@aiwg/cli 2026.8.14 → 2026.8.15

package/dist/src/cli/handlers/setup.js

@@ -68,8 +68,10 @@ export function parseSetupProjectOptions(ctx) {
         nonInteractive: boolFlag(args, '--non-interactive') || boolFlag(args, '--yes'),
         primary: flagValue(args, '--primary'),
         issueTracker: flagValue(args, '--issue-tracker'),
+        customerIssueTracker: flagValue(args, '--customer-issue-tracker'),
         ci: flagValue(args, '--ci'),
         issueProvider: parseEnum(flagValue(args, '--issue-provider'), ISSUE_PROVIDERS, '--issue-provider'),
+        customerIssueProvider: parseEnum(flagValue(args, '--customer-issue-provider'), ISSUE_PROVIDERS, '--customer-issue-provider'),
         deliveryMode: parseEnum(flagValue(args, '--delivery-mode'), DELIVERY_MODES, '--delivery-mode'),
         defaultBranch: flagValue(args, '--default-branch'),
         requireCiGreen: parseBooleanFlag(args, '--require-ci-green'),
@@ -84,6 +86,8 @@ export function parseSetupProjectOptions(ctx) {
         signingEnforce: parseEnum(flagValue(args, '--signing-enforce'), ['commits', 'tags', 'all'], '--signing-enforce'),
         trackerActorLogin: flagValue(args, '--tracker-actor-login'),
         trackerActorVia: parseEnum(flagValue(args, '--tracker-actor-via'), TRACKER_VIA, '--tracker-actor-via'),
+        customerTrackerActorLogin: flagValue(args, '--customer-tracker-actor-login'),
+        customerTrackerActorVia: parseEnum(flagValue(args, '--customer-tracker-actor-via'), TRACKER_VIA, '--customer-tracker-actor-via'),
         providers: parseStringList(flagValue(args, '--providers')),
     };
 }
@@ -201,6 +205,12 @@ function validateSetupConfig(config, remotes, issueProvider) {
     if (config.remotes?.issue_provider && !ISSUE_PROVIDERS.includes(config.remotes.issue_provider)) {
         errors.push('remotes.issue_provider is invalid');
     }
+    if (config.remotes?.customer_issue_tracker) {
+        checkRemote('remotes.customer_issue_tracker', config.remotes.customer_issue_tracker);
+    }
+    if (config.remotes?.customer_issue_provider && !ISSUE_PROVIDERS.includes(config.remotes.customer_issue_provider)) {
+        errors.push('remotes.customer_issue_provider is invalid');
+    }
     checkRemote('remotes.ci', config.remotes?.ci);
     if (!DELIVERY_MODES.includes(config.delivery?.mode))
         errors.push('delivery.mode is invalid');
@@ -217,6 +227,9 @@ function validateSetupConfig(config, remotes, issueProvider) {
     if (config.remotes?.tracker_actor?.via && !TRACKER_VIA.includes(config.remotes.tracker_actor.via)) {
         errors.push('remotes.tracker_actor.via is invalid');
     }
+    if (config.remotes?.customer_tracker_actor?.via && !TRACKER_VIA.includes(config.remotes.customer_tracker_actor.via)) {
+        errors.push('remotes.customer_tracker_actor.via is invalid');
+    }
     if (!config.providers.every(p => VALID_PROVIDERS.includes(p))) {
         errors.push('providers contains an unknown AIWG provider');
     }
@@ -237,11 +250,15 @@ export async function buildSetupProjectPlan(options) {
         ? 'local'
         : options.issueTracker ?? base.remotes?.issue_tracker ?? primary;
     const ci = options.ci ?? base.remotes?.ci ?? primary;
+    const customerIssueTracker = options.customerIssueTracker ?? base.remotes?.customer_issue_tracker;
+    const customerIssueProvider = options.customerIssueProvider ?? base.remotes?.customer_issue_provider;
     const remotesConfig = {
         primary,
         issue_tracker: issueTracker,
         issue_provider: issueProvider,
         ci,
+        ...(customerIssueTracker ? { customer_issue_tracker: customerIssueTracker } : {}),
+        ...(customerIssueProvider ? { customer_issue_provider: customerIssueProvider } : {}),
         secondary: base.remotes?.secondary ?? secondaryRemotes(remotes, primary, issueTracker, ci),
     };
     const trackerLogin = options.trackerActorLogin ?? base.remotes?.tracker_actor?.login;
@@ -253,6 +270,16 @@ export async function buildSetupProjectPlan(options) {
             ...(trackerVia ? { via: trackerVia } : {}),
         };
     }
+    const customerTrackerLogin = options.customerTrackerActorLogin ?? base.remotes?.customer_tracker_actor?.login;
+    const customerTrackerVia = options.customerTrackerActorVia ?? base.remotes?.customer_tracker_actor?.via
+        ?? (customerIssueProvider === 'github' ? 'gh' : customerIssueProvider === 'gitea' ? 'tea' : undefined);
+    if (customerTrackerLogin || customerTrackerVia || base.remotes?.customer_tracker_actor?.forbid_actors) {
+        remotesConfig.customer_tracker_actor = {
+            ...(base.remotes?.customer_tracker_actor ?? {}),
+            ...(customerTrackerLogin ? { login: customerTrackerLogin } : {}),
+            ...(customerTrackerVia ? { via: customerTrackerVia } : {}),
+        };
+    }
     const existingDelivery = base.delivery ?? {};
     const delivery = {
         ...existingDelivery,

