akm-cli 0.10.261012-beta → 0.10.261013-beta

package/dist/commands/env/env-cli.js

@@ -5,8 +5,7 @@
  * `akm env` command family. Extracted verbatim from src/cli.ts (WS6) so the God
  * Module shrinks; the `main.subCommands.env` key and every subcommand's
  * args/output shape are byte-identical. The ref-resolution helpers
- * (parseEnvRef / findEnvSource / makeEnvRef / resolveEnvPath + the env-path
- * traversal guard) live in src/core/env-secret-ref.ts so env + secret share one
+ * (parseEnvRef / makeEnvRef / resolveEnvPath) live in src/core/env-secret-ref.ts so env + secret share one
  * copy.
  *
  * `akm env` manages whole `.env` files under each stash's env/ directory.
@@ -42,7 +41,7 @@ const envCreateCommand = defineJsonCommand({
     args: {
         name: {
             type: "positional",
-            description: "Env name (flat, e.g. prod → prod.env; use --path for a subdirectory)",
+            description: "Env ref (flat name, e.g. env/prod → prod.env; use --path for a subdirectory)",
             required: true,
         },
         path: {
@@ -119,10 +118,7 @@ const envPathCommand = defineJsonCommand({
         quiet: { type: "boolean", alias: "q", description: "Suppress the unsafe-source warning", default: false },
     },
     async run({ args }) {
-        const { name, absPath, source } = resolveEnvPath(args.ref);
-        if (!fs.existsSync(absPath)) {
-            throw new NotFoundError(`Env not found: ${makeEnvRef(name, source)}`);
-        }
+        const { absPath } = resolveEnvPath(args.ref);
         // The raw `.env` may contain `X=$(cmd)`, which executes if `source`d.
         // Warning goes to stderr (never contaminates the path on stdout) and is
         // suppressed with --quiet for the legitimate `_FILE` / `--env-file` use.
@@ -166,9 +162,6 @@ const envExportCommand = defineJsonCommand({
                 "       session). export never prints values to stdout, to avoid leaking them into a captured context.", "MISSING_REQUIRED_ARGUMENT");
         }
         const { name, absPath, source } = resolveEnvPath(args.ref);
-        if (!fs.existsSync(absPath)) {
-            throw new NotFoundError(`Env not found: ${makeEnvRef(name, source)}`);
-        }
         const { buildShellExportScript } = await import("./env.js");
         const resolvedOut = path.resolve(outPath);
         writeFileAtomic(resolvedOut, buildShellExportScript(absPath), 0o600);
@@ -177,16 +170,19 @@ const envExportCommand = defineJsonCommand({
 });
 /**
  * Shared implementation for `env run`. Injects an entire env file's values into
- * the child process env — never via a shell — after scanning the injected keys
- * for process-hijacking variables.
+ * the child process env — never via a shell.
  */
 async function runEnvInjected(target, opts) {
     const command = getParsedInvocation().passthroughArgs();
     if (command.length === 0) {
         throw new UsageError("Missing command. Usage: akm env run <ref> -- <command>");
     }
-    const { name, absPath, source } = resolveEnvPath(target);
-    if (!fs.existsSync(absPath)) {
+    try {
+        resolveEnvPath(target);
+    }
+    catch (error) {
+        if (!(error instanceof NotFoundError))
+            throw error;
         // Help users who reach for the removed single-key `ref/KEY` form.
         const slash = target.lastIndexOf("/");
         if (slash > 0) {
@@ -194,7 +190,8 @@ async function runEnvInjected(target, opts) {
             if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(maybeKey)) {
                 let baseExists = false;
                 try {
-                    baseExists = fs.existsSync(resolveEnvPath(target.slice(0, slash)).absPath);
