aiwg 2026.7.25 → 2026.8.0

package/agentic/code/addons/aiwg-utils/docs/security/supply-chain/external-npm/README.md

@@ -2,6 +2,11 @@
 
 Generated: 2026-05-23
 
+Manifest/lockfile version inventory refreshed: 2026-08-01
+
+Individual linked reports retain their own audit dates and evidence. A newer
+version in this index does not imply that its linked report has been re-audited.
+
 Parent: #1443
 
 This directory tracks external npm package audit evidence for the current dependency-audit wave:
@@ -14,22 +19,22 @@ This directory tracks external npm package audit evidence for the current depend
 
 | Package | Version | Tracking | Native/Binary/Lifecycle Surface | Status | Report |
 |---|---:|---|---|---|---|
-| `@modelcontextprotocol/sdk` | `1.24.3` | #1444, #1447 | no | complete | [report](modelcontextprotocol__sdk.md) |
+| `@modelcontextprotocol/sdk` | `1.29.0` | #1444, #1447 | no | complete | [report](modelcontextprotocol__sdk.md) |
 | `chalk` | `4.1.2` | #1444 | no | complete | [report](chalk.md) |
-| `chokidar` | `3.6.0` | #1444 | no | complete | [report](chokidar.md) |
+| `chokidar` | `4.0.3` | #1444 | no | complete | [report](chokidar.md) |
 | `commander` | `12.1.0` | #1444, #1447 | no | complete | [report](commander.md) |
-| `glob` | `13.0.1` | #1444 | no | complete | [report](glob.md) |
+| `glob` | `13.0.6` | #1444 | no | complete | [report](glob.md) |
 | `graceful-fs` | `4.2.11` | #1444 | no | complete | [report](graceful-fs.md) |
-| `js-yaml` | `4.1.1` | #1444, #1447 | no | complete | [report](js-yaml.md) |
+| `js-yaml` | `4.3.0` | #1444, #1447 | no | complete | [report](js-yaml.md) |
 | `listr2` | `8.3.3` | #1444 | no | complete | [report](listr2.md) |
 | `ora` | `5.4.1` | #1444 | no | complete | [report](ora.md) |
-| `yaml` | `2.8.2` | #1444 | no | complete | [report](yaml.md) |
+| `yaml` | `2.9.0` | #1444 | no | complete | [report](yaml.md) |
 | `zod` | `3.25.76` | #1444 | no | complete | [report](zod.md) |
-| `@hono/node-server` | `1.19.14` | #1445 | no | complete | [report](hono__node-server.md) |
+| `@hono/node-server` | `2.0.11` | #1973 | no | complete | [report](hono__node-server.md) |
 | `hnswlib-node` | `3.0.0` | #1445 | yes | complete | [report](hnswlib-node.md) |
-| `hono` | `4.12.18` | #1445 | no | complete | [report](hono.md) |
+| `hono` | `4.12.31` | #1445 | no | complete | [report](hono.md) |
 | `node-pty` | `1.1.0` | #1445 | yes | complete | [report](node-pty.md) |
-| `ws` | `8.20.0` | #1445 | no | complete | [report](ws.md) |
+| `ws` | `8.21.1` | #1445 | no | complete | [report](ws.md) |
 | `@xenova/transformers` | `2.17.2` | #1445 | yes | complete | [report](xenova__transformers.md) |
 | `better-sqlite3` | `12.8.0` | #1445 | yes | complete | [report](better-sqlite3.md) |
 | `@matric/eval-client` | `0.1.0` | #1447 | no | complete | [report](matric__eval-client.md) |

package/agentic/code/addons/aiwg-utils/skills/schedule/SKILL.md

@@ -2,10 +2,10 @@
 namespace: aiwg
 name: schedule
 platforms: [all]
-description: Create, update, list, or run scheduled remote agents (triggers) that execute on a cron schedule
+description: Route recurring work to a provider-native scheduler or an explicitly external host scheduler
 commandHint:
-  argumentHint: "create|list|delete [--name <name>] [--cron <expr>] [--task <prompt>] [--provider <provider>]"
-  allowedTools: Bash, Read, Write, CronCreate, CronDelete, CronList
+  argumentHint: "create|list|delete [provider-native options]"
+  allowedTools: CronCreate, CronDelete, CronList
   model: haiku
   category: scheduling
   modelRole: efficiency
@@ -14,305 +14,60 @@ commandHint:
 
 # Schedule
 
-**You are the Cross-Provider Scheduler** — creating, listing, and deleting scheduled agent tasks using the best available backend for the current platform.
+Route scheduling requests without inventing an AIWG scheduler backend.
 
