@aiwg/cli 2026.8.18 → 2026.8.20

package/dist/src/cli/handlers/index.js

@@ -32,6 +32,7 @@ import { regenerateHandler, regenerateHandlers } from './regenerate.js';
 import { workspaceContextHandler, workspaceContextHandlers } from './workspace-context.js';
 import { artifactsHandler, artifactsHandlers } from './artifacts.js';
 import { mcHandler, mcHandlers } from './mc.js';
+import { missionHandlers } from './mission.js';
 import { sdlcAccelerateHandler } from './sdlc-accelerate.js';
 import { teamHandler, teamHandlers } from './team.js';
 import { installHandler } from './install.js';
@@ -64,6 +65,7 @@ import { evidenceHandler } from './evidence.js';
 import { artifactVerifyHandler } from './artifact-verify.js';
 import { outputModeHandler } from './output-mode.js';
 import { installationHandler } from './installation.js';
+import { uhpHandler } from './uhp.js';
 // Re-export individual handlers
 export { 
 // Maintenance
@@ -75,7 +77,7 @@ newBundleHandler, quickrefHandler, newProjectHandler, sessionHandler, sessionsHa
 // Workspace
 statusHandler, wizardHandler, migrateWorkspaceHandler, rollbackWorkspaceHandler, 
 // Subcommands
-mcpHandler, catalogHandler, modelsHandler, versionsHandler, indexHandler, artifactsHandler, corpusHandler, discoverHandler, showHandler, featuresHandler, skillsHandler, configHandler, opsHandler, storageHandler, activityLogHandler, commandLogHandler, skillUsageHandler, kbHandler, memoryHandler, reflectionsHandler, provenanceHandler, researchStoreHandler, researchQueryHandler, runtimeInfoHandler, agentcardHandler, 
+mcpHandler, catalogHandler, modelsHandler, versionsHandler, indexHandler, artifactsHandler, corpusHandler, discoverHandler, showHandler, featuresHandler, skillsHandler, configHandler, opsHandler, storageHandler, activityLogHandler, commandLogHandler, skillUsageHandler, kbHandler, memoryHandler, reflectionsHandler, provenanceHandler, researchStoreHandler, researchQueryHandler, runtimeInfoHandler, agentcardHandler, uhpHandler, 
 // Agentic Tools (RLM)
 chunkHandler, fanoutHandler, rlmPrepHandler, rlmSearchHandler, rlmStatusCliHandler, rlmCacheHandler, 
 // Utilities
@@ -111,7 +113,7 @@ repoAccessHandler,
 // Lint
 lintHandler, };
 // Re-export handler arrays
-export { workspaceHandlers, utilityHandlers, scaffoldingHandlers, ralphHandlers, subcommandHandlers, mcHandlers, teamHandlers, stewardHandlers, regenerateHandlers, workspaceContextHandlers, artifactsHandlers, daemonHandlers, sandboxHandlers, repoAccessHandlers, };
+export { workspaceHandlers, utilityHandlers, scaffoldingHandlers, ralphHandlers, subcommandHandlers, mcHandlers, missionHandlers, teamHandlers, stewardHandlers, regenerateHandlers, workspaceContextHandlers, artifactsHandlers, daemonHandlers, sandboxHandlers, repoAccessHandlers, };
 /**
  * All registered command handlers
  *
@@ -170,6 +172,7 @@ export const allHandlers = [
     skillsHandler,
     runtimeInfoHandler,
     agentcardHandler,
+    uhpHandler,
     // Utilities
     prefillCardsHandler,
     contributeStartHandler,
@@ -188,6 +191,7 @@ export const allHandlers = [
     ...ralphHandlers,
     // Mission Control
     ...mcHandlers,
+    ...missionHandlers,
     // Agent Teams
     ...teamHandlers,
     // Steward (capability awareness)

package/dist/src/cli/handlers/installation.js

@@ -45,7 +45,7 @@ export const installationHandler = {
         };
         if (action === 'show') {
             const identity = loadInstallationIdentity({ ...common, createIfMissing: true });
-            display(inspectInstallation({ ...common, identity }), json);
+            display(inspectInstallation({ ...common, identity, probeManager: true }), json);
             return { exitCode: 0 };
         }
         if (action === 'adopt') {

