akm-cli 0.9.0-beta.50 → 0.9.0-beta.52

package/CHANGELOG.md

@@ -6,6 +6,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.9.0] — 2026-06-30
+
 ### Fixed
 
 - **improve/recombine: cap-aware decay — the `maxClustersPerRun` cap no longer

package/README.md

@@ -7,8 +7,8 @@
 [![license](https://img.shields.io/github/license/itlackey/akm)](https://github.com/itlackey/akm/blob/main/LICENSE)
 
 `akm` is a package manager for AI agent capabilities -- scripts, skills, commands,
-agents, knowledge, memories, workflows, wikis, vaults, lessons, and scheduled
-tasks. It works with any AI coding assistant that can run shell commands,
+agents, knowledge, memories, workflows, wikis, env files, secrets, lessons, and
+scheduled tasks. It works with any AI coding assistant that can run shell commands,
 including [Claude Code](https://claude.ai/code),
 [OpenCode](https://opencode.ai), [Cursor](https://cursor.com), and more.
 
@@ -30,9 +30,17 @@ irm https://github.com/itlackey/akm/releases/latest/download/install.ps1 | iex
 bun install -g akm-cli
 ```
 
+**Option 3 — Node.js (requires Node.js >= 20.12):**
+
+```sh
+npm install -g akm-cli
+```
+
 Upgrade in place with `akm upgrade`.
 
-> **AKM 0.8 requires the prebuilt binary or the Bun runtime. Node.js / npm / pnpm are not supported in 0.8.0** — running `npm install -g akm-cli` on a Node.js-only machine will print an error from the preinstall hook and exit without installing. Cross-runtime support (Node, npm, pnpm) is planned for 0.9.0.
+> **AKM 0.9.0 supports three install paths:** prebuilt binary, Bun, or Node.js >= 20.12.
+> The old `vault` asset type was removed in 0.9.0; use `env` for whole `.env`
+> groups and `secret` for standalone sensitive values.
 
 ## Quick Start
 
@@ -59,7 +67,7 @@ Add this to your `AGENTS.md`, `CLAUDE.md`, or system prompt:
 ## Resources & Capabilities
 
 You have access to a searchable library of scripts, skills, commands, agents,
-knowledge, memories, workflows, wikis, vaults, lessons, and scheduled tasks
+knowledge, memories, workflows, wikis, env files, secrets, lessons, and scheduled tasks
 via the `akm` CLI. Use `akm -h` for details.
 ```
 

package/dist/akm

@@ -0,0 +1,38 @@
+#!/bin/sh
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+case "$0" in
+	*/*) SCRIPT_PATH=$0 ;;
+	*)
+		SCRIPT_PATH=$(command -v -- "$0" 2>/dev/null || true)
+		if [ -z "$SCRIPT_PATH" ]; then
+			echo "akm launcher could not resolve its own path." >&2
+			exit 127
+		fi
+		;;
+esac
+
+if command -v readlink >/dev/null 2>&1; then
+	while [ -L "$SCRIPT_PATH" ]; do
+		LINK_TARGET=$(readlink "$SCRIPT_PATH")
+		case "$LINK_TARGET" in
+			/*) SCRIPT_PATH=$LINK_TARGET ;;
+			*) SCRIPT_PATH=${SCRIPT_PATH%/*}/$LINK_TARGET ;;
+		esac
+	done
+fi
+
+SCRIPT_DIR=$(CDPATH= cd -- "${SCRIPT_PATH%/*}" && pwd)
+
+if command -v bun >/dev/null 2>&1; then
+	exec bun "$SCRIPT_DIR/cli.js" "$@"
+fi
+
+if command -v node >/dev/null 2>&1; then
+	exec node "$SCRIPT_DIR/cli-node.mjs" "$@"
+fi
+
+echo "akm requires Bun or Node.js >= 20.12.0 on PATH." >&2
+exit 127

package/dist/akm-migrate-storage

@@ -0,0 +1,38 @@
+#!/bin/sh
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+case "$0" in
+	*/*) SCRIPT_PATH=$0 ;;
+	*)
+		SCRIPT_PATH=$(command -v -- "$0" 2>/dev/null || true)
+		if [ -z "$SCRIPT_PATH" ]; then
+			echo "akm-migrate-storage launcher could not resolve its own path." >&2
+			exit 127
+		fi
+		;;
+esac
+
+if command -v readlink >/dev/null 2>&1; then
+	while [ -L "$SCRIPT_PATH" ]; do
+		LINK_TARGET=$(readlink "$SCRIPT_PATH")
+		case "$LINK_TARGET" in
+			/*) SCRIPT_PATH=$LINK_TARGET ;;
+			*) SCRIPT_PATH=${SCRIPT_PATH%/*}/$LINK_TARGET ;;
+		esac
+	done
+fi
+
+SCRIPT_DIR=$(CDPATH= cd -- "${SCRIPT_PATH%/*}" && pwd)
+
+if command -v bun >/dev/null 2>&1; then
+	exec bun "$SCRIPT_DIR/scripts/migrate-storage.js" "$@"
+fi
+
+if command -v node >/dev/null 2>&1; then
+	exec node "$SCRIPT_DIR/migrate-storage-node.mjs" "$@"
+fi
+
+echo "akm-migrate-storage requires Bun or Node.js >= 20.12.0 on PATH." >&2
+exit 127

package/dist/assets/wiki/ingest-workflow-template.md

@@ -20,16 +20,36 @@ empty and the caller explicitly asked for interactive ingest.
    ```
    Focus on `uncited-raw` findings: those raw files exist under `raw/` but are
    not yet cited by any authored page. Treat each `uncited-raw` finding as a
-   pending ingest item. If there are no `uncited-raw` findings, exit cleanly
-   after a final `akm index` + `akm wiki lint {{WIKI_NAME}}` verification.
+   pending ingest item, and sort the queue **oldest raw file first** (by
+   filename/mtime). Processing oldest-first keeps backlog age bounded even
+   when the queue is larger than one run can finish. If there are no
+   `uncited-raw` findings, exit cleanly after a final `akm index` +
+   `akm wiki lint {{WIKI_NAME}}` verification.
 
