akm-cli 0.7.3 → 0.7.5

package/dist/integrations/agent/prompts.js

@@ -47,16 +47,30 @@ function knownTypeList() {
     return Object.keys(TYPE_DIRS).sort().join(", ");
 }
 /**
- * Common envelope every prompt asks the agent to honour. The wrapper code
- * uses `JSON.parse(stdout)` to extract the payload — anything outside the
- * JSON object will be treated as a parse error.
+ * Common envelope every prompt asks the agent to honour when NO draft file
+ * path is available. The wrapper code uses `JSON.parse(stdout)` to extract
+ * the payload — anything outside the JSON object will be treated as a parse
+ * error.
  */
-const RESPONSE_CONTRACT = [
+const RESPONSE_CONTRACT_JSON = [
     "Respond ONLY with a single JSON object. No prose before or after.",
     'Shape: {"ref": "<type>:<name>", "content": "<full file contents>", "frontmatter": {...}}',
     "`content` is the full file body that will be written if accepted.",
     "`frontmatter` is optional — include it if `content` starts with `---` so reviewers can sanity-check the keys.",
 ].join("\n");
+/**
+ * Response contract used when a draft file path is available. Instructs the
+ * agent to write the improved asset content directly to the file using its
+ * native file-editing tools — no stdout JSON parsing required.
+ */
+function fileWriteContract(draftFilePath) {
+    return [
+        `Write the complete improved asset content to: ${draftFilePath}`,
+        "Use your file-editing tools to create or overwrite that file.",
+        "Do NOT output JSON to stdout. Do NOT print the file contents. Just write the file.",
+        "When you are done writing the file, output a single line: DRAFT_WRITTEN",
+    ].join("\n");
+}
 /**
  * Build the prompt for `akm reflect [ref]`. Asks the agent to review an
  * existing asset (plus any negative feedback / lint findings) and propose
@@ -105,7 +119,7 @@ export function buildReflectPrompt(input) {
             sections.push(`- ${line}`);
     }
     sections.push("Produce a single proposal that addresses the feedback and respects the asset-type contract.");
-    sections.push(RESPONSE_CONTRACT);
+    sections.push(input.draftFilePath ? fileWriteContract(input.draftFilePath) : RESPONSE_CONTRACT_JSON);
     return sections.join("\n\n");
 }
 /**
@@ -124,19 +138,35 @@ export function buildProposePrompt(input) {
             sections.push(`- ${line}`);
     }
     sections.push("Produce a single proposal that, if accepted, would land as the asset described above.");
-    sections.push(RESPONSE_CONTRACT);
+    sections.push(input.draftFilePath ? fileWriteContract(input.draftFilePath) : RESPONSE_CONTRACT_JSON);
     return sections.join("\n\n");
 }
 /**
  * Parse agent stdout into a proposal payload. The agent contract requires a
  * single JSON object; anything else is reported as a parse error so callers
  * can map to {@link AgentFailureReason} `parse_error`.
+ *
+ * Resilient to two common local-LLM failure modes:
+ *  1. `<think>…</think>` blocks emitted before the JSON (stripped by `stripJsonFences`).
+ *  2. Prose preamble / postamble around the JSON object (handled by `extractEmbeddedJson`).
  */
 export function parseAgentProposalPayload(stdout) {
     const trimmed = stripJsonFences(stdout).trim();
     if (!trimmed)
         throw new Error("agent produced empty output");
-    const parsed = JSON.parse(trimmed);
+    let parsed;
+    try {
+        parsed = JSON.parse(trimmed);
+    }
+    catch (directErr) {
+        // Agent output contains prose before/after the JSON object (e.g. a local
+        // LLM that narrates before responding). Try extracting the first balanced
+        // top-level `{…}` from the text rather than failing immediately.
+        const embedded = extractEmbeddedJson(trimmed);
+        if (!embedded)
+            throw directErr;
+        parsed = embedded;
+    }
     if (typeof parsed.ref !== "string" || !parsed.ref.trim()) {
         throw new Error('agent response missing required string field "ref"');
     }
@@ -153,15 +183,65 @@ export function parseAgentProposalPayload(stdout) {
     return out;
 }
 /**
- * Strip `\`\`\`json … \`\`\`` fences if the agent wrapped its JSON output.
- * Mirrors the same helper in `src/llm/client.ts` but kept local here so
- * `agent/` does not import from `llm/` (the boundary is one-way per
- * v1 spec §9.7 — agents are shell-out only).
+ * Extract the first balanced top-level `{…}` object from `text`. Used as a
+ * fallback when direct `JSON.parse` fails due to surrounding prose. Kept
+ * local to `agent/` (mirrors `parseEmbeddedJsonResponse` in `src/llm/client.ts`
+ * without importing across the one-way boundary — v1 spec §9.7).
+ */
+function extractEmbeddedJson(text) {
+    for (let start = 0; start < text.length; start++) {
+        if (text[start] !== "{")
+            continue;
+        let depth = 0;
+        let inString = false;
+        let escaped = false;
+        for (let i = start; i < text.length; i++) {
+            const ch = text[i];
+            if (inString) {
+                if (escaped) {
+                    escaped = false;
+                }
+                else if (ch === "\\") {
+                    escaped = true;
+                }
+                else if (ch === '"') {
+                    inString = false;
+                }
+                continue;
+            }
+            if (ch === '"') {
+                inString = true;
+                continue;
+            }
+            if (ch === "{")
+                depth++;
+            if (ch === "}") {
+                depth--;
+                if (depth === 0) {
+                    try {
+                        return JSON.parse(text.slice(start, i + 1));
+                    }
+                    catch {
+                        break;
+                    }
+                }
+            }
+        }
+    }
+    return undefined;
+}
+/**
+ * Strip `\`\`\`json … \`\`\`` fences and `<think>…</think>` reasoning blocks
+ * from agent output. Mirrors `client.ts` but kept local to `agent/` per v1
+ * spec §9.7 (one-way boundary — `agent/` does not import from `llm/`).
  */
 export function stripJsonFences(text) {
-    const trimmed = text.trim();
-    const fenced = trimmed.match(/^```(?:json)?\s*\n([\s\S]*?)\n```$/);
+    const stripped = text
+        .trim()
+        .replace(/<think>[\s\S]*?<\/think>/gi, "")
+        .trim();
+    const fenced = stripped.match(/^```(?:json)?\s*\n([\s\S]*?)\n```$/);
     if (fenced)
-        return fenced[1] ?? trimmed;
-    return trimmed;
+        return fenced[1] ?? stripped;
+    return stripped;
 }

