@aiwg/cli 2026.8.8 → 2026.8.10

package/dist/src/cli/handlers/utilities.js

@@ -18,6 +18,7 @@ import { updateInstallation } from '../../update/service.mjs';
 import { useHandler as useFrameworkHandler } from './use.js';
 import { projectAiwgPath } from '../../config/project-artifacts.js';
 import { checkCollisions, } from '../../smiths/skillsmith/collision-detector.js';
+import { renderUseDeploymentResult, verifyConfiguredDeployments, } from '../services/deployment-verification.js';
 /**
  * Maps framework registry IDs (e.g. 'sdlc-complete') to `aiwg use` names (e.g. 'sdlc').
  */
@@ -429,6 +430,24 @@ async function runUserScopeDoctor(verbose) {
         message: lines.join('\n') + '\n',
     };
 }
+const DOCTOR_HELP = `aiwg doctor — check AIWG installation health
+
+Usage:
+  aiwg doctor [options]
+  aiwg -doctor [options]
+  aiwg --doctor [options]
+
+Options:
+  --deployment          Verify configured provider deployments
+  --provider <name>     Limit deployment verification to one provider
+  --bundle <name>       Limit deployment verification to one bundle
+  --scope <scope>       Verification scope: project or user
+  --user                Alias for --scope user
+  --project-local       Include project-local artifact diagnostics
+  --json                Emit machine-readable deployment verification output
+  --verbose, -v         Include verbose diagnostics
+  --help, -h            Show this help
+`;
 /**
  * Handler for doctor command
  *
@@ -448,6 +467,30 @@ export const doctorHandler = {
     category: 'maintenance',
     aliases: ['-doctor', '--doctor'],
     async execute(ctx) {
+        if (ctx.args.includes('--help') || ctx.args.includes('-h')) {
+            return { exitCode: 0, message: DOCTOR_HELP, rawOutput: true };
+        }
+        if (ctx.args.includes('--deployment')) {
+            const providerIndex = ctx.args.indexOf('--provider');
+            const bundleIndex = ctx.args.indexOf('--bundle');
+            const scopeIndex = ctx.args.indexOf('--scope');
+            const scopeValue = scopeIndex >= 0 ? ctx.args[scopeIndex + 1] : undefined;
+            if (scopeValue && scopeValue !== 'project' && scopeValue !== 'user') {
+                return { exitCode: 2, message: `Invalid deployment verification scope: ${scopeValue}` };
+            }
+            const result = await verifyConfiguredDeployments(ctx.cwd || process.cwd(), {
+                provider: providerIndex >= 0 ? ctx.args[providerIndex + 1] : undefined,
+                bundle: bundleIndex >= 0 ? ctx.args[bundleIndex + 1] : undefined,
+                scope: scopeValue,
+            }, ctx.frameworkRoot);
+            return {
+                exitCode: result.exitCode,
+                message: ctx.args.includes('--json')
+                    ? JSON.stringify(result, null, 2)
+                    : renderUseDeploymentResult(result),
+                rawOutput: ctx.args.includes('--json'),
+            };
+        }
         // #1156 Phase 1 — `aiwg doctor --scope user` / `aiwg doctor --user`
         // validates the per-user registry (~/.aiwg/installed.json) without
         // running the project-scope diagnostics. Operators need this to verify
@@ -584,6 +627,111 @@ export const doctorHandler = {
             : result;
     },
 };
+const CONTEXT_FIREWALL_HELP = `aiwg context-firewall — inspect provider context and reviewed memory
+
+Usage:
+  aiwg context-firewall [scan] [options]
+  aiwg context-firewall baseline [--plan]
+  aiwg context-firewall baseline --write --confirm-reviewed [--output <path>]
+
+Actions:
+  scan       Read-only inventory, trust, poisoning, drift, and budget checks (default)
+  baseline   Plan or explicitly write the reviewed digest baseline
+
+Options:
+  --root <path>           Project root (default: current directory)
+  --provider <name>       Limit to a provider; repeatable
+  --baseline <path>       Existing reviewed baseline used by the scan
+  --output <path>         Baseline destination (must remain within the project)
+  --budget-tokens <n>     Portable provider-context budget
+  --warn-ratio <n>        Warning threshold as a fraction of the budget
+  --strict                Exit non-zero for violations or a missing baseline
+  --json                  Emit stable machine-readable output
+  --limit <n>             Bound scan detail in human-readable output
+  --no-content-scan       Skip poisoning classification
+  --plan                  Show every record; do not write (baseline default)
+  --write                 Write after review; requires --confirm-reviewed
+  --confirm-reviewed      Confirm every record in the plan was reviewed
+`;
+function contextFirewallError(message) {
+    return { exitCode: 2, message: `${message}\n\n${CONTEXT_FIREWALL_HELP}` };
+}
+/**
+ * Public operator route for the context/memory firewall.
+ *
+ * The implementation remains a reusable packaged engine, while this handler
+ * owns stable command vocabulary and keeps internal script entrypoints out of
+ * user- and agent-facing remediation guidance.
+ */
+export const contextFirewallHandler = {
+    id: 'context-firewall',
+    name: 'Context Firewall',
+    description: 'Audit provider context and manage its reviewed baseline',
+    category: 'maintenance',
+    aliases: ['-context-firewall', '--context-firewall'],
+    async execute(ctx) {
+        if (ctx.args.includes('--help') || ctx.args.includes('-h')) {
+            return { exitCode: 0, message: CONTEXT_FIREWALL_HELP };
+        }
+        const action = ctx.args[0] && !ctx.args[0].startsWith('-') ? ctx.args[0] : 'scan';
+        if (!['scan', 'baseline'].includes(action)) {
+            return contextFirewallError(`Unknown context-firewall action '${action}'.`);
+        }
+        const input = action === 'scan' ? ctx.args.slice(action === ctx.args[0] ? 1 : 0) : ctx.args.slice(1);
+        const forwarded = ['--package-root', ctx.frameworkRoot];
+        let output;
+        let plan = false;
+        let write = false;
+        let confirmed = false;
+        for (let index = 0; index < input.length; index += 1) {
+            const arg = input[index];
+            if (arg === '--output') {
+                output = input[index + 1];
+                if (!output)
+                    return contextFirewallError('--output requires a path.');
+                index += 1;
+            }
+            else if (arg.startsWith('--output=')) {
+                output = arg.slice('--output='.length);
+                if (!output)
+                    return contextFirewallError('--output requires a path.');
+            }
+            else if (arg === '--plan') {
+                plan = true;
+            }
+            else if (arg === '--write') {
+                write = true;
+            }
+            else if (arg === '--confirm-reviewed') {
+                confirmed = true;
+            }
+            else {
+                forwarded.push(arg);
+            }
+        }
+        if (action === 'scan' && (output || plan || write || confirmed)) {
+            return contextFirewallError('Baseline mutation options require the `baseline` action.');
+        }
+        if (plan && write)
+            return contextFirewallError('Choose either --plan or --write, not both.');
+        if (write && !confirmed) {
+            return contextFirewallError('Baseline writes require --confirm-reviewed after inspecting the plan.');
+        }
+        if (confirmed && !write) {
+            return contextFirewallError('--confirm-reviewed is only valid with --write.');
+        }
+        if (action === 'baseline') {
+            if (write) {
+                forwarded.push(output ? `--write-baseline=${output}` : '--write-baseline', '--confirm-reviewed');
+            }
+            else {
+                forwarded.push(output ? `--plan-baseline=${output}` : '--plan-baseline');
+            }
+        }
+        const runner = createScriptRunner(ctx.frameworkRoot);
+        return runner.run('tools/security/context-memory-firewall.mjs', forwarded, { cwd: ctx.cwd });
+    },
+};
 /**
  * Handler for update command
  *
@@ -713,6 +861,7 @@ export const utilityHandlers = [
     contributeStartHandler,
     validateMetadataHandler,
     doctorHandler,
+    contextFirewallHandler,
     updateHandler,
 ];
 //# sourceMappingURL=utilities.js.map

