@aiwg/cli 2026.8.18 → 2026.8.19

package/dist/src/artifacts/index-builder.js

@@ -2,7 +2,7 @@
  * Artifact Index Builder
  *
  * Scans .aiwg/ directories, extracts metadata from artifact frontmatter,
- * computes checksums, extracts @-mention dependencies, and builds a
+ * computes checksums, extracts @-mention and Markdown-link dependencies, and builds a
  * structured index at .aiwg/.index/.
  *
  * @implements #415
@@ -68,6 +68,57 @@ export function extractMentions(content) {
     }
     return Array.from(mentions);
 }
+/**
+ * Extract relative Markdown links that may resolve to graph-local artifacts.
+ *
+ * External URLs, absolute paths, and anchor-only links are intentionally absent
+ * from the accepted pattern. Resolution still happens later against indexed
+ * nodes, so a parsed link outside the active graph cannot create an edge.
+ */
+export function extractMarkdownLinks(content) {
+    const links = new Set();
+    const pattern = /(!?)\[[^\]]+\]\((\.\/?[^)#\s]+)(?:#[^)]+)?\)/g;
+    let match;
+    while ((match = pattern.exec(content)) !== null) {
+        if (match[1] === '!')
+            continue;
+        links.add(match[2]);
+    }
+    return Array.from(links);
+}
+function resolveMarkdownLinkDependency(cwd, sourcePath, rawLink, entries, graph) {
+    const target = rawLink.split('#')[0]?.trim();
+    if (!target)
+        return null;
+    const sourceFullPath = absoluteEntryPath(cwd, sourcePath, graph);
+    const targetFullPath = path.resolve(path.dirname(sourceFullPath), target);
+    let stat;
+    try {
+        stat = fs.statSync(targetFullPath);
+    }
+    catch {
+        return null;
+    }
+    if (!stat.isFile())
+        return null;
+    const indexedPath = indexPathFor(cwd, targetFullPath, graph);
+    return entries[indexedPath] ? indexedPath : null;
+}
+function addDependencyEdge(depGraph, entries, sourcePath, targetPath, type) {
+    if (sourcePath === targetPath)
+        return false;
+    if (!depGraph[sourcePath])
+        depGraph[sourcePath] = { upstream: [], downstream: [] };
+    if (!depGraph[targetPath])
+        depGraph[targetPath] = { upstream: [], downstream: [] };
+    if (depGraph[sourcePath].upstream.some(edge => edge.path === targetPath))
+        return false;
+    depGraph[sourcePath].upstream.push({ path: targetPath, type });
+    depGraph[targetPath].downstream.push({ path: sourcePath, type });
+    if (entries[targetPath])
+        entries[targetPath].dependents.push(sourcePath);
+    return true;
+}
 /**
  * Extract title from content (first # heading or frontmatter title)
  */
@@ -846,6 +897,7 @@ export async function buildIndex(cwd, options = {}) {
             const tags = flow ? flow.tags : (Array.isArray(data.tags) ? data.tags.map(String) : []);
             const summary = flow?.description ?? schemaDoc?.capability ?? runbook?.capability ?? extractSummary(data, body);
             const dependencies = extractMentions(content);
+            const markdownLinks = extractMarkdownLinks(content);
             // Discovery metadata (#1214, #1540, #1792) — meaningful for operational
             // AIWG artifact kinds. Kept undefined on document types so the index file
             // stays small for the common case.
@@ -879,6 +931,7 @@ export async function buildIndex(cwd, options = {}) {
                 checksum,
                 summary,
                 dependencies,
+                ...(markdownLinks.length > 0 ? { markdownLinks } : {}),
                 dependents: [], // Computed after all entries are processed
                 ...(name ? { name } : {}),
                 ...(triggers && triggers.length > 0 ? { triggers } : {}),
@@ -915,6 +968,7 @@ export async function buildIndex(cwd, options = {}) {
         }
     }
     // Build dependency graph and compute dependents
+    let markdownLinkEdgeCount = 0;
     for (const entry of Object.values(entries)) {
         if (!depGraph[entry.path]) {
             depGraph[entry.path] = { upstream: [], downstream: [] };
@@ -923,17 +977,13 @@ export async function buildIndex(cwd, options = {}) {
             // Normalize: check if referenced path exists in the index
             const normalizedDep = Object.keys(entries).find(p => p === dep || p.endsWith(dep));
             if (normalizedDep && normalizedDep !== entry.path) {
-                const upEdge = { path: normalizedDep, type: 'depends-on' };
-                depGraph[entry.path].upstream.push(upEdge);
-                if (!depGraph[normalizedDep]) {
-                    depGraph[normalizedDep] = { upstream: [], downstream: [] };
-                }
-                const downEdge = { path: entry.path, type: 'depends-on' };
-                depGraph[normalizedDep].downstream.push(downEdge);
-                // Also update the dependents field on the target entry
-                if (entries[normalizedDep]) {
-                    entries[normalizedDep].dependents.push(entry.path);
-                }
+                addDependencyEdge(depGraph, entries, entry.path, normalizedDep, 'depends-on');
+            }
+        }
+        for (const link of entry.markdownLinks ?? []) {
+            const normalizedDep = resolveMarkdownLinkDependency(cwd, entry.path, link, entries, graph);
+            if (normalizedDep && addDependencyEdge(depGraph, entries, entry.path, normalizedDep, 'markdown-link')) {
+                markdownLinkEdgeCount++;
             }
         }
     }
@@ -1069,6 +1119,7 @@ export async function buildIndex(cwd, options = {}) {
         tagDistribution: tagDist,
         graphMetrics: {
             totalEdges,
+            markdownLinkEdges: markdownLinkEdgeCount,
             ...(citationMetrics ? {
                 canonicalEdges: citationMetrics.canonicalEdges,
                 outgoingDeclarations: citationMetrics.outgoingDeclarations,

