akm-cli 0.10.261012-beta → 0.10.261014-beta

package/dist/commands/targets.js

@@ -0,0 +1,175 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/**
+ * Where akm's work runs, as one table: a row for each configured connection
+ * and harness, and a row for each kind of work naming the connection or
+ * harness, and the model, it resolves to. The work rows are resolved by the same
+ * resolvers the calls use, so the table never disagrees with what a call does.
+ *
+ * Pure but for the key and PATH lookups it reads. What needs the network or a
+ * process (is the endpoint reachable, what does the harness report as its
+ * version) is passed in by the caller that wants it: `akm health` supplies
+ * them, `akm info` does not.
+ */
+import { ambiguousDefaultAdvice, defaultConnection, defaultHarness, } from "../core/config/config.js";
+import { readCredential } from "../core/config/credentials.js";
+import { IMPROVE_ENGINE_PROCESSES } from "../core/config/engine-semantics.js";
+import { SHIPPED_ALIAS } from "../core/config/model-aliases.js";
+import { envReferenceName } from "../core/config/schema/primitives.js";
+import { ConfigError } from "../core/errors.js";
+import { redactUrlCredentials } from "../core/redaction.js";
+import { defaultWhich } from "../integrations/agent/detect.js";
+import { resolveTarget } from "../integrations/agent/resolution.js";
+import { DEFAULT_LOCAL_MODEL } from "../llm/embedder.js";
+import { effectiveEmbedding } from "../llm/embedders/connection.js";
+import { resolveIndexPassExecution } from "../llm/index-passes.js";
+import { resolveImproveExecution } from "./improve/execution.js";
+function keyState(connection, name, env) {
+    const variable = connection.apiKey === undefined ? undefined : envReferenceName(connection.apiKey);
+    if (variable !== undefined)
+        return env[variable]?.trim() ? "env-set" : "env-unset";
+    return readCredential({ connection: name }, connection.endpoint) !== undefined ? "credentials" : "none";
+}
+function connectionRows(input) {
+    const { config } = input;
+    const defaultName = defaultConnection(config)?.name;
+    return Object.entries(config.connections ?? {}).map(([name, connection]) => {
+        const reach = input.reachability?.get(name);
+        return {
+            type: "connection",
+            name,
+            default: name === defaultName,
+            endpoint: redactUrlCredentials(connection.endpoint),
+            key: keyState(connection, name, input.env ?? process.env),
+            ...(reach ? { reachable: reach.reachable, ...(reach.error ? { error: reach.error } : {}) } : {}),
+        };
+    });
+}
+/** A harness's binary, as a call to it would resolve it. */
+function harnessBin(config, name, harness) {
+    try {
+        const target = resolveTarget({ config, layers: [{ harness: name }] });
+        if (target.kind === "harness")
+            return target.bin;
+    }
+    catch {
+        // Falls through: nothing to look up.
+    }
+    return harness.bin ?? harness.platform ?? name;
+}
+function harnessRows(input) {
+    const { config } = input;
+    const defaultName = defaultHarness(config)?.name;
+    const which = input.which ?? defaultWhich;
+    return Object.entries(config.harnesses ?? {}).map(([name, harness]) => {
+        const version = input.versions?.get(name);
+        const bin = harnessBin(config, name, harness);
+        return {
+            type: "harness",
+            name,
+            default: name === defaultName,
+            platform: harness.platform ?? name,
+            bin,
+            installed: Boolean(which(bin)),
+            ...(harness.modelWork === false ? { modelWork: false } : {}),
+            ...(version ? { version } : {}),
+        };
+    });
+}
+/** What a resolver says: a runner, nothing (not set up), or what is wrong with the config. */
+function attempt(resolve) {
+    try {
+        const runner = resolve();
+        return runner ? { runner } : {};
+    }
+    catch (err) {
+        if (err instanceof ConfigError && (err.code === "LLM_NOT_CONFIGURED" || err.code === "AGENT_NOT_CONFIGURED")) {
+            return {};
+        }
+        return { problem: err instanceof Error ? err.message : String(err) };
+    }
+}
+const sameTarget = (a, b) => a.runner?.kind === b.runner?.kind && a.runner?.name === b.runner?.name && a.runner?.model === b.runner?.model;
+/** A work row from its base resolution and the variants that may resolve somewhere else. */
+function runnerRow(process, base, variants = [], ambiguous) {
+    const overrides = variants
+        .filter(([, variant]) => !sameTarget(variant, base))
+        .map(([name, variant]) => ({
+        name,
+        kind: variant.runner?.kind ?? null,
+        target: variant.runner?.name ?? null,
+        model: variant.runner?.model ?? null,
+    }));
+    // Work that resolves to nothing because the config has several entries and no default is not "not set up".