package/dist/src/config/aiwg-config.js

@@ -478,6 +478,7 @@ export function resolveRemoteProvider(remoteUrl) {
  * Defaults:
  *   - `primary` defaults to "origin"
  *   - `issue_tracker` defaults to `primary`
+ *   - customer tracker fields remain unset unless explicitly configured
  *   - `ci` defaults to `primary`
  *   - `secondary` defaults to `[]`
  *
@@ -491,6 +492,9 @@ export function resolveRemotes(remotes) {
         issue_provider: remotes?.issue_provider,
         ci: remotes?.ci ?? primary,
         tracker_actor: remotes?.tracker_actor,
+        customer_issue_tracker: remotes?.customer_issue_tracker,
+        customer_issue_provider: remotes?.customer_issue_provider,
+        customer_tracker_actor: remotes?.customer_tracker_actor,
         transport: remotes?.transport,
         secondary: remotes?.secondary ?? [],
     };

package/dist/src/config/cli.js

@@ -151,7 +151,9 @@ const ENUM_RULES = {
     'delivery.release_signing.format': ['openpgp', 'ssh', 'x509'],
     'delivery.release_signing.enforce': ['commits', 'tags', 'all'],
     'remotes.issue_provider': ['gitea', 'github', 'local'],
+    'remotes.customer_issue_provider': ['gitea', 'github', 'local'],
     'remotes.tracker_actor.via': ['tea', 'gh', 'mcp', 'api'],
+    'remotes.customer_tracker_actor.via': ['tea', 'gh', 'mcp', 'api'],
     'remotes.transport.protocol': ['ssh', 'https'],
     'repo_maintainer.tiers.local': ['collaborator', 'maintainer', 'admin'],
     'security.threatAssessment.mode': ['off', 'audit', 'enforce'],
@@ -169,6 +171,7 @@ const BOOLEAN_FIELDS = new Set([
 ]);
 const STRING_ARRAY_FIELDS = new Set([
     'remotes.tracker_actor.forbid_actors',
+    'remotes.customer_tracker_actor.forbid_actors',
     'command_log.scopes',
     'telemetry.skill_usage.scopes',
 ]);
@@ -592,6 +595,9 @@ For project-level config: aiwg config show --project [--json]
     const remotesView = {
         primary: { name: resolvedRemotes.primary, url: getUrl(resolvedRemotes.primary) },
         issue_tracker: { name: resolvedRemotes.issue_tracker, url: getUrl(resolvedRemotes.issue_tracker) },
+        customer_issue_tracker: resolvedRemotes.customer_issue_tracker
+            ? { name: resolvedRemotes.customer_issue_tracker, url: getUrl(resolvedRemotes.customer_issue_tracker) }
+            : null,
         ci: { name: resolvedRemotes.ci, url: getUrl(resolvedRemotes.ci) },
         secondary: resolvedRemotes.secondary.map((s) => ({
             ...s,
@@ -653,7 +659,10 @@ For project-level config: aiwg config show --project [--json]
     };
     console.log(fmt('Primary       ', remotesView.primary));
     if (remotesView.issue_tracker.name !== remotesView.primary.name) {
-        console.log(fmt('Issue tracker ', remotesView.issue_tracker));
+        console.log(fmt('Internal issues', remotesView.issue_tracker));
+    }
+    if (remotesView.customer_issue_tracker) {
+        console.log(fmt('Customer issues', remotesView.customer_issue_tracker));
     }
     if (remotesView.ci.name !== remotesView.primary.name) {
         console.log(fmt('CI            ', remotesView.ci));