package/dist/src/artifacts/index-files.js

@@ -31,22 +31,40 @@ export function indexPathFor(cwd, fullPath, graph) {
         return toPosixPath(relative);
     return fullPath;
 }
-/** Recursively find indexable files, excluding hidden directories such as .index. */
 export function findArtifactFiles(dir, extensions = DEFAULT_INDEX_EXTENSIONS) {
+    return walkArtifactFiles(dir, extensions, new Set());
+}
+/** Recursively find indexable files, excluding hidden directories such as .index. */
+function walkArtifactFiles(dir, extensions, seenRealDirs) {
     const results = [];
     if (!fs.existsSync(dir))
         return results;
+    let realDir;
+    try {
+        realDir = fs.realpathSync(dir);
+    }
+    catch {
+        return results;
+    }
+    if (seenRealDirs.has(realDir))
+        return results;
+    seenRealDirs.add(realDir);
     const entries = fs.readdirSync(dir, { withFileTypes: true });
     for (const entry of entries) {
         const fullPath = path.join(dir, entry.name);
-        if (entry.isSymbolicLink() && !fs.existsSync(fullPath))
+        let stat;
+        try {
+            stat = fs.statSync(fullPath);
+        }
+        catch {
             continue;
-        if (entry.isDirectory()) {
+        }
+        if (stat.isDirectory()) {
             if (entry.name.startsWith('.'))
                 continue;
-            results.push(...findArtifactFiles(fullPath, extensions));
+            results.push(...walkArtifactFiles(fullPath, extensions, seenRealDirs));
         }
-        else if (extensions.some(extension => entry.name.endsWith(extension))) {
+        else if (stat.isFile() && extensions.some(extension => entry.name.endsWith(extension))) {
             results.push(fullPath);
         }
     }
@@ -55,6 +73,9 @@ export function findArtifactFiles(dir, extensions = DEFAULT_INDEX_EXTENSIONS) {
 /** Return the exact current source-file set used by a standard graph build. */
 export async function collectGraphIndexFiles(cwd, graph) {
     const config = graph ? GRAPH_CONFIGS[graph] : undefined;
+    if (graph && !config) {
+        throw new Error(`Unknown graph: ${graph}`);
+    }
     const scanDirs = config
         ? config.scanDirs.map(directory => resolveGraphScanDir(cwd, directory))
         : [resolveProjectAiwgDir(cwd)];

