akm-cli 0.6.1 → 0.7.0

package/dist/tests/source.test.js

@@ -0,0 +1,533 @@
+import { afterAll, afterEach, beforeEach, expect, test } from "bun:test";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { akmInit } from "../src/commands/init";
+import { akmSearch } from "../src/commands/search";
+import { akmShowUnified as akmShow } from "../src/commands/show";
+import { getConfigPath, saveConfig } from "../src/core/config";
+import { getBinDir } from "../src/core/paths";
+import { akmIndex } from "../src/indexer/indexer";
+const createdTmpDirs = [];
+function createTmpDir(prefix = "akm-stash-") {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+    createdTmpDirs.push(dir);
+    return dir;
+}
+function writeFile(filePath, content = "") {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, content);
+}
+function isLocalHit(hit) {
+    return hit.type !== "registry";
+}
+afterAll(() => {
+    for (const dir of createdTmpDirs) {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+});
+/** Place a dummy rg binary in stashDir/bin so ensureRg skips download */
+function _stubRg(stashDir) {
+    const binDir = path.join(stashDir, "bin");
+    fs.mkdirSync(binDir, { recursive: true });
+    const rgPath = path.join(binDir, "rg");
+    fs.writeFileSync(rgPath, "#!/bin/sh\necho 'ripgrep 14.1.1'\n");
+    fs.chmodSync(rgPath, 0o755);
+}
+function stubCachedRg() {
+    const binDir = getBinDir();
+    fs.mkdirSync(binDir, { recursive: true });
+    const rgPath = path.join(binDir, "rg");
+    fs.writeFileSync(rgPath, "#!/bin/sh\necho 'ripgrep 14.1.1'\n");
+    fs.chmodSync(rgPath, 0o755);
+}
+// Isolate each test with its own cache directory so SQLite databases don't leak
+const originalXdgCacheHome = process.env.XDG_CACHE_HOME;
+const originalXdgConfigHome = process.env.XDG_CONFIG_HOME;
+let testCacheDir = "";
+let testConfigDir = "";
+beforeEach(() => {
+    testCacheDir = createTmpDir("akm-stash-cache-");
+    testConfigDir = createTmpDir("akm-stash-config-");
+    process.env.XDG_CACHE_HOME = testCacheDir;
+    process.env.XDG_CONFIG_HOME = testConfigDir;
+});
+afterEach(() => {
+    if (originalXdgCacheHome === undefined) {
+        delete process.env.XDG_CACHE_HOME;
+    }
+    else {
+        process.env.XDG_CACHE_HOME = originalXdgCacheHome;
+    }
+    if (originalXdgConfigHome === undefined) {
+        delete process.env.XDG_CONFIG_HOME;
+    }
+    else {
+        process.env.XDG_CONFIG_HOME = originalXdgConfigHome;
+    }
+    if (testCacheDir) {
+        fs.rmSync(testCacheDir, { recursive: true, force: true });
+        testCacheDir = "";
+    }
+    if (testConfigDir) {
+        fs.rmSync(testConfigDir, { recursive: true, force: true });
+        testConfigDir = "";
+    }
+});
+test("akmSearch only includes script files with supported extensions and returns run", async () => {
+    const stashDir = createTmpDir("akm-stash-");
+    writeFile(path.join(stashDir, "scripts", "deploy.sh"), "#!/usr/bin/env bash\necho deploy\n");
+    writeFile(path.join(stashDir, "scripts", "script.ts"), "console.log('x')\n");
+    writeFile(path.join(stashDir, "scripts", "README.md"), "ignore\n");
+    process.env.AKM_STASH_DIR = stashDir;
+    const result = await akmSearch({ query: "", type: "script" });
+    const localHits = result.hits.filter(isLocalHit);
+    expect(localHits.length).toBe(2);
+    expect(localHits.every((hit) => hit.type === "script")).toBe(true);
