akm-cli 0.10.261012-beta → 0.10.261014-beta

package/dist/workflows/parser.js

@@ -35,10 +35,12 @@ import { LineCounter, parseDocument } from "yaml";
 import { bundleRefToString, parseBundleRef } from "../core/asset/asset-ref.js";
 import { parseFrontmatterBlock } from "../core/asset/frontmatter.js";
 import { parseMarkdownToc } from "../core/asset/markdown.js";
-import { isContainedRelativePath, isRecord } from "../core/common.js";
+import { isRecord } from "../core/common.js";
 import { formatExtraParamsIssue, validateExtraParams } from "../core/extra-params.js";
 import { checkJsonSchemaDefinition, JSON_SCHEMA_SUBSET_SUPPORTED_KEYWORDS } from "../core/json-schema.js";
+import { warnOnce } from "../core/warn.js";
 import { INPUT_NAME_PATTERN } from "../execution/input-contract.js";
+import { warnRetiredEngineKey } from "../execution/source.js";
 import { classifyTargetRef } from "../execution/target-ref.js";
 import { WORKFLOW_PLAN_VERSION, } from "./plan.js";
 import { parseReference } from "./program/expressions.js";
@@ -88,13 +90,15 @@ const ENVELOPE_KEYS = [
 ];
 const WORKFLOW_KEYS = ["params", "defaults", "budget", "steps"];
 const TOP_LEVEL_KEYS = [...ENVELOPE_KEYS, ...WORKFLOW_KEYS];
-const DEFAULTS_KEYS = ["engine", "model", "timeout", "on_error", "llm"];
+const DEFAULTS_KEYS = ["connection", "harness", "engine", "model", "timeout", "on_error", "llm"];
 const BUDGET_KEYS = ["max_tokens", "max_units"];
 const STEP_KEYS = ["id", "unit", "map", "inputs", "output", "gate"];
 const UNIT_KEYS = [
     "exec",
     "workflow",
     "with",
+    "connection",
+    "harness",
     "engine",
     "model",
     "llm",
@@ -105,8 +109,8 @@ const UNIT_KEYS = [
     "env",
 ];
 const EXEC_KEYS = ["command", "cwd", "pass_env"];
-/** Unit keys that name an ENGINE dispatch and therefore cannot appear beside `exec:`. */
-const UNIT_ENGINE_KEYS = ["engine", "model", "llm"];
+/** Unit keys that name a model or agent dispatch and therefore cannot appear beside `exec:`. `engine` is the retired spelling of `connection` / `harness`. */
+const UNIT_ENGINE_KEYS = ["connection", "harness", "engine", "model", "llm"];
 const MAP_KEYS = ["over", "concurrency", "reducer", "unit"];
 const RETRY_KEYS = ["max", "on"];
 const GATE_KEYS = ["max_loops"];
@@ -182,7 +186,6 @@ export function parseWorkflow(markdown, source) {
     const ctx = {
         filePath: path,
         errors,
-        ...(source.validateExecCwd ? { validateExecCwd: source.validateExecCwd } : {}),
         lineAt,
         lineAtOffset: (offset) => Math.max(1, lineCounter.linePos(offset).line + lineOffset),
         nodeAt: (p) => (p.length === 0 ? doc.contents : doc.getIn(p, true)),
@@ -524,10 +527,14 @@ function parseDefaults(ctx, raw) {
     }
     checkUnknownKeys(ctx, raw, path, DEFAULTS_KEYS, `"defaults"`);
     const defaults = {};
-    if (raw.engine !== undefined) {
-        const engine = parseEngineName(ctx, raw.engine, [...path, "engine"], `"defaults.engine"`);
-        if (engine !== undefined)
-            defaults.engine = engine;
+    for (const key of ["connection", "harness", "engine"]) {
+        if (raw[key] === undefined)
+            continue;
+        const name = parseEngineName(ctx, raw[key], [...path, key], `"defaults.${key}"`);
+        if (name !== undefined)
+            defaults[key] = name;
+        if (key === "engine")
+            warnRetiredEngineKey();
     }
     if (raw.model !== undefined) {
         if (typeof raw.model === "string" && raw.model.trim() !== "")
@@ -655,7 +662,7 @@ function parseUnit(ctx, raw, path, stepLabel, allowWorkflow = true) {
         const exec = parseExec(ctx, raw.exec, [...path, "exec"], stepLabel);
         if (exec !== undefined)
             unit.exec = exec;
-        // An exec unit dispatches no engine call, so every engine-selection key is
+        // An exec unit dispatches no model call, so every connection or harness selection key is
         // a contradiction rather than a harmless extra. Reported per key so the
         // author sees exactly which line to delete.
