akm-cli 0.10.261013-beta → 0.10.261014-beta

package/dist/commands/command/command-execution.js

@@ -1,13 +1,14 @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
+import { SHIPPED_ALIAS } from "../../core/config/model-aliases.js";
 import { UsageError } from "../../core/errors.js";
+import { mergeNotices } from "../../execution/notices.js";
 import { createInlineResolvedCommand, createResolvedCommand, createResolvedPersona, } from "../../execution/resolved-request.js";
 import { isPortableExecutionAgentSelector, } from "../../execution/source.js";
 import { recordIndexedShowUsage } from "../../indexer/usage/show-usage.js";
 import { resolveUsageEventSource } from "../../indexer/usage/usage-events.js";
-import { fallbackAnnouncement } from "../../integrations/agent/engine-fallback.js";
-import { buildExecution, resolveExecution, } from "../../integrations/agent/execution.js";
+import { buildExecution, currentLayer, resolveExecution, shippedAlias, } from "../../integrations/agent/execution.js";
 import { runExecution } from "../../integrations/agent/runner-dispatch.js";
 import { parseBuiltinCommandAction } from "./builtin-action.js";
 import { loadAdapterExecutionSource, } from "./execution-source-loader.js";
@@ -106,18 +107,22 @@ export async function prepareCommandInvocation(options) {
         renderedPersona = rendered;
     }
     const persona = renderedPersona ? createResolvedPersona(renderedPersona) : selectedAgent.present ? null : undefined;
+    const layers = [
+        shippedAlias(SHIPPED_ALIAS.agent),
+        ...(renderedPersona
+            ? [{ id: renderedPersona.identity.ref, kind: "agent", values: renderedPersona.defaults }]
+            : []),
+        { id: renderedCommand?.identity.ref ?? "inline-command", kind: "command", values: commandDefaults },
+        ...(options.invocationDefaults
+            ? [{ id: "invocation-defaults", kind: "invocation-defaults", values: options.invocationDefaults }]
+            : []),
+        ...(options.current ? [currentLayer(options.current)] : []),
+    ];
     return resolveExecution({
         command,
         config: options.config,
         ...(persona !== undefined ? { persona } : {}),
-        ...(renderedPersona ? { agentLayer: { id: renderedPersona.identity.ref, values: renderedPersona.defaults } } : {}),
-        commandLayer: {
-            id: renderedCommand?.identity.ref ?? "inline-command",
-            values: commandDefaults,
-        },
-        ...(options.invocationDefaults ? { invocationDefaults: options.invocationDefaults } : {}),
-        ...(options.current ? { current: options.current } : {}),
-        ...(options.modelMap ? { modelMap: options.modelMap } : {}),
+        layers,
     });
 }
 function compareText(left, right) {
@@ -126,38 +131,27 @@ function compareText(left, right) {
 const DIAGNOSTIC_PROVENANCE_FIELDS = new Set([
     "/inference",
     "agent",
-    "authorization",
     "command",
-    "engine",
-    "engine.requested",
     "model",
     "outputSchema",
     "persona",
     "runtime.environment",
-    "runtime.settings",
     "runtime.timeoutMs",
     "runtime.workspace",
-    "tools",
+    "target",
 ]);
 const DIAGNOSTIC_NOTICE_FIELDS = new Set([
     "agent",
     "command.content",
-    "command.extensions",
     "conversation",
-    "engine",
-    "engine.extensions",
-    "extensions",
     "inference",
     "model",
     "outputSchema",
     "persona",
-    "persona.extensions",
     "runtime.environment",
-    "runtime.extensions",
-    "runtime.settings",
     "runtime.timeoutMs",
     "runtime.workspace",
-    "tools",
+    "target",
 ]);
 function canonicalDiagnosticProvenanceField(field) {
     if (field.startsWith("/inference/"))
@@ -219,20 +213,15 @@ function safeDiagnosticNotice(notice) {
                 severity: "info",
                 adapter: notice.adapter,
                 field: "persona",
-                message: "The selected engine has no native persona channel; AKM composed the persona into the prompt.",
+                message: "The selected harness has no native persona channel; AKM composed the persona into the prompt.",
             });
         default:
             return undefined;
     }
 }
 function diagnosticNotices(notices) {
-    const canonical = new Map();
-    for (const notice of notices) {
-        const safe = safeDiagnosticNotice(notice);
-        if (safe)
-            canonical.set(JSON.stringify(safe), safe);
-    }
-    return Object.freeze([...canonical.values()].sort((left, right) => compareText(JSON.stringify(left), JSON.stringify(right))));
+    const safe = notices.flatMap((notice) => safeDiagnosticNotice(notice) ?? []);
+    return Object.freeze([...(mergeNotices(safe) ?? [])].sort((left, right) => compareText(JSON.stringify(left), JSON.stringify(right))));
 }
 /**
  * Build a prepared invocation and project only safe structural diagnostics.
@@ -245,7 +234,7 @@ export function inspectPreparedCommandInvocation(prepared) {
         shape: "command-dry-run",
         ok: true,
         dryRun: true,
-        engine: prepared.request.engine.name,
+        engine: prepared.request.target.name,
         provenance: diagnosticProvenance(prepared.provenance),
         notices: diagnosticNotices(built.notices),
     };
@@ -270,22 +259,19 @@ function resultEnvelope(result, engine, warnings, notices) {
 export async function dispatchPreparedCommandInvocation(prepared, options = {}) {
     const { request } = prepared;
     const built = buildExecution(request, prepared.runner);
-    const selectedEngine = request.engine.name;
+    const selectedEngine = request.target.name;
     const result = await runExecution(built, runOptionsFor(options));
     const consumedRefs = new Set();
     if (request.command.source)
         consumedRefs.add(request.command.source.ref);
     if (request.persona)
         consumedRefs.add(request.persona.source.ref);
-    // F-1 (spec §5.2 point 3): options.eventSource is only a FALLBACK — an
-    // ambient AKM_EVENT_SOURCE still wins (D5 clause d). Absent, this is
-    // byte-identical to the pre-P1b bare resolveUsageEventSource() call (P-07's
-    // own default is "user").
+    // options.eventSource is only a FALLBACK — an ambient AKM_EVENT_SOURCE still
+    // wins. Absent, the default is "user".
     const eventSource = resolveUsageEventSource(process.env, options.eventSource ?? "user");
     for (const ref of consumedRefs)
         recordIndexedShowUsage(ref, eventSource);
-    const announcement = fallbackAnnouncement(prepared.fallbackEngineName, selectedEngine);
-    return resultEnvelope(result, selectedEngine, announcement ? [announcement] : [], built.notices);
+    return resultEnvelope(result, selectedEngine, [], built.notices);
 }
 export async function executeCommandInvocation(options, dispatchOptions = {}) {
     return dispatchPreparedCommandInvocation(await prepareCommandInvocation(options), dispatchOptions);