+    const problem = base.problem ??
+        variants.find(([, variant]) => variant.problem)?.[1].problem ??
+        (base.runner ? undefined : ambiguous);
+    return {
+        type: "process",
+        process,
+        kind: base.runner?.kind ?? null,
+        target: base.runner?.name ?? null,
+        model: base.runner?.model ?? null,
+        ...(overrides.length > 0 ? { overrides } : {}),
+        ...(problem ? { problem } : {}),
+    };
+}
+function embeddingRow(config, ambiguous) {
+    const off = { type: "process", process: "embedding", kind: null, target: null, model: null };
+    if (config.semanticSearchMode === "off")
+        return off;
+    // A model with no endpoint of its own is served by the default connection; with none to choose, the built-in embedder runs instead.
+    const wantsDefaultConnection = config.embedding?.model !== undefined && config.embedding.endpoint === undefined;
+    const embedding = effectiveEmbedding(config);
+    if (embedding?.endpoint === undefined) {
+        return {
+            ...off,
+            kind: "local",
+            target: "built-in",
+            model: embedding?.localModel ?? DEFAULT_LOCAL_MODEL,
+            ...(wantsDefaultConnection && ambiguous ? { problem: ambiguous } : {}),
+        };
+    }
+    const served = config.embedding?.endpoint === undefined;
+    return {
+        ...off,
+        kind: served ? "connection" : "endpoint",
+        target: served ? (defaultConnection(config)?.name ?? null) : redactUrlCredentials(embedding.endpoint),
+        model: embedding.model ?? null,
+    };
+}
+function rerankRow(config) {
+    const rerank = config.search?.curateRerank;
+    const on = rerank?.enabled === true && rerank.endpoint !== undefined;
+    return {
+        type: "process",
+        process: "curate-rerank",
+        kind: on ? "endpoint" : null,
+        target: on ? redactUrlCredentials(rerank.endpoint) : null,
+        model: on ? (rerank.model ?? null) : null,
+    };
+}
+function processRows(config) {
+    const ambiguous = ambiguousDefaultAdvice(config);
+    const improve = (processName, alias, rest = {}) => attempt(() => resolveImproveExecution({ config, processName, alias: SHIPPED_ALIAS[alias], ...rest })?.runner);
+    const gate = config.improve?.qualityGate;
+    return [
+        runnerRow("improve", improve("improve", "improve"), IMPROVE_ENGINE_PROCESSES.map((name) => [name, improve(name, "improve")]), ambiguous),
+        runnerRow("judges", improve("judge", "judge"), [
+            ["triage judgment", improve("triage-judgment", "judge", { process: "triage" })],
+            ["quality gate", improve("quality-judge", "judge", gate ? { current: gate } : {})],
+        ], ambiguous),
+        runnerRow("agents", attempt(() => resolveTarget({ config, layers: [{ model: SHIPPED_ALIAS.agent }] })), [], ambiguous),
+        runnerRow("extract", improve("extract", "extract"), [], ambiguous),
+        runnerRow("enrich", improve("remember-enrich", "enrich"), [], ambiguous),
+        runnerRow("index", attempt(() => resolveIndexPassExecution("memory", config).runner), [], 
+        // A pass that is switched off is not waiting for a default.
+        config.index?.memory?.enabled === false ? undefined : ambiguous),
+        embeddingRow(config, ambiguous),
+        rerankRow(config),
+    ];
+}
+export function targetRows(input) {
+    return [...connectionRows(input), ...harnessRows(input), ...processRows(input.config)];
+}

package/dist/commands/tasks/explain.js

@@ -2,8 +2,7 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 /**
- * `akm task explain <ref> [input flags]` — read-only task introspection
- * (spec docs/plans/specs/p2b-input-bindings.md §4.5, §1.7 B-N4).
