akm-cli 0.10.261009-beta → 0.10.261010-beta

package/dist/commands/ui/server.js

@@ -10,7 +10,7 @@
  * `Host` header must be the address the server is bound to, which stops a web
  * page from reaching it through DNS rebinding. Static UI files are served
  * without the token and embed no data. Only GET (and HEAD) is accepted, except
- * for the three proposal writes (accept, reject, accept several): a POST to one
+ * for explicit proposal and workspace actions: a POST to one
  * of those must carry the token in the `X-Akm-Ui-Token` header (never the
  * query string), a JSON content type and an `Origin` that is this server's own,
  * so another web page cannot make the browser send one.
@@ -27,6 +27,7 @@ import chartsJs from "../../assets/ui/charts.js" with { type: "text" };
 import configJs from "../../assets/ui/config.js" with { type: "text" };
 import diffJs from "../../assets/ui/diff.js" with { type: "text" };
 import diffViewJs from "../../assets/ui/diff-view.js" with { type: "text" };
+import editorJs from "../../assets/ui/editor.js" with { type: "text" };
 import indexHtml from "../../assets/ui/index.html" with { type: "text" };
 import libJs from "../../assets/ui/lib.js" with { type: "text" };
 import markdownJs from "../../assets/ui/markdown.js" with { type: "text" };
@@ -40,9 +41,12 @@ import { getDirname } from "../../runtime.js";
 import { handleApiRequest, NO_SUCH_ROUTE } from "./api.js";
 import { classifyProposalError, handleWriteRequest, matchWriteRoute } from "./proposal-actions.js";
 import { scrubUrlCredentials } from "./redact.js";
+import { classifyWorkspaceError, handleWorkspaceAction, matchWorkspaceAction, } from "./workspace-actions.js";
 export const TOKEN_HEADER = "x-akm-ui-token";
 /** Largest request body a write route reads. */
 export const MAX_BODY_BYTES = 64 * 1024;
+/** Largest body of a route that carries a whole Markdown document (`/api/asset/save`, `/api/knowledge/create`). */
+export const MAX_DOCUMENT_BODY_BYTES = 8 * 1024 * 1024;
 const UI_DIR = path.join(getDirname(import.meta.url), "../../assets/ui");
 /**
  * The UI files embedded at build time. Disk stays primary (an edit shows
@@ -62,6 +66,7 @@ export const EMBEDDED_UI = {
     "config.js": configJs,
     "diff-view.js": diffViewJs,
     "diff.js": diffJs,
+    "editor.js": editorJs,
     "lib.js": libJs,
     "markdown.js": markdownJs,
     "overview.js": overviewJs,
@@ -148,11 +153,11 @@ function originAllowed(origin, hostHeader) {
 function isJsonContentType(header) {
     return (header ?? "").split(";")[0]?.trim().toLowerCase() === "application/json";
 }
-/** The request body as text, or `null` when it is larger than {@link MAX_BODY_BYTES}. */
-function readBody(req) {
+/** The request body as text, or `null` when it is larger than `limit` bytes. */
+function readBody(req, limit) {
     return new Promise((resolve, reject) => {
         const declared = Number(req.headers["content-length"]);
-        if (Number.isFinite(declared) && declared > MAX_BODY_BYTES) {
+        if (Number.isFinite(declared) && declared > limit) {
             resolve(null);
             return;
         }
@@ -161,7 +166,7 @@ function readBody(req) {
         let tooLarge = false;
         req.on("data", (chunk) => {
             size += chunk.length;
-            if (size > MAX_BODY_BYTES)
+            if (size > limit)
                 tooLarge = true;
             else
                 chunks.push(chunk);
@@ -237,7 +242,8 @@ export async function startUiServer(options = {}) {
         }
         const url = new URL(req.url ?? "/", "http://akm-ui.invalid");
         const isApi = url.pathname === "/api" || url.pathname.startsWith("/api/");
-        const writeRoute = req.method === "POST" ? matchWriteRoute(url.pathname) : null;
+        const workspace = req.method === "POST" ? matchWorkspaceAction(url.pathname) : null;
+        const writeRoute = req.method === "POST" ? (workspace ? { workspace } : matchWriteRoute(url.pathname)) : null;
         if (writeRoute) {
             await handleWrite(req, res, writeRoute);
             return;
@@ -255,7 +261,7 @@ export async function startUiServer(options = {}) {
             }
         }
         if (!readMethod) {
-            sendError(req, res, 405, "METHOD_NOT_ALLOWED", "Only GET is accepted here. akm ui writes only through POST /api/proposals/:id/accept, /reject and /api/proposals/accept.", {
+            sendError(req, res, 405, "METHOD_NOT_ALLOWED", "Only GET is accepted here. Use an explicit UI action to make changes.", {
                 Allow: "GET, HEAD",
             });
             return;
@@ -271,7 +277,9 @@ export async function startUiServer(options = {}) {
             }
             catch (error) {
                 const code = error instanceof AkmError ? error.code : "INTERNAL_ERROR";
-                sendError(req, res, statusFor(error), code, error instanceof Error ? error.message : String(error));
+                // The editor's source read refuses what a save would refuse, with the same status.
+                const status = url.pathname === "/api/asset/source" ? classifyWorkspaceError(error).status : statusFor(error);
+                sendError(req, res, status, code, error instanceof Error ? error.message : String(error));
             }
             return;
         }
@@ -288,7 +296,7 @@ export async function startUiServer(options = {}) {
         });
         res.end(req.method === "HEAD" ? undefined : asset.body);
     }
-    /** The three proposal writes. Every check runs before the body is read. */
+    /** Explicit write actions. Every check runs before the body is read. */
     async function handleWrite(req, res, route) {
         // The header only: a token in the URL ends up in history and logs, and a link can carry it.
         const given = req.headers[TOKEN_HEADER];
@@ -306,9 +314,11 @@ export async function startUiServer(options = {}) {
             sendError(req, res, 415, "UNSUPPORTED_MEDIA_TYPE", "Writes must be sent as Content-Type: application/json.");
             return;
         }
-        const text = await readBody(req);
+        const document = "workspace" in route && (route.workspace === "document-save" || route.workspace === "knowledge-create");
+        const limit = document ? MAX_DOCUMENT_BODY_BYTES : MAX_BODY_BYTES;
+        const text = await readBody(req, limit);
         if (text === null) {
-            sendError(req, res, 413, "BODY_TOO_LARGE", `The request body is larger than ${MAX_BODY_BYTES} bytes.`, {
+            sendError(req, res, 413, "BODY_TOO_LARGE", `The request body is larger than ${limit} bytes.`, {
                 Connection: "close",
             });
             return;
@@ -322,11 +332,13 @@ export async function startUiServer(options = {}) {
             return;
         }
         try {
-            const data = await handleWriteRequest(route, body);
+            const data = "workspace" in route
+                ? await handleWorkspaceAction(route.workspace, body)
+                : await handleWriteRequest(route, body);
             sendJson(req, res, 200, { ok: true, data: scrubUrlCredentials(data) });
         }
         catch (error) {
-            const { status, code, message } = classifyProposalError(error);
+            const { status, code, message } = "workspace" in route ? classifyWorkspaceError(error) : classifyProposalError(error);
             sendError(req, res, status, code, message);
         }
     }

