akm-cli 0.5.0 → 0.6.0-rc2

package/dist/{completions.js → commands/completions.js}

@@ -1,7 +1,7 @@
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { getAssetTypes } from "./asset-spec";
+import { getAssetTypes } from "../core/asset-spec";
 // ── Known flag values ────────────────────────────────────────────────────────
 const FLAG_VALUES = {
     "--format": ["json", "text", "yaml", "jsonl"],

package/dist/{config-cli.js → commands/config-cli.js}

@@ -1,9 +1,18 @@
-import { DEFAULT_CONFIG, } from "./config";
-import { UsageError } from "./errors";
+import { DEFAULT_CONFIG, } from "../core/config";
+import { UsageError } from "../core/errors";
+// ── Merge helpers for LLM/embedding subkey set ───────────────────────────────
+function mergeLlmLike(base, patch) {
+    return { endpoint: "", model: "", ...(base ?? {}), ...patch };
+}
+function mergeLlmLikeEmbedding(base, patch) {
+    return { endpoint: "", model: "", ...(base ?? {}), ...patch };
+}
 export function parseConfigValue(key, value) {
     switch (key) {
         case "stashDir":
             return { stashDir: requireNonEmptyString(value, key) };
+        case "defaultWriteTarget":
+            return { defaultWriteTarget: requireNonEmptyString(value, key) };
         case "semanticSearchMode":
             // Accept legacy boolean-style strings from CLI
             if (value === "true")
@@ -16,12 +25,26 @@ export function parseConfigValue(key, value) {
             return { semanticSearchMode: value };
         case "embedding":
             return { embedding: parseEmbeddingConnectionValue(value) };
+        case "embedding.endpoint":
+            return { embedding: mergeLlmLikeEmbedding(undefined, { endpoint: requireNonEmptyString(value, key) }) };
+        case "embedding.model":
+            return { embedding: mergeLlmLikeEmbedding(undefined, { model: requireNonEmptyString(value, key) }) };
+        case "embedding.apiKey":
+            return { embedding: mergeLlmLikeEmbedding(undefined, { apiKey: requireNonEmptyString(value, key) }) };
         case "llm":
             return { llm: parseLlmConnectionValue(value) };
+        case "llm.endpoint":
+            return { llm: mergeLlmLike(undefined, { endpoint: requireNonEmptyString(value, key) }) };
+        case "llm.model":
+            return { llm: mergeLlmLike(undefined, { model: requireNonEmptyString(value, key) }) };
+        case "llm.apiKey":
+            return { llm: mergeLlmLike(undefined, { apiKey: requireNonEmptyString(value, key) }) };
         case "registries":
             return { registries: parseRegistriesValue(value) };
+        case "sources":
         case "stashes":
-            return { stashes: parseStashesValue(value) };
+            // "stashes" is kept as an alias for backwards-compat; both write to `sources`.
+            return { sources: parseStashesValue(value) };
         case "output.format":
             return { output: { format: parseOutputFormat(value) } };
         case "output.detail":
@@ -46,16 +69,32 @@ export function getConfigValue(config, key) {
     switch (key) {
         case "stashDir":
             return config.stashDir ?? null;
+        case "defaultWriteTarget":
+            return config.defaultWriteTarget ?? null;
         case "semanticSearchMode":
             return config.semanticSearchMode;
         case "embedding":
             return config.embedding ?? null;
+        case "embedding.endpoint":
+            return config.embedding?.endpoint ?? null;
+        case "embedding.model":
+            return config.embedding?.model ?? null;
+        case "embedding.apiKey":
+            return config.embedding?.apiKey ?? null;
         case "llm":
             return config.llm ?? null;
+        case "llm.endpoint":
+            return config.llm?.endpoint ?? null;
+        case "llm.model":
+            return config.llm?.model ?? null;
+        case "llm.apiKey":
+            return config.llm?.apiKey ?? null;
         case "registries":
             return config.registries ?? DEFAULT_CONFIG.registries ?? [];
+        case "sources":
         case "stashes":
-            return config.stashes ?? [];
+            // "stashes" is an alias for "sources" for backwards-compat.