package/dist/src/cli/handlers/mission.js

@@ -0,0 +1,27 @@
+const usage = `Usage: aiwg mission migrate [--dry-run] [--root <workspace>]
+       aiwg mission migrate --apply --target mission.aiwg.io/v1 [--id <id>]
+       aiwg mission migrate --verify <id> | --resume <id> | --rollback <id>
+
+Preview is the default. Apply is backup-first and requires an explicit target.`;
+export const missionHandler = {
+    id: 'mission',
+    name: 'Mission Protocol',
+    description: 'Preview, apply, verify, resume, or roll back Mission Protocol migrations',
+    category: 'orchestration',
+    aliases: [],
+    async execute(ctx) {
+        if (ctx.args[0] !== 'migrate' || ctx.args.includes('--help') || ctx.args.includes('-h')) {
+            return { exitCode: ctx.args[0] === 'migrate' ? 0 : 2, message: usage, rawOutput: true };
+        }
+        const { spawn } = await import('node:child_process');
+        const path = await import('node:path');
+        const script = path.join(ctx.frameworkRoot, 'tools/mission-protocol/migrate.mjs');
+        return await new Promise(resolve => {
+            const child = spawn(process.execPath, [script, ...ctx.args.slice(1), '--root', ctx.cwd], { stdio: 'inherit', signal: ctx.signal });
+            child.once('error', error => resolve({ exitCode: 1, error, message: error.message }));
+            child.once('exit', code => resolve({ exitCode: code ?? 1 }));
+        });
+    },
+};
+export const missionHandlers = [missionHandler];
+//# sourceMappingURL=mission.js.map

package/dist/src/cli/handlers/refresh.js

@@ -205,6 +205,7 @@ export const refreshHandler = {
         if (!quiet)
             ui.info(dryRun ? 'Would refresh remote packages...' : 'Refreshing remote packages...');
         const deploymentFailures = [];
+        let updateFailure = null;
         if (!dryRun) {
             try {
                 const refreshed = await refreshAllPackages();
@@ -242,10 +243,10 @@ export const refreshHandler = {
                         ui.success('Package up to date');
                 }
                 else {
-                    return {
-                        exitCode: updateResult.exitCode,
-                        message: 'Installation update failed; refresh stopped before re-deployment. Run `aiwg installation show` for canonical-install diagnostics.',
-                    };
+                    updateFailure = { exitCode: updateResult.exitCode };
+                    if (!quiet) {
+                        ui.warn('Installation update failed; continuing with re-deployment. Run `aiwg installation show` for canonical-install diagnostics.');
+                    }
                 }
             }
         }
@@ -465,6 +466,7 @@ export const refreshHandler = {
                 channel: channel || undefined,
                 staleAgentRemovals,
                 deploymentFailures,
+                updateFailure,
             });
             console.log(output);
         }

package/dist/src/cli/handlers/runtime-info.js

@@ -53,8 +53,37 @@ async function handleRuntimeInfo(args, cwd = process.cwd()) {
     const hasCheck = checkIndex >= 0;
     const hasCapabilities = args.includes('--capabilities');
     const hasProviders = args.includes('--providers');
+    const hasTransports = args.includes('--transports');
     const featureIndex = args.indexOf('--feature');
     const hasFeature = featureIndex >= 0;
+    if (hasTransports) {
+        const { readAiwgConfig } = await import('../../config/aiwg-config.js');
+        const config = await readAiwgConfig(cwd);
+        const profiles = Object.entries(config?.uhp?.profiles ?? {}).map(([name, profile]) => ({
+            name,
+            transport: 'uhp',
+            protocolVersion: profile.version,
+            experimental: true,
+            configured: true,
+            enabled: config?.uhp?.enabled === true,
+            endpointOrigin: new URL(profile.endpoint).origin,
+            credentialSource: profile.credential.source,
+            credentialReference: profile.credential.name,
+        }));
+        const output = { providersAreTransports: false, transports: { uhp: { experimental: true, enabled: config?.uhp?.enabled === true, profiles } } };
+        if (hasJson)
+            console.log(JSON.stringify(output, null, 2));
+        else {
+            console.log('\nTransport Inventory');
+            console.log('===================');
+            console.log('UHP is a remote execution transport, not an AIWG provider.');
+            if (!profiles.length)
+                console.log('  UHP: not configured (experimental)');
+            for (const profile of profiles)
+                console.log(`  UHP/${profile.name}: ${profile.enabled ? 'enabled' : 'disabled'}, ${profile.protocolVersion}, ${profile.endpointOrigin}`);
+        }
+        return;
+    }
     // --- Capability matrix queries (no RuntimeDiscovery needed) ---
     if (hasProviders) {
         const { collectProviderInventory } = await import('../../providers/provider-inventory.js');

