@aiwg/cli 2026.9.19 → 2026.9.21

package/dist/src/plugin/skill-command-translator.js

@@ -94,6 +94,7 @@ const SKILLS_ONLY_PROVIDERS = new Set([
     'cursor',
     'grokbot',
     'hermes',
+    'muse', // #236: skills deploy natively; no command translation (indexed-only agents/commands/rules)
     'openhuman',
     'pi',
     'omp',

package/dist/src/providers/capability-matrix.yaml

@@ -405,11 +405,18 @@ providers:
     display_name: Grok Build
     status: experimental
     # xAI Grok Build CLI/TUI. Distinct from Grok Bot (`grokbot`).
-    # Wave 1 (#2575): native kernel skills + AGENTS.md. Agents/rules writers deferred #2577.
+    # #2577: fixture-backed native subagents and background tasks; see
+    # test/unit/providers/grok-build-provider.test.ts and
+    # test/unit/providers/grok-build-dispatch.test.ts. MCP is independently
+    # covered by test/unit/providers/grok-build-native-integration.test.ts.
+    # Headless and ACP protocol contracts are tested in grok-build-headless.test.ts
+    # and grok-build-acp.test.ts. ACP does not establish a daemon lifecycle.
+    # No fixture supports native cron, multi-agent teams, mission control,
+    # or AIWG behavior registration; those claims remain false.
     daemon_tier: unsupported
     daemon_pty_adapter: false
     artifact_paths:
-      agents: "Indexed: aiwg discover / aiwg show agent (native .grok/agents writer deferred #2577)"
+      agents: .grok/agents/  # qualified AIWG model workers only
       commands: null
       skills: .grok/skills/
       skills_cross_agent: .grok/.aiwg/skills/  # --copy-all opt-in mirror
@@ -417,16 +424,16 @@ providers:
       behaviors: null
     native_features:
       cron: false
-      agent_teams: false
-      tasks: false
+      agent_teams: false # independent subagents do not imply native team orchestration
+      tasks: true        # native background subagents/tasks
       mcp: true
       behaviors: false
       mission_control: false
       daemon: false
     emulation:
       cron: null
-      agent_teams: null
-      tasks: aiwg-mc
+      agent_teams: aiwg-mc
+      tasks: native
       mcp: null
       behaviors: aiwg-mc
       mission_control: aiwg-mc
@@ -479,6 +486,51 @@ providers:
     deploy_target: mixed
     aggregated_output: true
 
+  muse:
+    display_name: Muse Code
+    status: experimental
+    # Meta's terminal/CI coding agent (Muse Spark-powered). Explicitly not a
+    # model-API surface: Glimmer/Image/Voice are out of scope.
+    # Skill writer (.agents/skills + XDG user root), discover-first AGENTS.md
+    # bridge, managed .muse/hooks.json, and opt-in MCP settings profile.
+    # ADR: docs/architecture/adr-muse-provider-target.md · epic #223.
+    daemon_tier: unsupported
+    daemon_pty_adapter: false
+    artifact_paths:
+      agents: "Indexed: aiwg discover / aiwg show agent (native writer deferred)"
+      commands: null
+      # Project root is fixed; the user root resolves at deploy time from
+      # XDG_CONFIG_HOME (default ~/.config/muse/skills when unset). Never
+      # advertise ~/.muse as a skill root, and never silently mirror into
+      # ~/.agents/skills (#226).