package/dist/integrations/agent/spawn.js

@@ -252,21 +252,74 @@ export async function runAgent(profile, prompt, options = {}) {
         };
     }
     if (parseOutput === "json" && stdioMode === "captured") {
+        // Strip <think> blocks and code fences, then try direct parse with
+        // embedded-JSON fallback for local LLMs that emit prose around the payload.
+        const cleaned = stdout
+            .trim()
+            .replace(/<think>[\s\S]*?<\/think>/gi, "")
+            .trim()
+            .replace(/^```(?:json)?\s*\n?/, "")
+            .replace(/\n?```\s*$/, "")
+            .trim();
+        let parsed;
         try {
-            const parsed = JSON.parse(stdout);
-            return { ok: true, exitCode, stdout, stderr, durationMs, parsed };
+            parsed = JSON.parse(cleaned);
         }
-        catch (err) {
-            return {
-                ok: false,
-                exitCode,
-                stdout,
-                stderr,
-                durationMs,
-                reason: "parse_error",
-                error: err instanceof Error ? err.message : String(err),
-            };
+        catch {
+            // Fallback: extract the first balanced {…} from prose output.
+            let found;
+            for (let s = 0; s < cleaned.length; s++) {
+                if (cleaned[s] !== "{")
+                    continue;
+                let depth = 0, inStr = false, esc = false;
+                for (let i = s; i < cleaned.length; i++) {
+                    const c = cleaned[i];
+                    if (inStr) {
+                        if (esc) {
+                            esc = false;
+                        }
+                        else if (c === "\\") {
+                            esc = true;
+                        }
+                        else if (c === '"') {
+                            inStr = false;
+                        }
+                        continue;
+                    }
+                    if (c === '"') {
+                        inStr = true;
+                        continue;
+                    }
+                    if (c === "{")
+                        depth++;
+                    if (c === "}") {
+                        depth--;
+                        if (depth === 0) {
+                            try {
+                                found = JSON.parse(cleaned.slice(s, i + 1));
+                            }
+                            catch { }
+                            break;
+                        }
+                    }
+                }
+                if (found !== undefined)
+                    break;
+            }
+            if (found === undefined) {
+                return {
+                    ok: false,
+                    exitCode,
+                    stdout,
+                    stderr,
+                    durationMs,
+                    reason: "parse_error",
+                    error: "no JSON object found in agent output",
+                };
+            }
+            parsed = found;
         }
+        return { ok: true, exitCode, stdout, stderr, durationMs, parsed };
     }
     return { ok: true, exitCode, stdout, stderr, durationMs };
 }