-## Core Philosophy
+## Capability boundary
 
-Scheduling should work identically regardless of provider. Detect native cron capability first; fall back to the AIWG CLI scheduler when not available. Always check `chrony` installation and recommend it for precise timing.
+AIWG's production CLI does **not** expose `aiwg schedule`, `aiwg daemon`, or
+`aiwg daemon schedule`. Never recommend or execute those commands.
 
-## Natural Language Triggers
+There are three distinct states:
 
-Users may say:
-- "schedule X to run every day at 9am"
-- "run aiwg sync every morning"
-- "set up a daily health check"
-- "schedule a recurring task"
-- "create a cron job for X"
-- "list my scheduled tasks"
-- "delete the daily-sync schedule"
-- "show scheduled agents"
-- "what's scheduled?"
-- "aiwg schedule create/list/delete"
+1. **Provider native** — use the provider's scheduling tools directly. In a
+   Claude Code agent session these are `CronCreate`, `CronList`, and
+   `CronDelete`.
+2. **AIWG implemented** — no production scheduler implementation currently
+   exists. Do not label this state as emulated.
+3. **External trigger** — system cron, a systemd timer, or CI owns time and
+   launches a reviewed, non-interactive provider command. AIWG may document the
+   contract, but it does not own the clock.
 
-## Parameters
+## Routing
 
-### Operation (positional, required)
-- `create` — Create a new scheduled task
-- `list` — List all scheduled tasks
-- `delete` — Delete a scheduled task by name
+- When `CronCreate`/`CronList`/`CronDelete` are available, use them.
+- Otherwise, explain that scheduling is external and ask which host mechanism
+  the operator controls.
+- Do not create a cron entry or CI workflow without explicit authorization.
+- Keep prompts and reviewed configuration in files; do not place credentials,
+  session material, or sensitive prompt text in process arguments.
 
-### --name (required for create/delete)
-Unique identifier for the scheduled task. Example: `daily-sync`
+## Provider-native operations
 
-### --cron (required for create)
-Standard 5-field cron expression. Examples:
-- `"0 9 * * *"` — every day at 9:00 AM
-- `"*/30 * * * *"` — every 30 minutes
-- `"0 0 * * 1"` — every Monday at midnight
-- `"0 9 * * 1-5"` — weekdays at 9 AM
+For Claude Code inside an agent session:
 