package/dist/src/config/workspace.js

@@ -119,8 +119,7 @@ async function resolveEndpoint(repoPath, remote, providerHint) {
                 : 'unknown',
     };
 }
-function trackerProviderHint(remotes, fallback) {
-    const configured = remotes.issue_provider;
+function providerHint(configured, fallback) {
     if (configured === 'gitea' || configured === 'github')
         return configured;
     return fallback;
@@ -130,10 +129,14 @@ async function resolveMember(entry, workspaceRoot) {
     const configPath = getConfigPath(memberPath);
     const config = await readAiwgConfig(memberPath);
     const remotes = resolveRemotes(config?.remotes);
-    const issueProviderHint = trackerProviderHint(remotes, entry.provider);
-    const [primary, issueTracker, ci] = await Promise.all([
+    const issueProviderHint = providerHint(remotes.issue_provider, entry.provider);
+    const customerProviderHint = providerHint(remotes.customer_issue_provider);
+    const [primary, issueTracker, customerIssueTracker, ci] = await Promise.all([
         resolveEndpoint(memberPath, remotes.primary, entry.provider),
         resolveEndpoint(memberPath, remotes.issue_tracker, issueProviderHint),
+        remotes.customer_issue_tracker
+            ? resolveEndpoint(memberPath, remotes.customer_issue_tracker, customerProviderHint)
+            : Promise.resolve(undefined),
         resolveEndpoint(memberPath, remotes.ci, entry.provider),
     ]);
     const drift = [];
@@ -145,12 +148,18 @@ async function resolveMember(entry, workspaceRoot) {
         drift.push(`primary remote '${remotes.primary}' is unavailable`);
     if (!issueTracker.url)
         drift.push(`issue tracker remote '${remotes.issue_tracker}' is unavailable`);
+    if (remotes.customer_issue_tracker && !customerIssueTracker?.url) {
+        drift.push(`customer issue tracker remote '${remotes.customer_issue_tracker}' is unavailable`);
+    }
     if (primary.provider === 'unknown') {
         drift.push(`primary remote provider is unknown for '${primary.domain ?? remotes.primary}'`);
     }
     if (issueTracker.provider === 'unknown') {
         drift.push(`issue tracker provider is unknown for '${issueTracker.domain ?? remotes.issue_tracker}'`);
     }
+    if (customerIssueTracker?.provider === 'unknown') {
+        drift.push(`customer issue tracker provider is unknown for '${customerIssueTracker.domain ?? remotes.customer_issue_tracker}'`);
+    }
     if (entry.allowed.includes('issue-comment') && !remotes.tracker_actor?.login) {
         drift.push('issue-comment is allowed but remotes.tracker_actor.login is missing');
     }
@@ -158,6 +167,10 @@ async function resolveMember(entry, workspaceRoot) {
         && remotes.tracker_actor.forbid_actors?.includes(remotes.tracker_actor.login)) {
         drift.push(`configured tracker actor '${remotes.tracker_actor.login}' is also forbidden`);
     }
+    if (remotes.customer_tracker_actor?.login
+        && remotes.customer_tracker_actor.forbid_actors?.includes(remotes.customer_tracker_actor.login)) {
+        drift.push(`configured customer tracker actor '${remotes.customer_tracker_actor.login}' is also forbidden`);
+    }
     if (config?.delivery?.signing?.enforce
         && !config.delivery.signing.key
         && !config.delivery.signing.key_file) {
@@ -177,6 +190,7 @@ async function resolveMember(entry, workspaceRoot) {
         remotes,
         primary,
         issueTracker,
+        ...(customerIssueTracker ? { customerIssueTracker } : {}),
         ci,
         drift,
     };
@@ -251,33 +265,35 @@ export async function authorizeWorkspaceOperation(startPath, targetPath, action,
     };
 }
 /** Enforce the member config tracker_actor + forbid_actors contract. */
-export function checkTrackerActor(member, actualActor) {
-    const configured = member.remotes.tracker_actor;
+export function checkTrackerActor(member, actualActor, role = 'internal') {
+    const configured = role === 'customer'
+        ? member.remotes.customer_tracker_actor
+        : member.remotes.tracker_actor;
     const actor = actualActor ?? configured?.login;
     if (!actor) {
         return {
             allowed: false,
-            reason: `repo '${member.name}' does not resolve a tracker actor`,
+            reason: `repo '${member.name}' does not resolve a ${role} tracker actor`,
         };
     }
     if (configured?.forbid_actors?.includes(actor)) {
         return {
             allowed: false,
             actor,
-            reason: `tracker actor '${actor}' is forbidden by repo '${member.name}'`,
+            reason: `${role} tracker actor '${actor}' is forbidden by repo '${member.name}'`,
         };
     }
     if (actualActor && configured?.login && actualActor !== configured.login) {
         return {
             allowed: false,
             actor,
-            reason: `tracker actor '${actualActor}' does not match configured actor '${configured.login}'`,
+            reason: `${role} tracker actor '${actualActor}' does not match configured actor '${configured.login}'`,
         };
     }
     return {
         allowed: true,
         actor,
-        reason: `tracker actor '${actor}' is allowed for repo '${member.name}'`,
+        reason: `${role} tracker actor '${actor}' is allowed for repo '${member.name}'`,
     };
 }
 //# sourceMappingURL=workspace.js.map

