@aiwg/cli 2026.8.18 → 2026.8.20

package/dist/src/uhp/mission.js

@@ -0,0 +1,111 @@
+import { UHP_VERSION } from './types.js';
+import { decodeMission } from '../mission-protocol/index.js';
+function collectArtifacts(response) {
+    const artifacts = new Map();
+    const visit = (value) => {
+        if (Array.isArray(value)) {
+            value.forEach(visit);
+            return;
+        }
+        if (!value || typeof value !== 'object')
+            return;
+        const object = value;
+        if (typeof object.file_id === 'string')
+            artifacts.set(object.file_id, {
+                fileId: object.file_id,
+                ...(typeof object.container_id === 'string' ? { containerId: object.container_id } : {}),
+                ...(typeof object.filename === 'string' ? { filename: object.filename } : {}),
+                ...(typeof object.media_type === 'string' ? { mediaType: object.media_type } : {}),
+                source: structuredClone(object),
+            });
+        for (const child of Object.values(object))
+            visit(child);
+    };
+    visit(response.output);
+    return [...artifacts.values()];
+}
+function collectInputFiles(request) {
+    const files = [];
+    const visit = (value) => {
+        if (Array.isArray(value)) {
+            value.forEach(visit);
+            return;
+        }
+        if (!value || typeof value !== 'object')
+            return;
+        const object = value;
+        if (object.type === 'input_file')
+            files.push({
+                ...(typeof object.file_id === 'string' ? { fileId: object.file_id } : {}),
+                ...(typeof object.filename === 'string' ? { filename: object.filename } : {}),
+                ...(typeof object.file_data === 'string' && object.file_data.startsWith('data:') ? { mediaType: object.file_data.slice(5).split(/[;,]/, 1)[0] } : {}),
+                source: structuredClone(object),
+            });
+        for (const child of Object.values(object))
+            visit(child);
+    };
+    visit(request.input);
+    return files;
+}
+export function projectUhpResponseToMission(profile, response, request = { input: '' }, event) {
+    const known = ['in_progress', 'completed', 'failed', 'incomplete', 'cancelled'].includes(response.status);
+    const state = response.status === 'in_progress' ? 'running' : known ? response.status : 'unknown';
+    const metadata = response.metadata ?? {};
+    const artifacts = collectArtifacts(response);
+    const knownKeys = new Set(['id', 'object', 'created_at', 'status', 'model', 'previous_response_id', 'output', 'error', 'incomplete_details', 'metadata', 'store', 'usage']);
+    return {
+        transport: 'uhp',
+        protocolVersion: UHP_VERSION,
+        endpointProfile: profile,
+        state,
+        nativeState: response.status,
+        observationState: known ? 'authoritative' : 'unknown',
+        responseId: response.id,
+        previousResponseId: response.previous_response_id ?? request.previous_response_id,
+        sessionId: metadata.session_id,
+        harness: {
+            requested: request.metadata?.harness_id,
+            actual: metadata.harness_id,
+            substitutionReason: typeof metadata.harness_substitution_reason === 'string' ? metadata.harness_substitution_reason : undefined,
+        },
+        model: {
+            requested: request.model,
+            actual: response.model,
+            substitutionReason: metadata.model_substitution_reason ?? (typeof metadata.model_fallback_reason === 'string' ? metadata.model_fallback_reason : undefined),
+        },
+        containerId: metadata.container_id,
+        eventSequence: event?.sequence_number,
+        terminalEvent: event && /^response\.(?:completed|failed|incomplete|cancelled)$/.test(event.type) ? event.type : undefined,
+        artifactIds: artifacts.map(artifact => artifact.fileId),
+        inputFiles: collectInputFiles(request),
+        artifacts,
+        partialOutput: response.status !== 'completed' && Boolean(response.output?.length),
+        extensions: Object.fromEntries(Object.entries(response).filter(([key]) => !knownKeys.has(key))),
+        ...(known ? {} : { diagnostic: `Unknown UHP response state '${String(response.status)}'` }),
+    };
+}
+export function unknownUhpMissionEvidence(profile, diagnostic, responseId, lastSequence) {
+    return {
+        transport: 'uhp', protocolVersion: UHP_VERSION, endpointProfile: profile,
+        state: 'unknown', nativeState: 'unknown', observationState: 'unknown', responseId,
+        harness: {}, model: {}, eventSequence: lastSequence, artifactIds: [], inputFiles: [], artifacts: [], partialOutput: false,
+        extensions: {}, diagnostic,
+    };
+}
+/** Canonical Mission adapter consumed by UHP; the legacy evidence projection remains a compatibility view. */
+export function projectUhpResponseToCanonicalMission(profile, response, request = { input: '' }, event) {
+    const evidence = projectUhpResponseToMission(profile, response, request, event);
+    return decodeMission({
+        ...evidence,
+        objective: typeof request.input === 'string' && request.input.length ? request.input : 'UHP task',
+        status: evidence.nativeState,
+        artifacts: evidence.artifacts.map(artifact => ({
+            id: artifact.fileId,
+            kind: 'uhp-file',
+            ...(artifact.mediaType ? { mediaType: artifact.mediaType } : {}),
+            ...(artifact.source.sha256 ? { sha256: artifact.source.sha256 } : {}),
+            extensions: { 'uhp.file': artifact.source },
+        })),
+    }, 'uhp-2026-08-11');
+}
+//# sourceMappingURL=mission.js.map

