@aiwg/cli 2026.9.0 → 2026.9.2

package/agentic/code/providers/capability-matrix.yaml

@@ -470,6 +470,47 @@ providers:
     deploy_target: mixed
     aggregated_output: true
 
+  pi:
+    display_name: Pi Coding Agent
+    aliases:
+      - pi-coding-agent
+    status: experimental
+    daemon_tier: unsupported
+    daemon_pty_adapter: false
+    artifact_paths:
+      agents: .agents/skills/
+      commands: .pi/prompts/
+      skills: .pi/skills/
+      skills_cross_agent: .agents/skills/
+      rules: AGENTS.md
+      behaviors: .pi/extensions/
+    native_features:
+      cron: false
+      agent_teams: false
+      tasks: false
+      mcp: false
+      behaviors: true
+      mission_control: false
+      daemon: false
+    emulation:
+      cron: external-trigger
+      agent_teams: aiwg-mc
+      tasks: aiwg-mc
+      mcp: null
+      behaviors: null
+      mission_control: aiwg-mc
+      daemon: null
+    hook_wiring:
+      at_link_support: false
+      fallback: full-inject
+      context_file: AGENTS.md
+    interaction:
+      structured_questions: none
+      fallback: markdown
+      notes: Pi does not expose a built-in structured question tool.
+    deploy_target: project
+    aggregated_output: false
+
 # Feature definitions — documents what each feature key means and
 # what emulation strategies are available when native support is absent.
 features:

package/agentic/code/providers/model-capabilities.v1.json

@@ -76,6 +76,17 @@
       "verification": "Inspect active profile and run metadata",
       "sourceUrl": "https://docs.warp.dev/agent-platform/capabilities/agent-profiles-permissions", "verifiedAt": "2026-07-20"
     },
+    "pi": {
+      "agent": "native", "skill": "inherited", "globalChild": "native",
+      "identifierSyntax": "provider/model identifier accepted by Pi --model",
+      "effortValues": ["minimal", "low", "medium", "high", "xhigh"],
+      "inheritance": "Omitted model and thinking level inherit the invoking Pi session",
+      "invalidPinFallback": "Pi resolves against its configured catalog and exits on invalid explicit selection",
+      "configTarget": "Pi headless launch arguments",
+      "artifactFormat": "Runtime --model and --thinking flags",
+      "verification": "Inspect strict JSONL state and the selected provider/model",
+      "sourceUrl": "https://github.com/earendil-works/pi/tree/main/packages/coding-agent#cli-reference", "verifiedAt": "2026-09-04"
+    },
     "windsurf": {
       "agent": "unsupported", "skill": "unsupported", "globalChild": "inherited",
       "identifierSyntax": "UI-selected provider model",

package/agentic/code/providers/model-catalog.v1.json

@@ -52,6 +52,14 @@
       },
       "sourceUrl": "https://opencode.ai/docs/models", "verifiedAt": "2026-07-20"
     },
+    "pi": {
+      "roles": {
+        "reasoning": { "id": "configured/reasoning", "status": "unverified", "observed": false },
+        "coding": { "id": "configured/coding", "status": "unverified", "observed": false },
+        "efficiency": { "id": "configured/efficiency", "status": "unverified", "observed": false }
+      },
+      "sourceUrl": "https://github.com/earendil-works/pi/tree/main/packages/coding-agent#providers--models", "verifiedAt": "2026-09-04"
+    },
     "warp": {
       "roles": {
         "reasoning": { "id": "profile-selected", "status": "unverified", "observed": false },

