@ghl-ai/aw 0.2.0 → 0.2.1

package/aw-usage-wiring.mjs

@@ -33,6 +33,7 @@ export const AW_USAGE_HOOK_SCRIPTS = [
   'aw-usage-stop.js',
   'aw-usage-telemetry-send.js',
   'aw-usage-commit-created.js',
+  'aw-usage-commit-trailer.js',
 ];
 
 // The aw-ecc Cursor adapter checks for these lib files, package.json and

package/c4/detect.mjs

@@ -5,7 +5,8 @@
  *   'cursor-cloud' | 'codex-web' | 'claude-web' | 'unknown'
  *
  * Detection signals (precedence top → bottom):
- *   1. cursor-cloud  ← env.CURSOR_AGENT === 'true' || env.CURSOR_BACKGROUND_AGENT_ID
+ *   1. cursor-cloud  ← env.CURSOR_CONVERSATION_ID starts with 'bc-'
+ *                      || env.CURSOR_AGENT === 'true' || env.CURSOR_BACKGROUND_AGENT_ID
  *   2. codex-web     ← env.CODEX_ENVIRONMENT === '1' || /\.codex(\/|$)/.test(cwd)
  *   3. claude-web    ← env.CLAUDE_CODE_REMOTE === 'true' || fsProbe('/home/user/.claude')
  *   4. unknown       ← fallback
@@ -46,7 +47,8 @@ export function detectHarness({
     return /** @type {HarnessId} */ (override);
   }
 
-  if (env.CURSOR_AGENT === 'true' || env.CURSOR_BACKGROUND_AGENT_ID) {
+  // Cloud VMs set CURSOR_AGENT=1 (as local agents do) and a bc-<uuid> conversation id.
+  if (env.CURSOR_CONVERSATION_ID?.startsWith('bc-') || env.CURSOR_AGENT === 'true' || env.CURSOR_BACKGROUND_AGENT_ID) {
     return 'cursor-cloud';
   }
 

package/commands/c4.mjs

@@ -259,7 +259,7 @@ export async function c4Command(rawArgs, overrides = {}) {
 
   // Step 1 — harness detection (override wins).
   const cliHarness = args['--harness'];
-  const harness = SUPPORTED_HARNESSES.includes(cliHarness) ? cliHarness : c4.detectHarness({ env }).harness;
+  const harness = SUPPORTED_HARNESSES.includes(cliHarness) ? cliHarness : c4.detectHarness({ env });
   const home = env.HOME ?? '~';
   const awHome = join(home, '.aw');
   const awRegistry = join(awHome, '.aw_registry');

package/ecc.mjs

@@ -19,10 +19,10 @@ const REQUIRED_ECC_FILES = [
   "scripts/sync-ecc-to-codex.sh",
 ];
 
-const MARKETPLACE_NAME = "aw-marketplace";
+export const MARKETPLACE_NAME = "aw-marketplace";
 const PLUGIN_KEY = `aw@${MARKETPLACE_NAME}`;
 
-function eccDir() { return join(homedir(), ".aw-ecc"); }
+export function eccDir() { return join(homedir(), ".aw-ecc"); }
 
 // "claude" uses a no-commands module set so hooks, rules, shared references,
 // and install-state land in ~/.claude/ — while slash commands stay owned by