package/dist/llm/client.js

@@ -39,6 +39,7 @@ export function redactErrorBody(input) {
     return out;
 }
 export async function chatCompletion(config, messages, options) {
+    const timeoutMs = options?.timeoutMs ?? config.timeoutMs ?? 120_000;
     const headers = { "Content-Type": "application/json" };
     if (config.apiKey) {
         headers.Authorization = `Bearer ${config.apiKey}`;
@@ -53,7 +54,7 @@ export async function chatCompletion(config, messages, options) {
             max_tokens: options?.maxTokens ?? config.maxTokens ?? 512,
             ...config.extraParams,
         }),
-    }, 30_000, options?.signal);
+    }, timeoutMs, options?.signal);
     if (!response.ok) {
         const rawBody = await response.text().catch(() => "");
         const safeBody = redactErrorBody(rawBody);
@@ -64,12 +65,49 @@ export async function chatCompletion(config, messages, options) {
 }
 /** Strip leading/trailing markdown code fences from an LLM response. */
 export function stripJsonFences(raw) {
-    return raw
+    const repaired = raw
         .trim()
         .replace(/<think>[\s\S]*?<\/think>/gi, "")
         .replace(/^```(?:json)?\s*\n?/i, "")
         .replace(/\n?```\s*$/i, "")
         .trim();
+    let out = "";
+    let inString = false;
+    let escaped = false;
+    for (let i = 0; i < repaired.length; i++) {
+        const ch = repaired[i];
+        if (escaped) {
+            out += ch;
+            escaped = false;
+            continue;
+        }
+        if (ch === "\\" && inString) {
+            out += ch;
+            escaped = true;
+            continue;
+        }
+        if (ch === '"') {
+            inString = !inString;
+            out += ch;
+            continue;
+        }
+        if (inString) {
+            if (ch === "\n") {
+                out += "\\n";
+                continue;
+            }
+            if (ch === "\r") {
+                out += "\\r";
+                continue;
+            }
+            if (ch === "\t") {
+                out += "\\t";
+                continue;
+            }
+        }
+        out += ch;
+    }
+    return out;
 }
 /** Parse a possibly-fenced JSON response. Returns undefined if invalid. */
 export function parseJsonResponse(raw) {

package/dist/llm/graph-extract.js

@@ -26,8 +26,6 @@ const MAX_BODY_CHARS = 4000;
 const MAX_ENTITIES_PER_ASSET = 32;
 /** Hard cap on relations returned per asset. */
 const MAX_RELATIONS_PER_ASSET = 32;
-/** Hard timeout for the LLM call; an `akm index` run must not hang on a misbehaving endpoint. */
-const LLM_TIMEOUT_MS = 30_000;
 const SYSTEM_PROMPT = "You extract a knowledge graph from developer notes. Return only valid JSON. " + "No prose, no markdown fences.";
 const USER_PROMPT_PREFIX = `Extract entities and relations from the asset body below.
 