-### --task (required for create)
-The prompt or command to run. Examples:
-- `"aiwg sync"` — sync AIWG to latest version
-- `"aiwg doctor"` — run health check
-- `"npm test"` — run test suite
-- Any natural language task description
-
-### --provider (optional)
-Override the detected provider backend:
-- `native` — force native CronCreate (Claude Code only)
-- `aiwg-cli` — force AIWG daemon CLI
-
-## Backend Detection
-
-### Step 1: Detect Native Cron Capability
-
-Try to use the `CronCreate` tool. This tool is natively available only on Claude Code (agent runtime). On all other providers it will not be present.
-
-```
-Detection order:
-1. CronCreate available? → use native-cron backend
-2. CronCreate unavailable? → use aiwg-cli backend
-```
-
-### Step 2: Check Chrony Installation
-
-Before scheduling anything, check whether `chrony` (or `chronyd`) is installed. Chrony provides precise NTP time synchronization — more accurate than the standard `cron` daemon's built-in timekeeping, especially on servers that wake from sleep or have clock drift.
-
-```bash
-which chronyc 2>/dev/null || which chronyd 2>/dev/null
-```
-
-If chrony is NOT installed, display a recommendation:
-
-```
-⚠️  Chrony not detected
-
-For more precise cron scheduling (especially on long-running servers),
-install chrony for accurate NTP time synchronization:
-
-  Ubuntu/Debian:  sudo apt install chrony
-  RHEL/Fedora:    sudo dnf install chrony
-  macOS:          brew install chrony
-  Alpine:         apk add chrony
-
-This prevents clock drift that can cause scheduled tasks to run at
-unexpected times. Proceeding with current system clock.
-```
-
-## Execution: CREATE
-
-### Backend: Native CronCreate (Claude Code)
-
-When CronCreate is available:
-
-```
-CronCreate({
-  name: "<name>",
-  schedule: "<cron-expression>",
-  prompt: "<task>"
-})
-```
-
-**Output on success**:
-```
-✓ Scheduled task created (native-cron backend)
-
-  Name:     daily-sync
-  Schedule: 0 9 * * * (every day at 09:00)
-  Task:     aiwg sync
-  Backend:  native-cron (CronCreate)
-
-To list: /schedule list
-To delete: /schedule delete --name daily-sync
-```
-
-### Backend: AIWG CLI (all other providers)
-
-When CronCreate is NOT available, delegate to the AIWG daemon scheduler:
-
-```bash
-# Check if daemon is running
-aiwg daemon status
-
-# Create scheduled job via daemon config
-aiwg daemon schedule create --name "<name>" --cron "<expr>" --task "<task>"
-```
-
-If the daemon is not running, start it first or guide the user:
-
-```
-⚠️  AIWG daemon not running
-
-The aiwg-cli scheduler requires the AIWG daemon. Start it with:
-  aiwg daemon start
-
-Then retry: /schedule create --name <name> --cron "<expr>" --task "<task>"
-```
-
-**Output on success**:
-```
-✓ Scheduled task created (aiwg-cli backend)
-
-  Name:     daily-sync
-  Schedule: 0 9 * * * (every day at 09:00)
-  Task:     aiwg sync
-  Backend:  aiwg-cli (daemon)
-
-To list: /schedule list
-To delete: /schedule delete --name daily-sync
-```
-
-## Execution: LIST
-
-### Backend: Native CronList (Claude Code)
-
-```
+```text
+CronCreate({ name: "daily-sync", schedule: "0 9 * * *", prompt: "Run the reviewed daily sync" })
 CronList()
+CronDelete({ name: "daily-sync" })
 ```
 
-Display results as a table:
-
-```
-Scheduled Tasks (native-cron backend)
-
-  NAME           SCHEDULE          NEXT RUN              TASK
-  daily-sync     0 9 * * *         2026-03-28 09:00:00   aiwg sync
-  health-check   0 */6 * * *       2026-03-27 18:00:00   aiwg doctor
-```
-
-### Backend: AIWG CLI
-
-```bash
-aiwg daemon schedule
-```
-
-Parse and display in the same table format.
-
-If no tasks are scheduled:
-```
-No scheduled tasks found.
-
-Create one with: /schedule create --name <name> --cron "<expr>" --task "<task>"
-```
-
-## Execution: DELETE
-
-### Backend: Native CronDelete (Claude Code)
-
-```
-CronDelete({ name: "<name>" })
-```
-
-### Backend: AIWG CLI
-
-```bash
-aiwg daemon schedule delete --name "<name>"
-```
+Outside that tool surface, report:
 
-**Output on success**:
+```text
+No provider-native scheduler is available in this session.
+Use an external scheduler (system cron, systemd timer, or CI) to launch a
+reviewed provider command. AIWG does not provide a resident scheduler command.
 ```
-✓ Scheduled task deleted
-
-  Name:    daily-sync
-  Backend: native-cron
 