+            return config.sources ?? config.stashes ?? [];
         case "output.format":
             return config.output?.format ?? null;
         case "output.detail":
@@ -85,6 +124,7 @@ export function setConfigValue(config, key, rawValue) {
         case "embedding":
         case "llm":
         case "registries":
+        case "sources":
         case "stashes":
         case "output.format":
         case "output.detail":
@@ -95,6 +135,38 @@ export function setConfigValue(config, key, rawValue) {
         case "security.installAudit.registryWhitelist":
         case "security.installAudit.allowedFindings":
             return mergeConfigValue(config, parseConfigValue(key, rawValue));
+        // Subkey setters use deep-merge so sibling fields are preserved
+        case "embedding.endpoint":
+            return {
+                ...config,
+                embedding: mergeLlmLikeEmbedding(config.embedding, { endpoint: requireNonEmptyString(rawValue, key) }),
+            };
+        case "embedding.model":
+            return {
+                ...config,
+                embedding: mergeLlmLikeEmbedding(config.embedding, { model: requireNonEmptyString(rawValue, key) }),
+            };
+        case "embedding.apiKey":
+            return {
+                ...config,
+                embedding: mergeLlmLikeEmbedding(config.embedding, { apiKey: requireNonEmptyString(rawValue, key) }),
+            };
+        case "llm.endpoint":
+            return { ...config, llm: mergeLlmLike(config.llm, { endpoint: requireNonEmptyString(rawValue, key) }) };
+        case "llm.model":
+            return { ...config, llm: mergeLlmLike(config.llm, { model: requireNonEmptyString(rawValue, key) }) };
+        case "llm.apiKey":
+            return { ...config, llm: mergeLlmLike(config.llm, { apiKey: requireNonEmptyString(rawValue, key) }) };
+        case "defaultWriteTarget": {
+            const name = requireNonEmptyString(rawValue, key);
+            const knownNames = (config.sources ?? config.stashes ?? [])
+                .map((s) => s.name)
+                .filter((n) => typeof n === "string");
+            if (knownNames.length > 0 && !knownNames.includes(name)) {
+                throw new UsageError(`Unknown source name "${name}" for defaultWriteTarget; configured source names: ${knownNames.map((n) => `"${n}"`).join(", ")}`);
+            }
+            return { ...config, defaultWriteTarget: name };
+        }
         default:
             throw new UsageError(`Unknown config key: ${key}`);
     }
@@ -103,14 +175,38 @@ export function unsetConfigValue(config, key) {
     switch (key) {
         case "stashDir":
             return { ...config, stashDir: undefined };
+        case "defaultWriteTarget":
+            return { ...config, defaultWriteTarget: undefined };
         case "embedding":
             return { ...config, embedding: undefined };
+        case "embedding.endpoint":
+            return { ...config, embedding: mergeLlmLikeEmbedding(config.embedding, { endpoint: "" }) };
+        case "embedding.model":
+            return { ...config, embedding: mergeLlmLikeEmbedding(config.embedding, { model: "" }) };
+        case "embedding.apiKey": {
+            if (!config.embedding)
+                return config;
+            const { apiKey: _a, ...rest } = config.embedding;
+            return { ...config, embedding: rest };
+        }
         case "llm":
             return { ...config, llm: undefined };
+        case "llm.endpoint":
+            return { ...config, llm: mergeLlmLike(config.llm, { endpoint: "" }) };
+        case "llm.model":
+            return { ...config, llm: mergeLlmLike(config.llm, { model: "" }) };
+        case "llm.apiKey": {
+            if (!config.llm)
+                return config;
+            const { apiKey: _b, ...restLlm } = config.llm;
+            return { ...config, llm: restLlm };
+        }
         case "registries":
             return { ...config, registries: undefined };
+        case "sources":
         case "stashes":
-            return { ...config, stashes: undefined };
+            // "stashes" is kept as an alias for backwards-compat; both clear `sources`.