package/dist/src/cli/handlers/steward.js

@@ -182,6 +182,7 @@ async function handleSteward(args, ctx) {
     aiwg steward capabilities --feature <name>    Provider support matrix for a feature
     aiwg steward capabilities --all               Full matrix (all providers x features)
     aiwg steward find --capability <name>         Routing advice for your current provider
+    aiwg steward transports                       Report transport capabilities separately from providers
     aiwg steward models [--complex|--high-impact] Model policy/discovery routing advice
     aiwg steward models --route --capability-type <agent|skill|rule|workflow>
       --capability <id> --assignment <text> [--provider <name>] [--json]
@@ -263,6 +264,17 @@ async function handleSteward(args, ctx) {
             exitCode: EXIT_CODES.USAGE,
         });
     }
+    if (subcommand === 'transports') {
+        const projectDir = ctx ? getProjectDir(ctx, args) : process.cwd();
+        const config = await readAiwgConfig(projectDir);
+        const profiles = Object.keys(config?.uhp?.profiles ?? {});
+        console.log('\n  Remote execution transports');
+        console.log('  ───────────────────────────');
+        console.log(`  UHP ${config?.uhp?.enabled ? 'enabled' : 'disabled'} (experimental client transport; not a provider capability)`);
+        console.log(`  Profiles: ${profiles.length ? profiles.join(', ') : 'none'}`);
+        console.log('  Routing: explicit `aiwg uhp <operation> --profile <name>`; no UHP↔A2A fallback.');
+        return;
+    }
     const matrix = loadCapabilityMatrix();
     if (subcommand === 'capabilities') {
         const providerFlag = args.indexOf('--provider');

