akm-cli 0.10.261012-beta → 0.10.261014-beta

package/dist/storage/sqlite-read-snapshot.js

@@ -101,6 +101,38 @@ function copyFileOutsideThisProcess(source, destination) {
     const reason = result.stderr.trim() || (result.signal ? `killed by ${result.signal}` : `exit status ${result.status}`);
     throw new Error(`cp could not copy ${source}: ${reason}`);
 }
+/**
+ * Copy a stable main/WAL pair of the database at `dbPath` to `snapshotPath`
+ * (and `<snapshotPath>-wal`), never attaching SQLite to the source. Retries
+ * while a writer is active; throws {@link SqliteReadSnapshotUnavailableError}
+ * when the files never settle.
+ */
+export function copySqliteSnapshot(dbPath, snapshotPath) {
+    for (let attempt = 0; attempt < SNAPSHOT_MAX_ATTEMPTS; attempt++) {
+        if (attempt > 0)
+            sleepSync(SNAPSHOT_BACKOFF_MS * attempt);
+        try {
+            if (pathExists(`${dbPath}-journal`))
+                continue;
+            const before = databaseFingerprint(dbPath);
+            copyFileOutsideThisProcess(dbPath, snapshotPath);
+            if (before.wal)
+                copyFileOutsideThisProcess(`${dbPath}-wal`, `${snapshotPath}-wal`);
+            else
+                fs.rmSync(`${snapshotPath}-wal`, { force: true });
+            const after = databaseFingerprint(dbPath);
+            if (fingerprintsEqual(before, after) && !pathExists(`${dbPath}-journal`))
+                return;
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                continue;
+            throw error;
+        }
+    }
+    throw new SqliteReadSnapshotUnavailableError(`SQLite main/WAL files did not settle after ${SNAPSHOT_MAX_ATTEMPTS} attempts with backoff — ` +
+        "a writer may be continuously active, or a hot rollback journal never cleared");
+}
 /**
  * Open an isolated copy of an existing SQLite database.
  *
@@ -118,35 +150,7 @@ export function openSqliteReadSnapshot(dbPath) {
     const snapshotPath = path.join(snapshotDir, "snapshot.db");
     let db;
     try {
-        let copied = false;
-        for (let attempt = 0; attempt < SNAPSHOT_MAX_ATTEMPTS; attempt++) {
-            if (attempt > 0)
-                sleepSync(SNAPSHOT_BACKOFF_MS * attempt);
-            try {
-                if (pathExists(`${dbPath}-journal`))
-                    continue;
-                const before = databaseFingerprint(dbPath);
-                copyFileOutsideThisProcess(dbPath, snapshotPath);
-                if (before.wal)
-                    copyFileOutsideThisProcess(`${dbPath}-wal`, `${snapshotPath}-wal`);
-                else
-                    fs.rmSync(`${snapshotPath}-wal`, { force: true });
-                const after = databaseFingerprint(dbPath);
-                if (fingerprintsEqual(before, after) && !pathExists(`${dbPath}-journal`)) {
-                    copied = true;
-                    break;
-                }
-            }
-            catch (error) {
-                if (error.code === "ENOENT")
-                    continue;
-                throw error;
-            }
-        }
-        if (!copied) {
-            throw new SqliteReadSnapshotUnavailableError(`SQLite main/WAL files did not settle after ${SNAPSHOT_MAX_ATTEMPTS} attempts with backoff — ` +
-                "a writer may be continuously active, or a hot rollback journal never cleared");
-        }
+        copySqliteSnapshot(dbPath, snapshotPath);
         db = openDatabaseFinalizing(snapshotPath, { readonly: true, create: false });
         const closeSnapshot = db.close.bind(db);
         let closed = false;

package/dist/tasks/embedded.js

@@ -69,7 +69,7 @@ export function listEmbeddedTasks() {
             }
             let parsed;
             try {
-                parsed = parseTaskSource({ yaml, filePath, workspaceRoot: TASKS_ASSETS_DIR });
+                parsed = parseTaskSource({ yaml, filePath });
             }
             catch {
                 continue;

