@aiwg/cli 2026.8.11 → 2026.8.13

package/schemas/security/aiwg-artifact-provenance.v1.schema.json

@@ -0,0 +1,204 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://aiwg.io/schemas/security/aiwg-artifact-provenance.v1.schema.json",
+  "title": "AIWG artifact provenance in-toto Statement v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["_type", "subject", "predicateType", "predicate"],
+  "properties": {
+    "_type": {
+      "const": "https://in-toto.io/Statement/v1"
+    },
+    "subject": {
+      "type": "array",
+      "minItems": 1,
+      "items": { "$ref": "#/$defs/resourceDescriptor" }
+    },
+    "predicateType": {
+      "const": "https://aiwg.io/attestations/artifact-provenance/v1"
+    },
+    "predicate": {
+      "$ref": "#/$defs/predicate"
+    }
+  },
+  "$defs": {
+    "sha256": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$"
+    },
+    "nonEmpty": {
+      "type": "string",
+      "minLength": 1
+    },
+    "resourceDescriptor": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["name", "digest"],
+      "properties": {
+        "name": { "$ref": "#/$defs/nonEmpty" },
+        "uri": { "type": "string", "format": "uri-reference" },
+        "mediaType": { "$ref": "#/$defs/nonEmpty" },
+        "digest": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["sha256"],
+          "properties": {
+            "sha256": { "$ref": "#/$defs/sha256" }
+          }
+        }
+      }
+    },
+    "assetType": {
+      "oneOf": [
+        {
+          "enum": [
+            "setup-manifest",
+            "agentic-flow",
+            "agent",
+            "skill",
+            "command",
+            "rule",
+            "behavior",
+            "tool",
+            "mcp-server",
+            "hook",
+            "workflow",
+            "profile",
+            "persona",
+            "theme",
+            "media",
+            "reference",
+            "template",
+            "documentation",
+            "framework",
+            "addon",
+            "extension",
+            "plugin",
+            "schema",
+            "package",
+            "release-manifest",
+            "sbom",
+            "web-resource",
+            "index",
+            "fortemi-shard",
+            "fortemi-receipt",
+            "marketplace-envelope",
+            "marketplace-catalog",
+            "generated-provider-artifact",
+            "project-artifact",
+            "site-deployment"
+          ]
+        },
+        {
+          "type": "string",
+          "format": "uri",
+          "pattern": "^https://"
+        }
+      ]
+    },
+    "publisher": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "namespace"],
+      "properties": {
+        "id": { "$ref": "#/$defs/nonEmpty" },
+        "namespace": { "$ref": "#/$defs/nonEmpty" },
+        "role": { "$ref": "#/$defs/nonEmpty" }
+      }
+    },
+    "publication": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["version", "channel", "sequence"],
+      "properties": {
+        "version": { "$ref": "#/$defs/nonEmpty" },
+        "channel": { "$ref": "#/$defs/nonEmpty" },
+        "sequence": { "type": "integer", "minimum": 1 },
+        "sourceUri": { "type": "string", "format": "uri" },
+        "collection": { "$ref": "#/$defs/resourceDescriptor" },
+        "supersedes": { "$ref": "#/$defs/resourceDescriptor" }
+      }
+    },
+    "material": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["uri", "digest"],
+      "properties": {
+        "name": { "$ref": "#/$defs/nonEmpty" },
+        "uri": { "type": "string", "format": "uri-reference" },
+        "mediaType": { "$ref": "#/$defs/nonEmpty" },
+        "digest": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["sha256"],
+          "properties": {
+            "sha256": { "$ref": "#/$defs/sha256" }
+          }
+        }
+      }
+    },
+    "derivation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["builder", "materials"],
+      "properties": {
+        "builder": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["id"],
+          "properties": {
+            "id": { "$ref": "#/$defs/nonEmpty" },
+            "version": { "$ref": "#/$defs/nonEmpty" }
+          }
+        },
+        "transformation": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["id", "version"],
+          "properties": {
+            "id": { "$ref": "#/$defs/nonEmpty" },
+            "version": { "$ref": "#/$defs/nonEmpty" },
+            "provider": { "$ref": "#/$defs/nonEmpty" }
+          }
+        },
+        "materials": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "$ref": "#/$defs/material" }
+        },
+        "reproducible": { "type": "boolean" },
+        "invocationId": { "$ref": "#/$defs/nonEmpty" }
+      }
+    },
+    "provenanceGraph": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["standard", "uri", "sha256"],
+      "properties": {
+        "standard": { "const": "W3C-PROV" },
+        "uri": { "type": "string", "format": "uri-reference" },
+        "sha256": { "$ref": "#/$defs/sha256" }
+      }
+    },
+    "predicate": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["schemaVersion", "assetType", "publisher", "publication", "issuedAt"],
+      "properties": {
+        "schemaVersion": { "const": "aiwg.artifact-provenance.v1" },
+        "assetType": { "$ref": "#/$defs/assetType" },
+        "publisher": { "$ref": "#/$defs/publisher" },
+        "publication": { "$ref": "#/$defs/publication" },
+        "issuedAt": { "type": "string", "format": "date-time" },
+        "notBefore": { "type": "string", "format": "date-time" },
+        "expiresAt": { "type": "string", "format": "date-time" },
+        "derivation": { "$ref": "#/$defs/derivation" },
+        "provenanceGraph": { "$ref": "#/$defs/provenanceGraph" },
+        "dependencies": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/resourceDescriptor" }
+        }
+      }
+    }
+  }
+}