+ * `akm task explain <ref> [input flags]` — read-only task introspection.
  *
  * Prints the task source path and owning bundle, its input declarations with
  * defaults, the supplied values WITH PROVENANCE (`default` | `flag` |
@@ -14,13 +13,12 @@
  * (`src/tasks/run/attempt-lifecycle.ts` is never imported here), never writes
  * history or a log (`src/tasks/run/task-history.ts` /
  * `src/tasks/run/task-log.ts` are never imported here), never touches the
- * scheduler (`src/tasks/scheduler-*.ts` are never imported here), and never
- * resolves a composed command/persona REF against the local index
- * (`src/tasks/prepare/prepare.ts`'s own command branch always does, via
- * `prepareCommandInvocation`'s default `sourceLoader` — an unindexed bundle
- * would otherwise make a read-only introspection command fail with "Run `akm
- * index` to build it", which is the wrong shape of dependency for a command
- * whose whole point is to work on a task the caller just wrote).
+ * scheduler (`src/tasks/scheduler-*.ts` are never imported here), and reads a
+ * composed command/persona REF only through the read-only lookup `akm command
+ * run --dry-run` uses (an isolated snapshot of the index, never the live one).
+ * A command or persona that cannot be read is reported as the envelope's
+ * `execution.problem`, not thrown: the task the caller just wrote is the thing
+ * being explained.
  *
  * SECRET-FREE BY CONSTRUCTION for the structural bans below — these hold
  * regardless of any value's shape, because the excluded data never reaches
@@ -33,20 +31,16 @@
  *     rendered command/persona source — so a `run:` command string,
  *     `with.content`, an inline `akm/command` prompt body, or a stored
  *     command's own rendered content is never read, let alone printed;
- *   - effective execution settings (engine/model/timeout) reuse
- *     `resolveExecution` (`src/integrations/agent/execution.ts`) — the SAME
- *     resolution entry point every command/persona invocation goes through —
- *     fed a BLANK inline placeholder command (`createInlineResolvedCommand`)
- *     and an EMPTY command-layer values map, instead of the task's real referenced
- *     command source. This is a deliberate, documented trade-off: a
- *     referenced command's OWN frontmatter overrides (its own `engine:`/
- *     `model:`, if any) do not contribute a layer here, in exchange for never
- *     needing the index, never reading the referenced file's bytes, and never
- *     risking a leaked `runtime.environment` value (the cascade's own
- *     "current" layer, built here from the TASK's own `execution` overrides
- *     ONLY — engine/model/inference/outputSchema/tools/timeout, deliberately
- *     never `environment`/`workspace`/`agent`, so a portable persona selector
- *     can never demand a persona this module never loads). Only
+ *   - effective execution settings (engine/model/timeout) come from the SAME
+ *     entry point `akm command run` uses (`prepareCommandInvocation`), so a
+ *     stored command's own frontmatter (its `harness:`, `model:`, `agent:`) and
+ *     the persona it names contribute their layers and the target named is the
+ *     target `command run --dry-run` names. An inline `akm/command` prompt has
+ *     no frontmatter: it goes through `resolveExecution` with a BLANK inline
+ *     command. The cascade's "current" layer is built from the TASK's own
+ *     `execution` overrides ONLY — connection/harness/engine/model/agent/inference/
+ *     outputSchema/timeout, deliberately never `environment`/`workspace`, so no
+ *     `runtime.environment` value is ever near this module. Only
  *     `engine`/`model`/`runtime.timeoutMs` and the cascade's own
  *     `{layer,kind,via}` provenance map are read back — never
  *     `request.command`, `request.persona`, `request.conversation`, or
@@ -62,45 +56,47 @@
  * `redacted: true`, instead of the real value — applied uniformly across
  * every place a declared or supplied VALUE can appear in this envelope: a
  * declaration's own `default`, each entry of a declaration's own `enum`
- * list (checked per-entry, not as one blanked list — code-review finding,
- * explain.ts:184), a `suppliedInputs` entry regardless of provenance, and a
- * `schedule[].inputs` entry (code-review finding: the declaration row alone
- * left the identical value printed verbatim one section over, in
- * `suppliedInputs`). Do not paste this command's output into an untrusted
+ * list (checked per-entry, not as one blanked list), a `suppliedInputs` entry
+ * regardless of provenance, and a `schedule[].inputs` entry (the declaration
+ * row alone would leave the identical value printed verbatim one section over,
+ * in `suppliedInputs`). Do not paste this command's output into an untrusted
  * place on the assumption that it can never contain a credential.