+    expect(localHits.some((hit) => hit.name === "README.md")).toBe(false);
+    expect(localHits.some((hit) => typeof hit.run === "string")).toBe(true);
+});
+test("akmSearch creates bun run from nearest package.json up to scripts root", async () => {
+    const stashDir = createTmpDir("akm-stash-");
+    const nestedScript = path.join(stashDir, "scripts", "group", "nested", "job.js");
+    writeFile(nestedScript, "console.log('job')\n");
+    writeFile(path.join(stashDir, "scripts", "group", "package.json"), '{"name":"group"}');
+    writeFile(path.join(stashDir, "scripts", "package.json"), '{"name":"root"}');
+    process.env.AKM_STASH_DIR = stashDir;
+    const result = await akmSearch({ query: "job", type: "script" });
+    const hit = result.hits.filter(isLocalHit)[0];
+    expect(result.hits.length).toBe(1);
+    expect(hit.run).toContain("bun");
+    expect(hit.run).toContain("job.js");
+});
+test("akmSearch detects setup from package.json in nearby directory", async () => {
+    const stashDir = createTmpDir("akm-stash-");
+    const nestedScript = path.join(stashDir, "scripts", "group", "nested", "job.js");
+    writeFile(nestedScript, "console.log('job')\n");
+    writeFile(path.join(stashDir, "scripts", "group", "nested", "package.json"), '{"name":"group"}');
+    process.env.AKM_STASH_DIR = stashDir;
+    const result = await akmSearch({ query: "job", type: "script" });
+    const hit = result.hits.filter(isLocalHit)[0];
+    expect(result.hits.length).toBe(1);
+    // Search hits only expose run, not setup/cwd
+    expect(hit.run).toContain("bun");
+    expect(hit.run).toContain("job.js");
+});
+test("akmSearch resolves script run correctly for search path directories", async () => {
+    const primaryStashDir = createTmpDir("akm-stash-primary-");
+    const searchPathDir = createTmpDir("akm-stash-searchpath-");
+    writeFile(path.join(primaryStashDir, "scripts", "placeholder.sh"), "#!/usr/bin/env bash\necho primary\n");
+    writeFile(path.join(searchPathDir, "scripts", "group", "nested", "job.js"), "console.log('job')\n");
+    writeFile(path.join(searchPathDir, "scripts", "group", "package.json"), '{"name":"group"}');
+    saveConfig({ semanticSearchMode: "off", sources: [{ type: "filesystem", path: searchPathDir }] });
+    process.env.AKM_STASH_DIR = primaryStashDir;
+    await akmIndex({ stashDir: primaryStashDir, full: true });
+    const result = await akmSearch({ query: "job", type: "script" });
+    const searchPathHit = result.hits.filter(isLocalHit).find((hit) => hit.path.includes(searchPathDir));
+    expect(searchPathHit).toBeDefined();
+    expect(searchPathHit?.run ?? "").toContain("bun");
+    expect(searchPathHit?.run ?? "").toContain("job.js");
+});
+test("akmSearch includes explainability reasons for indexed hits", async () => {
+    const stashDir = createTmpDir("akm-stash-");
+    writeFile(path.join(stashDir, "scripts", "summarize-diff.ts"), "console.log('summarize')\n");
+    saveConfig({ semanticSearchMode: "auto" });
+    process.env.AKM_STASH_DIR = stashDir;
+    await akmIndex({ stashDir, full: true });
+    const result = await akmSearch({ query: "summarize diff", type: "script" });
+    expect(result.hits.length).toBeGreaterThan(0);
+    expect(result.hits[0].whyMatched).toBeDefined();
+    // Ranking mode depends on whether semantic search (embeddings) is available.
+    // Accept "fts bm25 relevance", "semantic similarity", or "hybrid (fts + semantic)".