package/schemas/security/aiwg-artifact-trust-root.v1.schema.json

@@ -0,0 +1,59 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://aiwg.io/schemas/security/aiwg-artifact-trust-root.v1.schema.json",
+  "title": "AIWG versioned artifact trust root v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["mediaType", "signed", "signatures"],
+  "properties": {
+    "mediaType": { "const": "application/vnd.aiwg.artifact-trust-root.v1+json" },
+    "signed": {
+      "type": "object", "additionalProperties": false,
+      "required": ["schemaVersion", "version", "issuedAt", "expiresAt", "identities", "sigstoreProfiles", "root", "delegations", "revocations", "policy"],
+      "properties": {
+        "schemaVersion": { "const": "aiwg.artifact-trust-root.v1" },
+        "version": { "type": "integer", "minimum": 1 }, "issuedAt": { "type": "string", "format": "date-time" }, "expiresAt": { "type": "string", "format": "date-time" },
+        "identities": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/identity" } },
+        "sigstoreProfiles": { "type": "array", "items": { "$ref": "#/$defs/sigstoreProfile" } },
+        "root": { "$ref": "#/$defs/role" },
+        "delegations": { "type": "array", "items": { "$ref": "#/$defs/delegation" } },
+        "revocations": { "type": "array", "items": { "$ref": "#/$defs/revocation" } },
+        "policy": {
+          "type": "object", "additionalProperties": false, "required": ["name", "requireMaterialDigests", "maxFreezeSeconds", "allowPolicyExempt"],
+          "properties": {
+            "name": { "$ref": "#/$defs/nonEmpty" },
+            "requireMaterialDigests": { "type": "boolean" },
+            "maxFreezeSeconds": { "type": "integer", "minimum": 0 },
+            "allowPolicyExempt": { "type": "array", "items": { "$ref": "#/$defs/scope" } },
+            "marketplace": {
+              "type": "object", "additionalProperties": false,
+              "required": ["evidenceMode", "legacySignatureMigrationGate", "recursiveDependencies"],
+              "properties": {
+                "evidenceMode": { "enum": ["marketplace-only", "dual-required", "cross-asset-required"] },
+                "legacySignatureMigrationGate": { "type": "boolean" },
+                "recursiveDependencies": { "enum": ["if-present", "required"] }
+              }
+            }
+          }
+        }
+      }
+    },
+    "signatures": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/signature" } }
+  },
+  "$defs": {
+    "nonEmpty": { "type": "string", "minLength": 1 },
+    "stringSet": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "$ref": "#/$defs/nonEmpty" } },
+    "scope": { "type": "object", "additionalProperties": false, "required": ["assetTypes", "namespaces", "channels"], "properties": { "assetTypes": { "$ref": "#/$defs/stringSet" }, "namespaces": { "$ref": "#/$defs/stringSet" }, "channels": { "$ref": "#/$defs/stringSet" } } },