package/dist/commands/ui/ui-cli.js

@@ -2,7 +2,7 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 /**
- * `akm ui` — a local web UI, read-only apart from accepting and rejecting proposals, over the same data the CLI reports:
+ * `akm ui` — a local web UI over the same data and explicit operations the CLI offers:
  * health and metrics, bundles, config, the proposal queue, recent changes and
  * search. See `docs/reference/ui-api.md` for the API the page reads.
  */
@@ -23,7 +23,7 @@ function parsePort(raw) {
 export const uiCommand = defineJsonCommand({
     meta: {
         name: "ui",
-        description: "Experimental: serve a local web UI (health, bundles, config, proposals, recent changes, search) and open it in your browser. It is read-only except that you can accept and reject proposals in it. The URL carries a per-launch token. Press Ctrl-C to stop.",
+        description: "Experimental: serve a local web UI for browsing, feedback, bundle management, Markdown authoring and proposal decisions. Browsing is read-only; explicit actions use existing AKM operations. The URL carries a per-launch token. Press Ctrl-C to stop.",
     },
     args: {
         port: { type: "string", description: "Port to listen on (default: a random free port)" },
@@ -40,7 +40,7 @@ export const uiCommand = defineJsonCommand({
         const host = args.host?.trim() || "127.0.0.1";
         const server = await startUiServer({ host, port: parsePort(args.port) });
         if (!isLoopbackBind(host)) {
-            warn(`[ui] Listening on ${host}, not just this machine: anyone who can reach it and has the token can read your stash, config and proposals. Keep the URL private.`);
+            warn(`[ui] Listening on ${host}, not just this machine: anyone who can reach it and has the token can read your data and use the UI's write actions. Keep the URL private.`);
         }
         // The URL is the command's output, so it goes to stdout like any other result.
         process.stdout.write(`akm ui: ${server.url}\n`);