+    expect(result.hits[0].whyMatched?.includes("fts bm25 relevance") ||
+        result.hits[0].whyMatched?.includes("semantic similarity") ||
+        result.hits[0].whyMatched?.includes("hybrid (fts + semantic)")).toBe(true);
+    expect(result.hits[0].whyMatched).toContain("matched name tokens");
+});
+test("akmSearch includes ref, action, and size for local hits", async () => {
+    const stashDir = createTmpDir("akm-stash-");
+    const scriptPath = path.join(stashDir, "scripts", "deploy.sh");
+    writeFile(scriptPath, "#!/usr/bin/env bash\necho deploy\n");
+    writeFile(path.join(stashDir, "scripts", ".stash.json"), JSON.stringify({
+        entries: [
+            {
+                name: "deploy",
+                type: "script",
+                description: "Deploy app",
+                filename: "deploy.sh",
+            },
+        ],
+    }));
+    saveConfig({ semanticSearchMode: "off" });
+    process.env.AKM_STASH_DIR = stashDir;
+    await akmIndex({ stashDir, full: true });
+    const result = await akmSearch({ query: "deploy", type: "script" });
+    const hit = result.hits.filter(isLocalHit)[0];
+    expect(hit.ref).toContain("script:deploy.sh");
+    expect(hit.action).toContain("akm show");
+    expect(hit.size).toBe("small");
+});
+test("akmSearch includes origin for installed-source hits", async () => {
+    const stashDir = createTmpDir("akm-stash-");
+    const installedStash = createTmpDir("akm-installed-");
+    writeFile(path.join(stashDir, "scripts", "placeholder.sh"), "#!/usr/bin/env bash\necho placeholder\n");
+    writeFile(path.join(installedStash, "scripts", "deploy.sh"), "#!/usr/bin/env bash\necho deploy\n");
+    saveConfig({
+        semanticSearchMode: "off",
+        installed: [
+            {
+                id: "npm:@scope/deploy-stash",
+                source: "npm",
+                ref: "@scope/deploy-stash",
+                artifactUrl: "https://example.com/deploy-stash.tgz",
+                stashRoot: installedStash,
+                cacheDir: installedStash,
+                installedAt: new Date().toISOString(),
+            },
+        ],
+    });
+    process.env.AKM_STASH_DIR = stashDir;
+    await akmIndex({ stashDir, full: true });
+    const result = await akmSearch({ query: "deploy", type: "script" });
+    expect(result.hits.filter(isLocalHit).some((hit) => hit.origin === "npm:@scope/deploy-stash")).toBe(true);
+});
+test("akmShow returns full payloads for skill/command/agent", async () => {
+    const stashDir = createTmpDir("akm-stash-");
+    writeFile(path.join(stashDir, "skills", "ops", "SKILL.md"), "# Ops\n");
+    writeFile(path.join(stashDir, "commands", "release.md"), '---\ndescription: "Release command"\n---\nrun release\n');
+    writeFile(path.join(stashDir, "agents", "coach.md"), '---\ndescription: "Coach"\nmodel: "gpt-5"\n---\nGuide users\n');
+    process.env.AKM_STASH_DIR = stashDir;
+    const skill = await akmShow({ ref: "skill:ops" });
+    const command = await akmShow({ ref: "command:release.md" });
+    const agent = await akmShow({ ref: "agent:coach.md" });
+    expect(skill.type).toBe("skill");
+    expect(skill.action).toContain("Read and follow");
+    expect(skill.content ?? "").toMatch(/Ops/);
+    expect(command.type).toBe("command");
+    expect(command.action).toContain("dispatch");
+    expect(command.template ?? "").toMatch(/run release/);
+    expect(command.description).toBe("Release command");
+    expect(agent.type).toBe("agent");
+    expect(agent.action).toContain("verbatim");
+    expect(agent.prompt ?? "").toMatch(/Guide users/);
+    expect(agent.modelHint).toBe("gpt-5");
+});
+test("akmShow returns clear error when stash type root is missing", async () => {
+    const stashDir = createTmpDir("akm-stash-");
+    try {
+        process.env.AKM_STASH_DIR = stashDir;
+        // QA #27: error should not leak "Stash type root" wording; be user-facing