-No more scheduled tasks. Create one with: /schedule create
-```
+## Safety
 
-**Output if not found**:
-```
-✗ Task not found: daily-sync
-
-Available tasks:
-  health-check   (0 */6 * * *)
-```
-
-## Backend Routing Table
-
-| Provider | Native CronCreate | Fallback |
-|----------|------------------|---------|
-| Claude Code | ✓ CronCreate/CronList/CronDelete | — |
-| Warp Terminal | — | aiwg daemon |
-| GitHub Copilot | — | aiwg daemon |
-| Cursor | — | aiwg daemon |
-| Windsurf | — | aiwg daemon |
-| OpenCode | — | aiwg daemon |
-| Factory AI | — | aiwg daemon |
-| OpenCode (Codex) | — | aiwg daemon |
-| OpenClaw | — | aiwg daemon |
-
-## Chrony Setup Recommendations
-
-Always check and report chrony status when creating schedules. Include platform-specific install instructions if missing.
-
-| Priority | When chrony is missing |
-|----------|----------------------|
-| HIGH | Server environments, long-running containers |
-| MEDIUM | Developer workstations |
-| LOW | Short-lived CI/CD agents |
-
-Chrony is especially important when:
-- Tasks are scheduled at exact times (not just intervals)
-- The host may sleep/hibernate between runs
-- Sub-minute precision is needed
-- The system runs in a VM or container with clock drift
-
-## Error Handling
-
-| Error | Action |
-|-------|--------|
-| CronCreate unavailable | Fall back to aiwg-cli, no error shown |
-| Daemon not running | Show start instructions, stop gracefully |
-| Invalid cron expression | Validate and show examples |
-| Name conflict | Show existing task, offer to update |
-| Delete non-existent | Show available tasks |
-
-## Cron Expression Quick Reference
-
-```
-┌───────────── minute (0 - 59)
-│ ┌───────────── hour (0 - 23)
-│ │ ┌───────────── day of month (1 - 31)
-│ │ │ ┌───────────── month (1 - 12)
-│ │ │ │ ┌───────────── day of week (0 - 6, Sunday=0)
-│ │ │ │ │
-* * * * *
-
-Examples:
-  "0 9 * * *"       every day at 9:00 AM
-  "*/30 * * * *"    every 30 minutes
-  "0 0 * * 0"       every Sunday at midnight
-  "0 9,17 * * 1-5"  weekdays at 9 AM and 5 PM
-  "0 0 1 * *"       first of every month at midnight
-```
-
-## Examples
-
-```bash
-# Create a daily sync at 9 AM
-/schedule create --name daily-sync --cron "0 9 * * *" --task "aiwg sync"
-
-# Create a health check every 6 hours
-/schedule create --name health-check --cron "0 */6 * * *" --task "aiwg doctor"
-
-# List all scheduled tasks
-/schedule list
-
-# Delete a scheduled task
-/schedule delete --name daily-sync
-
-# Natural language — parsed and routed automatically
-"run aiwg sync every day at 9am"
-"schedule a health check every 6 hours"
-"show me what's scheduled"
-"delete the daily-sync schedule"
-```
+- Treat external scheduler configuration as an operator-owned deployment.
+- Use absolute, reviewed workspace and prompt paths.
+- Never embed tokens, cookies, browser profiles, or session data.
+- Prefer stdin for provider prompts and use the platform's approved secret
+  store or file-backed reference mechanism.
+- Require an idempotency strategy and lock for mutation-capable jobs.
 
-## References
+## Discovery terms
 
-- #597 — Issue: intelligent cross-provider scheduler design
-- @.aiwg/planning/issue-driven-ralph-loop-design.md — Scheduling context
-- CronCreate / CronList / CronDelete — Claude Code native cron tools
-- `aiwg daemon schedule` — AIWG daemon CLI fallback
-- `aiwg runtime-info` — Reports active scheduler backend
+scheduled recurring task, cron, systemd timer, external trigger, provider-native scheduler

package/agentic/code/addons/aiwg-utils/skills/steward/SKILL.md

@@ -177,16 +177,20 @@ aiwg steward find --capability cron
 ```
 cron support across providers:
   claude-code:  native
-  codex:        emulated via aiwg-scheduler
-  copilot:      emulated via aiwg-scheduler
-  cursor:       emulated via aiwg-scheduler
-  factory:      native
-  opencode:     emulated via aiwg-scheduler
-  warp:         emulated via aiwg-scheduler
-  windsurf:     emulated via aiwg-scheduler
-  openclaw:     emulated via aiwg-scheduler
+  codex:        external trigger (system cron/systemd/CI)
+  copilot:      unsupported
+  cursor:       unsupported
+  factory:      unsupported
+  opencode:     unsupported
+  warp:         unsupported
+  windsurf:     unsupported
+  openclaw:     unsupported
 ```
 