package/dist/commands/ui/workspace-actions.js

@@ -0,0 +1,264 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+import { execFile } from "node:child_process";
+import { isDeepStrictEqual } from "node:util";
+import { parseRefInput } from "../../core/asset/resolve-ref.js";
+import { getConfigValueSource, loadConfig, mutateConfig, resetConfigCache, sanitizeConfigForWrite, } from "../../core/config/config.js";
+import { AkmError, UsageError } from "../../core/errors.js";
+import { appendEvent } from "../../core/events.js";
+import { resolveAkmInvocation } from "../../tasks/resolve-akm-bin.js";
+import { setConfigValue, unsetConfigValue } from "../config-cli.js";
+import { writeMarkdownAsset } from "../read/knowledge.js";
+import { readDocumentSource } from "./document-source.js";
+import { assertWriteLeaseFree, classifyProposalError } from "./proposal-actions.js";
+import { redactForUi, redactUrlsInText } from "./redact.js";
+const ROUTES = {
+    "/api/feedback": "feedback",
+    "/api/bundles/add": "bundle-add",
+    "/api/bundles/remove": "bundle-remove",
+    "/api/bundles/update": "bundle-update",
+    "/api/bundles/settings": "bundle-settings",
+    "/api/knowledge/create": "knowledge-create",
+    "/api/asset/save": "document-save",
+};
+export function matchWorkspaceAction(path) {
+    return ROUTES[path] ?? null;
+}
+function object(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new UsageError("A JSON object is required.");
+    return value;
+}
+function text(body, key) {
+    const value = body[key];
+    if (typeof value !== "string" || !value.trim())
+        throw new UsageError(`${key} is required.`);
+    return value.trim();
+}
+function positional(body, key) {
+    const value = text(body, key);
+    if (value.startsWith("-"))
+        throw new UsageError(`${key} must be a target, not a command option. Use ./ for a relative path beginning with a dash.`);
+    return value;
+}
+function preserveUnrelatedConfig(config = loadConfig()) {
+    if (!isDeepStrictEqual(sanitizeConfigForWrite(config, { quiet: true }), config)) {
+        throw new UsageError("AKM's config sanitizer would remove unrelated credentials. Move literal API keys to $VAR or secret:// references and remove registry URL credentials using the CLI before changing bundle configuration in the UI.");
+    }
+}
+/** The error kind behind each exit code of the CLI contract (`EXIT_CODES`, `src/cli/shared.ts`). */
+const KIND_BY_EXIT = { 1: "not-found", 2: "usage", 75: "transient", 78: "config" };
+/** Preserve the CLI's error identity while crossing a process boundary. */
+class CommandError extends AkmError {
+    code;
+    kind;
+    /** Exit 70, a signal or a failed spawn: akm itself failed, not the request. */
+    internal;
+    constructor(message, code, exitCode) {
+        super(message);
+        this.code = code;
+        const kind = typeof exitCode === "number" ? KIND_BY_EXIT[exitCode] : undefined;
+        this.internal = kind === undefined;
+        this.kind = kind ?? "config";
+    }
+    hint() {
+        return undefined;
+    }
+}
+/** Exit zero is not sufficient evidence that the expected action returned a valid result. */
+export function parseCommandResponse(stdout, expectedShape) {
+    try {
+        const result = JSON.parse(stdout);
+        if (!result ||
+            typeof result !== "object" ||
+            Array.isArray(result) ||
+            result.shape !== expectedShape ||
+            !Number.isInteger(result.schemaVersion) ||
+            result.ok === false)
+            throw new Error("Invalid command envelope");
+        return redactForUi(result);
+    }
+    catch {
+        throw new CommandError("AKM returned an invalid action response. State may already have changed. Reload the view before retrying; do not automatically repeat the action.", "INVALID_COMMAND_RESPONSE", 70);
+    }
+}
+/**
+ * HTTP status and code for a failed workspace action. A config refusal (a
+ * read-only bundle, exit 78) is something the user can address: `409`. Exit 70
+ * and anything unclassified stay `500`; the rest map as for proposal decisions.
+ */
+export function classifyWorkspaceError(error) {
+    if (error instanceof CommandError && error.internal)
+        return { status: 500, code: error.code, message: error.message };
+    const classified = classifyProposalError(error);