package/hooks/aw-usage/hooks/aw-usage-commit-trailer.js

@@ -0,0 +1,124 @@
+#!/usr/bin/env node
+/**
+ * Commit attribution trailers — called from the prepare-commit-msg git hook.
+ *
+ * Adds to the commit message file:
+ *   Agent-Harness: <harness>; session=<id>   when git runs inside an agent session
+ *                                            (harness only when the id is unsafe)
+ *   AW-Skills: <a>, <b>, stage:<s>,          when that session ran an AW skill or
+ *   <co-author line> and AW-Version: <v>     stage at any point (aw_skills)
+ *
+ * The laptop records which AW skills ran; the server decides which are SDLC.
+ *
+ * The session comes from the variable each agent sets in its shell
+ * (CLAUDE_CODE_SESSION_ID, CURSOR_CONVERSATION_ID, CODEX_THREAD_ID). It is the
+ * same id the AW hooks send as session_id, so the server can join on it. A
+ * hand-typed commit has none of them and gets no trailer. Trailers the agent
+ * wrote itself are left alone. On --amend in the same session our own lines
+ * are replaced, not repeated; a message that already carries another session's
+ * Agent-Harness (rebase, cherry-pick, amend) is left unchanged. Any error
+ * leaves the message unchanged.
+ *
+ * Usage: node aw-usage-commit-trailer.js <commit-msg-file> <co-author-line>
+ */
+
+'use strict';
+
+const fs = require('fs');
+const { readSessionAwSkills, getAwCliVersionDetails } = require('../lib/aw-usage-telemetry');
+
+const SESSION_ENV = [
+  ['CLAUDE_CODE_SESSION_ID', 'claude'],
+  ['CURSOR_CONVERSATION_ID', 'cursor'],
+  ['CODEX_THREAD_ID', 'codex'],
+];
+// Also keeps the id from adding lines to the message or leaving the sessions folder.
+const SAFE_SESSION_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+// Lines this script owns: replaced on --amend so the latest values win.
+const OWN_TRAILER = /^(?:Agent-Harness|AW-Skills|AW-Version): /;
+
+function commitSession(env) {
+  for (const [name, harness] of SESSION_ENV) {
+    const id = env[name];
+    if (!id) continue;
+    // An unsafe id still tells us the harness; it is never written or used as a path.
+    if (!SAFE_SESSION_ID.test(id)) return { harness, sessionId: null };
+    // Cursor cloud agents get a bc-<uuid> conversation id; local agents a plain UUID.
+    return { harness: harness === 'cursor' && id.startsWith('bc-') ? 'cursor-cloud' : harness, sessionId: id };
+  }
+  return null;
+}
+
+function buildTrailers({ env, coAuthor }) {
+  const session = commitSession(env);
+  if (!session) return [];
+  if (!session.sessionId) return [`Agent-Harness: ${session.harness}`];
+  const trailers = [`Agent-Harness: ${session.harness}; session=${session.sessionId}`];
+  const skills = readSessionAwSkills(session.sessionId);
+  if (coAuthor && skills.length > 0) {
+    trailers.push(`AW-Skills: ${skills.join(', ')}`, coAuthor);
+    const version = getAwCliVersionDetails().version;
+    if (version) trailers.push(`AW-Version: ${version}`);
+  }
+  return trailers;
+}
+
+// git commit -v: git drops this line and everything below it (the diff).
+const SCISSORS = /^# -+ >8 -+$/;
+const TRAILER_LINE = /^[A-Za-z][A-Za-z0-9-]*: /;
+// Editor commits end with git's `#` help text, which git strips after the editor.
+// shortcut: assumes the default core.commentChar '#'; read it from git config if teams change it.
+const isComment = (line) => line.startsWith('#');
+
+function appendTrailers(message, trailers) {
+  const eol = message.includes('\r\n') ? '\r\n' : '\n';
+  const lines = message.split(/\r?\n/);
+  // A commit another session wrote (rebase, cherry-pick, amend) keeps its own
+  // attribution: replacing it would erase that session's evidence.
+  const harnessLines = lines.filter((line) => line.startsWith('Agent-Harness: '));
+  if (harnessLines.length > 0 && !harnessLines.includes(trailers[0])) return message;
+
+  // The message git keeps ends at the last line that is not blank, a comment or below the cut.
+  const cut = lines.findIndex((line) => SCISSORS.test(line));
+  const head = cut === -1 ? lines : lines.slice(0, cut);
+  let end = head.length;
+  while (end > 0 && (!head[end - 1].trim() || isComment(head[end - 1]))) end -= 1;
+  // Drop our own stale lines (from an earlier commit of this message) first.
+  const kept = head.slice(0, end).filter((line) => !OWN_TRAILER.test(line) || trailers.includes(line));
+  // No real content: leave it, so git still aborts an empty commit message.
+  if (!kept.some((line) => line.trim() && !isComment(line))) return message;
+  const missing = trailers.filter((trailer) => !kept.includes(trailer));
+  if (missing.length === 0) return message;
+
+  // Join the existing trailer block when the message already ends with one.
+  const body = kept.join('\n').replace(/\s+$/, '');
+  const lastParagraph = body.split(/\n\s*\n/).pop();
+  const endsWithTrailers = body.includes('\n') && lastParagraph.split('\n').every((line) => TRAILER_LINE.test(line));
+  const rest = [...head.slice(end), ...(cut === -1 ? [] : lines.slice(cut))].join('\n');
+  const updated = `${body}${endsWithTrailers ? '\n' : '\n\n'}${missing.join('\n')}\n${rest}`;
+  return eol === '\n' ? updated : updated.replace(/\n/g, eol);
+}
+
+function main() {
+  const [file, coAuthor] = process.argv.slice(2);
+  if (!file) return;
+  try {
+    const trailers = buildTrailers({ env: process.env, coAuthor });
+    if (trailers.length === 0) return;
+    const message = fs.readFileSync(file, 'utf8');
+    const updated = appendTrailers(message, trailers);
+    if (updated !== message) fs.writeFileSync(file, updated);
+  } catch {
+    // Never block or change a commit because attribution failed.
+  }
+}
+
+if (require.main === module) {
+  main();
+}
+
+module.exports = {
+  appendTrailers,
+  buildTrailers,
+  commitSession,
+};

