akm-cli 0.10.261012-beta → 0.10.261014-beta

package/dist/core/config/config-walker.js

@@ -25,9 +25,9 @@ import { isRecord } from "../common.js";
 import { UsageError } from "../errors.js";
 import { hasRegistryUrlCredentials, REGISTRY_CREDENTIALS_UNSUPPORTED } from "../registry-url.js";
 import { warnOnce } from "../warn.js";
-import { AkmConfigBaseSchema, EngineConfigSchema, listTopLevelConfigKeys } from "./config-schema.js";
+import { AkmConfigBaseSchema, listTopLevelConfigKeys } from "./config-schema.js";
 import { deepMergeConfig } from "./deep-merge.js";
-import { isApiKeyReference } from "./schema/primitives.js";
+import { isEnvReference } from "./schema/primitives.js";
 /**
  * Parse a dotted path into segments. Empty segments are rejected. Bracket
  * notation (e.g. `sources[0]`) is NOT supported — arrays are set as JSON.
@@ -73,6 +73,10 @@ function unwrap(schema) {
         }
     }
 }
+/** True for a schema that accepts any value (`z.unknown()`): its contents are not keys akm defines. */
+export function isOpaqueSchema(schema) {
+    return unwrap(schema) instanceof z.ZodUnknown;
+}
 /**
  * Resolve the Zod schema for a given dotted path, walking from the top-level
  * AkmConfig schema. Returns `undefined` if any path segment doesn't match a
@@ -100,7 +104,7 @@ export function resolveSchemaAt(path, config, raw) {
             }
         }
         else if (schema instanceof z.ZodRecord) {
-            // Named records (engines, improve.strategies, sources, etc.)
+            // Named records (connections, harnesses, improve.strategies, sources, etc.)
             // accept any string key — descend into the value schema.
             schema = schema._def.valueType;
         }
@@ -108,7 +112,7 @@ export function resolveSchemaAt(path, config, raw) {
             const option = selectUnionObjectOption(schema._def.options, segment, existing, index === path.length - 1 ? raw : undefined);
             if (!option)
                 return undefined;
-            schema = option.shape[segment];
+            schema = (option.shape[segment] ?? option._def.catchall);
         }
         else {
             // Cannot descend into a non-object schema.
@@ -139,7 +143,9 @@ function selectUnionObjectOption(candidates, segment, existing, raw) {
         if (selected)
             return segment in selected.shape ? selected : undefined;
     }
-    return options.find((option) => segment in option.shape);
+    return (options.find((option) => segment in option.shape) ??
+        // A model entry such as `{ model, reasoning_effort }` holds request fields the object does not name.
+        options.find((option) => !(option._def.catchall instanceof z.ZodNever)));
 }
 /**
  * Get the value at the dotted path from a config-shaped object. Returns
@@ -176,26 +182,20 @@ export function configSet(config, dotted, raw) {
     if (path.length === 1 && path[0] === "configVersion") {
         throw new UsageError("configVersion cannot be changed through config set.", "INVALID_FLAG_VALUE");
     }
-    // #454: apiKey paths are not persistable. Throw at set time.
-    rejectApiKeyPath(path, dotted);
+    // #454: a literal apiKey is not persistable. Throw at set time.
+    rejectApiKeyPath(path, raw, dotted);
     rejectLiteralApiKeyInWholeObjectSet(path, raw, dotted);
     const schema = resolveSchemaAt(path, config, raw);
-    const symbolicApiKey = (path[0] === "engines" && path[2] === "apiKey") ||
-        (path[0] === "embedding" && path.length === 2 && path[1] === "apiKey");
-    const isUnknownKey = !schema && !symbolicApiKey;
+    const isUnknownKey = !schema;
     if (isUnknownKey) {
         warnOnce(`config-set:unknown-key:${dotted}`, `"${dotted}" is not a known config key; storing it anyway. Run \`akm config get ${dotted}\` to confirm it round-trips as expected.`);
     }
     const judgmentObjectPath = isTriageJudgmentPath(path);
     const value = judgmentObjectPath && raw === "null"
         ? undefined
-        : path[0] === "engines" && path.length === 2
-            ? parseObjectPatch(raw, dotted)
-            : symbolicApiKey
-                ? raw
-                : isUnknownKey
-                    ? bestEffortJsonValue(raw)
-                    : coerceForSchema(schema, raw, dotted);
+        : isUnknownKey
+            ? bestEffortJsonValue(raw)
+            : coerceForSchema(schema, raw, dotted);
     if (path[0] === "registries")
         rejectRegistryCredentialValue(value, dotted);
     const existing = path.reduce((value, key) => {
@@ -212,18 +212,7 @@ export function configSet(config, dotted, raw) {
     // mismatches, out-of-range numbers, schema-level shape errors (writable
     // npm/website sources via .superRefine, strict-mode unknown keys in nested
     // objects, etc.) BEFORE we apply the patch.
-    const parsed = path[0] === "engines" && path.length === 2
-        ? EngineConfigSchema.safeParse(value)
-        : symbolicApiKey
-            ? isApiKeyReference(raw)
-                ? { success: true, data: value }
-                : {
-                    success: false,
-                    error: { issues: [{ path: [], message: "apiKey must be $VAR, ${VAR}, or secret://<name>" }] },
-                }
-            : isUnknownKey
-                ? { success: true, data: value }
-                : schema.safeParse(candidate);
+    const parsed = isUnknownKey ? { success: true, data: value } : schema.safeParse(candidate);
     if (!parsed.success) {
         const lines = parsed.error.issues
             .map((i) => {
@@ -255,8 +244,10 @@ function isTriageJudgmentPath(path) {
         path[5] === "judgment");
 }
 /**
- * Unset the value at the dotted path. Removes the leaf key (and prunes empty
- * parent objects if they become empty). Returns a new config object.
+ * Unset the value at the dotted path. Removes the leaf key and leaves its
+ * parent objects in place, even when they become empty: `{}` is a value here
+ * (`harnesses.opencode: {}` is how a harness is enabled). Returns a new config
+ * object.
  */
 export function configUnset(config, dotted) {
     const path = parsePath(dotted);
@@ -271,26 +262,36 @@ export function configUnset(config, dotted) {
     return unsetPath(config, path);
 }
 // ── apiKey rejection (#454) ─────────────────────────────────────────────────
+const LITERAL_API_KEY_RECIPE = "use a $VAR reference (and set that variable), or put the key in credentials.json under the block's name";
+const LITERAL_API_KEY_HINT = "Storing API keys in config.json leaks them through backups, logs, and version control. " +
+    "akm keeps keys in the environment or in credentials.json.";
+/** The three config blocks that carry an `apiKey` akm resolves at request time. */
+function isCredentialPath(path) {
+    return ((path[0] === "connections" && path.length === 3) ||
+        (path[0] === "embedding" && path.length === 2) ||
+        (path[0] === "search" && path[1] === "curateRerank" && path.length === 3));
+}
 /**
- * Embedding credentials are never persisted. Engine credentials are symbolic
- * configuration and are validated by the engine schema below.
+ * A literal `apiKey` is never persisted: on the three credential blocks only a
+ * `$VAR` reference is accepted, and an `apiKey` anywhere else is not a key akm
+ * defines.
  */
-function rejectApiKeyPath(path, dotted) {
-    if (path[0] === "engines" && path[2] === "apiKey")
-        return;
-    if (path[0] === "embedding" && path.length === 2 && path[1] === "apiKey")
+function rejectApiKeyPath(path, raw, dotted) {
+    if (path[path.length - 1] !== "apiKey")
         return;
-    const last = path[path.length - 1];
-    if (last !== "apiKey")
+    if (isCredentialPath(path) && isEnvReference(raw))
         return;
-    const recipe = recipeForApiKey(path, dotted);
-    throw new UsageError(`apiKey cannot be persisted in config; export ${recipe} instead. (key: ${dotted})`, "INVALID_FLAG_VALUE", "Storing API keys in config.json leaks them through backups, logs, and version control. " +
-        "Use the corresponding environment variable. AKM reads it at request time.");
+    throw new UsageError(`apiKey cannot be a literal in config; ${LITERAL_API_KEY_RECIPE}. (key: ${dotted})`, "INVALID_FLAG_VALUE", LITERAL_API_KEY_HINT);
+}
+/** Whether `value` holds a string `apiKey` that is not a `$VAR` reference, at any depth. */
+function holdsLiteralApiKey(value) {
+    if (!isRecord(value))
+        return false;
+    return Object.entries(value).some(([key, child]) => key === "apiKey" ? typeof child === "string" && !isEnvReference(child) : holdsLiteralApiKey(child));
 }
 function rejectLiteralApiKeyInWholeObjectSet(path, raw, dotted) {
-    const isWholeEngineSet = path[0] === "engines" && path.length === 2;
-    const isWholeEmbeddingSet = path.length === 1 && path[0] === "embedding";
-    if (!isWholeEngineSet && !isWholeEmbeddingSet)
+    const wholeObject = ["connections", "embedding", "search"].includes(path[0]) && !isCredentialPath(path);
+    if (!wholeObject)
         return;
     let parsed;
     try {
@@ -299,12 +300,9 @@ function rejectLiteralApiKeyInWholeObjectSet(path, raw, dotted) {
     catch {
         return; // Malformed JSON — the caller's own parse/coercion reports this.
     }
-    if (!isRecord(parsed) || typeof parsed.apiKey !== "string")
-        return;
-    if (isApiKeyReference(parsed.apiKey))
+    if (!holdsLiteralApiKey(parsed))
         return;
-    throw new UsageError(`apiKey cannot be persisted in config; export ${recipeForApiKey([...path, "apiKey"], `${dotted}.apiKey`)} instead. (key: ${dotted}.apiKey)`, "INVALID_FLAG_VALUE", "Storing API keys in config.json leaks them through backups, logs, and version control. " +
-        "Use the corresponding environment variable. AKM reads it at request time.");
+    throw new UsageError(`apiKey cannot be a literal in config; ${LITERAL_API_KEY_RECIPE}. (key: ${dotted})`, "INVALID_FLAG_VALUE", LITERAL_API_KEY_HINT);
 }
 function rejectRegistryCredentialValue(value, dotted) {
     const entries = Array.isArray(value) ? value : [value];
@@ -323,25 +321,6 @@ function bestEffortJsonValue(raw) {
         return raw;
     }
 }
-function parseObjectPatch(raw, key) {
-    try {
-        const value = JSON.parse(raw);
-        if (!isRecord(value))
-            throw new Error("expected an object");
-        return value;
-    }
-    catch (err) {
-        throw new UsageError(`Invalid JSON object for ${key}: ${err instanceof Error ? err.message : String(err)}`, "INVALID_JSON_CONFIG_VALUE");
-    }
-}
-function recipeForApiKey(path, _dotted) {
-    if (path[0] === "embedding")
-        return "AKM_EMBED_API_KEY";
-    if (path[0] === "engines" && typeof path[1] === "string") {
-        return `AKM_ENGINE_${path[1].toUpperCase().replaceAll("-", "_")}_API_KEY`;
-    }
-    return "AKM_LLM_API_KEY / AKM_EMBED_API_KEY";
-}
 // ── Coercion ────────────────────────────────────────────────────────────────
 /**
  * Coerce a CLI string into the value expected by the given schema. JSON-object
@@ -457,17 +436,11 @@ function unsetPath(config, path) {
     if (typeof existing !== "object" || existing === null || Array.isArray(existing)) {
         return next; // nothing to unset
     }
-    const updated = unsetPath(existing, rest);
-    if (Object.keys(updated).length === 0) {
-        delete next[head];
-    }
-    else {
-        next[head] = updated;
-    }
+    next[head] = unsetPath(existing, rest);
     return next;
 }
 // ── Hint generation (#460) ──────────────────────────────────────────────────
 export function unknownKeyHint() {
     const keys = listTopLevelConfigKeys();
-    return `Valid top-level keys: ${keys.join(", ")}. Use dotted paths for nested values (e.g. embedding.endpoint, engines.<name>.model).`;
+    return `Valid top-level keys: ${keys.join(", ")}. Use dotted paths for nested values (e.g. embedding.endpoint, connections.<name>.endpoint).`;
 }