+    return error instanceof AkmError && error.kind === "config" ? { ...classified, status: 409 } : classified;
+}
+/** Fixed UI actions use the real CLI, including feedback's argv-dependent tag validation and bundle install audits. */
+async function command(args, input, userFeedback = false) {
+    const [bin, ...prefix] = resolveAkmInvocation().argv;
+    // Options go before a `--` that ends them, so a positional name may begin with a dash.
+    const end = args.indexOf("--");
+    const argv = end === -1 ? [...args, "--format=json"] : [...args.slice(0, end), "--format=json", ...args.slice(end)];
+    return new Promise((resolve, reject) => {
+        const child = execFile(bin, [...prefix, ...argv], {
+            encoding: "utf8",
+            maxBuffer: 16 * 1024 * 1024,
+            // An ambient event source (an improve or task run) wins, as for every akm child.
+            ...(userFeedback ? { env: { ...process.env, AKM_EVENT_SOURCE: process.env.AKM_EVENT_SOURCE || "user" } } : {}),
+        }, (error, stdout, stderr) => {
+            resetConfigCache();
+            if (error) {
+                const json = stderr.slice(stderr.lastIndexOf("\n{") + 1).trim();
+                let detail = {};
+                try {
+                    detail = JSON.parse(json);
+                }
+                catch {
+                    /* Keep the command's readable error. */
+                }
+                reject(new CommandError(redactUrlsInText(detail.error ?? (stderr.trim() || error.message)), detail.code ?? "COMMAND_FAILED", error.code));
+                return;
+            }
+            try {
+                resolve(parseCommandResponse(stdout, args[0] === "bundle" ? args[1] : args[0]));
+            }
+            catch (error) {
+                reject(error);
+            }
+        });
+        // Argument validation can close the child before a Markdown body finishes writing.
+        child.stdin?.on("error", (error) => {
+            if (error.code !== "EPIPE")
+                reject(error);
+        });
+        child.stdin?.end(input);
+    });
+}
+function settings(body) {
+    const result = mutateConfig((current) => {
+        let updated = current;
+        if (body.bundle !== undefined) {
+            const name = text(body, "bundle");
+            const entry = current.bundles?.[name];
+            if (!entry || !Object.hasOwn(current.bundles ?? {}, name))
+                throw new UsageError(`No configured bundle named "${name}".`);
+            for (const key of ["enabled", "writable"]) {
+                if (body[key] === undefined)
+                    continue;
+                if (typeof body[key] !== "boolean")
+                    throw new UsageError(`${key} must be a boolean.`);
+                updated = setConfigValue(updated, `bundles.${name}.${key}`, String(body[key]));
+            }
+            if (body.componentWritability !== undefined) {
+                for (const [id, writable] of Object.entries(object(body.componentWritability))) {
+                    if (!Object.hasOwn(entry.components ?? {}, id) || id.includes(".") || typeof writable !== "boolean") {
+                        throw new UsageError("Only existing components with a boolean writable value can be changed.");
+                    }
+                    updated = setConfigValue(updated, `bundles.${name}.components.${id}.writable`, String(writable));
+                }
+            }
+        }
+        for (const key of ["defaultBundle", "defaultWriteTarget"]) {
+            if (body[key] === undefined)
+                continue;
+            if (typeof body[key] !== "string")
+                throw new UsageError(`${key} must be a bundle name or empty.`);
+            const name = body[key].trim();
+            if (name && !Object.hasOwn(current.bundles ?? {}, name))
+                throw new UsageError(`No configured bundle named "${name}".`);
+            const source = name ? "" : getConfigValueSource(key);
+            if (source.startsWith("extends:"))
+                throw new UsageError(`Config key "${key}" is inherited from ${source} and cannot be unset here.`, "TARGET_NOT_UPDATABLE", `Override it locally with "akm config set ${key} <value>", or edit the base file directly.`);
+            updated = name ? setConfigValue(updated, key, name) : unsetConfigValue(updated, key);