+            return { ...config, sources: undefined, stashes: undefined };
         case "output.format":
             return { ...config, output: mergeOutputConfig(config.output, { format: undefined }) };
         case "output.detail":
@@ -155,8 +251,10 @@ export function listConfig(config) {
         output: mergeOutputConfig(DEFAULT_CONFIG.output, config.output) ?? null,
         stashDir: config.stashDir ?? null,
         installed: config.installed ?? [],
-        stashes: config.stashes ?? [],
+        sources: config.sources ?? config.stashes ?? [],
     };
+    if (config.defaultWriteTarget)
+        result.defaultWriteTarget = config.defaultWriteTarget;
     if (config.embedding)
         result.embedding = config.embedding;
     if (config.llm)
@@ -349,7 +447,7 @@ function parseJsonObject(value, key, example) {
     }
     catch {
         throw new UsageError(`Invalid value for ${key}: expected JSON object with endpoint and model` +
-            ` (e.g. '{"endpoint":"${example.endpoint}","model":"${example.model}"}')`);
+            ` (e.g. '{"endpoint":"${example.endpoint}","model":"${example.model}"}')`, "INVALID_JSON_CONFIG_VALUE");
     }
     if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
         throw new UsageError(`Invalid value for ${key}: expected a JSON object`);
@@ -388,18 +486,18 @@ function parseStashesValue(value) {
         parsed = JSON.parse(value);
     }
     catch {
-        throw new UsageError(`Invalid value for stashes: expected JSON array of {type, path?, url?, name?, enabled?, options?} objects`);
+        throw new UsageError(`Invalid value for sources: expected JSON array of {type, path?, url?, name?, enabled?, options?} objects`);
     }
     if (!Array.isArray(parsed)) {
-        throw new UsageError(`Invalid value for stashes: expected a JSON array`);
+        throw new UsageError(`Invalid value for sources: expected a JSON array`);
     }
     return parsed.map((entry, i) => {
         if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {
-            throw new UsageError(`Invalid value for stashes[${i}]: expected an object with a "type" field`);
+            throw new UsageError(`Invalid value for sources[${i}]: expected an object with a "type" field`);
         }
         const obj = entry;
         if (typeof obj.type !== "string" || !obj.type) {
-            throw new UsageError(`Invalid value for stashes[${i}]: "type" is required`);
+            throw new UsageError(`Invalid value for sources[${i}]: "type" is required`);
         }
         const result = { type: obj.type };
         if (typeof obj.path === "string" && obj.path)

package/dist/commands/curate.js

@@ -0,0 +1,263 @@
+/**
+ * Curate logic for `akm curate`.
+ *
+ * Given a query (and optional type filter / source / limit), pick a small,
+ * high-signal set of stash + registry hits and enrich each with the data
+ * needed to act (ref, run, parameters, follow-up command).
+ *
+ * The exported `akmCurate()` API is the single entry point. Internal
+ * helpers stay private. Tests can drive the public API or call the smaller
+ * pure helpers (`curateSearchResults`, `orderCuratedTypes`,
+ * `deriveCurateFallbackQueries`) by importing them directly.
+ */
+import { UsageError } from "../core/errors";
+import { truncateDescription } from "../output/shapes";
+import { akmSearch, parseSearchSource } from "./search";
+import { akmShowUnified } from "./show";
+const CURATE_FALLBACK_FILTER_WORDS = new Set([
+    "a",
+    "an",
+    "and",
+    "for",
+    "how",
+    "i",
+    "in",
+    "of",
+    "or",
+    "the",
+    "to",
+    "with",
+]);
+const CURATED_TYPE_FALLBACK_ORDER = ["skill", "command", "script", "knowledge", "agent", "memory"];
+const CURATED_TYPE_FALLBACK_INDEX = new Map(CURATED_TYPE_FALLBACK_ORDER.map((type, index) => [type, index]));
+const MIN_CURATE_FALLBACK_TOKEN_LENGTH = 3;
+const MAX_CURATE_FALLBACK_KEYWORDS = 6;
+export const CURATE_SEARCH_LIMIT_MULTIPLIER = 4;
+export const MIN_CURATE_SEARCH_LIMIT = 12;
+const DEFAULT_CURATE_LIMIT = 4;
+/**
+ * Public curate entry point. Performs the search itself when
+ * `options.searchResponse` is not supplied.