@@ -61,9 +59,9 @@ export async function extractGraphFromBody(llmConfig, body, signal) {
             chatCompletion(llmConfig, [
                 { role: "system", content: SYSTEM_PROMPT },
                 { role: "user", content: userPrompt },
-            ], { maxTokens: 1024, temperature: 0.1, signal }),
+            ], { maxTokens: 1024, temperature: 0.1, timeoutMs: llmConfig.timeoutMs ?? 120_000, signal }),
             new Promise((_, reject) => {
-                timeoutHandle = setTimeout(() => reject(new Error("graph extraction timed out")), LLM_TIMEOUT_MS);
+                timeoutHandle = setTimeout(() => reject(new Error("graph extraction timed out")), llmConfig.timeoutMs ?? 120_000);
             }),
         ]);
         if (!raw)

package/dist/llm/memory-infer.js

@@ -20,8 +20,6 @@ import { warn } from "../core/warn";
 import { chatCompletion, parseEmbeddedJsonResponse } from "./client";
 /** Hard cap on body chars sent to the model — pragmatic and matches `runLlmEnrich`. */
 const MAX_BODY_CHARS = 4000;
-/** Hard timeout for the LLM call. The index run must not hang on a misbehaving endpoint. */
-const LLM_TIMEOUT_MS = 30_000;
 const SYSTEM_PROMPT = "You compress a developer memory into one high-signal derived memory for later retrieval. " +
     "Return only valid JSON. No prose outside the JSON object. No markdown fences.";
 const USER_PROMPT_PREFIX = `Compress the memory below into one concise, information-dense derived memory.
@@ -68,9 +66,14 @@ export async function compressMemoryToDerivedMemory(llmConfig, body, signal) {
             chatCompletion(llmConfig, [
                 { role: "system", content: SYSTEM_PROMPT },
                 { role: "user", content: userPrompt },
-            ], { maxTokens: 768, temperature: 0.1, signal }),
+            ], {
+                maxTokens: llmConfig.maxTokens ?? 4096,
+                temperature: 0.1,
+                timeoutMs: llmConfig.timeoutMs ?? 120_000,
+                signal,
+            }),
             new Promise((_, reject) => {
-                timeoutHandle = setTimeout(() => reject(new Error("memory inference timed out")), LLM_TIMEOUT_MS);
+                timeoutHandle = setTimeout(() => reject(new Error("memory inference timed out")), llmConfig.timeoutMs ?? 120_000);
             }),
         ]);
         if (!raw)

package/dist/output/cli-hints.js

@@ -24,6 +24,10 @@ For workflow tasks:
 2. Do the step work in your workspace
 3. \`akm workflow complete <run-id> --step <step-id>\` — mark done, get next step
 
+Workflow runs are scoped to your current project/worktree/directory. Ref-based
+commands like \`workflow next workflow:<name>\`, \`workflow status workflow:<name>\`,
+and \`workflow list\` operate within the current scope only.
+
 ## Quick Reference
 
 \`\`\`sh
@@ -55,7 +59,7 @@ akm registry search "<query>"                 # Search all registries
 | knowledge | A reference doc (use \`toc\` or \`section "..."\` to navigate) |
 | workflow | Parsed steps plus workflow-specific execution commands |
 | memory | Recalled context (read the content for background information) |
-| vault | Key names only; use vault commands to inspect or load values safely |
+| vault | Key names only; use \`akm vault path\` or \`akm vault run\` to use values safely |
 | wiki | A page in a multi-wiki knowledge base. For any wiki task, start with \`akm wiki list\`, then \`akm wiki ingest <name>\` for the workflow. Run \`akm wiki -h\` for the full surface. |
 
 When an asset meaningfully helps or fails, record that with \`akm feedback\` so
@@ -186,24 +190,29 @@ akm vault create prod                         # Create a new vault
 akm vault set prod DB_URL postgres://...      # Set a key (or KEY=VALUE combined form)
 akm vault set prod DB_URL=postgres://...      # Combined KEY=VALUE form also works
 akm vault unset prod DB_URL                   # Remove a key
-akm vault list vault:prod                     # List key names (no values)
-akm vault show vault:prod                     # Same as list (alias)
-akm vault load vault:prod                     # Print export statements to source
+akm vault list                                # List all vaults across all stashes with key names
+akm vault path vault:prod                     # Print the vault file path for shell loading
+akm vault run vault:prod -- env               # Run one command with all vault vars injected
+akm vault run vault:prod/DB_URL -- printenv DB_URL # Inject one key for one command
 \`\`\`
 
 ## Workflows
 
 Step-based workflows stored as \`<stashDir>/workflows/<name>.md\`.
 