+        }
+        // Only a write can drop credentials, so a request that changes nothing is never refused.
+        if (updated !== current)
+            preserveUnrelatedConfig(current);
+        return updated;
+    });
+    return { saved: result.written };
+}
+export async function handleWorkspaceAction(action, value) {
+    const body = object(value);
+    // `bundle update` writes only the lockfile, so it never passes config through the sanitizer.
+    if (action === "bundle-add" || action === "bundle-remove")
+        preserveUnrelatedConfig();
+    switch (action) {
+        case "feedback": {
+            const signal = text(body, "signal");
+            if (signal !== "positive" && signal !== "negative")
+                throw new UsageError("signal must be positive or negative.");
+            const args = ["feedback", positional(body, "ref"), `--${signal}`];
+            if (typeof body.reason === "string" && body.reason.trim())
+                args.push(`--reason=${body.reason.trim()}`);
+            if (body.tags !== undefined) {
+                if (!Array.isArray(body.tags) || body.tags.some((tag) => typeof tag !== "string"))
+                    throw new UsageError("tags must be strings.");
+                for (const tag of body.tags)
+                    args.push(`--tag=${tag}`);
+            }
+            return command(args, undefined, true);
+        }
+        case "bundle-add": {
+            const args = ["bundle", "add", positional(body, "source")];
+            if (typeof body.name === "string" && body.name.trim())
+                args.push(`--name=${body.name.trim()}`);
+            if (body.writable === true)
+                args.push("--writable");
+            return command(args);
+        }
+        case "bundle-remove": {
+            if (body.confirm !== true)
+                throw new UsageError("Confirm removal of this configured bundle first.");
+            const name = text(body, "bundle");
+            if (!Object.hasOwn(loadConfig().bundles ?? {}, name))
+                throw new UsageError(`No configured bundle named "${name}".`);
+            return command(["bundle", "remove", "--yes", "--", name]);
+        }
+        case "bundle-update": {
+            const name = text(body, "bundle");
+            if (!Object.hasOwn(loadConfig().bundles ?? {}, name))
+                throw new UsageError(`No configured bundle named "${name}".`);
+            return command(["bundle", "update", "--", name]);
+        }
+        case "bundle-settings":
+            return settings(body);
+        case "document-save": {
+            if (typeof body.content !== "string")
+                throw new UsageError("Markdown content is required.");
+            const content = body.content;
+            const revision = text(body, "revision");
+            const ref = text(body, "ref");
+            await assertWriteLeaseFree("ui-document-save");
+            // The writer takes the lease and compares `revision` with the live bytes inside it.
+            const source = await readDocumentSource(ref);
+            const identity = parseRefInput(source.ref);
+            const result = await writeMarkdownAsset({
+                type: source.type,
+                content,
+                name: identity.name,
+                fallbackPrefix: source.type,
+                target: identity.origin,
+                force: true,
+                expectedContentHash: revision,
+            });
+            if (!result.unchanged)
+                appendEvent({
+                    eventType: source.type === "knowledge" ? "import" : "remember",
+                    ref: result.ref,
+                    metadata: { source: "ui", path: result.path, force: true },
+                });
+            return result;
+        }
+        case "knowledge-create": {
+            if (typeof body.content !== "string" || !body.content.trim())
+                throw new UsageError("Document content is required.");
+            const args = ["import", "-", `--name=${text(body, "name")}`, `--bundle=${text(body, "bundle")}`];
+            if (typeof body.path === "string" && body.path.trim())
+                args.push(`--path=${body.path.trim()}`);
+            await assertWriteLeaseFree("ui-knowledge-create");
+            return command(args, body.content);
+        }
+    }
+}

