akm-cli 0.10.261012-beta → 0.10.261014-beta

package/dist/core/redaction.js

@@ -1,35 +1,6 @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
-const ENV_PASSTHROUGH_REDACTION_POLICY = {
-    HOME: "path",
-    PATH: "path",
-    USER: "identifier",
-    LANG: "identifier",
-    LC_ALL: "identifier",
-    TERM: "identifier",
-    TMPDIR: "path",
-    SYSTEMROOT: "path",
-    COMSPEC: "path",
-    PATHEXT: "path",
-    WINDIR: "path",
-    TEMP: "path",
-    TMP: "path",
-    AKM_EVENT_SOURCE: "identifier",
-    OPENCODE_CONFIG: "path",
-    CLAUDE_CONFIG: "path",
-    CODEX_CONFIG: "path",
-    XDG_CONFIG_HOME: "path",
-    XDG_DATA_HOME: "path",
-    XDG_CACHE_HOME: "path",
-    XDG_STATE_HOME: "path",
-    AWS_PROFILE: "identifier",
-    AWS_REGION: "identifier",
-    LLM_MODEL: "identifier",
-    LLM_BASE_URL: "url",
-};
-/** Environment names whose ordinary values identify runtime configuration rather than credentials. */
-export const ENV_PASSTHROUGH_REDACTION_ALLOWLIST = new Set(Object.keys(ENV_PASSTHROUGH_REDACTION_POLICY));
 const SIGNED_QUERY_KEYS = new Set([
     "accesskey",
     "accesskeyid",
@@ -190,6 +161,56 @@ function inspectCredentialBearingUrl(value, values) {
         return found;
     }
 }
+/**
+ * Shortest value an INFERRED (name-heuristic) match may contribute as a
+ * redaction needle. Declared secrets bypass this entirely.
+ *
+ * Redaction replaces substrings, so a short needle is not merely useless — it
+ * corrupts unrelated output. Below 8 the noise tier is fully intact (`1`, `0`,
+ * `/`, `80`, `true`, `xhigh`, `31999`); at 8 a chance collision with ordinary
+ * log vocabulary is negligible, and every credential format in real use is far
+ * longer. It also matches the conventional minimum password length, so a
+ * secret shorter than this is already outside normal policy.
+ */
+export const MIN_INFERRED_SECRET_LENGTH = 8;
+/**
+ * Environment names whose VALUE is treated as a credential on shape alone.
+ *
+ * The keyword must be a whole `_`-delimited word. Anchoring on only one side
+ * would drag in ordinary configuration from whichever side is left open:
+ * a leading anchor alone matches `KEYBOARD_LAYOUT` and `AUTHOR`, a trailing one
+ * matches `MONKEY` and `BYPASS`. Whole-word matching gets `GH_TOKEN`,
+ * `NPM_AUTH_TOKEN`, `MY_API_KEY`, `DB_PASS` and `AWS_SECRET_ACCESS_KEY` right.
+ */
+const INFERRED_SECRET_NAME = /(?:^|_)(?:API_?KEY|KEY|TOKEN|SECRET|PASSWORD|PASSWD|PASS|CREDENTIALS?|AUTH)(?:_|$)/i;
+/**
+ * Credential variables whose name is a single glued word, which no
+ * word-boundary rule can see. Enumerated rather than matched: loosening the
+ * pattern enough to catch `PGPASSWORD` also catches `MONKEY`.
+ *
+ * `PWD` cannot be a keyword above for the same reason it appears here as part
+ * of `MYSQL_PWD` — on its own it is the working directory.
+ */
+const KNOWN_SECRET_NAMES = new Set(["PGPASSWORD", "MYSQL_PWD"]);
+/** True when the NAME alone marks this variable as holding a credential. */
+export function isInferredSecretName(name) {
+    return KNOWN_SECRET_NAMES.has(name.toUpperCase()) || INFERRED_SECRET_NAME.test(name);
+}
+/**
+ * The values in `env` whose variable NAME marks them as credentials ({@link isInferredSecretName}), at or above
+ * {@link MIN_INFERRED_SECRET_LENGTH}. Every process akm starts inherits akm's environment, so a reply or a log that
+ * echoes one of these must be scrubbed of it; this is the one place that rule lives (task logs and dispatch replies).
