akm-cli 0.10.261012-beta → 0.10.261014-beta

package/schemas/akm-task.json

@@ -9,8 +9,7 @@
     "maxStringUtf8Bytes": 262144,
     "maxJsonDepth": 64,
     "maxJsonNodes": 10000,
-    "canonicalRefsRequireNfc": true,
-    "workingDirectoryRequiresWorkspaceRoot": true
+    "canonicalRefsRequireNfc": true
   },
   "type": "object",
   "required": ["version"],
@@ -55,8 +54,7 @@
     "working-directory": {
       "type": "string",
       "minLength": 1,
-      "maxLength": 262144,
-      "pattern": "^(?![\\\\/])(?![A-Za-z]:[\\\\/])(?!.*(?:^|[\\\\/])\\.\\.(?:[\\\\/]|$))(?!.*[\\\\/]{2})(?!.*[\\\\/]$)[^\\u0000]+$"
+      "maxLength": 262144
     },
     "schedule": {
       "oneOf": [
@@ -70,6 +68,8 @@
       ]
     },
     "agent": { "$ref": "#/definitions/nullableSelector" },
+    "connection": { "$ref": "#/definitions/nullableSelector" },
+    "harness": { "$ref": "#/definitions/nullableSelector" },
     "engine": { "$ref": "#/definitions/nullableSelector" },
     "model": { "$ref": "#/definitions/nullableSelector" },
     "inference": {