         for (const key of UNIT_ENGINE_KEYS) {
@@ -672,7 +679,7 @@ function parseUnit(ctx, raw, path, stepLabel, allowWorkflow = true) {
         if (raw.exec !== undefined) {
             ctx.err([...path, "workflow"], `${stepLabel} "unit" declares both "exec" and "workflow" — a unit runs one or the other.`);
         }
-        // A workflow unit starts a child run: it reaches no engine and the child carries its own environment.
+        // A workflow unit starts a child run: it reaches no model and the child carries its own environment.
         for (const key of [...UNIT_ENGINE_KEYS, "env"]) {
             if (raw[key] === undefined)
                 continue;
@@ -691,10 +698,14 @@ function parseUnit(ctx, raw, path, stepLabel, allowWorkflow = true) {
             unit.with = raw.with;
         }
     }
-    if (raw.engine !== undefined) {
-        const engine = parseEngineName(ctx, raw.engine, [...path, "engine"], `${stepLabel} "engine"`);
-        if (engine !== undefined)
-            unit.engine = engine;
+    for (const key of ["connection", "harness", "engine"]) {
+        if (raw[key] === undefined)
+            continue;
+        const name = parseEngineName(ctx, raw[key], [...path, key], `${stepLabel} "${key}"`);
+        if (name !== undefined)
+            unit[key] = name;
+        if (key === "engine")
+            warnRetiredEngineKey();
     }
     if (raw.model !== undefined) {
         if (typeof raw.model === "string" && raw.model.trim() !== "")
@@ -780,16 +791,18 @@ function parseExec(ctx, raw, path, stepLabel) {
     return exec;
 }
 /**
- * `pass_env:` — extra parent-process env var NAMES the child may see on top of
- * the default allowlist. NAMES ONLY: a value would be a plaintext secret in the
- * frozen plan, which is exactly what `env:` bindings exist to avoid.
+ * `pass_env:` — env var NAMES, recorded in the frozen plan. They select nothing:
+ * an exec child inherits akm's environment, so a workflow written before that
+ * still parses. NAMES ONLY: a value would be a plaintext secret in the frozen
+ * plan, which is exactly what `env:` bindings exist to avoid.
  */
 function parseExecPassEnv(ctx, raw, path, stepLabel) {
     if (raw === undefined)
         return undefined;
     if (!Array.isArray(raw) || raw.length === 0) {
-        ctx.err(path, `${stepLabel} "exec.pass_env" must be a non-empty list of environment variable NAMES to copy through from ` +
-            `akm's own environment, e.g. pass_env: [CARGO_HOME]. Values never appear here — use "env:" bindings for those.`);
+        ctx.err(path, `${stepLabel} "exec.pass_env" must be a non-empty list of environment variable NAMES, e.g. ` +
+            `pass_env: [CARGO_HOME]. It has no effect: the command inherits akm's environment. Values never appear ` +
+            `here — use "env:" bindings for those.`);
         return undefined;
     }
     const names = [];
@@ -829,36 +842,18 @@ function parseExecCommand(ctx, raw, path, stepLabel) {
     return argv;
 }
 /**
- * The optional relative `cwd:`. Rejected here (statically) for absolute paths
- * and `..` segments; containment against the resolved base directory is
- * re-checked at dispatch, so a symlinked subdirectory cannot escape either.