+      skills: .agents/skills/
+      skills_cross_agent: null
+      rules: "Indexed: aiwg show rule + AGENTS.md discover-first bridge"
+      behaviors: null
+    native_features:
+      cron: false
+      agent_teams: false
+      tasks: false
+      mcp: true
+      behaviors: false
+      mission_control: false
+      daemon: false
+    emulation:
+      cron: null
+      agent_teams: null
+      tasks: aiwg-mc
+      mcp: null
+      behaviors: aiwg-mc
+      mission_control: aiwg-mc
+      daemon: null
+    hook_wiring:
+      at_link_support: false
+      hook_file: .muse/hooks.json
+      fallback: full-inject
+      context_file: AGENTS.md
+    deploy_target: mixed
+    aggregated_output: false
+
   openclaw:
     display_name: OpenClaw
     status: stable

package/dist/src/providers/grok-build-acp.js

@@ -0,0 +1,192 @@
+/** Grok Build ACP stdio client. Separate from one-shot headless execution. */
+import { spawn } from 'node:child_process';
+import { redactGrokOutput } from './grok-build-headless.js';
+export class GrokAcpClient {
+    child;
+    env;
+    timeoutMs;
+    maxStderrBytes;
+    cwd;
+    onUpdate;
+    pending = new Map();
+    nextId = 1;
+    stdoutBuffer = '';
+    stderrBuffer = '';
+    closed = false;
+    terminated = false;
+    sessionId;
+    text = '';
+    constructor(options) {
+        this.env = options.env ?? process.env;
+        this.cwd = options.cwd;
+        this.timeoutMs = Math.min(Math.max(options.timeoutMs ?? 30_000, 1), 120_000);
+        this.maxStderrBytes = options.maxStderrBytes ?? 1024 * 1024;
+        this.onUpdate = options.onUpdate;
+        this.child = spawn(options.command ?? 'grok', [...(options.prefixArgs ?? []), '--no-auto-update', ...(options.disableSubagents ? ['--no-subagents'] : []), 'agent', 'stdio'], {
+            cwd: options.cwd, env: this.env, stdio: ['pipe', 'pipe', 'pipe'], shell: false,
+        });
+        this.child.on('error', error => this.failAll(new Error(`Grok ACP launch failed: ${error.message}`)));
+        this.child.on('close', code => {
+            this.failAll(new Error(`Grok ACP closed (exit ${code ?? 'signal'})`));
+            void options.onExit?.();
+        });
+        this.child.stdout.on('data', (chunk) => this.receive(chunk.toString('utf8')));
+        this.child.stderr.on('data', (chunk) => {
+            this.stderrBuffer += chunk.toString('utf8');
+            if (Buffer.byteLength(this.stderrBuffer) > this.maxStderrBytes) {
+                this.failAll(new Error('Grok ACP stderr limit exceeded'));
+                this.close();
+            }
+        });
+    }
+    get stderr() { return redactGrokOutput(this.stderrBuffer, this.env); }
+    failAll(error) {
+        this.closed = true;
+        for (const [id, pending] of this.pending) {
+            clearTimeout(pending.timer);
+            pending.reject(error);
+            this.pending.delete(id);
+        }
+    }
+    receive(chunk) {
+        this.stdoutBuffer += chunk;
+        if (this.stdoutBuffer.length > 8 * 1024 * 1024) {
+            this.failAll(new Error('Grok ACP stdout limit exceeded'));
+            this.close();
+            return;
+        }
+        let end;
+        while ((end = this.stdoutBuffer.indexOf('\n')) >= 0) {
+            const line = this.stdoutBuffer.slice(0, end).trim();
+            this.stdoutBuffer = this.stdoutBuffer.slice(end + 1);
+            if (!line)
+                continue;
+            let message;
+            try {
+                message = JSON.parse(line);
+            }
+            catch {
+                this.failAll(new Error('Invalid Grok ACP JSON-RPC message'));
+                this.close();
+                return;
+            }
+            if (message.method === 'session/update') {
+                const params = message.params;
+                const update = params?.update;
+                if (update) {
+                    const safe = JSON.parse(redactGrokOutput(JSON.stringify(update), this.env));
+                    const content = safe.content;