+Ref-based workflow commands are scoped to the current project/worktree/directory,
+so one active run does not block unrelated directories from starting the same
+workflow. Direct run-id commands still target the exact run.
+
 \`\`\`sh
 akm workflow template                         # Print a starter workflow template
 akm workflow create ship-release             # Scaffold a new workflow asset
-akm workflow start workflow:ship-release     # Start a new run
-akm workflow next workflow:ship-release      # Advance to the next step (or auto-start)
+akm workflow start workflow:ship-release     # Start a new run in the current scope
+akm workflow next workflow:ship-release      # Advance to the next step (or auto-start) in the current scope
 akm workflow complete <run-id>               # Mark a step complete and advance
-akm workflow status <run-id>                 # Show current run status
+akm workflow status <run-id>                 # Show the exact run by id
 akm workflow resume <run-id>                 # Resume a blocked or failed run
-akm workflow list                            # List all workflow runs
+akm workflow list                            # List workflow runs in the current scope
 \`\`\`
 
 ## Clone

package/dist/output/renderers.js

@@ -563,12 +563,17 @@ const vaultEnvRenderer = {
             type: "vault",
             name,
             path: ctx.absPath,
-            action: 'Vault — keys + comments only. Use `eval "$(akm vault load <ref>)"` to load values into the current shell. Values stay on disk and are never written to akm\'s stdout.',
+            action: 'Vault — keys + comments only. Use `source "$(akm vault path <ref>)"` to load values into the current shell, or `akm vault run <ref[/KEY]> -- <command>` to run with injected env. Values stay on disk and are never written to akm\'s stdout.',
             description: comments.length > 0 ? comments.join("\n") : undefined,
             keys,
             comments,
         };
     },
+    enrichSearchHit(hit, _stashDir) {
+        const { keys } = listVaultKeys(hit.path);
+        if (keys.length > 0)
+            hit.keys = keys;
+    },
     extractMetadata(entry, ctx) {
         // Re-derive from the file directly to guarantee no value ever transits
         // through any other code path. Caller already short-circuits in

package/dist/output/shapes.js

@@ -407,19 +407,22 @@ export function shapeSearchHit(hit, detail) {
     // `ref` is included at `brief` so agents can run `akm show <ref>` without
     // needing --detail full or --for-agent (REC-03).
     if (detail === "brief")
-        return pickFields(hit, ["type", "name", "ref", "action", "estimatedTokens"]);
+        return pickFields(hit, ["type", "name", "ref", "action", "estimatedTokens", "keys"]);
     if (detail === "normal") {
         // `warnings` is projected at `normal` so non-fatal hit-level issues are
         // visible without forcing callers up to `--detail full`. Optional
         // `quality` (v1 spec §4.2) is also surfaced when present so callers
         // can see why a `proposed` entry showed up under `--include-proposed`.
-        return capDescription(pickFields(hit, ["type", "name", "description", "action", "score", "estimatedTokens", "warnings", "quality"]), NORMAL_DESCRIPTION_LIMIT);
+        const shaped = capDescription(pickFields(hit, ["type", "name", "description", "action", "score", "estimatedTokens", "warnings", "quality"]), NORMAL_DESCRIPTION_LIMIT);
+        if (Array.isArray(hit.keys) && hit.keys.length > 0)
+            shaped.keys = hit.keys;
+        return shaped;
     }
     return hit;
 }
 /** Agent-optimized search hit: only fields an LLM agent needs to decide and act */
 export function shapeSearchHitForAgent(hit) {
-    const picked = pickFields(hit, ["name", "ref", "type", "description", "action", "score", "estimatedTokens"]);
+    const picked = pickFields(hit, ["name", "ref", "type", "description", "action", "score", "estimatedTokens", "keys"]);
     return capDescription(picked, NORMAL_DESCRIPTION_LIMIT);
 }
 export function capDescription(hit, limit) {
@@ -449,6 +452,7 @@ export function shapeShowOutput(result, detail, forAgent = false) {
             "run",
             "setup",
             "cwd",
+            "activeRun",
             "toolPolicy",
             "modelHint",
             "agent",
@@ -495,6 +499,7 @@ export function shapeShowOutput(result, detail, forAgent = false) {
         "run",
         "setup",
         "cwd",
+        "activeRun",
         "keys",
         "comments",
         // path and editable are always projected so JSON consumers can locate and