package/schemas/akm-workflow.json

@@ -74,7 +74,7 @@
       "minLength": 1,
       "maxLength": 63,
       "pattern": "^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$",
-      "description": "Named engine: lowercase dash-separated words of letters and digits, starting with a letter. Same grammar the frozen-plan decoder enforces (src/workflows/resource-limits.ts WORKFLOW_ENGINE_NAME_PATTERN)."
+      "description": "Named connection or harness: lowercase dash-separated words of letters and digits, starting with a letter. Same grammar the frozen-plan decoder enforces (src/workflows/resource-limits.ts WORKFLOW_ENGINE_NAME_PATTERN)."
     },
     "onError": {
       "description": "Failure policy: fail the step on the first unit failure (default), or record failures and let the gate decide.",
@@ -86,9 +86,9 @@
       "properties": {
         "temperature": { "type": "number" },
         "max_tokens": { "type": "integer", "minimum": 1 },
-        "supports_json_schema": { "type": "boolean" },
+        "supports_json_schema": { "description": "Retired and ignored: akm retries without a schema when the endpoint rejects one.", "type": "boolean" },
         "extra_params": { "$ref": "#/definitions/extraParams" },
-        "context_length": { "type": "integer", "minimum": 1 },
+        "context_length": { "description": "Retired and ignored: the context window is a connection's setting.", "type": "integer", "minimum": 1 },
         "enable_thinking": { "type": "boolean" },
         "reasoning_effort": { "type": "string", "minLength": 1 }
       }
@@ -189,13 +189,20 @@
       "description": "Run-level defaults, overridable per unit.",
       "additionalProperties": false,
       "properties": {
-        "engine": {
+        "connection": {
+          "$ref": "#/definitions/engineName"
+        },
+        "harness": {
           "$ref": "#/definitions/engineName"
         },
+        "engine": {
+          "$ref": "#/definitions/engineName",
+          "description": "Retired spelling of `connection` / `harness`: a connection by this name, else a harness."
+        },
         "model": {
           "type": "string",
           "minLength": 1,
-          "description": "Model alias (tier) or exact id; resolved per-harness at dispatch."
+          "description": "Model alias (tier) or exact id; resolved on the connection or harness at dispatch."
         },
         "timeout": {
           "$ref": "#/definitions/timeout"
@@ -210,7 +217,7 @@
     },
     "exec": {
       "type": "object",
-      "description": "Run a shell command as this unit instead of dispatching to an engine. `command` is an ARGV ARRAY and there is no shell-string form: the child is spawned directly, so shell metacharacters (`;` `|` `&&` `$(…)` `>` `*`) are inert literal argument bytes — the quoting/injection class simply does not exist. Write the interpreter explicitly (e.g. [\"bash\", \"-lc\", \"a | b\"]) when a pipeline is really wanted. stdout is the promoted step artifact with trailing newlines stripped (like shell `$(…)`); when the unit declares an `output` schema, stdout must instead be exactly one JSON value, which is validated against it. A non-zero exit fails the unit with failure reason `non_zero_exit`, honoring `retry:` and `on_error:` like any other unit. The child's environment is an ALLOWLIST by default (PATH, HOME, locale/temp vars, the Windows process-creation essentials) — widen it only with named `env:` environment bindings or `pass_env`.",
+      "description": "Run a shell command as this unit instead of dispatching to an engine. `command` is an ARGV ARRAY and there is no shell-string form: the child is spawned directly, so shell metacharacters (`;` `|` `&&` `$(…)` `>` `*`) are inert literal argument bytes — the quoting/injection class simply does not exist. Write the interpreter explicitly (e.g. [\"bash\", \"-lc\", \"a | b\"]) when a pipeline is really wanted. stdout is the promoted step artifact with trailing newlines stripped (like shell `$(…)`); when the unit declares an `output` schema, stdout must instead be exactly one JSON value, which is validated against it. A non-zero exit fails the unit with failure reason `non_zero_exit`, honoring `retry:` and `on_error:` like any other unit. The child inherits the environment akm runs in, with the directories akm resolved and the unit's `env:` environment bindings set over it.",