+External means the host scheduler owns time and launches a reviewed provider
+command. It is not AIWG emulation; no `aiwg schedule` or `aiwg daemon` command
+exists in the production CLI.
+
 ### Example 4: Full matrix
 
 **User**: "Show me the capability matrix for all providers"

package/agentic/code/addons/daemon/docs/quickstart.md

@@ -1,196 +1,36 @@
-# Daemon Quickstart
+# Daemon Addon Status
 
-> **First time using AIWG?** Begin with [Install, Connect, and Verify](https://docs.aiwg.io/pages/getting-started--install-connect-verify.html). This guide assumes AIWG is already installed, `all` is deployed for your provider, and `aiwg-regenerate` has connected the agent to this project.
+> **First time using AIWG?** Begin with [Install, Connect, and Verify](https://docs.aiwg.io/pages/getting-started--install-connect-verify.html). This status page assumes AIWG is already installed and `aiwg-regenerate` has connected the agent to this project.
 
-Start the AIWG daemon, enable the Concierge front-end, and access the operator web UI.
+The daemon addon contains design artifacts and configuration scaffolding, but
+the production AIWG CLI does not currently register a resident `daemon`
+command. Consequently there is no supported start, status, stop, PTY, or
+scheduler quickstart in this release.
 
-## Prerequisites
-
-The daemon is the persistent background process that manages agent sessions, file watching, and scheduled tasks. It requires the AIWG CLI and runs as a Node.js process.
-
-## Installation
-
-```bash
-# Deploy the daemon addon
-aiwg use daemon
-
-# Verify deployment
-aiwg list
-# daemon    installed
-```
-
-## Initialize Daemon Configuration
+`aiwg daemon-init` may be used to inspect or scaffold configuration for
+development work:
 
 ```bash
 aiwg daemon-init
 ```
 
-This creates `.aiwg/daemon.json` with sensible defaults for your project. Inspect and adjust the defaults before starting.
-
-## Start the Daemon
-
-```bash
-aiwg daemon start
-```
-
-The daemon detaches from the terminal and runs in the background. State is stored in `.aiwg/daemon/`.
-
-Check that it started:
-
-```bash
-aiwg daemon status
-```
-
-Output includes PID, uptime, active subsystems, and connected adapters.
-
-## Access the Web UI
-
-The operator web UI is available at `http://localhost:7474` when enabled. Enable it in `.aiwg/daemon.json`:
-
-```json
-{
-  "interface": {
-    "web": {
-      "enabled": true,
-      "port": 7474,
-      "host": "127.0.0.1"
-    }
-  }
-}
-```
-
-Restart the daemon after enabling the web UI:
-
-```bash
-aiwg daemon stop
-aiwg daemon start
-```
-
-Then open `http://localhost:7474` in a browser. The web UI shows active sessions, task queue status, and subsystem health.
-
-## Enable the Concierge
-
-The Concierge is a hotel-concierge-style interaction layer that greets users contextually, routes requests silently to the appropriate skill or agent, and composes responses with consistent tone.
-
-Add to `.aiwg/daemon.json`:
-
-```json
-{
-  "supervisor": {
-    "behaviors": ["concierge"]
-  },
-  "behaviors": {
-    "concierge": {
-      "enabled": true,
-      "memory": {
-        "cross_session": true,
-        "store": ".aiwg/daemon/concierge-memory.json"
-      }
-    }
-  }
-}
-```
-
-Or deploy via CLI:
-
-```bash
-aiwg add-behavior concierge
-```
-
-Once enabled, the concierge activates at session start and wraps all output before it reaches the user.
-
-## Submit a Task
-
-```bash
-aiwg task submit "Fix the failing tests in auth module"
-```
-
-The daemon queues the task, spawns a `claude -p` subprocess to execute it, and reports progress. Task output is logged to `.aiwg/daemon/tasks/`.
-
-## Check Daemon Health
-
-From within an agent session, use the daemon-status skill:
-
-```
-Show daemon status
-```
-
-Output shows:
-- Daemon process PID and uptime
-- Active agent sessions (count and IDs)
-- Task queue depth
-- Subsystem health (file watcher, scheduler, IPC socket)
-- Circuit breaker state
-
-## Stop the Daemon
-
-```bash
-# Graceful shutdown (15 second drain window for running tasks)
-aiwg daemon stop
-
-# Immediate stop
-aiwg daemon stop --force
-```
-
-## Common Configuration
-
-**Set concurrency limit** (default 4):
-```json
-{
-  "supervisor": {
-    "max_concurrent": 4,
-    "max_queue_depth": 20
-  }
-}
-```
-
-**Set a daily spend cap**:
-```json
-{
-  "supervisor": {
-    "daily_budget_usd": 50
-  }
-}
-```
-
-**Enable file watching** (trigger tasks on source changes):
-```json
-{
-  "watch": {
-    "enabled": true,
-    "paths": ["src/", "test/"],
-    "ignore": ["node_modules/", ".git/"],
-    "debounce_ms": 1000
-  }
-}
-```
-
-**Add a scheduled job** (run health check every 30 minutes):
-```json
-{
-  "schedule": {
-    "enabled": true,
-    "jobs": [
-      {
-        "name": "health-check",
-        "cron": "*/30 * * * *",
-        "action": "health-check"
-      }
-    ]
-  }
-}
-```
-
-## Uninstall
+That command does not start a daemon. Verify the installed top-level surface
+with:
 
 ```bash
-aiwg remove daemon
+aiwg help
 ```
 