+ */
+export async function akmCurate(options) {
+    const trimmedQuery = options.query.trim();
+    if (!trimmedQuery) {
+        throw new UsageError('A curation query is required. Usage: akm curate "<task or prompt>" [--type <type>] [--limit <n>]', "MISSING_REQUIRED_ARGUMENT");
+    }
+    const limit = options.limit && options.limit > 0 ? options.limit : DEFAULT_CURATE_LIMIT;
+    const source = options.source ?? parseSearchSource("stash");
+    const searchResponse = options.searchResponse ??
+        (await searchForCuration({
+            query: options.query,
+            type: options.type,
+            // Search deeper than the final curated count so we can pick one strong
+            // match per type and still have room for fallback retries.
+            limit: Math.max(limit * CURATE_SEARCH_LIMIT_MULTIPLIER, MIN_CURATE_SEARCH_LIMIT),
+            source,
+        }));
+    return curateSearchResults(options.query, searchResponse, limit, options.type);
+}
+export async function curateSearchResults(query, result, limit, selectedType) {
+    const stashHits = result.hits.filter((hit) => hit.type !== "registry");
+    const registryHits = result.registryHits ?? [];
+    let selectedStashHits;
+    if (selectedType && selectedType !== "any") {
+        selectedStashHits = stashHits.slice(0, limit);
+    }
+    else {
+        const bestByType = new Map();
+        for (const hit of stashHits) {
+            if (!bestByType.has(hit.type))
+                bestByType.set(hit.type, hit);
+        }
+        const orderedTypes = orderCuratedTypes(query, Array.from(bestByType.keys()));
+        selectedStashHits = orderedTypes
+            .map((type) => bestByType.get(type))
+            .filter((hit) => Boolean(hit));
+    }
+    const selectedRegistryHits = selectedStashHits.length >= limit ? [] : registryHits.slice(0, Math.min(2, limit - selectedStashHits.length));
+    const items = [
+        ...(await Promise.all(selectedStashHits.slice(0, limit).map((hit) => enrichCuratedStashHit(query, hit)))),
+        ...selectedRegistryHits.map((hit) => buildCuratedRegistryItem(query, hit)),
+    ].slice(0, limit);
+    return {
+        query,
+        summary: buildCurateSummary(query, items),
+        items,
+        ...(result.warnings?.length ? { warnings: result.warnings } : {}),
+        ...(result.tip ? { tip: result.tip } : {}),
+    };
+}
+export function orderCuratedTypes(query, types) {
+    const lower = query.toLowerCase();
+    const boosts = new Map();
+    const addBoost = (type, amount) => boosts.set(type, (boosts.get(type) ?? 0) + amount);
+    if (/(run|script|bash|shell|cli|execute|automation|deploy|build|test|lint)/.test(lower)) {
+        addBoost("script", 6);
+        addBoost("command", 4);
+    }
+    if (/(guide|docs?|readme|reference|how|explain|learn|why)/.test(lower)) {
+        addBoost("knowledge", 6);
+        addBoost("skill", 4);
+    }
+    if (/(agent|assistant|planner|review|analy[sz]e|architect|prompt)/.test(lower)) {
+        addBoost("agent", 6);
+        addBoost("skill", 3);
+    }
+    if (/(config|template|release|generate|command)/.test(lower)) {
+        addBoost("command", 5);
+    }
+    if (/(memory|context|recall|remember)/.test(lower)) {
+        addBoost("memory", 6);
+    }
+    return [...types].sort((a, b) => {
+        const boostDiff = (boosts.get(b) ?? 0) - (boosts.get(a) ?? 0);
+        if (boostDiff !== 0)
+            return boostDiff;
+        return ((CURATED_TYPE_FALLBACK_INDEX.get(a) ?? Number.MAX_SAFE_INTEGER) -
+            (CURATED_TYPE_FALLBACK_INDEX.get(b) ?? Number.MAX_SAFE_INTEGER));