package/agentic/code/providers/pi/aiwg-bridge.ts

@@ -0,0 +1,26 @@
+/** AIWG's reviewed Pi bridge. Loaded only after Pi project trust is granted. */
+import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';
+
+const destructive = /(?:^|[;&|]\s*)(?:sudo\s+)?(?:rm\s+-\S*r\S*\s+|git\s+(?:reset\s+--hard|clean\s+-)|chmod\s+777|chown\s+-R)/i;
+const packageMutation = /(?:^|[;&|]\s*)(?:npm|pnpm|yarn|bun|pipx?|uv|cargo)\s+(?:install|add|update|upgrade)\b/i;
+
+export async function evaluateAiwgPiCommand(
+  command: string,
+  hasUI: boolean,
+  confirm?: () => Promise<boolean>,
+): Promise<{ block: true; reason: string } | undefined> {
+  if (!destructive.test(command) && !packageMutation.test(command)) return undefined;
+  if (!hasUI) return { block: true, reason: 'AIWG policy blocked a destructive or package-mutating command in headless mode.' };
+  return await confirm?.() ? undefined : { block: true, reason: 'Denied by AIWG operator policy.' };
+}
+
+export default function aiwgBridge(pi: ExtensionAPI): void {
+  pi.on('tool_call', async (event, context) => {
+    if (event.toolName !== 'bash') return undefined;
+    const command = typeof event.input?.command === 'string' ? event.input.command : '';
+    return evaluateAiwgPiCommand(command, context.hasUI, async () => {
+      const choice = await context.ui.select('AIWG policy requires explicit approval for this command.', ['Deny', 'Allow once']);
+      return choice === 'Allow once';
+    });
+  });
+}

package/bin/aiwg.mjs

@@ -128,6 +128,7 @@ const FAST_HELP_TEXT = `
   DISPATCH
     run skill <name>             Execute a script-bearing skill
     run <script-name>            Run a user-defined script from .aiwg/aiwg.config
+    output-mode <action>         Configure composable output language and presentation
 
   FEATURES
     features                     Show optional feature install status
@@ -183,7 +184,7 @@ const FAST_HELP_TEXT = `
     --use-stable                 Switch back to stable npm package
 ────────────────────────────────────────────────────────
 
-  Providers: claude (default), copilot, factory, codex, cursor, opencode, warp, windsurf
+  Providers: 12 — claude (default), codex, copilot, cursor, factory, hermes, opencode, openclaw, openhuman, pi, warp, windsurf (alias: devin)
 
   Examples:
     aiwg use sdlc                   Install SDLC framework
@@ -233,6 +234,12 @@ function maybeWarnUnbuiltDist() {
 }
 maybeWarnUnbuiltDist();
 
+// Propagate the strict no-write contract through helpers that may resolve
+// installation/channel state before the command context exists.
+if (process.argv.slice(2).includes('--dry-run')) {
+  process.env['AIWG_CLI_DRY_RUN'] = '1';
+}
+
 // Display a cached notice and schedule its refresh before every eligible CLI
 // path, including fast help/version, channel recovery, and later preflight
 // failures. This local-only bootstrap never waits on the registry and failures
@@ -299,7 +306,7 @@ trace('bin:entry');
  */
 async function resolveRouterPath() {
   const { loadConfig } = await import('../dist/src/channel/manager.mjs');
-  const config = await loadConfig();
+  const config = await loadConfig({ createIfMissing: !process.argv.slice(2).includes('--dry-run') });
   if (config.devMode && config.edgePath && config.edgePath !== packageRoot) {
     const devRouter = path.join(config.edgePath, 'dist', 'src', 'cli', 'router.js');
     if (!existsSync(devRouter)) {
@@ -414,7 +421,12 @@ async function main() {
       process.exit(1);
     }
     const { assertCanonicalInstallation } = await import(pathToFileURL(identityPath).href);
-    assertCanonicalInstallation({ actualRoot: activePackageRoot });
+    const readOnlyPreview = args.includes('--dry-run');
+    assertCanonicalInstallation({
+      actualRoot: activePackageRoot,
+      createIfMissing: !readOnlyPreview,
+      allowUnrecorded: readOnlyPreview,
+    });
   }
 