+ * The optional `cwd:`: a non-empty string, relative to the workflow's bundle root or absolute, and
+ * free to carry `${ref}` tokens. Nothing else is checked here; the unit's working directory is
+ * resolved at dispatch.
  */
 function parseExecCwd(ctx, raw, path, stepLabel) {
     if (raw === undefined)
         return undefined;
     if (typeof raw !== "string" || raw.trim() === "") {
-        ctx.err(path, `${stepLabel} "exec.cwd" must be a non-empty relative path inside the unit's working directory.`);
-        return undefined;
-    }
-    const value = raw.trim();
-    if (!isContainedRelativePath(value)) {
-        ctx.err(path, `${stepLabel} "exec.cwd" (${JSON.stringify(value)}) must be a RELATIVE path inside the unit's working ` +
-            `directory — absolute paths, Windows drive letters, "~", and ".." segments are rejected.`);
+        ctx.err(path, `${stepLabel} "exec.cwd" must be a non-empty string.`);
         return undefined;
     }
-    if (ctx.validateExecCwd) {
-        const semantic = ctx.validateExecCwd(value);
-        if (!semantic.ok) {
-            ctx.errors.push({
-                code: semantic.code,
-                line: ctx.lineAt(path),
-                message: semantic.message,
-            });
-            return undefined;
-        }
-        return semantic.value;
-    }
-    return value;
+    return raw.trim();
 }
 function parseMap(ctx, raw, path, stepLabel) {
     if (!isRecord(raw)) {
@@ -943,19 +938,19 @@ function parseGate(ctx, raw, path, stepLabel) {
 // Field helpers
 // ---------------------------------------------------------------------------
 /**
- * Engine names must already satisfy the frozen-plan grammar
+ * Connection and harness names must already satisfy the frozen-plan grammar
  * (`WORKFLOW_ENGINE_NAME_PATTERN`, max 63 chars) at parse time — the decoder
  * enforces the same bound on persisted plans, and a name that only fails there
  * surfaces as an unlocated "Invalid frozen workflow plan" at `workflow run`.
  */
 function parseEngineName(ctx, raw, path, label) {
     if (typeof raw !== "string" || raw.trim() === "") {
-        ctx.err(path, `${label} must be a non-empty engine name.`);
+        ctx.err(path, `${label} must be a non-empty name.`);
         return undefined;
     }
     const name = raw.trim();
     if (!WORKFLOW_ENGINE_NAME_PATTERN.test(name) || name.length > WORKFLOW_MAX_ENGINE_NAME_LENGTH) {
-        ctx.err(path, `${label} has an invalid engine name ${JSON.stringify(name)}. Engine names are lowercase words of letters ` +
+        ctx.err(path, `${label} has an invalid name ${JSON.stringify(name)}. Names are lowercase words of letters ` +
             `and digits separated by single dashes, starting with a letter (e.g. "code-review-llm"), at most ` +
             `${WORKFLOW_MAX_ENGINE_NAME_LENGTH} characters.`);
         return undefined;
@@ -1044,7 +1039,12 @@ function parseEnumField(ctx, raw, path, label, allowed) {
     ctx.err(path, `${label} must be one of: ${allowed.join(" | ")} (got ${JSON.stringify(raw)}).`);
     return undefined;
 }
-/** Parse only invocation tuning. Connection identity belongs to a named engine. */
+/** Keys a unit's `llm:` once took and akm no longer reads: warned about once, then ignored. */
+const RETIRED_LLM_KEYS = {
+    supports_json_schema: "akm retries without a schema when the endpoint rejects one",
+    context_length: "the context window is a connection's setting (contextLength)",
+};
+/** Parse only invocation tuning. Where it is sent belongs to a named connection. */
 function parseLlmOverrides(ctx, raw, path, label) {
     if (raw === undefined)
