@aiwg/cli 2026.8.26 → 2026.8.28

package/bin/aiwg.mjs

@@ -407,6 +407,12 @@ async function main() {
   // commands remain reachable so an operator can explicitly adopt or switch.
   if (args[0] !== 'installation') {
     const identityPath = path.join(activePackageRoot, 'dist', 'src', 'installation', 'manager.mjs');
+    if (activePackageRoot !== packageRoot && !existsSync(identityPath)) {
+      console.error(`Dev mode: compiled installation manager not found at ${identityPath}`);
+      console.error(`  Run: (cd ${activePackageRoot} && npm run build:cli)`);
+      console.error(`  Or switch back: aiwg --use-stable`);
+      process.exit(1);
+    }
     const { assertCanonicalInstallation } = await import(pathToFileURL(identityPath).href);
     assertCanonicalInstallation({ actualRoot: activePackageRoot });
   }

package/dist/src/a2a/client.js

@@ -102,7 +102,10 @@ export class A2AClient {
     }
     operationPath(v1Path, legacyPath) {
         if (this.selectedInterface) {
-            return this.protocolVersion === '1.0' ? `/${v1Path}` : `/v1/${legacyPath}`;
+            // An advertised interface URL is already the operation base. Appending
+            // the legacy route prefix again turns cards ending in `/v1` into
+            // `/v1/v1/...` and breaks otherwise valid negotiated 0.3 calls.
+            return this.protocolVersion === '1.0' ? `/${v1Path}` : `/${legacyPath}`;
         }
         return `${this.agentPath()}/${legacyPath}`;
     }

package/dist/src/a2a/codecs.js

@@ -24,8 +24,11 @@ export function decodePushNotificationConfig(version, input, path = '$') {
     const result = {
         url: stringAt(version, `${path}.url`, obj.url),
     };
-    const id = version === '1.0' ? obj.id : obj.configId;
-    assignOptionalString(version, result, 'configId', id, `${path}.${version === '1.0' ? 'id' : 'configId'}`);
+    // The deployed 0.3 sandbox predates the stable field rename and returns
+    // `id`; accept that compatibility spelling while continuing to encode the
+    // documented 0.3 `configId` shape.
+    const id = version === '1.0' ? obj.id : (obj.configId ?? obj.id);
+    assignOptionalString(version, result, 'configId', id, `${path}.${version === '1.0' || obj.configId === undefined ? 'id' : 'configId'}`);
     assignOptionalString(version, result, 'token', obj.token, `${path}.token`);
     if (version === '0.3') {
         assignOptionalString(version, result, 'secret', obj.secret, `${path}.secret`);

package/dist/src/a2a/protocol.js

@@ -38,7 +38,7 @@ export function normalizeAgentCard(card) {
         if (!entry || typeof entry !== 'object' || typeof entry.url !== 'string') {
             throw new A2ANegotiationError('agent_card.interface_invalid', `supportedInterfaces[${preference}] must contain an absolute URL`);
         }
-        assertAbsoluteUrl(entry.url, `supportedInterfaces[${preference}].url`);
+        assertAbsoluteInterfaceUrl(entry.url, `supportedInterfaces[${preference}].url`);
         const interfaceVersion = normalizeProtocolVersion(entry.protocolVersion);
         if (entry.protocolVersion !== undefined && !interfaceVersion) {
             throw new A2ANegotiationError('agent_card.interface_version_invalid', `supportedInterfaces[${preference}].protocolVersion is unsupported`);
@@ -133,4 +133,15 @@ function assertAbsoluteUrl(value, field) {
         throw new A2ANegotiationError('agent_card.url_invalid', `${field} must be an absolute HTTP(S) URL`);
     }
 }
+function assertAbsoluteInterfaceUrl(value, field) {
+    try {
+        const url = new URL(value);
+        if (!['http:', 'https:', 'ws:', 'wss:'].includes(url.protocol)) {
+            throw new Error('unsupported interface scheme');
+        }
+    }
+    catch {
+        throw new A2ANegotiationError('agent_card.url_invalid', `${field} must be an absolute HTTP(S) or WS(S) URL`);
+    }
+}
 //# sourceMappingURL=protocol.js.map

package/dist/src/activity-log/cli.js

@@ -18,6 +18,7 @@
 import { ACTIVITY_OPERATIONS, formatEntry, formatUtcTimestamp, isActivityOperation, } from './types.js';
 import { parseLog, parseUtcDate } from './parser.js';
 import { resolveStorage } from '../storage/index.js';
+import { redactText } from '../governance/redaction.js';
 const LOG_PATH = 'activity.log';
 const DEFAULT_LIMIT = 20;
 export async function main(args) {
@@ -74,7 +75,9 @@ async function handleAppend(args) {
             `  Valid operations: ${ACTIVITY_OPERATIONS.join(', ')}`);
     }
     const op = args[0];
-    const summary = args.slice(1).join(' ').trim();
+    const summary = redactText(args.slice(1).join(' ').trim(), {
+        limits: { maxInputBytes: 16 * 1024 },
+    }).text;
     if (!isActivityOperation(op)) {
         throw new Error(`Invalid operation "${op}". Valid operations: ${ACTIVITY_OPERATIONS.join(', ')}`);
     }