   // Wire up the logger level from -v/-vv/--quiet/AIWG_LOG_LEVEL before any

package/dist/src/api/index.d.ts

@@ -19,5 +19,8 @@ export * from '../marketplace/artifact-attestation.js';
 export * from '../uhp/index.js';
 export * from '../mission-protocol/index.js';
 export * from '../governance/index.js';
+export * from '../output-modes/index.js';
+export * from '../schema/index.js';
+export * from '../dataset/index.js';
 export { ARTIFACT_TRUST_ROOT_MEDIA_TYPE, ARTIFACT_TRUST_ROOT_SCHEMA_VERSION, ARTIFACT_TRUST_STATE_SCHEMA_VERSION, bootstrapTrustRoot, parseTrustRoot, parseTrustState, readTrustState, validateTrustRoot, validateTrustState, verifyRootTransition, writeTrustState, channelStateKey, canonicalJson, dssePae, publicKeyFingerprint, sha256, type ArtifactTrustRoot, type ArtifactTrustState, type RootBootstrapResult, type RootTransitionResult, type ArtifactTrustPolicySettings, type TrustedChannelState, } from '../security/artifact-trust.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/api/index.js

@@ -19,5 +19,8 @@ export * from '../marketplace/artifact-attestation.js';
 export * from '../uhp/index.js';
 export * from '../mission-protocol/index.js';
 export * from '../governance/index.js';
+export * from '../output-modes/index.js';
+export * from '../schema/index.js';
+export * from '../dataset/index.js';
 export { ARTIFACT_TRUST_ROOT_MEDIA_TYPE, ARTIFACT_TRUST_ROOT_SCHEMA_VERSION, ARTIFACT_TRUST_STATE_SCHEMA_VERSION, bootstrapTrustRoot, parseTrustRoot, parseTrustState, readTrustState, validateTrustRoot, validateTrustState, verifyRootTransition, writeTrustState, channelStateKey, canonicalJson, dssePae, publicKeyFingerprint, sha256, } from '../security/artifact-trust.js';
 //# sourceMappingURL=index.js.map

package/dist/src/auth/credential-store.js

@@ -17,6 +17,12 @@ export const defaultCommandRunner = (command, args, stdin = "") => new Promise((
     child.stdout.on("data", (chunk) => collect(stdout, chunk));
     child.stderr.on("data", (chunk) => collect(stderr, chunk));
     child.once("error", reject);
+    child.stdin.once("error", (error) => {
+        // A short-lived credential helper may close stdin before Node flushes the
+        // payload. Its process exit remains the authoritative command result.
+        if (error.code !== "EPIPE")
+            reject(error);
+    });
     child.once("close", (code) => resolve({
         stdout: Buffer.concat(stdout).toString("utf8"),
         stderr: Buffer.concat(stderr).toString("utf8"),

package/dist/src/channel/manager.mjs

@@ -213,8 +213,8 @@ export async function getChannel() {
  * Get the framework root path based on current channel
  * @returns {Promise<string>} Path to framework root
  */
-export async function getFrameworkRoot() {
-  const config = await loadConfig();
+export async function getFrameworkRoot(options = {}) {
+  const config = await loadConfig(options);
 
