@akanjs/devkit 3.1.1-rc.10 → 3.1.1-rc.12

package/akanApp/akanApp.host.test.ts

@@ -13,6 +13,18 @@ describe("readProcessRssBytes", () => {
     expect(rssBytes).toBeLessThan(64 * 1024 * 1024 * 1024);
   });
 
+  // The builder's own report triggers a recycle and this reading settles it, so the two must agree.
+  test.skipIf(process.platform !== "darwin")("reads what the process reports once it frees memory", async () => {
+    let held: number[][] | null = Array.from({ length: 64 }, (_, idx) => new Array<number>(500_000).fill(idx + 0.5));
+    expect(held.length).toBe(64);
+    held = null;
+    Bun.gc(true);
+    await Bun.sleep(500);
+    const rssBytes = await AkanAppHost.readProcessRssBytes(process.pid);
+    if (rssBytes === null) throw new Error("expected to read this process's own rss");
+    expect(Math.abs(rssBytes - process.memoryUsage.rss())).toBeLessThan(64 * 1024 * 1024);
+  });
+
   // A 0 would read as "settled below the ceiling" and cancel a recycle that should happen.
   test("returns null for a pid that does not exist", async () => {
     expect(await AkanAppHost.readProcessRssBytes(2_147_483_646)).toBeNull();

package/akanApp/akanApp.host.ts

@@ -651,6 +651,13 @@ export class AkanAppHost {
         ["tasklist", "/FI", `PID eq ${pid}`, "/FO", "CSV", "/NH"],
         AkanAppHost.#tasklistRssKb,
       );
+    if (process.platform === "darwin") {
+      const footprintBytes = await AkanAppHost.#readRssKbVia(
+        ["footprint", "-p", String(pid), "-f", "bytes"],
+        AkanAppHost.#footprintKb,
+      );
+      if (footprintBytes !== null) return footprintBytes;
+    }
     const status = await Bun.file(`/proc/${pid}/status`)
       .text()
       .catch(() => null);
@@ -687,6 +694,11 @@ export class AkanAppHost {
     const memUsage = /"([^"]*)"\s*$/m.exec(output)?.[1];
     return memUsage ? Number(memUsage.replace(/\D/g, "")) : Number.NaN;
   }
+  // The footprint is what `process.memoryUsage.rss()` reports on macOS; `ps` also counts pages freed for reuse.
+  static #footprintKb(output: string): number {
+    const bytes = /Footprint: (\d+) B\b/.exec(output)?.[1];
+    return bytes ? Number(bytes) / 1024 : Number.NaN;
+  }
   #cancelRssRecycle(): void {
     this.#rssRecycleReason = null;
     this.#rssRecycleOver = null;

package/akanConfig/akanConfig.test.ts

@@ -317,6 +317,36 @@ describe("AkanAppConfig", () => {
     expect(() => brokenConfig.getProductionPackageJson()).toThrow("Dependency missing-lib not found");
   });
 
+  test("carries the root's overrides and resolutions, so the image resolves what the workspace locked", () => {
+    const pinned = new AkanAppConfig(
+      app,
+      [],
+      { ...packageJson, overrides: { "js-tokens": "2.0.0" }, resolutions: { ms: "2.0.0" } },
+      {},
+      baseDevEnv,
+    );
+    expect(pinned.getProductionPackageJson()).toMatchObject({
+      overrides: { "js-tokens": "2.0.0" },
+      resolutions: { ms: "2.0.0" },
+    });
+    const local = new AkanAppConfig(
+      app,
+      [],
+      {
+        ...packageJson,
+        overrides: { "js-tokens": "2.0.0", patched: "file:./patches/patched", shared: "workspace:*" },
+        resolutions: { ms: "link:../ms" },
+      },
+      {},
+      baseDevEnv,
+    ).getProductionPackageJson();
+    expect(local.overrides).toEqual({ "js-tokens": "2.0.0" });
+    expect(local).not.toHaveProperty("resolutions");
+    const unpinned = new AkanAppConfig(app, [], packageJson, {}, baseDevEnv).getProductionPackageJson();
+    expect(unpinned).not.toHaveProperty("overrides");
+    expect(unpinned).not.toHaveProperty("resolutions");
+  });
+
   test("falls back to akanjs package versions for built-in runtime dependencies", () => {
     const runtimeDependencies = {
       ...akanPackageJson.dependencies,