package/dist/src/artifacts/query-engine.js

@@ -181,7 +181,7 @@ const SCORE_STOPWORDS = new Set([
     'with', 'into', 'from', 'is', 'are', 'be', 'i', 'we', 'my',
     // pronouns / determiners / fillers
     'it', 'you', 'me', 'us', 'your', 'our', 'this', 'that', 'these', 'those',
-    'there', 'here', 'some', 'any', 'all', 'also', 'please', 'about',
+    'there', 'here', 'some', 'any', 'all', 'also', 'please', 'about', 'project',
     // question words
     'how', 'what', 'which', 'where', 'when', 'who', 'why',
     // asking / request verbs ("find a skill that handles …")
@@ -191,6 +191,7 @@ const SCORE_STOPWORDS = new Set([
     // AIWG meta-type nouns — zero discriminating signal in a discover query
     'aiwg', 'skill', 'skills', 'agent', 'agents', 'command', 'commands',
     'rule', 'rules', 'schema', 'schemas', 'flow', 'flows', 'workflow', 'workflows',
+    'template', 'templates',
 ]);
 /**
  * Tokenize a query phrase into lowercased keywords for multi-word
@@ -200,8 +201,18 @@ const SCORE_STOPWORDS = new Set([
 function tokenize(text) {
     return text
         .toLowerCase()
-        .split(/[^a-z0-9-]+/)
-        .filter(t => t.length > 1 && !SCORE_STOPWORDS.has(t));
+        .split(/[^a-z0-9]+/)
+        .filter(t => t.length > 1 && !SCORE_STOPWORDS.has(t))
+        .map(token => token.length > 4 && token.endsWith('s') && !token.endsWith('ss')
+        ? token.slice(0, -1)
+        : token);
+}
+function matchedFieldTokens(queryTokens, field) {
+    const fieldTokens = new Set(tokenize(field));
+    return queryTokens.filter(token => fieldTokens.has(token));
+}
+function fieldContainsQuery(field, queryTokens) {
+    return containsTokenSequence(tokenize(field), queryTokens);
 }
 /**
  * Score a metadata entry against a keyword query.
@@ -297,6 +308,7 @@ function scoreEntryDetailed(entry, text, opts = {}) {
     const personaIdentitySuppressed = diagnoseFacetActivations(text).some((activation) => activation.facet === 'persona-identity' && activation.status === 'suppressed');
     let score = 0;
     const matches = [];
+    const creditedTokens = new Set();
     const finish = (uncappedScore = score, cap = 1) => ({
         score: Math.min(uncappedScore, cap),
         diagnostic: {
@@ -311,6 +323,17 @@ function scoreEntryDetailed(entry, text, opts = {}) {
         score += contribution;
         matches.push({ ...match, contribution });
     };
+    const addTokenMatch = (contributionPerToken, hits, match) => {
+        const newlyMatched = hits.filter(token => !creditedTokens.has(token));
+        if (newlyMatched.length === 0)
+            return;
+        newlyMatched.forEach(token => creditedTokens.add(token));
+        addMatch(contributionPerToken * newlyMatched.length, {
+            ...match,
+            matched_tokens: newlyMatched,
+            query_token_coverage: tokens.length > 0 ? newlyMatched.length / tokens.length : 0,
+        });
+    };
     // Exact-name floor (#1233) — if the query (normalized) exactly matches
     // the entry's canonical name, this is the artifact the user is asking
     // for and it must surface at the top regardless of how cluttered the
@@ -422,14 +445,12 @@ function scoreEntryDetailed(entry, text, opts = {}) {
                 });
             }
             else if (useMultiToken) {
-                const hits = tokens.filter(t => trigger.includes(t));
+                const hits = matchedFieldTokens(tokens, trigger);
                 if (overlapOK(hits.length)) {
-                    addMatch(0.06 * 4 * (hits.length / tokens.length), {
+                    addTokenMatch(0.1 * 4, hits, {
                         field: 'trigger',
                         match: 'token-overlap',
                         value: trigger,
-                        matched_tokens: hits,
-                        query_token_coverage: hits.length / tokens.length,
                     });
                 }
             }
@@ -437,7 +458,7 @@ function scoreEntryDetailed(entry, text, opts = {}) {
     }
     // Capability description (2x weight) — full phrase first, then tokens
     if (capabilityLower) {
-        if (capabilityLower.includes(lower)) {
+        if (fieldContainsQuery(capabilityLower, tokens)) {
             addMatch(0.2 * 2, {
                 field: 'capability',
                 match: 'contained-phrase',
@@ -445,20 +466,18 @@ function scoreEntryDetailed(entry, text, opts = {}) {
             });
         }
         else if (useMultiToken) {
-            const hits = tokens.filter(t => capabilityLower.includes(t));
+            const hits = matchedFieldTokens(tokens, capabilityLower);
             if (overlapOK(hits.length)) {
-                addMatch(0.1 * 2 * (hits.length / tokens.length), {
+                addTokenMatch(0.1 * 2, hits, {
                     field: 'capability',
                     match: 'token-overlap',
                     value: entry.capability,
-                    matched_tokens: hits,
-                    query_token_coverage: hits.length / tokens.length,
                 });
             }
         }
     }
     // Title (3x weight)
-    if (titleLower.includes(lower)) {
+    if (fieldContainsQuery(titleLower, tokens)) {
         addMatch(0.3 * 3, {
             field: 'title',
             match: titleLower === lower ? 'exact' : 'contained-phrase',
@@ -469,93 +488,83 @@ function scoreEntryDetailed(entry, text, opts = {}) {
         }
     }
     else if (useMultiToken) {
-        const hits = tokens.filter(t => titleLower.includes(t));
+        const hits = matchedFieldTokens(tokens, titleLower);
         if (overlapOK(hits.length)) {
-            addMatch(0.08 * 3 * (hits.length / tokens.length), {
+            addTokenMatch(0.08 * 3, hits, {
                 field: 'title',
                 match: 'token-overlap',
                 value: entry.title,
-                matched_tokens: hits,
-                query_token_coverage: hits.length / tokens.length,
             });
         }
     }
     // Tags (2x weight)
     for (const tag of tagsLower) {
-        if (tag.includes(lower)) {
+        if (fieldContainsQuery(tag, tokens)) {
             addMatch(0.2 * 2, { field: 'tag', match: 'contained-phrase', value: tag });
         }
         else if (useMultiToken) {
-            const hits = tokens.filter(t => tag.includes(t));
+            const hits = matchedFieldTokens(tokens, tag);
             if (overlapOK(hits.length)) {
-                addMatch(0.05 * 2 * (hits.length / tokens.length), {
+                addTokenMatch(0.05 * 2, hits, {
                     field: 'tag',
                     match: 'token-overlap',
                     value: tag,
-                    matched_tokens: hits,
-                    query_token_coverage: hits.length / tokens.length,
                 });
             }
         }
     }
     // Structure-aware language terms (1.5x weight). These are deliberately
     // below declared triggers/capabilities but above generic body summaries.
-    if (searchTermsLower.includes(lower)) {
+    if (fieldContainsQuery(searchTermsLower, tokens)) {
         addMatch(0.18 * 1.5, { field: 'search_terms', match: 'contained-phrase' });
     }
     else if (useMultiToken) {
-        const hits = tokens.filter(t => searchTermsLower.includes(t));
+        const hits = matchedFieldTokens(tokens, searchTermsLower);
         if (overlapOK(hits.length)) {
-            addMatch(0.06 * 1.5 * (hits.length / tokens.length), {
+            addTokenMatch(0.06 * 1.5, hits, {
                 field: 'search_terms',
                 match: 'token-overlap',
-                matched_tokens: hits,
-                query_token_coverage: hits.length / tokens.length,
             });
         }
     }
     // Exact declarative kind and physical source classification are compact,
     // useful routing signals (e.g. FlowPlaybook vs OpsInventory; runbook that
     // originated under templates/).
-    if (kindLower.includes(lower)) {
+    if (fieldContainsQuery(kindLower, tokens)) {
         addMatch(0.15, { field: 'kind', match: 'contained-phrase', value: entry.kind });
     }
-    if (sourceTypeLower.includes(lower)) {
+    if (fieldContainsQuery(sourceTypeLower, tokens)) {
         addMatch(0.08, { field: 'source_type', match: 'contained-phrase', value: entry.sourceType });
     }
     // Summary (1x weight)
-    if (summaryLower.includes(lower)) {
+    if (fieldContainsQuery(summaryLower, tokens)) {
         addMatch(0.15, { field: 'summary', match: 'contained-phrase' });
     }
     else if (useMultiToken) {
-        const hits = tokens.filter(t => summaryLower.includes(t));
+        const hits = matchedFieldTokens(tokens, summaryLower);
         if (overlapOK(hits.length)) {
-            addMatch(0.04 * (hits.length / tokens.length), {
+            addTokenMatch(0.04, hits, {
                 field: 'summary',
                 match: 'token-overlap',
-                matched_tokens: hits,
-                query_token_coverage: hits.length / tokens.length,
             });
         }
     }
     // Path (0.5x weight)
-    if (pathLower.includes(lower)) {
+    if (fieldContainsQuery(pathLower, tokens)) {
         addMatch(0.1, { field: 'path', match: 'contained-phrase', value: entry.path });
     }
     else if (useMultiToken) {
-        const hits = tokens.filter(t => pathLower.includes(t));
+        const hits = matchedFieldTokens(tokens, pathLower);
         if (overlapOK(hits.length)) {
-            addMatch(0.03 * (hits.length / tokens.length), {
+            addTokenMatch(0.03, hits, {
                 field: 'path',
                 match: 'token-overlap',
                 value: entry.path,
-                matched_tokens: hits,
-                query_token_coverage: hits.length / tokens.length,
             });
         }
     }
     // Type (0.5x weight)
-    if (typeLower.includes(lower)) {
+    if (fieldContainsQuery(typeLower, tokens)) {
         addMatch(0.1, { field: 'type', match: 'contained-phrase', value: entry.type });
     }
     return finish();
@@ -1078,36 +1087,27 @@ export async function discoverCapability(cwd, params) {
     // lexical ranking so canonical domain phrases rank their owning capability
     // top-K instead of being out-scored by artifacts that merely mention the
     // word. Facet activation can also rescue an otherwise-empty strict pass.
-    let scored = dedupeDiscoverResults(await applyFacetFusion(strictScored, candidates, params.phrase)).slice(0, limit);
-    // #1561 — verbose-query fallback. A wordy full-sentence query
-    // ("find me a skill that handles intake forms") dilutes the token hit ratio
-    // below the strict ceil(n/2) overlap gate and returns nothing, training
-    // agents to conclude "no skill exists" — the exact decline-without-search
-    // failure the skill-discovery rule guards against. When the strict pass
-    // dead-ends, re-score with a relaxed (single-hit) overlap so the meaningful
-    // tokens still surface ranked candidates rather than an empty set.
-    let relaxed = false;
-    if (scored.length === 0) {
-        // Floor the relaxed pass so a single incidental path/summary token hit
-        // (~0.006–0.008) doesn't surface as noise. Capability/title/trigger field
-        // hits land ~0.04+, so this keeps meaningful matches while dropping junk —
-        // if nothing clears the floor, we fall through to the no-match hint, which
-        // is more honest than surfacing a 0.01 path match.
-        const RELAXED_MIN_SCORE = 0.02;
-        const relaxedFull = candidates
-            .map(entry => {
-            const detailed = scoreEntryDetailed(entry, params.phrase, { relaxOverlap: true });
+    // #154 — a strict result anywhere in the corpus must not suppress relevant
+    // partial matches for a natural-language query. Score the relaxed pass on
+    // matched terms (unmatched terms do not divide the score), apply a noise
+    // floor, and union it with strict matches before ranking. Word-boundary
+    // token matching keeps this from resurrecting substring noise such as UX in
+    // Linux.
+    const RELAXED_MIN_SCORE = 0.02;
+    const strictPaths = new Set(strictScored.map(result => result.entry.path));
+    const combinedByPath = new Map(strictScored.map(result => [result.entry.path, result]));
+    for (const entry of candidates) {
+        const detailed = scoreEntryDetailed(entry, params.phrase, { relaxOverlap: true });
+        if (detailed.score < RELAXED_MIN_SCORE)
+            continue;
+        const existing = combinedByPath.get(entry.path);
+        if (!existing || detailed.score > existing.score) {
+            combinedByPath.set(entry.path, { entry, score: detailed.score });
             lexicalDiagnostics.set(entry.path, detailed.diagnostic);
-            return { entry, score: detailed.score };
-        })
-            .filter(r => r.score >= RELAXED_MIN_SCORE)
-            .sort(compareDiscoverResults);
-        const relaxedScored = dedupeDiscoverResults(await applyFacetFusion(relaxedFull, candidates, params.phrase)).slice(0, limit);
-        if (relaxedScored.length > 0) {
-            scored = relaxedScored;
-            relaxed = true;
         }
     }
+    const scored = dedupeDiscoverResults(await applyFacetFusion(Array.from(combinedByPath.values()).sort(compareDiscoverResults), candidates, params.phrase)).slice(0, limit);
+    const relaxed = scored.some(result => !strictPaths.has(result.entry.path));
     const queryTimeMs = Date.now() - startTime;
     /**
      * Resolve a stored framework-graph path to an absolute AIWG_ROOT