+                    resolveEnvPath(target.slice(0, slash));
+                    baseExists = true;
                 }
                 catch {
                     baseExists = false;
@@ -205,16 +202,15 @@ async function runEnvInjected(target, opts) {
                 }
             }
         }
-        throw new NotFoundError(`Env not found: ${makeEnvRef(name, source)}`);
+        throw error;
     }
-    // Load → filter → secret-substitute → dangerous-key policy → keys-only
+    // Load → filter → secret-substitute → keys-only
     // audit event. Shared with the workflow engine's per-unit env bindings —
     // see env-binding.ts for the extracted core and its safety invariants.
     const { resolveEnvBinding } = await import("./env-binding.js");
     const { values: envValues } = resolveEnvBinding(target, {
         only: opts.only,
         except: opts.except,
-        allowDangerousEnvKeys: opts.allowDangerousEnvKeys,
     });
     const mergedEnv = buildChildEnv(process.env, {
         clean: opts.clean === true,
@@ -264,8 +260,8 @@ const envRunCommand = defineJsonCommand({
     meta: {
         name: "run",
         description: 
-        // biome-ignore lint/suspicious/noTemplateCurlyInString: literal `${secret:NAME}` token syntax documented for users, not interpolation
-        "Run a command with the env file injected into its environment: `akm env run <ref> -- <command>`. Use `-- $SHELL` for an interactive session. Restrict which variables are injected with --only / --except. Values may embed `${secret:NAME}` tokens, replaced at run time with the sibling `${secret:NAME}` value from the same bundle. Pass --clean to start the child with a minimal inherited environment instead of the full parent environment.",
+        // biome-ignore lint/suspicious/noTemplateCurlyInString: literal `${ref}` token syntax documented for users, not interpolation
+        "Run a command with the env file injected into its environment: `akm env run <ref> -- <command>`. Use `-- $SHELL` for an interactive session. Restrict which variables are injected with --only / --except. Values may embed `${ref}` tokens, replaced at run time: a `${secrets/NAME}` (or `${bundle//secrets/NAME}`) token with the secret's value, any other asset ref with its absolute path. Pass --clean to start the child with a minimal inherited environment instead of the full parent environment.",
     },
     args: {
         target: { type: "positional", description: "Env ref", required: true },
@@ -283,9 +279,12 @@ const envRunCommand = defineJsonCommand({
             type: "string",
             description: "When used with --clean, also inherit these parent env vars (comma-separated). Ignored without --clean.",
         },
+        // Deprecated no-op, accepted through 0.10 so scripts that pass it do not
+        // fail with UNKNOWN_FLAG. Installing a bundle is the trust decision: env
+        // run no longer blocks process-hijacking keys.
         "allow-dangerous-env-keys": {
             type: "boolean",
-            description: "Allow injecting a process-hijacking variable (e.g. LD_PRELOAD, GIT_SSH_COMMAND) from a third-party stash, which otherwise blocks. Use only after explicitly reviewing the env file.",
+            description: "Deprecated, no effect: env run no longer blocks process-hijacking variables. Accepted through 0.10 for existing scripts.",
             default: false,
         },
     },
@@ -295,7 +294,6 @@ const envRunCommand = defineJsonCommand({
             except: parseKeyListFlag(args.except),
             clean: args.clean === true,
             inherit: parseKeyListFlag(args.inherit) ?? [],
-            allowDangerousEnvKeys: args["allow-dangerous-env-keys"] === true,
         });
     },
 });