package/dist/src/cli/handlers/workspace.js

@@ -11,6 +11,7 @@
 import { createScriptRunner } from './script-runner.js';
 import { getFrameworkRoot } from '../../channel/manager.mjs';
 import { maybePrintCommunityFooter } from '../../community/footer.js';
+import { buildDeploymentStatusProbe } from '../services/deployment-verification.js';
 /**
  * Handler for workspace status command
  *
@@ -29,6 +30,15 @@ export const statusHandler = {
     category: 'workspace',
     aliases: ['-status', '--status'],
     async execute(ctx) {
+        if (ctx.args.includes('--probe')) {
+            const projectRoot = ctx.args.find((arg) => !arg.startsWith('-')) ?? ctx.cwd ?? process.cwd();
+            const probe = await buildDeploymentStatusProbe(projectRoot, ctx.frameworkRoot);
+            return {
+                exitCode: probe.status === 'needs-repair' ? 1 : 0,
+                message: JSON.stringify(probe, null, 2),
+                rawOutput: true,
+            };
+        }
         const frameworkRoot = await getFrameworkRoot();
         const runner = createScriptRunner(frameworkRoot);
         const result = await runner.run('tools/cli/workspace-status.mjs', ctx.args, {

package/dist/src/cli/help-generator.js

@@ -89,7 +89,8 @@ export function generateHelp(registry) {
     lines.push('  cursor                Cursor IDE');
     lines.push('  opencode              OpenCode');
     lines.push('  warp                  Warp Terminal');
-    lines.push('  windsurf              Windsurf');
+    lines.push('  devin                 Devin Desktop');
+    lines.push('  windsurf              Deprecated alias for devin');
     lines.push('');
     // Examples
     lines.push('Examples:');

package/dist/src/cli/router.js

@@ -201,7 +201,10 @@ export async function run(args, options = {}) {
         }
         // Output message if present
         if (result.message) {
-            if (result.exitCode !== 0) {
+            if (result.rawOutput) {
+                process.stdout.write(result.message.endsWith('\n') ? result.message : `${result.message}\n`);
+            }
+            else if (result.exitCode !== 0) {
                 ui.error(result.message);
             }
             else {