package/dist/src/artifacts/stats.js

@@ -7,7 +7,7 @@
  * @source @src/artifacts/types.ts
  * @tests @test/unit/artifacts/stats.test.ts
  */
-import { GRAPH_CONFIGS, loadUserGraphConfigs } from './types.js';
+import { GRAPH_CONFIGS, loadGlobalGraphConfigs, loadUserGraphConfigs } from './types.js';
 import { loadIndexStats, loadGraphIndexFile } from './index-reader.js';
 import { collectGraphIndexFiles, indexPathFor } from './index-files.js';
 /** Calculate coverage over the same current file set used by the index builder. */
@@ -30,6 +30,8 @@ async function calculateCoverage(cwd, stats, graphType) {
  */
 export async function showStats(cwd, options = {}) {
     const { graph } = options;
+    loadUserGraphConfigs(cwd);
+    loadGlobalGraphConfigs();
     if (graph) {
         // Single graph mode
         const stats = loadGraphIndexFile(cwd, 'stats.json', graph);
@@ -42,7 +44,6 @@ export async function showStats(cwd, options = {}) {
         return;
     }
     // No graph specified: show all graphs with defaultBuild=true
-    loadUserGraphConfigs(cwd);
     const graphTypes = Object.entries(GRAPH_CONFIGS)
         .filter(([, config]) => config.defaultBuild)
         .map(([name]) => name);
@@ -128,6 +129,9 @@ async function renderStats(cwd, stats, options, graphType) {
     // Dependency graph
     console.log('Dependency Graph:');
     console.log(`  Total edges:        ${stats.graphMetrics.totalEdges}`);
+    if (stats.graphMetrics.markdownLinkEdges !== undefined) {
+        console.log(`  Markdown link edges:${String(stats.graphMetrics.markdownLinkEdges).padStart(3)}`);
+    }
     if (stats.graphMetrics.canonicalEdges !== undefined) {
         console.log(`  Canonical edges:    ${stats.graphMetrics.canonicalEdges}`);
         console.log(`  Outgoing declares:  ${stats.graphMetrics.outgoingDeclarations}`);

package/dist/src/artifacts/types.js

@@ -104,7 +104,7 @@ export const INDEX_VERSION = '1.0.0';
  * making the serialized index schema incompatible; a mismatch simply forces a
  * one-time content re-extraction during the next incremental build.
  */
-export const INDEX_EXTRACTOR_VERSION = '2026.07.21.2';
+export const INDEX_EXTRACTOR_VERSION = '2026.08.24.1';
 /**
  * Built-in graph definitions
  */

package/dist/src/cli/handlers/installation.js

@@ -45,7 +45,7 @@ export const installationHandler = {
         };
         if (action === 'show') {
             const identity = loadInstallationIdentity({ ...common, createIfMissing: true });
-            display(inspectInstallation({ ...common, identity }), json);
+            display(inspectInstallation({ ...common, identity, probeManager: true }), json);
             return { exitCode: 0 };
         }
         if (action === 'adopt') {