package/akanConfig/akanConfig.ts

@@ -776,7 +776,15 @@ CMD [${command.map((c) => `"${c}"`).join(",")}]`;
   static get akanVersion() {
     return getAkanPackageJson().version;
   }
+  //? The image installs from the registry alone: a pin to a path or a workspace package resolves nowhere there.
+  static #registryPins(pins: Record<string, string> | undefined) {
+    if (!pins) return undefined;
+    const kept = Object.entries(pins).filter(([, spec]) => !/^(?:file:|link:|workspace:|portal:|[./~])/.test(spec));
+    return kept.length ? Object.fromEntries(kept) : undefined;
+  }
   getProductionPackageJson(data: Partial<PackageJson> = {}): PackageJson {
+    const overrides = AkanAppConfig.#registryPins(this.rootPackageJson.overrides);
+    const resolutions = AkanAppConfig.#registryPins(this.rootPackageJson.resolutions);
     return {
       name: this.app.name,
       description: this.app.name,
@@ -789,6 +797,8 @@ CMD [${command.map((c) => `"${c}"`).join(",")}]`;
         ]),
       ),
       ...(this.trustedDependencies.length ? { trustedDependencies: this.trustedDependencies } : {}),
+      ...(overrides ? { overrides } : {}),
+      ...(resolutions ? { resolutions } : {}),
       ...data,
     };
   }

package/akanConfig/productionLockfile.test.ts

@@ -70,6 +70,37 @@ describe("ProductionLockfile", () => {
     });
   });
 
+  test("keeps a version an override pinned outside its parent's range", async () => {
+    const overriddenLock = `{
+  "lockfileVersion": 1,
+  "configVersion": 1,
+  "workspaces": {
+    "": {
+      "name": "repo",
+      "dependencies": {
+        "loose-envify": "^1.4.0",
+      },
+    },
+  },
+  "overrides": {
+    "js-tokens": "2.0.0",
+  },
+  "packages": {
+    "js-tokens": ["js-tokens@2.0.0", "", {}, "sha512-kk4RjoztHFeAlCNPdTr/uF04oN5z53L18LJfADBQ7YHkO3iR2rP2ZwOH0n33r2FRw0psRmjTDEkOWPE//zmujg=="],
+
+    "loose-envify": ["loose-envify@1.4.0", "", { "dependencies": { "js-tokens": "^3.0.0 || ^4.0.0" }, "bin": { "loose-envify": "cli.js" } }, "sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q=="],
+  }
+}
+`;
+    await withWorkspace(overriddenLock, async (root) => {
+      const lock = await ProductionLockfile.prune(root, {
+        ...productionPackageJson,
+        overrides: { "js-tokens": "2.0.0" },
+      });
+      expect(lock).toContain('"js-tokens": ["js-tokens@2.0.0"');
+    });
+  });
+
   test("refuses a workspace without a bun.lock, so the build can fall back to an unlocked install", async () => {
     await withWorkspace(null, async (root) => {
       await expect(ProductionLockfile.prune(root, productionPackageJson)).rejects.toThrow(

package/akanConfig/productionLockfile.ts

@@ -13,9 +13,11 @@ export class ProductionLockfile {
     if (!(await workspaceLock.exists())) throw new Error(`the workspace root has no ${ProductionLockfile.fileName}`);
     const dir = await mkdtemp(path.join(os.tmpdir(), "akan-production-lock-"));
     try {
+      const npmrc = Bun.file(path.join(workspaceRoot, ".npmrc"));
       await Promise.all([
         Bun.write(path.join(dir, "package.json"), JSON.stringify(packageJson, null, 2)),
         Bun.write(path.join(dir, ProductionLockfile.fileName), workspaceLock),
+        ...((await npmrc.exists()) ? [Bun.write(path.join(dir, ".npmrc"), npmrc)] : []),
       ]);
       const install = Bun.spawn([process.execPath, "install", "--lockfile-only", "--no-progress"], {
         cwd: dir,