package/dist/tasks/log-redaction.js

@@ -1,110 +1,9 @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
-/**
- * Decide which exact values must be scrubbed from a task's persisted run log
- * (issue #755).
- *
- * # The gap
- *
- * All three task target kinds funnel through `persistRunLog`, which applied
- * only `redactCredentialPatterns` — credential *shapes* (`Bearer …`, `sk-…`,
- * webhook URLs). Prompt- and workflow-target runs additionally redact the exact
- * secret values reachable by the run before their output ever reaches the log.
- * Command-target runs did not: a scheduled command that echoed a configured
- * secret whose value is not credential-shaped persisted it verbatim, into both
- * the `.log` file and `logs.db`, for the whole retention window.
- *
- * # Why the obvious fix is wrong
- *
- * The issue proposed reusing {@link isEnvPassthroughValueSafeToExpose} — the
- * filter the prompt path uses — over the env handed to the child. That filter
- * fails CLOSED for any name outside a 22-entry allowlist, which is right where
- * it currently runs: the prompt path filters `envPassthrough`, a short list the
- * operator explicitly declared. A command task inherits the WHOLE ambient
- * environment, so the same rule classifies essentially everything as secret.
- * Measured on a developer machine: 127 of 132 variables, 25 of them with
- * one-character values (`SHLVL=1`, `OLDPWD=/`, `GIT_TERMINAL_PROMPT=0`).
- * Redaction is substring replacement, so those become live needles:
- *
- *     Build finished in 12.4s        ->  Build finished in [REDACTED]2.[REDACTED]s
- *     3 tests passed, 0 failed       ->  [REDACTED] tests passed, [REDACTED] failed
- *     wrote dist/index.js (48 KB)    ->  wrote dist[REDACTED]index.js ([REDACTED]8 KB)
- *
- * A fix that destroys every command log is not a fix.
- *
- * # What this does instead
- *
- * Three sources, and the distinction between them is the whole design:
- *
- *  1. **Declared by config** — the config names which variables hold
- *     credentials (`engines.<n>.apiKey: ${VAR}`, `embedding.apiKey`, and the
- *     implicit `AKM_ENGINE_<NAME>_API_KEY` / `AKM_LLM_API_KEY` /
- *     `AKM_EMBED_API_KEY` recipes). akm KNOWS these are secret.
- *  2. **Declared by the task** — the `redact:` list, names only.
- *  3. **Inferred** — a name-shape heuristic over the remaining environment, for
- *     the ambient credential akm was never told about.
- *
- * Only (3) is a guess, so only (3) carries {@link MIN_INFERRED_SECRET_LENGTH}.
- * A declared secret is redacted at ANY length, because the operator told us
- * what it is; applying a floor to declared values would silently stop redacting
- * short secrets that are scrubbed today. The floor exists solely to stop a
- * *guess* from mangling a log, and 8 clears every real credential format (AWS
- * key id 20, GitHub PAT 40, `sk-…` 40+) while excluding the flags and counters
- * that a name heuristic occasionally catches.
- *
- * Note what is deliberately NOT collected: the akm secret store on disk. A
- * spawned command sees `process.env`, not akm's stores — a stored secret can
- * only be echoed if it is already in the environment, where the rules above
- * catch it by name. Walking every bundle's `secrets/` on each task firing would
- * cost a recursive readdir plus an unbounded read for values the child cannot
- * reach anyway. `redact:` is the escape hatch for a secret injected under a
- * name none of the rules recognise.
- */
-import { collectSensitiveValues, isEnvPassthroughValueSafeToExpose } from "../core/redaction.js";
-import { collectEngineCredentialValues } from "../integrations/agent/engine-resolution.js";
-/**
- * Shortest value an INFERRED (name-heuristic) match may contribute as a
- * redaction needle. Declared secrets bypass this entirely.
- *
- * Redaction replaces substrings, so a short needle is not merely useless — it
- * corrupts unrelated output. Below 8 the noise tier is fully intact (`1`, `0`,