  *
  * Field-level execution provenance is READ from `resolveExecution`'s own
  * `provenance` — this module is a CONSUMER of the one common resolver, never a
- * second resolver: it never re-derives engine/model precedence itself.
+ * second resolver: it never re-derives connection, harness or model precedence itself.
  */
 import fs from "node:fs";
 import { detectAdapterId } from "../../core/adapter/detect-adapter.js";
-import { makeBundleRef } from "../../core/asset/asset-ref.js";
+import { makeBundleRef, parseBundleRef } from "../../core/asset/asset-ref.js";
 import { loadConfig } from "../../core/config/config.js";
-import { NotFoundError } from "../../core/errors.js";
+import { SHIPPED_ALIAS } from "../../core/config/model-aliases.js";
+import { ConfigError, NotFoundError } from "../../core/errors.js";
 import { applyInputDefaults, materializeInputFlags, } from "../../execution/input-contract.js";
 import { createInlineResolvedCommand } from "../../execution/resolved-request.js";
+import { isPortableExecutionAgentSelector } from "../../execution/source.js";
+import { lookupBundleRefReadonly } from "../../indexer/indexer.js";
 import { resolveAdapterConceptOwner } from "../../indexer/lookup/adapter-concept-owner.js";
-import { resolveExecution } from "../../integrations/agent/execution.js";
+import { currentLayer, resolveExecution, shippedAlias, } from "../../integrations/agent/execution.js";
 import { isSchedulerRefEnabled } from "../../tasks/activation-config.js";
 import { parseTaskSource } from "../../tasks/source/parse-task-source.js";
 import { projectTaskSourceV4 } from "../../tasks/source/project-v4.js";
 import { TASK_INPUT_DIAGNOSTICS } from "../../tasks/source/task-input-diagnostics.js";
 import { validateTaskConceptId, validateTaskId } from "../../tasks/task-id.js";
 import { detectSecretShapedParams } from "../../workflows/exec/param-secrets.js";
+import { prepareCommandInvocation } from "../command/command-execution.js";
 import { parseTaskRef, resolveTaskReadBundle, taskIdForAdapter } from "./tasks.js";
 function isSecretShapedValue(name, value) {
     return detectSecretShapedParams({ [name]: value }).length > 0;
 }
 /**
- * Code-review finding (explain.ts:175, B-N4): `buildInputDeclarations`
- * already redacted a secret-shaped DEFAULT, but `buildSuppliedInputs` (and
- * a v4 schedule entry's own `inputs`, printed verbatim from the source)
- * echoed the identical value unredacted in the same envelope — a
- * `sk-live-…` default appeared in full in both output formats. Applied to
+ * `buildInputDeclarations` redacts a secret-shaped DEFAULT, so
+ * `buildSuppliedInputs` (and a v4 schedule entry's own `inputs`, printed
+ * verbatim from the source) must redact the identical value too, or a
+ * `sk-live-…` default would appear in full in the same envelope. Applied to
  * every supplied/schedule-binding row regardless of provenance, so the same
- * best-effort redaction (see this file's header) applies uniformly across
- * the whole envelope, not just the declaration row.
+ * best-effort redaction (see this file's header) applies uniformly across the
+ * whole envelope, not just the declaration row.