package/codeAgent/agent/CodeAgent.ts

@@ -114,6 +114,10 @@ export class CodeAgent {
       profile: options.profile,
       apps: options.apps ?? [],
       canSeeImages: akanCodeModelSupportsImages(model),
+      model: () => {
+        const current = agent.#session?.model;
+        return current ? { provider: current.provider, id: current.id } : undefined;
+      },
       deepseek: await DeepSeekWeb.fromRuntime(modelRuntime, !!proxy),
       depth: options.depth ?? 0,
       ...(options.subagentSpend ? { subagentSpend: options.subagentSpend } : {}),

package/codeAgent/agent/SubagentPool.ts

@@ -2,11 +2,14 @@ import type { ExtensionAPI, InlineExtension } from "@earendil-works/pi-coding-ag
 import { type CodeAgentProfile, type CodeAgentSubagent, codeAgentReadOnlyBuiltins } from "akanjs/common";
 import { Type } from "typebox";
 import type { Workspace } from "../../commandDecorators";
+import type { CodeAgentModelRef } from "./akanCodeModel";
 
 export interface SubagentPoolOptions {
   workspace: Workspace;
   cwd: string;
   parent: CodeAgentProfile;
+  /** The parent's model, read when a task starts: a child runs on the model the parent runs on now. */
+  model?: () => CodeAgentModelRef | undefined;
   depth: number;
   /** What the tree above this pool has spent and has running; a root pool starts its own. */
   spend?: SubagentSpend;
@@ -164,10 +167,12 @@ export class SubagentPool {
     const { CodeAgent } = await import("./CodeAgent");
     const budget = this.#options.parent.tools.subagent;
     const child = SubagentPool.childOf(this.#options.parent, kind);
+    const model = this.#options.model?.();
     const agent = await CodeAgent.create({
       workspace: this.#options.workspace,
       cwd: this.#options.cwd,
       profile: child,
+      ...(model ? { model } : {}),
       apps: [],
       depth: this.#options.depth + 1,
       subagentSpend: this.#spend,

package/codeAgent/agent/codeAgent.test.ts

@@ -6,7 +6,7 @@ import { type CodeAgentEvent, type CodeAgentProfile, codeAgentPresets } from "ak
 import { WorkspaceExecutor } from "../../executors";
 import { isolateEnv, tempDirs } from "../../testHelpers";
 import { AkanCodePlugins } from "../tools/AkanCodePlugins";
-import { akanCodeDefaultModel } from "./akanCodeModel";
+import { akanCodeDefaultModel, type CodeAgentModelRef } from "./akanCodeModel";
 import { akanCodePaths } from "./akanCodePaths";
 import { CodeAgent, type CodeAgentOptions } from "./CodeAgent";
 import { CodeAgentSuspended } from "./CodeAgentSuspended";
@@ -37,11 +37,14 @@ const usageChunk = (promptTokens: number) =>
 let llm: ReturnType<typeof Bun.serve>;
 let llmCalls = 0;
 let reportedTokens = 0;
+const requestedModels: string[] = [];
 beforeAll(() => {
   llm = Bun.serve({
     port: 0,
-    fetch: () => {
+    fetch: async (request) => {
       llmCalls += 1;
+      const body = (await request.json().catch(() => ({}))) as { model?: string };
+      requestedModels.push(body.model ?? "");
       const usage = reportedTokens ? usageChunk(reportedTokens) : "";
       return new Response(
         `${chunk({ role: "assistant", content: "ok" })}${chunk({}, "stop")}${usage}data: [DONE]\n\n`,
@@ -160,6 +163,42 @@ describe("CodeAgent", () => {
       spy.mockRestore();
     }
   });
+
+  test("a task child sends its requests on the parent's model, and on the one the parent switches to", async () => {
+    const root = await makeTempRoot();
+    const build = AkanCodePlugins.build;
+    let parentModel: (() => CodeAgentModelRef | undefined) | undefined;
+    const spy = spyOn(AkanCodePlugins, "build").mockImplementation(async (options) => {
+      parentModel = options.model;
+      return await build.call(AkanCodePlugins, options);
+    });
+    const agent = await createAgent(root, { model: { provider: "deepseek", id: "deepseek-v4-pro" } });
+    spy.mockRestore();
+    const profile = quietProfile(root);
+    const pool = SubagentPool.extensionFor({
+      workspace: new WorkspaceExecutor({ workspaceRoot: root, repoName: "repo" }),
+      cwd: root,
+      parent: { ...profile, tools: { ...profile.tools, subagent: { maxDepth: 2, maxConcurrent: 3, budget: 100_000 } } },
+      ...(parentModel ? { model: parentModel } : {}),
+      depth: 0,
+    });
+    let execute: ((id: string, params: never) => Promise<unknown>) | undefined;
+    if (pool && "factory" in pool)
+      pool.factory({
+        registerTool: (tool: { execute: typeof execute }) => {
+          execute = tool.execute;
+        },
+      } as never);
+    try {
+      requestedModels.length = 0;
+      await execute?.("c1", { description: "d", prompt: "p" } as never);
+      await agent.setModel(akanCodeDefaultModel);
+      await execute?.("c2", { description: "d", prompt: "p" } as never);
+      expect(requestedModels).toEqual(["deepseek-v4-pro", akanCodeDefaultModel.id]);
+    } finally {
+      agent.dispose();
+    }
+  });
 });
 
