akm-cli 0.10.261012-beta → 0.10.261014-beta

package/dist/tasks/source/task-source-v4.js

@@ -2,34 +2,22 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 /**
- * Task source v4 — the second, additive task source grammar (spec
- * docs/plans/specs/p2a-task-source-v4.md §1.1 D1, §1.2 D2, §1.5 D2-N1..D2-N7,
- * §3). Never call this grammar bare "v4" in prose — the workflow plan IR is
- * separately versioned (D1).
+ * Task source v4 — the second, additive task source grammar. Never call this
+ * grammar bare "v4" in prose — the workflow plan IR is separately versioned.
  *
  * `version: 4` introduces typed `inputs:`, a single bounded `output:` schema
  * (legal only on command targets, the one kind whose runtime consumes it —
  * see `targetConsumesOutputSchema` below),
- * OPTIONAL scheduling (absent `schedule:` is valid and manual-only, D2-N6),
+ * OPTIONAL scheduling (absent `schedule:` is valid and manual-only),
  * and top-level execution controls (the `akm:` options bag and the `on:`
- * trigger block are both GONE — every `akm:` member that D2 does not
- * re-home survives as a top-level key instead, D2-N7). There is no
+ * trigger block are both GONE — every `akm:` member that is not re-homed
+ * survives as a top-level key instead). There is no
  * github-action `uses:` variant.
  *
- * `src/tasks/source-v3.ts` IS edited by this phase (D2-N4): the bounded-document
- * front end and the path-generic field helpers move body-intact out of that
- * file into `./bounded-document.ts`, and `source-v3.ts` now imports (and,
- * for the names that were already part of its public surface, re-exports)
- * them instead of declaring its own copies — see `./bounded-document.ts`'s
- * own header and spec §6 F-2 for the extraction itself. `parseTimeout` and
- * `parseTools` moved that way; `nullableSelector` did not (a recorded
- * deviation from a literal reading of D2-N4's own extraction list — see the
- * P2a Review log) and stays declared directly in `source-v3.ts`.
- *
- * This file implements its OWN top-level-rooted versions of the three v3
+ * This file implements its OWN top-level-rooted versions of the two v3
  * helpers that hardcode the `["akm", …]` field path —
- * `parseTimeoutTopLevel`/`nullableSelectorTopLevel`/`parseToolsTopLevel`
- * below, siblings of v3's `parseTimeout`/`nullableSelector`/`parseTools` —
+ * `parseTimeoutTopLevel`/`nullableSelectorTopLevel` below, siblings of v3's
+ * `parseTimeout`/`nullableSelector` —
  * because task source v4 needs the same accept/reject semantics at a
  * different, un-prefixed field path, not the same field path.
  */
@@ -37,15 +25,16 @@ import { parseBuiltinCommandAction } from "../../commands/command/builtin-action
 import { UsageError } from "../../core/errors.js";
 import { checkJsonSchemaDefinition, JSON_SCHEMA_SUBSET_SUPPORTED_KEYWORDS, validateJsonSchemaSubset, } from "../../core/json-schema.js";
 import { DURATION_UNITS, parseDuration } from "../../core/time.js";
-import { warn } from "../../core/warn.js";
+import { warn, warnOnce } from "../../core/warn.js";
 import { applyInputDefaults, INPUT_NAME_PATTERN, validateInputs, } from "../../execution/input-contract.js";
 import { EXECUTION_MAX_TIMEOUT_MS } from "../../execution/limits.js";
+import { warnRetiredEngineKey } from "../../execution/source.js";
 import { classifyTargetRef } from "../../execution/target-ref.js";
 import { detectSecretShapedParams } from "../../workflows/exec/param-secrets.js";
 import { WORKFLOW_ENV_VAR_NAME_PATTERN, WORKFLOW_MAX_SCHEMA_BYTES } from "../../workflows/resource-limits.js";
 import { TASK_V3_HOST_SHELLS, TASK_V3_MAX_SCHEDULES } from "../source-v3.js";
 import { TASK_RUN_RESERVED_FLAG_NAMES } from "../task-run-reserved-flags.js";
-import { asRecord, checkKeys, cloneBoundedJson, noGithubExpression, own, parseEnvironment, parseStringArray, presentJsonValue, readBoundedTaskSourceYaml, sourceError, stringField, TASK_V3_MAX_REDACT_NAMES, utf8Bytes, validateWorkingDirectory, } from "./bounded-document.js";
+import { asRecord, checkKeys, cloneBoundedJson, noGithubExpression, own, parseEnvironment, parseStringArray, presentJsonValue, readBoundedTaskSourceYaml, sourceError, stringField, TASK_V3_MAX_REDACT_NAMES, utf8Bytes, } from "./bounded-document.js";