       "required": ["command"],
       "additionalProperties": false,
       "properties": {
@@ -231,7 +238,7 @@
         },
         "pass_env": {
           "type": "array",
-          "description": "Extra environment variable NAMES copied through from akm's own environment on top of the default allowlist — for a per-machine toolchain variable (e.g. CARGO_HOME) that no committed `env:` asset could carry. NAMES ONLY: values never appear in a workflow, and unlike `env:` bindings these values are NOT redacted from the command's output, so never list a credential here.",
+          "description": "Environment variable NAMES kept for workflows written when the child started from an empty environment. It selects nothing: the command inherits akm's environment. NAMES ONLY: values never appear in a workflow.",
           "minItems": 1,
           "uniqueItems": true,
           "items": {
@@ -243,7 +250,7 @@
     },
     "unit": {
       "type": "object",
-      "description": "Optional dispatch-override bag for a unit/map step. A step with none of these carries the run's engine/model/timeout defaults verbatim. Declaring `exec` turns the step into a shell-command unit: it names no engine, so `engine`, `model`, and `llm` are rejected alongside it. Declaring `workflow` (Experimental, not allowed inside `map.unit`) makes the step start a child workflow run: it names no engine or env either, and the child's last step output is the step's result.",
+      "description": "Optional dispatch-override bag for a unit/map step. A step with none of these carries the run's engine/model/timeout defaults verbatim. Declaring `exec` turns the step into a shell-command unit: it names no connection or harness, so `connection`, `harness`, `engine`, `model`, and `llm` are rejected alongside it. Declaring `workflow` (Experimental, not allowed inside `map.unit`) makes the step start a child workflow run: it names no engine or env either, and the child's last step output is the step's result.",
       "additionalProperties": false,
       "allOf": [
         {
@@ -253,6 +260,12 @@
           "then": {
             "not": {
               "anyOf": [
+                {
+                  "required": ["connection"]
+                },
+                {
+                  "required": ["harness"]
+                },
                 {
                   "required": ["engine"]
                 },
@@ -276,6 +289,12 @@
                 {
                   "required": ["exec"]
                 },
+                {
+                  "required": ["connection"]
+                },
+                {
+                  "required": ["harness"]
+                },
                 {
                   "required": ["engine"]
                 },
@@ -314,9 +333,17 @@
           "type": "object",
           "description": "Experimental. Binds the child workflow's params: each key is a declared child param, each value a literal or `{ from: <reference> }`."
         },
+        "connection": {
+          "$ref": "#/definitions/engineName",
+          "description": "Named connection selected when the workflow run is created."
+        },
+        "harness": {
+          "$ref": "#/definitions/engineName",
+          "description": "Named harness selected when the workflow run is created."
+        },
         "engine": {
           "$ref": "#/definitions/engineName",
-          "description": "Named engine selected when the workflow run is created."
+          "description": "Retired spelling of `connection` / `harness`: a connection by this name, else a harness."
         },
         "model": {
           "type": "string",