   if (config.channel === 'edge') {
     // Check if edge installation exists

package/dist/src/cli/handlers/dataset.js

@@ -0,0 +1,186 @@
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { createBuiltinAdapterRegistry } from "../../dataset/adapters.js";
+import { FileDatasetOrchestrationRepository } from "../../dataset/file-orchestration-repository.js";
+import { LocalDatasetExecutionBackend } from "../../dataset/local-execution-backend.js";
+import { DatasetOrchestrationService } from "../../dataset/orchestration-service.js";
+import { presentDatasetResult } from "../../dataset/presentation.js";
+export const DATASET_ACTIONS = [
+    "source",
+    "check",
+    "preview",
+    "plan",
+    "ingest",
+    "status",
+    "show",
+    "verify",
+    "query",
+    "lineage",
+    "export",
+    "cancel",
+    "retry",
+];
+function option(args, name) {
+    const i = args.indexOf(name);
+    return i < 0 ? undefined : args[i + 1];
+}
+function positions(args) {
+    const values = new Set([
+        "--file",
+        "--count",
+        "--digest",
+        "--idempotency-key",
+        "--approve",
+        "--reconciliation-digest",
+        "--reconciliation-threshold",
+    ]);
+    const out = [];
+    for (let i = 0; i < args.length; i++) {
+        if (values.has(args[i])) {
+            i++;
+            continue;
+        }
+        if (!args[i].startsWith("-"))
+            out.push(args[i]);
+    }
+    return out;
+}
+function input(ctx) {
+    const file = option(ctx.args, "--file");
+    if (!file)
+        throw new Error("DATASET_INPUT_REQUIRED: --file <json> is required");
+    return JSON.parse(readFileSync(resolve(ctx.cwd, file), "utf8"));
+}
+function service(ctx) {
+    const registry = createBuiltinAdapterRegistry();
+    return new DatasetOrchestrationService(new FileDatasetOrchestrationRepository(ctx.cwd), {
+        adapter: (id, version) => {
+            const adapter = registry.adapters.find((candidate) => {
+                const manifest = candidate.describe();
+                return manifest.id === id && manifest.version === version;
+            });
+            if (!adapter)
+                throw new Error(`ADAPTER_NOT_REGISTERED: ${id}@${version}`);
+            return adapter;
+        },
+        localBackend: new LocalDatasetExecutionBackend(),
+    });
+}
+export async function executeDatasetCommand(ctx, providedService) {
+    const [action, ...ids] = positions(ctx.args);
+    if (!DATASET_ACTIONS.includes(action))
+        return {
+            exitCode: 1,
+            message: `Unknown dataset action '${action ?? ""}'.`,
+        };
+    const s = providedService ?? service(ctx);
+    let result;
+    switch (action) {
+        case "source":
+            result = await s.source(input(ctx));
+            break;
+        case "check":
+            result = await s.check(ids[0], ctx.args.includes("--offline"));
+            break;
+        case "preview":
+            result = await s.preview(ids[0], Number(option(ctx.args, "--count") ?? 10), ctx.args.includes("--offline"), ctx.signal);
+            break;
+        case "plan":
+            result = await s.plan(input(ctx));
+            break;
+        case "ingest":
+            result = await s.ingest({
+                planId: ids[0],
+                planDigest: option(ctx.args, "--digest") ?? "",
+                idempotencyKey: option(ctx.args, "--idempotency-key") ?? "",
+                approvalIds: (option(ctx.args, "--approve") ?? "")
+                    .split(",")
+                    .filter(Boolean),
+                ...(option(ctx.args, "--reconciliation-digest")
+                    ? {
+                        reconciliationApproval: {
+                            previewDigest: option(ctx.args, "--reconciliation-digest"),
+                            threshold: Number(option(ctx.args, "--reconciliation-threshold")),
+                        },
+                    }
+                    : {}),
+                signal: ctx.signal,
+            });
+            break;
+        case "status":
+            result = await s.status(ids[0]);
+            break;
+        case "show":
+            result = await s.show(ids[0]);
+            break;
+        case "verify":
+            result = await s.verify(ids[0]);
+            break;
+        case "query":
+            result = await s.query(ids[0]);
+            break;
+        case "lineage":
+            result = await s.lineage(ids[0]);
+            break;
+        case "export":
+            result = await s.export(ids[0]);
+            break;
+        case "cancel":
+            result = await s.cancel(ids[0]);
+            break;
+        case "retry":
+            result = await s.retry(ids[0], ctx.signal);
+            break;
+    }
+    return {
+        exitCode: result.ok ? 0 : 1,
+        rawOutput: true,
+        message: presentDatasetResult(result, ctx.args.includes("--json")),
+    };
+}
+export const datasetHandler = {
+    id: "dataset",
+    name: "Dataset intelligence",
+    description: "Register, preview, plan, ingest, verify, query, and trace datasets",
+    category: "index",
+    aliases: ["datasets"],
+    async help() {
+        return {
+            exitCode: 0,
+            rawOutput: true,
+            message: [
+                "Usage: aiwg dataset <action> [id] [options]",
+                "",
+                "Actions: source, check, preview, plan, ingest, status, show, verify, query, lineage, export, cancel, retry",
+                "source/plan: --file <json>",
+                "preview: <source-id> [--count N] [--offline]",
+                "ingest: <plan-id> --digest <sha256> --idempotency-key <key> [--approve id,id]",
+                "All actions: --json for the canonical aiwg.dataset-orchestration/v1 envelope.",
+            ].join("\n"),
+        };
+    },
+    async execute(ctx) {
+        try {
+            return await executeDatasetCommand(ctx);
+        }
+        catch (e) {
+            return {
+                exitCode: 1,
+                rawOutput: true,
+                message: JSON.stringify({
+                    schema: "aiwg.dataset-orchestration/v1",
+                    ok: false,
+                    diagnostics: [
+                        {
+                            code: "DATASET_CLI_INVALID",
+                            message: e instanceof Error ? e.message : String(e),
+                            boundary: "input",
+                            retryable: false,
+                        },
+                    ],
+                }, null, 2) + "\n",
+            };
+        }
+    },
+};
+//# sourceMappingURL=dataset.js.map

package/dist/src/cli/handlers/help.js

@@ -90,6 +90,7 @@ function displayHelp() {
     helpGroup('DISPATCH', [
         ['run skill <name>', 'Execute a script-bearing skill'],
         ['run <script-name>', 'Run a user-defined script from .aiwg/aiwg.config'],
+        ['output-mode <action>', 'Configure composable output language and presentation'],
     ]);
     helpGroup('FEATURES', [
         ['features', 'Show optional feature install status'],
@@ -143,7 +144,7 @@ function displayHelp() {
     ]);
     ui.rule();
     ui.blank();
-    console.log(`  ${ui.dimText('Providers:')} claude (default), copilot, factory, codex, cursor, opencode, warp, windsurf`);
+    console.log(`  ${ui.dimText('Providers:')} 12 — claude (default), codex, copilot, cursor, factory, hermes, opencode, openclaw, openhuman, pi, warp, windsurf (alias: devin)`);
     ui.blank();
     console.log(`  ${ui.dimText('Examples:')}`);
     console.log(`    aiwg use sdlc                   ${ui.dimText('Install SDLC framework')}`);

package/dist/src/cli/handlers/index.js

@@ -66,12 +66,14 @@ import { artifactVerifyHandler } from './artifact-verify.js';
 import { outputModeHandler } from './output-mode.js';
 import { installationHandler } from './installation.js';
 import { uhpHandler } from './uhp.js';
+import { schemaHandler } from './schema.js';
+import { datasetHandler } from './dataset.js';
 // Re-export individual handlers
 export { 
 // Maintenance
 helpHandler, versionHandler, authHandler, doctorHandler, contextFirewallHandler, updateHandler, refreshHandler, regenerateHandler, workspaceContextHandler, 
 // Framework management
-useHandler, listHandler, removeHandler, promoteHandler, installHandler, packagesHandler, marketplaceHandler, initHandler, setupHandler, setupGenerateHandler, setupRunHandler, setupValidateHandler, issueHandler, issueAuditHandler, runHandler, jobHandler, costReportHandler, evidenceHandler, artifactVerifyHandler, outputModeHandler, installationHandler, 
+useHandler, listHandler, removeHandler, promoteHandler, installHandler, packagesHandler, marketplaceHandler, initHandler, setupHandler, setupGenerateHandler, setupRunHandler, setupValidateHandler, issueHandler, issueAuditHandler, runHandler, jobHandler, costReportHandler, evidenceHandler, artifactVerifyHandler, outputModeHandler, schemaHandler, datasetHandler, installationHandler, 
 // Project
 newBundleHandler, quickrefHandler, newProjectHandler, sessionHandler, sessionsHandler, 
 // Workspace
@@ -156,6 +158,8 @@ export const allHandlers = [
     evidenceHandler,
     artifactVerifyHandler,
     outputModeHandler,
+    schemaHandler,
+    datasetHandler,
     // Workspace management
     ...workspaceHandlers,
     // Subcommand handlers (MCP, catalog, index, skills)

package/dist/src/cli/handlers/init.js

@@ -30,6 +30,7 @@ const PROVIDER_LABELS = {
     codex: 'OpenAI Codex      ~/.codex/',
     openclaw: 'OpenClaw          ~/.openclaw/',
     hermes: 'Hermes (MCP)      aiwg mcp',
+    pi: 'Pi Coding Agent   .pi/ + .agents/skills/',
 };
 // Local aliases for the shared prompt utilities. These preserve existing
 // call sites (askYesNo/askString) while routing through a single timeout

package/dist/src/cli/handlers/output-mode.js

@@ -53,12 +53,29 @@ async function execute(ctx) {
             return { exitCode: 1, message: `Unknown output mode '${id}'.` };
         modes = action === 'enable' ? [...new Set([...modes, id])] : modes.filter(value => value !== id);
     }
-    await resolveOutputModes(ctx.cwd, ctx.frameworkRoot, scope === 'session' ? modes : []);
+    await resolveOutputModes(ctx.cwd, ctx.frameworkRoot, [], { [scope]: modes });
     const path = await writeOutputModeState(ctx.cwd, scope, modes);
     return { exitCode: 0, message: `${action === 'clear' ? 'Cleared' : `${action}d`} ${scope} output modes (${modes.join(', ') || 'unaltered'}) at ${path}` };
 }
 export const outputModeHandler = {
     id: 'output-mode', name: 'Output Modes', description: 'List, inspect, and select composable output modes', category: 'project', aliases: ['output-modes'],
+    async help() {
+        return {
+            exitCode: 0,
+            rawOutput: true,
+            message: [
+                'Usage:',
+                '  aiwg output-mode list',
+                '  aiwg output-mode show <id>',
+                '  aiwg output-mode enable <id> --scope invocation|session|project',
+                '  aiwg output-mode disable <id> --scope session|project',
+                '  aiwg output-mode clear --scope session|project',
+                '  aiwg output-mode status [--output-mode <id>]...',
+                '',
+                'Use repeated --output-mode flags with aiwg run for a one-command stack.',
+            ].join('\n'),
+        };
+    },
     async execute(ctx) { try {
         return await execute(ctx);
     }

package/dist/src/cli/handlers/run.js

@@ -17,11 +17,16 @@ import { readAiwgConfig, getProjectDir } from '../../config/aiwg-config.js';
 import { handlerResultFromError } from '../errors.js';
 import * as ui from '../ui.js';
 import { resolveOutputModes } from '../../output-modes/registry.js';
-function extractOutputModes(args) {
+export function extractOutputModes(args) {
     const cleaned = [];
     const modes = [];
+    let forwarding = false;
     for (let i = 0; i < args.length; i++) {
-        if (args[i] === '--output-mode') {
+        if (args[i] === '--') {
+            forwarding = true;
+            cleaned.push(args[i]);
+        }
+        else if (!forwarding && args[i] === '--output-mode') {
             const id = args[i + 1];
             if (!id || id.startsWith('-'))
                 throw new Error('--output-mode requires a mode ID');
@@ -67,7 +72,10 @@ export const runHandler = {
         }
         const scriptName = parsed.args[0];
         const projectDir = getProjectDir(ctx, ctx.args);
-        let outputModeEnv = {};
+        let outputModeEnv = {
+            AIWG_OUTPUT_MODES: '',
+            AIWG_OUTPUT_MODES_JSON: '[]',
+        };
         try {
             const resolved = await resolveOutputModes(projectDir, ctx.frameworkRoot, parsed.modes);
             if (resolved.modes.length > 0) {