 // ── Closed constants (D1, D2-N3, D2-N7) ─────────────────────────────────────
 export const TASK_SOURCE_V4_VERSION = 4;
 /** The exact, closed top-level key set (D2-N7) — `akm` and `on` are deliberately absent. */
@@ -65,6 +54,8 @@ export const TASK_SOURCE_V4_TOP_LEVEL_KEYS = [
     "working-directory",
     "schedule",
     "agent",
+    "connection",
+    "harness",
     "engine",
     "model",
     "inference",
@@ -95,26 +86,23 @@ function ctxFrom(options) {
     return {
         filePath: options.filePath,
         sourceLabel: SOURCE_LABEL,
-        ...(options.workspaceRoot ? { workspaceRoot: options.workspaceRoot } : {}),
         ...(options.lineAt ? { lineAt: options.lineAt } : {}),
     };
 }
-// ── classifyTaskSourceV4Uses (spec §3.3) ────────────────────────────────────
+// ── classifyTaskSourceV4Uses ────────────────────────────────────────────────
 /**
  * A value SHAPED like `owner/repo[/path]@revision` — used only to produce a
- * good "the github-action target was removed" message (B-13), never to
+ * good "the github-action target was removed" message, never to
  * accept. Deliberately a shape test, not a full github-locator grammar:
- * native target classification recognizes no github-action variant at all
- * (P4 deleted the last one, `classifyTaskV3Uses`'s locator branch in
- * `source-v3.ts`) — only the shape needs to be recognized here, so the
+ * native target classification recognizes no github-action variant at all —
+ * only the shape needs to be recognized here, so the
  * rejection can name the target the user typed rather than guess.
  *
- * Runs ONLY on {@link classifyTargetRef}'s failure path (0.9.2 review round 2):
+ * Runs ONLY on {@link classifyTargetRef}'s failure path:
  * `@` is a legal character in a canonical asset ref, so a value the canonical
  * classifier accepts (`commands/review@v2`) is a valid target even though it
  * also matches this shape — the shape test upgrades the generic invalid-ref
- * message, and never vetoes a ref classification accepts (spec §3.3: "exists
- * only to produce a good message, never to accept").
+ * message, and never vetoes a ref classification accepts.
  */
 function looksLikeGithubActionLocator(value) {
     const at = value.lastIndexOf("@");
@@ -129,18 +117,18 @@ function looksLikeGithubActionLocator(value) {
     return true;
 }
 /**
- * Classify one exact `uses:` string for task source v4 (spec §3.3). Delegates
+ * Classify one exact `uses:` string for task source v4. Delegates
  * to {@link classifyTargetRef} (`src/execution/target-ref.ts`) — the repo's
  * one canonical-ref classifier — rather than re-deriving ref grammar; layers
- * the `akm/command` builtin special case, the task-ref rejection (B-14), and
+ * the `akm/command` builtin special case, the task-ref rejection, and
  * — on the classification-failure path only — the github-locator-shape
- * rejection (B-13) on top.
+ * rejection on top.
  */
 /**
  * The remedy sentence every `uses:` rejection below ends with. ONE constant so
  * the advice can never drift from what {@link TaskSourceV4UsesTarget} actually
  * admits — `commands/`, `scripts/`, `workflows/`, and the `akm/command`
- * builtin. Notably NOT `tasks/`: a task ref is rejected by B-14 below.
+ * builtin. Notably NOT `tasks/`: a task ref is rejected below.
  */
 const TASK_SOURCE_V4_USES_REMEDY = "Use a canonical commands/, scripts/, or workflows/ ref, or akm/command, instead.";
 export function classifyTaskSourceV4Uses(value) {
@@ -210,18 +198,6 @@ function parseTimeoutTopLevel(value, ctx) {
     }
     return value;
 }
-function parseToolsTopLevel(value, ctx) {
-    if (value === null || typeof value === "string")
-        return value;
-    if (Array.isArray(value)) {
-        if (value.some((entry) => typeof entry !== "string"))
-            sourceError(ctx, ["tools"], "array values must be strings.");
-        return value;
-    }
-    if (typeof value === "object")
-        return value;
-    sourceError(ctx, ["tools"], "must be a string, string array, mapping, or null.");
-}
 function parseTarget(input, ctx) {
     const hasUses = own(input, "uses");
     if (hasUses) {
@@ -272,7 +248,6 @@ function parseTarget(input, ctx) {
         workingDirectory = stringField(input["working-directory"], ctx, ["working-directory"], {