 describe("a sub-agent its parent stops before the sub-agent's run is live", () => {

package/codeAgent/skills/akan-code/SKILL.md

@@ -85,6 +85,7 @@ Stored under `.akan/code/sessions` — project history, so a second checkout of
 ## Model, effort, keys
 
 - `/model <provider>/<id>`, e.g. `/model deepseek/deepseek-v4-pro`. `/effort <level>` for how hard it thinks.
+  A `task` sub-agent starts on the model the session is on at that moment.
 - A provider is authorized by **`<PROVIDER>_API_KEY`** — `DEEPSEEK_API_KEY`, `ANTHROPIC_API_KEY`. The
   workspace's own `.env` is read as well as the environment, and a key found there is used for the run and
   never copied anywhere.

package/codeAgent/tools/AkanCodePlugins.ts

@@ -1,6 +1,7 @@
 import type { InlineExtension } from "@earendil-works/pi-coding-agent";
 import type { CodeAgentMcpStatus, CodeAgentProfile, CodeAgentQuestion, CodeAgentSubagent } from "akanjs/common";
 import type { Workspace } from "../../commandDecorators";
+import type { CodeAgentModelRef } from "../agent/akanCodeModel";
 import type { CodeMailbox } from "../agent/CodeMailbox";
 import { SubagentPool, type SubagentSpend } from "../agent/SubagentPool";
 import { DevLogFeedback } from "../feedback/DevLogFeedback";
@@ -23,6 +24,8 @@ export interface AkanCodePluginsOptions {
   /** Apps whose dev server should be watched, and whose page should be probed. */
   apps: string[];
   canSeeImages: boolean;
+  /** The owning agent's model as it is now; a `task` child runs on it. */
+  model?: () => CodeAgentModelRef | undefined;
   deepseek?: DeepSeekWeb | undefined;
   /** How many `task` levels deep the owning agent is. */
   depth: number;
@@ -92,6 +95,7 @@ export class AkanCodePlugins {
       workspace: options.workspace,
       cwd: options.cwd,
       parent: options.profile,
+      ...(options.model ? { model: options.model } : {}),
       depth: options.depth,
       ...(options.subagentSpend ? { spend: options.subagentSpend } : {}),
       ...(options.onNotice ? { onNotice: options.onNotice } : {}),

package/codeAgent/tools/akanCodePlugins.test.ts

@@ -519,6 +519,54 @@ describe("SubagentPool", () => {
     }
   });
 
