@aiwg/cli 2026.9.24 → 2026.10.1

package/tools/agents/providers/base.mjs

@@ -592,15 +592,34 @@ export function toKebabCase(str) {
 }
 
 /**
- * Strip JSON comments (JSONC) for parsing
- * Used by Factory provider for settings.json
+ * Strip JSON comments (JSONC) for parsing. Used by the Factory and Muse
+ * settings and hooks merges, which write the parsed document back, so the
+ * scanner tracks string literals: `//` in a URL or a slash-star sequence in
+ * a glob matcher is data, not a comment. A regex-only stripper collapsed glob
+ * matchers inside strings and rejected any settings file containing a URL.
  */
 export function stripJsonComments(jsonc) {
-  // Remove single-line comments
-  let result = jsonc.replace(/\/\/.*$/gm, '');
-  // Remove multi-line comments
-  result = result.replace(/\/\*[\s\S]*?\*\//g, '');
-  return result;
+  const text = String(jsonc);
+  let out = '';
+  let i = 0;
+  while (i < text.length) {
+    const ch = text[i];
+    if (ch === '"') {
+      let j = i + 1;
+      while (j < text.length && text[j] !== '"') j += text[j] === '\\' ? 2 : 1;
+      out += text.slice(i, j + 1);
+      i = j + 1;
+    } else if (ch === '/' && text[i + 1] === '/') {
+      while (i < text.length && text[i] !== '\n') i++;
+    } else if (ch === '/' && text[i + 1] === '*') {
+      const end = text.indexOf('*/', i + 2);
+      i = end === -1 ? text.length : end + 2;
+    } else {
+      out += ch;
+      i++;
+    }
+  }
+  return out;
 }
 
 // ============================================================================
@@ -1344,13 +1363,13 @@ export function computeAllArtifactBasenames(srcRoot, type) {
     // Soul companions live alongside agents and are deployed with them —
     // keep their stems in the desired set so the prune never removes them.
     add(frameworkArtifacts.souls || []);
-    add(getAddonAgentFiles(aiwgRoot));
+    add(getAddonAgentFiles(aiwgRoot, [], { includeExplicit: true }));
   } else if (type === 'commands') {
     add(frameworkArtifacts.commands);
-    add(getAddonCommandFiles(aiwgRoot));
+    add(getAddonCommandFiles(aiwgRoot, [], { includeExplicit: true }));
   } else if (type === 'rules') {
     add(frameworkArtifacts.rules);
-    add(getAddonRuleFiles(aiwgRoot));
+    add(getAddonRuleFiles(aiwgRoot, [], { includeExplicit: true }));
   }
 
   return stems;
@@ -2245,9 +2264,10 @@ export function collectFrameworkArtifacts(srcRoot, mode, options = {}) {
 /**
  * Discover all addons in the agentic/code/addons directory
  * @param {string} srcRoot - Source root directory
+ * @param {{includeExplicit?: boolean}} [options] - includeExplicit also returns explicitInstall addons
  * @returns {Array<{name: string, path: string, manifest: object}>} - Array of addon info
  */
-export function discoverAddons(srcRoot) {
+export function discoverAddons(srcRoot, { includeExplicit = false } = {}) {
   const addonsDir = path.join(srcRoot, 'agentic', 'code', 'addons');
   if (!fs.existsSync(addonsDir)) return [];
 
@@ -2271,7 +2291,9 @@ export function discoverAddons(srcRoot) {
     if (manifest.devOnly === true) continue;
     // explicitInstall addons deploy only when named (`aiwg use <addon>`), never
     // as part of a framework or `all` bulk deploy (#2641).
-    if (manifest.explicitInstall === true) continue;
+    // The stale-artifact prune passes includeExplicit so a named install's own
+    // files stay in its desired set and are not deleted right after deployment.
+    if (manifest.explicitInstall === true && !includeExplicit) continue;
 
     addons.push({
       name: entry.name,
@@ -2289,8 +2311,8 @@ export function discoverAddons(srcRoot) {
  * @param {string[]} excludeAddons - Addon names to exclude (default: none)
  * @returns {string[]} - Array of agent file paths
  */
-export function getAddonAgentFiles(srcRoot, excludeAddons = []) {
-  const addons = discoverAddons(srcRoot);
+export function getAddonAgentFiles(srcRoot, excludeAddons = [], options = {}) {
+  const addons = discoverAddons(srcRoot, options);
   const files = [];
 
   for (const addon of addons) {
@@ -2311,8 +2333,8 @@ export function getAddonAgentFiles(srcRoot, excludeAddons = []) {
  * @param {string[]} excludeAddons - Addon names to exclude (default: none)
  * @returns {string[]} - Array of command file paths
  */
-export function getAddonCommandFiles(srcRoot, excludeAddons = []) {
-  const addons = discoverAddons(srcRoot);
+export function getAddonCommandFiles(srcRoot, excludeAddons = [], options = {}) {
+  const addons = discoverAddons(srcRoot, options);
   const files = [];
 
   for (const addon of addons) {
@@ -2632,8 +2654,8 @@ export function writeOnDemandRuleIndex(destDir, onDemandFiles, opts = {}) {
   return names.length + demotedNames.length;
 }
 