package/dist/src/cli/handlers/uhp.js

@@ -0,0 +1,88 @@
+import { readAiwgConfig } from '../../config/aiwg-config.js';
+import { resolveUhpProfile } from '../../uhp/config.js';
+import { UhpClient } from '../../uhp/client.js';
+import { projectUhpResponseToCanonicalMission, projectUhpResponseToMission, unknownUhpMissionEvidence } from '../../uhp/mission.js';
+import { UhpError } from '../../uhp/errors.js';
+function valueAfter(args, name) {
+    const index = args.indexOf(name);
+    return index >= 0 ? args[index + 1] : undefined;
+}
+function usage() {
+    return `Usage: aiwg uhp <discover|harnesses|models|run> --profile <name> [options]
+
+Experimental UHP ${'2026-08-11'} client (client support only; no server conformance claim)
+
+  discover                         Inspect unauthenticated capability discovery
+  harnesses                        List configured remote harnesses
+  models [--harness <id>]          List global or per-harness model availability
+  run --input <text> [--harness <id>] [--model <id>] [--stream]
+                                   Run an explicit smoke task
+
+All commands require --profile. Credentials are resolved from the profile's
+secret reference at request time; bearer values are never accepted as CLI arguments.`;
+}
+async function executeUhp(ctx) {
+    const [operation] = ctx.args;
+    if (!operation || operation === 'help' || operation === '--help')
+        return { exitCode: 0, message: usage(), rawOutput: true };
+    const profileName = valueAfter(ctx.args, '--profile');
+    if (!profileName)
+        return { exitCode: 2, message: 'UHP routing requires explicit --profile <name> selection.' };
+    const config = await readAiwgConfig(ctx.cwd);
+    const profile = resolveUhpProfile(config?.uhp, profileName);
+    const client = new UhpClient(profileName, profile);
+    if (operation === 'discover')
+        return { exitCode: 0, message: JSON.stringify(await client.discover(), null, 2), rawOutput: true };
+    if (operation === 'harnesses')
+        return { exitCode: 0, message: JSON.stringify(await client.listHarnesses(), null, 2), rawOutput: true };
+    if (operation === 'models')
+        return { exitCode: 0, message: JSON.stringify(await client.listModels(valueAfter(ctx.args, '--harness')), null, 2), rawOutput: true };
+    if (operation !== 'run')
+        return { exitCode: 2, message: `Unknown UHP operation '${operation}'.\n${usage()}`, rawOutput: true };
+    const input = valueAfter(ctx.args, '--input');
+    if (!input)
+        return { exitCode: 2, message: 'aiwg uhp run requires --input <text>.' };
+    const request = {
+        input,
+        ...(valueAfter(ctx.args, '--model') ? { model: valueAfter(ctx.args, '--model') } : {}),
+        metadata: { ...(valueAfter(ctx.args, '--harness') ? { harness_id: valueAfter(ctx.args, '--harness') } : {}) },
+    };
+    if (ctx.args.includes('--stream')) {
+        const events = [];
+        let terminal;
+        try {
+            for await (const event of client.streamResponse(request, { signal: ctx.signal })) {
+                events.push(event);
+                if (event.response)
+                    terminal = event.response;
+            }
+            const canonical = terminal ? projectUhpResponseToCanonicalMission(profileName, terminal, request, events.at(-1)) : undefined;
+            return { exitCode: 0, message: JSON.stringify({ events, evidence: terminal ? projectUhpResponseToMission(profileName, terminal, request, events.at(-1)) : unknownUhpMissionEvidence(profileName, 'Stream ended without a response'), ...(canonical ? { mission: canonical.value, adapter: { sourceVersion: canonical.sourceVersion, warnings: canonical.warnings, lossReport: canonical.lossReport } } : {}) }, null, 2), rawOutput: true };
+        }
+        catch (error) {
+            if (error instanceof UhpError && error.options.remoteState === 'unknown') {
+                return { exitCode: 1, message: JSON.stringify({ error: { code: error.code, message: error.message }, evidence: unknownUhpMissionEvidence(profileName, error.message, terminal?.id, events.at(-1)?.sequence_number) }, null, 2), rawOutput: true };
+            }
+            throw error;
+        }
+    }
+    const response = await client.createResponse(request, { signal: ctx.signal });
+    const canonical = projectUhpResponseToCanonicalMission(profileName, response, request);
+    return { exitCode: 0, message: JSON.stringify({ response, evidence: projectUhpResponseToMission(profileName, response, request), mission: canonical.value, adapter: { sourceVersion: canonical.sourceVersion, warnings: canonical.warnings, lossReport: canonical.lossReport } }, null, 2), rawOutput: true };
+}
+export const uhpHandler = {
+    id: 'uhp',
+    name: 'Unified Harness Protocol',
+    description: 'Inspect and smoke-test an explicitly selected experimental UHP endpoint profile',
+    category: 'toolsmith',
+    aliases: [],
+    async execute(ctx) {
+        try {
+            return await executeUhp(ctx);
+        }
+        catch (error) {
+            return { exitCode: error instanceof UhpError || error instanceof Error ? 1 : 1, message: error instanceof Error ? error.message : 'UHP operation failed' };
+        }
+    },
+};
+//# sourceMappingURL=uhp.js.map