             nonempty: true,
         });
-        validateWorkingDirectory(workingDirectory, ctx);
     }
     return Object.freeze({
         kind: "run",
@@ -283,16 +258,20 @@ function parseTarget(input, ctx) {
 }
 function parseExecutionControls(input, ctx) {
     const out = {};
-    for (const key of ["agent", "engine", "model"]) {
+    for (const key of ["agent", "connection", "harness", "engine", "model"]) {
         if (own(input, key))
             out[key] = nullableSelectorTopLevel(input[key], ctx, key);
+        if (key === "engine" && own(input, key))
+            warnRetiredEngineKey();
     }
     if (own(input, "inference")) {
         const inference = presentJsonValue(input.inference, ctx, ["inference"]);
         out.inference = inference === null ? null : asRecord(inference, ctx, ["inference"]);
     }
-    if (own(input, "tools"))
-        out.tools = parseToolsTopLevel(presentJsonValue(input.tools, ctx, ["tools"]), ctx);
+    // Retired: assets no longer restrict an agent's tools.
+    if (own(input, "tools")) {
+        warnOnce(`task-source-v4-tools:${ctx.filePath}`, `${ctx.filePath}: \`tools\` is retired and ignored.`);
+    }
     if (own(input, "timeout"))
         out.timeout = parseTimeoutTopLevel(input.timeout, ctx);
     if (own(input, "redact")) {
@@ -378,8 +357,7 @@ function parseInputDeclarations(value, ctx) {
         if (!INPUT_NAME_PATTERN.test(name)) {
             sourceError(ctx, ["inputs", name], "must match the input name pattern (a letter/underscore, then letters, digits, or underscores).");
         }
-        // Code-review finding (docs/plans/specs/p2b-input-bindings.md review
-        // round 2, scheduler-binding.ts:238): a declared input name that
+        // A declared input name that
         // collides with a flag `akm task run` already binds to itself (--bundle,
         // --scheduled, …) can never be supplied through that CLI — parseTaskInputFlags
         // (../../commands/tasks/tasks-cli.ts) always treats the name as its OWN
@@ -415,7 +393,7 @@ function parseOutputSchema(value, ctx) {
  * output schema anywhere (run-native-task.ts decides status from the exit
  * code alone; the workflow arm freezes a child plan without one), so an
  * authored `output:` there would be a silently unenforced contract — the
- * fifth state the fail-closed rule forbids (0.9.2 review round 2; same
+ * fifth state the fail-closed rule forbids (same
  * grammar pattern as `with:` being legal only with `uses: akm/command`).
  */
 function targetConsumesOutputSchema(target) {
@@ -423,7 +401,7 @@ function targetConsumesOutputSchema(target) {
 }
 // ── schedule: -> TaskSourceV4ScheduleBinding[] (D2-N5, D2-N6, B-06..B-10, B-38) ──
 /**
- * Every schedule binding must be independently runnable (0.9.2 review round 2).
+ * Every schedule binding must be independently runnable.
  *
  * A scheduled firing supplies NO input flags — `compileTaskSchedulerBindings`
  * (../scheduler-binding.ts) appends only the entry's own
@@ -431,8 +409,8 @@ function targetConsumesOutputSchema(target) {
  * tail — so that literal PLUS the declared defaults is the complete value set
  * `akm task run --scheduled` will see, and it is checked there by the very
  * same `applyInputDefaults` + `validateInputs` pair (../run/load-task.ts).
- * A `required: true` declaration may not also carry a `default` (D2-N3,
- * `parseInputDeclaration` above), so an entry that names no value for one can
+ * A `required: true` declaration may not also carry a `default`
+ * (`parseInputDeclaration` above), so an entry that names no value for one can
  * never satisfy the contract, at any hour, ever.
  *
  * The source document alone knows both halves of that contradiction, so it is
@@ -442,11 +420,11 @@ function targetConsumesOutputSchema(target) {
  * the DEFAULTED view — that gate is what makes such a schedule unreachable
  * rather than merely ill-advised, and it still guards a task source reaching
  * sync through any other path — but an author should not have to run `akm
- * task sync` to learn that a document contradicts itself (the parse-time
- * rejection p2a's own review log named as the natural fix). Manual `akm task
+ * task sync` to learn that a document contradicts itself, so it is rejected at
