akm-cli 0.10.26101201-alpha → 0.10.26101202-alpha

package/CHANGELOG.md

@@ -6,6 +6,22 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.10.26101202] - 2026-10-12
+
+### Fixed
+
+- **A signal to `akm agent` no longer leaves the CLI harness running (#1049).** `akm agent` on the `opencode`,
+  `claude` and `codex` CLI engines runs the harness in its own process group, so SIGTERM or SIGINT to akm ended akm and
+  left `opencode run` (and, on OpenCode 2, its `serve --stdio` child) running. The managed-subprocess primitive now runs
+  the timeout kill ladder on every live group child when akm gets such a signal with no handler of its own, then
+  re-raises it so akm still ends by the signal.
+- **An OpenCode 2 SDK dispatch ends when akm rejects a permission request (#1049).** OpenCode 2 interrupts the step
+  (`aborted`, "Step interrupted") and goes idle without writing the closing `idle` message, so the dispatch waited out
+  its whole deadline. It now returns at once with `reason: "aborted"` and the declined tool call in `error`.
+- **Documented: OpenCode permission defaults in a dispatch (#1049).** OpenCode 1 asks before reading or writing outside
+  the project directory; OpenCode 2 does not unless its config says `ask`, so akm's permission rejection only happens
+  on OpenCode 2 once you add that rule. akm changes no default. See [Configuration](docs/reference/configuration.md#engines).
+
 ## [0.10.26101201] - 2026-10-12
 
 ### Removed

package/dist/core/subprocess.js

@@ -116,6 +116,51 @@ export function scheduleKillLadder(proc, opts) {
     if (typeof sigkillTimer !== "number")
         sigkillTimer.unref?.();
 }
+const liveGroupChildren = new Set();
+let signalGuardHandlers;
+function removeSignalGuard() {
+    for (const [signal, handler] of signalGuardHandlers ?? [])
+        process.off(signal, handler);
+    signalGuardHandlers = undefined;
+}
+/**
+ * A captured child runs in its own process group, so the terminal's Ctrl-C and
+ * a `kill <akm-pid>` no longer reach it: without this, SIGTERM/SIGINT to akm
+ * ended akm and left the harness CLI (and everything it started) running. Each
+ * live child is registered here and, on the first such signal, takes the same
+ * ladder as a timeout; once every child is gone the signal is re-raised so akm
+ * still ends by the signal itself.
+ *
+ * The listeners are installed only while a child is live and only when nothing
+ * else handles the signal. A command that handles it itself (`workflow run`,
+ * `improve`, task runs) unwinds through its own cleanup, which already aborts
+ * its children, and must not have its handling pre-empted by a re-raise.
+ */
+function registerLiveGroupChild(child) {
+    liveGroupChildren.add(child);
+    if (!signalGuardHandlers && process.listenerCount("SIGINT") === 0 && process.listenerCount("SIGTERM") === 0) {
+        const handlers = [];
+        for (const signal of ["SIGINT", "SIGTERM"]) {
+            const handler = () => {
+                const children = [...liveGroupChildren];
+                for (const live of children)
+                    live.terminate();
+                removeSignalGuard();
+                void Promise.allSettled(children.map((live) => live.proc.exited)).then(() => {
+                    process.kill(process.pid, signal);
+                });
+            };
+            process.once(signal, handler);
+            handlers.push([signal, handler]);
+        }
+        signalGuardHandlers = handlers;
+    }
+    return () => {
+        liveGroupChildren.delete(child);
+        if (liveGroupChildren.size === 0)
+            removeSignalGuard();
+    };
+}
 /**
  * The joined, human-readable reason ONE managed run's capture is incomplete, or
  * `undefined` when both pipes drained cleanly.
@@ -401,6 +446,8 @@ export async function runManagedSubprocess(cmd, opts) {
         else
             abortSignal.addEventListener("abort", onAbort, { once: true });
     }
+    // A termination signal to this process takes the own-group child down too.
+    const unregisterLiveChild = capture && spawnsOwnProcessGroup() ? registerLiveGroupChild({ proc, terminate: onAbort }) : () => { };
     // Stream-drain timeout: a short grace once nothing living owns the pipe any
     // more, or a one-hour safety bound when execution itself is unbounded.
     //
@@ -454,6 +501,7 @@ export async function runManagedSubprocess(cmd, opts) {
         if (timer !== undefined)
             clearTimeoutImpl(timer);
         abortSignal?.removeEventListener("abort", onAbort);
+        unregisterLiveChild();
         // Drain readers so they don't surface as unhandled rejections. The streams
         // carry their own drain timeout so this cannot block indefinitely.
         await Promise.allSettled([stdoutPromise, stderrPromise]);
@@ -470,6 +518,7 @@ export async function runManagedSubprocess(cmd, opts) {
     }
     clearTimeoutImpl(timer);
     abortSignal?.removeEventListener("abort", onAbort);
+    unregisterLiveChild();
     const [stdoutRead, stderrRead] = await Promise.all([stdoutPromise, stderrPromise]);
     return {
         exitCode,

