwg/skills',
+                skills: resolveHermesHomePath('skills', '.aiwg'),
                 rules: null,
                 behaviors: null,
             },
-            kernelSkills: '~/.hermes/skills',
+            kernelSkills: resolveHermesHomePath('skills'),
             configFile: 'AGENTS.md',
             contextFiles: { aiwgMd: true, agentsMd: true, claudeMdHook: false, hookFile: '.hermes.md', contextFile: 'AGENTS.md' },
         },
         smithPaths: {
             agents: null,
             commands: null,
-            skills: '~/.hermes/skills',
+            skills: resolveHermesHomePath('skills'),
             rules: null,
             fileExtension: '.md',
             configFile: 'AGENTS.md',

package/dist/src/providers/transformation-receipt-integration.js

@@ -0,0 +1,448 @@
+import { createHash } from 'node:crypto';
+import { access, lstat, readFile, readdir } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import path from 'node:path';
+import { readAiwgConfig } from '../config/aiwg-config.js';
+import { readUserRegistry } from '../config/user-registry.js';
+import { USER_SCOPE_PATHS } from '../cli/scope-resolver.js';
+import { getProviderDefinition, getProviderKernelSkillPath, normalizeProviderDefinitionId, resolveProviderPathValue, } from './provider-definitions.js';
+import { createProviderTransformationReceipt, diagnoseProviderTransformationReceipt, providerTransformationReceiptPath, writeProviderTransformationReceipt, } from './transformation-receipt.js';
+const TRANSFORMER_ID = 'aiwg-provider-transformer';
+const TRANSFORMER_VERSION = '1';
+const MANAGED_SIDECAR = '.aiwg-manifest.json';
+const MANAGED_DIRECTORY_MARKER = '.aiwg-managed';
+const MANAGED_FILE_MARKER = /^(?:<!-- aiwg:managed |# aiwg:managed )/m;
+const FRAMEWORK_BUNDLE_DIRS = {
+    all: 'sdlc-complete',
+    sdlc: 'sdlc-complete',
+    marketing: 'media-marketing-kit',
+    'media-curator': 'media-curator',
+    research: 'research-complete',
+    forensics: 'forensics-complete',
+    dfir: 'forensics-complete',
+    'security-engineering': 'security-engineering',
+    ops: 'ops-complete',
+    validation: 'validation-complete',
+    'knowledge-base': 'knowledge-base',
+};
+function sha256(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+function stable(value) {
+    if (Array.isArray(value))
+        return `[${value.map(stable).join(',')}]`;
+    if (value && typeof value === 'object') {
+        const record = value;
+        return `{${Object.keys(record).sort().map(key => `${JSON.stringify(key)}:${stable(record[key])}`).join(',')}}`;
+    }
+    return JSON.stringify(value) ?? 'null';
+}
+function portablePath(root, absolute) {
+    const relative = path.relative(root, absolute);
+    if (!relative || relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative))
+        return null;
+    return relative.split(path.sep).join('/');
+}
+async function regularFiles(root) {
+    const files = [];
+    let entries;
+    try {
+        entries = await readdir(root, { withFileTypes: true });
+    }
+    catch {
+        return files;
+    }
+    for (const entry of entries) {
+        const candidate = path.join(root, entry.name);
+        if (entry.isDirectory())
+            files.push(...await regularFiles(candidate));
+        else if (entry.isFile())
+            files.push(candidate);
+    }
+    return files;
+}
+async function addEntry(files, candidate) {
+    try {
+        const metadata = await lstat(candidate);
+        if (metadata.isFile())
+            files.add(candidate);
+        else if (metadata.isDirectory()) {
+            for (const file of await regularFiles(candidate))
+                files.add(file);
+        }
+    }
+    catch {
+        // A registry or sidecar entry can describe a stale partial deployment.
+        // Receipt finalization binds only successful on-disk outputs; an existing
+        // receipt remains responsible for diagnosing later deletion.
+    }
+}
+async function collectOwnedDirectory(directory, exactEntries, files) {
+    for (const entry of exactEntries)
+        await addEntry(files, path.join(directory, entry));
+    const sidecarPath = path.join(directory, MANAGED_SIDECAR);
+    try {
+        const sidecar = JSON.parse(await readFile(sidecarPath, 'utf8'));
+        const managed = sidecar.managed && typeof sidecar.managed === 'object'
+            ? Object.keys(sidecar.managed)
+            : [];
+        if (managed.length > 0)
+            files.add(sidecarPath);
+        for (const name of managed) {
+            if (name === path.basename(name) && name !== MANAGED_SIDECAR) {
+                await addEntry(files, path.join(directory, name));
+            }
+        }
+    }
+    catch {
+        // Missing or invalid sidecars are not ownership evidence.