+ * parse time. Manual `akm task
  * run` is deliberately unaffected: a manual run takes the value from the
  * input's own `--<name>` flag, so a required, default-less input plus NO
- * `schedule:` stays valid and manual-only (B-06, D2-N6).
+ * `schedule:` stays valid and manual-only.
  *
  * Runs for every entry, AFTER the raw `schedule[i].inputs` check below, so an
  * entry that authors an `inputs:` mapping keeps that check's exact
@@ -475,12 +453,12 @@ function parseScheduleEntry(entryRaw, index, contract, ctx) {
             ...entryPath,
             "inputs",
         ]);
-        // Fail-closed exact-name check (code-review finding, task-source-v4.ts:530):
-        // `validateInputs`'s synthetic `{type:"object", properties}` schema (spec
-        // §4.2) deliberately carries no `additionalProperties:false` — that is the
+        // Fail-closed exact-name check:
+        // `validateInputs`'s synthetic `{type:"object", properties}` schema
+        // deliberately carries no `additionalProperties:false` — that is the
         // right default for a general-purpose contract validator with other
         // callers (materializeInputFlags already does its own exact-name check
-        // before ever calling validateInputs, per D3-N3's design) — so relying on
+        // before ever calling validateInputs) — so relying on
         // validateInputs alone here would silently accept a typo'd or wholly
         // undeclared schedule[i].inputs key forever, exactly the fifth state the
         // fail-closed rule forbids. checkKeys mirrors materializeInputFlags' own
@@ -491,9 +469,8 @@ function parseScheduleEntry(entryRaw, index, contract, ctx) {
         // sourceError call rooted at entryPath, not [...entryPath, "inputs"]: the
         // per-error detail already carries "inputs.<name>" (validateInputs), so
         // adding a SECOND ".inputs" segment to the field path here would render
-        // two path roots in one message (code-review finding, was the bare "$"
-        // default leaking through — see docs/plans/specs/p2a-task-source-v4.md
-        // review-log item 4a).
+        // two path roots in one message (the bare "$" default would otherwise
+        // leak through).
         const errors = validateInputs(contract, inputsValue, { pathRoot: "inputs" });
         if (errors.length > 0)
             sourceError(ctx, entryPath, errors.join("; "));
@@ -528,8 +505,8 @@ function parseSchedule(input, contract, ctx) {
 // ── Top-level key rejection (akm:/on: removal, B-11/B-12; D2-N7) ───────────
 function checkTopLevelKeys(input, ctx) {
     if (own(input, "akm")) {
-        sourceError(ctx, ["akm"], "is removed in task source v4; its members are top-level keys now (schedule, timeout, engine, model, redact, " +
-            "maxSteps, maxRetries, description, when_to_use, tags, agent, inference, tools, and output for outputSchema) " +
+        sourceError(ctx, ["akm"], "is removed in task source v4; its members are top-level keys now (schedule, timeout, connection, harness, model, redact, " +
+            "maxSteps, maxRetries, description, when_to_use, tags, agent, inference, and output for outputSchema) " +
             "— see docs/reference/tasks.md.");
     }
     if (own(input, "on")) {
@@ -537,8 +514,8 @@ function checkTopLevelKeys(input, ctx) {
     }
     checkKeys(input, TASK_SOURCE_V4_TOP_LEVEL_KEYS, ctx, []);
 }
-// ── parseTaskSourceV4Document (spec §3.2) ───────────────────────────────────
-/** Parse an already-decoded JSON/YAML value as a task source v4 document (spec §3.2). */
+// ── parseTaskSourceV4Document ───────────────────────────────────────────────
+/** Parse an already-decoded JSON/YAML value as a task source v4 document. */
 export function parseTaskSourceV4Document(value, options) {
     const ctx = ctxFrom(options);
     const cloned = cloneBoundedJson(value, ctx, [], { nodes: 0 });
@@ -596,7 +573,6 @@ export function parseTaskSourceV4(input) {
     const { root, lineAt } = readBoundedTaskSourceYaml(input, { sourceLabel: SOURCE_LABEL });
     return parseTaskSourceV4Document(root, {
         filePath: input.filePath,
-        ...(input.workspaceRoot ? { workspaceRoot: input.workspaceRoot } : {}),
         lineAt,
     });
 }