package/dist/integrations/harnesses/opencode-sdk/v2-adapter.js

@@ -57,6 +57,27 @@ export function v2Turn(messages, userId) {
     }
     return undefined;
 }
+/**
+ * The turn that began with the user message `userId`, when OpenCode 2 ended it
+ * by interrupting a step instead of writing the closing `idle` message. Only
+ * meaningful once `session.wait` has returned (the session is not running).
+ *
+ * Recorded from 2.0.26: when akm rejects a permission request the step fails
+ * with `{ type: "aborted", message: "Step interrupted" }` (`finish: "error"`),
+ * the tool call is `error` ("The user declined this tool call"),
+ * `session.execution.interrupted` fires and the session goes idle, but no
+ * `idle` message is written and `session.idle` is not emitted.
+ */
+export function v2InterruptedTurn(messages, userId) {
+    const start = messages.findIndex((m) => m.id === userId);
+    if (start < 0)
+        return undefined;
+    const assistants = messages.slice(start + 1).filter((m) => m.type === "assistant");
+    const last = assistants.at(-1);
+    return last?.finish === "error" && last.error?.type === "aborted"
+        ? { outcome: "interrupted", assistants }
+        : undefined;
+}
 /** Decode a finished turn into the answer, the usage of every step and the failure, if any. */
 function v2PromptResult(turn) {
     const text = turn.assistants
@@ -82,7 +103,11 @@ function v2PromptResult(turn) {
 }
 function v2Failure(turn) {
     if (turn.outcome === "interrupted") {
-        return { reason: "aborted", message: "OpenCode session was interrupted" };
+        // Say why when the last step says so, e.g. "Step interrupted: The user declined this tool call".
+        const last = turn.assistants.at(-1);
+        const declined = last?.content.flatMap((c) => c.type === "tool" && c.state.status === "error" ? [c.state.error.message] : []);
+        const detail = [last?.error?.message, ...(declined ?? [])].filter(Boolean).join(": ");
+        return { reason: "aborted", message: `OpenCode session was interrupted${detail ? ` (${detail})` : ""}` };
     }
     const last = turn.assistants.at(-1);
     if (turn.outcome === "failed") {
@@ -154,7 +179,8 @@ export const V2_ADAPTER = {
         const user = await c.session.prompt({ sessionID: sessionId, text }, { signal });
         for (;;) {
             await c.session.wait({ sessionID: sessionId }, { signal });
-            const turn = v2Turn(await c.session.context({ sessionID: sessionId }, { signal }), user.id);
+            const messages = await c.session.context({ sessionID: sessionId }, { signal });
+            const turn = v2Turn(messages, user.id) ?? v2InterruptedTurn(messages, user.id);
             if (turn)
                 return v2PromptResult(turn);
             // `wait` can return before the queued prompt starts; look again.

package/docs/reference/configuration.md

@@ -168,6 +168,23 @@ working and logs a warning recommending OpenCode 2. A `--version` akm cannot rea
 with the raw output. To run a particular OpenCode, set the engine's `bin`, e.g.
 `{"kind":"agent","platform":"opencode-sdk","bin":"/opt/opencode1/bin/opencode"}`.
 
+**Permissions in a dispatch.** akm answers every OpenCode permission request of a
+dispatch with "reject" (there is no one to approve it), and the rejection reaches
+the model as a tool error. akm changes no OpenCode permission default, so what
+gets asked is OpenCode's own setting:
+
+- **OpenCode 1** asks before reading or writing outside the project directory
+  (`external_directory`), so akm rejects it.
+- **OpenCode 2** (2.0.26) does not ask: a read or write outside the project
+  directory just runs, and akm's rejection never happens, unless your OpenCode
+  config says to ask. Add a rule to the global `opencode.json`, e.g.
+  `"permissions": [{"action": "external_directory", "resource": "*", "effect": "ask"}]`
+  (`"read"` and `"shell"` are actions too).
+
+On OpenCode 2 a rejection ends the turn: the dispatch returns `ok: false` with
+`reason: "aborted"` and the declined tool call in `error`. On OpenCode 1 the model
+carries on.
+
 On an engine without `timeoutMs`, model work (an improve process, a quality or
 triage judge, or an index pass) stops after 600 seconds, whatever the engine's
 kind; other work on an agent engine runs until it finishes. An improve stage's

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "akm-cli",
-  "version": "0.10.26101201-alpha",
+  "version": "0.10.26101202-alpha",
   "type": "module",
   "description": "akm (Agent Knowledge Manager) — a portable, local-first capability library for AI agents. Discover, load, share, and improve reusable skills, scripts, workflows, and knowledge across any shell-capable coding agent, including Claude Code, OpenCode, and Cursor.",
   "keywords": [