+        await expect(akmShow({ ref: "agent:missing.md" })).rejects.toThrow(/Asset not found for ref: agent:missing\.md|not found for ref/i);
+    }
+    finally {
+        fs.rmSync(stashDir, { recursive: true, force: true });
+    }
+});
+test("akmShow rejects invalid asset type in ref", async () => {
+    const stashDir = createTmpDir("akm-stash-");
+    process.env.AKM_STASH_DIR = stashDir;
+    await expect(akmShow({ ref: "widget:foo" })).rejects.toThrow(/Invalid asset type/);
+});
+test("akmShow rejects traversal and absolute path refs", async () => {
+    const stashDir = createTmpDir("akm-stash-");
+    process.env.AKM_STASH_DIR = stashDir;
+    await expect(akmShow({ ref: "script:../outside.sh" })).rejects.toThrow(/Path traversal/);
+    await expect(akmShow({ ref: "script:/etc/passwd" })).rejects.toThrow(/Absolute path/);
+});
+test("akmShow blocks symlink escapes outside stash type root", async () => {
+    const stashDir = createTmpDir("akm-stash-");
+    const outsideDir = createTmpDir("akm-outside-");
+    const outsideFile = path.join(outsideDir, "outside.sh");
+    const symlinkFile = path.join(stashDir, "scripts", "link.sh");
+    writeFile(outsideFile, "echo outside\n");
+    fs.mkdirSync(path.join(stashDir, "scripts"), { recursive: true });
+    try {
+        fs.symlinkSync(outsideFile, symlinkFile);
+    }
+    catch {
+        // Symlinks not supported in this environment — skip
+        return;
+    }
+    process.env.AKM_STASH_DIR = stashDir;
+    await expect(akmShow({ ref: "script:link.sh" })).rejects.toThrow(/Ref resolves outside the stash root/);
+});
+// ── Knowledge tests ─────────────────────────────────────────────────────────
+const KNOWLEDGE_DOC = `---
+title: API Guide
+description: "API documentation"
+---
+# Overview
+
+This is the API guide.
+
+## Authentication
+
+Use bearer tokens.
+
+## Endpoints
+
+### GET /users
+
+Returns all users.
+
+### POST /users
+
+Creates a user.
+`;
+test("akmSearch finds knowledge assets", async () => {
+    const stashDir = createTmpDir("akm-stash-");
+    writeFile(path.join(stashDir, "knowledge", "api-guide.md"), KNOWLEDGE_DOC);
+    process.env.AKM_STASH_DIR = stashDir;
+    const result = await akmSearch({ query: "", type: "knowledge" });
+    expect(result.hits.length).toBe(1);
+    expect(result.hits[0].type).toBe("knowledge");
+    expect(result.hits[0].name).toBe("api-guide");
+});
+test("akmShow returns full content for knowledge by default", async () => {
+    const stashDir = createTmpDir("akm-stash-");
+    writeFile(path.join(stashDir, "knowledge", "api-guide.md"), KNOWLEDGE_DOC);
+    process.env.AKM_STASH_DIR = stashDir;
+    const result = await akmShow({ ref: "knowledge:api-guide.md" });
+    expect(result.type).toBe("knowledge");
+    expect(result.content).toContain("# Overview");
+    expect(result.content).toContain("## Authentication");
+});
+test("akmShow returns TOC for knowledge with view toc", async () => {
+    const stashDir = createTmpDir("akm-stash-");
+    writeFile(path.join(stashDir, "knowledge", "api-guide.md"), KNOWLEDGE_DOC);
+    process.env.AKM_STASH_DIR = stashDir;
+    const result = await akmShow({ ref: "knowledge:api-guide.md", view: { mode: "toc" } });
+    expect(result.type).toBe("knowledge");
+    expect(result.content).toContain("# Overview");
+    expect(result.content).toContain("## Authentication");
+    expect(result.content).toContain("## Endpoints");
+    expect(result.content).toContain("lines total");
+});
+test("akmShow extracts section for knowledge", async () => {
+    const stashDir = createTmpDir("akm-stash-");
+    writeFile(path.join(stashDir, "knowledge", "api-guide.md"), KNOWLEDGE_DOC);
+    process.env.AKM_STASH_DIR = stashDir;
+    const result = await akmShow({
+        ref: "knowledge:api-guide.md",
+        view: { mode: "section", heading: "Authentication" },
+    });
+    expect(result.type).toBe("knowledge");
+    expect(result.content).toContain("bearer tokens");
+    expect(result.content).not.toContain("Endpoints");