package/dist/commands/workflow-cli.js

@@ -77,7 +77,9 @@ const workflowStatusCommand = defineJsonCommand({
 const workflowListCommand = defineJsonCommand({
     meta: {
         name: "list",
-        description: "List workflow runs in the current working scope",
+        description: "List workflow runs in the current working scope. A scheduled task runs from the scheduler's cwd, so its runs " +
+            "sit in another scope: get the run id from `akm task history <task-id> --limit 1` (detail.runId) and pass it " +
+            "to `akm workflow status <run-id>`, which works from any directory, or pass --all-scopes.",
     },
     args: {
         ref: { type: "string", description: "Filter to one workflow ref" },

package/dist/core/asset/akm-markdown.js

@@ -32,12 +32,14 @@ import { parseFrontmatterBlock, replaceFrontmatterLine, spliceFrontmatterLine }
  * intended mapping; when it does not (a `type` value that spans several lines,
  * a flow-style `{…}` block), the document is re-serialized instead, as it
  * always used to be. A document with no frontmatter block gets a new one;
- * malformed YAML throws.
+ * malformed YAML throws. An inserted or re-serialized block uses CRLF when
+ * every line break in the document is CRLF, and LF otherwise.
  */
 export function ensureAkmMarkdownType(content, type, now = new Date()) {
+    const eol = documentLineEnding(content);
     const block = parseFrontmatterBlock(content);
     if (!block) {
-        return `---\n${serializeFrontmatter({ type, updated: localDateStamp(now) })}\n---\n${content}`;
+        return (`---\n${serializeFrontmatter({ type, updated: localDateStamp(now) })}\n---\n`.replaceAll("\n", eol) + content);
     }
     let parsed;
     try {
@@ -74,7 +76,21 @@ export function ensureAkmMarkdownType(content, type, now = new Date()) {
     const next = { type, ...rest };
     if (needsUpdated)
         next.updated = updated;
-    return `---\n${serializeFrontmatter(next)}\n---\n${block.content}`;
+    return `---\n${serializeFrontmatter(next)}\n---\n`.replaceAll("\n", eol) + block.content;
+}
+/**
+ * The exact text `writeAssetToSource` writes for an AKM Markdown asset: the
+ * conformant document from {@link ensureAkmMarkdownType}, ending in a line
+ * break in the document's own line-ending style.
+ */
+export function normalizeAkmMarkdown(content, type, now = new Date()) {
+    const authored = ensureAkmMarkdownType(content, type, now);
+    return authored.endsWith("\n") ? authored : authored + documentLineEnding(authored);
+}
+/** CRLF only when every line break is CRLF; LF for LF-only, mixed or single-line text. */
+function documentLineEnding(text) {
+    const breaks = text.split("\n").length - 1;
+    return breaks > 0 && text.split("\r\n").length - 1 === breaks ? "\r\n" : "\n";
 }
 /** True when the frontmatter of `text` parses to exactly `intended`. */
 function parsesTo(text, intended) {