+                    if (safe.sessionUpdate === 'agent_message_chunk' && typeof content?.text === 'string')
+                        this.text += content.text;
+                    this.onUpdate?.(safe);
+                }
+                continue;
+            }
+            const id = message.id;
+            if (typeof id !== 'number')
+                continue;
+            const pending = this.pending.get(id);
+            if (!pending)
+                continue;
+            this.pending.delete(id);
+            clearTimeout(pending.timer);
+            const error = message.error;
+            if (error)
+                pending.reject(new Error(`Grok ACP request failed: ${redactGrokOutput(String(error.message ?? 'provider error'), this.env)}`));
+            else
+                pending.resolve((message.result && typeof message.result === 'object' ? message.result : {}));
+        }
+    }
+    request(method, params) {
+        if (this.closed)
+            return Promise.reject(new Error('Grok ACP connection is closed'));
+        const id = this.nextId++;
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.pending.delete(id);
+                reject(new Error(`Grok ACP ${method} timed out`));
+                this.close();
+            }, this.timeoutMs);
+            this.pending.set(id, { resolve, reject, timer });
+            this.child.stdin.write(`${JSON.stringify({ jsonrpc: '2.0', id, method, params })}\n`, error => {
+                if (error) {
+                    clearTimeout(timer);
+                    this.pending.delete(id);
+                    reject(new Error(`Grok ACP ${method} write failed`));
+                }
+            });
+        });
+    }
+    async initialize() {
+        const init = await this.request('initialize', {
+            protocolVersion: 1,
+            clientCapabilities: { fs: { readTextFile: true, writeTextFile: true }, terminal: true },
+        });
+        const methods = Array.isArray(init.authMethods)
+            ? init.authMethods.map(item => item.id) : [];
+        const authMethod = this.env.XAI_API_KEY && methods.includes('xai.api_key') ? 'xai.api_key'
+            : methods.includes('cached_token') ? 'cached_token' : null;
+        if (!authMethod) {
+            const reason = methods.includes('grok.com')
+                ? 'grok.com interactive authentication is not qualified for AIWG ACP'
+                : 'no supported non-interactive method was offered';
+            throw new Error(`Grok ACP authentication unavailable: ${reason}`);
+        }
+        await this.request('authenticate', { methodId: authMethod, _meta: { headless: true } });
+        const session = await this.request('session/new', { cwd: this.cwd, mcpServers: [] });
+        if (typeof session.sessionId !== 'string' || !session.sessionId)
+            throw new Error('Grok ACP session/new returned no sessionId');
+        this.sessionId = session.sessionId;
+        return { authMethod, sessionId: session.sessionId };
+    }
+    async prompt(prompt, signal) {
+        if (!this.sessionId)
+            throw new Error('Grok ACP session is not initialized');
+        if (!prompt.trim())
+            throw new Error('Grok ACP prompt is required');
+        const aborted = () => Object.assign(new Error('Grok ACP prompt aborted'), { name: 'AbortError' });
+        // A pre-aborted request never starts a provider turn, so there is nothing
+        // to cancel. Sending session/cancel here could cancel an unrelated turn.
+        if (signal?.aborted)
+            throw aborted();
+        this.text = '';
+        let abortRequested = false;
+        const onAbort = () => { abortRequested = true; this.cancel(); };
+        signal?.addEventListener('abort', onAbort, { once: true });
+        try {
+            const result = await this.request('session/prompt', { sessionId: this.sessionId, prompt: [{ type: 'text', text: prompt }] });
+            // Grok can deliver final session/update chunks immediately after the
+            // completion response; give the pipe a bounded settling window.