+  test("a child runs on the model its parent runs on when the task starts", async () => {
+    const { opened, spy } = openFakeAgents([]);
+    let current = { provider: "deepseek", id: "deepseek-v4-pro" };
+    try {
+      const root = SubagentPool.extensionFor({
+        workspace,
+        cwd: "/tmp/akan",
+        parent: budgeted(1_000),
+        model: () => current,
+        depth: 0,
+      });
+      await runTask(root, "c1");
+      current = { provider: "openai", id: "gpt-5.5" };
+      await runTask(root, "c2");
+      expect(opened.map((options) => options.model)).toEqual([
+        { provider: "deepseek", id: "deepseek-v4-pro" },
+        { provider: "openai", id: "gpt-5.5" },
+      ]);
+    } finally {
+      spy.mockRestore();
+    }
+  });
+
+  test("the plugins hand their pool the owning agent's model", async () => {
+    const { opened, spy } = openFakeAgents([]);
+    try {
+      const plugins = await AkanCodePlugins.build({
+        workspace,
+        cwd: "/tmp/akan",
+        profile: budgeted(1_000),
+        apps: [],
+        canSeeImages: false,
+        model: () => ({ provider: "deepseek", id: "deepseek-v4-pro" }),
+        depth: 0,
+        currentSessionId: () => "",
+        mailbox: () => undefined,
+      });
+      await runTask(
+        plugins.extensions.find((extension) => extension.name === "akan-subagent"),
+        "c1",
+      );
+      expect(opened[0]?.model).toEqual({ provider: "deepseek", id: "deepseek-v4-pro" });
+      plugins.dispose();
+    } finally {
+      spy.mockRestore();
+    }
+  });
+
   test("a child keeps no session and cannot ask a human", () => {
     const child = SubagentPool.childOf(codeAgentPresets.local("/tmp/akan"), "explore");
     expect(child.session).toEqual({ store: "memory", crossSession: false });

package/commandDecorators/workspaceVersionCheck.test.ts

@@ -23,14 +23,24 @@ describe("WorkspaceVersionCheck", () => {
     expect(WorkspaceVersionCheck.warning("3.1.1-rc.5", argv("sync", "demo"), await makeWorkspace({}))).toBeNull();
   });
 
-  test("names both versions and the matching CLI with the same arguments", async () => {
+  test("names both versions and the matching CLI with the same arguments, quoted for the shell it runs in", async () => {
     const root = await makeWorkspace({ akanjs: "3.1.0-rc.6" });
-
-    const warning = WorkspaceVersionCheck.warning("3.1.0", argv("sync", "demo", "--title", "it's"), root);
-
-    expect(warning).toContain("@akanjs/cli 3.1.0, but this workspace has akanjs 3.1.0-rc.6");
-    expect(warning).toContain(`Run the matching CLI: bunx -p @akanjs/cli@3.1.0-rc.6 akan sync demo --title 'it'\\''s'`);
-    expect(warning).toEndWith("together: akan update");
+    const platform = Object.getOwnPropertyDescriptor(process, "platform");
+    const warningOn = (os: NodeJS.Platform) => {
+      Object.defineProperty(process, "platform", { value: os });
+      return WorkspaceVersionCheck.warning("3.1.0", argv("sync", "demo", "--title", "it's"), root);
+    };
+    try {
+      const posix = warningOn("linux");
+      expect(posix).toContain("@akanjs/cli 3.1.0, but this workspace has akanjs 3.1.0-rc.6");
+      expect(posix).toContain(`Run the matching CLI: bunx -p @akanjs/cli@3.1.0-rc.6 akan sync demo --title 'it'\\''s'`);
+      expect(posix).toEndWith("together: akan update");
+      expect(warningOn("win32")).toContain(
+        `Run the matching CLI: bunx -p @akanjs/cli@3.1.0-rc.6 akan sync demo --title "it's"`,
+      );
+    } finally {
+      if (platform) Object.defineProperty(process, "platform", platform);
+    }
   });
 
   test("offers akan update with the CLI's prerelease tag only when the CLI is the newer one", async () => {

package/commandDecorators/workspaceVersionCheck.ts

@@ -45,6 +45,9 @@ export class WorkspaceVersionCheck {
   }
 
   static #quote(arg: string) {
-    return /^[\w@%+=:,./-]+$/.test(arg) ? arg : `'${arg.replaceAll("'", `'\\''`)}'`;
+    if (/^[\w@%+=:,./-]+$/.test(arg)) return arg;
+    //? cmd and PowerShell take neither single quotes nor '\'' as POSIX shells do.
+    if (process.platform === "win32") return `"${arg.replaceAll('"', '\\"')}"`;
+    return `'${arg.replaceAll("'", `'\\''`)}'`;
   }
 }

package/csrE2e/ssrRegistry.e2e.test.ts

@@ -61,7 +61,12 @@ describe.skipIf(!CsrE2eHarness.enabled)("SSR dev registry (minimal)", () => {
   let ssr: CsrE2eHarness;
 