package/dist/output/text.js

@@ -404,22 +404,7 @@ export function formatRegistryBuildIndexPlain(r) {
     return `Wrote registry index ${version} (${total} kits) → ${outPath}`.replace(/\s+/g, " ").trim();
 }
 export function formatVaultListPlain(r) {
-    // Single-vault listing: { ref, path, entries: [{ key, comment? }, ...] }
-    if (typeof r.ref === "string" && Array.isArray(r.entries)) {
-        const ref = r.ref;
-        const entries = r.entries;
-        if (entries.length === 0) {
-            return `No keys in ${ref}. Set one with \`akm vault set ${ref} KEY=VALUE\`.`;
-        }
-        const lines = [ref];
-        for (const e of entries) {
-            const key = String(e.key ?? "?");
-            const comment = typeof e.comment === "string" && e.comment ? `  # ${e.comment}` : "";
-            lines.push(`  ${key}${comment}`);
-        }
-        return lines.join("\n");
-    }
-    // Multi-vault listing: { vaults: [{ ref, path, keyCount }, ...] }
+    // Multi-vault listing: { vaults: [{ ref, path, keys }, ...] }
     const vaults = Array.isArray(r.vaults) ? r.vaults : [];
     if (vaults.length === 0) {
         return "No vaults. Create one with `akm vault create <name>` then `akm vault set vault:<name> KEY=VALUE`.";
@@ -427,8 +412,17 @@ export function formatVaultListPlain(r) {
     const lines = [];
     for (const v of vaults) {
         const ref = String(v.ref ?? "?");
-        const keyCount = typeof v.keyCount === "number" ? v.keyCount : 0;
-        lines.push(`${ref}\t${keyCount} key(s)`);
+        const keys = Array.isArray(v.keys) ? v.keys.map(String) : [];
+        if (lines.length > 0)
+            lines.push("");
+        lines.push(`## ${ref}`);
+        if (keys.length === 0) {
+            lines.push("- (no keys)");
+            continue;
+        }
+        for (const key of keys) {
+            lines.push(`- ${key}`);
+        }
     }
     return lines.join("\n");
 }
@@ -795,7 +789,7 @@ function isCommandOutputSkill(lines) {
 export function formatWorkflowListPlain(result) {
     const runs = Array.isArray(result.runs) ? result.runs : [];
     if (runs.length === 0) {
-        return "No workflow runs. Start one with `akm workflow next workflow:<name>` or author one with `akm workflow create <name>`.";
+        return "No workflow runs in the current working scope. Start one with `akm workflow next workflow:<name>` or author one with `akm workflow create <name>`.";
     }
     return runs
         .map((run) => {
@@ -906,6 +900,8 @@ export function formatSearchPlain(r, detail) {
             lines.push(`  ref: ${String(hit.ref)}`);
         if (hit.origin !== undefined)
             lines.push(`  origin: ${String(hit.origin)}`);
+        if (Array.isArray(hit.keys) && hit.keys.length > 0)
+            lines.push(`  keys: ${hit.keys.join(", ")}`);
         if (hit.size)
             lines.push(`  size: ${String(hit.size)}`);
         if (hit.action)
@@ -1088,6 +1084,9 @@ export function formatCuratePlain(r, detail) {
             lines.push(`  ref: ${String(item.ref)}`);
         if (item.id)
             lines.push(`  id: ${String(item.id)}`);
+        if (Array.isArray(item.keys) && item.keys.length > 0) {
+            lines.push(`  keys: ${item.keys.join(", ")}`);
+        }
         if (Array.isArray(item.parameters) && item.parameters.length > 0) {
             lines.push(`  parameters: ${item.parameters.join(", ")}`);
         }