+    }
+    let entries;
+    try {
+        entries = await readdir(directory, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        const candidate = path.join(directory, entry.name);
+        if (entry.isDirectory()) {
+            try {
+                const marker = await lstat(path.join(candidate, MANAGED_DIRECTORY_MARKER));
+                if (!marker.isFile())
+                    continue;
+                await addEntry(files, candidate);
+            }
+            catch {
+                // Unmarked directories remain operator-owned.
+            }
+            continue;
+        }
+        if (!entry.isFile() || entry.name === MANAGED_SIDECAR)
+            continue;
+        try {
+            const content = await readFile(candidate, 'utf8');
+            if (MANAGED_FILE_MARKER.test(content))
+                files.add(candidate);
+        }
+        catch {
+            // Unreadable files cannot establish an ownership signal.
+        }
+    }
+}
+function artifactPaths(provider, scope) {
+    const definition = getProviderDefinition(provider);
+    if (!definition)
+        return null;
+    if (scope === 'user')
+        return USER_SCOPE_PATHS[provider] ?? null;
+    return {
+        agents: definition.paths.artifacts.agents ?? '',
+        commands: definition.paths.artifacts.commands ?? '',
+        skills: definition.paths.artifacts.skills ?? '',
+        rules: definition.paths.artifacts.rules ?? '',
+        behaviors: definition.paths.artifacts.behaviors ?? '',
+    };
+}
+async function installedEntries(options) {
+    if (options.scope === 'user' && options.provider !== 'openhuman') {
+        return (await readUserRegistry()).installed;
+    }
+    return (await readAiwgConfig(options.projectRoot))?.installed ?? {};
+}
+function exactUserEntries(installed, bundles, provider, type) {
+    const entries = new Set();
+    for (const bundle of bundles) {
+        const deployment = installed[bundle]?.deployedTo[provider];
+        for (const name of deployment?.entries?.[type] ?? []) {
+            if (name === path.basename(name) && name !== '.' && name !== '..')
+                entries.add(name);
+        }
+    }
+    return [...entries].sort();
+}
+async function sourceBundleFiles(root) {
+    const files = [];
+    const walk = async (directory) => {
+        const entries = await readdir(directory, { withFileTypes: true });
+        for (const entry of entries) {
+            const candidate = path.join(directory, entry.name);
+            if (entry.isSymbolicLink())
+                throw new Error(`canonical source bundle contains a symbolic link: ${candidate}`);
+            if (entry.isDirectory())
+                await walk(candidate);
+            else if (entry.isFile())
+                files.push(candidate);
+            else
+                throw new Error(`canonical source bundle contains a non-regular entry: ${candidate}`);
+        }
+    };
+    await walk(root);
+    const inventory = await Promise.all(files.map(async (absolutePath) => {
+        const content = await readFile(absolutePath);
+        return {
+            path: path.relative(root, absolutePath).split(path.sep).join('/'),
+            sha256: sha256(content),
+            bytes: content.byteLength,
+            absolutePath,
+        };
+    }));
+    return inventory.sort((left, right) => left.path.localeCompare(right.path));
+}
+async function resolveSourceBundle(options, bundle, entry) {
+    const candidates = [];
+    if (entry?.source === 'project-local' && entry.localPath) {
+        candidates.push(path.resolve(options.projectRoot, entry.localPath, 'manifest.json'));
+    }
+    const frameworkDir = FRAMEWORK_BUNDLE_DIRS[bundle] ?? bundle;
+    candidates.push(path.join(options.frameworkRoot, 'agentic', 'code', 'frameworks', frameworkDir, 'manifest.json'), path.join(options.frameworkRoot, 'agentic', 'code', 'addons', bundle, 'manifest.json'), path.join(options.frameworkRoot, 'agentic', 'code', 'extensions', bundle, 'manifest.json'));
+    for (const candidate of candidates) {
+        try {
+            await access(candidate);
+            const root = path.dirname(candidate);
+            const files = await sourceBundleFiles(root);
+            if (files.length === 0)
+                continue;
+            return {
+                digest: sha256(stable(files.map(({ path: file, sha256: digest, bytes }) => ({ path: file, sha256: digest, bytes })))),
+                root,
+                files,
+                canonicalBytesAvailable: true,
+            };
+        }
+        catch {
+            // Continue through the canonical source locations.
+        }
+    }
+    const recorded = entry?.manifestHash?.replace(/^sha256:/, '');
+    return recorded && /^[a-f0-9]{64}$/.test(recorded)
+        ? { digest: recorded, root: '', files: [], canonicalBytesAvailable: false }
+        : null;
+}
+function receiptBundles(installed, options) {
+    const deployed = Object.keys(installed)
+        .filter(bundle => Boolean(installed[bundle]?.deployedTo[options.provider]))
+        .sort();
+    return deployed.length > 0 ? deployed : [...new Set(options.requestedBundles)].sort();
+}
+/**
+ * Convert an already signature-verified web release into the stable verifier
+ * result contract for the complete canonical bundle consumed by deployment.
+ * Every local file must match its signed descriptor; a registry's self-recorded
+ * manifestHash is never an authentication boundary.
+ */
+export async function sourceVerificationsFromSignedWebRelease(options, release) {
+    const installed = await installedEntries(options);
+    const results = {};
+    for (const bundle of receiptBundles(installed, options)) {
+        const entry = installed[bundle];
+        if (entry?.source === 'project-local')
+            continue;
+        const source = await resolveSourceBundle(options, bundle, entry);
+        if (!source?.canonicalBytesAvailable)
+            continue;
+        let matched = true;
+        for (const file of source.files) {
+            const relative = path.relative(options.frameworkRoot, file.absolutePath).split(path.sep).join('/');
+            if (!relative || relative === '..' || relative.startsWith('../')) {
+                matched = false;
+                break;
+            }
+            const descriptor = release.descriptors.get(`raw/${relative}`);
+            if (!descriptor || descriptor.sha256 !== file.sha256 || descriptor.size !== file.bytes) {
+                matched = false;
+                break;
+            }
+        }
+        if (!matched)
+            continue;
+        const artifactName = `aiwg:bundle-inventory:${bundle}`;
+        results[bundle] = {
+            schemaVersion: 'aiwg.verify.result.v1',
+            status: 'verified',
+            exitCode: 0,
+            artifact: { name: artifactName, sha256: source.digest },
+            policy: 'aiwg-signed-web-release',
+            identities: ['aiwg-release-publisher'],
+            ...(release.channelSequence === undefined ? {} : {
+                freshness: {
+                    namespace: 'aiwg',
+                    channel: release.selector,
+                    sequence: release.channelSequence,
+                    version: release.version,
+                },
+            }),
+            diagnostics: [{
+                    code: 'SIGNED_RELEASE_DESCRIPTOR',
+                    message: `Exact canonical source bytes match signed release manifest ${release.manifestDigest}`,
+                }],
+        };
+    }
+    return results;
+}
+async function sourceEvidence(options, installed) {
+    const bundles = [...new Set(options.requestedBundles)].sort();
+    const materials = [];
+    let authenticated = Boolean(options.sourceVerifications);
+    for (const bundle of bundles) {
+        const entry = installed[bundle];
+        const source = await resolveSourceBundle(options, bundle, entry);
+        if (!source) {
+            return {
+                subject: `aiwg:deployment:${sha256(bundles.join('\0')).slice(0, 24)}`,
+                sha256: sha256(stable(materials)),
+                verification: 'failed',
+            };
+        }
+        const verification = options.sourceVerifications?.[bundle];
+        if (!source.canonicalBytesAvailable
+            || verification?.status !== 'verified'
+            || verification.artifact.sha256 !== source.digest) {
+            authenticated = false;
+        }
+        materials.push({
+            bundle,
+            digest: source.digest,
+            source: entry?.source ?? 'unknown',
+            version: entry?.version ?? 'unknown',
+        });
+    }
+    const digest = sha256(stable(materials));
+    return {
+        subject: `aiwg:deployment:${digest.slice(0, 24)}`,
+        sha256: digest,
+        verification: options.sourceVerifications
+            ? authenticated ? 'verified' : 'failed'
+            : 'policy-exempt',
+    };
+}
+function transformerEvidence(provider, scope) {
+    const definition = getProviderDefinition(provider);
+    const adapterContract = definition
+        ? {
+            adapters: definition.adapters,
+            artifacts: definition.paths.artifacts,
+            kernelSkills: definition.paths.kernelSkills,
+            scope,
+            userArtifacts: scope === 'user' ? USER_SCOPE_PATHS[provider] ?? null : null,
+        }
+        : { provider, scope };
+    return {
+        id: TRANSFORMER_ID,