package/dist/tasks/source-v3.js

@@ -2,11 +2,8 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import { TASK_V3_MAX_SCHEDULES } from "./source/bounded-document.js";
-// D2-N4 (spec docs/plans/specs/p2a-task-source-v4.md §3.1, §9): re-exported
-// at its EXISTING name so no importer changes. The one name a surviving
-// `src` consumer still imports (task-source-v4.ts) — every other
-// bounded-document re-export this file used to carry was dropped in P4
-// §3.2.3.
+// Re-exported at its existing name so no importer changes: the one name a
+// surviving `src` consumer still imports (task-source-v4.ts).
 export { TASK_V3_MAX_SCHEDULES };
 export const TASK_EXTENSION = ".yml";
 export const TASK_NEAR_MISS_EXTENSION = ".yaml";

package/dist/tasks/task-run-reserved-flags.js

@@ -7,8 +7,7 @@
  * declared `inputs:` name that collides with one, without creating an import
  * cycle back through the CLI layer.
  *
- * Code-review finding (docs/plans/specs/p2b-input-bindings.md, P2b review
- * round 2): `schedulerInputFlagTail` (`../tasks/scheduler-binding.ts`) and
+ * `schedulerInputFlagTail` (`../tasks/scheduler-binding.ts`) and
  * `akm task run <id> --<name> <value>` both let an authored/declared input
  * NAME collide with a flag `akm task run` already binds to itself
  * (`--bundle`, `--scheduled`, …). `parseTaskInputFlags`