- * `/`, `80`, `true`, `xhigh`, `31999`); at 8 a chance collision with ordinary
- * log vocabulary is negligible, and every credential format in real use is far
- * longer. It also matches the conventional minimum password length, so a
- * secret shorter than this is already outside normal policy.
- */
-export const MIN_INFERRED_SECRET_LENGTH = 8;
-/**
- * Environment names whose VALUE is treated as a credential on shape alone.
- *
- * The keyword must be a whole `_`-delimited word. Anchoring on only one side
- * would drag in ordinary configuration from whichever side is left open:
- * a leading anchor alone matches `KEYBOARD_LAYOUT` and `AUTHOR`, a trailing one
- * matches `MONKEY` and `BYPASS`. Whole-word matching gets `GH_TOKEN`,
- * `NPM_AUTH_TOKEN`, `MY_API_KEY`, `DB_PASS` and `AWS_SECRET_ACCESS_KEY` right.
- */
-const INFERRED_SECRET_NAME = /(?:^|_)(?:API_?KEY|KEY|TOKEN|SECRET|PASSWORD|PASSWD|PASS|CREDENTIALS?|AUTH)(?:_|$)/i;
-/**
- * Credential variables whose name is a single glued word, which no
- * word-boundary rule can see. Enumerated rather than matched: loosening the
- * pattern enough to catch `PGPASSWORD` also catches `MONKEY`.
- *
- * `PWD` cannot be a keyword above for the same reason it appears here as part
- * of `MYSQL_PWD` — on its own it is the working directory.
- */
-const KNOWN_SECRET_NAMES = new Set(["PGPASSWORD", "MYSQL_PWD"]);
-/** True when the NAME alone marks this variable as holding a credential. */
-export function isInferredSecretName(name) {
-    return KNOWN_SECRET_NAMES.has(name.toUpperCase()) || INFERRED_SECRET_NAME.test(name);
-}
-/** Resolve `${VAR}` / `$VAR` to the variable NAME, or undefined for anything else. */
-function envRefName(spec) {
-    if (!spec)
-        return undefined;
-    const match = /^\$\{?([A-Za-z_][A-Za-z0-9_]*)\}?$/.exec(spec.trim());
-    return match?.[1];
-}
+import { collectCredentialValues } from "../core/config/credentials.js";
+import { collectInferredSecretValues, collectSensitiveValues } from "../core/redaction.js";
+export { isInferredSecretName, MIN_INFERRED_SECRET_LENGTH } from "../core/redaction.js";
 /**
  * Every value that must be scrubbed from one task's persisted output.
  *
@@ -127,28 +26,17 @@ export function collectTaskLogSensitiveValues(input) {
         if (trimmed.length > 0)
             values.add(trimmed);
     };
-    // (1) Declared by config — engine credentials, via the collector the prompt
-    // path already uses, plus the embedding key it does not cover.
+    // (1) Declared by config — every key a connection, the embedder or the reranker can resolve.
     if (config) {
-        for (const value of collectEngineCredentialValues(config, env))
+        for (const value of collectCredentialValues(config, env))
             values.add(value);
-        addDeclared(env[envRefName(config.embedding?.apiKey) ?? "AKM_EMBED_API_KEY"]);
     }
     // (2) Declared by the task's `redact:` list — names only, never values.
     for (const name of declaredNames ?? [])
         addDeclared(env[name]);
-    // (3) Inferred from the name shape. The only guessing tier, so the only one
-    // with a length floor — and still subject to the value-level check that keeps
-    // an allowlisted name from being treated as secret.
-    for (const [name, value] of Object.entries(env)) {
-        if (value === undefined || value.length < MIN_INFERRED_SECRET_LENGTH)
-            continue;
-        if (!isInferredSecretName(name))
-            continue;
-        if (isEnvPassthroughValueSafeToExpose(name, value))
-            continue;
+    // (3) Inferred from the name shape, the one guessing tier (`collectInferredSecretValues`).
+    for (const value of collectInferredSecretValues(env))
         values.add(value);
-    }
     // Expands credential-bearing URLs into their embedded components. Can yield
     // needles shorter than the floor (a URL's password), which is correct: the
     // operator's own value implied them.