  */
 function redactIfSecretShaped(name, value) {
     if (!isSecretShapedValue(name, value))
@@ -114,13 +110,10 @@ function declarationEnum(schema) {
     return Array.isArray(schema.enum) ? schema.enum : undefined;
 }
 /**
- * Code-review finding (explain.ts:184, B-N4): `buildInputDeclarations`
- * already redacted a secret-shaped `default`, via {@link redactIfSecretShaped}
- * applied to the WHOLE default value, but the identical value appearing in
- * that same declaration's JSON-Schema `enum:` list printed unredacted one
- * key over — an `enum: [..., "sk-live-…"]` list echoed the credential in
- * full even though the matching `default:` on the same declaration was
- * already redacted. Fixed by applying the SAME per-value check
+ * `buildInputDeclarations` redacts a secret-shaped `default` via
+ * {@link redactIfSecretShaped} applied to the WHOLE default value, but the
+ * identical value appearing in that same declaration's JSON-Schema `enum:`
+ * list would print unredacted one key over. Apply the SAME per-value check
  * ({@link isSecretShapedValue}) to each entry independently, replacing only
  * the secret-shaped ones with `"<redacted>"` — deliberately NOT collapsing
  * the whole list to one `"<redacted>"` sentinel the way a single `default`
@@ -173,7 +166,7 @@ function targetSection(document) {
     const uses = document.target.uses;
     return { kind: uses.kind, ref: uses.ref };
 }
-/** True only for the two `uses:` kinds an execution cascade (engine/model resolution) actually applies to. */
+/** True only for the two `uses:` kinds an execution cascade (connection, harness and model resolution) actually applies to. */
 function isCommandTarget(document) {
     return (document.target.kind === "uses" &&
         (document.target.uses.kind === "builtin-command" || document.target.uses.kind === "command"));
@@ -183,46 +176,88 @@ function isCommandTarget(document) {
  * home for both a v3 document's authored `akm.*` and a v4 document's
  * projected `execution` block) as a cascade "current" layer — the exact
  * non-secret subset `src/tasks/prepare/prepare-support.ts`'s
- * `currentExecutionValues` also forwards, minus `agent`/`workspace`/
- * `environment` (this module never loads a persona and never reads `env:`,
- * see this file's header).
+ * `currentExecutionValues` also forwards, minus `workspace`/`environment`
+ * (this module never reads `env:`, see this file's header).
  */
-function currentExecutionValues(document) {
+function currentExecutionValues(document, bundleName) {
     const akm = document.akm;
     if (!akm)
         return {};
     const out = {};
-    for (const key of ["engine", "model", "inference", "outputSchema", "tools", "timeout"]) {
+    for (const key of ["connection", "harness", "engine", "model", "inference", "outputSchema", "timeout"]) {
         if (Object.hasOwn(akm, key))
             out[key] = akm[key];
     }
+    if (Object.hasOwn(akm, "agent")) {
+        const agent = akm.agent;
+        out.agent =
+            typeof agent === "string" && isPortableExecutionAgentSelector(agent) ? qualifyInBundle(agent, bundleName) : agent;
+    }
     return out;
 }
+/** A ref the task wrote, relative to its own bundle unless it names one. */
+function qualifyInBundle(ref, bundleName) {
+    const parsed = parseBundleRef(ref);
+    return makeBundleRef(parsed.bundle ?? bundleName, parsed.conceptId);
+}
+/** The stored command the task runs, if it runs one; an inline `akm/command` prompt has none. */
+function storedCommandRef(document) {
+    if (document.target.kind !== "uses")
+        return undefined;
+    if (document.target.uses.kind === "command")
+        return document.target.uses.ref;
+    const command = document.target.command;
+    return command?.kind === "stored" ? command.ref : undefined;
+}
 /**
  * Effective execution settings + field-level provenance for a command-kind
- * target — see this file's header for why this is a BLANK-command cascade
- * call rather than a real command/persona load.
+ * target. A stored command is prepared the way `akm command run --dry-run`
+ * prepares it; one that cannot be (a missing command or persona) falls back to
+ * the cascade without it, with the reason in `problem`.