+});
+test("akmShow extracts line range for knowledge", async () => {
+    const stashDir = createTmpDir("akm-stash-");
+    writeFile(path.join(stashDir, "knowledge", "api-guide.md"), KNOWLEDGE_DOC);
+    process.env.AKM_STASH_DIR = stashDir;
+    const result = await akmShow({ ref: "knowledge:api-guide.md", view: { mode: "lines", start: 5, end: 7 } });
+    expect(result.type).toBe("knowledge");
+    expect(result.content).toContain("# Overview");
+});
+test("akmShow extracts frontmatter for knowledge", async () => {
+    const stashDir = createTmpDir("akm-stash-");
+    writeFile(path.join(stashDir, "knowledge", "api-guide.md"), KNOWLEDGE_DOC);
+    process.env.AKM_STASH_DIR = stashDir;
+    const result = await akmShow({ ref: "knowledge:api-guide.md", view: { mode: "frontmatter" } });
+    expect(result.type).toBe("knowledge");
+    expect(result.content).toContain("title: API Guide");
+    expect(result.content).not.toContain("# Overview");
+});
+test("akmShow returns no-frontmatter message when missing", async () => {
+    const stashDir = createTmpDir("akm-stash-");
+    writeFile(path.join(stashDir, "knowledge", "plain.md"), "# Just a heading\nSome text.\n");
+    process.env.AKM_STASH_DIR = stashDir;
+    const result = await akmShow({ ref: "knowledge:plain.md", view: { mode: "frontmatter" } });
+    expect(result.content).toBe("(no frontmatter)");
+});
+test("akmShow returns helpful message for missing section in knowledge", async () => {
+    const stashDir = createTmpDir("akm-stash-");
+    writeFile(path.join(stashDir, "knowledge", "api-guide.md"), KNOWLEDGE_DOC);
+    process.env.AKM_STASH_DIR = stashDir;
+    const result = await akmShow({
+        ref: "knowledge:api-guide.md",
+        view: { mode: "section", heading: "Nonexistent" },
+    });
+    expect(result.type).toBe("knowledge");
+    expect(result.content).toContain('Section "Nonexistent" not found');
+    expect(result.content).toContain("akm show");
+    expect(result.content).toContain("toc");
+    expect(result.content).toContain("discover available headings");
+});
+test("akmShow for script type returns run", async () => {
+    const stashDir = createTmpDir("akm-stash-");
+    writeFile(path.join(stashDir, "scripts", "deploy.sh"), "#!/usr/bin/env bash\necho deploy\n");
+    process.env.AKM_STASH_DIR = stashDir;
+    const result = await akmShow({ ref: "script:deploy.sh" });
+    expect(result.type).toBe("script");
+    expect(result.run).toBeTruthy();
+    expect(typeof result.run).toBe("string");
+    expect(result.run).toContain("bash");
+});
+test("akmInit returns created false when stash dir already exists", async () => {
+    const origHome = process.env.HOME;
+    const origStashDir = process.env.AKM_STASH_DIR;
+    const tmpHome = createTmpDir("akm-home-");
+    // Pre-create the akm directory at the new default location (~/akm)
+    const stashPath = path.join(tmpHome, "akm");
+    fs.mkdirSync(stashPath, { recursive: true });
+    process.env.HOME = tmpHome;
+    delete process.env.AKM_STASH_DIR;
+    try {
+        stubCachedRg();
+        const result = await akmInit();
+        expect(result.created).toBe(false);
+        expect(result.stashDir).toBe(stashPath);
+    }
+    finally {
+        if (origHome === undefined)
+            delete process.env.HOME;
+        else
+            process.env.HOME = origHome;
+        if (origStashDir === undefined)
+            delete process.env.AKM_STASH_DIR;
+        else
+            process.env.AKM_STASH_DIR = origStashDir;
+        fs.rmSync(tmpHome, { recursive: true, force: true });
+    }
+});
+test("akmShow throws unsupported script extension for .txt file", async () => {
+    const origStashDir = process.env.AKM_STASH_DIR;
+    const stashDir = createTmpDir("akm-stash-");
+    writeFile(path.join(stashDir, "scripts", "readme.txt"), "not a script\n");
+    process.env.AKM_STASH_DIR = stashDir;
+    try {