-This removes all deployed artifacts. The daemon infrastructure files in `tools/daemon/` are unaffected.
+For recurring work, use a provider-native scheduler when available or an
+operator-owned external scheduler such as system cron, a systemd timer, or CI.
+Do not use `aiwg schedule`, `aiwg daemon`, or `aiwg daemon schedule`; those
+commands are not registered.
 
-## References
+For approval-gated Gitea work executed by Codex, use the separate single-shot
+`aiwg job validate`, `aiwg job render-cron`, and `aiwg job run --once` surface.
+Those commands validate and execute a reviewed job while the external service
+continues to own the schedule. See the public External-trigger jobs guide.
 
-- `@$AIWG_ROOT/agentic/code/addons/daemon/docs/daemon-addon-guide.md` — Full architecture, provider support, and configuration
-- `@$AIWG_ROOT/docs/daemon-guide.md` — Daemon infrastructure and supervisor configuration
-- `@$AIWG_ROOT/agentic/code/addons/daemon/behaviors/concierge.behavior.md` — Concierge behavior definition
+A future daemon release must land command registration, lifecycle handlers,
+help text, tests, and documentation together before this guide can advertise
+runtime operations.

package/agentic/code/frameworks/media-marketing-kit/README.md

@@ -49,6 +49,19 @@ The Media/Marketing Kit (MMK) framework provides a comprehensive Plan → Act li
 - `artifacts/` - Sample campaigns demonstrating complete lifecycle
 - `config/` - Framework configuration (models.json, etc.)
 
+### Design operations
+
+The `theme-manager` skill and **Template & Theme Manager** agent coordinate reusable visual direction across web, social, email, presentations, reports, campaigns, and print. They keep expressive themes separate from structural templates, research and compare five directions by default, generate comparable image samples when supported, fall back to production-grade specifications elsewhere, and record selection and rotation history under `.aiwg/design/`.
+
+```bash
+aiwg discover "pick a visual theme"
+aiwg discover "create five hero directions"
+aiwg discover "stop repeating the same aesthetic"
+aiwg run skill theme-manager -- init .
+```
+
+See `flows/choose-theme.md`, `flows/design-operations.md`, and `docs/design-operations-examples.md`.
+
 ### Template Categories
 
 The framework provides 87+ templates organized by marketing discipline: