aiwg 2026.8.1 → 2026.8.3

package/agentic/code/addons/aiwg-utils/skills/install-plugin/SKILL.md

@@ -2,7 +2,7 @@
 namespace: aiwg
 name: install-plugin
 platforms: [all]
-description: Install Claude Code marketplace plugins with registry lookup, download, and local deployment
+description: Install Claude Code marketplace plugins or route local/Git wrappers through the supported package workflow
 ---
 
 # Install Plugin
@@ -28,6 +28,8 @@ Alternate expressions and non-obvious activations (primary phrases are matched a
 | Claude Code plugin | "install claude code plugin utils" | Run `aiwg install-plugin utils@aiwg` |
 | Dry run | "show me what installing sdlc would do" | Run `aiwg install-plugin sdlc@aiwg --dry-run` |
 | Specific version | "install sdlc version 2026.3.0" | Run `aiwg install-plugin sdlc@aiwg@2026.3.0` |
+| Local wrapper | "install this local plugin wrapper" | Run `aiwg install <path> --dry-run`, then `aiwg use <plugin-id>` |
+| Git wrapper | "install this plugin Git URL" | Run `aiwg install <git-url> --dry-run`, then `aiwg use <plugin-id>` |
 
 ## Behavior
 
@@ -55,6 +57,12 @@ When triggered:
 
    # Force reinstall even if already installed
    aiwg install-plugin sdlc@aiwg --force
+
+   # Standalone local/Git wrappers use the package installer, not the legacy
+   # manifest-only install-plugin backend.
+   aiwg install ./path/to/wrapper --dry-run
+   aiwg install https://example.invalid/owner/wrapper.git --dry-run
+   aiwg use <plugin-id>
    ```
 
 3. **Report the result** — name the installed marketplace wrapper and confirm which agents, skills, commands, and rules were deployed and where.

package/agentic/code/plugins/utils/skills/install-plugin/SKILL.md

@@ -2,7 +2,7 @@
 namespace: aiwg
 name: install-plugin
 platforms: [all]
-description: Install Claude Code marketplace plugins with registry lookup, download, and local deployment
+description: Install Claude Code marketplace plugins or route local/Git wrappers through the supported package workflow
 ---
 
 # Install Plugin
@@ -28,6 +28,8 @@ Alternate expressions and non-obvious activations (primary phrases are matched a
 | Claude Code plugin | "install claude code plugin utils" | Run `aiwg install-plugin utils@aiwg` |
 | Dry run | "show me what installing sdlc would do" | Run `aiwg install-plugin sdlc@aiwg --dry-run` |
 | Specific version | "install sdlc version 2026.3.0" | Run `aiwg install-plugin sdlc@aiwg@2026.3.0` |
+| Local wrapper | "install this local plugin wrapper" | Run `aiwg install <path> --dry-run`, then `aiwg use <plugin-id>` |
+| Git wrapper | "install this plugin Git URL" | Run `aiwg install <git-url> --dry-run`, then `aiwg use <plugin-id>` |
 
 ## Behavior
 
@@ -55,6 +57,12 @@ When triggered:
 
    # Force reinstall even if already installed
    aiwg install-plugin sdlc@aiwg --force
+
+   # Standalone local/Git wrappers use the package installer, not the legacy
+   # manifest-only install-plugin backend.
+   aiwg install ./path/to/wrapper --dry-run
+   aiwg install https://example.invalid/owner/wrapper.git --dry-run
+   aiwg use <plugin-id>
    ```
 
 3. **Report the result** — name the installed marketplace wrapper and confirm which agents, skills, commands, and rules were deployed and where.

package/dist/src/cli/handlers/install.js

@@ -20,6 +20,7 @@
 import path from 'path';
 import { installPackage } from '../../packages/registry.js';
 import { recordDeployment } from '../../packages/package-registry.js';
+import { marketplaceConfigDir, resolveVerificationPolicy } from '../../marketplace/exchange.js';
 import { createScriptRunner } from './script-runner.js';
 import { handlerResultFromError } from '../errors.js';
 import * as ui from '../ui.js';
@@ -59,6 +60,12 @@ export const installHandler = {
                     '  --provider <name>       Target provider (claude, copilot, cursor...)',
                     '  --target <dir>          Project directory to deploy into',
                     '  --refresh               Force re-pull even if cached',
+                    '  --ref <tag-or-sha>      Resolve this ref and lock its immutable commit',
+                    '  --package <id>          Select one wrapper when a repository contains several',
+                    '  --verify                Require a publisher signature trusted by local policy',
+                    '  --policy <name|path>    Named trust policy or JSON policy file',
+                    '  --project-local         Store registry, lock, receipts, and index under <target>/.aiwg',
+                    '  --global                Store package state in the user AIWG directory (default)',
                 ].join('\n'),
             };
         }
@@ -66,6 +73,15 @@ export const installHandler = {
         const refresh = hasFlag(ctx.args, '--refresh');
         const provider = parseFlag(ctx.args, '--provider') ?? 'claude';
         const target = parseFlag(ctx.args, '--target') ?? ctx.cwd;
+        const projectLocal = hasFlag(ctx.args, '--project-local');
+        const global = hasFlag(ctx.args, '--global');
+        if (projectLocal && global) {
+            return { exitCode: 1, message: 'Error: Choose either --project-local or --global, not both' };
+        }
+        const verify = hasFlag(ctx.args, '--verify');
+        const policyName = parseFlag(ctx.args, '--policy');
+        const scope = { projectLocal, projectDir: target };
+        const configDir = marketplaceConfigDir(scope);
         ui.blank();
         console.log(`  ${ui.brandMark()} ${ui.bold('aiwg install')}  ${ui.dimText(rawRef)}`);
         ui.rule();
@@ -75,8 +91,23 @@ export const installHandler = {
         let key;
         let type;
         let namespace;
+        let lockId;
+        let verificationStatus;
         try {
-            ({ cachePath, key, type, namespace } = await installPackage(rawRef, { refresh }));
+            const resolvedPolicy = await resolveVerificationPolicy(policyName, scope);
+            const installed = await installPackage(rawRef, {
+                refresh,
+                ref: parseFlag(ctx.args, '--ref'),
+                packageSelector: parseFlag(ctx.args, '--package'),
+                verify,
+                verificationPolicy: resolvedPolicy.policy,
+                trustStore: resolvedPolicy.trustStore,
+                configDir,
+                actor: 'local-user',
+            });
+            ({ cachePath, key, type, namespace } = installed);
+            lockId = installed.lock.lockId;
+            verificationStatus = installed.verification.status;
         }
         catch (error) {
             // Preserve AiwgError.exitCode while keeping the "Error: " prefix users
@@ -85,9 +116,12 @@ export const installHandler = {
             return { ...result, message: `Error: ${result.message}` };
         }
         ui.success(`Installed: ${key} (${type})`);
-        ui.dimText(`  Cache: ${cachePath}`);
+        ui.dim(`  Cache: ${cachePath}`);
+        ui.dim(`  Lock: ${lockId}`);
+        ui.dim(`  Verification: ${verificationStatus}`);
+        ui.dim(`  Scope: ${projectLocal ? 'project-local' : 'global'}`);
         if (namespace !== 'aiwg') {
-            ui.dimText(`  Namespace: ${namespace}`);
+            ui.dim(`  Namespace: ${namespace}`);
         }
         // Optionally deploy
         if (deploy) {
@@ -98,6 +132,10 @@ export const installHandler = {
                 '--deploy-commands',
                 '--deploy-skills',
                 '--deploy-rules',
+                // External packages do not participate in AIWG's global artifact
+                // index. Copy their complete skill payload into the target so a
+                // successful install cannot silently deploy agents/rules only.
+                '--copy-all',
                 '--provider', provider,
                 '--target', target,
                 '--namespace', namespace,
@@ -116,7 +154,7 @@ export const installHandler = {
                     projectPath: target,
                     provider,
                     deployedAt: new Date().toISOString(),
-                });
+                }, configDir);
             }
         }
         ui.blank();