         return undefined;
@@ -1076,11 +1076,9 @@ function parseLlmOverrides(ctx, raw, path, label) {
         else
             ctx.err([...path, "max_tokens"], `${label}.max_tokens must be a positive integer.`);
     }
-    if (raw.supports_json_schema !== undefined) {
-        if (typeof raw.supports_json_schema === "boolean")
-            result.supportsJsonSchema = raw.supports_json_schema;
-        else
-            ctx.err([...path, "supports_json_schema"], `${label}.supports_json_schema must be a boolean.`);
+    for (const [key, why] of Object.entries(RETIRED_LLM_KEYS)) {
+        if (raw[key] !== undefined)
+            warnOnce(`workflow-llm-${key}`, `A workflow's llm.${key} is ignored: ${why}.`);
     }
     if (raw.extra_params !== undefined) {
         if (!isRecord(raw.extra_params)) {
@@ -1099,13 +1097,6 @@ function parseLlmOverrides(ctx, raw, path, label) {
             }
         }
     }
-    if (raw.context_length !== undefined) {
-        if (typeof raw.context_length === "number" && Number.isInteger(raw.context_length) && raw.context_length > 0) {
-            result.contextLength = raw.context_length;
-        }
-        else
-            ctx.err([...path, "context_length"], `${label}.context_length must be a positive integer.`);
-    }
     if (raw.enable_thinking !== undefined) {
         if (typeof raw.enable_thinking === "boolean")
             result.enableThinking = raw.enable_thinking;

package/dist/workflows/plan.js

@@ -1,5 +1,11 @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
-/** Stored plans record this; 0.9.15 and 0.9.16 wrote 5, which still decodes (the 0.9.15 floor, #1091). */
-export const WORKFLOW_PLAN_VERSION = 6;
+/**
+ * Stored plans record this; 0.9.15 and 0.9.16 wrote 5 and early 0.10 wrote 6,
+ * which still decode (the 0.9.15 floor, #1091). 7 stopped freezing locations:
+ * the plan names the refs the engine dereferences, never a directory or file.
+ * 8 freezes a connection or harness where 7 froze an engine: a plan of 7 or
+ * earlier that holds a command target cannot be decoded, and its run starts afresh.
+ */
+export const WORKFLOW_PLAN_VERSION = 8;

package/dist/workflows/renderer.js

@@ -9,7 +9,9 @@
  * declares one.
  */
 import { displayRef } from "../core/asset/resolve-ref.js";
+import { isInstalledBundle, resolveRefOwner } from "../core/env-secret-ref.js";
 import { UsageError } from "../core/errors.js";
+import { substituteRefTokens } from "../core/ref-token.js";
 import { compileWorkflowSource, workflowStepInstructions } from "./compile.js";
 function shellQuote(value) {
     return `'${value.replace(/'/g, `'\\''`)}'`;
@@ -25,7 +27,7 @@ function deriveName(ctx) {
     return ext > 0 ? ctx.relPath.slice(0, ext) : ctx.relPath;
 }
 function loadPlan(ctx) {
-    const result = compileWorkflowSource(ctx.content(), { path: ctx.relPath, workspaceRoot: ctx.stashRoot });
+    const result = compileWorkflowSource(ctx.content(), { path: ctx.relPath });
     if (result.ok)
         return result.plan;
     const summary = result.errors.map((e) => `${e.path}:${e.line} — ${e.message}`).join("\n");
@@ -43,16 +45,16 @@ function projectParameters(plan) {
 }
 /**
  * Compact, show-facing orchestration summary for one step. Field mapping:
- * `engine`/`model`/`timeoutMs` merge the run-level `defaults` exactly like the
+ * `engine` (the connection or harness a unit names), `model` and `timeoutMs` merge the run-level `defaults` exactly like the
  * compiler does (per-unit override wins), `fanOut.over` carries the raw
  * reference string.
  * Returns undefined when the step declares nothing worth summarizing.
