akm-cli 0.10.261007-beta → 0.10.261008-beta

package/CHANGELOG.md

@@ -6,6 +6,17 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.10.261008] - 2026-10-20
+
+### Fixed
+
+- **`akm remember`, config saves and other writes work on filesystems that refuse chmod.** On a CIFS/SMB mount
+  such as an Azure Files share, chmod fails with `EPERM`, and akm treated that as fatal: every atomic write
+  (`akm remember`, `akm setup`, `akm env`, `akm secret`) and every config backup failed. akm now keeps the mode the
+  file was created with when the filesystem refuses chmod (`EPERM`, `ENOTSUP`, `EINVAL`); the mount options decide
+  it there, so `env/`, `secrets/` and config backups are not guaranteed owner-only on such a share. Any other chmod
+  error still fails the write.
+
 ## [0.10.261007] - 2026-10-20
 
 ### Added

package/dist/core/common.js

@@ -165,8 +165,15 @@ export function writeFileAtomic(target, content, mode) {
     try {
         fd = fs.openSync(tmp, "wx", fileMode);
         tempOwned = true;
-        if (process.platform !== "win32")
-            fs.fchmodSync(fd, fileMode);
+        if (process.platform !== "win32") {
+            try {
+                fs.fchmodSync(fd, fileMode);
+            }
+            catch (error) {
+                if (!isChmodUnsupported(error))
+                    throw error;
+            }
+        }
         let offset = 0;
         while (offset < data.byteLength) {
             const written = fs.writeSync(fd, data, offset, data.byteLength - offset);
@@ -361,6 +368,14 @@ export function hasErrnoCode(error, code) {
         return false;
     return error.code === code;
 }
+/**
+ * True when a chmod failed because the filesystem has no settable POSIX modes
+ * (CIFS/SMB such as an Azure Files share, some FUSE mounts). The mount options
+ * decide the mode there, so callers keep going with whatever mode the file got.
+ */
+export function isChmodUnsupported(error) {
+    return hasErrnoCode(error, "EPERM") || hasErrnoCode(error, "ENOTSUP") || hasErrnoCode(error, "EINVAL");
+}
 /**
  * True when `value` is a RELATIVE path that cannot leave its base directory:
  * no absolute form (POSIX `/`, Windows `\` or a `C:` drive prefix), no `~`

package/dist/core/config/config-io.js

@@ -15,7 +15,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { sleepSync } from "../../runtime.js";
-import { readTextFile, stripJsonComments, writeFileAtomic } from "../common.js";
+import { isChmodUnsupported, readTextFile, stripJsonComments, writeFileAtomic } from "../common.js";
 import { ConfigError } from "../errors.js";
 import { createLockPayload, probeLock, reclaimStaleLock, releaseLock, tryAcquireLockSync } from "../file-lock.js";
 import { getCacheDir, getConfigDir } from "../paths.js";
@@ -88,7 +88,7 @@ export function backupExistingConfig(configPath, now = new Date()) {
     // env.ts/secret.ts convention — so no other local user can traverse in during
     // the copy→chmod window. chmod again to tighten a dir from an older version.
     fs.mkdirSync(backupDir, { recursive: true, mode: 0o700 });
-    fs.chmodSync(backupDir, 0o700);
+    chmodIfSupported(backupDir, 0o700);
     const timestamp = now.toISOString().replace(/[.:]/g, "-");
     let sequence = 0;
     let timestamped;
@@ -109,11 +109,21 @@ export function backupExistingConfig(configPath, now = new Date()) {
     // 08-F4: a config backup carries the same sensitive fields as the live config
     // (endpoints, tokens). `copyFileSync` inherits the source's (often 0644) mode,
     // so tighten the backups to owner-only — mirrors the env-cli 0600 write floor.
-    fs.chmodSync(timestamped, 0o600);
-    fs.chmodSync(latest, 0o600);
+    chmodIfSupported(timestamped, 0o600);
+    chmodIfSupported(latest, 0o600);
     pruneOldBackups(backupDir);
     return { timestamped, latest };
 }
+/** chmod, skipped on a filesystem without POSIX modes (CIFS), where the mount sets them. */
+function chmodIfSupported(target, mode) {
+    try {
+        fs.chmodSync(target, mode);
+    }
+    catch (error) {
+        if (!isChmodUnsupported(error))
+            throw error;
+    }
+}
 function pruneOldBackups(backupDir) {
     pruneToNewest(backupDir, MAX_CONFIG_BACKUPS, (entry) => entry.isFile() && isTimestampedConfigBackup(entry.name));
 }