package/ROADMAP.md

@@ -1,112 +0,0 @@
-# Roadmap
-
-This page outlines the high-level focus for the next two releases.
-
-It is intentionally directional rather than exhaustive. Detailed command,
-schema, and migration behavior still lives in the release notes, the
-migration guides, and [STABILITY.md](STABILITY.md), which classifies
-today's public contract by surface. The internal design specs behind the
-0.9.0 architecture consolidation live under
-[`docs/architecture/specs/`](docs/architecture/specs/).
-
-## 0.8 Foundation
-
-Release `0.8.0` already established much of the product shape that `0.9` and
-`1.0` build on.
-
-- The CLI and config surface were substantially redesigned.
-- `akm improve` became the main self-improvement and maintenance entry point.
-- Task assets, proposal workflows, health reporting, and agent command-building
-  all landed as first-class capabilities.
-- Storage, indexing, graph extraction, and migration paths were tightened to
-  support the v1 contract freeze.
-
-That means the next two releases are less about inventing a new direction and
-more about hardening, simplifying, and freezing what `0.8.0` put in place.
-
-## 0.9
-
-Release `0.9` is the architecture-consolidation release ahead of the `1.0`
-contract freeze. It replaces the flat asset-type registry with a
-**bundle / adapter** model and settles the durable contracts `1.0` will freeze.
-
-- **One canonical ref grammar.** Refs are `[bundle//]conceptId` — a
-  subdir-qualified concept id such as `skills/code-review` or `memories/vpn-note`
-  — replacing the pre-`0.9` `type:name` spelling. Durable state stores the
-  fully-qualified form; the short bundle-omitted form is input sugar. This is a
-  deliberate, one-time break, taken pre-`1.0` while it is still cheap.
-- **Format-neutral bundles.** Installed sources are bundles, each recognized by
-  a built-in adapter (Agent Skills, Claude/OpenCode commands and agents,
-  knowledge, YAML workflows, tasks, env/secret files, scripts, OKF and LLM-wiki
-  knowledge bases) instead of a closed asset-type list.
-- **Storage consolidation.** The durable databases collapse from four to three
-  (`state.db` / `index.db` / a separate `logs.db`); config migrates from the
-  flat `stashDir` / `sources` / `installed` keys to `bundles` / `defaultBundle`.
-  The one-time cutover is journaled and crash-resumable via `akm migrate apply`,
-  with a verified backup taken first.
-- **Debt paydown.** The improve / proposal / workflow internals are decomposed
-  onto one file-change transaction model and an ambient run context, the
-  deprecated `0.8` CLI aliases are removed, and the `vault` asset type is
-  retired in favor of `env` / `secret`.
-
-In short: `0.9` reduces ambiguity, pays down pre-`1.0` debt, and arrives at a
-small, durable core ready for the `1.0` freeze.
-
-### The 0.9.x series
-
-`0.9.x` is a series of refactoring and clean-up releases. The intent is to
-have **all technical debt paid off and all planned breaking changes handled
-before the 0.10.x series begins**. To get there quickly, 0.9.x patch releases
-may include breaking changes (see [STABILITY.md](STABILITY.md)); every
-break ships with a CHANGELOG migration note.
-
-Alongside the bug fixes and compatibility improvements, `0.9.x` also focuses
-on **tuning the improve processes** — reflect, distill, consolidate, memory
-inference, graph extraction, and proactive maintenance — and **settling the
-final design of those features** so the `0.10.0` release starts from a
-finished improve surface rather than one still being reshaped.
-
-## 0.10
-
-The `0.10.x` series is focused on **bug fixes and tuning** on top of the
-debt-free 0.9 core — no new architecture. With the clean-up done, 0.10.x
-attempts to return to the normal semver discipline: breaking changes only in
-major and minor releases, never in patches.
-
-## 0.X
-
-There may be other minor releases between 0.10.x and 1.0.0. The goal is to minimize the number of minor releases after 0.10.x, and they will only be used for addressing breaking changes that are justifiable before the 1.0.0 release.
-
-## 1.0
-
-Release `1.0` is focused on freezing the public contract and shipping the first
-stable ecosystem layer around that core.
-
-- Freeze the supported source model, the `[bundle//]conceptId` ref format,
-  search behavior, and write-target rules — the surfaces
-  [STABILITY.md](STABILITY.md)'s own 1.0 contract-freeze section
-  already names — and settle the surfaces it currently classifies as
-  Evolving or Experimental.
-- Carry the `0.8` agent and improvement workflow forward as a stable,
-  documented product surface rather than a collection of pre-release features.
-- Ship an official akm SDK for building integrations against the stable v1
-  contract instead of reverse-engineering CLI behavior.
-- Ship in-process akm plugins for Claude Code and OpenCode, built on that SDK,
-  so those tools can integrate more deeply without changing the CLI-first core
-  model that akm itself relies on.
-- Keep the CLI as the canonical foundation so the SDK and plugin story extends
-  the existing system rather than forking it into separate integration models.
-
-In short: `1.0` is where akm stops being only a strong CLI and becomes a stable
-platform for both direct use and deeper tool integration.
-
-## Scope Notes
-
-- The CLI remains the foundation in both releases.
-- `0.9` prioritizes hardening over expansion.
-- `1.0` adds the SDK and in-process plugin story on top of a frozen core, not
-  instead of it.
-- The roadmap assumes the `0.8.0` redesign is the baseline; later releases are
-  about stabilizing and extending that baseline, not replacing it.
-- Specific features may move between releases as implementation and testing
-  shake out, but the themes above are the intended direction.

