akm-cli 0.10.261012-beta → 0.10.261014-beta

package/dist/commands/env/env-cli.js

@@ -5,8 +5,7 @@
  * `akm env` command family. Extracted verbatim from src/cli.ts (WS6) so the God
  * Module shrinks; the `main.subCommands.env` key and every subcommand's
  * args/output shape are byte-identical. The ref-resolution helpers
- * (parseEnvRef / findEnvSource / makeEnvRef / resolveEnvPath + the env-path
- * traversal guard) live in src/core/env-secret-ref.ts so env + secret share one
+ * (parseEnvRef / makeEnvRef / resolveEnvPath) live in src/core/env-secret-ref.ts so env + secret share one
  * copy.
  *
  * `akm env` manages whole `.env` files under each stash's env/ directory.
@@ -42,7 +41,7 @@ const envCreateCommand = defineJsonCommand({
     args: {
         name: {
             type: "positional",
-            description: "Env name (flat, e.g. prod → prod.env; use --path for a subdirectory)",
+            description: "Env ref (flat name, e.g. env/prod → prod.env; use --path for a subdirectory)",
             required: true,
         },
         path: {
@@ -119,10 +118,7 @@ const envPathCommand = defineJsonCommand({
         quiet: { type: "boolean", alias: "q", description: "Suppress the unsafe-source warning", default: false },
     },
     async run({ args }) {
-        const { name, absPath, source } = resolveEnvPath(args.ref);
-        if (!fs.existsSync(absPath)) {
-            throw new NotFoundError(`Env not found: ${makeEnvRef(name, source)}`);
-        }
+        const { absPath } = resolveEnvPath(args.ref);
         // The raw `.env` may contain `X=$(cmd)`, which executes if `source`d.
         // Warning goes to stderr (never contaminates the path on stdout) and is
         // suppressed with --quiet for the legitimate `_FILE` / `--env-file` use.
@@ -166,9 +162,6 @@ const envExportCommand = defineJsonCommand({
                 "       session). export never prints values to stdout, to avoid leaking them into a captured context.", "MISSING_REQUIRED_ARGUMENT");
         }
         const { name, absPath, source } = resolveEnvPath(args.ref);
-        if (!fs.existsSync(absPath)) {
-            throw new NotFoundError(`Env not found: ${makeEnvRef(name, source)}`);
-        }
         const { buildShellExportScript } = await import("./env.js");
         const resolvedOut = path.resolve(outPath);
         writeFileAtomic(resolvedOut, buildShellExportScript(absPath), 0o600);
@@ -177,16 +170,19 @@ const envExportCommand = defineJsonCommand({
 });
 /**
  * Shared implementation for `env run`. Injects an entire env file's values into
- * the child process env — never via a shell — after scanning the injected keys
- * for process-hijacking variables.
+ * the child process env — never via a shell.
  */
 async function runEnvInjected(target, opts) {
     const command = getParsedInvocation().passthroughArgs();
     if (command.length === 0) {
         throw new UsageError("Missing command. Usage: akm env run <ref> -- <command>");
     }
-    const { name, absPath, source } = resolveEnvPath(target);
-    if (!fs.existsSync(absPath)) {
+    try {
+        resolveEnvPath(target);
+    }
+    catch (error) {
+        if (!(error instanceof NotFoundError))
+            throw error;
         // Help users who reach for the removed single-key `ref/KEY` form.
         const slash = target.lastIndexOf("/");
         if (slash > 0) {
@@ -194,7 +190,8 @@ async function runEnvInjected(target, opts) {
             if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(maybeKey)) {
                 let baseExists = false;
                 try {
-                    baseExists = fs.existsSync(resolveEnvPath(target.slice(0, slash)).absPath);
+                    resolveEnvPath(target.slice(0, slash));
+                    baseExists = true;
                 }
                 catch {
                     baseExists = false;
@@ -205,16 +202,15 @@ async function runEnvInjected(target, opts) {
                 }
             }
         }
-        throw new NotFoundError(`Env not found: ${makeEnvRef(name, source)}`);
+        throw error;
     }
-    // Load → filter → secret-substitute → dangerous-key policy → keys-only
+    // Load → filter → secret-substitute → keys-only
     // audit event. Shared with the workflow engine's per-unit env bindings —
     // see env-binding.ts for the extracted core and its safety invariants.
     const { resolveEnvBinding } = await import("./env-binding.js");
     const { values: envValues } = resolveEnvBinding(target, {
         only: opts.only,
         except: opts.except,
-        allowDangerousEnvKeys: opts.allowDangerousEnvKeys,
     });
     const mergedEnv = buildChildEnv(process.env, {
         clean: opts.clean === true,
@@ -241,8 +237,8 @@ async function runEnvInjected(target, opts) {
         throw err;
     }
     // R-067: was `process.exit(result.status ?? 0)`, which terminates the
-    // process synchronously and skips the `finally { await
-    // disposeDispatchResources(); }` block in src/cli.ts's `runCommand` — even
+    // process synchronously and skips the `finally { disposeLlmUsageSink(); }`
+    // block in src/cli.ts's `runCommand` — even
     // on the success path, since this call was unconditional. Setting
     // `process.exitCode` and returning lets cleanup run while still exiting
     // with the child's exact status once the event loop drains, matching the
@@ -264,8 +260,8 @@ const envRunCommand = defineJsonCommand({
     meta: {
         name: "run",
         description: 
-        // biome-ignore lint/suspicious/noTemplateCurlyInString: literal `${secret:NAME}` token syntax documented for users, not interpolation
-        "Run a command with the env file injected into its environment: `akm env run <ref> -- <command>`. Use `-- $SHELL` for an interactive session. Restrict which variables are injected with --only / --except. Values may embed `${secret:NAME}` tokens, replaced at run time with the sibling `${secret:NAME}` value from the same bundle. Pass --clean to start the child with a minimal inherited environment instead of the full parent environment.",
+        // biome-ignore lint/suspicious/noTemplateCurlyInString: literal `${ref}` token syntax documented for users, not interpolation
+        "Run a command with the env file injected into its environment: `akm env run <ref> -- <command>`. Use `-- $SHELL` for an interactive session. Restrict which variables are injected with --only / --except. Values may embed `${ref}` tokens, replaced at run time: a `${secrets/NAME}` (or `${bundle//secrets/NAME}`) token with the secret's value, any other asset ref with its absolute path. Pass --clean to start the child with a minimal inherited environment instead of the full parent environment.",
     },
     args: {
         target: { type: "positional", description: "Env ref", required: true },
@@ -283,9 +279,12 @@ const envRunCommand = defineJsonCommand({
             type: "string",
             description: "When used with --clean, also inherit these parent env vars (comma-separated). Ignored without --clean.",
         },
+        // Deprecated no-op, accepted through 0.10 so scripts that pass it do not
+        // fail with UNKNOWN_FLAG. Installing a bundle is the trust decision: env
+        // run no longer blocks process-hijacking keys.
         "allow-dangerous-env-keys": {
             type: "boolean",
-            description: "Allow injecting a process-hijacking variable (e.g. LD_PRELOAD, GIT_SSH_COMMAND) from a third-party stash, which otherwise blocks. Use only after explicitly reviewing the env file.",
+            description: "Deprecated, no effect: env run no longer blocks process-hijacking variables. Accepted through 0.10 for existing scripts.",
             default: false,
         },
     },
@@ -295,7 +294,6 @@ const envRunCommand = defineJsonCommand({
             except: parseKeyListFlag(args.except),
             clean: args.clean === true,
             inherit: parseKeyListFlag(args.inherit) ?? [],
-            allowDangerousEnvKeys: args["allow-dangerous-env-keys"] === true,
         });
     },
 });

package/dist/commands/env/env.js

@@ -37,13 +37,11 @@
  *
  * Value parsing is delegated to the `dotenv` package.
  *
- * Secret-token substitution: env VALUES may embed `${secret:NAME}` tokens, which
- * are replaced at `env run` time with the value of the sibling `secret:NAME`
- * asset in the SAME stash (see `resolveSecretTokens`). Substitution applies to
- * values only, never keys; only the `${secret:...}` form is recognised —
- * shell-style `${VAR}` / `$VAR` are left untouched. The secret lookup is
- * injected so this module keeps its narrow dependency surface (dotenv +
- * core/common) and never reaches into the secret resolver/source machinery.
+ * Ref-token substitution: env VALUES may embed `${ref}` tokens (a secret's
+ * value, or any other asset's path), replaced when the env is injected (see
+ * `substituteRefTokens` in core/ref-token.ts and `resolveEnvBinding`).
+ * Substitution applies to values only, never keys; shell-style `${VAR}` /
+ * `$VAR` are left untouched.
  */
 import fs from "node:fs";
 import path from "node:path";
@@ -91,11 +89,11 @@ export function loadEnv(envPath) {
  * it to the literal string `$(rm -rf ~)` and we re-emit it single-quoted. This
  * backs `akm env export <ref> --out <file>` (file-only; never printed to stdout).
  *
- * NOTE: `${secret:NAME}` token substitution is intentionally NOT applied here.
- * The export path emits values single-quoted as literals, so an unsubstituted
- * `${secret:NAME}` is written verbatim (it would expand to nothing under POSIX
- * shells, never to the secret). Secret-token resolution is scoped to the
- * `env run` value-injection path only; see `resolveSecretTokens`.
+ * NOTE: `${ref}` token substitution is intentionally NOT applied here. The
+ * export path emits values single-quoted as literals, so an unsubstituted
+ * `${secrets/name}` is written verbatim (it would expand to nothing under POSIX
+ * shells, never to the secret). Token resolution is scoped to the value
+ * injection path only; see `resolveEnvBinding`.
  */
 export function buildShellExportScript(envPath) {
     const env = loadEnv(envPath);
@@ -110,52 +108,6 @@ export function buildShellExportScript(envPath) {
     }
     return lines.length > 0 ? `${lines.join("\n")}\n` : "";
 }
-/**
- * Matches a `${secret:NAME}` substitution token in an env value. The captured
- * NAME accepts the same character set as a secret asset name (letters, digits,
- * `_`, `.`, `/`, `-`). Only this exact form is recognised — shell-style
- * `${VAR}` and `$VAR` deliberately do not match and are left untouched.
- */
-const SECRET_TOKEN_RE = /\$\{secret:([A-Za-z0-9_./-]+)\}/g;
-/**
- * Replace every `${secret:NAME}` token in each value with the corresponding
- * secret value, looked up via the injected `resolveSecret`. Keys are never
- * touched. Multiple tokens per value and tokens embedded in larger strings
- * (e.g. `Bearer ${secret:a}:${secret:b}`) are all substituted.
- *
- * `resolveSecret` returns `undefined` for an unknown secret name; such names are
- * collected into `missing` (de-duplicated, in first-seen order) and their tokens
- * are left unsubstituted in the returned values. Callers MUST treat a non-empty
- * `missing` as a hard error and inject NOTHING — never partially inject.
- *
- * The lookup is injected so this module does not import the secret
- * resolver/source machinery directly, preserving its narrow dependency surface.
- * Resolved secret values must never be logged or printed by callers.
- */
-export function resolveSecretTokens(values, resolveSecret) {
-    const missing = [];
-    const missingSeen = new Set();
-    const out = {};
-    const cache = new Map();
-    for (const [key, value] of Object.entries(values)) {
-        out[key] = value.replace(SECRET_TOKEN_RE, (match, name) => {
-            let resolved = cache.get(name);
-            if (!cache.has(name)) {
-                resolved = resolveSecret(name);
-                cache.set(name, resolved);
-            }
-            if (resolved === undefined) {
-                if (!missingSeen.has(name)) {
-                    missingSeen.add(name);
-                    missing.push(name);
-                }
-                return match;
-            }
-            return resolved;
-        });
-    }
-    return { values: out, missing };
-}
 /** Create an empty env file (does nothing if it already exists). */
 export function createEnv(envPath) {
     ensureParentDir(envPath);

package/dist/commands/env/secret-cli.js

@@ -5,8 +5,7 @@
  * `akm secret` command family. Extracted verbatim from src/cli.ts (WS6) so the
  * God Module shrinks; the `main.subCommands.secret` key and every subcommand's
  * args/output shape are byte-identical. The ref-resolution helpers
- * (parseSecretRef / makeSecretRef / resolveSecretPath, plus the shared
- * findEnvSource) live in src/core/env-secret-ref.ts so env + secret share one
+ * (parseSecretRef / makeSecretRef / resolveSecretPath) live in src/core/env-secret-ref.ts so env + secret share one
  * copy.
  *
  * `akm secret` manages whole-file secrets under each stash's secrets/ directory.
@@ -32,14 +31,13 @@ import path from "node:path";
 import { getParsedInvocation } from "../../cli/invocation.js";
 import { getStringArg } from "../../cli/parse-args.js";
 import { defineGroupCommand, defineJsonCommand, output } from "../../cli/shared.js";
-import { decideDangerousEnvInjection } from "../../core/activation-policy.js";
 import { deriveCanonicalAssetName } from "../../core/asset/asset-placement.js";
 import { loadConfig } from "../../core/config/config.js";
 import { makeSecretRef, resolveSecretPath, resolveSecretWriteTarget, sensitiveMarkerPath, withEnvSecretWrite, } from "../../core/env-secret-ref.js";
 import { ConfigError, NotFoundError, UsageError } from "../../core/errors.js";
 import { appendEvent } from "../../core/events.js";
-import { warn } from "../../core/warn.js";
 import { resolveSourceEntries } from "../../indexer/search/search-source.js";
+import { isFileOrFileSymlink } from "../../indexer/walk/walker.js";
 import { readStdin } from "../../runtime.js";
 import { buildChildEnv } from "./child-env.js";
 function parseKeyListFlag(raw) {
@@ -65,7 +63,7 @@ function listSecretsRecursive() {
                     walk(full);
                     continue;
                 }
-                if (!entry.isFile())
+                if (!entry.isFile() && !(entry.isSymbolicLink() && isFileOrFileSymlink(full)))
                     continue;
                 if (entry.name.endsWith(".lock") || entry.name.endsWith(".sensitive"))
                     continue;
@@ -99,7 +97,7 @@ const secretSetCommand = defineJsonCommand({
     args: {
         ref: {
             type: "positional",
-            description: "Secret ref (flat name, e.g. secrets/deploy-key or just deploy-key; use --path for a subdirectory)",
+            description: "Secret ref (flat name, e.g. secrets/deploy-key; use --path for a subdirectory)",
             required: true,
         },
         path: {
@@ -170,9 +168,9 @@ const secretRunCommand = defineJsonCommand({
         },
     },
     async run({ args }) {
-        // Validate the target env var name FIRST (before the command split) so a
-        // dangerous/invalid name is rejected regardless of how the command is
-        // supplied — and so the failure does not depend on argv parsing.
+        // Validate the target env var name FIRST (before the command split) so an
+        // invalid name is rejected regardless of how the command is supplied — and
+        // so the failure does not depend on argv parsing.
         const varName = args.var;
         if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(varName)) {
             throw new UsageError(`"${varName}" is not a valid environment variable name.`, "INVALID_FLAG_VALUE");
@@ -182,28 +180,12 @@ const secretRunCommand = defineJsonCommand({
             throw new UsageError("Missing command. Usage: akm secret run <ref> <VAR> -- <command>");
         }
         const { name, absPath, source } = resolveSecretPath(args.ref);
-        if (!fs.existsSync(absPath)) {
-            throw new NotFoundError(`Secret not found: ${makeSecretRef(name, source)}`);
-        }
-        const { isDangerousEnvKey } = await import("../lint/env-key-rules.js");
-        if (isDangerousEnvKey(varName)) {
-            const detail = `"${varName}" is a known process-hijacking variable (e.g. LD_PRELOAD, PATH).`;
-            const decision = decideDangerousEnvInjection({
-                dangerousKeys: [varName],
-                thirdParty: Boolean(source.registryId),
-            });
-            if (decision === "block") {
-                throw new UsageError(`Refusing to inject a secret from a third-party stash into ${detail}\n` +
-                    "       Review the secret, then copy it into a first-party secret if you trust it.", "INVALID_FLAG_VALUE");
-            }
-            warn(`Injecting a secret into ${detail} Injecting anyway (first-party stash).`);
-        }
-        const { readValue } = await import("./secret.js");
+        const { readValue } = await import("../../core/secret-value.js");
         const mergedEnv = buildChildEnv(process.env, {
             clean: args.clean === true,
             inherit: parseKeyListFlag(args.inherit) ?? [],
         });
-        mergedEnv[varName] = readValue(absPath).toString("utf8");
+        mergedEnv[varName] = readValue(absPath);
         // Audit trail: record access by ref + var name only — never the value.
         appendEvent({
             eventType: "secret_access",
@@ -225,8 +207,8 @@ const secretRunCommand = defineJsonCommand({
             throw err;
         }
         // R-067: was `process.exit(result.status ?? 0)`, unconditional even on
-        // the success path — it skipped the `finally { await
-        // disposeDispatchResources(); }` cleanup in src/cli.ts's `runCommand`.
+        // the success path — it skipped the `finally { disposeLlmUsageSink(); }`
+        // cleanup in src/cli.ts's `runCommand`.
         // Setting `process.exitCode` and returning still exits with the child's
         // exact status once the event loop drains, but lets cleanup run first —
         // same pattern `emitJsonError` (src/cli/shared.ts) already established.

package/dist/commands/env/secret.js

@@ -17,7 +17,7 @@
  * The supported value-use path is:
  *
  *   - `akm secret run <ref> <VAR> -- <cmd>` — value injected into the child
- *     process env as `VAR=<value>` (see `readValue`).
+ *     process env as `VAR=<value>` (see `readValue` in `core/secret-value.ts`).
  *
  * `akm secret path <ref>` (print the file path for the Docker `/run/secrets` +
  * `_FILE` convention) was removed in 0.9.0 alongside `akm secret remove` — an
@@ -25,8 +25,8 @@
  * and could silently target different files. A ref's file still lives at
  * `<stash>/secrets/<name>`; locate or delete it there directly.
  *
- * Values are stored as raw bytes (no quoting, multi-line allowed) so they
- * round-trip byte-exact, unlike env values which forbid literal newlines.
+ * Values are stored as raw bytes (no quoting, multi-line allowed), unlike env
+ * values which forbid literal newlines; they are read back trimmed (`core/secret-value.ts`).
  */
 import { createHash } from "node:crypto";
 import fs from "node:fs";
@@ -82,13 +82,6 @@ function ensureParentDir(filePath) {
         fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
 }
 // ── Public API ──────────────────────────────────────────────────────────────
-/**
- * Read a secret's raw bytes. Internal use only (for `secret run`). Callers
- * MUST NOT write the returned value to stdout or any log.
- */
-export function readValue(secretPath) {
-    return fs.readFileSync(secretPath);
-}
 /**
  * Write (create or overwrite) a secret with the given raw bytes, atomically at
  * mode 0600 under a write-lock. No quoting; multi-line / binary allowed.