package/dist/src/cli/handlers/refresh.js

@@ -205,6 +205,7 @@ export const refreshHandler = {
         if (!quiet)
             ui.info(dryRun ? 'Would refresh remote packages...' : 'Refreshing remote packages...');
         const deploymentFailures = [];
+        let updateFailure = null;
         if (!dryRun) {
             try {
                 const refreshed = await refreshAllPackages();
@@ -242,10 +243,10 @@ export const refreshHandler = {
                         ui.success('Package up to date');
                 }
                 else {
-                    return {
-                        exitCode: updateResult.exitCode,
-                        message: 'Installation update failed; refresh stopped before re-deployment. Run `aiwg installation show` for canonical-install diagnostics.',
-                    };
+                    updateFailure = { exitCode: updateResult.exitCode };
+                    if (!quiet) {
+                        ui.warn('Installation update failed; continuing with re-deployment. Run `aiwg installation show` for canonical-install diagnostics.');
+                    }
                 }
             }
         }
@@ -465,6 +466,7 @@ export const refreshHandler = {
                 channel: channel || undefined,
                 staleAgentRemovals,
                 deploymentFailures,
+                updateFailure,
             });
             console.log(output);
         }

package/dist/src/cli/handlers/use.js

@@ -1873,11 +1873,13 @@ async function deploySourceDirectory(opts) {
         args.push('--force');
     if (opts.copyAll)
         args.push('--copy-all');
+    if (opts.kernelOnly)
+        args.push('--kernel-only');
     if (opts.quiet)
         args.unshift('--quiet');
     const runner = createScriptRunner(opts.frameworkRoot);
     const result = await runner.run('tools/agents/deploy-agents.mjs', args, opts.quiet ? { capture: true } : {});
-    if (result.exitCode === 0) {
+    if (result.exitCode === 0 && !opts.kernelOnly) {
         try {
             await registerSourceCliCommands({
                 source: opts.source,
@@ -2436,6 +2438,7 @@ export class UseHandler {
             }
             ui.dim('  Use `aiwg use all` for the full deployment.');
             for (const providerName of providersForFiltered) {
+                const kernelOnly = !copyAll;
                 for (const selected of selectedFrameworks) {
                     const frameworkDir = resolveFrameworkDir(selected);
                     if (!frameworkDir)
@@ -2450,6 +2453,7 @@ export class UseHandler {
                         verbose,
                         force,
                         copyAll,
+                        kernelOnly,
                         quiet,
                         modelArgs: modelDeployArgs,
                     });
@@ -2467,6 +2471,7 @@ export class UseHandler {
                         verbose,
                         force,
                         copyAll,
+                        kernelOnly,
                         quiet,
                         modelArgs: modelDeployArgs,
                     });
@@ -2484,6 +2489,7 @@ export class UseHandler {
                         verbose,
                         force,
                         copyAll,
+                        kernelOnly,
                         quiet,
                         modelArgs: modelDeployArgs,
                     });
@@ -2985,6 +2991,11 @@ export class UseHandler {
         const providerDeployArgs = builtInProviderResolution.requestedProvider
             ? withProviderOverride(deployFilteredArgs, provider)
             : deployFilteredArgs;
+        const bulkKernelOnly = framework === 'all'
+            && !remainingArgs.includes('--copy-all')
+            && !remainingArgs.includes('--copy-standard-skills');
+        if (bulkKernelOnly)
+            providerDeployArgs.push('--kernel-only');
         const targetIdx = remainingArgs.findIndex(a => a === '--target');
         const target = targetIdx >= 0 && remainingArgs[targetIdx + 1] ? remainingArgs[targetIdx + 1] : process.cwd();
         if ((verbose || dryRun) && projectLocalProviderResolution.requestedProvider) {
@@ -3084,11 +3095,15 @@ export class UseHandler {
         }
         // Build common args for addon deployments (inherit provider and target)
         const addonBaseArgs = ['--deploy-commands', '--deploy-skills', '--deploy-rules'];
+        if (bulkKernelOnly)
+            addonBaseArgs.push('--kernel-only');
         addonBaseArgs.push(...modelDeployArgs);
         if (provider)
             addonBaseArgs.push('--provider', provider);
         if (target)
             addonBaseArgs.push('--target', target);
+        if (dryRun)
+            addonBaseArgs.push('--dry-run');
         if (verbose)
             addonBaseArgs.push('--verbose');
         // Forward --copy-all to addon deploys so the legacy mirror behavior
@@ -3182,7 +3197,7 @@ export class UseHandler {
         }
         await ensureProviderGeneratedDirsIgnored(target, provider, { dryRun, verbose });
         const paths = getProviderPaths(provider);
-        if (!dryRun && !skipUtils) {
+        if (!dryRun && !skipUtils && !bulkKernelOnly) {
             const wrapperValidation = await validateDeployedModelWrappers({
                 provider,
                 target,
@@ -3200,7 +3215,7 @@ export class UseHandler {
         const targetKernelSkillsDir = kernelSkillsPath ? resolveProviderPath(target, kernelSkillsPath) : '';
         // Translate deployed skills to commands for providers that require legacy command format.
         // (#550) Skills are canonical; commands are generated deployment artifacts.
-        if (providerNeedsCommands(provider) && targetCommandsDir) {
+        if (!bulkKernelOnly && providerNeedsCommands(provider) && targetCommandsDir) {
             try {
                 const translationResult = await translateSkillsToCommands(targetSkillsDir, {
                     provider,
@@ -3222,7 +3237,7 @@ export class UseHandler {
         // provider loads skills natively: users still expect setup, update,
         // status, intake, and flow workflows to show up in the provider's `/`
         // command picker where supported.
-        if (targetCommandsDir) {
+        if (!bulkKernelOnly && targetCommandsDir) {
             try {
                 const standardMirrored = await mirrorStandardCommandSkills({
                     provider,

package/dist/src/installation/manager-command.mjs

@@ -0,0 +1,31 @@
+import { execFileSync } from 'node:child_process';
+
+function quoteCmdArgument(value) {
+  return `"${String(value).replace(/%/g, '%%').replace(/"/g, '""')}"`;
+}
+
+/**
+ * Resolve a package-manager invocation without asking Node to execute a
+ * Windows command script directly. Node rejects direct .cmd/.bat execution on
+ * current Windows releases; cmd.exe is the native interpreter for those files.
+ */
+export function resolveManagerCommand(file, args, options = {}) {
+  const platform = options.platform ?? process.platform;
+  if (platform !== 'win32' || !/\.(?:cmd|bat)$/i.test(file)) {
+    return { file, args };
+  }
+
+  const env = options.env ?? process.env;
+  const commandInterpreter = env.ComSpec || env.COMSPEC || 'cmd.exe';
+  const command = `"${[file, ...args].map(quoteCmdArgument).join(' ')}"`;
+  return {
+    file: commandInterpreter,
+    args: ['/d', '/s', '/c', command],
+  };
+}
+
+export function executeManagerCommand(file, args, options = {}) {
+  const invocation = resolveManagerCommand(file, args, options);
+  const execute = options.execute ?? execFileSync;
+  return execute(invocation.file, invocation.args, options.execOptions ?? { stdio: 'inherit' });
+}

package/dist/src/installation/manager.mjs

@@ -12,6 +12,7 @@ import {
 } from 'node:fs';
 import path from 'node:path';
 import { resolveUserConfigDir } from '../config/user-config-dir.mjs';
+import { executeManagerCommand } from './manager-command.mjs';
 
 export const INSTALLATION_IDENTITY_VERSION = 1;
 export const INSTALLATION_FILE = 'installation.json';
@@ -188,6 +189,25 @@ export function inspectInstallation(options = {}) {
   if (identity.managerExecutable && !executableIsUsable(identity.managerExecutable)) {
     drift.push(`recorded manager executable is missing or not executable: ${identity.managerExecutable}`);
   }
+  let managerProbe = null;
+  if (
+    options.probeManager === true &&
+    identity.managerExecutable &&
+    executableIsUsable(identity.managerExecutable)
+  ) {
+    try {
+      executeManagerCommand(identity.managerExecutable, ['--version'], {
+        ...options,
+        execute: options.executeManager,
+        execOptions: { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000 },
+      });
+      managerProbe = { state: 'usable' };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      managerProbe = { state: 'failed', error: message };
+      drift.push(`recorded manager executable cannot be invoked: ${message}`);
+    }
+  }
   return {
     state: drift.length === 0 ? 'aligned' : (existsSync(canonicalRoot) ? 'mismatch' : 'stale'),
     identity,
@@ -195,6 +215,7 @@ export function inspectInstallation(options = {}) {
     actualRoot,
     actualMethod,
     drift,
+    managerProbe,
   };
 }
 

package/dist/src/smiths/context-pipeline/claude-hook.js

@@ -22,6 +22,7 @@
 import * as fs from 'fs/promises';
 import * as path from 'path';
 import { buildProviderBootstrapBlock, PROVIDER_BOOTSTRAP_START, PROVIDER_BOOTSTRAP_END, } from './workspace-context.js';
+import { dominantLineEnding, withLineEnding } from './line-endings.js';
 export const CLAUDE_HOOK_START = '<!-- AIWG:claude-md-hook:start -->';
 export const CLAUDE_HOOK_END = '<!-- AIWG:claude-md-hook:end -->';
 function buildClaudeArtifactOutputPolicy(policy = {}) {
@@ -77,7 +78,7 @@ export async function ensureClaudeMdHook(projectPath, opts = {}) {
     catch {
         // Missing/legacy/temporarily malformed config receives the safe default.
     }
-    const block = buildClaudeHookBlock(policy);
+    let block = buildClaudeHookBlock(policy);
     // Case 1: CLAUDE.md does not exist — create a minimal one with just the block.
     let existing;
     try {
@@ -92,6 +93,8 @@ export async function ensureClaudeMdHook(projectPath, opts = {}) {
         }
         throw err;
     }
+    const lineEnding = dominantLineEnding(existing);
+    block = withLineEnding(block, lineEnding);
     const startIdx = existing.indexOf(CLAUDE_HOOK_START);
     const endIdx = existing.indexOf(CLAUDE_HOOK_END);
     // Case 2: marker block does not exist — append the block to end of file.
@@ -117,8 +120,8 @@ export async function ensureClaudeMdHook(projectPath, opts = {}) {
             return result;
         }
         // Ensure the file ends with a single newline before appending.
-        const trimmed = existing.replace(/\n+$/, '\n');
-        const updated = `${trimmed}\n${block}\n`;
+        const trimmed = existing.replace(/(?:\r?\n)+$/, lineEnding);
+        const updated = `${trimmed}${lineEnding}${block}${lineEnding}`;
         await fs.writeFile(claudeMdPath, updated, 'utf8');
         result.action = 'inserted';
         return result;
@@ -135,8 +138,8 @@ export async function ensureClaudeMdHook(projectPath, opts = {}) {
             await fs.writeFile(backupPath, existing, 'utf8');
             result.backupPath = backupPath;
         }
-        const trimmed = existing.replace(/\n+$/, '\n');
-        const updated = `${trimmed}\n${block}\n`;
+        const trimmed = existing.replace(/(?:\r?\n)+$/, lineEnding);
+        const updated = `${trimmed}${lineEnding}${block}${lineEnding}`;
         await fs.writeFile(claudeMdPath, updated, 'utf8');
         result.action = 'inserted';
         return result;

package/dist/src/smiths/context-pipeline/line-endings.js

@@ -0,0 +1,12 @@
+/** Select the majority line ending, preferring LF for ties and new files. */
+export function dominantLineEnding(content) {
+    const crlfCount = content.match(/\r\n/g)?.length ?? 0;
+    const newlineCount = content.match(/\n/g)?.length ?? 0;
+    const bareLfCount = newlineCount - crlfCount;
+    return crlfCount > bareLfCount ? '\r\n' : '\n';
+}
+/** Render generated text using the line-ending convention of existing content. */
+export function withLineEnding(content, lineEnding) {
+    return content.replace(/\r?\n/g, lineEnding);
+}
+//# sourceMappingURL=line-endings.js.map

package/dist/src/smiths/context-pipeline/managed-hook.js

@@ -14,6 +14,7 @@
 import * as fs from 'fs/promises';
 import * as path from 'path';
 import { buildProviderBootstrapBlock } from './workspace-context.js';
+import { dominantLineEnding, withLineEnding } from './line-endings.js';
 export const CONTEXT_HOOK_START = '<!-- AIWG:context-hook:start -->';
 export const CONTEXT_HOOK_END = '<!-- AIWG:context-hook:end -->';
 /** The managed block — loads canonical workspace context before framework context. */
@@ -42,7 +43,7 @@ export function hasContextHook(content) {
  */
 export async function ensureManagedHook(filePath, opts = {}) {
     const base = path.basename(filePath);
-    const block = buildContextHookBlock(opts.provider);
+    let block = buildContextHookBlock(opts.provider);
     const result = { path: filePath, action: 'skipped', warnings: [] };
     let existing;
     try {
@@ -56,6 +57,8 @@ export async function ensureManagedHook(filePath, opts = {}) {
         }
         throw err;
     }
+    const lineEnding = dominantLineEnding(existing);
+    block = withLineEnding(block, lineEnding);
     // Already has both bare includes (operator wired them by hand) — nothing to do.
     if (!existing.includes(CONTEXT_HOOK_START) && /^[ \t]*@WORKSPACE\.md[ \t]*$/m.test(existing) && /^[ \t]*@AIWG\.md[ \t]*$/m.test(existing)) {
         result.action = 'unchanged';
@@ -65,16 +68,16 @@ export async function ensureManagedHook(filePath, opts = {}) {
     const e = existing.indexOf(CONTEXT_HOOK_END);
     // No managed block — append it to the end, preserving everything above.
     if (s === -1 && e === -1) {
-        const trimmed = existing.replace(/\n+$/, '\n');
-        await fs.writeFile(filePath, `${trimmed}\n${block}\n`, 'utf8');
+        const trimmed = existing.replace(/(?:\r?\n)+$/, lineEnding);
+        await fs.writeFile(filePath, `${trimmed}${lineEnding}${block}${lineEnding}`, 'utf8');
         result.action = 'inserted';
         return result;
     }
     // Malformed (one marker only) — repair only with --force to avoid clobbering.
     if (s === -1 || e === -1) {
         if (opts.force) {
-            const trimmed = existing.replace(/\n+$/, '\n');
-            await fs.writeFile(filePath, `${trimmed}\n${block}\n`, 'utf8');
+            const trimmed = existing.replace(/(?:\r?\n)+$/, lineEnding);
+            await fs.writeFile(filePath, `${trimmed}${lineEnding}${block}${lineEnding}`, 'utf8');
             result.action = 'inserted';
             return result;
         }

package/dist/src/smiths/context-pipeline/workspace-context.js

@@ -14,6 +14,7 @@ import { buildNormalizedAiwgMd } from './finalization.js';
 import { getProviderDefinition, listProviderDefinitions, } from '../../providers/provider-definitions.js';
 import { readAiwgConfig } from '../../config/aiwg-config.js';
 import { projectAiwgPath, projectControlPath, resolveProjectAiwgDir, } from '../../config/project-artifacts.js';
+import { dominantLineEnding, withLineEnding } from './line-endings.js';
 export const WORKSPACE_MANAGED_START = '<!-- AIWG:workspace-context:start -->';
 export const WORKSPACE_MANAGED_END = '<!-- AIWG:workspace-context:end -->';
 export const WORKSPACE_OPERATOR_START = '<!-- AIWG:workspace-operator:start -->';
@@ -90,7 +91,8 @@ function replaceBlock(content, start, end, block) {
         return null;
     if (startIndex < 0 || endIndex < startIndex)
         throw new Error(`Malformed managed block: ${start} / ${end}`);
-    return content.slice(0, startIndex) + block + content.slice(endIndex + end.length);
+    const renderedBlock = withLineEnding(block, dominantLineEnding(content));
+    return content.slice(0, startIndex) + renderedBlock + content.slice(endIndex + end.length);
 }
 function stripGeneratedBlocks(content) {
     let stripped = content;

package/dist/src/update/service.mjs

@@ -16,6 +16,7 @@ import {
   loadInstallationIdentity,
   saveInstallationIdentity,
 } from '../installation/manager.mjs';
+import { resolveManagerCommand } from '../installation/manager-command.mjs';
 
 const VALID_MODES = new Set(['npm', 'web', 'source']);
 
@@ -148,8 +149,9 @@ export async function updateInstallation(options = {}) {
     throw new Error('Canonical npm installation has no package-manager executable. Run `aiwg installation adopt --manager <absolute-path-to-npm>`.');
   }
   if (!dryRun) {
+    const invocation = resolveManagerCommand(managerExecutable, command, options);
     const execute = options.execute ?? ((file, args) => execFileSync(file, args, { stdio: 'inherit' }));
-    execute(managerExecutable, command);
+    execute(invocation.file, invocation.args);
     if (detected.identity && detected.identityPersistent && options.persistIdentity !== false) {
       saveInstallationIdentity({ ...detected.identity, channel }, options);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwg/cli",
-  "version": "2026.8.18",
+  "version": "2026.8.19",
   "description": "Lightweight AIWG CLI for signed, versioned web-backed resources.",
   "type": "module",
   "license": "MIT",

package/tools/agents/deploy-agents.mjs

@@ -340,7 +340,7 @@ function mirrorSkillsAsCommands(provider, target, srcRoot, opts) {
  * @param {string|null} explicitSource the raw `--source` value (null when unset)
  */
 function pruneStaleAiwgArtifacts(provider, target, srcRoot, opts, explicitSource) {
-  if (opts.skillsOnly) return; // skills run their own prune in the provider
+  if (opts.skillsOnly && !opts.kernelOnly) return; // skills run their own prune in the provider
 
   const aiwgRoot = resolveAiwgRoot(srcRoot);
   if (!aiwgRoot) return; // no AIWG tree → bundle/standalone deploy; never prune
@@ -355,6 +355,20 @@ function pruneStaleAiwgArtifacts(provider, target, srcRoot, opts, explicitSource
     if (!underCode) return; // project-local bundle / external source → skip
   }
 