package/dist/assets/models.json

@@ -1,35 +0,0 @@
-{
-  "version": 1,
-  "aliases": {
-    "fast": {
-      "claude": "claude-haiku-4-5-20251001",
-      "opencode": "opencode/claude-haiku-4-5",
-      "opencode-sdk": "anthropic/claude-haiku-4-5"
-    },
-    "balanced": {
-      "claude": "claude-sonnet-4-6",
-      "opencode": "opencode/claude-sonnet-4-6",
-      "opencode-sdk": "anthropic/claude-sonnet-4-6"
-    },
-    "reasoning": {
-      "claude": {
-        "model": "claude-opus-4-7",
-        "inference": {
-          "effort": "high"
-        }
-      },
-      "opencode": {
-        "model": "opencode/claude-opus-4-7",
-        "inference": {
-          "effort": "high"
-        }
-      },
-      "opencode-sdk": {
-        "model": "anthropic/claude-opus-4-7",
-        "inference": {
-          "effort": "high"
-        }
-      }
-    }
-  }
-}

package/dist/commands/health/engine-usage.js

@@ -1,45 +0,0 @@
-// This Source Code Form is subject to the terms of the Mozilla Public
-// License, v. 2.0. If a copy of the MPL was not distributed with this
-// file, You can obtain one at https://mozilla.org/MPL/2.0/.
-/**
- * `engine-last-used` support for `akm health` (#950).
- *
- * An engine bound to an enabled improve process that has not actually been
- * invoked in weeks looks identical to a healthy one on every existing check —
- * `default-llm-engine`/`configured-engines` only probe availability/reachability,
- * never USE. This module answers "when did this engine last run, and for
- * whom" by folding `llm_usage` events over a fixed lookback window,
- * independent of the report's `--since` (mirrors `session-extraction`'s
- * independent `SESSION_EXTRACTION_LEDGER_WINDOW_DAYS` window in `checks.ts`).
- */
-import { daysToMs } from "../../core/common.js";
-import { readEvents } from "../../core/events.js";
-import { LLM_USAGE_EVENT } from "../../llm/usage-persist.js";
-import { decodeLlmUsageRecord } from "../../llm/usage-telemetry.js";
-/** Rolling window `engine-last-used` reads over, independent of `--since`. */
-export const ENGINE_LAST_USED_LOOKBACK_DAYS = 30;
-/** ISO cutoff for the `ENGINE_LAST_USED_LOOKBACK_DAYS` window, ending at `now()`. */
-export function engineLastUsedSince(now) {
-    return new Date(now() - daysToMs(ENGINE_LAST_USED_LOOKBACK_DAYS)).toISOString();
-}
-/**
- * Fold `llm_usage` events over the lookback window into the most recent call
- * per engine. Best-effort like every other health probe: an event with no
- * `engine` field (pre-#576 rows, or a call outside any resolved engine) is
- * skipped rather than bucketed under a synthetic key.
- */
-export function readLastEngineUsage(stateDbPath, now, readOnly = false) {
-    const since = engineLastUsedSince(now);
-    const events = readEvents({ since, type: LLM_USAGE_EVENT }, { dbPath: stateDbPath, readOnly }).events;
-    const lastUsed = new Map();
-    for (const event of events) {
-        const record = decodeLlmUsageRecord(event.metadata);
-        if (!record?.engine)
-            continue;
-        const existing = lastUsed.get(record.engine);
-        if (!existing || event.ts > existing.lastUsedAt) {
-            lastUsed.set(record.engine, { lastUsedAt: event.ts, process: record.process });
-        }
-    }
-    return lastUsed;
-}