  */
-function resolveExecutionSettings(document) {
+async function resolveExecutionSettings(document, bundleName) {
     if (!isCommandTarget(document))
         return { provenance: {} };
-    const current = currentExecutionValues(document);
-    const prepared = resolveExecution({
+    const config = loadConfig();
+    const current = currentExecutionValues(document, bundleName);
+    const ref = storedCommandRef(document);
+    let problem;
+    let prepared;
+    if (ref !== undefined) {
+        try {
+            prepared = await prepareCommandInvocation({
+                action: { ref: qualifyInBundle(ref, bundleName) },
+                config,
+                current: current,
+                sourceLookup: lookupBundleRefReadonly,
+            });
+        }
+        catch (error) {
+            if (error instanceof ConfigError)
+                throw error;
+            problem = error instanceof Error ? error.message : String(error);
+        }
+    }
+    prepared ??= resolveExecution({
         command: createInlineResolvedCommand({ template: "", content: "" }),
-        config: loadConfig(),
-        commandLayer: { id: "task-explain", values: {} },
-        ...(Object.keys(current).length > 0 ? { current } : {}),
+        config,
+        layers: [
+            shippedAlias(SHIPPED_ALIAS.agent),
+            { id: "task-explain", kind: "command", values: {} },
+            ...(Object.keys(current).length > 0 ? [currentLayer(current)] : []),
+        ],
     });
-    const engine = prepared.request.engine;
+    const target = prepared.request.target;
     return {
         engine: {
-            name: engine.name,
-            kind: engine.kind,
-            ...(Object.hasOwn(engine, "platform") ? { platform: engine.platform } : {}),
+            name: target.name,
+            kind: target.kind,
+            ...(target.platform !== undefined ? { platform: target.platform } : {}),
         },
         ...(prepared.request.model !== undefined ? { model: prepared.request.model } : {}),
         ...(prepared.request.runtime.timeoutMs !== undefined ? { timeoutMs: prepared.request.runtime.timeoutMs } : {}),
         provenance: prepared.provenance,
+        ...(problem !== undefined ? { problem } : {}),
     };
 }
 /**
@@ -247,9 +282,9 @@ export async function akmTaskExplain(ref, options = {}) {
     }
     const sourcePath = owner.path;
     const yaml = fs.readFileSync(sourcePath, "utf8");
-    const parsed = parseTaskSource({ yaml, filePath: sourcePath, workspaceRoot: bundle.source.path });
+    const parsed = parseTaskSource({ yaml, filePath: sourcePath });
     const inputContract = parsed.v4.inputs ?? {};
-    // Code-review finding (explain.ts:299, B-N4): `akm task run`'s
+    // `akm task run`'s
     // load-task.ts copies this same materialize -> applyInputDefaults ->
     // validateInputs ladder, but its own trailing `validateInputs` +
     // `contractViolation` throw is load-task's OWN enforcement that a task
@@ -259,8 +294,8 @@ export async function akmTaskExplain(ref, options = {}) {
     // input is exactly the fact `explain` exists to surface, not a condition
     // that should make the command refuse to print. Deliberately NOT calling
     // `validateInputs` here: `materializeInputFlags` above still runs its own
-    // per-flag validation (an unknown flag name still fails UNKNOWN_FLAG,
-    // B-55; a supplied value failing its own declared schema still fails
+    // per-flag validation (an unknown flag name still fails UNKNOWN_FLAG; a
+    // supplied value failing its own declared schema still fails
     // here), so only the "required and never supplied at all" case is left
     // unenforced. `buildSuppliedInputs` below naturally renders that case as a
     // declaration row (always present, carrying `required: true`) with no
@@ -298,7 +333,7 @@ export async function akmTaskExplain(ref, options = {}) {
         target: targetSection(document),
         inputDeclarations: buildInputDeclarations(inputContract),
         suppliedInputs: buildSuppliedInputs(defaultedInputs, materializedInputs),
-        execution: resolveExecutionSettings(document),
+        execution: await resolveExecutionSettings(document, bundle.source.name),
         schedule,
     };
 }

package/dist/commands/tasks/tasks-cli.js

@@ -25,6 +25,7 @@
 import { defineCommand } from "citty";
 import { getParsedInvocation } from "../../cli/invocation.js";
 import { parsePositiveIntFlag } from "../../cli/parse-args.js";
+import { RETIRED_ENGINE_ARG, SELECTION_ARGS, selectionFromArgs } from "../../cli/selection.js";
 import { defineGroupCommand, defineJsonCommand, EXIT_CODES, GLOBAL_OUTPUT_ARGS, output, outputWithExitCode, runWithJsonErrors, } from "../../cli/shared.js";
 import { UsageError } from "../../core/errors.js";
 import { TASK_RUN_BOOLEAN_FLAGS, TASK_RUN_VALUE_FLAGS } from "../../tasks/task-run-reserved-flags.js";
@@ -47,7 +48,7 @@ const bundleArg = {
  * other value spelling (`--<name>=false`, `--<name>=1`, `--<name>=`) walks
  * straight past it and is then absorbed downstream — by citty's non-strict
  * parser, or by `parseTaskInputFlags`' reserved-name skip — exactly the
- * silent-discard defect these rejecters exist to close (review round 1). The
+ * silent-discard defect these rejecters exist to close. The
  * name is taken as everything before the FIRST `=`, which is
  * `parseTaskInputFlags`' own split (see its `body.indexOf("=")` below), so the
  * rejecter and the scanner can never disagree about what a token names.