package/dist/src/uhp/sse.js

@@ -0,0 +1,76 @@
+import { UhpError, redactUhpText } from './errors.js';
+const TERMINAL_EVENTS = new Set(['response.completed', 'response.failed', 'response.incomplete', 'response.cancelled']);
+export async function* parseUhpEventStream(body, options) {
+    const reader = body.getReader();
+    const decoder = new TextDecoder();
+    let buffer = '';
+    let expectedSequence = 0;
+    let terminalCount = 0;
+    let first = true;
+    const read = async () => {
+        let timer;
+        try {
+            return await Promise.race([
+                reader.read(),
+                new Promise((_, reject) => {
+                    timer = setTimeout(() => reject(new UhpError('stream_inactivity_timeout', 'UHP stream became inactive; remote task state is unknown', { retryable: true, remoteState: 'unknown' })), options.inactivityTimeoutMs);
+                }),
+            ]);
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+    };
+    const decodeBlock = (block) => {
+        const data = block.split(/\r?\n/).filter(line => line.startsWith('data:')).map(line => line.slice(5).trimStart()).join('\n');
+        if (!data)
+            return undefined;
+        let event;
+        try {
+            event = JSON.parse(data);
+        }
+        catch {
+            throw new UhpError('malformed_sse', redactUhpText('Malformed JSON in UHP event stream', options.secrets), { remoteState: 'unknown' });
+        }
+        if (!Number.isSafeInteger(event.sequence_number) || event.sequence_number !== expectedSequence) {
+            throw new UhpError('event_sequence_gap', `Expected UHP event sequence ${expectedSequence}, received ${String(event.sequence_number)}`, { remoteState: 'unknown' });
+        }
+        if (first && event.type !== 'response.created')
+            throw new UhpError('invalid_first_event', `First UHP event must be response.created, received ${event.type}`, { remoteState: 'unknown' });
+        first = false;
+        expectedSequence += 1;
+        if (TERMINAL_EVENTS.has(event.type))
+            terminalCount += 1;
+        if (terminalCount > 1)
+            throw new UhpError('duplicate_terminal_event', 'UHP stream emitted more than one terminal event', { remoteState: 'unknown' });
+        return event;
+    };
+    try {
+        while (true) {
+            options.signal?.throwIfAborted();
+            const { done, value } = await read();
+            buffer += decoder.decode(value, { stream: !done });
+            const blocks = buffer.split(/\r?\n\r?\n/);
+            buffer = blocks.pop() ?? '';
+            for (const block of blocks) {
+                const event = decodeBlock(block);
+                if (event)
+                    yield event;
+            }
+            if (done)
+                break;
+        }
+        if (buffer.trim()) {
+            const event = decodeBlock(buffer);
+            if (event)
+                yield event;
+        }
+        if (terminalCount !== 1)
+            throw new UhpError('missing_terminal_event', 'UHP stream ended without exactly one terminal event; remote task state is unknown', { retryable: true, remoteState: 'unknown' });
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
+//# sourceMappingURL=sse.js.map

package/dist/src/uhp/types.js

@@ -0,0 +1,2 @@
+export const UHP_VERSION = '2026-08-11';
+//# sourceMappingURL=types.js.map

package/dist/src/update/service.mjs

@@ -16,6 +16,7 @@ import {
   loadInstallationIdentity,
   saveInstallationIdentity,
 } from '../installation/manager.mjs';
+import { resolveManagerCommand } from '../installation/manager-command.mjs';
 
 const VALID_MODES = new Set(['npm', 'web', 'source']);
 