package/dist/scripts/akm-migrate-node.js

@@ -26201,8 +26201,14 @@ function writeFileAtomic(target, content, mode) {
   try {
     fd = fs2.openSync(tmp, "wx", fileMode);
     tempOwned = true;
-    if (process.platform !== "win32")
-      fs2.fchmodSync(fd, fileMode);
+    if (process.platform !== "win32") {
+      try {
+        fs2.fchmodSync(fd, fileMode);
+      } catch (error) {
+        if (!isChmodUnsupported(error))
+          throw error;
+      }
+    }
     let offset = 0;
     while (offset < data.byteLength) {
       const written = fs2.writeSync(fd, data, offset, data.byteLength - offset);
@@ -26351,6 +26357,9 @@ function hasErrnoCode(error, code) {
     return false;
   return error.code === code;
 }
+function isChmodUnsupported(error) {
+  return hasErrnoCode(error, "EPERM") || hasErrnoCode(error, "ENOTSUP") || hasErrnoCode(error, "EINVAL");
+}
 function isContainedRelativePath(value) {
   if (value === "" || value.startsWith("/") || value.startsWith("\\") || value.startsWith("~"))
     return false;
@@ -39230,7 +39239,7 @@ function backupExistingConfig(configPath, now = new Date) {
     return;
   const backupDir = path20.join(getCacheDir(), "config-backups");
   fs16.mkdirSync(backupDir, { recursive: true, mode: 448 });
-  fs16.chmodSync(backupDir, 448);
+  chmodIfSupported(backupDir, 448);
   const timestamp = now.toISOString().replace(/[.:]/g, "-");
   let sequence = 0;
   let timestamped;
@@ -39247,11 +39256,19 @@ function backupExistingConfig(configPath, now = new Date) {
   }
   const latest = path20.join(backupDir, "config.latest.json");
   fs16.copyFileSync(configPath, latest);
-  fs16.chmodSync(timestamped, 384);
-  fs16.chmodSync(latest, 384);
+  chmodIfSupported(timestamped, 384);
+  chmodIfSupported(latest, 384);
   pruneOldBackups(backupDir);
   return { timestamped, latest };
 }
+function chmodIfSupported(target, mode) {
+  try {
+    fs16.chmodSync(target, mode);
+  } catch (error2) {
+    if (!isChmodUnsupported(error2))
+      throw error2;
+  }
+}
 function pruneOldBackups(backupDir) {
   pruneToNewest(backupDir, MAX_CONFIG_BACKUPS, (entry) => entry.isFile() && isTimestampedConfigBackup(entry.name));
 }

package/dist/scripts/akm-migrate.js

@@ -25529,8 +25529,14 @@ function writeFileAtomic(target, content, mode) {
   try {
     fd = fs2.openSync(tmp, "wx", fileMode);
     tempOwned = true;
-    if (process.platform !== "win32")
-      fs2.fchmodSync(fd, fileMode);
+    if (process.platform !== "win32") {
+      try {
+        fs2.fchmodSync(fd, fileMode);
+      } catch (error) {
+        if (!isChmodUnsupported(error))
+          throw error;
+      }
+    }
     let offset = 0;
     while (offset < data.byteLength) {
       const written = fs2.writeSync(fd, data, offset, data.byteLength - offset);
@@ -25679,6 +25685,9 @@ function hasErrnoCode(error, code) {
     return false;
   return error.code === code;
 }
+function isChmodUnsupported(error) {
+  return hasErrnoCode(error, "EPERM") || hasErrnoCode(error, "ENOTSUP") || hasErrnoCode(error, "EINVAL");
+}
 function isContainedRelativePath(value) {
   if (value === "" || value.startsWith("/") || value.startsWith("\\") || value.startsWith("~"))
     return false;
@@ -38558,7 +38567,7 @@ function backupExistingConfig(configPath, now = new Date) {
     return;
   const backupDir = path20.join(getCacheDir(), "config-backups");
   fs16.mkdirSync(backupDir, { recursive: true, mode: 448 });
-  fs16.chmodSync(backupDir, 448);
+  chmodIfSupported(backupDir, 448);
   const timestamp = now.toISOString().replace(/[.:]/g, "-");
   let sequence = 0;
   let timestamped;
@@ -38575,11 +38584,19 @@ function backupExistingConfig(configPath, now = new Date) {
   }
   const latest = path20.join(backupDir, "config.latest.json");
   fs16.copyFileSync(configPath, latest);
-  fs16.chmodSync(timestamped, 384);
-  fs16.chmodSync(latest, 384);
+  chmodIfSupported(timestamped, 384);
+  chmodIfSupported(latest, 384);
   pruneOldBackups(backupDir);
   return { timestamped, latest };
 }
+function chmodIfSupported(target, mode) {
+  try {
+    fs16.chmodSync(target, mode);
+  } catch (error2) {
+    if (!isChmodUnsupported(error2))
+      throw error2;
+  }
+}
 function pruneOldBackups(backupDir) {
   pruneToNewest(backupDir, MAX_CONFIG_BACKUPS, (entry) => entry.isFile() && isTimestampedConfigBackup(entry.name));
 }