   beforeAll(async () => {
-    ssr = await CsrE2eHarness.start({ app: "minimal", port, env: { AKAN_DEV_SSR_ARM_DELAY_MS: "3000" } });
+    ssr = await CsrE2eHarness.start({
+      app: "minimal",
+      port,
+      // The server-log assertions match verbose-level lines, which a workspace `.env` may or may not turn on.
+      env: { AKAN_DEV_SSR_ARM_DELAY_MS: "3000", AKAN_PUBLIC_LOG_LEVEL: "verbose" },
+    });
   }, 240_000);
 
   afterAll(async () => {

package/integration/devStability.integration.test.ts

@@ -1,4 +1,5 @@
 import { afterAll, afterEach, beforeAll, describe, expect, test } from "bun:test";
+import { AkanAppHost } from "../akanApp";
 import { DevGeneratedIndexSync } from "../frontendBuild";
 import { DevStabilityHarness, type DevStabilityHmrProbe } from "./devStabilityHarness";
 
@@ -467,7 +468,8 @@ export class FixtureService extends serve("fixture" as const, { serverMode: "bat
     const harness = await createHarness();
     const port = await harness.resolvePort();
     // Child 0's deterministic ws port, held the way an orphaned replica from a killed run would hold it.
-    const blocker = Bun.serve({ port: port + 10_000, fetch: () => new Response("occupied") });
+    //? On the child's own 127.0.0.1: macOS lets a loopback bind share a port a wildcard listener holds.
+    const blocker = Bun.serve({ port: port + 10_000, hostname: "127.0.0.1", fetch: () => new Response("occupied") });
     try {
       const host = await harness.startHost();
       await host.waitForLog(/falling back to an ephemeral port/);
@@ -583,9 +585,9 @@ describe("dev resource budgets", () => {
     expect(await DevStabilityHarness.buildWorkerProcess(host.proc.pid)).toBeNull();
   });
 
-  //? Between a fresh builder and one that has built a route, or the host stops enforcing it or never recycles.
-  //? macOS keeps the bundler arenas (~380MiB built); Linux measured 101-115MiB fresh, 157-176MiB built and settled.
-  const CEILING_MB = process.platform === "linux" ? 135 : 200;
+  //? Between a fresh builder and one that has built a route, or the host stops enforcing it or never recycles. Linux
+  //? measured 101-115MiB fresh, 157-176MiB built and settled; macOS's footprint (Bun 1.4.4) 65MiB fresh, 109MiB built.
+  const CEILING_MB = process.platform === "darwin" ? 87 : 135;
 
   budgetTest("recycles the builder at an unmeetable ceiling and keeps developing through it", async () => {
     const harness = await createHarness();
@@ -635,9 +637,11 @@ describe("dev resource budgets", () => {
       await host.waitForLogSince(mark, /pages-rebundle ok/, WAIT_MS).catch(() => undefined);
     }
     const settled = await DevStabilityHarness.builderProcess(host.proc.pid);
+    //? Read as the host reads it: on macOS `ps` also counts the pages the builder freed.
+    const settledRss = settled ? await AkanAppHost.readProcessRssBytes(settled.pid) : null;
     const warned = /ceiling costs about one boot build per interval/.test(host.logs.join("").slice(start));
     //? Past the interval (a slow machine) the next report recycles instead of warning: either answer settles it.
-    if ((settled?.rssBytes ?? 0) >= CEILING_MB * MB && !warned)
+    if ((settledRss ?? 0) >= CEILING_MB * MB && !warned)
       await host.waitForLogSince(
         settledFrom,
         /ceiling costs about one boot build per interval|recycling builder pid=\d+|skipped: the builder fell to/,

package/mobile/desktopRelease.test.ts

@@ -381,7 +381,7 @@ describe("DesktopRelease signer", () => {
 
   const windowsTool = (powershell: (out: string) => Promise<number>) =>
     recordingTool(async (cmd, env) => {
-      if (cmd[0] === "tar.exe") {
+      if (cmd[0] === path.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "tar.exe")) {
         await Bun.write(path.join(extractedTo(cmd), cmd.at(-1) ?? ""), "MZ");
         return { code: 0, output: "" };
       }