package/dist/commands/env/env.js

@@ -37,13 +37,11 @@
  *
  * Value parsing is delegated to the `dotenv` package.
  *
- * Secret-token substitution: env VALUES may embed `${secret:NAME}` tokens, which
- * are replaced at `env run` time with the value of the sibling `secret:NAME`
- * asset in the SAME stash (see `resolveSecretTokens`). Substitution applies to
- * values only, never keys; only the `${secret:...}` form is recognised —
- * shell-style `${VAR}` / `$VAR` are left untouched. The secret lookup is
- * injected so this module keeps its narrow dependency surface (dotenv +
- * core/common) and never reaches into the secret resolver/source machinery.
+ * Ref-token substitution: env VALUES may embed `${ref}` tokens (a secret's
+ * value, or any other asset's path), replaced when the env is injected (see
+ * `substituteRefTokens` in core/ref-token.ts and `resolveEnvBinding`).
+ * Substitution applies to values only, never keys; shell-style `${VAR}` /
+ * `$VAR` are left untouched.
  */
 import fs from "node:fs";
 import path from "node:path";
@@ -91,11 +89,11 @@ export function loadEnv(envPath) {
  * it to the literal string `$(rm -rf ~)` and we re-emit it single-quoted. This
  * backs `akm env export <ref> --out <file>` (file-only; never printed to stdout).
  *
- * NOTE: `${secret:NAME}` token substitution is intentionally NOT applied here.
- * The export path emits values single-quoted as literals, so an unsubstituted
- * `${secret:NAME}` is written verbatim (it would expand to nothing under POSIX
- * shells, never to the secret). Secret-token resolution is scoped to the
- * `env run` value-injection path only; see `resolveSecretTokens`.
+ * NOTE: `${ref}` token substitution is intentionally NOT applied here. The
+ * export path emits values single-quoted as literals, so an unsubstituted
+ * `${secrets/name}` is written verbatim (it would expand to nothing under POSIX
+ * shells, never to the secret). Token resolution is scoped to the value
+ * injection path only; see `resolveEnvBinding`.
  */
 export function buildShellExportScript(envPath) {
     const env = loadEnv(envPath);
@@ -110,52 +108,6 @@ export function buildShellExportScript(envPath) {
     }
     return lines.length > 0 ? `${lines.join("\n")}\n` : "";
 }
-/**
- * Matches a `${secret:NAME}` substitution token in an env value. The captured
- * NAME accepts the same character set as a secret asset name (letters, digits,
- * `_`, `.`, `/`, `-`). Only this exact form is recognised — shell-style
- * `${VAR}` and `$VAR` deliberately do not match and are left untouched.
- */
-const SECRET_TOKEN_RE = /\$\{secret:([A-Za-z0-9_./-]+)\}/g;
-/**
- * Replace every `${secret:NAME}` token in each value with the corresponding
- * secret value, looked up via the injected `resolveSecret`. Keys are never
- * touched. Multiple tokens per value and tokens embedded in larger strings
- * (e.g. `Bearer ${secret:a}:${secret:b}`) are all substituted.
- *
- * `resolveSecret` returns `undefined` for an unknown secret name; such names are
- * collected into `missing` (de-duplicated, in first-seen order) and their tokens
- * are left unsubstituted in the returned values. Callers MUST treat a non-empty
- * `missing` as a hard error and inject NOTHING — never partially inject.
- *
- * The lookup is injected so this module does not import the secret
- * resolver/source machinery directly, preserving its narrow dependency surface.
- * Resolved secret values must never be logged or printed by callers.
- */
-export function resolveSecretTokens(values, resolveSecret) {
-    const missing = [];
-    const missingSeen = new Set();
-    const out = {};
-    const cache = new Map();
-    for (const [key, value] of Object.entries(values)) {
-        out[key] = value.replace(SECRET_TOKEN_RE, (match, name) => {
-            let resolved = cache.get(name);
-            if (!cache.has(name)) {
-                resolved = resolveSecret(name);
-                cache.set(name, resolved);
-            }
-            if (resolved === undefined) {
-                if (!missingSeen.has(name)) {
-                    missingSeen.add(name);
-                    missing.push(name);
-                }
-                return match;
-            }
-            return resolved;
-        });
-    }
-    return { values: out, missing };
-}
 /** Create an empty env file (does nothing if it already exists). */
 export function createEnv(envPath) {
     ensureParentDir(envPath);