package/dist/commands/sources/dangerous-env-audit.js

@@ -1,134 +0,0 @@
-// This Source Code Form is subject to the terms of the Mozilla Public
-// License, v. 2.0. If a copy of the MPL was not distributed with this
-// file, You can obtain one at https://mozilla.org/MPL/2.0/.
-import fs from "node:fs";
-import path from "node:path";
-import * as p from "../../cli/clack.js";
-import { decideDangerousKeyInstall } from "../../core/activation-policy.js";
-import { ConfigError } from "../../core/errors.js";
-import { warn } from "../../core/warn.js";
-import { sanitizeString } from "../../sources/providers/provider-utils.js";
-import { scanEnvKeyNames } from "../env/env.js";
-import { isDangerousEnvKey } from "../lint/env-key-rules.js";
-let scannerOverride;
-/** TEST-ONLY. Inject a scanner fault at the audit boundary; undefined restores. */
-export function _setDangerousKeyScannerForTests(scanner) {
-    scannerOverride = scanner;
-}
-function collectEnvFilePathsRecursive(rootDir) {
-    const results = [];
-    const walk = (dir) => {
-        const entries = fs.readdirSync(dir, { withFileTypes: true });
-        for (const entry of entries) {
-            const full = path.join(dir, entry.name);
-            if (entry.isDirectory()) {
-                walk(full);
-                continue;
-            }
-            if (!entry.isFile())
-                continue;
-            if (entry.name !== ".env" && !entry.name.endsWith(".env"))
-                continue;
-            results.push(full);
-        }
-    };
-    walk(rootDir);
-    return results;
-}
-function collectDangerousKeyFindings(installedStashRoot, checkEnvForDangerousKeys) {
-    const allFindings = [];
-    if (!fs.statSync(installedStashRoot).isDirectory()) {
-        throw new Error(`Expected ${installedStashRoot} to be a directory.`);
-    }
-    const dir = path.join(installedStashRoot, "env");
-    try {
-        if (!fs.statSync(dir).isDirectory()) {
-            throw new Error(`Expected ${dir} to be a directory.`);
-        }
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return allFindings;
-        throw error;
-    }
-    for (const envPath of collectEnvFilePathsRecursive(dir)) {
-        const relToEnvDir = path.relative(dir, envPath);
-        const segments = relToEnvDir.split(path.sep);
-        const lastSegment = segments[segments.length - 1] ?? "";
-        const lastSegmentBase = lastSegment.endsWith(".env") ? lastSegment.slice(0, -".env".length) : lastSegment;
-        const refSegments = [...segments.slice(0, -1), lastSegmentBase === "" ? "default" : lastSegmentBase];
-        const envRef = `env/${refSegments.join("/")}`;
-        const relPath = path.join("env", relToEnvDir);
-        for (const finding of checkEnvForDangerousKeys(envPath, relPath, envRef)) {
-            const keyMatch = finding.detail.match(/Env key `([^`]+)`/);
-            allFindings.push({ envRef, keyName: keyMatch?.[1] ?? finding.file, relPath });
-        }
-    }
-    return allFindings;
-}
-function scanStashForDangerousKeys(installedStashRoot) {
-    const scanner = scannerOverride ??
-        ((envPath, relPath) => scanEnvKeyNames(fs.readFileSync(envPath, "utf8"))
-            .filter(isDangerousEnvKey)
-            .map((key) => ({ file: relPath, detail: `Env key \`${key}\`` })));
-    return collectDangerousKeyFindings(installedStashRoot, scanner);
-}
-export async function auditStashForDangerousKeys(opts) {
-    let allFindings;
-    try {
-        allFindings = scanStashForDangerousKeys(opts.stashRoot);
-    }
-    catch (error) {
-        const rollbackWarning = await opts.rollback?.();
-        throw new ConfigError(`Dangerous environment-key audit failed for "${opts.ref}"; refusing to ${opts.operation} unverified content. ${error instanceof Error ? error.message : String(error)}${rollbackWarning ? ` ${rollbackWarning}` : ""}`, "DANGEROUS_ENV_AUDIT_FAILED");
-    }
-    const stance = decideDangerousKeyInstall({
-        findingsPresent: allFindings.length > 0,
-        allowDangerousEnvKeys: opts.allowDangerousKeys,
-    });
-    if (stance === "allow")
-        return { blocked: false, findings: allFindings };
-    if (stance === "warn-allow") {
-        for (const finding of allFindings) {
-            warn(`[dangerous-env-key] ${finding.relPath}: key \`${finding.keyName}\` in ${finding.envRef} can hijack process execution via \`akm env run\`. Proceeding because --allow-dangerous-env-keys was set.`);
-        }
-        return { blocked: false, findings: allFindings };
-    }
-    const operationTitle = opts.operation === "install" ? "Install" : "Update";
-    const operationPast = opts.operation === "install" ? "installed" : "updated";
-    let error;
-    if (opts.isTTY) {
-        const groupedByEnv = new Map();
-        for (const finding of allFindings) {
-            const existing = groupedByEnv.get(finding.envRef) ?? [];
-            existing.push(finding.keyName);
-            groupedByEnv.set(finding.envRef, existing);
-        }
-        for (const [envRef, keys] of groupedByEnv) {
-            warn(`[warn] Env "${sanitizeString(envRef)}" in stash "${sanitizeString(opts.ref)}" contains potentially dangerous keys:`);
-            for (const key of keys)
-                warn(`  - ${sanitizeString(key)}: can hijack process execution via \`akm env run\``);
-        }
-        const confirmed = await p.confirm({ message: `${operationTitle} anyway?`, initialValue: false });
-        if (!p.isCancel(confirmed) && confirmed === true)
-            return { blocked: false, findings: allFindings };
-        error = `${operationTitle} aborted: stash contains dangerous env keys. Remove the keys or re-run with --allow-dangerous-env-keys to bypass.`;
-    }
-    else {
-        const keyList = allFindings.map((finding) => `  - ${finding.keyName} (${finding.envRef})`).join("\n");
-        error = `${operationTitle} blocked: stash "${opts.ref}" contains dangerous env keys that can hijack process execution via \`akm env run\`:\n${keyList}\nRe-run with --allow-dangerous-env-keys to bypass this check after reviewing the env file.`;
-    }
-    const rollbackWarning = await opts.rollback?.();
-    if (opts.renderBlockedError !== false) {
-        console.error(JSON.stringify({
-            ok: false,
-            error,
-            code: "DANGEROUS_ENV_KEY",
-            ...(rollbackWarning ? { rollbackWarning } : {}),
-        }, null, 2));
-    }
-    if (rollbackWarning) {
-        warn(`The blocked ${opts.operation} could not be fully rolled back after content was ${operationPast}: ${rollbackWarning}`);
-    }
-    return { blocked: true, exitCode: 1, code: "DANGEROUS_ENV_KEY", error, findings: allFindings };
-}