+ */
+export function collectInferredSecretValues(env) {
+    const values = [];
+    for (const [name, value] of Object.entries(env)) {
+        if (value === undefined || value.length < MIN_INFERRED_SECRET_LENGTH)
+            continue;
+        if (isInferredSecretName(name))
+            values.push(value);
+    }
+    return values;
+}
 /** Collect exact secrets plus decoded values embedded in credential-bearing URLs. */
 export function collectSensitiveValues(rawValues) {
     const values = new Set();
@@ -203,29 +224,6 @@ export function collectSensitiveValues(rawValues) {
     }
     return [...values];
 }
-/**
- * Decide whether an allowlisted passthrough value may cross an output boundary.
- * The name allowlist never overrides value inspection: URL userinfo and signed
- * query credentials remain secret even under ordinarily non-secret names.
- */
-export function isEnvPassthroughValueSafeToExpose(name, value) {
-    if (value === undefined)
-        return true;
-    const policy = ENV_PASSTHROUGH_REDACTION_POLICY[name];
-    if (!policy)
-        return false;
-    const classifiedPolicy = policy;
-    switch (classifiedPolicy) {
-        case "identifier":
-        case "path":
-        case "url":
-            return !inspectCredentialBearingUrl(value);
-        default: {
-            const exhaustive = classifiedPolicy;
-            return exhaustive;
-        }
-    }
-}
 function utf8SequenceLength(firstByte) {
     if (firstByte <= 0x7f)
         return 1;
@@ -499,10 +497,23 @@ export function redactErrorBody(input) {
     }
     return out;
 }
+/**
+ * The spellings a JSON encoder gives a value inside a string literal: the
+ * `JSON.stringify` form, and the ASCII-only form with non-ASCII as `\uXXXX`
+ * (what Python's `json.dumps` writes). Empty for a value that needs no escaping.
+ */
+function jsonEscapedSpellings(value) {
+    const json = JSON.stringify(value).slice(1, -1);
+    // ASCII-only encoders (Python's ensure_ascii) also escape DEL; some (Java's) write uppercase hex.
+    const ascii = json.replace(/[\u007f-\uffff]/g, (char) => `\\u${char.charCodeAt(0).toString(16).padStart(4, "0")}`);
+    const upper = ascii.replace(/\\u([0-9a-f]{4})/g, (_match, hex) => `\\u${hex.toUpperCase()}`);
+    return [...new Set([json, ascii, upper])].filter((spelling) => spelling !== value);
+}
 export function redactSensitiveText(text, sensitiveValues) {
-    const values = [...new Set(sensitiveValues)]
-        .filter((value) => value.length > 0)
-        .sort((a, b) => b.length - a.length || a.localeCompare(b));
+    const exact = [...sensitiveValues].filter((value) => value.length > 0);
+    // A child that prints JSON writes a secret's escaped spelling (`\"`, `\\`, `\n`, `\uXXXX`),
+    // which the exact value never matches. Each escaped spelling is just another needle.