package/dist/commands/env/secret-cli.js

@@ -5,8 +5,7 @@
  * `akm secret` command family. Extracted verbatim from src/cli.ts (WS6) so the
  * God Module shrinks; the `main.subCommands.secret` key and every subcommand's
  * args/output shape are byte-identical. The ref-resolution helpers
- * (parseSecretRef / makeSecretRef / resolveSecretPath, plus the shared
- * findEnvSource) live in src/core/env-secret-ref.ts so env + secret share one
+ * (parseSecretRef / makeSecretRef / resolveSecretPath) live in src/core/env-secret-ref.ts so env + secret share one
  * copy.
  *
  * `akm secret` manages whole-file secrets under each stash's secrets/ directory.
@@ -32,14 +31,13 @@ import path from "node:path";
 import { getParsedInvocation } from "../../cli/invocation.js";
 import { getStringArg } from "../../cli/parse-args.js";
 import { defineGroupCommand, defineJsonCommand, output } from "../../cli/shared.js";
-import { decideDangerousEnvInjection } from "../../core/activation-policy.js";
 import { deriveCanonicalAssetName } from "../../core/asset/asset-placement.js";
 import { loadConfig } from "../../core/config/config.js";
 import { makeSecretRef, resolveSecretPath, resolveSecretWriteTarget, sensitiveMarkerPath, withEnvSecretWrite, } from "../../core/env-secret-ref.js";
 import { ConfigError, NotFoundError, UsageError } from "../../core/errors.js";
 import { appendEvent } from "../../core/events.js";
-import { warn } from "../../core/warn.js";
 import { resolveSourceEntries } from "../../indexer/search/search-source.js";
+import { isFileOrFileSymlink } from "../../indexer/walk/walker.js";
 import { readStdin } from "../../runtime.js";
 import { buildChildEnv } from "./child-env.js";
 function parseKeyListFlag(raw) {
@@ -65,7 +63,7 @@ function listSecretsRecursive() {
                     walk(full);
                     continue;
                 }
-                if (!entry.isFile())
+                if (!entry.isFile() && !(entry.isSymbolicLink() && isFileOrFileSymlink(full)))
                     continue;
                 if (entry.name.endsWith(".lock") || entry.name.endsWith(".sensitive"))
                     continue;
@@ -99,7 +97,7 @@ const secretSetCommand = defineJsonCommand({
     args: {
         ref: {
             type: "positional",
-            description: "Secret ref (flat name, e.g. secrets/deploy-key or just deploy-key; use --path for a subdirectory)",
+            description: "Secret ref (flat name, e.g. secrets/deploy-key; use --path for a subdirectory)",
             required: true,
         },
         path: {
@@ -170,9 +168,9 @@ const secretRunCommand = defineJsonCommand({
         },
     },
     async run({ args }) {
-        // Validate the target env var name FIRST (before the command split) so a
-        // dangerous/invalid name is rejected regardless of how the command is
-        // supplied — and so the failure does not depend on argv parsing.
+        // Validate the target env var name FIRST (before the command split) so an
+        // invalid name is rejected regardless of how the command is supplied — and
+        // so the failure does not depend on argv parsing.
         const varName = args.var;
         if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(varName)) {
             throw new UsageError(`"${varName}" is not a valid environment variable name.`, "INVALID_FLAG_VALUE");
@@ -182,28 +180,12 @@ const secretRunCommand = defineJsonCommand({
             throw new UsageError("Missing command. Usage: akm secret run <ref> <VAR> -- <command>");
         }
         const { name, absPath, source } = resolveSecretPath(args.ref);
-        if (!fs.existsSync(absPath)) {
-            throw new NotFoundError(`Secret not found: ${makeSecretRef(name, source)}`);
-        }
-        const { isDangerousEnvKey } = await import("../lint/env-key-rules.js");
-        if (isDangerousEnvKey(varName)) {
-            const detail = `"${varName}" is a known process-hijacking variable (e.g. LD_PRELOAD, PATH).`;
-            const decision = decideDangerousEnvInjection({
-                dangerousKeys: [varName],
-                thirdParty: Boolean(source.registryId),
-            });
-            if (decision === "block") {
-                throw new UsageError(`Refusing to inject a secret from a third-party stash into ${detail}\n` +
-                    "       Review the secret, then copy it into a first-party secret if you trust it.", "INVALID_FLAG_VALUE");
-            }
-            warn(`Injecting a secret into ${detail} Injecting anyway (first-party stash).`);
-        }
-        const { readValue } = await import("./secret.js");
+        const { readValue } = await import("../../core/secret-value.js");
         const mergedEnv = buildChildEnv(process.env, {
             clean: args.clean === true,
             inherit: parseKeyListFlag(args.inherit) ?? [],
         });
-        mergedEnv[varName] = readValue(absPath).toString("utf8");
+        mergedEnv[varName] = readValue(absPath);
         // Audit trail: record access by ref + var name only — never the value.
         appendEvent({
             eventType: "secret_access",