package/dist/core/asset/markdown.js

@@ -16,7 +16,8 @@ export function markdownHeadingSlug(heading) {
 export function markdownFragmentSlugs(content) {
     return uniqueHeadingSlugs(parseMarkdownToc(content).headings).filter(Boolean);
 }
-function uniqueHeadingSlugs(headings) {
+/** One slug per heading, in order; a heading with no sluggable text gets "". */
+export function uniqueHeadingSlugs(headings) {
     const used = new Set();
     return headings.map((heading) => {
         const base = markdownHeadingSlug(heading.text);
@@ -36,15 +37,22 @@ export function parseMarkdownToc(content) {
     const headings = [];
     const parsed = parseFrontmatter(content);
     const start = parsed.frontmatter ? parsed.bodyStartLine - 1 : 0;
-    let inFence = false;
+    // Fenced code blocks follow CommonMark, so headings inside them are skipped:
+    // a fence opens with 3+ backticks or tildes indented at most 3 spaces (a
+    // backtick fence's info string has no backtick) and closes only on a line of
+    // the same character, at least as long, followed by nothing but whitespace.
+    let fence;
     for (let i = start; i < lines.length; i++) {
-        // Track fenced code blocks (``` or ~~~) so headings inside them are skipped.
-        if (/^\s*(`{3,}|~{3,})/.test(lines[i])) {
-            inFence = !inFence;
+        const [, run = "", rest = ""] = lines[i].match(/^ {0,3}(`{3,}|~{3,})(.*)$/) ?? [];
+        if (fence) {
+            if (run[0] === fence.char && run.length >= fence.length && !rest.trim())
+                fence = undefined;
             continue;
         }
-        if (inFence)
+        if (run && !(run[0] === "`" && rest.includes("`"))) {
+            fence = { char: run[0], length: run.length };
             continue;
+        }
         const match = lines[i].match(/^(#{1,6})\s+(.+)$/);
         if (match) {
             headings.push({

package/dist/core/config/config.js

@@ -752,9 +752,10 @@ export function schedulerSourceIdFor(config, bundleId) {
  * user knows their key was dropped and how to provide it at runtime (#474).
  * Previously the strip was silent — a user invoking `akm setup --from <file>
  * --yes` with an `apiKey` field expected persistence and got a wiped config
- * with no feedback.
+ * with no feedback. `quiet` skips the warnings for a caller that only asks
+ * whether a write would drop anything and writes nothing itself.
  */
-export function sanitizeConfigForWrite(config) {
+export function sanitizeConfigForWrite(config, options) {
     const sanitized = { ...config };
     const stripped = [];
     if (config.embedding?.apiKey !== undefined) {
@@ -787,7 +788,7 @@ export function sanitizeConfigForWrite(config) {
         }
         sanitized.engines = engines;
     }
-    if (stripped.length > 0) {
+    if (stripped.length > 0 && !options?.quiet) {
         warn(`Config sanitizer dropped API key(s) before writing to disk:\n  - ${stripped.join("\n  - ")}\n\nakm does not persist API keys to config.json. Set the listed environment variables to provide them at runtime, or use \`\${VAR}\` references in your config to defer lookup. See docs/reference/data-and-telemetry.md.`);
     }
     if (config.registries) {
@@ -800,7 +801,8 @@ export function sanitizeConfigForWrite(config) {
         });
         if (droppedRegistries.length > 0) {
             sanitized.registries = registries;
-            warn(`Config sanitizer dropped registry entr${droppedRegistries.length === 1 ? "y" : "ies"} with URL credentials before writing to disk:\n  - ${droppedRegistries.join("\n  - ")}\n\nRegistry URLs must be credential-free; configure a credential-free HTTPS endpoint.`);
+            if (!options?.quiet)
+                warn(`Config sanitizer dropped registry entr${droppedRegistries.length === 1 ? "y" : "ies"} with URL credentials before writing to disk:\n  - ${droppedRegistries.join("\n  - ")}\n\nRegistry URLs must be credential-free; configure a credential-free HTTPS endpoint.`);
         }
     }
     return sanitized;