package/mobile/desktopRelease.ts

@@ -245,7 +245,9 @@ Set-Content -LiteralPath $env:AKAN_SIGNER_OUT -Value $subject -Encoding UTF8`;
   }
 
   static async #subjectOf(run: SignatureTool, archive: string, tmp: string, exe: string) {
-    await run(["tar.exe", "-xzf", archive, "-C", tmp, exe]);
+    //? Windows' own bsdtar: a GNU tar ahead of it on PATH (Git's) takes `C:` for a remote host.
+    const tar = path.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "tar.exe");
+    await run([tar, "-xzf", archive, "-C", tmp, exe]);
     const extracted = path.join(tmp, exe);
     if (!(await Bun.file(extracted).exists())) return { signer: null, unread: `the archive holds no ${exe}` };
     const out = path.join(tmp, "signer.txt");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akanjs/devkit",
-  "version": "3.1.1-rc.10",
+  "version": "3.1.1-rc.12",
   "sourceType": "module",
   "type": "module",
   "publishConfig": {
@@ -48,7 +48,7 @@
     "@earendil-works/pi-tui": "1.3.0",
     "@inquirer/prompts": "^8.7.3",
     "@tailwindcss/node": "^4.3.3",
-    "akanjs": "3.1.1-rc.10",
+    "akanjs": "3.1.1-rc.12",
     "chalk": "^6.0.1",
     "commander": "^15.0.0",
     "dayjs": "^1.11.23",

package/platformTest/LinuxDockerTarget.ts

@@ -40,6 +40,9 @@ export class LinuxDockerTarget extends PlatformTestTarget {
       "run",
       "-d",
       "--rm",
+      //? An init as PID 1 reaps orphans as a real host does; under `sleep` a killed orphan stays a zombie that still
+      //? answers kill(pid, 0).
+      "--init",
       "--name",
       container,
       "--cpus",

package/signalMutationIndex.test.ts

@@ -110,6 +110,21 @@ export class ItemEndpoint extends endpoint(srv.item, ({ query, mutation }) => ({
     expect(index.isMutation("apps/third/page/x.tsx", "approveTicket")).toBe(false);
   });
 
+  test("reads a lib page's call by its own lib's endpoint before another lib's of that name", () => {
+    const shared = fileOf(
+      "libs/shared/lib/_shared/shared.signal.ts",
+      `export class SharedEndpoint extends endpoint(srv.shared, ({ mutation }) => ({ syncFeed: mutation(Boolean, {}).exec(() => true) })) {}`,
+    );
+    const social = fileOf(
+      "libs/social/lib/_social/social.signal.ts",
+      `export class SocialEndpoint extends endpoint(srv.social, ({ query }) => ({ syncFeed: query(Boolean, {}).exec(() => true) })) {}`,
+    );
+    const index = new SignalMutationIndex([shared, social]);
+    expect(index.isMutation("libs/social/page/x.tsx", "syncFeed")).toBe(false);
+    expect(index.policyIndexOf("libs/social/page/x.tsx", "syncFeed")).toBeNull();
+    expect(index.isMutation("libs/shared/page/x.tsx", "syncFeed")).toBe(true);
+  });
+
   test("ignores signal tests and specs", () => {
     const spec = fileOf(
       "apps/demo/lib/ticket/ticket.signal.spec.ts",

package/signalMutationIndex.ts

@@ -34,7 +34,7 @@ export class SignalMutationIndex {
 
   #shapeOf(consumerFile: string, name: string) {
     const [root, owner] = consumerFile.split("/");
-    const own = root === "apps" ? this.#shapesByOwner.get(`apps/${owner}`)?.get(name) : undefined;
+    const own = this.#shapesByOwner.get(`${root}/${owner}`)?.get(name);
     if (own) return own;
     for (const [key, shapes] of this.#shapesByOwner) {
       const shape = shapes.get(name);

package/types.ts

@@ -12,6 +12,7 @@ export interface PackageJson {
   optionalDependencies?: Record<string, string>;
   trustedDependencies?: string[];
   overrides?: Record<string, string>;
+  resolutions?: Record<string, string>;
   engines?: Record<string, string>;
   exports?: Record<string, string | Record<string, string>>;
   bun?: {