package/docs/reference/cli.md

@@ -2193,7 +2193,8 @@ service's config; reach for `secret` when one value *is* an auth credential.
 Manage `.env`-backed **environment files** — a group of related **configuration**
 for an app or service (URLs, feature flags, and any credentials it needs),
 loaded together. Each `env` asset is an entire `.env` file stored under `env/`
-in your bundle (mode 0600). Values may or may not be sensitive; **akm protects
+in your bundle (mode 0600; on a filesystem without POSIX permissions, such as a
+CIFS/Azure Files share, the mount options decide the mode instead). Values may or may not be sensitive; **akm protects
 them all the same** — key *names* are discoverable; values and comment text
 never appear in structured output (comments routinely contain commented-out
 credentials, so they are treated like values). akm does **not** manage
@@ -2353,7 +2354,9 @@ Manage **secrets** — a single sensitive value used on its own for
 service-account JSON. Where an [env](#env) file holds a *group* of related
 configuration and exposes key *names*, a secret is *one* value and its **entire
 file is the value**, so only the secret's *name* is ever surfaced. Each secret
-is a mode-0600 file under `secrets/` in your bundle.
+is a mode-0600 file under `secrets/` in your bundle (on a filesystem without
+POSIX permissions, such as a CIFS/Azure Files share, the mount options decide
+the mode instead).
 
 This mirrors Docker's secret model (one value per file, mounted at
 `/run/secrets/<name>`, read at runtime, never baked into the image or env at

package/docs/reference/data-and-telemetry.md

@@ -97,7 +97,7 @@ Everything in the cache is regenerable. It is safe to delete the entire cache di
 
 | Path | Contents | Safe to delete? |
 |---|---|---|
-| `config-backups/config-<timestamp>.json` | Pre-save config snapshots (5 retained; owner-only permissions — file `0600`, dir `0700`, since 08-F4) | Yes |
+| `config-backups/config-<timestamp>.json` | Pre-save config snapshots (5 retained; owner-only permissions — file `0600`, dir `0700`, since 08-F4; on a filesystem without POSIX permissions, such as a CIFS/Azure Files share, the mount options decide them instead) | Yes |
 | `config-backups/config.latest.json` | Latest backup alias (owner-only `0600`) | Yes |
 | `registry/` | Downloaded registry tarballs (bundle packages from npm, GitHub, etc.) | Yes — re-downloaded on next `akm bundle add` or `akm bundle update` |
 | `registry-index/` | Legacy per-URL JSON cache (v0.7 artifact) | Yes — fully replaced by `index.db` in 0.8.0 |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "akm-cli",
-  "version": "0.10.261007-beta",
+  "version": "0.10.261008-beta",
   "type": "module",
   "description": "akm (Agent Knowledge Manager) — a portable, local-first capability library for AI agents. Discover, load, share, and improve reusable skills, scripts, workflows, and knowledge across any shell-capable coding agent, including Claude Code, OpenCode, and Cursor.",
   "keywords": [