package/dist/tasks/prepare/prepare-support.js

@@ -4,6 +4,7 @@
 import { makeBundleRef, parseBundleRef } from "../../core/asset/asset-ref.js";
 import { COMPOSITION_INVALID_MULTI_JOB_HINT, ConfigError, NotFoundError, UsageError } from "../../core/errors.js";
 import { DURATION_UNITS, parseDuration } from "../../core/time.js";
+import { warn } from "../../core/warn.js";
 import { isPortableExecutionAgentSelector } from "../../execution/source.js";
 import { buildExecution } from "../../integrations/agent/execution.js";
 import { resolveAssetPath } from "../../sources/resolve.js";
@@ -22,7 +23,7 @@ export function environmentSnapshot(environment) {
             continue;
         const value = String(raw);
         if (isInferredSecretName(key) || detectSecretShapedParams({ [key]: value }).length > 0) {
-            throw new UsageError(`Task env.${key} is a secret-shaped literal env value. Store credentials in a secret/env binding rather than durable task source.`, "TASK_SOURCE_INVALID");
+            warn(`Task env.${key} looks like a credential. Task source is durable and readable; keep the value in a secret or env file and inject it at run time with \`akm secret run\` or \`akm env run\` in the task's \`run:\`. (Heuristic warning; the value is used as written.)`);
         }
         Object.defineProperty(out, key, { value, enumerable: true, configurable: false, writable: false });
     }
@@ -66,11 +67,12 @@ export function currentExecutionValues(document, context, environment) {
                     : agent,
             }
             : {}),
+        ...(own(akm, "connection") ? { connection: akm?.connection } : {}),
+        ...(own(akm, "harness") ? { harness: akm?.harness } : {}),
         ...(own(akm, "engine") ? { engine: akm?.engine } : {}),
         ...(own(akm, "model") ? { model: akm?.model } : {}),
         ...(own(akm, "inference") ? { inference: akm?.inference } : {}),
         ...(own(akm, "outputSchema") ? { outputSchema: akm?.outputSchema } : {}),
-        ...(own(akm, "tools") ? { tools: akm?.tools } : {}),
         ...(own(akm, "timeout") ? { timeout: akm?.timeout } : {}),
         workspace: context.bundleRoot,
         environment,
@@ -109,8 +111,8 @@ export function defaultTaskShell(platform) {
 }
 export function validatePreparedCommand(invocation, context) {
     const { request } = invocation;
-    if (!request.engine.name) {
-        throw new ConfigError(`Task ${JSON.stringify(context.taskRef)} has no resolved execution engine. Configure defaults.engine or akm.engine before running it.`, "INVALID_CONFIG_FILE");
+    if (!request.target.name) {
+        throw new ConfigError(`Task ${JSON.stringify(context.taskRef)} has no resolved connection or harness. Run \`akm setup\`, or set akm.connection or akm.harness before running it.`, "INVALID_CONFIG_FILE");
     }
     // Lowering is pure. Running it before the durable-attempt boundary proves
     // the selected target is transport-projectable; dispatch repeats the same
@@ -120,10 +122,9 @@ export function validatePreparedCommand(invocation, context) {
 }
 export function validateWorkflowRuntimeSource(file, workspaceRoot, readFile) {
     const source = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(readFile(file, workspaceRoot));
-    const compiled = compileWorkflowSource(source, { path: file, workspaceRoot });
+    const compiled = compileWorkflowSource(source, { path: file });
     if (!compiled.ok) {
-        // P4-N2's mapping (docs/plans/specs/p4-deletions-closeout.md §3.3.4): a
-        // task-wrapped workflow target's own multi-job source is a composition
+        // A task-wrapped workflow target's own multi-job source is a composition
         // failure, same as freezing it directly would be; any other compile
         // failure is WORKFLOW_SOURCE_INVALID.
         const detail = compiled.errors.map((error) => `${error.path}:${error.line}: ${error.message}`).join("; ");

package/dist/tasks/prepare/prepare.js

@@ -5,7 +5,7 @@
  * Pure task runtime projection.
  *
  * This is the only bridge from an already-parsed, already-projected task
- * source document (the `PreparableTaskDocument` seam, P4-N4) into executable
+ * source document (the `PreparableTaskDocument` seam) into executable
  * work. It performs all source/config/asset reads before the task runner
  * reserves a durable attempt and returns immutable snapshots. In particular,
  * script work contains frozen bytes and their digest, never a path that can
@@ -14,30 +14,29 @@
  * `prepareTaskV3Execution`'s three production callers are
  * `src/tasks/run/load-task.ts`, `src/tasks/scheduler-sync.ts`, and
  * `src/workflows/freeze/targets/task.ts`'s `taskDispatch`. The name and the
- * `TaskV3*` type family it takes stay (spec docs/plans/specs/p4-deletions-closeout.md
- * §0, R-R1) — only task source v4 ever reaches this function now, always via
- * `src/tasks/source/project-v4.ts`'s `projectTaskSourceV4()`.
+ * `TaskV3*` type family it takes stay; only task source v4 ever reaches this
+ * function now, always via `src/tasks/source/project-v4.ts`'s
+ * `projectTaskSourceV4()`.
  */
 import fs from "node:fs";
+import path from "node:path";
 import { prepareCommandInvocation } from "../../commands/command/command-execution.js";
 import { UsageError } from "../../core/errors.js";
 import { warn } from "../../core/warn.js";
 import { base, commandEnvironmentSnapshot, currentExecutionValues, defaultTaskShell, environmentSnapshot, qualifyOwnedRef, resolvedOwnedAsset, validatePreparedCommand, validateWorkflowRuntimeSource, } from "./prepare-support.js";
-import { captureDirectoryIdentity, captureScriptTarget } from "./script-capture.js";
+import { captureScriptTarget } from "./script-capture.js";
 /** Project one canonical task-v3 source into immutable executable work. */
 export async function prepareTaskV3Execution(document, context) {
     const environment = environmentSnapshot(document.env);
     const commandEnvironment = commandEnvironmentSnapshot(environment, context.schedulerContext);
     const common = base(document, context, environment);
     if (document.target.kind === "run") {
-        const cwdIdentity = captureDirectoryIdentity(context.bundleRoot, document.target.workingDirectory);
         return Object.freeze({
             ...common,
             kind: "shell",
             command: document.target.run,
             shell: document.target.shell ?? defaultTaskShell(context.platform ?? process.platform),
-            cwd: cwdIdentity.realCwd,
-            cwdIdentity,
+            cwd: path.resolve(context.bundleRoot, document.target.workingDirectory ?? "."),
         });
     }
     const target = document.target.uses;
@@ -98,7 +97,7 @@ export async function prepareTaskV3Execution(document, context) {
         throw new UsageError("Script refs do not accept with.", "COMPOSITION_INVALID");
     }
     const resolved = await resolvedOwnedAsset(qualified, "script", context);
-    // Shared with prepare-script-target.ts's prepareScriptTarget() (spec §4.3):
+    // Shared with prepare-script-target.ts's prepareScriptTarget():
     // one implementation of the byte/interpreter capture, not two.
     const captured = captureScriptTarget(qualified, resolved.file, resolved.bundleRoot, context.readFile ?? ((targetPath) => fs.readFileSync(targetPath)));
     return Object.freeze({