package/dist/commands/env/secret.js

@@ -17,7 +17,7 @@
  * The supported value-use path is:
  *
  *   - `akm secret run <ref> <VAR> -- <cmd>` — value injected into the child
- *     process env as `VAR=<value>` (see `readValue`).
+ *     process env as `VAR=<value>` (see `readValue` in `core/secret-value.ts`).
  *
  * `akm secret path <ref>` (print the file path for the Docker `/run/secrets` +
  * `_FILE` convention) was removed in 0.9.0 alongside `akm secret remove` — an
@@ -25,8 +25,8 @@
  * and could silently target different files. A ref's file still lives at
  * `<stash>/secrets/<name>`; locate or delete it there directly.
  *
- * Values are stored as raw bytes (no quoting, multi-line allowed) so they
- * round-trip byte-exact, unlike env values which forbid literal newlines.
+ * Values are stored as raw bytes (no quoting, multi-line allowed), unlike env
+ * values which forbid literal newlines; they are read back trimmed (`core/secret-value.ts`).
  */
 import { createHash } from "node:crypto";
 import fs from "node:fs";
@@ -82,13 +82,6 @@ function ensureParentDir(filePath) {
         fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
 }
 // ── Public API ──────────────────────────────────────────────────────────────
-/**
- * Read a secret's raw bytes. Internal use only (for `secret run`). Callers
- * MUST NOT write the returned value to stdout or any log.
- */
-export function readValue(secretPath) {
-    return fs.readFileSync(secretPath);
-}
 /**
  * Write (create or overwrite) a secret with the given raw bytes, atomically at
  * mode 0600 under a write-lock. No quoting; multi-line / binary allowed.

package/dist/commands/health/scheduler-binary.js

@@ -10,7 +10,7 @@
  * stale after upgrading akm through a different installer than the one
  * active at the last `task sync` (e.g. npm-global to a standalone binary):
  * the schedule kept invoking a version behind, with nothing in `akm health`
- * surfacing it, until an unrelated failure (a rejected `secret://` engine
+ * surfacing it, until an unrelated failure (a rejected `${ref}` engine
  * key on the stale binary) surfaced the drift.
  *
  * Modelled 1:1 on `version-drift.ts`'s shape: an injectable seam,

package/dist/commands/improve/distill.js

@@ -1074,8 +1074,6 @@ async function defaultLookup(ref, stashDir) {
     return resolveAssetPath(ref, {
         stashDir,
         mode: "disk-only",
-        directoryIndexNames: ["SKILL.md"],
-        preserveDirectNameFallback: true,
         honorOrigin: false,
     });
 }

package/dist/commands/improve/eligibility.js

@@ -355,8 +355,6 @@ export async function findAssetFilePath(ref, stashDir, writableBundleIds) {
         stashDir,
         mode: "disk-only",
         writableBundleIds,
-        directoryIndexNames: ["SKILL.md"],
-        preserveDirectNameFallback: true,
         honorOrigin: true,
     });
 }

package/dist/commands/lint/env-key-rules.js

@@ -11,18 +11,19 @@
  *
  * Enforcement scope:
  *   - `akm lint` reports findings as `dangerous-env-key` (non-blocking warn).
- *   - `akm bundle add` BLOCKS install unless `--allow-dangerous-env-keys` is set (or, on TTY,
- *     the user explicitly confirms at the prompt).
+ *   - Nothing else consults this list. Installing a bundle is the trust
+ *     decision, so `akm bundle add` and `akm bundle update` do not scan env
+ *     files, and `akm env run` does not refuse a key. The
+ *     `--allow-dangerous-env-keys` flag is a deprecated no-op.
  *   - Local env writes do NOT consult this list — by design, the operator may
- *     legitimately store any key locally. The gate exists only for third-party
- *     stash installation.
+ *     legitimately store any key locally.
  *
  * False-positive tradeoff:
  *   A handful of keys (EDITOR, VISUAL, PAGER) are included because they are
  *   invoked by many interactive tools and are a documented RCE vector when
  *   sourced from untrusted environments. They will also flag on benign files
- *   where the operator legitimately wants to set their editor — accept the
- *   FP and bypass with `--allow-dangerous-env-keys` after review.
+ *   where the operator legitimately wants to set their editor — the warning is
+ *   advisory, so ignore it after review.
  */
 import fs from "node:fs";
 import { listKeys } from "../env/env.js";