  *
  * ## exec units
  *
- * An `exec` unit runs a shell command and names NO engine — the parser rejects
- * `engine`/`model`/`llm` alongside `exec:`. Merging `defaults.engine` into its
- * summary would make `show` state something untrue about what will run, so the
+ * An `exec` unit runs a shell command and names no connection or harness — the parser rejects
+ * `connection`/`harness`/`model`/`llm` alongside `exec:`. Merging the run's default
+ * into its summary would make `show` state something untrue about what will run, so the
  * two fields are suppressed and the argv is projected instead, under `exec`
  * (field presence carries the dispatch kind, exactly like `fanOut`
  * carries the step kind).
@@ -70,11 +72,16 @@ function projectParameters(plan) {
  * It is far smaller than the step `instructions` this same projection
  * already carries whole.
  */
-function summarizeStepOrchestration(step, defaults) {
+export function summarizeStepOrchestration(step, defaults) {
     const spec = step.spec;
     const unit = spec?.unit;
-    const exec = spec?.exec;
-    const engine = exec ? undefined : (unit?.engine ?? defaults?.engine);
+    // A stored plan carries no authored spec: read the same fields off its frozen dispatch.
+    const frozen = spec ? undefined : frozenDispatch(step);
+    const exec = spec ? spec.exec : frozen?.exec;
+    const env = unit?.env ?? frozen?.env;
+    const workflow = spec ? spec.workflow : frozen?.workflow;
+    const named = (settings) => settings?.connection ?? settings?.harness ?? settings?.engine;
+    const engine = exec ? undefined : (named(unit) ?? named(defaults));
     const model = exec ? undefined : (unit?.model ?? defaults?.model);
     const timeoutMs = unit?.timeoutMs !== undefined ? unit.timeoutMs : defaults?.timeoutMs;
     const summary = {
@@ -93,10 +100,77 @@ function summarizeStepOrchestration(step, defaults) {
             }
             : {}),
         ...(unit?.output !== undefined || step.outputSchema !== undefined ? { hasSchema: true } : {}),
-        ...(unit?.env !== undefined ? { env: [...unit.env] } : {}),
+        ...(env !== undefined ? { env: [...env] } : {}),
+        ...(workflow !== undefined ? { workflow } : {}),
     };
     return Object.keys(summary).length > 0 ? summary : undefined;
 }
+/** The exec argv, env refs and child workflow a frozen step dispatches. */
+function frozenDispatch(step) {
+    const root = step.root;
+    const unit = root?.kind === "map" ? root.template : root;
+    if (!unit)
+        return {};
+    const target = unit.frozenTarget;
+    const env = unit.environment.flatMap((binding) => (binding.kind === "env-ref" ? [binding.ref] : []));
+    return {
+        ...(target.kind === "shell"
+            ? {
+                exec: {
+                    command: [...target.exec.command],
+                    ...(target.exec.cwd !== undefined ? { cwd: target.exec.cwd } : {}),
+                    ...(target.exec.passEnv ? { passEnv: [...target.exec.passEnv] } : {}),
+                },
+            }
+            : {}),
+        ...(env.length > 0 ? { env } : {}),
+        ...(target.kind === "child-workflow" ? { workflow: target.ref } : {}),
+    };
+}
+/**
+ * Add the bundle-qualified ref every `${ref}` token in the argv or cwd, every
+ * `env:` entry and the child `workflow:` resolves to right now, through the
+ * one owner walk (`resolveRefOwner`). A ref no bundle owns lands in
+ * `unresolved` instead; callers decide whether that is an error. No secret
+ * is read and no path is returned.