package/dist/tasks/prepare/script-capture.js

@@ -2,18 +2,15 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 /**
- * The one shared implementation of frozen-script byte/interpreter capture
- * (spec docs/plans/specs/p1b-model-extraction.md §4.3). Both prepare.ts's
- * script arm (the moved prepareTaskV3Execution) and
+ * The one shared implementation of frozen-script byte/interpreter capture.
+ * Both prepare.ts's script arm (prepareTaskV3Execution) and
  * prepare-script-target.ts's typed prepareScriptTarget() call
  * captureScriptTarget() below, so the two never drift into two copies of the
- * same capture logic. scriptInterpreter() and captureDirectoryIdentity() are
- * moved body-intact out of the pre-P1b src/tasks/runtime-v3.ts.
+ * same capture logic.
  */
 import { createHash } from "node:crypto";
 import path from "node:path";
 import { UsageError } from "../../core/errors.js";
-import { captureFrozenDirectoryIdentity } from "../../execution/directory-identity.js";
 import { isBunStandaloneMain } from "../resolve-akm-bin.js";
 const SCRIPT_INTERPRETERS = Object.freeze({
     ".sh": "sh",
@@ -77,36 +74,23 @@ export function scriptInterpreter(extension, ref, bytes) {
     }
     throw new UsageError(`Task v3 script target ${JSON.stringify(ref)} requires Bun for ${extension} execution, but this runtime cannot provide it.`, "TASK_TARGET_UNSUPPORTED");
 }
-export function captureDirectoryIdentity(bundleRoot, workingDirectory) {
-    try {
-        return captureFrozenDirectoryIdentity(bundleRoot, workingDirectory);
-    }
-    catch (cause) {
-        if (cause instanceof UsageError)
-            throw cause;
-        throw new UsageError(`Task working directory ${JSON.stringify(workingDirectory ?? ".")} cannot be physically verified: ${cause instanceof Error ? cause.message : String(cause)}`, "TASK_SOURCE_INVALID");
-    }
-}
 /**
- * Read a script's bytes off disk (or the caller's own read seam) and freeze
- * the interpreter/digest/directory-identity shape every script dispatch
- * needs. `ref` is used only for interpreter-selection error messages — it is
- * the script's own qualified ref, never a synthetic task ref. `bundleRoot` is
- * where directory identity is captured from (one level above the script file
- * itself, matching prepareTaskV3Execution's historical behavior).
+ * Read a script's bytes off disk (or the caller's own read seam, following a
+ * symlink to wherever it points) and freeze the interpreter/digest shape every
+ * script dispatch needs. `ref` is used only for interpreter-selection error
+ * messages — it is the script's own qualified ref, never a synthetic task ref.
+ * `bundleRoot` is the script's working directory.
  */
 export function captureScriptTarget(ref, file, bundleRoot, readFile) {
     const extension = path.extname(file).toLowerCase();
     const raw = readFile(file, bundleRoot);
     const bytes = Uint8Array.from(raw);
-    const cwdIdentity = captureDirectoryIdentity(bundleRoot);
     return Object.freeze({
         interpreter: scriptInterpreter(extension, ref, bytes),
         extension,
         bytesBase64: Buffer.from(bytes).toString("base64"),
         byteLength: bytes.byteLength,
         sha256: createHash("sha256").update(bytes).digest("hex"),
-        cwd: cwdIdentity.realCwd,
-        cwdIdentity,
+        cwd: path.resolve(bundleRoot),
     });
 }