package/dist/src/api/index.d.ts

@@ -18,5 +18,6 @@ export * from '../providers/transformation-receipt-integration.js';
 export * from '../marketplace/artifact-attestation.js';
 export * from '../uhp/index.js';
 export * from '../mission-protocol/index.js';
+export * from '../governance/index.js';
 export { ARTIFACT_TRUST_ROOT_MEDIA_TYPE, ARTIFACT_TRUST_ROOT_SCHEMA_VERSION, ARTIFACT_TRUST_STATE_SCHEMA_VERSION, bootstrapTrustRoot, parseTrustRoot, parseTrustState, readTrustState, validateTrustRoot, validateTrustState, verifyRootTransition, writeTrustState, channelStateKey, canonicalJson, dssePae, publicKeyFingerprint, sha256, type ArtifactTrustRoot, type ArtifactTrustState, type RootBootstrapResult, type RootTransitionResult, type ArtifactTrustPolicySettings, type TrustedChannelState, } from '../security/artifact-trust.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/api/index.js

@@ -18,5 +18,6 @@ export * from '../providers/transformation-receipt-integration.js';
 export * from '../marketplace/artifact-attestation.js';
 export * from '../uhp/index.js';
 export * from '../mission-protocol/index.js';
+export * from '../governance/index.js';
 export { ARTIFACT_TRUST_ROOT_MEDIA_TYPE, ARTIFACT_TRUST_ROOT_SCHEMA_VERSION, ARTIFACT_TRUST_STATE_SCHEMA_VERSION, bootstrapTrustRoot, parseTrustRoot, parseTrustState, readTrustState, validateTrustRoot, validateTrustState, verifyRootTransition, writeTrustState, channelStateKey, canonicalJson, dssePae, publicKeyFingerprint, sha256, } from '../security/artifact-trust.js';
 //# sourceMappingURL=index.js.map

package/dist/src/artifacts/backends/graphology-backend.js

@@ -11,6 +11,7 @@
  * @source @src/artifacts/graph-backend.ts
  * @tests @test/unit/artifacts/graphology-backend.test.ts
  */
+import { compareGraphIds, pageGraphIds } from '../graph-backend.js';
 import { normalizeEdges } from '../types.js';
 import { loadFeaturePackage } from '../../features/runtime.js';
 /**
@@ -73,7 +74,15 @@ export class GraphologyBackend {
         return this.graph.getNodeAttributes(id);
     }
     nodes() {
-        return this.graph.nodes();
+        return this.graph.nodes().sort(compareGraphIds);
+    }
+    queryNodes(filters) {
+        return this.graph.nodes()
+            .filter((id) => Object.entries(filters).every(([key, value]) => this.graph.getNodeAttribute(id, key) === value))
+            .sort(compareGraphIds);
+    }
+    pageNodes(limit, after) {
+        return pageGraphIds(this.graph.nodes(), limit, after);
     }
     // --- Traversal ---
     neighbors(nodeId, direction, edgeType) {
@@ -98,7 +107,7 @@ export class GraphologyBackend {
             // Add the "other" node
             results.add(src === nodeId ? tgt : src);
         }
-        return [...results];
+        return [...results].sort(compareGraphIds);
     }
     // --- Set operations ---
     intersection(setA, setB) {

package/dist/src/artifacts/backends/json-backend.js

@@ -9,6 +9,7 @@
  * @source @src/artifacts/graph-backend.ts
  * @tests @test/unit/artifacts/graph-backend.test.ts
  */
+import { compareGraphIds, pageGraphIds } from '../graph-backend.js';
 import { normalizeEdges } from '../types.js';
 /**
  * JSON-backed graph using plain objects and JS Set operations.
@@ -52,7 +53,16 @@ export class JsonGraphBackend {
         return this.graph.get(id)?.attrs;
     }
     nodes() {
-        return [...this.graph.keys()];
+        return [...this.graph.keys()].sort(compareGraphIds);
+    }
+    queryNodes(filters) {
+        return [...this.graph]
+            .filter(([, node]) => Object.entries(filters).every(([key, value]) => node.attrs[key] === value))
+            .map(([id]) => id)
+            .sort(compareGraphIds);
+    }
+    pageNodes(limit, after) {
+        return pageGraphIds([...this.graph.keys()], limit, after);
     }
     // --- Traversal ---
     neighbors(nodeId, direction, edgeType) {
@@ -74,7 +84,7 @@ export class JsonGraphBackend {
                 }
             }
         }
-        return [...results];
+        return [...results].sort(compareGraphIds);
     }
     // --- Set operations ---
     intersection(setA, setB) {

