@aiwg/cli 2026.8.2 → 2026.8.3

package/dist/src/cli/handlers/subcommands.js

@@ -1062,6 +1062,7 @@ export const installPluginHandler = {
         const runner = createScriptRunner(frameworkRoot);
         return runner.run("tools/plugin/plugin-installer-cli.mjs", ctx.args, {
             cwd: ctx.cwd,
+            env: { AIWG_ROOT: frameworkRoot },
         });
     },
 };

package/dist/src/cli/handlers/use.js

@@ -31,7 +31,7 @@ import { PROJECT_LOCAL_TYPE_TO_DIR } from '../../extensions/project-local-paths.
 import { buildUpstreamRegistry } from '../../extensions/upstream-registry.js';
 import { resolveShadows, formatShadowReport, } from '../../extensions/shadow-resolver.js';
 import { appendProjectLocalActivity, emitDiscoverEventsDeduped, } from '../../extensions/project-local-activity.js';
-import { hashBundleArtifacts } from '../../extensions/project-local-remove.js';
+import { hashBundleArtifacts, hashDeployedBundleArtifacts, } from '../../extensions/project-local-remove.js';
 import { installAiwgHooks } from '../../extensions/claude-hooks-installer.js';
 import { detectScope, mirrorToUserScope, rejectOpenClawProjectScope, USER_SCOPE_PATHS, } from '../scope-resolver.js';
 import { maybeWarnProjectIsolation } from '../project-isolation/index.js';
@@ -1185,6 +1185,7 @@ async function deployProjectLocalBundles(opts) {
                 // #1037 — record per-artifact source hashes so `aiwg remove` can
                 // detect pristine vs mutated vs replaced deployed files.
                 const artifactHashes = await hashBundleArtifacts(bundle.artifactPath);
+                const deployedArtifactHashes = await hashDeployedBundleArtifacts(projectDir, provider, artifactHashes);
                 const updated = updateInstalled(config, bundle.id, provider, result.counts, {
                     version: bundle.manifest.version,
                     source: 'project-local',
@@ -1193,6 +1194,7 @@ async function deployProjectLocalBundles(opts) {
                     localType: bundle.type,
                     manifestVersion: bundle.manifest.manifestVersion,
                     artifactHashes,
+                    deployedArtifactHashes,
                 });
                 await writeAiwgConfig(projectDir, updated);
             }

package/dist/src/config/aiwg-config.js

@@ -784,6 +784,10 @@ export function updateInstalled(config, name, provider, counts, opts) {
             existing.manifestVersion = opts.manifestVersion;
         if (opts.artifactHashes)
             existing.artifactHashes = opts.artifactHashes;
+        if (opts.deployedArtifactHashes) {
+            existing.deployedArtifactHashes ??= {};
+            existing.deployedArtifactHashes[provider] = opts.deployedArtifactHashes;
+        }
     }
     else {
         // Clear stale project-local fields if a previously project-local entry is
@@ -792,6 +796,7 @@ export function updateInstalled(config, name, provider, counts, opts) {
         delete existing.localType;
         delete existing.manifestVersion;
         delete existing.artifactHashes;
+        delete existing.deployedArtifactHashes;
     }
     config.installed[name] = existing;
     return config;

package/dist/src/extensions/project-local-doctor.js

@@ -12,8 +12,7 @@
  * @design @.aiwg/architecture/design-doctor-log-promote.md
  * @implements #1037
  */
-import { join, resolve } from 'path';
-import { homedir } from 'os';
+import { join } from 'path';
 import { discoverProjectLocalBundles } from './project-local-discovery.js';
 import { buildUpstreamRegistry } from './upstream-registry.js';
 import { resolveShadows } from './shadow-resolver.js';
@@ -22,6 +21,7 @@ import { sha256OfFileRawAndNormalized } from './managed-marker.js';
 import { projectAiwgPath } from '../config/project-artifacts.js';
 import { projectRelativePathIfInside } from './project-local-paths.js';
 import { auditProjectQuickref } from './project-quickref.js';
+import { artifactHashesForProvider, candidateDeployedPaths } from './project-local-remove.js';
 /**
  * Hash a deployed file in raw and managed-marker-normalized forms. Returns
  * null on read errors (e.g., file missing — caller treats as
@@ -48,23 +48,6 @@ const TYPE_DIR = {
     plugin: 'plugins',
     provider: 'providers',
 };
-// Per PUW-026 (#1127): home-deploying providers get absolute prefixes so
-// `resolve(projectDir, prefix)` correctly produces the home-rooted path
-// (resolve treats absolute paths as authoritative). Previously these were
-// `null`, which silently skipped lifecycle operations against home-deployed
-// project-local bundles.
-const PROVIDER_PREFIX = {
-    claude: '.claude',
-    cursor: '.cursor',
-    factory: '.factory',
-    opencode: '.opencode',
-    windsurf: '.windsurf',
-    warp: '.warp',
-    codex: '.codex',
-    copilot: '.github',
-    openclaw: resolve(homedir(), '.openclaw'),
-    hermes: resolve(homedir(), '.hermes'),
-};
 export async function buildProjectLocalDoctorSection(opts) {
     const { projectDir, frameworkRoot, config, quiet = false } = opts;
     const discovery = await discoverProjectLocalBundles(projectDir);
@@ -165,18 +148,19 @@ export async function buildProjectLocalDoctorSection(opts) {
             const entry = config.installed[bundle.id];
             if (!entry || entry.source !== 'project-local')
                 continue;
-            const hashes = entry.artifactHashes;
-            if (!hashes) {
+            if (!entry.artifactHashes && !entry.deployedArtifactHashes) {
                 unhashedSeen = true;
                 continue;
             }
             for (const provider of Object.keys(entry.deployedTo)) {
-                const prefix = PROVIDER_PREFIX[provider];
-                if (!prefix)
-                    continue;
+                const hashes = artifactHashesForProvider(entry, provider);
                 for (const [sourceRel, expectedHash] of Object.entries(hashes)) {
-                    const deployedAbs = resolve(projectDir, `${prefix}/${sourceRel}`);
-                    const actualHash = await hashDeployed(deployedAbs);
+                    let actualHash = null;
+                    for (const deployedAbs of candidateDeployedPaths(projectDir, provider, sourceRel)) {
+                        actualHash = await hashDeployed(deployedAbs);
+                        if (actualHash)
+                            break;
+                    }
                     if (actualHash === null) {
                         // Missing — not drift, deploy is just absent
                         continue;