package/dist/commands/lint/index.js

@@ -497,7 +497,7 @@ export function lintAssetFile(ctx, subdir) {
             issues.push(...factDiagnostics(ctx.relPath, ctx.data));
             break;
         case "tasks":
-            issues.push(...taskDiagnostics(ctx.relPath, ctx.raw, ctx.stashRoot));
+            issues.push(...taskDiagnostics(ctx.relPath, ctx.raw));
             break;
         case "memories":
             appendMemoryStubIssue(ctx, issues);

package/dist/commands/proposal/validators/proposal-validators.js

@@ -80,10 +80,7 @@ const canonicalProposalValidators = {
             ];
         }
         const sourcePath = proposal.changes[0]?.path || proposal.ref;
-        const result = compileWorkflowSource(content, {
-            path: sourcePath,
-            workspaceRoot: proposal.proposedTarget.root,
-        });
+        const result = compileWorkflowSource(content, { path: sourcePath });
         if (result.ok)
             return [];
         return result.errors.map((error) => ({

package/dist/commands/read/show.js

@@ -26,7 +26,7 @@ import { extractSection, markdownFragmentSlugs } from "../../core/asset/markdown
 import { buildMarkdownLeadContext, fragmentForSelector, MARKDOWN_FRAGMENT_CONTEXT_DEFAULT_MAX_CHARS, } from "../../core/asset/markdown-fragments.js";
 import { displayRef, displayRefForConceptId, typeNameFromConceptId } from "../../core/asset/resolve-ref.js";
 import { META_DIR, parseMetaRef, readMetaFile } from "../../core/asset/stash-meta.js";
-import { asNonEmptyString, isWithin } from "../../core/common.js";
+import { asNonEmptyString, isContainedResolvedPath } from "../../core/common.js";
 import { loadConfig } from "../../core/config/config.js";
 import { NotFoundError, rethrowIfDataDirUnreadable, rethrowIfTestIsolationError, UsageError } from "../../core/errors.js";
 import { appendEvent } from "../../core/events.js";
@@ -45,9 +45,7 @@ import { withIndexDb } from "../../storage/repositories/index-db.js";
 import { getEntryById, getEntryIdByFilePath } from "../../storage/repositories/index-entries-repository.js";
 import { getIndexedMarkdownFragment } from "../../storage/repositories/index-fts-repository.js";
 import { readEntryLinks } from "../../storage/repositories/index-links-repository.js";
-import { getCurrentWorkflowScopeKey } from "../../workflows/authoring/scope-key.js";
 import { buildWorkflowAction } from "../../workflows/renderer.js";
-import { getActiveWorkflowRun } from "../../workflows/runtime/runs.js";
 /**
  * Unified show: queries the local FTS5 index, then reads that row's file path.
  * A physical owner can arbitrate collisions during lookup, but show never
@@ -381,20 +379,6 @@ export async function showLocal(input) {
     }
     if (response.type === "workflow")
         response.action = buildWorkflowAction(canonicalRef);
-    // 07 P1-D: provenance-aware toolPolicy CEILING. An agent's self-declared
-    // `tools` frontmatter is honoured ONLY for the operator's own PRIMARY stash —
-    // the assets they authored. Every other source is content pulled from
-    // elsewhere and must not name its own tool grant: registry-installed packs, a
-    // configured secondary source, and even a git source the operator marked
-    // `--writable` to contribute edits upstream (writability is "can I push", not
-    // "do I trust this content to grant itself tools"). Drop the policy so dispatch
-    // falls back to the parent/default grant. Keys off primary-stash identity —
-    // `allSources[0]` is always the primary (search-source.ts) — not a
-    // name-derived registryId or the orthogonal `writable` bit. `source` undefined
-    // (unresolved path) also fails closed.
-    if (response.toolPolicy !== undefined && !isPrimaryStash) {
-        delete response.toolPolicy;
-    }
     const editable = isEditable(assetPath, config, allSources);
     // Evidence must describe the same revision as the rendered claim: ordinary
     // Markdown show is source-live, while indexed fragment show is a snapshot.
@@ -421,10 +405,6 @@ export async function showLocal(input) {
         ...(!editable ? { editHint: buildEditHint(canonicalRef) } : {}),
         ...showLinks(indexedEntry.itemRef, displayDefaultBundle, input.readOnly === true),
     };
-    const activeRun = input.readOnly ? null : await getActiveWorkflowRun(getCurrentWorkflowScopeKey());
-    if (activeRun) {
-        fullResponse.activeRun = activeRun;
-    }
     if (input.detail === "brief") {
         return buildBriefResponse(fullResponse, assetPath);
     }
@@ -513,16 +493,15 @@ function findUnrecognizedScriptSource(assetParts, sources) {
                 continue;
             const sourceRoot = path.resolve(source.path);
             const candidate = path.resolve(assetPathForName("script", path.join(sourceRoot, scriptDir), assetParts.name));
-            if (!isWithin(candidate, sourceRoot))
+            if (!isContainedResolvedPath(candidate, sourceRoot))
                 continue;
             const authoredStat = fs.lstatSync(candidate);
             if (!authoredStat.isFile() && !authoredStat.isSymbolicLink())
                 continue;
-            const realRoot = fs.realpathSync(sourceRoot);
             const realCandidate = fs.realpathSync(candidate);
-            if (!isWithin(realCandidate, realRoot) || !fs.statSync(realCandidate).isFile())
+            if (!fs.statSync(realCandidate).isFile())
                 continue;
-            return { extension, path: realCandidate, sourceRoot: realRoot };
+            return { extension, path: realCandidate, sourceRoot: fs.realpathSync(sourceRoot) };
         }
         catch {
             // Missing, unreadable, dangling, or otherwise unsafe paths remain normal