package/dist/commands/completions.js

@@ -58,7 +58,7 @@ function walkCommandTree(cmd, parentPath = "") {
     const valueFlags = [];
     if (cmd.args) {
         for (const [flagName, arg] of Object.entries(cmd.args)) {
-            if (arg.type === "positional")
+            if (arg.type === "positional" || arg.hidden === true)
                 continue;
             flags.push(`--${flagName}`);
             if (arg.type === "boolean" && arg.default === true)

package/dist/commands/config-cli.js

@@ -9,14 +9,15 @@
  * zero lines here — the walker handles get/set/unset/coercion uniformly.
  *
  * `configVersion` is controlled by the config lifecycle. All execution
- * settings use their canonical engine/strategy paths; retired aliases are not
+ * settings use their canonical connection, harness and strategy paths; retired aliases are not
  * rewritten at this boundary.
  */
 import { isDeepStrictEqual } from "node:util";
 import { defineGroupCommand, defineJsonCommand, output } from "../cli/shared.js";
 import { isRecord } from "../core/common.js";
-import { DEFAULT_CONFIG, getConfigValueSource, loadConfig, mutateConfig, parseAndValidateConfigText, resolveConfigRefSource, } from "../core/config/config.js";
+import { DEFAULT_CONFIG, getConfigValueSource, loadConfig, mutateConfig, parseAndValidateConfigText, resolveConfigRefSource, unusableEntryAt, } from "../core/config/config.js";
 import { configGet, configSet, configUnset, unknownKeyHint } from "../core/config/config-walker.js";
+import { isEnvReference } from "../core/config/schema/primitives.js";
 import { UsageError } from "../core/errors.js";
 import { getConfigPath } from "../core/paths.js";
 import { formatRegistryUrl } from "../core/registry-url.js";
@@ -31,11 +32,13 @@ export function unsetConfigValue(config, key) {
     return configUnset(config, key);
 }
 export function listConfig(config) {
-    // 0.9.0 (spec §10.1): sources live in `bundles` (spread from config); the
+    // Sources live in `bundles` (spread from config); the
     // retired top-level `sources[]` array is no longer surfaced.
     return redactConfigValue({ ...DEFAULT_CONFIG, ...config });
 }
 function redactConfigValue(value, path = []) {
+    if (path.at(-1) === "apiKey" && typeof value === "string" && !isEnvReference(value))
+        return undefined;
     if (typeof value === "string" && isRegistryUrlPath(path))
         return formatRegistryUrl(value);
     if (Array.isArray(value))
@@ -44,8 +47,7 @@ function redactConfigValue(value, path = []) {
         return value;
     const result = {};
     for (const [key, child] of Object.entries(value)) {
-        if (key !== "apiKey" ||
-            (typeof child === "string" && /^\$(?:[A-Za-z_][A-Za-z0-9_]*|\{[A-Za-z_][A-Za-z0-9_]*\})$/.test(child))) {
+        if (key !== "apiKey" || (typeof child === "string" && isEnvReference(child))) {
             result[key] = redactConfigValue(child, [...path, key]);
         }
     }
@@ -195,6 +197,13 @@ export const configCommand = defineGroupCommand({
                 if (source.startsWith("extends:")) {
                     throw new UsageError(`Config key "${args.key}" is inherited from ${source} and cannot be unset here.`, "TARGET_NOT_UPDATABLE", `Override it locally with "akm config set ${args.key} <value>", or edit the base file directly.`);
                 }
+                // An entry the reader drops is not in the config `unsetConfigValue` sees, so it would no-op and say ok.
+                const ignored = unusableEntryAt(args.key);
+                if (ignored) {
+                    throw new UsageError(`Config key "${args.key}" is inside ${ignored.kind} "${ignored.name}", which akm ignores (${ignored.why}), so \`akm config\` cannot edit it.`, "TARGET_NOT_UPDATABLE", ignored.inFile
+                        ? `Remove or fix the ${ignored.group}.${ignored.name} entry in ${getConfigPath()} by hand.`
+                        : `${getConfigPath()} is still in the retired engines form: run \`akm migrate apply\` first, then fix or remove the entry.`);
+                }
                 const result = mutateConfig((current) => unsetConfigValue(current, args.key), { absentNoop: true });
                 const updated = result.config;
                 if (!args.silent) {