@@ -94,21 +95,20 @@ function rejectExplainScheduledFlag() {
         return;
     throw new UsageError('Unknown flag "--scheduled".', "UNKNOWN_FLAG");
 }
-// ── `akm task run` input flags — Stage 1: capture (spec §5.1) ──────────────
+// ── `akm task run` input flags — Stage 1: capture ───────────────────────────
 //
 // Mirrors `parseWorkflowParameterFlags` (src/commands/workflow-cli.ts:232-289)
 // exactly: the CLI carries RAW string/boolean flag values to the boundary
 // that knows the task's declared contract (Stage 2, src/tasks/run/load-task.ts)
 // — coercion happens once, there. `akm task run`'s own declared flags
 // (GLOBAL_OUTPUT_ARGS, --bundle, --scheduled) are excluded so they are never
-// mistaken for inputs (B-33).
+// mistaken for inputs.
 // `TASK_RUN_VALUE_FLAGS` / `TASK_RUN_BOOLEAN_FLAGS` are re-exported here
 // (unchanged in name, location, and value) from a dependency-free leaf module
 // so `src/tasks/source/task-source-v4.ts` can reject a declared `inputs:`
 // name that collides with one of them without importing this CLI file —
 // which would cycle back through `./tasks` -> `../../tasks/source/*` into the
-// parser (code-review finding, docs/plans/specs/p2b-input-bindings.md review
-// round 2; see `../../tasks/task-run-reserved-flags.ts`'s own header).
+// parser (see `../../tasks/task-run-reserved-flags.ts`'s own header).
 export { TASK_RUN_BOOLEAN_FLAGS, TASK_RUN_VALUE_FLAGS };
 const TASK_RUN_VALUE_FLAG_SET = new Set(TASK_RUN_VALUE_FLAGS);
 const TASK_RUN_BOOLEAN_FLAG_SET = new Set(TASK_RUN_BOOLEAN_FLAGS);
@@ -182,8 +182,8 @@ const tasksAddCommand = defineJsonCommand({
             type: "string",
             description: 'Exact shell string to run on the schedule (no AI agent), e.g. "akm improve --strategy consolidate".',
         },
-        engine: { type: "string", description: "Engine to use for prompt targets (default: defaults.engine)" },
-        model: { type: "string", description: "Model override for prompt targets" },
+        ...SELECTION_ARGS,
+        ...RETIRED_ENGINE_ARG,
         "timeout-ms": { type: "string", description: "Positive timeout in milliseconds for prompt or command targets" },
         params: { type: "string", description: "Workflow params as a JSON object" },
         name: { type: "string", description: "Human-readable name for the task" },
@@ -206,8 +206,7 @@ const tasksAddCommand = defineJsonCommand({
             workflow: args.workflow,
             prompt: args.prompt,
             command: args.command,
-            engine: args.engine,
-            model: args.model,
+            ...selectionFromArgs(args),
             timeoutMs: args["timeout-ms"] === undefined ? undefined : parsePositiveIntFlag(args["timeout-ms"]),
             params: args.params,
             name: args.name,
@@ -354,8 +353,7 @@ const tasksSyncCommand = defineJsonCommand({
         outputWithExitCode("task-sync", result, result.failures.length > 0 ? EXIT_CODES.GENERAL : undefined);
     },
 });
-// ── `akm task explain` — read-only introspection (P2b Lane B, spec
-// docs/plans/specs/p2b-input-bindings.md §4.5, §1.7 B-N4) ──────────────────
+// ── `akm task explain` — read-only introspection ────────────────────────────
 const tasksExplainCommand = defineJsonCommand({
     meta: {
         name: "explain",