package/dist/core/non-task-input.js

@@ -3,18 +3,82 @@
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 /** The line of `src/assets/stash-skeleton/README.md` that reaches curate verbatim as a query. */
 const STASH_README_LINE = "This is an **AKM stash** — a structured knowledge repository that stores reusable";
+/** Exact normalized whole-message phrases; added task text must still retrieve. */
+const SOCIAL_INPUTS = new Set([
+    "thanks",
+    "thanks that worked",
+    "thank you",
+    "thank you that worked",
+    "ok",
+    "ok sounds good",
+    "ok go ahead",
+    "ok sounds good go ahead",
+    "okay",
+    "okay sounds good",
+    "okay go ahead",
+    "okay sounds good go ahead",
+    "hi",
+    "hi are you still there",
+    "hi ready when you are",
+    "hello",
+    "hello are you still there",
+    "hello ready when you are",
+    "hey",
+    "hey are you still there",
+    "hey ready when you are",
+    "good morning",
+    "good morning are you still there",
+    "good morning ready when you are",
+    "good afternoon",
+    "good afternoon are you still there",
+    "good afternoon ready when you are",
+    "good evening",
+    "good evening are you still there",
+    "good evening ready when you are",
+    "yes",
+    "yep",
+    "y",
+    "no",
+    "lgtm",
+    "ok do it",
+    "do it",
+    "go ahead",
+    "sounds good",
+    "looks good",
+    "continue",
+    "continue please",
+    "perfect",
+    "nice",
+    "cool",
+    "thx",
+    "thanks so much",
+    "great thanks",
+    "ok thanks",
+    "ok got it",
+    "hi there",
+    "hello there",
+    "hey thanks a lot",
+]);
 /**
  * What the (trimmed) curate input is when it is not a task, else undefined.
  * Harness and tool envelopes (`<task-notification>…`, `<system-reminder>…`,
  * `<cross-session-message …>…`) start with a tag and close one, and the stash
- * README line arrives verbatim; on the retrieval suite neither shape occurs in
- * a real query. Length is not a signal: prompts over 2,000 characters found
- * relevant assets at about the rate of shorter long prompts.
+ * README line arrives verbatim. Only the explicit normalized phrases
+ * above are withheld; this is not general conversational intent detection.
+ * Length is not a signal: prompts over 2,000 characters found relevant assets
+ * at about the rate of shorter long prompts.
  */
 export function nonTaskInput(query) {
     if (query.startsWith("<") && query.includes("</"))
         return "a harness or tool envelope";
     if (query === STASH_README_LINE)
         return "the akm stash README boilerplate";
+    const conversational = query
+        .toLowerCase()
+        .replace(/[,.!?]+/g, " ")
+        .replace(/\s+/g, " ")
+        .trim();
+    if (SOCIAL_INPUTS.has(conversational))
+        return "an exact conversational phrase";
     return undefined;
 }

package/dist/core/write-source.js

@@ -32,7 +32,7 @@ import { lockContentRootFor } from "../integrations/lockfile.js";
 import { GitStashPushError, getCachePaths, inspectGitUpstream, isGitBackedStash, parseGitRepoUrl, runGit, saveGitStash, } from "../sources/providers/git.js";
 import { listIgnoredExactPaths } from "../sources/providers/git-stash.js";
 import { detectAdapterId } from "./adapter/detect-adapter.js";
-import { ensureAkmMarkdownType } from "./asset/akm-markdown.js";
+import { normalizeAkmMarkdown } from "./asset/akm-markdown.js";
 import { assetPathForName, stashDirFor } from "./asset/asset-placement.js";
 import { conceptIdFromTypeName, displayRef } from "./asset/resolve-ref.js";
 import { deriveBundleId } from "./bundle-id.js";
@@ -236,7 +236,7 @@ export async function writeAssetToSource(source, config, ref, content) {
     assertSupportedKind(source);
     assertAkmAssetWrite(source);
     const filePath = resolveAssetFilePath(source, ref);
-    const authored = filePath.toLowerCase().endsWith(".md") ? ensureAkmMarkdownType(content, ref.type) : content;
+    const authored = filePath.toLowerCase().endsWith(".md") ? normalizeAkmMarkdown(content, ref.type) : content;
     const normalized = authored.endsWith("\n") ? authored : `${authored}\n`;
     fs.mkdirSync(path.dirname(filePath), { recursive: true });
     // Atomic: sibling temp file, fdatasync, rename — a crash or a full disk never