+    });
+}
+async function enrichCuratedStashHit(query, hit) {
+    let shown;
+    try {
+        shown = await akmShowUnified({ ref: hit.ref });
+    }
+    catch {
+        shown = undefined;
+    }
+    const description = shown?.description ?? hit.description;
+    const preview = buildCuratedPreview(shown, hit);
+    return {
+        source: "stash",
+        type: shown?.type ?? hit.type,
+        name: shown?.name ?? hit.name,
+        ref: hit.ref,
+        ...(description ? { description } : {}),
+        ...(preview ? { preview } : {}),
+        ...(shown?.parameters?.length ? { parameters: shown.parameters } : {}),
+        ...(shown?.run ? { run: shown.run } : {}),
+        followUp: `akm show ${hit.ref}`,
+        reason: buildCuratedReason(query, shown?.type ?? hit.type),
+        ...(hit.score !== undefined ? { score: hit.score } : {}),
+    };
+}
+function buildCuratedRegistryItem(query, hit) {
+    return {
+        source: "registry",
+        type: "registry",
+        name: hit.name,
+        id: hit.id,
+        ...(hit.description ? { description: hit.description } : {}),
+        followUp: hit.action ?? `akm add ${hit.id}`,
+        reason: `Useful external source to explore for ${query}.`,
+        ...(hit.score !== undefined ? { score: hit.score } : {}),
+    };
+}
+function firstNonEmpty(values) {
+    return values.find((value) => typeof value === "string" && value.trim().length > 0);
+}
+function buildCuratedPreview(shown, hit) {
+    if (shown?.run)
+        return truncateDescription(`run ${shown.run}`, 160);
+    const payload = firstNonEmpty([shown?.template, shown?.prompt, shown?.content, hit.description])
+        ?.replace(/\s+/g, " ")
+        .trim();
+    return payload ? truncateDescription(payload, 160) : undefined;
+}
+function buildCuratedReason(query, type) {
+    switch (type) {
+        case "script":
+            return `Best runnable script match for "${query}".`;
+        case "command":
+            return `Best reusable command/template match for "${query}".`;
+        case "knowledge":
+            return `Best reference document match for "${query}".`;
+        case "skill":
+            return `Best instructions/workflow match for "${query}".`;
+        case "agent":
+            return `Best specialized agent prompt match for "${query}".`;
+        case "memory":
+            return `Best saved context match for "${query}".`;
+        default:
+            return `Best ${type} match for "${query}".`;
+    }
+}
+function buildCurateSummary(query, items) {
+    if (items.length === 0) {
+        return `No curated assets were selected for "${query}".`;
+    }
+    const labels = items.map((item) => `${item.type}:${item.name}`);
+    return `Selected ${items.length} high-signal result${items.length === 1 ? "" : "s"}: ${labels.join(", ")}.`;
+}
+function hasSearchResults(result) {
+    return result.hits.length > 0 || (result.registryHits?.length ?? 0) > 0;
+}
+/**
+ * Extract a small set of fallback keywords when a prompt-style curate query
+ * returns no hits as a whole phrase.
+ *
+ * We keep up to MAX_CURATE_FALLBACK_KEYWORDS distinct keywords and drop short
+ * or common filler words so follow-up searches stay inexpensive while focusing
+ * on higher-signal terms.
+ */
+export function deriveCurateFallbackQueries(query) {
+    return Array.from(new Set(query
+        .toLowerCase()
+        .split(/[^a-z0-9]+/)
+        .map((token) => token.trim())
+        // Keep longer tokens so fallback stays focused on higher-signal terms
+        // and avoids broad one- and two-letter matches that overwhelm curation.