package/dist/commands/sources/add-cli.js

@@ -7,8 +7,7 @@ import { VALID_ADAPTER_IDS } from "../../core/adapter/adapter-ids.js";
 import { UsageError } from "../../core/errors.js";
 import { appendEvent } from "../../core/events.js";
 import { warn } from "../../core/warn.js";
-import { auditStashForDangerousKeys } from "./dangerous-env-audit.js";
-import { akmRemove, akmUpdate } from "./installed-stashes.js";
+import { akmUpdate } from "./installed-stashes.js";
 import { akmAdd } from "./source-add.js";
 import { addStash, removeStash } from "./source-manage.js";
 // ── Shared website-options helper ──────────
@@ -36,31 +35,6 @@ export function shouldWarnOnPlainHttp(ref) {
         return true;
     }
 }
-/**
- * Audit a freshly-installed stash for dangerous env keys and decide whether the
- * install must be blocked. The scanner and decision policy are shared with
- * `bundle update` in dangerous-env-audit.ts.
- */
-export async function auditInstalledStashForDangerousKeys(opts) {
-    const { installedStashRoot, ref, allowDangerousKeys, rollbackTarget, isTTY } = opts;
-    return auditStashForDangerousKeys({
-        stashRoot: installedStashRoot,
-        ref,
-        allowDangerousKeys,
-        isTTY,
-        operation: "install",
-        rollback: async () => {
-            try {
-                await akmRemove({ target: rollbackTarget });
-                return undefined;
-            }
-            catch {
-                return (`Rollback failed — stash may still be installed at ${installedStashRoot}. ` +
-                    `Remove it manually with: akm bundle remove ${rollbackTarget}`);
-            }
-        },
-    });
-}
 // ── Command definition ────────────────────────────────────────────────────────
 export const addCommand = defineJsonCommand({
     meta: {
@@ -90,7 +64,8 @@ export const addCommand = defineJsonCommand({
         after: { type: "string", description: "Insert the new bundle after this configured bundle" },
         credential: {
             type: "string",
-            description: "Git HTTPS bearer credential reference ($VAR or secret://name); never a literal token",
+            // biome-ignore lint/suspicious/noTemplateCurlyInString: literal `${ref}` token syntax documented for users, not interpolation
+            description: "Git HTTPS bearer credential reference ($VAR or ${secrets/name}); never a literal token",
         },
         "max-pages": { type: "string", description: "Maximum pages to crawl for website sources (default: 50)" },
         "max-depth": { type: "string", description: "Maximum crawl depth for website sources (default: 3)" },
@@ -99,16 +74,18 @@ export const addCommand = defineJsonCommand({
             description: "Allow a plain HTTP source URL after explicitly accepting transport substitution risk.",
             default: false,
         },
+        // Deprecated no-op, accepted through 0.10 so scripts that pass it do not
+        // fail with UNKNOWN_FLAG. Installing a bundle is the trust decision: its
+        // env files are no longer scanned for process-hijacking keys.
         "allow-dangerous-env-keys": {
             type: "boolean",
-            description: "Allow reviewed process-hijacking env keys (e.g. LD_PRELOAD, PATH) in the installed bundle.",