package/dist/src/smiths/context-pipeline/aiwg-md.js

@@ -50,7 +50,7 @@ export async function buildAiwgMdContent(projectPath, stagedClaudeMdContent) {
     // #1362: parallelism cap section, injected after generation so it surfaces
     // in regenerated context files regardless of CLAUDE.md content.
     const parallelismSection = await buildParallelismSection(projectPath);
-    const finalizationBlock = await buildContextFinalizationBlock(projectPath);
+    const finalizationBlock = await buildContextFinalizationBlock(projectPath, path.join(projectPath, 'AIWG.md'));
     const externalLinksSection = await buildExternalLinksSection(projectPath);
     if (claudeMdContent) {
         // Insert the AIWG signature comment as the second line.

package/dist/src/smiths/context-pipeline/finalization.js

@@ -54,7 +54,21 @@ function displayProjectPath(projectPath, targetPath) {
         return relative;
     return targetPath;
 }
-export async function buildContextFinalizationBlock(projectPath) {
+function documentRelativeHref(projectPath, documentPath, targetPath) {
+    const absoluteDocument = path.isAbsolute(documentPath)
+        ? documentPath
+        : path.resolve(projectPath, documentPath);
+    const absoluteTarget = path.isAbsolute(targetPath)
+        ? targetPath
+        : path.resolve(projectPath, targetPath);
+    const relative = path.relative(path.dirname(absoluteDocument), absoluteTarget).replace(/\\/g, '/');
+    if (!relative)
+        return `./${path.basename(absoluteTarget)}`;
+    return relative.startsWith('./') || relative.startsWith('../')
+        ? relative
+        : `./${relative}`;
+}
+export async function buildContextFinalizationBlock(projectPath, documentPath = path.join(projectPath, 'AIWG.md')) {
     const config = await readConfig(projectPath);
     const remoteUrls = await readGitRemoteUrls(projectPath);
     const providers = config?.providers ?? [];
@@ -68,6 +82,7 @@ export async function buildContextFinalizationBlock(projectPath) {
             providerDeployments.add(provider);
         }
     }
+    const trackerAuthority = resolveTrackerAuthority(config, remoteUrls);
     const lines = [
         FINALIZATION_START,
         '## Context Finalization',
@@ -91,7 +106,9 @@ export async function buildContextFinalizationBlock(projectPath) {
         '',
         'When a user asks whether AIWG is active or engaged in this project, run or read `aiwg status --probe --json` and report the result plainly: engaged state, project root, deployed provider files, installed frameworks/addons, and the next action from the probe. Do not add AIWG attribution, signatures, generated-by text, or passive footers to user files, commits, PRs, comments, code headers, or docs.',
         '',
-        renderTrackerProtocol(resolveTrackerAuthority(config, remoteUrls)),
+        renderTrackerProtocol(trackerAuthority, {
+            configHref: documentRelativeHref(projectPath, documentPath, trackerAuthority.configPath),
+        }),
         '',
         '### Source Model',
         '',
@@ -112,7 +129,8 @@ export function replaceOrAppendFinalizationBlock(content, block) {
     return `${trimmed}\n\n${block}`;
 }
 export async function buildNormalizedAiwgMd(projectPath, existing = '') {
-    const block = await buildContextFinalizationBlock(projectPath);
+    const normalizedDocumentPath = projectControlPath(projectPath, 'AIWG.md');
+    const block = await buildContextFinalizationBlock(projectPath, normalizedDocumentPath);
     const externalLinksSection = await buildExternalLinksSection(projectPath);
     const normalizedAiwgMdPath = displayProjectPath(projectPath, projectControlPath(projectPath, 'AIWG.md'));
     const base = existing.trim().length > 0