package/dist/commands/env/child-env.js

@@ -1,7 +1,10 @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
-import { WIN32_SPAWN_ENV_FLOOR } from "../../core/spawn-env.js";
+/**
+ * What `env run --clean` / `secret run --clean` keeps of the parent environment. The user typed
+ * the flag to get a minimal one; without the last eight names Windows cannot create the process.
+ */
 const CLEAN_ENV_ALLOWLIST = [
     "HOME",
     "PATH",
@@ -31,6 +34,14 @@ const CLEAN_ENV_ALLOWLIST = [
     "TZ",
     "NO_COLOR",
     "COLORTERM",
+    "SystemRoot",
+    "SystemDrive",
+    "WINDIR",
+    "COMSPEC",
+    "PATHEXT",
+    "USERPROFILE",
+    "HOMEDRIVE",
+    "HOMEPATH",
 ];
 export function buildChildEnv(parentEnv, options) {
     const base = options.clean ? {} : { ...parentEnv };
@@ -39,19 +50,6 @@ export function buildChildEnv(parentEnv, options) {
             if (parentEnv[key] !== undefined)
                 base[key] = parentEnv[key];
         }
-        // The allowlist above is POSIX-shaped. On Windows a child started without
-        // SystemRoot/COMSPEC/PATHEXT and friends frequently cannot start at all —
-        // which is why every other spawn path in the codebase applies this floor
-        // (see spawnEnvNamesFor). `env run --clean` / `secret run --clean` did not,
-        // so clean-mode injection was unusable there. The floor is names the OS
-        // requires of any child, not user configuration, so it does not weaken what
-        // "clean" means about inherited secrets.
-        if (process.platform === "win32") {
-            for (const key of WIN32_SPAWN_ENV_FLOOR) {
-                if (parentEnv[key] !== undefined)
-                    base[key] = parentEnv[key];
-            }
-        }
     }
     for (const key of options.inherit) {
         if (parentEnv[key] !== undefined)

package/dist/commands/env/env-cli.js

@@ -237,8 +237,8 @@ async function runEnvInjected(target, opts) {
         throw err;
     }
     // R-067: was `process.exit(result.status ?? 0)`, which terminates the
-    // process synchronously and skips the `finally { await
-    // disposeDispatchResources(); }` block in src/cli.ts's `runCommand` — even
+    // process synchronously and skips the `finally { disposeLlmUsageSink(); }`
+    // block in src/cli.ts's `runCommand` — even
     // on the success path, since this call was unconditional. Setting
     // `process.exitCode` and returning lets cleanup run while still exiting
     // with the child's exact status once the event loop drains, matching the

package/dist/commands/env/secret-cli.js

@@ -207,8 +207,8 @@ const secretRunCommand = defineJsonCommand({
             throw err;
         }
         // R-067: was `process.exit(result.status ?? 0)`, unconditional even on
-        // the success path — it skipped the `finally { await
-        // disposeDispatchResources(); }` cleanup in src/cli.ts's `runCommand`.
+        // the success path — it skipped the `finally { disposeLlmUsageSink(); }`
+        // cleanup in src/cli.ts's `runCommand`.
         // Setting `process.exitCode` and returning still exits with the child's
         // exact status once the event loop drains, but lets cleanup run first —
         // same pattern `emitJsonError` (src/cli/shared.ts) already established.