package/dist/src/extensions/project-local-remove.js

@@ -93,6 +93,34 @@ export async function hashBundleArtifacts(bundleAbsPath) {
     }
     return out;
 }
+/**
+ * Hash the provider-transformed files produced by a successful deployment.
+ * The source hash map supplies the canonical inventory/key shape; values are
+ * read from the first canonical provider path that exists.
+ */
+export async function hashDeployedBundleArtifacts(projectDir, provider, sourceHashes) {
+    const deployed = {};
+    for (const [sourceRel, sourceHash] of Object.entries(sourceHashes)) {
+        // Keep the complete inventory if a provider path unexpectedly cannot be
+        // resolved. Removal then fails safely instead of clearing the registry
+        // while leaving an untracked provider artifact behind.
+        deployed[sourceRel] = sourceHash;
+        for (const candidate of candidateDeployedPaths(projectDir, provider, sourceRel)) {
+            try {
+                deployed[sourceRel] = await sha256Hex(candidate);
+                break;
+            }
+            catch {
+                // Try translated/provider-alternate paths before leaving it absent.
+            }
+        }
+    }
+    return deployed;
+}
+/** Resolve current provider hashes while preserving old registry entries. */
+export function artifactHashesForProvider(entry, provider) {
+    return entry.deployedArtifactHashes?.[provider] ?? entry.artifactHashes ?? {};
+}
 /** Resolve a recorded source-relative artifact through the canonical provider
  * definition rather than assuming every artifact lives directly under the
  * provider prefix (#1869). Returned paths are absolute for both project- and
@@ -111,6 +139,11 @@ export function candidateDeployedPaths(projectDir, provider, sourceRel) {
     const tail = sourceRel.slice(separator + 1);
     const absoluteRoot = isAbsolute(root) ? root : resolve(projectDir, root);
     const candidates = [join(absoluteRoot, tail)];
+    // Codex discovers project skills from the shared native `.agents/skills`
+    // root while retaining `.codex` as its compatibility deployment surface.
+    if (provider === 'codex' && artifactType === 'skills') {
+        candidates.unshift(join(resolve(projectDir, '.agents', 'skills'), tail));
+    }
     // Provider adapters may translate source extensions.
     if (provider === 'cursor' && artifactType === 'rules' && tail.endsWith('.md')) {
         candidates.push(join(absoluteRoot, `${tail.slice(0, -3)}.mdc`));
@@ -186,12 +219,10 @@ function resolveOwnership(config, selfBundleId, provider, sourceRel) {
             continue;
         if (entry.source !== 'project-local')
             continue;
-        if (!entry.artifactHashes)
-            continue;
-        if (sourceRel in entry.artifactHashes) {
+        const hashes = artifactHashesForProvider(entry, provider);
+        if (sourceRel in hashes) {
             // Same source-rel path claimed by another project-local bundle —
             // the deployed file (if present) is theirs, not ours.
-            void provider;
             return name;
         }
     }
@@ -219,12 +250,12 @@ export async function removeProjectLocalBundle(config, projectDir, bundleId, opt
     const { force = false, provider: onlyProvider, dryRun = false, keepRegistry = false } = opts;
     const confirmMutation = opts.confirmMutation ?? (async () => false);
     const installedEntry = entry;
-    const artifactHashes = installedEntry.artifactHashes ?? {};
     const providers = Object.keys(installedEntry.deployedTo).filter(p => !onlyProvider || p === onlyProvider);
     const outcomes = [];
     const revertedProviders = [];
     const partialProviders = [];
     for (const provider of providers) {
+        const artifactHashes = artifactHashesForProvider(installedEntry, provider);
         let providerHadSkip = false;
         for (const sourceRel of Object.keys(artifactHashes)) {
             const owner = resolveOwnership(config, bundleId, provider, sourceRel);
@@ -334,6 +365,12 @@ export async function removeProjectLocalBundle(config, projectDir, bundleId, opt
         // Mutate registry for fully-reverted providers
         if (!dryRun && !keepRegistry && !providerHadSkip) {
             delete installedEntry.deployedTo[provider];
+            if (installedEntry.deployedArtifactHashes) {
+                delete installedEntry.deployedArtifactHashes[provider];
+                if (Object.keys(installedEntry.deployedArtifactHashes).length === 0) {
+                    delete installedEntry.deployedArtifactHashes;
+                }
+            }
         }
     }
     // Top-level remove activity entry

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiwg/cli",
-  "version": "2026.8.2",
+  "version": "2026.8.3",
   "description": "Lightweight AIWG CLI for signed, versioned web-backed resources.",
   "type": "module",
   "license": "MIT",
@@ -64,7 +64,7 @@
   },
   "dependencies": {
     "@fortemi/core": "2026.7.15",
-    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "chalk": "^4.1.2",
     "chokidar": "^4.0.3",
     "commander": "^12.1.0",