@@ -148,8 +149,9 @@ export async function updateInstallation(options = {}) {
     throw new Error('Canonical npm installation has no package-manager executable. Run `aiwg installation adopt --manager <absolute-path-to-npm>`.');
   }
   if (!dryRun) {
+    const invocation = resolveManagerCommand(managerExecutable, command, options);
     const execute = options.execute ?? ((file, args) => execFileSync(file, args, { stdio: 'inherit' }));
-    execute(managerExecutable, command);
+    execute(invocation.file, invocation.args);
     if (detected.identity && detected.identityPersistent && options.persistIdentity !== false) {
       saveInstallationIdentity({ ...detected.identity, channel }, options);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwg/cli",
-  "version": "2026.8.18",
+  "version": "2026.8.20",
   "description": "Lightweight AIWG CLI for signed, versioned web-backed resources.",
   "type": "module",
   "license": "MIT",

package/tools/agents/deploy-agents.mjs

@@ -340,7 +340,7 @@ function mirrorSkillsAsCommands(provider, target, srcRoot, opts) {
  * @param {string|null} explicitSource the raw `--source` value (null when unset)
  */
 function pruneStaleAiwgArtifacts(provider, target, srcRoot, opts, explicitSource) {
-  if (opts.skillsOnly) return; // skills run their own prune in the provider
+  if (opts.skillsOnly && !opts.kernelOnly) return; // skills run their own prune in the provider
 
   const aiwgRoot = resolveAiwgRoot(srcRoot);
   if (!aiwgRoot) return; // no AIWG tree → bundle/standalone deploy; never prune
@@ -355,6 +355,20 @@ function pruneStaleAiwgArtifacts(provider, target, srcRoot, opts, explicitSource
     if (!underCode) return; // project-local bundle / external source → skip
   }
 
+  if (opts.kernelOnly) {
+    for (const type of ['agents', 'commands', 'rules']) {
+      const relPath = provider.paths?.[type];
+      if (!relPath || relPath.endsWith('.md')) continue;
+      const destDir = path.isAbsolute(relPath) ? relPath : path.join(target, relPath);
+      pruneStaleAiwgFiles(destDir, new Set(), {
+        dryRun: opts.dryRun,
+        verbose: opts.verbose,
+        artifactExtensions: ['.md', '.mdc', '.toml'],
+      });
+    }
+    return;
+  }
+
   const typesThisRun = [];
   if (!opts.commandsOnly && !opts.rulesOnly) typesThisRun.push('agents');
   if (opts.deployCommands || opts.commandsOnly) typesThisRun.push('commands');
@@ -406,6 +420,7 @@ function parseArgs() {
     commandsOnly: false,
     skillsOnly: false,
     rulesOnly: false,
+    kernelOnly: false,
     filter: null,           // Glob pattern for agent names
     filterRole: null,       // Filter by role: reasoning|coding|efficiency
     save: false,            // Save model config to project models.json
@@ -438,6 +453,7 @@ function parseArgs() {
     else if (a === '--commands-only') cfg.commandsOnly = true;
     else if (a === '--skills-only') cfg.skillsOnly = true;
     else if (a === '--rules-only') cfg.rulesOnly = true;
+    else if (a === '--kernel-only') cfg.kernelOnly = true;
     else if (a === '--deploy-behaviors') cfg.deployBehaviors = true;
     else if (a === '--filter' && args[i + 1]) cfg.filter = args[++i];
     else if (a === '--filter-role' && args[i + 1]) cfg.filterRole = args[++i];
@@ -474,6 +490,7 @@ Options:
   --commands-only          Deploy only commands (skip agents)
   --skills-only            Deploy only skills (skip agents)
   --rules-only             Deploy only rules (skip agents)
+  --kernel-only            Deploy kernel skills only and prune managed bulk artifacts
   --dry-run                Show what would be deployed without writing
   --force                  Overwrite existing files
   --provider <name>        Target provider (see below)
@@ -490,7 +507,9 @@ Options:
   --create-agents-md           Create/update AGENTS.md template
   --skip-commands-migration    Skip deleting the commands directory before skills deployment
   --copy-all                   Copy ALL skills per-project (legacy mirror at <provider>/.aiwg/skills/).
-                               Default is kernel-only + index-driven discovery for the rest (#1217).
+                               For aiwg use all, this also restores the legacy full agent,
+                               command, and expanded-rule copy. Default bulk deployment is
+                               kernel-only + index-driven discovery for the rest (#1217).
                                Use this for sandboxed runtimes / air-gapped corpora where
                                $AIWG_ROOT isn't readable from the agent's working dir.
                                Alias: --copy-standard-skills — rc.29 era).
@@ -879,13 +898,14 @@ export async function main() {
     modelsConfig,
     asAgentsMd: cfg.asAgentsMd,
     createAgentsMd: cfg.createAgentsMd,
-    deployCommands: cfg.deployCommands,
-    deploySkills: cfg.deploySkills,
-    deployRules: cfg.deployRules,
-    deployBehaviors: cfg.deployBehaviors,
+    deployCommands: cfg.kernelOnly ? false : cfg.deployCommands,
+    deploySkills: cfg.kernelOnly ? true : cfg.deploySkills,
+    deployRules: cfg.kernelOnly ? false : cfg.deployRules,
+    deployBehaviors: cfg.kernelOnly ? false : cfg.deployBehaviors,
     commandsOnly: cfg.commandsOnly,
-    skillsOnly: cfg.skillsOnly,
+    skillsOnly: cfg.skillsOnly || cfg.kernelOnly,
     rulesOnly: cfg.rulesOnly,
+    kernelOnly: cfg.kernelOnly,
     filter: cfg.filter,
     filterRole: cfg.filterRole,
     save: cfg.save,
@@ -893,7 +913,7 @@ export async function main() {
     verbose: cfg.verbose,
     quiet: cfg.quiet,
     asPlugin: cfg.asPlugin,
-    deployBehaviors: cfg.deployBehaviors,
+    deployBehaviors: cfg.kernelOnly ? false : cfg.deployBehaviors,
     skipCommandsMigration: cfg.skipCommandsMigration,
     // #1217 / #1219: --copy-all flag forces legacy per-project mirror
     // for the standard tier. Default is no-copy + index-driven discovery.