+        .filter((token) => token.length >= MIN_CURATE_FALLBACK_TOKEN_LENGTH && !CURATE_FALLBACK_FILTER_WORDS.has(token)))).slice(0, MAX_CURATE_FALLBACK_KEYWORDS);
+}
+export function mergeCurateSearchResponses(base, extras) {
+    const hitsByRef = new Map();
+    for (const hit of base.hits.filter((entry) => entry.type !== "registry")) {
+        hitsByRef.set(hit.ref, hit);
+    }
+    for (const result of extras) {
+        for (const hit of result.hits.filter((entry) => entry.type !== "registry")) {
+            const existing = hitsByRef.get(hit.ref);
+            if (!existing || (hit.score ?? 0) > (existing.score ?? 0)) {
+                hitsByRef.set(hit.ref, hit);
+            }
+        }
+    }
+    const registryById = new Map();
+    for (const hit of base.registryHits ?? []) {
+        registryById.set(hit.id, hit);
+    }
+    for (const result of extras) {
+        for (const hit of result.registryHits ?? []) {
+            const existing = registryById.get(hit.id);
+            if (!existing || (hit.score ?? 0) > (existing.score ?? 0)) {
+                registryById.set(hit.id, hit);
+            }
+        }
+    }
+    const warnings = Array.from(new Set([...(base.warnings ?? []), ...extras.flatMap((result) => result.warnings ?? [])]));
+    const mergedHits = [...hitsByRef.values()].sort((a, b) => (b.score ?? 0) - (a.score ?? 0));
+    const mergedRegistryHits = [...registryById.values()].sort((a, b) => (b.score ?? 0) - (a.score ?? 0));
+    return {
+        ...base,
+        hits: mergedHits,
+        ...(mergedRegistryHits.length > 0 ? { registryHits: mergedRegistryHits } : {}),
+        ...(warnings.length > 0 ? { warnings } : {}),
+        ...(mergedHits.length > 0 || mergedRegistryHits.length > 0 ? { tip: undefined } : {}),
+    };
+}
+export async function searchForCuration(input) {
+    const initial = await akmSearch(input);
+    if (hasSearchResults(initial))
+        return initial;
+    const fallbackQueries = deriveCurateFallbackQueries(input.query);
+    if (fallbackQueries.length <= 1)
+        return initial;
+    const fallbackResults = await Promise.all(fallbackQueries.map((token) => akmSearch({
+        query: token,
+        type: input.type,
+        limit: input.limit,
+        source: input.source,
+    })));
+    return mergeCurateSearchResponses(initial, fallbackResults);
+}

package/dist/{info.js → commands/info.js}

@@ -1,10 +1,10 @@
 import fs from "node:fs";
-import { getAssetTypes } from "./asset-spec";
-import { loadConfig } from "./config";
-import { closeDatabase, getEntryCount, getMeta, isVecAvailable, openDatabase } from "./db";
-import { getDbPath } from "./paths";
-import { getEffectiveSemanticStatus, readSemanticStatus } from "./semantic-status";
-import { pkgVersion } from "./version";
+import { getAssetTypes } from "../core/asset-spec";
+import { loadConfig } from "../core/config";
+import { getDbPath } from "../core/paths";
+import { closeDatabase, getEntryCount, getMeta, isVecAvailable, openDatabase } from "../indexer/db";
+import { getEffectiveSemanticStatus, readSemanticStatus } from "../indexer/semantic-status";
+import { pkgVersion } from "../version";
 /**
  * Assemble system info describing the current capabilities, configuration,
  * and index state. Used by `akm info`.