package/dist/src/tracker/capability-protocol.js

@@ -54,6 +54,15 @@ export function resolveTrackerAuthority(config, remoteUrls = {}, configPath = '.
     const storageProvider = providerFromIssueStorage(issueStorage);
     const configuredProvider = remotes.issue_provider ? normalizeProvider(remotes.issue_provider) : 'unknown';
     const urlProvider = issueTrackerUrl ? normalizeProvider(resolveRemoteProvider(issueTrackerUrl)) : 'unknown';
+    const customerIssueTrackerUrl = remotes.customer_issue_tracker
+        ? remoteUrls[remotes.customer_issue_tracker]
+        : undefined;
+    const configuredCustomerProvider = remotes.customer_issue_provider
+        ? normalizeProvider(remotes.customer_issue_provider)
+        : 'unknown';
+    const customerUrlProvider = customerIssueTrackerUrl
+        ? normalizeProvider(resolveRemoteProvider(customerIssueTrackerUrl))
+        : 'unknown';
     return {
         configPath,
         primaryRemote: remotes.primary,
@@ -66,6 +75,13 @@ export function resolveTrackerAuthority(config, remoteUrls = {}, configPath = '.
             : storageProvider !== 'unknown'
                 ? storageProvider
                 : urlProvider,
+        ...(remotes.customer_issue_tracker ? {
+            customerIssueTrackerRemote: remotes.customer_issue_tracker,
+            customerIssueTrackerUrl,
+            customerProvider: configuredCustomerProvider !== 'unknown'
+                ? configuredCustomerProvider
+                : customerUrlProvider,
+        } : {}),
         secondaryRemotes: remotes.secondary,
     };
 }
@@ -91,7 +107,7 @@ export function chooseTrackerAccess(authority, probes) {
         ].join(' '),
     };
 }
-export function renderTrackerProtocol(authority) {
+export function renderTrackerProtocol(authority, options = {}) {
     const secondary = authority.secondaryRemotes.length > 0
         ? authority.secondaryRemotes
             .map((remote) => `${remote.name}${remote.purpose ? ` (${remote.purpose})` : ''}`)
@@ -99,11 +115,16 @@ export function renderTrackerProtocol(authority) {
         : 'none configured';
     const issueStorage = authority.issueStorage ?? 'not configured';
     const trackerUrl = authority.issueTrackerUrl ?? 'remote URL unavailable';
+    const customerTracker = authority.customerIssueTrackerRemote
+        ? `\`${authority.customerIssueTrackerRemote}\` (${authority.customerProvider ?? 'unknown'}; ${authority.customerIssueTrackerUrl ?? 'remote URL unavailable'})`
+        : 'not configured';
+    const configHref = options.configHref ?? `./${authority.configPath}`;
     return [
         '### Tracker Authority Protocol',
         '',
-        `- Source of truth: [${authority.configPath}](./${authority.configPath})`,
-        `- Canonical tracker: \`${authority.issueTrackerRemote}\` (${authority.provider}; ${trackerUrl})`,
+        `- Source of truth: [${authority.configPath}](${configHref})`,
+        `- Internal/canonical tracker: \`${authority.issueTrackerRemote}\` (${authority.provider}; ${trackerUrl})`,
+        `- Customer issue tracker: ${customerTracker}`,
         `- Primary repo remote: \`${authority.primaryRemote}\`; CI remote: \`${authority.ciRemote}\``,
         `- Secondary/mirror remotes: ${secondary}`,
         `- Issue storage mode: ${issueStorage}`,
@@ -115,6 +136,8 @@ export function renderTrackerProtocol(authority) {
         '4. Stop and report a blocker.',
         '',
         '- Project config decides tracker authority; installed/authenticated CLIs do not.',
+        '- Route internal engineering, delivery, and CI-sensitive issue work to the internal tracker.',
+        '- Route customer acknowledgements, follow-up, and closure to the customer tracker when configured.',
         '- Git SSH remote access is repository sync, not issue-tracker API access.',
         '- Do not file on mirror or secondary remotes just because their CLI is authenticated.',
         '- Treat an unauthenticated tracker CLI as one failed access path, then continue probing MCP/app/API before blocking.',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwg/cli",
-  "version": "2026.8.14",
+  "version": "2026.8.15",
   "description": "Lightweight AIWG CLI for signed, versioned web-backed resources.",
   "type": "module",
   "license": "MIT",