package/dist/workflows/authoring/authoring.js

@@ -49,15 +49,10 @@ export function assertWorkflowMarkdownName(name) {
     throw new UsageError(`akm workflow create is markdown-only: it emits Markdown and cannot create "${name}". ` +
         `Use a plain name (no ".yaml"/".yml" suffix).`);
 }
-// 0.9.2 review round 2 (P4 sweep criterion-21 caveat, spec
-// docs/plans/specs/p4-deletions-closeout.md §4.1 row B-49): this return's
-// third member was `stashDir` through 0.9.1 and leaked verbatim into the
+// This return's third member (`bundleDir`) leaks verbatim into the
 // `akm workflow create` JSON envelope (Stable per STABILITY.md) via
 // `output("workflow-create", { ok: true, ...result })`
-// (src/commands/workflow-cli.ts). Renamed to `bundleDir` here — the same
-// value-preserving field rename `RunTaskOptions.stashDir` got in P1b (see
-// src/tasks/run/task-result.ts's header, F-3) — so the shipped envelope now
-// matches current bundle vocabulary. BREAKING vs 0.9.1's envelope shape.
+// (src/commands/workflow-cli.ts), so renaming it changes the shipped envelope.
 export function createWorkflowAsset(input) {
     assertWorkflowMarkdownName(input.name);
     const config = loadConfig();

package/dist/workflows/compile.js

@@ -11,7 +11,6 @@
 import path from "node:path";
 import { parseWorkflow } from "./parser.js";
 import { formatReference, parseReference } from "./program/expressions.js";
-import { canonicalizeWorkflowWorkingDirectory, WorkflowSourceSemanticError } from "./source-semantics.js";
 /** Compile by authoritative source extension. */
 export function compileWorkflowSource(source, options) {
     const extension = path.extname(options.path).toLowerCase();
@@ -29,20 +28,7 @@ export function compileWorkflowSource(source, options) {
             ],
         };
     }
-    const parsed = parseWorkflow(source, {
-        path: options.path,
-        title,
-        validateExecCwd: (value) => {
-            try {
-                return { ok: true, value: canonicalizeWorkflowWorkingDirectory(value, options.workspaceRoot) };
-            }
-            catch (cause) {
-                if (cause instanceof WorkflowSourceSemanticError)
-                    return { ok: false, code: cause.code, message: cause.message };
-                return { ok: false, code: "working-directory-unverifiable", message: "cwd cannot be physically verified." };
-            }
-        },
-    });
+    const parsed = parseWorkflow(source, { path: options.path, title });
     if (parsed.ok)
         return parsed;
     return {

package/dist/workflows/concurrency-policy.js

@@ -19,7 +19,7 @@ export function workflowMaxConcurrency(configured, cpuCount = os.cpus()?.length
 // ── Fan-out defaults ─────────────────────────────────────────────────────────
 //
 // A `map` step's real width is the minimum of its own `map.concurrency`, the
-// run's frozen `execution.maxConcurrency`, the LLM engine's frozen
+// run's frozen `execution.maxConcurrency`, the connection's frozen
 // concurrency, and the host CPU cap. The defaults are modest: map units call
 // rate-limited providers and RAM-hungry agents.
 /**
@@ -29,12 +29,12 @@ export function workflowMaxConcurrency(configured, cpuCount = os.cpus()?.length
  * (`workflow.defaultMapConcurrency`; `1` restores serial fan-out).
  */
 export const DEFAULT_MAP_CONCURRENCY = 4;
-/** Default concurrency for an LLM engine on a loopback endpoint: a local model server runs one inference. */
+/** Default concurrency for a connection on a loopback endpoint: a local model server runs one inference. */
 export const DEFAULT_LOCAL_LLM_ENGINE_CONCURRENCY = 1;
-/** Default concurrency for a remote LLM engine: equal to {@link DEFAULT_MAP_CONCURRENCY}, so it never re-serializes a map. */
+/** Default concurrency for a connection on a remote endpoint: equal to {@link DEFAULT_MAP_CONCURRENCY}, so it never re-serializes a map. */
 export const DEFAULT_REMOTE_LLM_ENGINE_CONCURRENCY = 4;
 export { isLoopbackEndpoint, isLoopbackHost } from "../core/loopback.js";
-/** Concurrency to freeze for an LLM engine: an explicit `engines.<name>.concurrency` (clamped), else by endpoint. */
+/** Concurrency to freeze for a connection: its own `concurrency` (clamped), else by endpoint. */
 export function defaultLlmEngineConcurrency(endpoint, configured) {
     if (typeof configured === "number" && Number.isFinite(configured))
         return clampMaxConcurrency(configured);