package/dist/tasks/run/attempt-lifecycle.js

@@ -7,36 +7,15 @@
  * clamp every arm's result uses), and `recordTaskAttemptFailure` (the
  * catch-all for a dispatch that threw after an attempt was reserved).
  *
- * Moved from src/tasks/runner.ts (spec docs/plans/specs/p1b-model-extraction.md
- * §5.1, §9, runner.ts:970-1069). `reserveTaskAttempt` and `finishAttempt`
- * were module-private at head; both are exported here because run-task.ts and
+ * `reserveTaskAttempt` and `finishAttempt` are exported because run-task.ts and
  * every dispatch arm (run-native-task.ts, run-workflow-task.ts,
- * run-command-task.ts), now separate files, call them.
+ * run-command-task.ts) call them.
  *
- * F-4 (P1a advisory, spec §5.5): `SAFE_TASK_ATTEMPT_ERROR_CODES` gains
- * `TASK_SOURCE_INVALID` and `COMPOSITION_INVALID` — see the comment on the
- * set for the verified reachability path. `SAFE_TASK_ATTEMPT_ERROR_CODES` and
+ * `SAFE_TASK_ATTEMPT_ERROR_CODES` and
  * `safeTaskAttemptErrorCode` stay unexported: their membership is observed
  * the same way production code observes it, through
  * `recordTaskAttemptFailure`'s one externally-visible effect (the stored
- * `detail.error` code).
- *
- * P4 (docs/plans/specs/p4-deletions-closeout.md §4.1, row B-55): the set
- * additionally gains `TARGET_REF_INVALID`, `WORKFLOW_SOURCE_INVALID`,
- * `INPUT_BINDING_INVALID`, and `TASK_TARGET_UNSUPPORTED` — every code P4's
- * `INVALID_FLAG_VALUE` re-coding sweep (spec §5.2) makes reachable from the
- * same post-reservation dispatch catch. `TARGET_REF_INVALID`
- * (`execution/target-ref.ts`) and `INPUT_BINDING_INVALID`
- * (`workflows/freeze/task-bindings.ts`) already reach it today through the
- * same WORKFLOW arm as `COMPOSITION_INVALID` above — freezing a composed
- * child (a `tasks/<ref>` or `workflows/<ref>` step) during dispatch can
- * classify a malformed `uses:` or an invalid `with:` binding after the
- * attempt is reserved. `WORKFLOW_SOURCE_INVALID` and `TASK_TARGET_UNSUPPORTED`
- * get their first live throw sites in this same phase (the freeze wrapper's
- * P4-N2 mapping, and `prepare/script-capture.ts`'s interpreter rejections,
- * respectively) — added here ahead of / alongside that wiring rather than
- * split across two commits, since an unreachable member of an allowlist Set
- * is inert, not a defect.
+ * `detail.error` code). The comment on the set says why each code is reachable.
  */
 import { AkmError, rethrowIfTestIsolationError } from "../../core/errors.js";
 import { withStateDb } from "../../core/state-db.js";
@@ -83,19 +62,22 @@ export function finishAttempt(startedAt, observedFinishedAt) {
  * usage failures, never an unclassified internal error that might leak
  * implementation detail.
  *
- * F-4 (P1a advisory, spec §5.5): `TASK_SOURCE_INVALID` and
- * `COMPOSITION_INVALID` join the allowlist. Verified reachability: the only
- * caller of `recordTaskAttemptFailure` inside the runner is the
+ * Every code here is reachable from the post-reservation dispatch catch: the
+ * only caller of `recordTaskAttemptFailure` inside the runner is the
  * post-reservation catch in run-task.ts; task-source parsing happens BEFORE
  * reservation (load-task.ts), so the direct parse path never reaches it.
- * Both codes reach it through the WORKFLOW arm instead: a workflow task whose
- * plan freezes a `tasks/<ref>` step raises `TASK_SOURCE_INVALID` (via
+ * `TASK_SOURCE_INVALID`, `COMPOSITION_INVALID`, `TARGET_REF_INVALID` and
+ * `INPUT_BINDING_INVALID` reach it through the WORKFLOW arm: a workflow task
+ * whose plan freezes a `tasks/<ref>` step raises `TASK_SOURCE_INVALID` (via
  * `taskDispatch`'s `parseTaskSource`/`parseTaskSourceV4Document` —
- * `src/workflows/freeze/targets/task.ts`; `parseTaskV3Yaml` no longer exists
- * in `src`, P4 deleted task v3 acceptance, spec
- * docs/plans/specs/p4-deletions-closeout.md §3.2) or `COMPOSITION_INVALID`
- * (the P1a with-rejection guard) DURING dispatch, after the attempt was
- * already reserved. Before this widening, both were recorded as
+ * `src/workflows/freeze/targets/task.ts`), and freezing a composed child can
+ * classify a malformed `uses:` (`TARGET_REF_INVALID`,
+ * `execution/target-ref.ts`), an invalid `with:` binding
+ * (`INPUT_BINDING_INVALID`, `workflows/freeze/task-bindings.ts`) or a `with:`
+ * rejection (`COMPOSITION_INVALID`) DURING dispatch, after the attempt was
+ * already reserved. `WORKFLOW_SOURCE_INVALID` and `TASK_TARGET_UNSUPPORTED`
+ * are thrown by the freeze wrapper and by `prepare/script-capture.ts`'s
+ * interpreter rejections, respectively. Without them each would be recorded as
  * `"INTERNAL"`.
  */
 const SAFE_TASK_ATTEMPT_ERROR_CODES = new Set([