package/hooks/aw-usage/lib/aw-usage-commands.js

@@ -116,6 +116,7 @@ function isSdlcStageCommand(command) {
 
 module.exports = {
   AW_SDLC_STAGES,
+  BARE_SLASH_COMMANDS,
   extractTypedCommands,
   commandKey,
   isSdlcStageCommand,

package/hooks/aw-usage/lib/aw-usage-skill-source.js

@@ -8,8 +8,13 @@
  *                                           this hook does not know
  *
  * skill_origin rule (P11):
- * - Skill tool: `aw` for `aw:<x>`, `other` for any other namespace, omitted for a bare name.
- * - File or shell read: `aw` when the SKILL.md is under ~/.aw-ecc/, ~/.aw/,
+ * - Skill tool: `aw` for `aw:<x>`. Otherwise the skill's folder in ~/.claude/skills
+ *   (`ns:name` -> `ns-name`, else the folder whose SKILL.md declares that name),
+ *   when present, decides by the file rule below; else
+ *   `other` for any other namespace, omitted for a bare name.
+ * - File or shell read: `aw` when the SKILL.md, or the file a link to it points
+ *   to (aw links registry skills into ~/.codex/skills and ~/.cursor/skills), is
+ *   under ~/.aw-ecc/, ~/.aw/,
  *   ~/.claude/plugins/cache/aw-marketplace/, or is a destinationPath in
  *   ~/.cursor/ecc-install-state.json or ~/.codex/ecc-install-state.json
  *   (those folders mix AW and other skills; the install state lists what AW
@@ -66,10 +71,36 @@ function listedSkillPaths(home) {
   return listedCache.get(home);
 }
 
+// Read-only: resolves links, never creates, moves or deletes anything. The OS
+// resolver (.native) applies `..` after following links; the JS one collapses
+// `..` first, so `~/.aw/link/../x` would wrongly stay under ~/.aw.
+function realPath(filePath) {
+  try {
+    return fs.realpathSync.native(filePath);
+  } catch {
+    // Broken link, loop, unreadable folder or missing file.
+    return null;
+  }
+}
+
+function isUnderAwRoot(filePath, homes) {
+  const file = toForwardSlashes(filePath);
+  return homes.some(home => AW_ROOTS.some(segments => file.startsWith(`${toForwardSlashes(path.join(home, ...segments))}/`)));
+}
+
+// The real file decides: aw links registry skills into ~/.codex/skills,
+// ~/.cursor/skills and ~/.claude/skills, pointing into ~/.aw. A path that cannot
+// be resolved (missing, broken link) is judged as given.
+// Known limit: an AW folder that is itself a link (e.g. ~/.aw-ecc -> a dev
+// checkout) is not followed, so its skills count as other. `aw init` clones into
+// the real folders.
 function originFromPath(filePath, home) {
-  const absolute = toForwardSlashes(path.normalize(expandHome(filePath, home)));
-  const underAwRoot = AW_ROOTS.some(segments => absolute.startsWith(`${toForwardSlashes(path.join(home, ...segments))}/`));
-  return underAwRoot || listedSkillPaths(home).has(absolute) ? 'aw' : 'other';
+  const given = expandHome(filePath, home);
+  const absolute = path.normalize(given);
+  if (listedSkillPaths(home).has(toForwardSlashes(absolute))) return 'aw';
+  const real = realPath(given);
+  if (!real) return isUnderAwRoot(absolute, [home]) ? 'aw' : 'other';
+  return isUnderAwRoot(real, [home, realPath(home) || home]) ? 'aw' : 'other';
 }
 
 function originFromName(name) {
@@ -78,10 +109,69 @@ function originFromName(name) {
   return name.slice(0, colon).toLowerCase() === 'aw' ? 'aw' : 'other';
 }
 
+// A Skill-tool name as one folder name: `platform-core:echo-direct` -> `platform-core-echo-direct`.
+const SKILL_NAME = /^[A-Za-z0-9._-]+(?::[A-Za-z0-9._-]+)?$/;
+
+// Claude's Skill tool gives only a name. Its folder in ~/.claude/skills (often a
+// link aw made into ~/.aw/.aw_registry) is where the skill came from.
+const SKILL_HEAD_BYTES = 2048;
+const namedCache = new Map();
+
+function frontmatterName(file) {
+  let fd;
+  try {
+    fd = fs.openSync(file, 'r');
+    const buf = Buffer.alloc(SKILL_HEAD_BYTES);
+    const head = buf.toString('utf8', 0, fs.readSync(fd, buf, 0, SKILL_HEAD_BYTES, 0)).replace(/^\uFEFF/, '');
+    // Only the front matter (between the opening and closing ---) names the skill.
+    const frontMatter = head.match(/^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/);
+    const match = frontMatter && frontMatter[1].match(/^name:[ \t]*["']?([^"'\r\n]+?)["']?[ \t]*$/m);
+    return match ? match[1] : null;
+  } catch {
+    // Unreadable or broken link: it cannot be the skill Claude loaded.
+    return null;
+  } finally {
+    if (fd !== undefined) fs.closeSync(fd);
+  }
+}
+
+// name -> SKILL.md for skills whose folder name differs from their `name:`
+// (e.g. platform-core-architecture-design declares platform-shared:architecture-design).
+// Read once per process.
+function skillsByName(dir) {
+  if (!namedCache.has(dir)) {
+    const byName = new Map();
+    let entries = [];
+    try { entries = fs.readdirSync(dir); } catch { /* no skills folder: nothing to match */ }
+    for (const entry of entries) {
+      const file = path.join(dir, entry, 'SKILL.md');
+      const name = frontmatterName(file);
+      if (name && !byName.has(name)) byName.set(name, file);
+    }
+    namedCache.set(dir, byName);
+  }
+  return namedCache.get(dir);
+}
+
+function claudeSkillFile(name, home) {
+  if (!SKILL_NAME.test(name) || name.split(':').some(part => /^\.+$/.test(part))) return null;
+  const dir = path.join(home, '.claude', 'skills');
+  const file = path.join(dir, name.replace(':', '-'), 'SKILL.md');
+  if (fs.existsSync(file)) return file;
+  return skillsByName(dir).get(name) || null;
+}
+
 /** @param {{ name?: string, path?: string }} skill */
-function skillOrigin(skill, { home = os.homedir() } = {}) {
+function skillOrigin(skill, { home: givenHome = os.homedir() } = {}) {
+  // One spelling of HOME (no trailing slash) for prefix checks and caches.
+  const home = path.resolve(givenHome);
   if (typeof skill?.path === 'string' && skill.path) return originFromPath(skill.path, home);
-  if (typeof skill?.name === 'string' && skill.name) return originFromName(skill.name);
+  if (typeof skill?.name === 'string' && skill.name) {
+    const byName = originFromName(skill.name);
+    if (byName === 'aw') return byName;
+    const file = claudeSkillFile(skill.name, home);
+    return file ? originFromPath(file, home) : byName;
+  }
   return null;
 }
 
@@ -130,6 +220,7 @@ function cursorProbeSkillReads(toolName, toolInput) {
 }
 
 module.exports = {
+  AW_ROOTS,
   skillOrigin,
   skillSourceFields,
   shellSkillReads,

package/hooks/aw-usage/lib/aw-usage-telemetry.js

@@ -17,7 +17,7 @@ const os = require('os');
 const { spawn, execSync } = require('child_process');
 const crypto = require('crypto');
 const { newEventId, readHookVersion, nextSeq, withFileLock } = require('./aw-usage-envelope');
-const { commandKey } = require('./aw-usage-commands');
+const { commandKey, BARE_SLASH_COMMANDS } = require('./aw-usage-commands');
 
 const SENDER_SCRIPT = path.join(__dirname, '..', 'hooks', 'aw-usage-telemetry-send.js');
 const AW_HOME = path.join(os.homedir(), '.aw');
@@ -171,24 +171,31 @@ function resolveProjectHash(context) {
 }
 
 // ── Session file cleanup ─────────────────────────────────────────────
-// Prune session files older than SESSION_MAX_AGE_MS to prevent unbounded growth.
-// Called once per session start — best-effort, never blocks.
+// Prune session files idle longer than SESSION_FILE_RETENTION_MS to prevent
+// unbounded growth. Called once per session start — best-effort, never blocks.
 
-const SESSION_MAX_AGE_MS = 72 * 60 * 60 * 1000; // 72 hours
+const SESSION_MAX_AGE_MS = 72 * 60 * 60 * 1000; // 72 hours: v1 commit link only
+// Long enough that a session's aw_skills survive until its last commit.
+const SESSION_FILE_RETENTION_MS = 5 * 24 * 60 * 60 * 1000;
 
 function pruneStaleSessionFiles() {
+  let entries;
   try {
-    const entries = fs.readdirSync(SESSION_DIR);
-    const now = Date.now();
-    for (const entry of entries) {
-      if (!entry.endsWith('.json') && !entry.endsWith('.seq')) continue;
+    entries = fs.readdirSync(SESSION_DIR);
+  } catch {
+    return; // No sessions folder yet.
+  }
+  const now = Date.now();
+  for (const entry of entries) {
+    // .tmp: left by a crash between an atomic write and its rename.
+    if (!entry.endsWith('.json') && !entry.endsWith('.seq') && !entry.endsWith('.tmp')) continue;
+    try {
       const filePath = path.join(SESSION_DIR, entry);
-      const stat = fs.statSync(filePath);
-      if (now - stat.mtimeMs > SESSION_MAX_AGE_MS) {
-        fs.unlinkSync(filePath);
-      }
+      if (now - fs.statSync(filePath).mtimeMs > SESSION_FILE_RETENTION_MS) fs.unlinkSync(filePath);
+    } catch {
+      // Gone meanwhile, or not a plain file: skip it and keep pruning the rest.
     }
-  } catch { /* best effort */ }
+  }
 }
 
 // ── Session model persistence ────────────────────────────────────────
@@ -213,6 +220,8 @@ function readSessionModel(sessionId) {
 
 function readSessionState(sessionId) {
   if (!sessionId) return {};
+  // Keep the session's AW-skills file alive with the session, main file or not.
+  try { const now = new Date(); fs.utimesSync(awSkillsPath(sessionId), now, now); } catch { /* none recorded yet */ }
   try {
     const filePath = path.join(SESSION_DIR, sessionId + '.json');
     const data = JSON.parse(fs.readFileSync(filePath, 'utf8'));
@@ -333,6 +342,80 @@ function persistSessionPrompt(sessionId, { turn_id: turnId = null, commands = []
 
 const TYPED_COMMAND_WINDOW_MS = 10 * 60 * 1000;
 
+// aw_skills: the AW skills and stages this session ran, as the harness reported
+// them. The prepare-commit-msg hook writes them as the AW-Skills trailer; the
+// server decides which count as SDLC. Only where a skill came from is checked
+// here, so non-AW skill names never reach a commit.
+const AW_SKILLS_MAX = 20;
+const SAFE_AW_SKILL = /^[a-z0-9:_/$.-]{1,60}$/;
+// The AW router in any form: using-aw-skills, aw:/platform-core:using-aw-skills,
+// aw-using-aw-skills, platform-core-using-aw-skills (registry link folders).
+const ROUTER_SKILL = /(?:^|[:/-])using-aw-skills$/;
+
+// Typed forms other than slash_ns only match `aw-` names (aw-usage-commands.js);
+// slash_ns also carries other plugins' namespaces (`/caveman`, `/codex:rescue`).
+function isAwTypedCommand(name, commandForm) {
+  return commandForm !== 'slash_ns' || name.startsWith('aw:') || BARE_SLASH_COMMANDS.has(name);
+}
+
+/** The aw_skills entry for an event, or null when it is not AW evidence. */
+function awSkillEntry(eventType, payload) {
+  let entry = null;
+  if (eventType === 'sdlc_stage_started' || eventType === 'sdlc_stage_completed') {
+    entry = typeof payload?.stage === 'string' ? `stage:${payload.stage.toLowerCase()}` : null;
+  } else if (eventType === 'skill_invoked' && typeof payload?.skill_name === 'string') {
+    const name = payload.skill_name.toLowerCase();
+    const isAw = payload.source === 'user_prompt' ? isAwTypedCommand(name, payload.command_form) : payload.skill_origin === 'aw';
+    entry = isAw ? name : null;
+  }
+  if (!entry || !SAFE_AW_SKILL.test(entry)) return null;
+  return ROUTER_SKILL.test(entry) ? null : entry;
+}
+
+// Own file per session: the older session writers (model, last skill) rewrite
+// <session>.json without the lock, so they could wipe or half-write aw_skills.
+function awSkillsPath(sessionId) {
+  return path.join(SESSION_DIR, sessionId + '.aw.json');
+}
+
+function readAwSkillsState(sessionId) {
+  try {
+    const state = JSON.parse(fs.readFileSync(awSkillsPath(sessionId), 'utf8'));
+    return state && typeof state === 'object' ? state : {};
+  } catch {
+    // Missing or unreadable: no AW skills recorded for this session.
+    return {};
+  }
+}
+
+function recordSessionAwSkill(sessionId, entry, { now = Date.now() } = {}) {
+  if (!sessionId || sessionId === 'unknown') return;
+  const write = () => {
+    const state = readAwSkillsState(sessionId);
+    const skills = Array.isArray(state.aw_skills) ? state.aw_skills : [];
+    const filePath = awSkillsPath(sessionId);
+    const tmpPath = `${filePath}.${process.pid}.${crypto.randomUUID()}.tmp`;
+    fs.writeFileSync(tmpPath, JSON.stringify({
+      aw_skills: skills.includes(entry) || skills.length >= AW_SKILLS_MAX ? skills : [...skills, entry],
+      aw_used_at: new Date(now).toISOString(),
+    }));
+    fs.renameSync(tmpPath, filePath);
+  };
+  try {
+    fs.mkdirSync(SESSION_DIR, { recursive: true });
+    if (!withFileLock(sessionLockPath(sessionId), write, { waitMs: SESSION_LOCK_WAIT_MS }).ok) write();
+  } catch {
+    // Not writable: commits from this session carry no AW trailer.
+  }
+}
+
+/** The AW skills the session ran, safe for a trailer; [] when unknown. */
+function readSessionAwSkills(sessionId) {
+  if (!sessionId) return [];
+  const skills = readAwSkillsState(sessionId).aw_skills;
+  return Array.isArray(skills) ? skills.filter(s => typeof s === 'string' && SAFE_AW_SKILL.test(s)) : [];
+}
+
 function isCurrentPrompt(prompt, turnId, now) {
   if (prompt.turn_id && turnId) return prompt.turn_id === turnId;
   return now - parseUpdatedAt(prompt.at) <= TYPED_COMMAND_WINDOW_MS;
@@ -689,6 +772,8 @@ function buildEvent(hookInput, eventType, payload) {
   const seq = nextSeq(sessionId);
   const projectHash = computeProjectHash(cwd);
   if (eventType !== 'commit_created') touchSessionActivity(projectHash, sessionId, harness);
+  const awSkill = awSkillEntry(eventType, payload);
+  if (awSkill) recordSessionAwSkill(sessionId, awSkill);
 
   return {
     session_id: sessionId,
@@ -748,6 +833,7 @@ module.exports = {
   computeProjectHash,
   findRecentSdlcSessionForProject,
   findRecentActiveSessionForProject,
+  readSessionAwSkills,
   touchSessionActivity,
   readLastAssistantFromTranscript,
   resolvePromptText,

package/hooks.mjs

@@ -13,6 +13,15 @@ import { AW_CO_AUTHOR } from './constants.mjs';
 import { awUsageShellScriptPath } from './aw-usage-wiring.mjs';
 