+    "role": { "type": "object", "additionalProperties": false, "required": ["keyIds", "threshold", "scope"], "properties": { "keyIds": { "$ref": "#/$defs/stringSet" }, "threshold": { "type": "integer", "minimum": 1 }, "scope": { "$ref": "#/$defs/scope" } } },
+    "delegation": { "type": "object", "additionalProperties": false, "required": ["id", "parent", "keyIds", "threshold", "scope"], "properties": { "id": { "$ref": "#/$defs/nonEmpty" }, "parent": { "$ref": "#/$defs/nonEmpty" }, "keyIds": { "$ref": "#/$defs/stringSet" }, "threshold": { "type": "integer", "minimum": 1 }, "scope": { "$ref": "#/$defs/scope" }, "notBefore": { "type": "string", "format": "date-time" }, "expiresAt": { "type": "string", "format": "date-time" } } },
+    "identity": {
+      "oneOf": [
+        { "type": "object", "additionalProperties": false, "required": ["id", "independenceGroup", "kind", "algorithm", "publicKey"], "properties": { "id": { "$ref": "#/$defs/nonEmpty" }, "independenceGroup": { "$ref": "#/$defs/nonEmpty" }, "kind": { "const": "public-key" }, "algorithm": { "enum": ["ed25519", "ecdsa-p256-sha256", "rsa-pss-sha256"] }, "publicKey": { "$ref": "#/$defs/nonEmpty" } } },
+        { "type": "object", "additionalProperties": false, "required": ["id", "independenceGroup", "kind", "profile", "subjectAlternativeName"], "properties": { "id": { "$ref": "#/$defs/nonEmpty" }, "independenceGroup": { "$ref": "#/$defs/nonEmpty" }, "kind": { "const": "sigstore" }, "profile": { "$ref": "#/$defs/nonEmpty" }, "subjectAlternativeName": { "$ref": "#/$defs/nonEmpty" }, "issuer": { "$ref": "#/$defs/nonEmpty" } } }
+      ]
+    },
+    "sigstoreProfile": { "type": "object", "additionalProperties": false, "required": ["id", "trustedRoot", "tlogThreshold", "ctlogThreshold", "timestampThreshold"], "properties": { "id": { "$ref": "#/$defs/nonEmpty" }, "trustedRoot": { "type": "object" }, "tlogThreshold": { "type": "integer", "minimum": 0 }, "ctlogThreshold": { "type": "integer", "minimum": 0 }, "timestampThreshold": { "type": "integer", "minimum": 0 } } },
+    "revocation": { "type": "object", "additionalProperties": false, "required": ["identityId", "effectiveAt", "scope", "reason"], "properties": { "identityId": { "$ref": "#/$defs/nonEmpty" }, "effectiveAt": { "type": "string", "format": "date-time" }, "compromisedFrom": { "type": "string", "format": "date-time" }, "compromisedUntil": { "type": "string", "format": "date-time" }, "scope": { "$ref": "#/$defs/scope" }, "reason": { "$ref": "#/$defs/nonEmpty" } } },
+    "signature": { "type": "object", "additionalProperties": false, "required": ["sig"], "properties": { "identityId": { "$ref": "#/$defs/nonEmpty" }, "sig": { "$ref": "#/$defs/nonEmpty" } } }
+  }
+}