package/dist/tasks/run/load-task.js

@@ -11,11 +11,16 @@
 import fs from "node:fs";
 import { detectAdapterId } from "../../core/adapter/detect-adapter.js";
 import { makeBundleRef } from "../../core/asset/asset-ref.js";
+import { conceptIdFromTypeName } from "../../core/asset/resolve-ref.js";
+import { resolveStashDir } from "../../core/common.js";
 import { loadConfig } from "../../core/config/config.js";
-import { NotFoundError } from "../../core/errors.js";
-import { resolveWriteTarget } from "../../core/write-source.js";
+import { bundleKeyForContentRoot } from "../../core/config/config-sources.js";
+import { ConfigError, NotFoundError, UsageError } from "../../core/errors.js";
+import { assertBundleNotDisabled } from "../../core/write-source.js";
 import { applyInputDefaults, materializeInputFlags, validateInputs, } from "../../execution/input-contract.js";
-import { resolveAdapterConceptOwner } from "../../indexer/lookup/adapter-concept-owner.js";
+import { resolveAdapterConceptOwner, resolveConceptOwner } from "../../indexer/lookup/adapter-concept-owner.js";
+import { resolveSourceEntries } from "../../indexer/search/search-source.js";
+import { resolveSourcesForOrigin } from "../../registry/origin-resolve.js";
 import { resolveAssetPath } from "../../sources/resolve.js";
 import { prepareTaskV3Execution } from "../prepare/prepare.js";
 import { scheduledTaskContextEnv } from "../scheduler-invocation.js";
@@ -24,16 +29,50 @@ import { projectTaskSourceV4 } from "../source/project-v4.js";
 import { TASK_INPUT_DIAGNOSTICS } from "../source/task-input-diagnostics.js";
 import { validateTaskConceptId, validateTaskId } from "../task-id.js";
 /**
- * F-3 (spec §5.4): the literal bundle-name fallback, hoisted to a named
- * constant — the VALUE does not change (it is user-visible data, R-09's
- * observable behavior). The now-deleted `runner.ts:173`'s (P4) bare
- * `"stash"` became this at the P1b runner.ts split.
+ * The literal bundle-name fallback, hoisted to a named constant. The value is
+ * user-visible data, so it must not change.
  */
 export const DEFAULT_BUNDLE_NAME = "stash";
 const CONFIG_FREE_TASK_RUNTIME = Object.freeze({
     configVersion: "0.9.0",
     semanticSearchMode: "off",
 });
+/**
+ * The active source set a task read walks. A working stash that is a disabled
+ * configured bundle makes that set throw; it is simply not in the set, so the
+ * other bundles still resolve.
+ */
+export function activeTaskSources(config) {
+    try {
+        return resolveSourceEntries(undefined, config);
+    }
+    catch (cause) {
+        const working = bundleKeyForContentRoot(config, resolveStashDir());
+        const entry = working ? config.bundles?.[working] : undefined;
+        if (!(cause instanceof ConfigError) || !working || !entry || entry.enabled !== false)
+            throw cause;
+        const enabled = { ...config, bundles: { ...config.bundles, [working]: { ...entry, enabled: true } } };
+        return resolveSourceEntries(undefined, enabled).filter((source) => source.registryId !== working);
+    }
+}
+/**
+ * Resolve an asset a task names in another bundle (`uses:`) through the one
+ * ref-to-file walk. Reading needs no write target, so a bundle of any kind
+ * (git, npm, website) resolves. The file is the authored path, not the symlink
+ * target, so the script interpreter follows the name the author gave it.
+ */
+export function resolveBundleAsset(config, { bundle, type, name }) {
+    const conceptId = conceptIdFromTypeName(type, name);
+    const sources = activeTaskSources(config);
+    const match = resolveConceptOwner({ bundle, conceptId }, sources);
+    if (match)
+        return { file: match.owner.path, bundleRoot: match.source.path };
+    if (resolveSourcesForOrigin(bundle, sources).length === 0) {
+        assertBundleNotDisabled(config, bundle);
+        throw new UsageError(`Bundle ${JSON.stringify(bundle)} is not configured. Run \`akm bundle list\` to see available bundles.`, "INVALID_FLAG_VALUE");
+    }
+    throw new NotFoundError(`Task asset ${makeBundleRef(bundle, conceptId)} was not found.`, "ASSET_NOT_FOUND");
+}
 /** Resolve, parse, and project one task-v3 asset into a frozen, executable projection. */
 export async function loadPreparedTask(id, options) {
     const bundleDir = options.bundleDir;