+            await new Promise(resolve => setTimeout(resolve, 150));
+            if (abortRequested || signal?.aborted)
+                throw aborted();
+            return { text: this.text.trim(), ...(typeof result.stopReason === 'string' ? { stopReason: result.stopReason } : {}) };
+        }
+        catch (error) {
+            if (abortRequested || signal?.aborted)
+                throw aborted();
+            throw error;
+        }
+        finally {
+            signal?.removeEventListener('abort', onAbort);
+        }
+    }
+    cancel() {
+        if (this.closed || !this.sessionId)
+            return;
+        this.child.stdin.write(`${JSON.stringify({ jsonrpc: '2.0', method: 'session/cancel', params: { sessionId: this.sessionId } })}\n`);
+    }
+    close() {
+        if (this.terminated)
+            return;
+        this.terminated = true;
+        this.failAll(new Error('Grok ACP connection closed'));
+        this.child.stdin.end();
+        if (!this.child.kill('SIGTERM'))
+            return;
+        const forceTimer = setTimeout(() => this.child.kill('SIGKILL'), 2_000);
+        forceTimer.unref();
+        this.child.once('close', () => clearTimeout(forceTimer));
+    }
+}
+//# sourceMappingURL=grok-build-acp.js.map

package/dist/src/providers/grok-build-dispatch.js

@@ -0,0 +1,251 @@
+/** AIWG-controlled Grok Build dispatch: budgets, cap admission and isolation. */
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { lstat, mkdir, mkdtemp, open, readFile, readdir, realpath, unlink, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+import { readAiwgConfig, resolveParallelism } from '../config/aiwg-config.js';
+import { runGrokHeadless } from './grok-build-headless.js';
+import { GrokAcpClient } from './grok-build-acp.js';
+const git = promisify(execFile);
+const dispatchers = new Map();
+async function projectKey(projectRoot) {
+    const root = await realpath(projectRoot);
+    try {
+        return await realpath(await gitOut(root, 'rev-parse', '--path-format=absolute', '--git-common-dir'));
+    }
+    catch (error) {
+        if (/not a git repository/i.test(String(error.stderr ?? '')))
+            return root;
+        throw new Error('Cannot resolve Grok Build project Git identity; dispatch refused', { cause: error });
+    }
+}
+async function slotDirectory(key) {
+    const isGitDir = await lstat(join(key, 'objects')).then(info => info.isDirectory(), () => false)
+        && await lstat(join(key, 'HEAD')).then(info => info.isFile(), () => false);
+    const dir = isGitDir
+        ? join(key, 'aiwg-grok-dispatch-slots')
+        : join(tmpdir(), `aiwg-grok-dispatch-${process.getuid?.() ?? 'user'}-${createHash('sha256').update(key).digest('hex')}`);
+    await mkdir(dir, { recursive: true, mode: 0o700 });
+    const info = await lstat(dir);
+    if (!info.isDirectory() || (process.platform !== 'win32' && ((info.mode & 0o077) !== 0 || info.uid !== process.getuid?.()))) {
+        throw new Error('Grok Build dispatch slot directory is not private to this user');
+    }
+    return dir;
+}
+/** Atomic project slots are shared by independent AIWG processes and Git worktrees. */
+export async function acquireGrokProjectSlot(key, limit) {
+    if (!Number.isInteger(limit) || limit < 1)
+        throw new Error('Invalid Grok Build project parallelism cap');
+    const dir = await slotDirectory(key);
+    const occupied = await readdir(dir);
+    if (occupied.some(name => /^\d+\.json$/.test(name) && Number.parseInt(name, 10) >= limit)) {
+        throw new Error('Grok Build project parallelism cap was lowered while workers are active; wait for them to finish');
+    }
+    slot: for (let index = 0; index < limit; index++) {
+        const file = join(dir, `${index}.json`);
+        const token = randomUUID();
+        let handle;
+        try {
+            handle = await open(file, 'wx', 0o600);
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+            let info;
+            try {
+                info = await lstat(file);
+            }
+            catch (race) {
+                if (race.code === 'ENOENT') {
+                    index--;
+                    continue slot;
+                }
+                throw race;
+            }
+            if (!info.isFile() || (process.platform !== 'win32' && (info.mode & 0o077) !== 0)) {