+        await expect(akmShow({ ref: "script:readme.txt" })).rejects.toThrow(/Script ref must resolve to a file with a supported script extension/);
+    }
+    finally {
+        if (origStashDir === undefined)
+            delete process.env.AKM_STASH_DIR;
+        else
+            process.env.AKM_STASH_DIR = origStashDir;
+        fs.rmSync(stashDir, { recursive: true, force: true });
+    }
+});
+test("akmInit creates knowledge directory", async () => {
+    const origHome = process.env.HOME;
+    const origStashDir = process.env.AKM_STASH_DIR;
+    const tmpHome = createTmpDir("akm-home-");
+    process.env.HOME = tmpHome;
+    delete process.env.AKM_STASH_DIR;
+    try {
+        stubCachedRg();
+        const result = await akmInit();
+        expect(fs.existsSync(path.join(result.stashDir, "knowledge"))).toBe(true);
+    }
+    finally {
+        if (origHome === undefined)
+            delete process.env.HOME;
+        else
+            process.env.HOME = origHome;
+        if (origStashDir === undefined)
+            delete process.env.AKM_STASH_DIR;
+        else
+            process.env.AKM_STASH_DIR = origStashDir;
+        fs.rmSync(tmpHome, { recursive: true, force: true });
+    }
+});
+// ── Script tests ────────────────────────────────────────────────────────────
+test("akmSearch finds script assets with broad extensions", async () => {
+    const origStashDir = process.env.AKM_STASH_DIR;
+    const stashDir = createTmpDir("akm-stash-");
+    writeFile(path.join(stashDir, "scripts", "cleanup.sh"), "#!/usr/bin/env bash\necho cleanup\n");
+    writeFile(path.join(stashDir, "scripts", "process.py"), "print('hello')\n");
+    writeFile(path.join(stashDir, "scripts", "README.md"), "ignore\n");
+    try {
+        process.env.AKM_STASH_DIR = stashDir;
+        const result = await akmSearch({ query: "", type: "script" });
+        expect(result.hits.length).toBe(2);
+        expect(result.hits.every((hit) => hit.type === "script")).toBe(true);
+        expect(result.hits.some((hit) => hit.name === "README.md")).toBe(false);
+    }
+    finally {
+        if (origStashDir === undefined) {
+            delete process.env.AKM_STASH_DIR;
+        }
+        else {
+            process.env.AKM_STASH_DIR = origStashDir;
+        }
+        fs.rmSync(stashDir, { recursive: true, force: true });
+    }
+});
+test("akmSearch returns run for runnable script extensions", async () => {
+    const origStashDir = process.env.AKM_STASH_DIR;
+    const stashDir = createTmpDir("akm-stash-");
+    writeFile(path.join(stashDir, "scripts", "deploy.sh"), "#!/usr/bin/env bash\necho deploy\n");
+    try {
+        process.env.AKM_STASH_DIR = stashDir;
+        const result = await akmSearch({ query: "", type: "script" });
+        const hit = result.hits.filter(isLocalHit)[0];
+        expect(result.hits.length).toBe(1);
+        expect(hit.run).toBeTruthy();
+        expect(hit.run).toContain("bash");
+    }
+    finally {
+        if (origStashDir === undefined) {
+            delete process.env.AKM_STASH_DIR;
+        }
+        else {
+            process.env.AKM_STASH_DIR = origStashDir;
+        }
+        fs.rmSync(stashDir, { recursive: true, force: true });
+    }
+});
+test("akmShow returns run for python script (auto-detected interpreter)", async () => {
+    const origStashDir = process.env.AKM_STASH_DIR;
+    const stashDir = createTmpDir("akm-stash-");
+    writeFile(path.join(stashDir, "scripts", "process.py"), "# A python script\nprint('hello')\n");
+    try {
+        process.env.AKM_STASH_DIR = stashDir;
+        const result = await akmShow({ ref: "script:process.py" });
+        expect(result.type).toBe("script");
+        expect(result.run).toBeDefined();
+        expect(result.run).toContain("python");
+    }
+    finally {
+        if (origStashDir === undefined) {
+            delete process.env.AKM_STASH_DIR;
+        }
+        else {
+            process.env.AKM_STASH_DIR = origStashDir;
+        }