 const COMMIT_TELEMETRY_HOOK = awUsageShellScriptPath('aw-usage-commit-created.js');
+const COMMIT_TRAILER_HOOK = awUsageShellScriptPath('aw-usage-commit-trailer.js');
+
+// Adds Agent-Harness, and AW-Skills + AW co-author + AW-Version for sessions
+// that ran an AW skill or stage (see aw-usage-commit-trailer.js). Never fails the commit.
+const ADD_COMMIT_TRAILERS = `\
+    TRAILER_HOOK="${COMMIT_TRAILER_HOOK}"
+    if command -v node >/dev/null 2>&1 && [ -f "$TRAILER_HOOK" ]; then
+      node "$TRAILER_HOOK" "$1" "${AW_CO_AUTHOR}" >/dev/null 2>&1 || true
+    fi`;
 
 const HOME = homedir();
 const HOOKS_DIR = join(HOME, '.aw', 'hooks');
@@ -127,24 +136,15 @@ fi
 exit 0
 `;
 
-// prepare-commit-msg: synchronous hook — appends Co-Authored-By trailer to commits
+// prepare-commit-msg: synchronous hook — adds attribution trailers to commits
 // in AW-linked repos. Skips merge commits and respects AW_NO_COAUTHOR=1 opt-out.
+// Trailers the agent wrote (Claude, Cursor, Codex) are kept.
 const PREPARE_COMMIT_MSG = makeDispatcher('prepare-commit-msg', `\
-# Inject co-author trailer unless it's a merge commit or opt-out is set
+# Add attribution trailers unless it's a merge commit or opt-out is set
 if [ "$2" != "merge" ] && [ "$AW_NO_COAUTHOR" != "1" ]; then
-  # Only brand AW-linked repos (check for .aw/ symlink or worktree)
+  # Only AW-linked repos (check for .aw/ symlink or worktree)
   if [ -L ".aw" ] || [ -f ".aw/.git" ]; then
-    TRAILER="${AW_CO_AUTHOR}"
-    # Replace Claude/Cursor co-author trailers with AW
-    sed -i.bak '/^Co-Authored-By:.*Claude/d' "$1" 2>/dev/null || true
-    sed -i.bak '/^Co-Authored-By:.*noreply@anthropic\\.com/d' "$1" 2>/dev/null || true
-    sed -i.bak '/^Co-Authored-By:.*Cursor/d' "$1" 2>/dev/null || true
-    rm -f "$1.bak"
-    # Only append if not already present (idempotent)
-    if ! grep -qF "$TRAILER" "$1"; then
-      echo "" >> "$1"
-      echo "$TRAILER" >> "$1"
-    fi
+${ADD_COMMIT_TRAILERS}
   fi
 fi`);
 
@@ -253,19 +253,9 @@ case "$(pwd)" in /tmp/aw-*|/var/folders/*/aw-*|*/.aw|*/.aw/*) exit 0 ;; esac
 # Opt-out escape hatch
 [ "$AW_NO_COAUTHOR" = "1" ] && exit 0
 
-# Only brand AW-linked repos (check for .aw/ symlink or worktree)
+# Only AW-linked repos (check for .aw/ symlink or worktree)
 if [ -L ".aw" ] || [ -f ".aw/.git" ]; then
-  TRAILER="${AW_CO_AUTHOR}"
-  # Replace Claude/Cursor co-author trailers with AW
-  sed -i.bak '/^Co-Authored-By:.*Claude/d' "$1" 2>/dev/null || true
-  sed -i.bak '/^Co-Authored-By:.*noreply@anthropic\\.com/d' "$1" 2>/dev/null || true
-  sed -i.bak '/^Co-Authored-By:.*Cursor/d' "$1" 2>/dev/null || true
-  rm -f "$1.bak"
-  # Only append if not already present (idempotent)
-  if ! grep -qF "$TRAILER" "$1"; then
-    echo "" >> "$1"
-    echo "$TRAILER" >> "$1"
-  fi
+${ADD_COMMIT_TRAILERS}
 fi
 
 exit 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ghl-ai/aw",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Agentic Workspace CLI — pull, push & manage agents, skills and commands from the registry",
   "type": "module",
   "bin": {