package/dist/src/artifacts/backends/sqlite-backend.js

@@ -13,6 +13,7 @@
  * @source @src/artifacts/graph-backend.ts
  * @tests @test/unit/artifacts/sqlite-backend.test.ts
  */
+import { compareGraphIds, pageGraphIds } from '../graph-backend.js';
 import { normalizeEdges } from '../types.js';
 import { requireFeaturePackage } from '../../features/runtime.js';
 const SCHEMA_VERSION = 1;
@@ -131,23 +132,35 @@ export class SqliteGraphBackend {
         return JSON.parse(row.attrs);
     }
     nodes() {
-        return this.db.prepare('SELECT id FROM nodes').all().map((r) => r.id);
+        return this.db.prepare('SELECT id FROM nodes ORDER BY id COLLATE BINARY').all()
+            .map((r) => r.id);
     }
     queryNodes(filters) {
         const clauses = [];
         const values = [];
         if (filters.type !== undefined) {
-            clauses.push('type = ?');
-            values.push(filters.type);
+            if (filters.type === null)
+                clauses.push('type IS NULL');
+            else {
+                clauses.push('type = ?');
+                values.push(filters.type);
+            }
         }
         if (filters.phase !== undefined) {
-            clauses.push('phase = ?');
-            values.push(filters.phase);
+            if (filters.phase === null)
+                clauses.push('phase IS NULL');
+            else {
+                clauses.push('phase = ?');
+                values.push(filters.phase);
+            }
         }
         const where = clauses.length ? `WHERE ${clauses.join(' AND ')}` : '';
-        return this.db.prepare(`SELECT id FROM nodes ${where} ORDER BY id`).all(...values)
+        return this.db.prepare(`SELECT id FROM nodes ${where} ORDER BY id COLLATE BINARY`).all(...values)
             .map((row) => row.id);
     }
+    pageNodes(limit, after) {
+        return pageGraphIds(this.nodes(), limit, after);
+    }
     // --- Traversal ---
     neighbors(nodeId, direction, edgeType) {
         const results = new Set();
@@ -171,7 +184,7 @@ export class SqliteGraphBackend {
             for (const row of rows)
                 results.add(row.target);
         }
-        return [...results];
+        return [...results].sort(compareGraphIds);
     }
     // --- Set operations (native SQL) ---
     intersection(setA, setB) {

package/dist/src/artifacts/fortemi-core-sync.js

@@ -2,6 +2,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { createHash } from "node:crypto";
 import { fileURLToPath } from "node:url";
+import { parse as parseYaml } from "yaml";
 import { GRAPH_CONFIGS, getProjectIndexRoot, loadGlobalGraphConfigs } from "./types.js";
 import { buildAiwgFortemiIndexExport, } from "./browser-export.js";
 import { loadGraphIndexFile } from "./index-reader.js";
@@ -263,4 +264,40 @@ export function getFortemiCorePrebuiltStatus(graph = "framework") {
         reason: !exportExists ? "prebuilt manifest exists but export file is missing" : reason,
     };
 }
+/**
+ * Compare source script declarations with their compact prebuilt records.
+ * This is deliberately independent of cache freshness: a checksum-valid index
+ * can still be operationally broken when compaction drops runtime metadata.
+ */
+export function getFortemiCoreExecutableSkillStatus(graph = "framework", packageRoot) {
+    const root = packageRoot ?? findPackageRoot(path.dirname(fileURLToPath(import.meta.url)));
+    if (!root)
+        return { sourceExecutableCount: 0, packagedExecutableCount: 0, missing: [] };
+    const exportPath = path.join(root, "prebuilt", "fortemi-core", graph, "aiwg-fortemi-index-v2.json");
+    if (!fs.existsSync(exportPath))
+        return { sourceExecutableCount: 0, packagedExecutableCount: 0, missing: [] };
+    const exported = JSON.parse(fs.readFileSync(exportPath, "utf-8"));
+    let sourceExecutableCount = 0;
+    let packagedExecutableCount = 0;
+    const missing = [];
+    for (const item of exported.items ?? []) {
+        if (item.type !== "aiwg.skill" || typeof item.source?.path !== "string")
+            continue;
+        const sourcePath = path.join(root, item.source.path);
+        if (!fs.existsSync(sourcePath))
+            continue;
+        const match = fs.readFileSync(sourcePath, "utf-8").match(/^---\s*\r?\n([\s\S]*?)\r?\n---/);
+        if (!match)
+            continue;
+        const script = parseYaml(match[1])?.script;
+        if (!script)
+            continue;
+        sourceExecutableCount += 1;
+        if (item.search?.frontmatter?.aiwg_script)
+            packagedExecutableCount += 1;
+        else
+            missing.push(item.name ?? item.id);
+    }
+    return { sourceExecutableCount, packagedExecutableCount, missing };
+}
 //# sourceMappingURL=fortemi-core-sync.js.map