+ */
+export function resolveOrchestrationRefs(summary) {
+    const refs = [];
+    const unresolved = [];
+    const note = (ref, where) => {
+        let owner;
+        try {
+            owner = resolveRefOwner(ref);
+        }
+        catch {
+            owner = undefined;
+        }
+        if (owner)
+            refs.push({ ref, resolved: owner.ref, in: where });
+        else
+            unresolved.push({ ref, in: where });
+    };
+    const tokens = (values, where) => {
+        const seen = new Set();
+        substituteRefTokens(Object.fromEntries(values.map((value, index) => [String(index), value])), (ref) => {
+            if (!seen.has(ref)) {
+                seen.add(ref);
+                note(ref, where);
+            }
+            return { kind: "path", path: "" };
+        }, isInstalledBundle);
+    };
+    if (summary.exec) {
+        tokens(summary.exec.command, "argv");
+        if (summary.exec.cwd !== undefined)
+            tokens([summary.exec.cwd], "cwd");
+    }
+    for (const ref of summary.env ?? [])
+        note(ref, "env");
+    if (summary.workflow !== undefined)
+        note(summary.workflow, "workflow");
+    return { ...summary, refs, ...(unresolved.length > 0 ? { unresolved } : {}) };
+}
 function projectStepDefinitions(plan) {
     return plan.steps.map((step, sequenceIndex) => {
         const orchestration = summarizeStepOrchestration(step, plan.defaults);

package/dist/workflows/resource-limits.js

@@ -35,7 +35,7 @@ export const WORKFLOW_EXEC_OUTPUT_TRUNCATED_MARKER = "__akm_exec_output_truncate
 // Per-var: Win32 `SetEnvironmentVariable` caps one variable at 32 767 UTF-16
 // code units; measuring UTF-8 bytes is conservative in the right direction.
 // Total: akm's own share of the `CreateProcess` `lpEnvironment` block, which it
-// shares with the allowlist, the unit's `env:` bindings and the argv.
+// shares with the rest of the environment, the unit's `env:` bindings and the argv.
 const EXEC_CONTEXT_LIMITS_WIN32 = {
     perVarBytes: 32_767,
     totalBytes: 64_000,
@@ -45,7 +45,7 @@ const EXEC_CONTEXT_LIMITS_WIN32 = {
 // margin for the name, `=`, NUL and the kernel's own accounting — the guard must
 // never reject a spawn the platform would have accepted.
 // Total: half of macOS's 256 KiB `ARG_MAX` (the tightest supported total), so
-// the other half remains for the argv, the allowlist and the `env:` bindings.
+// the other half remains for the argv, the rest of the environment and the `env:` bindings.
 const EXEC_CONTEXT_LIMITS_POSIX = {
     perVarBytes: 96 * 1024,
     totalBytes: 128 * 1024,

package/dist/workflows/runtime/run-plan.js

@@ -7,15 +7,21 @@
  *
  * {@link decodeWorkflowPlan} accepts every plan shape a release at or above
  * the 0.9.15 floor has stored — irVersion 5 (with its `sourceReadSet` and
- * host-identity fields, which 0.9.15 and 0.9.16 wrote) as well as the current
- * one — and keeps keys it does not know rather than
- * refusing them. It rejects only a plan it cannot run: no steps, a unit with
- * no frozen target, a request that does not decode. `plan_ir_version` and
- * `plan_hash` are informational columns: neither gates execution. A plan that
- * cannot be decoded comes back from {@link readRunPlan} as a `problem`
+ * host-identity fields, which 0.9.15 and 0.9.16 wrote) and irVersion 6 (with
+ * its frozen `cwdIdentity` and env owner paths) as well as the current one —
+ * and keeps keys it does not know rather than refusing them. A stored target
+ * is kept exactly as stored, location fields included: the unit `input_hash`
+ * and the child invocation key derive from the whole target, so dropping them
+ * would make an interrupted run publish a second child after an upgrade.
+ * Dispatch finds the bundle and the env asset by ref and never reads them. It
+ * rejects only a plan it cannot run: no steps, a unit with no frozen target, a
+ * request that does not decode — which is every command target an earlier
+ * irVersion froze, since each names an engine. `plan_hash` is an informational column. A plan
+ * that cannot be decoded comes back from {@link readRunPlan} as a `problem`
  * sentence and the caller decides the remedy (the engine abandons such a run
- * instead of throwing) — except for a plan a NEWER akm froze, which is `newer`
- * and whose problem names upgrading akm as the remedy.