+                throw new Error(`Unsafe Grok Build dispatch slot ${index}; review ownership before retrying`);
+            }
+            let owner;
+            for (let attempt = 0; attempt < 20; attempt++) {
+                try {
+                    owner = JSON.parse(await readFile(file, 'utf8'));
+                    break;
+                }
+                catch (readError) {
+                    if (readError.code === 'ENOENT') {
+                        index--;
+                        continue slot;
+                    }
+                    if (attempt === 19)
+                        throw new Error(`Incomplete Grok Build dispatch slot ${index}; review ownership before retrying`);
+                    await new Promise(resolveWait => setTimeout(resolveWait, 10));
+                }
+            }
+            if (!owner)
+                throw new Error(`Incomplete Grok Build dispatch slot ${index}; review ownership before retrying`);
+            if (!Number.isInteger(owner.pid) || (owner.pid ?? 0) < 1 || typeof owner.token !== 'string') {
+                throw new Error(`Invalid Grok Build dispatch slot ${index}; review ownership before retrying`);
+            }
+            try {
+                process.kill(owner.pid, 0);
+            }
+            catch (probeError) {
+                if (probeError.code === 'ESRCH') {
+                    throw new Error(`Stale Grok Build dispatch slot ${index}; confirm no worker remains, then remove it explicitly`);
+                }
+                if (probeError.code !== 'EPERM')
+                    throw probeError;
+            }
+            continue;
+        }
+        try {
+            await handle.writeFile(`${JSON.stringify({ pid: process.pid, token, limit })}\n`);
+        }
+        catch (error) {
+            await handle.close();
+            await unlink(file);
+            throw error;
+        }
+        await handle.close();
+        let released = false;
+        return async () => {
+            if (released)
+                return;
+            const owner = JSON.parse(await readFile(file, 'utf8'));
+            if (owner.token !== token)
+                throw new Error('Grok Build dispatch slot ownership changed; refusing to release another worker');
+            await unlink(file);
+            released = true;
+        };
+    }
+    throw new Error(`Grok Build project parallelism cap ${limit} reached`);
+}
+async function gitOut(cwd, ...args) {
+    const result = await git('git', args, { cwd, timeout: 15_000, maxBuffer: 1024 * 1024 });
+    return result.stdout.trim();
+}
+/** Create a detached worktree and save its record in Git's per-worktree metadata. */
+export async function prepareGrokWorktree(source, owner = randomUUID()) {
+    const root = await gitOut(source, 'rev-parse', '--show-toplevel');
+    const dirty = await gitOut(root, 'status', '--porcelain');
+    if (dirty)
+        throw new Error('Grok Build worktree dispatch requires a clean source checkout; commit or preserve current changes before dispatch');
+    const baseCommit = await gitOut(root, 'rev-parse', 'HEAD');
+    const worktree = await mkdtemp(join(tmpdir(), 'aiwg-grok-worktree-'));
+    await gitOut(root, 'worktree', 'add', '--detach', worktree, baseCommit);
+    const gitDir = await gitOut(worktree, 'rev-parse', '--absolute-git-dir');
+    const record = {
+        schema: 'aiwg.grok-build.worktree.v1', owner, source: resolve(root), path: worktree,
+        baseCommit, createdAt: new Date().toISOString(),
+        recovery: `git -C ${JSON.stringify(root)} worktree list --porcelain`,
+    };
+    await writeFile(join(gitDir, 'aiwg-grok-owner.json'), `${JSON.stringify(record, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
+    return record;
+}
+export class GrokBuildDispatcher {
+    active = 0;
+    maxParallel;
+    key;
+    constructor(maxParallel, key) { this.maxParallel = maxParallel; this.key = key; }
+    static async forProject(projectRoot) {
+        const config = await readAiwgConfig(projectRoot);
+        const cap = resolveParallelism(config?.parallelism, 'grok-build').max_parallel_subagents;
+        if (!Number.isInteger(cap) || cap < 1)
+            throw new Error('Invalid Grok Build project parallelism cap');