@@ -49,14 +88,13 @@ export async function loadPreparedTask(id, options) {
     }
     const filePath = owner.path;
     const yaml = fs.readFileSync(filePath, "utf8");
-    const parsed = parseTaskSource({ yaml, filePath, workspaceRoot: bundleDir });
+    const parsed = parseTaskSource({ yaml, filePath });
     const source = projectTaskSourceV4(parsed.v4);
     const requiresCommandConfig = source.target.kind === "uses" &&
         (source.target.uses.kind === "builtin-command" || source.target.uses.kind === "command");
     const config = requiresCommandConfig ? loadConfig() : CONFIG_FREE_TASK_RUNTIME;
     const bundleName = options.bundleName ?? config.defaultBundle ?? DEFAULT_BUNDLE_NAME;
-    // P2a Lane C, Stage 2 (spec docs/plans/specs/p2a-task-source-v4.md §5.1):
-    // materialize akm task run's raw input flags (Stage 1,
+    // Stage 2: materialize akm task run's raw input flags (Stage 1,
     // src/commands/tasks/tasks-cli.ts) against the task's own declared
     // inputs: contract (empty when the document declares none, so any input
     // flag on such a task fails UNKNOWN_FLAG — there is nothing declared to
@@ -65,8 +103,8 @@ export async function loadPreparedTask(id, options) {
     // required input satisfied only by its own default (never supplied as a
     // flag) needs the SEPARATE validateInputs call below, run after defaults
     // are applied — materializeInputFlags returns {} immediately for zero
-    // flags, before ever checking `required` (spec §5.1, input-contract.ts's
-    // own header).
+    // flags, before ever checking `required` (input-contract.ts's own
+    // header).
     const inputContract = parsed.v4.inputs ?? {};
     const materializedInputs = materializeInputFlags(inputContract, options.inputFlags ?? [], TASK_INPUT_DIAGNOSTICS);
     const defaultedInputs = applyInputDefaults(inputContract, materializedInputs);
@@ -82,13 +120,12 @@ export async function loadPreparedTask(id, options) {
         });
         options.captureTaskInvocation(invocation);
     }
-    // P2b Lane B (spec docs/plans/specs/p2b-input-bindings.md §4.3, B-40): a
-    // task source v4 document's own declared `inputs:` deliver into a
+    // A task source v4 document's own declared `inputs:` deliver into a
     // `uses: workflows/<ref>` target's child-run params through the EXISTING
     // with-> params path (prepare.ts's workflow branch already reads
     // `document.target.with`) — task source v4 never authors `with:` on a
     // workflow target itself (task-source-v4.ts's own parser accepts `with:`
-    // only on `uses: akm/command`, source/task-source-v4.ts:329-333), so this
+    // only on `uses: akm/command`), so this
     // override is purely additive for a workflow-target task.
     const deliverySource = source.target.kind === "uses" && source.target.uses.kind === "workflow"
         ? { ...source, target: { ...source.target, with: defaultedInputs } }
@@ -99,23 +136,13 @@ export async function loadPreparedTask(id, options) {
         bundleName,
         bundleRoot: bundleDir,
         config,
-        // Agent profiles build child env from an allowlist, so freeze the closed
-        // AKM directory context the scheduled row set before command preparation.
+        // Freeze the AKM directory context the scheduled row set before command preparation.
         ...(options.scheduled ? { schedulerContext: scheduledTaskContextEnv() } : {}),
         resolveAsset: async ({ bundle, type, name }) => {
             if (bundle === bundleName) {
                 return { file: await resolveAssetPath(bundleDir, type, name), bundleRoot: bundleDir };
             }
-            const resolutionConfig = requiresCommandConfig ? config : loadConfig();
-            // `bundle` is the qualifier of an asset ref in the task, not a flag.
-            const resolvedBundle = resolveWriteTarget(resolutionConfig, bundle, {
-                requireWritable: false,
-                flag: "The asset ref's bundle",
-            });
-            return {
-                file: await resolveAssetPath(resolvedBundle.source.path, type, name),
-                bundleRoot: resolvedBundle.source.path,
-            };
+            return resolveBundleAsset(requiresCommandConfig ? config : loadConfig(), { bundle, type, name });
         },
     });
 }