+        fs.rmSync(stashDir, { recursive: true, force: true });
+    }
+});
+test("akmShow returns run for runnable script", async () => {
+    const stashDir = createTmpDir("akm-stash-");
+    writeFile(path.join(stashDir, "scripts", "deploy.sh"), "#!/usr/bin/env bash\necho deploy\n");
+    process.env.AKM_STASH_DIR = stashDir;
+    const result = await akmShow({ ref: "script:deploy.sh" });
+    expect(result.type).toBe("script");
+    expect(result.run).toBeTruthy();
+    expect(result.run).toContain("bash");
+});
+test("akmInit writes config outside the stash directory", async () => {
+    const origHome = process.env.HOME;
+    const origStashDir = process.env.AKM_STASH_DIR;
+    const tmpHome = createTmpDir("akm-home-");
+    process.env.HOME = tmpHome;
+    delete process.env.AKM_STASH_DIR;
+    try {
+        stubCachedRg();
+        const result = await akmInit();
+        expect(result.configPath).toBe(getConfigPath());
+        expect(result.configPath.startsWith(result.stashDir)).toBe(false);
+        expect(fs.existsSync(result.configPath)).toBe(true);
+        expect(fs.existsSync(path.join(result.stashDir, "config.json"))).toBe(false);
+    }
+    finally {
+        if (origHome === undefined)
+            delete process.env.HOME;
+        else
+            process.env.HOME = origHome;
+        if (origStashDir === undefined)
+            delete process.env.AKM_STASH_DIR;
+        else
+            process.env.AKM_STASH_DIR = origStashDir;
+        fs.rmSync(tmpHome, { recursive: true, force: true });
+    }
+});

package/dist/tests/tar-utils-scan.test.js

@@ -0,0 +1,73 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { extractTarGzSecure } from "../src/sources/providers/tar-utils";
+/**
+ * Regression tests for the post-extraction scanner in `tar-utils.ts`.
+ *
+ * PR #168 review flagged that the previous `entry.name.includes("..")`
+ * check rejected legitimate filenames like `archive..2024.tar` or
+ * `foo..bar.md`. The scanner now only rejects exact "." / ".." segments
+ * and instead enforces containment via `isWithin`.
+ *
+ * These tests construct real tarballs in a temp directory and run them
+ * through the actual extraction path so the post-scan logic is exercised
+ * end-to-end.
+ */
+const tmpDirs = [];
+function tmpDir(prefix = "akm-tar-scan-") {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+    tmpDirs.push(dir);
+    return dir;
+}
+afterEach(() => {
+    for (const dir of tmpDirs.splice(0)) {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+});
+/**
+ * Build a tarball where the inner directory wraps two files. Returns the
+ * tarball path and the destination dir for `extractTarGzSecure`.
+ */
+function buildTarball(rootName, entries) {
+    const work = tmpDir("akm-tar-build-");
+    const root = path.join(work, rootName);
+    fs.mkdirSync(root, { recursive: true });
+    for (const entry of entries) {
+        const file = path.join(root, entry.name);
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.writeFileSync(file, entry.body, "utf8");
+    }
+    const tarPath = path.join(work, `${rootName}.tar.gz`);
+    // Use system tar — present on macOS, Linux. The scanner is what we care
+    // about; building the archive itself is incidental.
+    const proc = Bun.spawnSync(["tar", "-czf", tarPath, "-C", work, rootName]);
+    if (proc.exitCode !== 0) {
+        throw new Error(`tar build failed: ${new TextDecoder().decode(proc.stderr)}`);
+    }
+    return tarPath;
+}
+describe("scanExtractedFiles — filename .. substring guard (PR #168 review #8)", () => {
+    test("accepts filenames containing `..` substrings (no false positive)", () => {
+        const tarPath = buildTarball("pkg", [
+            { name: "archive..2024.tar", body: "tar body bytes" },
+            { name: "notes/foo..bar.md", body: "# notes" },
+        ]);
+        const dest = tmpDir("akm-tar-extract-");
+        // Should NOT throw — these names previously failed the substring check.