+    const values = [...new Set([...exact, ...exact.flatMap(jsonEscapedSpellings)])].sort((a, b) => b.length - a.length || a.localeCompare(b));
     if (values.length === 0)
         return text;
     const coverageDelta = new Int32Array(text.length + 1);
@@ -569,3 +580,31 @@ export function redactSensitiveValue(value, sensitiveValues) {
     };
     return redact(value);
 }
+/** What stands in for a masked value where configuration is shown. */
+export const REDACTED = "[redacted]";
+/** Query parameters that carry a credential in a URL. */
+const SECRET_QUERY_PARAM = /^(api[-_]?key|key|token|access[-_]?token|auth|password|secret|sig|signature)$/i;
+/** `scheme://user:pass@host/?token=x` with the credentials masked. Anything that is not a URL is returned as is. */
+export function redactUrlCredentials(value) {
+    if (!/^[a-z][a-z0-9+.-]*:\/\//i.test(value))
+        return value;
+    try {
+        const url = new URL(value);
+        let changed = false;
+        if (url.username || url.password) {
+            url.username = "";
+            url.password = "";
+            changed = true;
+        }
+        for (const key of [...url.searchParams.keys()]) {
+            if (SECRET_QUERY_PARAM.test(key)) {
+                url.searchParams.set(key, REDACTED);
+                changed = true;
+            }
+        }
+        return changed ? url.toString() : value;
+    }
+    catch {
+        return value;
+    }
+}

package/dist/core/ref-token.js

@@ -0,0 +1,82 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/**
+ * The one substitution token akm hands to a process or a provider: `${ref}`,
+ * where `ref` is an akm ref (`[bundle//]conceptId`). A `secrets/…` ref stands
+ * for the secret's value; any other asset ref stands for the asset's absolute
+ * path. A `${…}` body that is not an akm ref (`${HOME}`, `${PATH//:/ }`,
+ * `${v//-/_}`, `${x/a/b}`: not led by a native type and not qualified by an
+ * installed bundle) is plain text and is left alone.
+ *
+ * Kept free of the commands layer so config credentials and env values share
+ * this one function.
+ */
+import { parseBundleRef } from "./asset/asset-ref.js";
+import { typeNameFromConceptId } from "./asset/resolve-ref.js";
+export const REF_TOKEN_RE = /\$\{([^}\s]+)\}/g;
+/**
+ * Does a `${…}` body parse as an akm ref (no export fragment) that either
+ * leads with a native asset type (bundle-qualified or not) or is bundle-qualified
+ * with a bundle `isBundleInstalled` accepts? Anything else stays text, so shell
+ * syntax (`${v//-/_}`, `${x/a/b}`) is never read as a ref. A qualified opaque body
+ * follows the core ref grammar and the owner walk, whatever adapter owns it, but
+ * only for an installed bundle; with no predicate no bundle is installed.
+ */
+function isRefBody(body, isBundleInstalled) {
+    try {
+        const ref = parseBundleRef(body);
+        if (ref.fragment !== undefined)
+            return false;
+        if (typeNameFromConceptId(ref.conceptId) !== undefined)
+            return true;
+        return ref.bundle !== undefined && isBundleInstalled?.(ref.bundle) === true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Is the whole string exactly one `${ref}` token? */
+export function isRefToken(value) {
+    const body = /^\$\{([^}\s]+)\}$/.exec(value)?.[1];
+    return body !== undefined && isRefBody(body);
+}
+/** Is the whole string exactly one `${ref}` token whose ref names a `secrets/` asset? */
+export function isSecretRefToken(value) {
+    const body = /^\$\{([^}\s]+)\}$/.exec(value)?.[1];
+    return (body !== undefined && isRefBody(body) && typeNameFromConceptId(parseBundleRef(body).conceptId)?.type === "secret");
+}
+/**
+ * Replace every `${ref}` token in each value. Keys are never touched, and
+ * tokens embedded in larger strings are all substituted. `isBundleInstalled`
+ * lets a bundle-qualified body that is not led by a native type be a ref when
+ * its bundle is installed. An unresolved ref is
+ * collected in `missing` and its token left in place. Resolved secret values
+ * must never be logged or printed by callers.
+ */
+export function substituteRefTokens(values, resolve, isBundleInstalled) {
+    const missing = [];
+    const secretValues = new Set();
+    const cache = new Map();
+    const out = {};
+    for (const [key, value] of Object.entries(values)) {
+        out[key] = value.replace(REF_TOKEN_RE, (token, body) => {
+            if (!isRefBody(body, isBundleInstalled))
+                return token;
+            if (!cache.has(body))
+                cache.set(body, resolve(body));
+            const resolved = cache.get(body);
+            if (resolved === undefined) {
+                if (!missing.includes(body))
+                    missing.push(body);
+                return token;
+            }
+            if (resolved.kind === "path")
+                return resolved.path;
+            if (resolved.value)
+                secretValues.add(resolved.value);
+            return resolved.value;
+        });
+    }
+    return { values: out, missing, secretValues: [...secretValues] };
+}

package/dist/core/secret-value.js

@@ -0,0 +1,14 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+import fs from "node:fs";
+/**
+ * Read a secret's value: the file content as UTF-8 with surrounding whitespace
+ * trimmed. The one read every consumer uses (`secret run`, env `${ref}`
+ * tokens, config credentials, website fetchers), so a hand-written file's
+ * trailing newline never lands in an HTTP header. Callers MUST NOT write the
+ * returned value to stdout or any log.
+ */
+export function readValue(secretPath) {
+    return fs.readFileSync(secretPath, "utf8").trim();
+}

package/dist/core/state/migrations.js

@@ -1037,17 +1037,16 @@ export const STATE_MIGRATIONS = [
         ON workflow_run_unit_attempts(run_id, status, claim_expires_at);
     `,
     },
-    // ── Migration 023 — child workflow run parentage (P3a) ────────────────────
+    // ── Migration 023 — child workflow run parentage ──────────────────────────
     //
     // Adds the columns and partial unique index `publishChildWorkflowRun`
     // (src/storage/repositories/workflow-runs-repository.ts) needs to record a
     // durable child workflow run under the parent unit that spawned it, and to
-    // make that publication idempotent per invocation
-    // (docs/plans/specs/p3a-plan-v5-child-freeze.md §5.1).
+    // make that publication idempotent per invocation.
     //
     // Disambiguation: this migration's `workflow_runs.parent_unit_id` is the
     // PARENT RUN's unit that spawned this CHILD RUN — a cross-run composition
-    // edge, new in P3a. It is NOT the same concept as the pre-existing
+    // edge. It is NOT the same concept as the pre-existing
     // `workflow_run_units.parent_unit_id` (migration 004, consolidated above
     // into migration 020's `workflow_run_units` table, migrations.ts:934),
     // which records MAP FAN-OUT TEMPLATE PARENTAGE — one expanded unit's row
@@ -1076,12 +1075,11 @@ export const STATE_MIGRATIONS = [
         WHERE parent_run_id IS NOT NULL;
     `,
     },
-    // ── Migration 024 — workflow run outputs (P3b) ─────────────────────────────
+    // ── Migration 024 — workflow run outputs ───────────────────────────────────
     //
     // Adds workflow_runs.outputs_json — the resolved map of a plan's declared
     // outputs:, persisted once at run completion in the SAME transaction as the
-    // final step's completion (docs/plans/specs/p3b-child-executor.md §4.3,
-    // B-N13). NULL for every run whose plan declares no outputs: (the
+    // final step's completion. NULL for every run whose plan declares no outputs: (the
     // overwhelming majority, including every run before this migration) and for
     // every run that fails or blocks before completing — never `{}`.
     // `WorkflowRunsRepository.setRunOutputs` is the only writer;
@@ -1092,28 +1090,25 @@ export const STATE_MIGRATIONS = [
       ALTER TABLE workflow_runs ADD COLUMN outputs_json TEXT;
     `,
     },
-    // ── Migration 025 — task_history D8 result-vocabulary backfill ─────────────
-    //
-    // The D8 re-code (docs/architecture/decisions/0005-task-result-vocabulary-
-    // and-legacy-read-mapping.md) renamed the written `target_kind` vocabulary
-    // and marked every new row with `targetVocab: 2` in `metadata_json`, but
-    // left every row written before it in the OLD vocabulary forever, pushing
-    // the "which generation is this row" decision onto three separate read
-    // sites (src/tasks/run/task-history.ts, src/commands/health/
-    // improve-metrics.ts, src/commands/health/windows.ts). That is exactly the
-    // shape `docs/plans/specs/p4-deletions-closeout.md` row B-51 ratified
-    // keeping "forever" — SUPERSEDED here: `task_history` is DB-owned data, the
-    // remap is deterministic and total, so it belongs in a one-time migration,
-    // not three permanently-recurring read-side shims.
+    // ── Migration 025 — task_history result-vocabulary backfill ────────────────
+    //
+    // The written `target_kind` vocabulary was renamed and every new row is
+    // marked `targetVocab: 2` in `metadata_json`, but every row written before
+    // that stayed in the OLD vocabulary, which would push the "which generation
+    // is this row" decision onto three separate read sites
+    // (src/tasks/run/task-history.ts, src/commands/health/
+    // improve-metrics.ts, src/commands/health/windows.ts). `task_history` is
+    // DB-owned data and the remap is deterministic and total, so it is a
+    // one-time migration, not three permanently-recurring read-side shims.
     //
     // The remap, applied only to rows with no `targetVocab` marker yet (a
     // NULL/absent `$.targetVocab` in the JSON column — already-marked or
     // malformed metadata_json is left untouched; malformed rows are a
     // pre-existing, unrelated skip-and-warn concern at read time):
     //   - target_kind 'prompt'  -> 'command' (the prepared command/agent-LLM
-    //     arm; D8 renamed its written label, this backfills the old one)
+    //     arm; its written label was renamed, this backfills the old one)
     //   - target_kind 'command' -> 'shell'   (the legacy native shell/script
-    //     arm's shared old label; D8 split it into 'shell'/'script', and only
+    //     arm's shared old label; it was split into 'shell'/'script', and only
     //     'shell' is reconstructable — the old vocabulary never distinguished
     //     script from shell, matching the read mapping this migration retires)
     // Only 'prompt' and legacy 'command' rows actually change meaning between

package/dist/core/structured.js

@@ -1,79 +1,13 @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
-/**
- * `runStructured<T>()` — transport-free structured-output core (P0.5 seam).
- *
- * akm has two structured-output paths that share no code: the LLM HTTP path
- * (`llm/structured-call.ts` + `responseSchema`) and the agent JSON path
- * (`agent/spawn.ts` `parseOutput: "json"` — embedded-JSON scan, no schema,
- * no retry). This module is the ONE validation-driven retry loop both are
- * meant to converge on: the workflow engine's schema units compose it with a
- * dispatch adapter per runner (llm = `chatCompletion` + `responseSchema`;
- * agent/sdk = `runAgent`/`runOpencodeSdk` + prompt-injected schema;
- * native-schema CLIs pass the schema through and still validate).
- *
- * Layering: this file lives in `core/` — NOT `llm/` — because the agent path
- * must be able to reach it and `agent/ ⇏ llm/` is an enforced invariant
- * (`tests/integration/architecture/agent-no-llm-sdk-guard.test.ts`). The transport is
- * always injected; this module never performs IO of its own.
- *
- * Retry semantics: only parse/validation misses are retried (with corrective
- * feedback appended to the re-dispatch). Transport errors PROPAGATE — the
- * transports own their own retry discipline (`chatCompletion` has a bounded
- * jittered retry; `runAgent` has timeout/abort semantics).
- */
-import { parseEmbeddedJsonResponse } from "./parse.js";
 /**
  * Append the one structured-output instruction to a prompt. Agent lowering
- * appends it to every schema-bearing request, alongside a harness's native
- * channel where one exists (codex `--output-schema`); the workflow engine
+ * appends it to every schema-bearing request, alongside a transport's native
+ * channel where one exists (a chat's `response_format`); the workflow engine
  * appends it for a direct-LLM unit. Resumed workflow runs depend on these
  * exact bytes, so do not reword it.
  */
 export function withSchemaInstruction(prompt, schema) {
     return `${prompt}\n\nRespond with ONLY a JSON value matching this JSON Schema (no prose, no code fences):\n${JSON.stringify(schema)}`;
 }
-export function defaultFeedback(failure) {
-    if (failure.reason === "parse_error") {
-        return "Your previous response contained no parseable JSON. Respond with ONLY a JSON value that matches the requested schema — no prose, no code fences.";
-    }
-    return `Your previous JSON response failed validation:\n- ${failure.errors.join("\n- ")}\nRespond again with ONLY a corrected JSON value.`;
-}
-/**
- * Run the dispatch→parse→validate loop, re-dispatching with corrective
- * feedback on parse/validation misses, up to `maxAttempts` total attempts.
- * Never throws for structure problems (returns a typed failure); transport
- * throws propagate untouched.
- */
-export async function runStructured(options) {
-    const parse = options.parse ?? ((raw) => parseEmbeddedJsonResponse(raw));
-    const buildFeedback = options.buildFeedback ?? defaultFeedback;
-    const maxAttempts = Math.max(1, options.maxAttempts ?? 2);
-    let feedback;
-    let lastFailure;
-    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
-        const raw = await options.dispatch(feedback);
-        const candidate = parse(raw);
-        if (candidate === undefined) {
-            lastFailure = {
-                ok: false,
-                reason: "parse_error",
-                errors: ["no JSON structure found in response"],
-                attempts: attempt,
-                raw,
-            };
-            feedback = buildFeedback({ reason: "parse_error", errors: lastFailure.errors, raw });
-            continue;
-        }
-        const verdict = options.validate(candidate);
-        if (verdict.ok) {
-            return { ok: true, value: verdict.value, attempts: attempt };
-        }
-        lastFailure = { ok: false, reason: "validation_error", errors: verdict.errors, attempts: attempt, raw };
-        feedback = buildFeedback({ reason: "validation_error", errors: verdict.errors, raw });
-    }
-    // maxAttempts >= 1 guarantees at least one loop iteration set lastFailure
-    // (a success would have returned), so the non-null assertion is safe.
-    return lastFailure;
-}

package/dist/core/subprocess.js

@@ -11,8 +11,10 @@
  *   • Process-GROUP spawn (`detached: true` when capturing ON POSIX) so a
  *     negative-pid kill reaps the whole descendant tree — no orphaned children.
  *     See {@link spawnsOwnProcessGroup} for why Windows is excluded.
- *   • A SIGTERM→SIGKILL kill ladder on timeout/abort — a child that ignores
- *     SIGTERM is force-killed after a grace period instead of wedging forever.
+ *   • A SIGINT→SIGTERM→SIGKILL kill ladder on timeout/abort — SIGINT first, as
+ *     a Ctrl-C would, so a program that treats an interrupt as a stop can wind
+ *     the run down; a child that ignores it is terminated, and one that ignores
+ *     that is force-killed, each after a grace period, instead of wedging forever.
  *   • Time-bounded output capture ({@link readStream}) that cannot block past
  *     the wall budget even when the child leaves a pipe endpoint open, plus an
  *     OPT-IN RETENTION cap (`maxOutputBytes`); see {@link readStream} for what
@@ -94,27 +96,58 @@ export function killGroup(proc, signal) {
         /* ignore */
     }
 }
+/** Whether anything still runs in `proc`'s process group (the leader included), or the leader has not exited. */
+function groupRunning(proc) {
+    if (typeof proc.pid === "number") {
+        try {
+            process.kill(-proc.pid, 0);
+            return true;
+        }
+        catch {
+            // No member is left, or the child leads no group of its own: only the leader's own exit tells.
+        }
+    }
+    return proc.exitCode === null;
+}
 /**
- * SIGTERM→SIGKILL kill ladder shared by the timeout and abort paths (§4.6
- * dedup, H3). No-op when the child has already exited; otherwise runs
- * `onKill` (the caller's reason flag — `timedOut` / `aborted` — set BEFORE
- * the first signal, exactly as the inlined copies did), SIGTERMs the
- * process group, and schedules a follow-up SIGKILL after `graceMs` in case
- * the process ignores SIGTERM. The SIGKILL timer is unref'ed so it never
- * pins the event loop.
+ * SIGINT→SIGTERM→SIGKILL kill ladder shared by the timeout and abort paths.
+ * No-op when the child has already exited; otherwise runs `onKill`
+ * (the caller's reason flag — `timedOut` / `aborted` — set BEFORE the first
+ * signal, exactly as the inlined copies did) and interrupts the process group.
+ * SIGTERM follows when `graceMs` runs out or as soon as the leader exits,
+ * whichever is first, because members of the group can outlive it: a job a
+ * shell started in the background ignores SIGINT. SIGKILL follows another
+ * `graceMs` later if anything in the group still runs. The timers are unref'ed
+ * so they never pin the event loop.
+ *
+ * SIGINT goes first because it is what a person's Ctrl-C sends, and a program
+ * that records how a run ended acts on it: the OpenCode 2 CLI marks its session
+ * interrupted and releases its claim, where on SIGTERM or SIGKILL the session
+ * stays suspended and OpenCode's own service may resume it later.
  */
 export function scheduleKillLadder(proc, opts) {
     if (!proc || proc.exitCode !== null)
         return;
     opts.onKill();
-    killGroup(proc, "SIGTERM");
-    const sigkillTimer = opts.setTimeoutFn(() => {
-        if (!proc || proc.exitCode !== null)
+    const afterGrace = (run) => {
+        const timer = opts.setTimeoutFn(run, opts.graceMs ?? 5000);
+        if (typeof timer !== "number")
+            timer.unref?.();
+    };
+    killGroup(proc, "SIGINT");
+    let terminated = false;
+    const terminate = () => {
+        if (terminated || !groupRunning(proc))
             return;
-        killGroup(proc, "SIGKILL");
-    }, opts.graceMs ?? 5000);
-    if (typeof sigkillTimer !== "number")
-        sigkillTimer.unref?.();
+        terminated = true;
+        killGroup(proc, "SIGTERM");
+        afterGrace(() => {
+            if (groupRunning(proc))
+                killGroup(proc, "SIGKILL");
+        });
+    };
+    afterGrace(terminate);
+    proc.exited.then(terminate, terminate);
 }
 const liveGroupChildren = new Set();
 let signalGuardHandlers;
@@ -211,7 +244,7 @@ function utf8BoundaryAtOrBefore(value, limit) {
 }
 /**
  * Drain a readable stream to text, optionally racing each read against a
- * timeout so a process that is killed via SIGTERM/SIGKILL but whose pipe
+ * timeout so a process that is killed via SIGINT/SIGTERM/SIGKILL but whose pipe
  * endpoints stay open (e.g. background threads still holding the fd) cannot
  * block the caller indefinitely. On timeout we return whatever was decoded
  * before the pipe stopped draining.
@@ -368,7 +401,7 @@ function toError(err) {
 }
 /**
  * Spawn `cmd` and manage its lifecycle: process-group spawn, hard timeout and
- * cooperative abort (both via the SIGTERM→SIGKILL {@link scheduleKillLadder}),
+ * cooperative abort (both via the SIGINT→SIGTERM→SIGKILL {@link scheduleKillLadder}),
  * bounded output capture, and an optional stdin payload. Never throws for a
  * spawn/exit failure — those surface as {@link ManagedSubprocessResult.spawnError}.
  */
@@ -413,7 +446,7 @@ export async function runManagedSubprocess(cmd, opts) {
         };
     }
     opts.onSpawn?.(proc);
-    // Hard timeout: SIGTERM now, SIGKILL after the grace period if ignored.
+    // Hard timeout: SIGINT now, SIGTERM and SIGKILL after each grace period if ignored.
     // Skipped entirely when timeoutMs is null.
     let timedOut = false;
     let timer;
@@ -495,9 +528,17 @@ export async function runManagedSubprocess(cmd, opts) {
         const stdinStream = proc.stdin;
         const stdinDone = (async () => {
             try {
-                const writer = stdinStream.getWriter();
-                await writer.write(new TextEncoder().encode(stdinPayload));
-                await writer.close();
+                // Bun.spawn's pipe is a FileSink (write/end), not a WritableStream.
+                const sink = stdinStream;
+                if (typeof sink.write === "function" && typeof sink.end === "function" && !("getWriter" in stdinStream)) {
+                    sink.write(stdinPayload);
+                    await sink.end();
+                }
+                else {
+                    const writer = stdinStream.getWriter();
+                    await writer.write(new TextEncoder().encode(stdinPayload));
+                    await writer.close();
+                }
             }
             catch {
                 // Best-effort: ignore stdin write failures, the child will get EOF.

package/dist/core/type-presentation.js

@@ -2,33 +2,29 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 /**
- * Chunk 1.5 (WI-1.5.1, D1.5-4) — the §2.3 "compile-time safety mitigation"
- * table for AKM's own presentation metadata. EXTENDED by chunk-2 WI-C
- * (`docs/architecture/specs/akm-0.9.0-bundle-adapter-spec.md` §2) to carry the per-`type`
- * renderer NAME + action builder, so this table becomes the `TYPE_PRESENTATION`
- * data table §2 mandates ("Renderer/action = data table keyed on the open
- * `type`, pointing at a named-function core module").
+ * The `TYPE_PRESENTATION` table of AKM's own presentation metadata: the per-`type`
+ * renderer NAME + action builder, a data table keyed on the open
+ * `type`, pointing at a named-function core module.
  *
- * The open type token (chunk 1.5) trades the deleted closed asset-type
+ * The open type token trades the deleted closed asset-type
  * union's exhaustiveness checking for a runtime lookup. `TYPE_PRESENTATION`
  * restores that exhaustiveness for AKM's OWN known types (the compiler
  * demands an entry whenever {@link KnownType} gains a member), while
  * {@link presentationFor} stays open over `string` so foreign/adapter types
  * still resolve to a sane generic fallback instead of `undefined`/a throw.
  *
- * ── renderer/action provenance (WI-C, §2) ──
+ * ── renderer/action provenance ──
  *
  * The `renderer` NAMES and `action` builders below are the SINGLE SOURCE OF
- * TRUTH for search-hit rendering — chunk-3 folded the old mutable renderer/
- * action registry singleton into this static table (reached via
- * {@link presentationFor}). They cover all built-in types — INCLUDING
+ * TRUTH for search-hit rendering (reached via {@link presentationFor}).
+ * They cover all built-in types — INCLUDING
  * the 15th type `instruction` (a read-like-knowledge markdown doc added for the
  * format-family adapters) and the 6 "static-only" mappings
- * (script/skill/command/agent/knowledge/memory) — §6 "6 renderer mappings".
+ * (script/skill/command/agent/knowledge/memory).
  * The workflow action is the one function-valued builder; its
  * `buildWorkflowAction` body (`output/renderers.ts` — a cycle-sensitive module)
  * is reproduced inline here rather than imported, to keep this leaf import-free
- * (only `recognition-util`, D1-5's pure sink); `tests/core/adapter/
+ * (only `recognition-util`, a pure sink); `tests/core/adapter/
  * akm-presentation.test.ts` pins the renderer/action values against drift.
  */
 import { isKnownType } from "./recognition-util.js";
@@ -119,7 +115,7 @@ export const TYPE_PRESENTATION = {
         action: (ref) => `akm show ${ref} -> read the stash fact and apply it as durable context`,
     },
     // `instruction` (CLAUDE.md / AGENTS.md) is a read-like-knowledge markdown
-    // doc (spec §6/§7 instruction row, maintainer resolution 2026-07): it REUSES
+    // doc: it REUSES
     // the `knowledge-md` renderer and mirrors knowledge's read action, so an
     // instruction hit renders exactly like knowledge instead of the generic
     // fallback (the parity guard in akm-presentation.test.ts pins this).