package/schemas/security/aiwg-artifact-trust-state.v1.schema.json

@@ -0,0 +1,32 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://aiwg.io/schemas/security/aiwg-artifact-trust-state.v1.schema.json",
+  "title": "AIWG persisted artifact trust state v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "rootVersion", "rootSha256", "trustedTime", "channels"],
+  "properties": {
+    "schemaVersion": { "const": "aiwg.artifact-trust-state.v1" },
+    "rootVersion": { "type": "integer", "minimum": 1 },
+    "rootSha256": { "$ref": "#/$defs/sha256" },
+    "trustedTime": { "type": "string", "format": "date-time" },
+    "channels": {
+      "type": "object",
+      "additionalProperties": {
+        "type": "object", "additionalProperties": false,
+        "dependentRequired": { "subject": ["assetType"], "assetType": ["subject"] },
+        "required": ["namespace", "channel", "sequence", "artifactSha256", "version", "verifiedAt"],
+        "properties": {
+          "namespace": { "$ref": "#/$defs/nonEmpty" }, "channel": { "$ref": "#/$defs/nonEmpty" },
+          "subject": { "$ref": "#/$defs/nonEmpty" }, "assetType": { "$ref": "#/$defs/nonEmpty" },
+          "sequence": { "type": "integer", "minimum": 1 }, "artifactSha256": { "$ref": "#/$defs/sha256" },
+          "version": { "$ref": "#/$defs/nonEmpty" }, "verifiedAt": { "type": "string", "format": "date-time" }
+        }
+      }
+    }
+  },
+  "$defs": {
+    "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "nonEmpty": { "type": "string", "minLength": 1 }
+  }
+}

package/schemas/security/aiwg-artifact-verification-result.v1.schema.json

@@ -0,0 +1,46 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://aiwg.io/schemas/security/aiwg-artifact-verification-result.v1.schema.json",
+  "title": "AIWG cross-asset verification result v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "status", "exitCode", "artifact", "identities", "diagnostics"],
+  "properties": {
+    "schemaVersion": { "const": "aiwg.verify.result.v1" },
+    "status": { "enum": ["verified", "policy-exempt", "unsigned", "unknown-signer", "expired", "revoked", "stale", "mismatched", "malformed", "offline-evidence-missing", "policy-denied"] },
+    "exitCode": { "enum": [0, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29] },
+    "artifact": {
+      "type": "object", "additionalProperties": false, "required": ["name", "sha256"],
+      "properties": { "name": { "type": "string", "minLength": 1 }, "sha256": { "$ref": "#/$defs/sha256" } }
+    },
+    "policy": { "type": "string", "minLength": 1 },
+    "identities": { "type": "array", "uniqueItems": true, "items": { "type": "string", "minLength": 1 } },
+    "rootVersion": { "type": "integer", "minimum": 1 },
+    "freshness": {
+      "type": "object", "additionalProperties": false, "required": ["namespace", "channel", "sequence", "version"],
+      "properties": {
+        "namespace": { "type": "string", "minLength": 1 }, "channel": { "type": "string", "minLength": 1 },
+        "sequence": { "type": "integer", "minimum": 1 }, "version": { "type": "string", "minLength": 1 }
+      }
+    },
+    "diagnostics": {
+      "type": "array", "minItems": 1,
+      "items": { "type": "object", "additionalProperties": false, "required": ["code", "message"], "properties": { "code": { "type": "string", "minLength": 1 }, "message": { "type": "string", "minLength": 1 } } }
+    },
+    "nextState": { "$ref": "aiwg-artifact-trust-state.v1.schema.json" }
+  },
+  "oneOf": [
+    { "properties": { "status": { "const": "verified" }, "exitCode": { "const": 0 } } },
+    { "properties": { "status": { "const": "policy-exempt" }, "exitCode": { "const": 20 } } },
+    { "properties": { "status": { "const": "unsigned" }, "exitCode": { "const": 21 } } },
+    { "properties": { "status": { "const": "unknown-signer" }, "exitCode": { "const": 22 } } },
+    { "properties": { "status": { "const": "expired" }, "exitCode": { "const": 23 } } },
+    { "properties": { "status": { "const": "revoked" }, "exitCode": { "const": 24 } } },
+    { "properties": { "status": { "const": "stale" }, "exitCode": { "const": 25 } } },
+    { "properties": { "status": { "const": "mismatched" }, "exitCode": { "const": 26 } } },
+    { "properties": { "status": { "const": "malformed" }, "exitCode": { "const": 27 } } },
+    { "properties": { "status": { "const": "offline-evidence-missing" }, "exitCode": { "const": 28 } } },
+    { "properties": { "status": { "const": "policy-denied" }, "exitCode": { "const": 29 } } }
+  ],
+  "$defs": { "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" } }
+}