+        expect(() => extractTarGzSecure(tarPath, dest)).not.toThrow();
+        expect(fs.existsSync(path.join(dest, "archive..2024.tar"))).toBe(true);
+        expect(fs.existsSync(path.join(dest, "notes/foo..bar.md"))).toBe(true);
+    });
+    test("accepts ordinary filenames", () => {
+        const tarPath = buildTarball("pkg", [
+            { name: "README.md", body: "# README" },
+            { name: "src/main.ts", body: "export const x = 1;" },
+        ]);
+        const dest = tmpDir("akm-tar-extract-ok-");
+        expect(() => extractTarGzSecure(tarPath, dest)).not.toThrow();
+        expect(fs.existsSync(path.join(dest, "README.md"))).toBe(true);
+        expect(fs.existsSync(path.join(dest, "src/main.ts"))).toBe(true);
+    });
+});

package/dist/tests/toggle-components.test.js

@@ -0,0 +1,73 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+const CLI = path.join(__dirname, "..", "src", "cli.ts");
+const tempDirs = [];
+function makeTempDir(prefix) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+    tempDirs.push(dir);
+    return dir;
+}
+afterEach(() => {
+    for (const dir of tempDirs.splice(0)) {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+});
+function runCli(args, env) {
+    const result = spawnSync("bun", [CLI, ...args], {
+        encoding: "utf8",
+        timeout: 30_000,
+        env,
+    });
+    return { status: result.status, stdout: result.stdout ?? "", stderr: result.stderr ?? "" };
+}
+describe("component toggles", () => {
+    test("akm disable skills.sh marks skills.sh registry as disabled", () => {
+        const xdgConfig = makeTempDir("akm-toggle-config-");
+        const xdgCache = makeTempDir("akm-toggle-cache-");
+        const stashDir = makeTempDir("akm-toggle-stash-");
+        const result = runCli(["disable", "skills.sh", "--format=json"], {
+            ...process.env,
+            XDG_CONFIG_HOME: xdgConfig,
+            XDG_CACHE_HOME: xdgCache,
+            AKM_STASH_DIR: stashDir,
+        });
+        expect(result.status).toBe(0);
+        expect(JSON.parse(result.stdout).enabled).toBe(false);
+        const configPath = path.join(xdgConfig, "akm", "config.json");
+        const config = JSON.parse(fs.readFileSync(configPath, "utf8"));
+        const skillsRegistry = config.registries?.find((entry) => entry.name === "skills.sh" || entry.provider === "skills-sh");
+        expect(skillsRegistry).toBeDefined();
+        expect(skillsRegistry?.enabled).toBe(false);
+    });
+    test("akm enable <unsupported-target> exits with usage error", () => {
+        const xdgConfig = makeTempDir("akm-toggle-config-");
+        const xdgCache = makeTempDir("akm-toggle-cache-");
+        const stashDir = makeTempDir("akm-toggle-stash-");
+        const result = runCli(["enable", "context-hub", "--format=json"], {
+            ...process.env,
+            XDG_CONFIG_HOME: xdgConfig,
+            XDG_CACHE_HOME: xdgCache,
+            AKM_STASH_DIR: stashDir,
+        });
+        expect(result.status).not.toBe(0);
+        const combined = `${result.stdout}\n${result.stderr}`;
+        expect(combined).toContain("Unsupported target");
+    });
+    test("akm disable <unsupported-target> exits with usage error", () => {
+        const xdgConfig = makeTempDir("akm-toggle-config-");
+        const xdgCache = makeTempDir("akm-toggle-cache-");
+        const stashDir = makeTempDir("akm-toggle-stash-");
+        const result = runCli(["disable", "context-hub", "--format=json"], {
+            ...process.env,
+            XDG_CONFIG_HOME: xdgConfig,
+            XDG_CACHE_HOME: xdgCache,
+            AKM_STASH_DIR: stashDir,
+        });
+        expect(result.status).not.toBe(0);
+        const combined = `${result.stdout}\n${result.stderr}`;
+        expect(combined).toContain("Unsupported target");
+    });
+});