-export function getAddonRuleFiles(srcRoot, excludeAddons = []) {
-  const addons = discoverAddons(srcRoot);
+export function getAddonRuleFiles(srcRoot, excludeAddons = [], options = {}) {
+  const addons = discoverAddons(srcRoot, options);
   const files = [];
 
   for (const addon of addons) {

package/tools/agents/providers/factory.mjs

@@ -785,8 +785,16 @@ export function deployFactoryHooks(dryRun) {
       fs.mkdirSync(settingsDir, { recursive: true });
     }
 
-    // Since we've successfully parsed the JSON, safe to write back
-    fs.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n', 'utf8');
+    // Parsed successfully, so the merge is safe to write back. It is written
+    // as canonical JSON, which drops operator comments and formatting, so
+    // keep a timestamped copy of a hand-edited user-global file first.
+    const updatedContent = JSON.stringify(settings, null, 2) + '\n';
+    if (hasExistingFile && originalContent !== JSON.stringify(JSON.parse(stripJsonComments(originalContent)), null, 2) + '\n') {
+      const backupPath = `${settingsPath}.aiwg-backup-${new Date().toISOString().replace(/[:.]/g, '-')}`;
+      fs.copyFileSync(settingsPath, backupPath);
+      console.log(`Backed up ${settingsPath} to ${backupPath} (comments and formatting are not preserved)`);
+    }
+    fs.writeFileSync(settingsPath, updatedContent, 'utf8');
     console.log(`Deployed SessionStart hook to ${settingsPath}`);
     console.log('Hook: aiwg sync --dry-run --quiet (runs on every new Factory session)');
   }

package/tools/agents/providers/muse-hooks.mjs

@@ -53,41 +53,13 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { stripJsonComments } from './base.mjs';
 import { resolveMuseXdgSkillsDir, museXdgSkillsDirRemediation } from './muse-paths.mjs';
 
 // ---------------------------------------------------------------------------
 // Shared JSON helpers
 // ---------------------------------------------------------------------------
 
-/**
- * Strip JSON comments (JSONC) before parsing. Comments are *read* tolerance
- * only: merged files are written back as canonical JSON. The scanner tracks
- * string literals so `//` in a URL or `/*` in a glob matcher is preserved.
- */
-function stripJsonComments(jsonc) {
-  const text = String(jsonc);
-  let out = '';
-  let i = 0;
-  while (i < text.length) {
-    const ch = text[i];
-    if (ch === '"') {
-      let j = i + 1;
-      while (j < text.length && text[j] !== '"') j += text[j] === '\\' ? 2 : 1;
-      out += text.slice(i, j + 1);
-      i = j + 1;
-    } else if (ch === '/' && text[i + 1] === '/') {
-      while (i < text.length && text[i] !== '\n') i++;
-    } else if (ch === '/' && text[i + 1] === '*') {
-      const end = text.indexOf('*/', i + 2);
-      i = end === -1 ? text.length : end + 2;
-    } else {
-      out += ch;
-      i++;
-    }
-  }
-  return out;
-}
-
 /**
  * Parse a JSON/JSONC document, failing closed with a coded error.
  */

package/tools/agents/providers/muse.mjs

@@ -1,5 +1,5 @@
 /**
- * Muse Code provider (experimental).
+ * Muse Code provider (stable).
  *
  * Muse-native skill roots (docs/architecture/adr-muse-provider-target.md):
  *   - Project scope: `<target>/.agents/skills/<id>/SKILL.md`
@@ -221,7 +221,10 @@ function assertSafeAgentsMd(target) {
 }
 
 export async function postDeploy(targetDir, opts = {}) {
-  const fullDeploy = !opts.commandsOnly && !opts.skillsOnly && !opts.rulesOnly;
+  // `aiwg use all` deploys in kernel-only mode, which deploy-agents also
+  // reports as skillsOnly. That is still a whole-provider deploy, so the
+  // bridge, managed hooks, and an opted-in MCP profile must not be skipped.
+  const fullDeploy = !opts.commandsOnly && !opts.rulesOnly && (!opts.skillsOnly || opts.kernelOnly === true);
   if (opts.createAgentsMd || fullDeploy) {
     createAgentsMd(targetDir, opts.srcRoot, opts.dryRun);
   }
@@ -273,7 +276,7 @@ export async function deploy(opts = {}) {
   } = opts;
 
   if (!opts.quiet) {
-    console.log(`\n=== Muse Code Provider (experimental) ===`);
+    console.log(`\n=== Muse Code Provider (stable) ===`);
     console.log(`Target: ${target}`);
     console.log(`Mode: ${mode}`);
     if (opts.dryRun) console.log('Dry-run: no filesystem mutations');