package/tools/agents/providers/base.mjs

@@ -1183,7 +1183,7 @@ export function computeAllKernelNames(srcRoot) {
  *   located — see `computeAllKernelNames`), pruning is skipped entirely so a
  *   project-local-bundle deploy without AIWG_ROOT never empties the kernel
  *   skills directory (#123).
- * @param {object} opts `{ dryRun, verbose }`
+ * @param {object} opts `{ dryRun, verbose, artifactExtensions }`
  * @returns {number} count of pruned entries
  */
 export function pruneStaleAiwgSkills(kernelDestDir, desiredKernelNames, opts = {}) {
@@ -1348,7 +1348,8 @@ export function resolveAiwgRoot(srcRoot) {
  * `pruneStaleAiwgSkills`.
  *
  * Removes a file from `destDir` only when ALL hold:
- *   1. It is a deployed artifact file (`.md` / `.mdc`), not `RULES-INDEX.md`
+ *   1. It has an allowed deployed-artifact extension (`.md` / `.mdc` by
+ *      default; callers may include `.toml`), is not `RULES-INDEX.md`,
  *      and not the sidecar manifest.
  *   2. Its stem is NOT in `desiredStems` (the source no longer ships it).
  *   3. It carries an AIWG ownership signal — either a `.aiwg-manifest.json`
@@ -1369,6 +1370,7 @@ export function resolveAiwgRoot(srcRoot) {
  */
 export function pruneStaleAiwgFiles(destDir, desiredStems, opts = {}) {
   const { dryRun = false, verbose = false } = opts;
+  const artifactExtensions = opts.artifactExtensions || ['.md', '.mdc'];
   const removed = [];
   if (!destDir || !fs.existsSync(destDir)) return removed;
 
@@ -1391,7 +1393,7 @@ export function pruneStaleAiwgFiles(destDir, desiredStems, opts = {}) {
     if (name === 'RULES-INDEX.md') continue;
     if (name === 'RULES-ONDEMAND.md') continue; // generated on-demand index (#1673)
     const lower = name.toLowerCase();
-    if (!lower.endsWith('.md') && !lower.endsWith('.mdc')) continue;
+    if (!artifactExtensions.some(extension => lower.endsWith(extension))) continue;
 
     if (desired.has(artifactStem(name))) continue;