+ * instead of throwing) — except for a plan a NEWER akm froze (`plan_ir_version`
+ * above this release's), which is refused unread as `newer` with a problem that
+ * names upgrading akm as the remedy.
  */
 import { UsageError } from "../../core/errors.js";
 import { warnOnce } from "../../core/warn.js";
@@ -26,6 +32,14 @@ export function readRunPlan(row) {
     if (!row.plan_json)
         return { ok: false, newer: false, problem: `Workflow run ${row.id} has no frozen workflow plan.` };
     const version = row.plan_ir_version ?? null;
+    if (version !== null && version > WORKFLOW_PLAN_VERSION) {
+        return {
+            ok: false,
+            newer: true,
+            problem: `Workflow run ${row.id} was frozen by a newer akm (plan irVersion ${version}) and this akm ` +
+                `(irVersion ${WORKFLOW_PLAN_VERSION}) will not run it. Upgrade akm to continue this run.`,
+        };
+    }
     try {
         const plan = decodeWorkflowPlan(JSON.parse(row.plan_json), {
             ...(row.workflow_ref ? { workflowRef: row.workflow_ref } : {}),
@@ -38,14 +52,6 @@ export function readRunPlan(row) {
     }
     catch (cause) {
         const detail = cause instanceof Error ? cause.message : String(cause);
-        if (version !== null && version > WORKFLOW_PLAN_VERSION) {
-            return {
-                ok: false,
-                newer: true,
-                problem: `Workflow run ${row.id} was frozen by a newer akm (plan irVersion ${version}) and this akm cannot decode it: ` +
-                    `${detail}. Upgrade akm to continue this run.`,
-            };
-        }
         const frozenAs = version === null ? "" : ` (frozen as plan irVersion ${version})`;
         return {
             ok: false,
@@ -166,7 +172,7 @@ function decodeTarget(value, label) {
                 kind: "shell",
                 contentHash: string(target.contentHash, `${label} contentHash`),
                 exec: decodeExec(target.exec, label),
-                cwdIdentity: record(target.cwdIdentity, `${label} cwdIdentity`),
+                ...legacyField(target, "cwdIdentity"),
                 ...optional,
             };
         case "child-workflow":
@@ -203,12 +209,15 @@ function decodeCommandTarget(target, label) {
         request,
         runner,
         ...(concurrency !== undefined ? { concurrency } : {}),
-        ...(target.cwdIdentity && typeof target.cwdIdentity === "object"
-            ? { cwdIdentity: target.cwdIdentity }
-            : {}),
+        ...legacyField(target, "cwdIdentity"),
         ...(inputBindings ? { inputBindings } : {}),
     };
 }
+/** A location field a stored target carries, kept as stored (see the module doc). */
+function legacyField(source, key) {
+    const value = source[key];
+    return value && typeof value === "object" ? { [key]: value } : {};
+}
 function decodeExec(value, label) {
     const exec = record(value, `${label} exec`);
     const command = exec.command;
@@ -246,14 +255,20 @@ function decodeEnvironmentBinding(value, label) {
         return { kind: "pass-through", name: string(binding.name, label) };
     if (binding.kind !== "env-ref")
         fail(`${label} has an unsupported kind`);
+    // Plans before irVersion 7 also carry the env file's owner, key names and secret names: kept as stored,
+    // never read (dispatch reads the env asset by ref).
     const strings = (items) => Array.isArray(items) ? items.filter((item) => typeof item === "string") : [];
     return {
         kind: "env-ref",
         ref: string(binding.ref, `${label} ref`),
-        owner: record(binding.owner, `${label} owner`),
-        keys: strings(binding.keys),
-        secretNames: strings(binding.secretNames),
         precedence: typeof binding.precedence === "number" ? binding.precedence : 0,
+        ...(binding.owner && typeof binding.owner === "object"
+            ? {
+                owner: binding.owner,
+                keys: strings(binding.keys),
+                secretNames: strings(binding.secretNames),
+            }
+            : {}),
     };
 }
 function positiveInteger(value) {