+        version: TRANSFORMER_VERSION,
+        providerAdapter: provider,
+        providerAdapterVersion: sha256(stable(adapterContract)),
+    };
+}
+export async function resolveProviderReceiptRuntimeEvidence(rawOptions) {
+    const provider = normalizeProviderDefinitionId(rawOptions.provider) ?? rawOptions.provider;
+    const options = { ...rawOptions, provider };
+    const installed = await installedEntries(options);
+    const deployedBundles = receiptBundles(installed, options);
+    const evidenceOptions = deployedBundles.length > 0
+        ? { ...options, requestedBundles: deployedBundles }
+        : options;
+    const paths = artifactPaths(provider, options.scope);
+    const outputRoot = path.resolve(options.outputRoot ?? (options.scope === 'user' ? homedir() : options.projectRoot));
+    const ownedFiles = new Set();
+    if (paths) {
+        for (const type of ['agents', 'commands', 'skills', 'rules', 'behaviors']) {
+            const configured = paths[type];
+            if (!configured)
+                continue;
+            const directory = resolveProviderPathValue(configured, outputRoot);
+            const entries = options.scope === 'user'
+                ? exactUserEntries(installed, evidenceOptions.requestedBundles, provider, type)
+                : [];
+            await collectOwnedDirectory(directory, entries, ownedFiles);
+        }
+        if (options.scope === 'project') {
+            const kernel = resolveProviderPathValue(getProviderKernelSkillPath(provider), outputRoot);
+            if (kernel)
+                await collectOwnedDirectory(kernel, [], ownedFiles);
+        }
+    }
+    const outputPaths = [...ownedFiles]
+        .map(file => portablePath(outputRoot, file))
+        .filter((file) => Boolean(file))
+        .sort();
+    return {
+        provider,
+        outputRoot,
+        outputPaths,
+        source: await sourceEvidence(evidenceOptions, installed),
+        transformer: transformerEvidence(provider, options.scope),
+    };
+}
+export async function finalizeProviderTransformationReceipt(options) {
+    if (!options.sourceVerifications) {
+        return {
+            status: 'skipped',
+            receiptPath: null,
+            outputCount: 0,
+            reason: 'authenticated canonical source evidence was not supplied',
+        };
+    }
+    const evidence = await resolveProviderReceiptRuntimeEvidence(options);
+    if (evidence.source.verification !== 'verified') {
+        return {
+            status: 'skipped',
+            receiptPath: null,
+            outputCount: 0,
+            reason: evidence.source.verification === 'failed'
+                ? 'canonical source verification failed'
+                : 'authenticated canonical source evidence was not supplied',
+        };
+    }
+    if (evidence.outputPaths.length === 0) {
+        return { status: 'skipped', receiptPath: null, outputCount: 0, reason: 'no managed provider outputs were found' };
+    }
+    const verifiedSource = {
+        subject: evidence.source.subject,
+        sha256: evidence.source.sha256,
+        verification: evidence.source.verification,
+    };
+    const receipt = await createProviderTransformationReceipt({
+        projectRoot: options.projectRoot,
+        outputRoot: evidence.outputRoot,
+        provider: evidence.provider,
+        scope: options.scope,
+        generatedAt: options.generatedAt,
+        source: verifiedSource,
+        transformer: evidence.transformer,
+        outputPaths: evidence.outputPaths,
+    });
+    return {
+        status: 'written',
+        receiptPath: await writeProviderTransformationReceipt(options.projectRoot, receipt),
+        outputCount: receipt.outputs.length,
+    };
+}
+export async function diagnoseIntegratedProviderTransformationReceipt(options) {
+    const provider = normalizeProviderDefinitionId(options.provider) ?? options.provider;
+    const receiptPath = providerTransformationReceiptPath(options.projectRoot, provider, options.scope);
+    try {
+        await access(receiptPath);
+    }
+    catch {
+        return {
+            status: 'missing-receipt',
+            receiptPath,
+            checkedOutputs: 0,
+            findings: [{
+                    kind: 'missing-receipt',
+                    message: 'No transformation receipt exists for this provider deployment.',
+                }],
+        };
+    }
+    const evidence = await resolveProviderReceiptRuntimeEvidence(options);
+    return diagnoseProviderTransformationReceipt({
+        projectRoot: options.projectRoot,
+        outputRoot: evidence.outputRoot,
+        provider: evidence.provider,
+        scope: options.scope,
+        source: evidence.source,
+        transformer: evidence.transformer,
+    });
+}
+//# sourceMappingURL=transformation-receipt-integration.js.map