package/dist/core/activation-policy.js

@@ -1,67 +0,0 @@
-// This Source Code Form is subject to the terms of the Mozilla Public
-// License, v. 2.0. If a copy of the MPL was not distributed with this
-// file, You can obtain one at https://mozilla.org/MPL/2.0/.
-/**
- * `EDITOR`/`VISUAL`/`PAGER` are flagged by `isDangerousEnvKey` for a
- * documented RCE vector (many tools invoke them to launch an editor/pager),
- * but env-key-rules.ts's own module doc calls out their "high FP rate" in
- * the same breath — an installed bundle's env file can supply a value, but
- * nothing in akm's own env-injection path ever *invokes* EDITOR/VISUAL/PAGER
- * with that value, so the RCE vector these three describe cannot fire from
- * an injected env the way LD_PRELOAD or GIT_SSH_COMMAND can. Blocking a
- * third-party install over them protects nothing while making "the operator
- * legitimately wants to set their editor" the common case that eats the
- * refusal. Kept as a name-level literal set (not an import of
- * `commands/lint/env-key-rules.ts`) so this module stays the pure leaf its
- * own doc comment promises — no new import edges into the rest of the tree.
- */
-const INTERACTIVE_TOOL_ENV_KEYS = new Set(["EDITOR", "VISUAL", "PAGER"]);
-/**
- * Decide whether injecting an env with the given dangerous keys is allowed,
- * warned, or blocked. Third-party (registry-installed) stashes hard-block a
- * genuine RCE-class key; first-party stashes warn. The interactive-tool
- * group (see {@link INTERACTIVE_TOOL_ENV_KEYS}) only ever warns, since akm's
- * own env-injection path never invokes those keys as a command. An explicit
- * `--allow-dangerous-env-keys` (threaded through by the caller, same override
- * `decideDangerousKeyInstall`'s `"warn-allow"` already honors for rule 2)
- * downgrades a remaining block to a warning too — the operator is not racing
- * themselves. See rule 1 above.
- *
- * @param dangerousKeys The subset of injected keys flagged as process-hijacking
- *   (already filtered by the caller via `isDangerousEnvKey`).
- * @param thirdParty `true` when the env's source is a third-party stash — i.e.
- *   its origin carries a `registryId`.
- * @param allowDangerousEnvKeys `true` when the operator passed `--allow-dangerous-env-keys` (or
- *   its equivalent) for this injection. Defaults to `false`.
- */
-export function decideDangerousEnvInjection(input) {
-    if (input.dangerousKeys.length === 0)
-        return "allow";
-    if (!input.thirdParty)
-        return "warn";
-    if (input.allowDangerousEnvKeys)
-        return "warn";
-    const onlyInteractiveTool = input.dangerousKeys.every((key) => INTERACTIVE_TOOL_ENV_KEYS.has(key));
-    return onlyInteractiveTool ? "warn" : "block";
-}
-/**
- * Decide the baseline install stance for a freshly-installed stash's
- * dangerous-key scan. The interactive confirm / rollback UX is applied by the
- * caller on top of the `"gate"` stance — this predicate only fixes the policy.
- * See rule 2 above.
- */
-export function decideDangerousKeyInstall(input) {
-    if (!input.findingsPresent)
-        return "allow";
-    return input.allowDangerousEnvKeys ? "warn-allow" : "gate";
-}
-// ── Rule 3: write activation (search-source.ts, installations.ts) ────────────
-/**
- * Whether a resolved source is write-activated. Only the primary stash and
- * sources explicitly marked `writable: true` are writable; registry-cached
- * (installed, read-only) sources are never written in place because
- * `akm update` overwrites them. See rule 3 above.
- */
-export function isSourceWriteActivated(source) {
-    return source.writable === true;
-}