package/dist/workflows/exec/child-workflow.js

@@ -104,8 +104,6 @@ async function publishChildRun(input, invocationKey) {
             run: {
                 id: childRunId,
                 workflowRef: target.ref,
-                scopeKey: parentRow.scope_key,
-                workflowEntryId: null,
                 workflowTitle: target.frozenPlan.title,
                 paramsJson: JSON.stringify(childParams),
                 currentStepId: target.frozenPlan.steps[0]?.stepId ?? null,
@@ -149,8 +147,7 @@ async function driveChildRun(input, childRow) {
         ...(ctx.dispatcher ? { dispatcher: ctx.dispatcher } : {}),
         ...(ctx.maxConcurrency !== undefined ? { maxConcurrency: ctx.maxConcurrency } : {}),
         ...(ctx.eventSource !== undefined ? { eventSource: ctx.eventSource } : {}),
-        // The parent's own `finally` owns the process-lifecycle drain; no maxSteps/maxRetries.
-        disposeDispatchResources: () => { },
+        ...(ctx.bundleRootOverride !== undefined ? { bundleRootOverride: ctx.bundleRootOverride } : {}),
     };
     try {
         // The re-read stays inside this try: an escaped throw would skip the

package/dist/workflows/exec/dispatch-redaction.js

@@ -2,105 +2,54 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 /**
- * The one redaction contract every frozen-workflow dispatch (unit or gate
- * judge) is held to before anything about its outcome reaches durable state.
- * A leaf module, so the judge path reuses it without an import cycle.
+ * What a frozen-workflow unit's outcome is scrubbed of before it reaches
+ * durable state: the secrets its environment bindings substituted, on top of
+ * what the dispatch itself already redacted (the runner's connection key), and
+ * the credential-named variables of the environment every unit's process inherits.
  */
-import { collectSensitiveValues, isEnvPassthroughValueSafeToExpose, redactSensitiveText, redactSensitiveValue, } from "../../core/redaction.js";
-import { lookupApiKeyFileValue, lookupApiKeySecretRefValue } from "../../integrations/agent/engine-resolution.js";
+import { collectInferredSecretValues, collectSensitiveValues, redactSensitiveValue } from "../../core/redaction.js";
+import { collectDispatchSensitiveValues } from "../../integrations/agent/runner-dispatch.js";
 /**
  * Every exact value that must never reach the journal from one dispatch: the
- * resolved `env` bindings, the engine's (and SDK fallback's) credential from
- * env, file, or secret store, and unsafe passthrough values. Read at call time,
- * so collect no earlier than the dispatch being scrubbed.
+ * secrets substituted into the unit's env bindings (`dispatch.sensitiveValues`;
+ * the rest of an env asset is configuration and reaches the journal as is), the
+ * runner's connection key, and the credential-named variables of akm's
+ * environment, which a shell command inherits as a runner does. Read at call
+ * time, so collect no earlier than the dispatch being scrubbed.
  */
-export function collectWorkflowDispatchSensitiveValues(dispatch, env) {
-    const values = new Set([...Object.values(env ?? {}), ...(dispatch.sensitiveValues ?? [])]);
-    const addCredential = (runner) => {
-        if (!runner)
-            return;
-        if (runner.kind === "llm") {
-            for (const name of runner.credential?.names ?? []) {
-                const value = process.env[name]?.trim();
-                if (value)
-                    values.add(value);
-            }
-            // #905: file-backed credential — best-effort read, never throws, so a
-            // broken apiKeyFile is reported by the real dispatch, not this collector.
-            if (runner.apiKeyFile) {
-                const value = lookupApiKeyFileValue(runner.apiKeyFile);
-                if (value)
-                    values.add(value);
-            }
-            // #953: secret-store-backed credential — same best-effort rationale.
-            if (runner.apiKeySecretRef) {
-                const value = lookupApiKeySecretRefValue(runner.apiKeySecretRef);