package/dist/src/cli/handlers/use.js

@@ -1873,11 +1873,13 @@ async function deploySourceDirectory(opts) {
         args.push('--force');
     if (opts.copyAll)
         args.push('--copy-all');
+    if (opts.kernelOnly)
+        args.push('--kernel-only');
     if (opts.quiet)
         args.unshift('--quiet');
     const runner = createScriptRunner(opts.frameworkRoot);
     const result = await runner.run('tools/agents/deploy-agents.mjs', args, opts.quiet ? { capture: true } : {});
-    if (result.exitCode === 0) {
+    if (result.exitCode === 0 && !opts.kernelOnly) {
         try {
             await registerSourceCliCommands({
                 source: opts.source,
@@ -2436,6 +2438,7 @@ export class UseHandler {
             }
             ui.dim('  Use `aiwg use all` for the full deployment.');
             for (const providerName of providersForFiltered) {
+                const kernelOnly = !copyAll;
                 for (const selected of selectedFrameworks) {
                     const frameworkDir = resolveFrameworkDir(selected);
                     if (!frameworkDir)
@@ -2450,6 +2453,7 @@ export class UseHandler {
                         verbose,
                         force,
                         copyAll,
+                        kernelOnly,
                         quiet,
                         modelArgs: modelDeployArgs,
                     });
@@ -2467,6 +2471,7 @@ export class UseHandler {
                         verbose,
                         force,
                         copyAll,
+                        kernelOnly,
                         quiet,
                         modelArgs: modelDeployArgs,
                     });
@@ -2484,6 +2489,7 @@ export class UseHandler {
                         verbose,
                         force,
                         copyAll,
+                        kernelOnly,
                         quiet,
                         modelArgs: modelDeployArgs,
                     });
@@ -2985,6 +2991,11 @@ export class UseHandler {
         const providerDeployArgs = builtInProviderResolution.requestedProvider
             ? withProviderOverride(deployFilteredArgs, provider)
             : deployFilteredArgs;
+        const bulkKernelOnly = framework === 'all'
+            && !remainingArgs.includes('--copy-all')
+            && !remainingArgs.includes('--copy-standard-skills');
+        if (bulkKernelOnly)
+            providerDeployArgs.push('--kernel-only');
         const targetIdx = remainingArgs.findIndex(a => a === '--target');
         const target = targetIdx >= 0 && remainingArgs[targetIdx + 1] ? remainingArgs[targetIdx + 1] : process.cwd();
         if ((verbose || dryRun) && projectLocalProviderResolution.requestedProvider) {
@@ -3084,11 +3095,15 @@ export class UseHandler {
         }
         // Build common args for addon deployments (inherit provider and target)
         const addonBaseArgs = ['--deploy-commands', '--deploy-skills', '--deploy-rules'];
+        if (bulkKernelOnly)
+            addonBaseArgs.push('--kernel-only');
         addonBaseArgs.push(...modelDeployArgs);
         if (provider)
             addonBaseArgs.push('--provider', provider);
         if (target)
             addonBaseArgs.push('--target', target);
+        if (dryRun)
+            addonBaseArgs.push('--dry-run');
         if (verbose)
             addonBaseArgs.push('--verbose');
         // Forward --copy-all to addon deploys so the legacy mirror behavior
@@ -3182,7 +3197,7 @@ export class UseHandler {
         }
         await ensureProviderGeneratedDirsIgnored(target, provider, { dryRun, verbose });
         const paths = getProviderPaths(provider);
-        if (!dryRun && !skipUtils) {
+        if (!dryRun && !skipUtils && !bulkKernelOnly) {
             const wrapperValidation = await validateDeployedModelWrappers({
                 provider,
                 target,
@@ -3200,7 +3215,7 @@ export class UseHandler {
         const targetKernelSkillsDir = kernelSkillsPath ? resolveProviderPath(target, kernelSkillsPath) : '';
         // Translate deployed skills to commands for providers that require legacy command format.
         // (#550) Skills are canonical; commands are generated deployment artifacts.
-        if (providerNeedsCommands(provider) && targetCommandsDir) {
+        if (!bulkKernelOnly && providerNeedsCommands(provider) && targetCommandsDir) {
             try {
                 const translationResult = await translateSkillsToCommands(targetSkillsDir, {
                     provider,
@@ -3222,7 +3237,7 @@ export class UseHandler {
         // provider loads skills natively: users still expect setup, update,
         // status, intake, and flow workflows to show up in the provider's `/`
         // command picker where supported.
-        if (targetCommandsDir) {
+        if (!bulkKernelOnly && targetCommandsDir) {
             try {
                 const standardMirrored = await mirrorStandardCommandSkills({
                     provider,