package/dist/sources/providers/git.js

@@ -407,7 +407,7 @@ export function saveGitStash(name, message, writableOverride) {
     let writable = false;
     if (name) {
         const config = loadConfig();
-        const stash = (config.sources ?? config.stashes ?? []).find((s) => s.name === name || s.url === name);
+        const stash = findGitStashByTarget(config.sources ?? config.stashes ?? [], name);
         if (!stash)
             throw new UsageError(`No git stash found with name "${name}"`);
         if (!GIT_STASH_TYPES.has(stash.type)) {
@@ -468,5 +468,47 @@ export function saveGitStash(name, message, writableOverride) {
         output: (commitResult.stdout + pushResult.stdout).trim() || "changes committed and pushed",
     };
 }
+function findGitStashByTarget(stashes, target) {
+    return stashes.find((stash) => matchesGitStashTarget(stash, target));
+}
+function matchesGitStashTarget(stash, target) {
+    if (!GIT_STASH_TYPES.has(stash.type))
+        return false;
+    if (stash.name === target || stash.url === target)
+        return true;
+    if (!stash.url)
+        return false;
+    try {
+        const repo = parseGitRepoUrl(stash.url);
+        if (repo.canonicalUrl === target)
+            return true;
+        return buildGithubTargetAliases(repo.canonicalUrl).has(target);
+    }
+    catch {
+        return false;
+    }
+}
+function buildGithubTargetAliases(canonicalUrl) {
+    try {
+        const parsed = new URL(canonicalUrl);
+        if (parsed.hostname !== "github.com")
+            return new Set();
+        const segments = parsed.pathname.split("/").filter(Boolean);
+        if (segments.length < 2)
+            return new Set();
+        const owner = segments[0];
+        const repo = segments[1];
+        const aliases = new Set([`${owner}/${repo}`, `github:${owner}/${repo}`]);
+        if (segments[2] === "tree" && segments.length >= 4) {
+            const ref = segments.slice(3).join("/");
+            aliases.add(`${owner}/${repo}#${ref}`);
+            aliases.add(`github:${owner}/${repo}#${ref}`);
+        }
+        return aliases;
+    }
+    catch {
+        return new Set();
+    }
+}
 // ── Exports ─────────────────────────────────────────────────────────────────
 export { ensureGitMirror, GitSourceProvider, getCachePaths, parseGitRepoUrl };

package/dist/workflows/db.js

@@ -21,6 +21,7 @@ function ensureWorkflowSchema(db) {
     CREATE TABLE IF NOT EXISTS workflow_runs (
       id                TEXT PRIMARY KEY,
       workflow_ref      TEXT NOT NULL,
+      scope_key         TEXT,
       workflow_entry_id INTEGER,
       workflow_title    TEXT NOT NULL,
       status            TEXT NOT NULL CHECK (status IN ('active', 'completed', 'blocked', 'failed')),
@@ -52,4 +53,12 @@ function ensureWorkflowSchema(db) {
     CREATE INDEX IF NOT EXISTS idx_workflow_run_steps_run_sequence
       ON workflow_run_steps(run_id, sequence_index);
   `);
+    const columns = db
+        .query("PRAGMA table_info(workflow_runs)")
+        .all()
+        .map((column) => column.name);
+    if (!columns.includes("scope_key")) {
+        db.exec("ALTER TABLE workflow_runs ADD COLUMN scope_key TEXT");
+    }
+    db.exec("CREATE INDEX IF NOT EXISTS idx_workflow_runs_scope_ref_status ON workflow_runs(scope_key, workflow_ref, status)");
 }