-                if (value)
-                    values.add(value);
-            }
-            return;
-        }
-        for (const name of runner.profile.envPassthrough ?? []) {
-            const value = process.env[name];
-            if (!isEnvPassthroughValueSafeToExpose(name, value) && value)
-                values.add(value);
-        }
-        if (runner.kind === "sdk") {
-            for (const name of runner.fallbackCredential?.names ?? []) {
-                const value = process.env[name]?.trim();
-                if (value)
-                    values.add(value);
-            }
-            if (runner.fallbackApiKeyFile) {
-                const value = lookupApiKeyFileValue(runner.fallbackApiKeyFile);
-                if (value)
-                    values.add(value);
-            }
-            if (runner.fallbackApiKeySecretRef) {
-                const value = lookupApiKeySecretRefValue(runner.fallbackApiKeySecretRef);
-                if (value)
-                    values.add(value);
-            }
-        }
-    };
-    addCredential(dispatch.runner);
+export function collectWorkflowDispatchSensitiveValues(dispatch) {
+    const values = new Set(dispatch.sensitiveValues ?? []);
+    const dispatchValues = dispatch.runner
+        ? collectDispatchSensitiveValues(dispatch.runner)
+        : collectInferredSecretValues(process.env);
+    for (const value of dispatchValues)
+        values.add(value);
     return collectSensitiveValues(values);
 }
+/**
+ * Turn a number leaf that is exactly a sensitive value into its text, so the string scrub redacts it (a
+ * numeric secret echoed as a JSON number). Only the unit's parsed `result` takes this path: a number
+ * elsewhere in an outcome (`tokens`) stays a number.
+ */
+function stringifySensitiveNumbers(value, sensitiveValues) {
+    if (typeof value === "number")
+        return sensitiveValues.includes(String(value)) ? String(value) : value;
+    if (Array.isArray(value))
+        return value.map((entry) => stringifySensitiveNumbers(entry, sensitiveValues));
+    if (value && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value).map(([key, child]) => [key, stringifySensitiveNumbers(child, sensitiveValues)]));
+    }
+    return value;
+}
 /**
  * Scrub a dispatch outcome before anything about it is journaled. A
  * `failureReason` the scrub altered carried a secret, so it is downgraded.
  */
 export function redactUnitOutcome(outcome, sensitiveValues) {
-    const redacted = redactSensitiveValue(outcome, sensitiveValues);
+    const prepared = "result" in outcome ? { ...outcome, result: stringifySensitiveNumbers(outcome.result, sensitiveValues) } : outcome;
+    const redacted = redactSensitiveValue(prepared, sensitiveValues);
     if (outcome.failureReason !== undefined && redacted.failureReason !== outcome.failureReason) {
         redacted.failureReason = "reported_failure";
     }
     return redacted;
 }
-/** Scrub a value thrown out of a dispatch; re-wrapped only when the scrub changed its message. */
-function redactDispatchError(err, sensitiveValues) {
-    if (sensitiveValues.length === 0 || !(err instanceof Error))
-        return err;
-    const redacted = redactSensitiveText(err.message, sensitiveValues);
-    if (redacted === err.message)
-        return err;
-    const replacement = new Error(redacted);
-    replacement.name = err.name;
-    return replacement;
-}
-/**
- * Wrap a dispatcher so both its outcome and its thrown error are scrubbed with
- * the request's `sensitiveValues` (the gate judge; the unit path scrubs at its
- * own journal boundary after the structured-output parse).
- */
-export function withDispatchRedaction(inner) {
-    return async (request, feedback) => {
-        const sensitiveValues = request.sensitiveValues ?? [];
-        try {
-            return redactUnitOutcome(await inner(request, feedback), sensitiveValues);
-        }
-        catch (err) {
-            throw redactDispatchError(err, sensitiveValues);
-        }
-    };
-}