@@ -13,8 +13,8 @@ import { pkgVersion } from "./version";
  */
 export function assembleInfo(options) {
     const config = loadConfig();
-    // Asset types
-    const assetTypes = getAssetTypes();
+    // Asset types (copy into a mutable array — `getAssetTypes()` returns readonly)
+    const assetTypes = [...getAssetTypes()];
     const semanticRuntime = readSemanticStatus();
     const semanticStatus = getEffectiveSemanticStatus(config, semanticRuntime);
     // Search modes
@@ -29,8 +29,14 @@ export function assembleInfo(options) {
         ...(r.provider ? { provider: r.provider } : {}),
         ...(r.enabled !== undefined ? { enabled: r.enabled } : {}),
     }));
-    // Stash providers
-    const stashProviders = (config.stashes ?? []).map((s) => ({
+    // Stash providers — prefer `sources[]`; fall back to `stashDir` when the
+    // user has not yet migrated to the sources[] config shape so that info
+    // always reflects at least one provider when a stash is configured.
+    const configuredSources = config.sources ?? config.stashes ?? [];
+    const stashesList = configuredSources.length === 0 && config.stashDir
+        ? [{ type: "filesystem", path: config.stashDir, name: "primary" }]
+        : configuredSources;
+    const sourceProviders = stashesList.map((s) => ({
         type: s.type,
         ...(s.name ? { name: s.name } : {}),
         ...(s.path ? { path: s.path } : {}),
@@ -51,7 +57,7 @@ export function assembleInfo(options) {
             ...(semanticRuntime?.message ? { message: semanticRuntime.message } : {}),
         },
         registries,
-        stashProviders,
+        sourceProviders,
         indexStats,
     };
 }

package/dist/{init.js → commands/init.js}

@@ -7,10 +7,10 @@
 import { spawnSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
-import { TYPE_DIRS } from "./asset-spec";
-import { getConfigPath, loadUserConfig, saveConfig } from "./config";
-import { getBinDir, getDefaultStashDir } from "./paths";
-import { ensureRg } from "./ripgrep-install";
+import { TYPE_DIRS } from "../core/asset-spec";
+import { getConfigPath, loadUserConfig, saveConfig } from "../core/config";
+import { getBinDir, getDefaultStashDir } from "../core/paths";
+import { ensureRg } from "../setup/ripgrep-install";
 export async function akmInit(options) {
     const stashDir = options?.dir ? path.resolve(options.dir) : getDefaultStashDir();
     let created = false;

package/dist/{install-audit.js → commands/install-audit.js}

@@ -1,6 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
-import { filterNonEmptyStrings } from "./common";
+import { filterNonEmptyStrings, toPosix } from "../core/common";
 const DEFAULT_INSTALL_AUDIT_CONFIG = {
     enabled: true,
     blockOnCritical: true,
@@ -346,16 +346,28 @@ function splitAllowedFindings(findings, ref, allowedFindings) {
     return { findings: active, waivedFindings: waived };
 }
 function matchesAllowedFinding(finding, ref, allowedFindings) {
+    // Normalize paths so a waiver written against `scripts/setup.sh` matches
+    // a finding emitted as `./scripts/setup.sh` or `scripts//setup.sh`. On
+    // Windows we also fold case, mirroring `isWithin`'s comparison rules.
+    const findingPathNormalized = normalizeWaiverPath(finding.file);
     return allowedFindings.some((allowed) => {
         if (allowed.id !== finding.id)
             return false;
         if (allowed.ref && allowed.ref !== ref)
             return false;
-        if (allowed.path && allowed.path !== finding.file)
+        if (allowed.path && normalizeWaiverPath(allowed.path) !== findingPathNormalized)
             return false;
         return true;
     });
 }
+function normalizeWaiverPath(value) {
+    if (!value)
+        return value;
+    // Strip a leading `./` and POSIX-ify after path.normalize so Windows path
+    // separators don't trigger spurious mismatches.
+    const normalized = toPosix(path.normalize(value)).replace(/^\.\/+/, "");
+    return process.platform === "win32" ? normalized.toLowerCase() : normalized;
+}
 function addUrlLabels(labels, rawUrl) {
     if (!rawUrl)
         return;