package/schemas/security/threat-assessment-input.v1.schema.json

@@ -0,0 +1,57 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://aiwg.io/schemas/security/threat-assessment-input.v1.schema.json",
+  "title": "ThreatAssessmentInput",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["surface"],
+  "properties": {
+    "surface": {
+      "type": "string",
+      "enum": ["issue-title", "issue-body", "issue-comment", "pull-request-title", "pull-request-body", "pull-request-diff-summary", "review-comment", "release-note", "handoff", "outbound-maintainer-comment"]
+    },
+    "content": { "type": "string" },
+    "semanticContext": {
+      "type": "string",
+      "enum": ["requested", "negative", "quoted", "documentation"]
+    },
+    "parts": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["text"],
+        "properties": {
+          "id": { "type": "string" },
+          "text": { "type": "string" },
+          "context": {
+            "type": "string",
+            "enum": ["requested", "negative", "quoted", "documentation"]
+          }
+        }
+      }
+    },
+    "source": {
+      "type": "object",
+      "additionalProperties": true,
+      "properties": {
+        "kind": { "type": "string" },
+        "id": { "type": ["string", "number"] }
+      }
+    },
+    "actor": {
+      "type": "object",
+      "additionalProperties": true,
+      "properties": {
+        "id": { "type": "string" },
+        "trust": { "type": "string" },
+        "provider": { "type": "string" }
+      }
+    },
+    "requestedAction": { "type": "string" }
+  },
+  "oneOf": [
+    { "required": ["content"] },
+    { "required": ["parts"] }
+  ]
+}

package/schemas/security/threat-assessment-report.v1.schema.json

@@ -0,0 +1,104 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://aiwg.io/schemas/security/threat-assessment-report.v1.schema.json",
+  "title": "ThreatAssessmentReport",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "engineVersion",
+    "policyVersion",
+    "profileVersion",
+    "policyHash",
+    "mode",
+    "profile",
+    "surface",
+    "source",
+    "actor",
+    "requestedAction",
+    "policyProvenance",
+    "assessed",
+    "findings",
+    "risk",
+    "decision"
+  ],
+  "properties": {
+    "schemaVersion": { "const": "1" },
+    "engineVersion": { "type": "string", "minLength": 1 },
+    "policyVersion": { "type": "string", "minLength": 1 },
+    "profileVersion": { "type": "string", "minLength": 1 },
+    "policyHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "mode": { "enum": ["off", "audit", "enforce"] },
+    "profile": { "type": "string", "minLength": 1 },
+    "surface": {
+      "enum": ["issue-title", "issue-body", "issue-comment", "pull-request-title", "pull-request-body", "pull-request-diff-summary", "review-comment", "release-note", "handoff", "outbound-maintainer-comment"]
+    },
+    "source": { "type": "object", "additionalProperties": true },
+    "actor": { "type": "object", "additionalProperties": true },
+    "requestedAction": { "type": "string" },
+    "policyProvenance": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["source", "path"],
+      "properties": {
+        "source": { "type": "string" },
+        "path": { "type": "string" }
+      }
+    },
+    "assessed": { "type": "boolean" },
+    "findings": {
+      "type": "array",
+      "items": { "$ref": "#/definitions/finding" }
+    },
+    "risk": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["score", "severity", "likelihood", "impact"],
+      "properties": {
+        "score": { "type": "number", "minimum": 0 },
+        "severity": { "$ref": "#/definitions/severity" },
+        "likelihood": { "type": "number", "minimum": 0, "maximum": 5 },
+        "impact": { "type": "number", "minimum": 0, "maximum": 5 }
+      }
+    },
+    "decision": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["action", "wouldAction", "interrupts", "reason"],
+      "properties": {
+        "action": { "$ref": "#/definitions/action" },
+        "wouldAction": { "$ref": "#/definitions/action" },
+        "interrupts": { "type": "boolean" },
+        "reason": { "type": "string" },
+        "matchedMandatoryRule": { "type": "string" }
+      }
+    }
+  },
+  "definitions": {
+    "severity": {
+      "enum": ["informational", "low", "moderate", "high", "critical"]
+    },
+    "action": {
+      "enum": ["proceed", "record", "flag", "require-authorization", "reject"]
+    },
+    "finding": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["ruleId", "ruleProvenance", "severity", "likelihood", "impact", "taxonomy", "partId", "context", "evidence", "suppressed", "matchedStatements"],
+      "properties": {
+        "ruleId": { "type": "string" },
+        "ruleProvenance": { "type": "string" },
+        "severity": { "$ref": "#/definitions/severity" },
+        "likelihood": { "type": "number", "minimum": 1, "maximum": 5 },
+        "impact": { "type": "number", "minimum": 1, "maximum": 5 },
+        "taxonomy": { "type": "array", "items": { "type": "string" } },
+        "partId": { "type": "string" },
+        "context": { "enum": ["requested", "negative", "quoted", "documentation"] },
+        "evidence": { "type": "string" },
+        "suppressed": { "type": "boolean" },
+        "suppressionReason": { "type": "string" },
+        "matchedStatements": { "type": "array", "items": { "type": "string" } }
+      }
+    }
+  }
+}