package/dist/src/config/aiwg-config.js

@@ -17,6 +17,7 @@ import { validateAuthorization, } from '../policy/authorization.js';
 import { projectAiwgPath, projectControlPath, resolveProjectAiwgDir, } from './project-artifacts.js';
 import { defaultThreatAssessmentConfig, validateThreatAssessmentConfig, } from '../security/threat-assessment-config.js';
 import { defaultArtifactOutputs, validateArtifactOutputs } from '../artifacts/output-policy.js';
+import { validateUhpConfig } from '../uhp/config.js';
 const CONFIG_FILENAME = 'aiwg.config';
 /**
  * Operations that a workspace may authorize for one member repository.
@@ -159,6 +160,9 @@ export function validateIndexConfig(index) {
         return ['index: must be an object'];
     }
     const indexObject = index;
+    if (indexObject.graphBackend !== undefined && !GRAPH_BACKENDS.includes(indexObject.graphBackend)) {
+        errors.push(`index.graphBackend: must be one of ${GRAPH_BACKENDS.join(' | ')}`);
+    }
     const isStringArray = (v) => Array.isArray(v) && v.every((x) => typeof x === 'string');
     const graphOverrides = indexObject.graphOverrides;
     if (graphOverrides !== undefined) {
@@ -772,6 +776,9 @@ export async function readAiwgConfig(projectDir) {
     const artifactOutputErrors = validateArtifactOutputs(parsed.artifact_outputs);
     if (artifactOutputErrors.length > 0)
         throw new Error(`Invalid .aiwg/aiwg.config:\n${artifactOutputErrors.join('\n')}`);
+    const uhpErrors = validateUhpConfig(parsed.uhp);
+    if (uhpErrors.length > 0)
+        throw new Error(`Invalid .aiwg/aiwg.config:\n${uhpErrors.join('\n')}`);
     return parsed;
 }
 /**
@@ -787,6 +794,9 @@ export async function writeAiwgConfig(projectDir, config) {
     const artifactOutputErrors = validateArtifactOutputs(config.artifact_outputs);
     if (artifactOutputErrors.length > 0)
         throw new Error(`Invalid .aiwg/aiwg.config:\n${artifactOutputErrors.join('\n')}`);
+    const uhpErrors = validateUhpConfig(config.uhp);
+    if (uhpErrors.length > 0)
+        throw new Error(`Invalid .aiwg/aiwg.config:\n${uhpErrors.join('\n')}`);
     const localPath = getConfigPath(projectDir);
     const artifactDir = resolveProjectAiwgDir(projectDir);
     const artifactPath = join(artifactDir, CONFIG_FILENAME);

package/dist/src/extensions/commands/definitions.js

@@ -1663,6 +1663,24 @@ export const agentcardCommand = {
         },
     },
 };
+export const uhpCommand = {
+    id: 'uhp',
+    type: 'command',
+    name: 'Unified Harness Protocol',
+    description: 'Inspect discovery and run smoke tasks through an explicit experimental UHP endpoint profile',
+    version: '1.0.0',
+    capabilities: ['cli', 'uhp', 'remote-harness', 'transport'],
+    keywords: ['uhp', 'unified harness protocol', 'remote harness', 'responses'],
+    category: 'toolsmith',
+    platforms: { claude: 'full', generic: 'full' },
+    deployment: { pathTemplate: '.{platform}/commands/{id}.md', core: true },
+    metadata: {
+        type: 'command',
+        template: 'utility',
+        argumentHint: '<discover|harnesses|models|run> --profile <name> [--harness <id>] [--model <id>] [--input <text>] [--stream]',
+        allowedTools: ['Read', 'Bash'],
+    },
+};
 // Utility Commands
 export const prefillCardsCommand = {
     id: 'prefill-cards',
@@ -2371,6 +2389,24 @@ export const mcCommand = {
         },
     },
 };
+export const missionCommand = {
+    id: 'mission',
+    type: 'command',
+    name: 'Mission Protocol',
+    description: 'Preview, apply, verify, resume, and roll back versioned Mission workspace migrations',
+    version: '1.0.0',
+    capabilities: ['cli', 'orchestration', 'mission-protocol', 'migration', 'rollback'],
+    keywords: ['mission', 'migrate', 'migration', 'preview', 'resume', 'rollback'],
+    category: 'orchestration',
+    platforms: { claude: 'full', generic: 'full' },
+    deployment: { pathTemplate: '.{platform}/commands/{id}.md', core: true },
+    metadata: {
+        type: 'command',
+        template: 'orchestration',
+        allowedTools: ['Bash', 'Read', 'Write'],
+        argumentHint: 'migrate [--dry-run|--apply|--verify|--resume|--rollback]',
+    },
+};
 // Steward Commands
 export const stewardCommand = {
     id: 'steward',
@@ -3631,6 +3667,7 @@ export const commandDefinitions = [
     // Toolsmith (1)
     runtimeInfoCommand,
     agentcardCommand,
+    uhpCommand,
     // Utility (5)
     prefillCardsCommand,
     contributeStartCommand,
@@ -3663,6 +3700,7 @@ export const commandDefinitions = [
     ralphConfigCommand,
     // Mission Control (1)
     mcCommand,
+    missionCommand,
     // Steward (1)
     stewardCommand,
     // Agent Teams (1)