package/dist/src/artifacts/graph-backend.js

@@ -10,6 +10,22 @@
  * @source @src/artifacts/types.ts
  * @tests @test/unit/artifacts/graph-backend.test.ts
  */
+/** SQLite BINARY collation and local backends share this UTF-8 byte order. */
+export function compareGraphIds(left, right) {
+    return Buffer.compare(Buffer.from(left, 'utf8'), Buffer.from(right, 'utf8'));
+}
+export function pageGraphIds(ids, limit, after) {
+    if (!Number.isInteger(limit) || limit < 1 || limit > 10_000) {
+        throw new Error('graph page limit must be an integer from 1 through 10000');
+    }
+    const ordered = [...ids].sort(compareGraphIds);
+    const eligible = after === undefined ? ordered : ordered.filter(id => compareGraphIds(id, after) > 0);
+    const nodes = eligible.slice(0, limit);
+    return {
+        nodes,
+        ...(eligible.length > limit && nodes.length ? { nextCursor: nodes[nodes.length - 1] } : {}),
+    };
+}
 /**
  * Create a graph backend instance.
  *

package/dist/src/audit/operator-decision.js

@@ -10,9 +10,8 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { appendFile, chmod, mkdir, readFile, rename, writeFile } from 'node:fs/promises';
 import { dirname } from 'node:path';
+import { redactStructured } from '../governance/redaction.js';
 export const OPERATOR_DECISION_SCHEMA = 'operator-decision.aiwg.io/v1';
-const secretKey = /token|secret|password|credential|authorization|cookie|csrf|api[_-]?key/i;
-const secretValue = /(?:bearer\s+\S+|\bsk-[a-z0-9_-]+|\bgh[pousr]_[a-z0-9_]+)/i;
 export function digestDecisionContext(context) {
     const safe = redact(context).value;
     return `sha256:${createHash('sha256').update(canonicalJson(safe)).digest('hex')}`;
@@ -167,28 +166,13 @@ function canonicalJson(value) {
     return JSON.stringify(value);
 }
 function redact(value, path = '$') {
-    if (Array.isArray(value)) {
-        const rows = value.map((item, index) => redact(item, `${path}[${index}]`));
-        return { value: rows.map(row => row.value), paths: rows.flatMap(row => row.paths) };
-    }
-    if (value && typeof value === 'object') {
-        const output = {};
-        const paths = [];
-        for (const [key, item] of Object.entries(value)) {
-            if (secretKey.test(key)) {
-                output[key] = '[redacted]';
-                paths.push(`${path}.${key}`);
-            }
-            else {
-                const child = redact(item, `${path}.${key}`);
-                output[key] = child.value;
-                paths.push(...child.paths);
-            }
-        }
-        return { value: output, paths };
-    }
-    if (typeof value === 'string' && secretValue.test(value))
-        return { value: '[redacted]', paths: [path] };
-    return { value, paths: [] };
+    const result = redactStructured(value);
+    return {
+        value: result.value,
+        paths: result.findings.map((finding) => {
+            const suffix = finding.path?.replaceAll('/', '.').replace(/^\./, '') ?? '';
+            return suffix ? `${path}.${suffix}` : path;
+        }),
+    };
 }
 //# sourceMappingURL=operator-decision.js.map

package/dist/src/features/catalog.js

@@ -32,15 +32,16 @@ export const FEATURE_CATALOG = [
     },
     {
         name: 'sqlite',
-        description: 'SQLite storage backend for memory / activity-log / kb subsystems',
+        description: 'SQLite runtime for session catalogs and persistent storage backends',
         packages: ['better-sqlite3'],
         packageSpecs: { 'better-sqlite3': '12.8.0' },
         scriptPackages: ['better-sqlite3'],
         enables: [
+            'aiwg sessions list / discover / import-discovered / timeline / search',
             'storage.config: backend=sqlite for any subsystem',
             'transactional reads/writes against `.aiwg/storage/`',
         ],
-        cost: '~5 MB — native compile via node-gyp',
+        cost: '~5 MB — platform prebuild when available, otherwise a native compile via node-gyp',
     },
     {
         name: 'postgres',