package/tools/agents/deploy-agents.mjs

@@ -210,7 +210,13 @@ function resolveCommandMirrorDir(provider, target) {
   // Closest conventional location for providers whose primary command
   // surface is MCP/aggregation rather than a documented command directory.
   if (provider.name === 'hermes') {
-    return path.join(os.homedir(), '.hermes', 'commands');
+    // #2119: HERMES_HOME is the single source of truth the running Hermes
+    // runtime uses to locate its files — resolve the home the same way the
+    // provider does instead of hardcoding $HOME/.hermes.
+    const hermesHome = typeof provider.getHermesHome === 'function'
+      ? provider.getHermesHome()
+      : path.join(os.homedir(), '.hermes');
+    return path.resolve(hermesHome, 'commands');
   }
 
   return null;
@@ -530,7 +536,7 @@ Providers (all deploy agents, commands, skills, and rules):
   devin     - Devin Desktop (preferred; aliases: devin-desktop, windsurf)
               Paths: .windsurf/agents/, .windsurf/workflows/, .windsurf/skills/, .windsurf/rules/
   hermes    - Hermes Agent (MCP-based integration)
-              Skills: ~/.hermes/skills/ (user-global) | Agents: AGENTS.md (lean routing guide)
+              Skills: $HERMES_HOME/skills/ (user-global; defaults to ~/.hermes/skills/) | Agents: AGENTS.md
               Commands/Rules: served via MCP, not file-deployed
 
 Modes:

package/tools/agents/providers/base.mjs

@@ -463,9 +463,36 @@ export function injectPlatformInContent(content, targetPlatform) {
   return open + fmLines.join('\n') + close + body;
 }
 
-/** @deprecated Use injectPlatformInContent instead */
+/**
+ * Remove the `platforms:` field from a SKILL.md frontmatter block.
+ *
+ * Hermes (and other providers that treat `platforms:` as an OS gate —
+ * linux / macos / windows) hide any skill whose value isn't a recognized
+ * OS. AIWG source skills use the field as a *provider* restriction token
+ * (`[all]`, provider names), which is the opposite meaning, so deployed
+ * copies destined for such providers must drop the field entirely. An
+ * absent field is the documented "compatible with all platforms" default.
+ */
 export function stripPlatformsFromContent(content) {
-  return injectPlatformInContent(content, null);
+  const fmMatch = content.match(/^(---\r?\n)([\s\S]*?)(\r?\n---(?:\r?\n|$))([\s\S]*)$/);
+  if (!fmMatch) return content;
+
+  const [, open, fm, close, body] = fmMatch;
+  let updated = fm.replace(/^platforms:[^\r\n]*(?:\r?\n|$)/m, '');
+
+  // Multi-line list form:
+  //   platforms:
+  //     - claude-code
+  //     - hermes
+  if (updated === fm) {
+    updated = fm.replace(
+      /^platforms:[ \t]*\r?\n(?:[ \t]+-[ \t]+\S[^\r\n]*(?:\r?\n|$))*/m,
+      '',
+    );
+  }
+
+  if (updated === fm) return content;
+  return open + updated + close + body;
 }
 
 /**