+  if (opts.kernelOnly) {
+    for (const type of ['agents', 'commands', 'rules']) {
+      const relPath = provider.paths?.[type];
+      if (!relPath || relPath.endsWith('.md')) continue;
+      const destDir = path.isAbsolute(relPath) ? relPath : path.join(target, relPath);
+      pruneStaleAiwgFiles(destDir, new Set(), {
+        dryRun: opts.dryRun,
+        verbose: opts.verbose,
+        artifactExtensions: ['.md', '.mdc', '.toml'],
+      });
+    }
+    return;
+  }
+
   const typesThisRun = [];
   if (!opts.commandsOnly && !opts.rulesOnly) typesThisRun.push('agents');
   if (opts.deployCommands || opts.commandsOnly) typesThisRun.push('commands');
@@ -406,6 +420,7 @@ function parseArgs() {
     commandsOnly: false,
     skillsOnly: false,
     rulesOnly: false,
+    kernelOnly: false,
     filter: null,           // Glob pattern for agent names
     filterRole: null,       // Filter by role: reasoning|coding|efficiency
     save: false,            // Save model config to project models.json
@@ -438,6 +453,7 @@ function parseArgs() {
     else if (a === '--commands-only') cfg.commandsOnly = true;
     else if (a === '--skills-only') cfg.skillsOnly = true;
     else if (a === '--rules-only') cfg.rulesOnly = true;
+    else if (a === '--kernel-only') cfg.kernelOnly = true;
     else if (a === '--deploy-behaviors') cfg.deployBehaviors = true;
     else if (a === '--filter' && args[i + 1]) cfg.filter = args[++i];
     else if (a === '--filter-role' && args[i + 1]) cfg.filterRole = args[++i];
@@ -474,6 +490,7 @@ Options:
   --commands-only          Deploy only commands (skip agents)
   --skills-only            Deploy only skills (skip agents)
   --rules-only             Deploy only rules (skip agents)
+  --kernel-only            Deploy kernel skills only and prune managed bulk artifacts
   --dry-run                Show what would be deployed without writing
   --force                  Overwrite existing files
   --provider <name>        Target provider (see below)
@@ -490,7 +507,9 @@ Options:
   --create-agents-md           Create/update AGENTS.md template
   --skip-commands-migration    Skip deleting the commands directory before skills deployment
   --copy-all                   Copy ALL skills per-project (legacy mirror at <provider>/.aiwg/skills/).
-                               Default is kernel-only + index-driven discovery for the rest (#1217).
+                               For aiwg use all, this also restores the legacy full agent,
+                               command, and expanded-rule copy. Default bulk deployment is
+                               kernel-only + index-driven discovery for the rest (#1217).
                                Use this for sandboxed runtimes / air-gapped corpora where
                                $AIWG_ROOT isn't readable from the agent's working dir.
                                Alias: --copy-standard-skills — rc.29 era).
@@ -879,13 +898,14 @@ export async function main() {
     modelsConfig,
     asAgentsMd: cfg.asAgentsMd,
     createAgentsMd: cfg.createAgentsMd,
-    deployCommands: cfg.deployCommands,
-    deploySkills: cfg.deploySkills,
-    deployRules: cfg.deployRules,
-    deployBehaviors: cfg.deployBehaviors,
+    deployCommands: cfg.kernelOnly ? false : cfg.deployCommands,
+    deploySkills: cfg.kernelOnly ? true : cfg.deploySkills,
+    deployRules: cfg.kernelOnly ? false : cfg.deployRules,
+    deployBehaviors: cfg.kernelOnly ? false : cfg.deployBehaviors,
     commandsOnly: cfg.commandsOnly,
-    skillsOnly: cfg.skillsOnly,
+    skillsOnly: cfg.skillsOnly || cfg.kernelOnly,
     rulesOnly: cfg.rulesOnly,
+    kernelOnly: cfg.kernelOnly,
     filter: cfg.filter,
     filterRole: cfg.filterRole,
     save: cfg.save,
@@ -893,7 +913,7 @@ export async function main() {
     verbose: cfg.verbose,
     quiet: cfg.quiet,
     asPlugin: cfg.asPlugin,
-    deployBehaviors: cfg.deployBehaviors,
+    deployBehaviors: cfg.kernelOnly ? false : cfg.deployBehaviors,
     skipCommandsMigration: cfg.skipCommandsMigration,
     // #1217 / #1219: --copy-all flag forces legacy per-project mirror
     // for the standard tier. Default is no-copy + index-driven discovery.

package/tools/agents/providers/base.mjs

@@ -1183,7 +1183,7 @@ export function computeAllKernelNames(srcRoot) {
  *   located — see `computeAllKernelNames`), pruning is skipped entirely so a
  *   project-local-bundle deploy without AIWG_ROOT never empties the kernel
  *   skills directory (#123).
- * @param {object} opts `{ dryRun, verbose }`
+ * @param {object} opts `{ dryRun, verbose, artifactExtensions }`
  * @returns {number} count of pruned entries
  */
 export function pruneStaleAiwgSkills(kernelDestDir, desiredKernelNames, opts = {}) {
@@ -1348,7 +1348,8 @@ export function resolveAiwgRoot(srcRoot) {
  * `pruneStaleAiwgSkills`.
  *
  * Removes a file from `destDir` only when ALL hold:
- *   1. It is a deployed artifact file (`.md` / `.mdc`), not `RULES-INDEX.md`
+ *   1. It has an allowed deployed-artifact extension (`.md` / `.mdc` by
+ *      default; callers may include `.toml`), is not `RULES-INDEX.md`,
  *      and not the sidecar manifest.
  *   2. Its stem is NOT in `desiredStems` (the source no longer ships it).
  *   3. It carries an AIWG ownership signal — either a `.aiwg-manifest.json`
@@ -1369,6 +1370,7 @@ export function resolveAiwgRoot(srcRoot) {
  */
 export function pruneStaleAiwgFiles(destDir, desiredStems, opts = {}) {
   const { dryRun = false, verbose = false } = opts;
+  const artifactExtensions = opts.artifactExtensions || ['.md', '.mdc'];
   const removed = [];
   if (!destDir || !fs.existsSync(destDir)) return removed;
 
@@ -1391,7 +1393,7 @@ export function pruneStaleAiwgFiles(destDir, desiredStems, opts = {}) {
     if (name === 'RULES-INDEX.md') continue;
     if (name === 'RULES-ONDEMAND.md') continue; // generated on-demand index (#1673)
     const lower = name.toLowerCase();
-    if (!lower.endsWith('.md') && !lower.endsWith('.mdc')) continue;
+    if (!artifactExtensions.some(extension => lower.endsWith(extension))) continue;
 
     if (desired.has(artifactStem(name))) continue;