+            description: "Deprecated, no effect: add no longer scans env files for process-hijacking keys. Accepted through 0.10 for existing scripts.",
             default: false,
         },
     },
     async run({ args }) {
         const ref = args.ref.trim();
         const allowInsecureTransport = args["allow-insecure-transport"];
-        const allowDangerousKeys = args["allow-dangerous-env-keys"];
         if (args.before && args.after)
             throw new UsageError("Only one of --before or --after may be used.");
         // --provider → declarative bundle source (URL for git/website; bare
@@ -153,7 +130,7 @@ export const addCommand = defineJsonCommand({
             if (args.provider === "git" && result.added && result.entry?.name) {
                 let updated;
                 try {
-                    updated = await akmUpdate({ target: result.entry.name, allowDangerousEnvKeys: allowDangerousKeys });
+                    updated = await akmUpdate({ target: result.entry.name });
                 }
                 catch (error) {
                     removeStash(result.entry.name);
@@ -204,38 +181,6 @@ export const addCommand = defineJsonCommand({
                 writable: args.writable === true,
             },
         });
-        // ── Post-install env key audit ──────────────────────────────────────────
-        // Resolve the stash root from the install result and scan any env files
-        // for dangerous env var keys.  When findings are present the install is
-        // gated: TTY → interactive confirmation prompt; non-TTY without
-        // --allow-dangerous-env-keys → hard failure (exit 1). Pass the dedicated
-        // flag to skip the prompt non-interactively.
-        const installedStashRoot = result.installed?.stashRoot ??
-            (result.sourceAdded && "stashRoot" in result.sourceAdded ? result.sourceAdded.stashRoot : undefined);
-        if (installedStashRoot) {
-            // Use the canonical installed id (most reliably resolved by akmRemove) rather
-            // than the raw user-supplied ref which may not match after URL normalisation.
-            const rollbackTarget = result.installed?.id ?? result.sourceAdded?.stashRoot ?? ref;
-            // The audit RETURNS its decision; we decide the exit outcome here,
-            // OUTSIDE any catch, so the abort cannot be lost to a swallowed
-            // exception (C3). F4: `process.exitCode = …; return;` instead of
-            // `process.exit(...)` — the DANGEROUS_ENV_KEY error envelope has
-            // already been written to stderr by the audit itself (or is about to
-            // be), so an explicit `return` here (skipping the success `output("add",
-            // …)` below) is load-bearing, not merely cosmetic: it is what stops a
-            // blocked install from ALSO printing a success envelope.
-            const decision = await auditInstalledStashForDangerousKeys({
-                installedStashRoot,
-                ref,
-                allowDangerousKeys,
-                rollbackTarget,
-                isTTY: process.stdin.isTTY === true,
-            });
-            if (decision.blocked) {
-                process.exitCode = decision.exitCode;
-                return;
-            }
-        }
         output("add", result);
     },
 });