package/dist/src/installation/manager-command.mjs

@@ -0,0 +1,31 @@
+import { execFileSync } from 'node:child_process';
+
+function quoteCmdArgument(value) {
+  return `"${String(value).replace(/%/g, '%%').replace(/"/g, '""')}"`;
+}
+
+/**
+ * Resolve a package-manager invocation without asking Node to execute a
+ * Windows command script directly. Node rejects direct .cmd/.bat execution on
+ * current Windows releases; cmd.exe is the native interpreter for those files.
+ */
+export function resolveManagerCommand(file, args, options = {}) {
+  const platform = options.platform ?? process.platform;
+  if (platform !== 'win32' || !/\.(?:cmd|bat)$/i.test(file)) {
+    return { file, args };
+  }
+
+  const env = options.env ?? process.env;
+  const commandInterpreter = env.ComSpec || env.COMSPEC || 'cmd.exe';
+  const command = `"${[file, ...args].map(quoteCmdArgument).join(' ')}"`;
+  return {
+    file: commandInterpreter,
+    args: ['/d', '/s', '/c', command],
+  };
+}
+
+export function executeManagerCommand(file, args, options = {}) {
+  const invocation = resolveManagerCommand(file, args, options);
+  const execute = options.execute ?? execFileSync;
+  return execute(invocation.file, invocation.args, options.execOptions ?? { stdio: 'inherit' });
+}

package/dist/src/installation/manager.mjs

@@ -12,6 +12,7 @@ import {
 } from 'node:fs';
 import path from 'node:path';
 import { resolveUserConfigDir } from '../config/user-config-dir.mjs';
+import { executeManagerCommand } from './manager-command.mjs';
 
 export const INSTALLATION_IDENTITY_VERSION = 1;
 export const INSTALLATION_FILE = 'installation.json';
@@ -188,6 +189,25 @@ export function inspectInstallation(options = {}) {
   if (identity.managerExecutable && !executableIsUsable(identity.managerExecutable)) {
     drift.push(`recorded manager executable is missing or not executable: ${identity.managerExecutable}`);
   }
+  let managerProbe = null;
+  if (
+    options.probeManager === true &&
+    identity.managerExecutable &&
+    executableIsUsable(identity.managerExecutable)
+  ) {
+    try {
+      executeManagerCommand(identity.managerExecutable, ['--version'], {
+        ...options,
+        execute: options.executeManager,
+        execOptions: { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 10_000 },
+      });
+      managerProbe = { state: 'usable' };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      managerProbe = { state: 'failed', error: message };
+      drift.push(`recorded manager executable cannot be invoked: ${message}`);
+    }
+  }
   return {
     state: drift.length === 0 ? 'aligned' : (existsSync(canonicalRoot) ? 'mismatch' : 'stale'),
     identity,
@@ -195,6 +215,7 @@ export function inspectInstallation(options = {}) {
     actualRoot,
     actualMethod,
     drift,
+    managerProbe,
   };
 }