+        const key = await projectKey(projectRoot);
+        const existing = dispatchers.get(key);
+        if (existing) {
+            existing.maxParallel = cap;
+            return existing;
+        }
+        const dispatcher = new GrokBuildDispatcher(cap, key);
+        dispatchers.set(key, dispatcher);
+        return dispatcher;
+    }
+    get activeDispatches() { return this.active; }
+    async openAcp(options) {
+        if (await projectKey(options.projectRoot) !== this.key)
+            throw new Error('Grok Build dispatcher project root changed');
+        if (this.active >= this.maxParallel)
+            throw new Error(`Grok Build project parallelism cap ${this.maxParallel} reached`);
+        if (!await options.authorize())
+            throw new Error('Grok Build dispatch authorization gate denied');
+        if (!await options.budgetRemaining())
+            throw new Error('Grok Build orchestration budget exhausted');
+        const release = await acquireGrokProjectSlot(this.key, this.maxParallel);
+        this.active += 1;
+        let settle;
+        let fail;
+        const exited = new Promise((resolveExit, rejectExit) => { settle = resolveExit; fail = rejectExit; });
+        // The process can exit before its caller asks to close the session.
+        // Keep the rejection observable through close() without an unhandled one.
+        void exited.catch(() => { });
+        let worktree;
+        let client;
+        let released = false;
+        const releaseAfterExit = async () => {
+            if (released)
+                return;
+            released = true;
+            this.active -= 1;
+            try {
+                await release();
+                settle();
+            }
+            catch (error) {
+                fail(error instanceof Error ? error : new Error(String(error)));
+            }
+        };
+        try {
+            worktree = options.isolate ? await prepareGrokWorktree(options.projectRoot) : undefined;
+            const env = { ...process.env, ...options.env };
+            client = new GrokAcpClient({
+                ...options, cwd: worktree?.path ?? options.projectRoot, env,
+                disableSubagents: true, onExit: releaseAfterExit,
+            });
+            const { authMethod, sessionId } = await client.initialize();
+            return {
+                client, authMethod, sessionId, ...(worktree ? { worktree } : {}),
+                close: async () => { client.close(); await exited; },
+            };
+        }
+        catch (error) {
+            if (client) {
+                client.close();
+                await exited;
+            }
+            else
+                await releaseAfterExit();
+            throw error;
+        }
+    }
+    async dispatch(options) {
+        if (await projectKey(options.projectRoot) !== this.key)
+            throw new Error('Grok Build dispatcher project root changed');
+        if (this.active >= this.maxParallel)
+            throw new Error(`Grok Build project parallelism cap ${this.maxParallel} reached`);
+        if (!await options.authorize())
+            throw new Error('Grok Build dispatch authorization gate denied');
+        if (!await options.budgetRemaining())
+            throw new Error('Grok Build orchestration budget exhausted');
+        const release = await acquireGrokProjectSlot(this.key, this.maxParallel);
+        this.active += 1;
+        try {
+            const worktree = options.isolate ? await prepareGrokWorktree(options.projectRoot) : undefined;
+            // Grok's internal autonomous subagent fan-out has no documented hard
+            // project cap. Disable it in AIWG-controlled headless workers so every
+            // parallel worker consumes one dispatcher slot. Interactive Grok use
+            // remains outside this bounded API and must not be claimed as enforced.
+            const env = { ...process.env, ...options.env, GROK_SUBAGENTS: '0' };
+            const result = await runGrokHeadless({ ...options, cwd: worktree?.path ?? options.projectRoot, env, disableSubagents: true });
+            return { result, ...(worktree ? { worktree } : {}) };
+        }
+        finally {
+            this.active -= 1;
+            await release();
+        }
+    }
+}
+//# sourceMappingURL=grok-build-dispatch.js.map