-3. **For each pending raw file, read the source and find related pages.**
-   Open the raw file directly from `{{WIKI_DIR}}/raw/`, then search:
+   Do not read or classify the whole backlog upfront. Work the queue as a
+   bounded loop, one raw file at a time: fully finish a raw (read → decide →
+   edit → log entry, steps 3-7 below) before looking at the next one. If you
+   run low on time partway through a large backlog, stop after finishing your
+   current raw — do not start a new one you can't complete. This is expected
+   and fine: whatever you already merged is committed to the pages and
+   `log.md`, so the next scheduled run picks up where you left off instead of
+   redoing this run's work.
+
+3. **For the current raw file, read the source and find related pages.**
+   Open the raw file directly from `{{WIKI_DIR}}/raw/`.
+
+   If the file does not read as text (binary content, garbled bytes, e.g. a
+   raw PDF byte-dump that was never text-extracted), do not attempt deep
+   forensic recovery (no web searches, no `strings`-style dumps). Append a
+   one-line `log.md` entry noting it as skipped/unprocessable with a short
+   reason, then move on to the next raw in the queue.
+
+   Otherwise, search for related pages:
    ```sh
    akm wiki search {{WIKI_NAME}} "<key terms from the raw source>"
    ```
-   Read the top hits with `akm show wiki:{{WIKI_NAME}}/<page>`. Use
-   `akm show wiki:{{WIKI_NAME}}/<page> toc` for large pages.
+   Read the top hits with `akm show wiki:{{WIKI_NAME}}/pages/<page>`. Use
+   `akm show wiki:{{WIKI_NAME}}/pages/<page> toc` for large pages.
 
 4. **Decide for each candidate.** For each related page:
    - **Append**: add a section or paragraph under the relevant heading.
@@ -38,16 +58,18 @@ empty and the caller explicitly asked for interactive ingest.
      Follow the schema's contradiction policy.
    - **Skip**: source doesn't add to this page — move on.
 
-5. **Create new pages for concepts/entities the source introduces.** Each
-   new page must have frontmatter with `description`, `pageKind`,
-   `xrefs`, and `sources`. Cross-reference with related pages both
-   directions.
+5. **Create new pages for concepts/entities the source introduces**, under
+   `{{WIKI_DIR}}/pages/` (never at the wiki root — only `schema.md`,
+   `index.md`, and `log.md` belong there). Each new page must have
+   frontmatter with `description`, `pageKind`, `xrefs`, and `sources`.
+   Cross-reference with related pages both directions.
 
 6. **Update xrefs both ways.** If page A now xrefs page B, page B must xref
    page A. `akm wiki lint {{WIKI_NAME}}` will flag violations.
 
-7. **Append to `log.md`.** One entry per ingested raw source: date, raw slug,
-   one-line summary, refs to created/edited pages. Newest at the top.
+7. **Append to `log.md`.** One entry per processed raw source (ingested or
+   skipped-as-unprocessable): date, raw slug, one-line summary, refs to
+   created/edited pages. Newest at the top.
 
 8. **Regenerate the index + verify.**
    ```sh

package/dist/assets/wiki/schema-template.md

@@ -8,7 +8,7 @@ wikiRole: schema
 This wiki follows the three-layer pattern:
 
 - `raw/` — immutable ingested sources (never edit)
-- `<page>.md` and `<topic>/<page>.md` — agent-authored pages
+- `pages/<page>.md` and `pages/<topic>/<page>.md` — agent-authored pages
 - `schema.md` (this file), `index.md`, `log.md` — wiki-level metadata
 
 ## Page frontmatter
@@ -20,7 +20,7 @@ Every page should carry frontmatter so akm can index and link it:
 description: one-sentence summary used in search and lint
 pageKind: entity | concept | question | note | <your-custom-kind>
 xrefs:
-  - wiki:{{WIKI_NAME}}/other-page
+  - wiki:{{WIKI_NAME}}/pages/other-page
 sources:
   - raw/<slug>.md
 ---
@@ -36,14 +36,14 @@ will surface in `index.md` as new sections after the next `akm index` run.
 1. Copy the new source into `raw/` with `akm wiki stash {{WIKI_NAME}} <path>`.
 2. Find related pages: `akm wiki search {{WIKI_NAME}} "<terms>"`.
 3. For each related page: append a section, note a contradiction, or create a
-   new page. Update xrefs on both sides.
+   new page under `pages/`. Update xrefs on both sides.
 4. Cite the raw source in each touched page's `sources:` frontmatter.
 5. Append one entry to `log.md` describing what was assimilated.
 
 ### Query
 
 1. `akm wiki search {{WIKI_NAME}} "<question>"` — find candidate pages.
-2. `akm show wiki:{{WIKI_NAME}}/<page>` — read the top hits.
+2. `akm show wiki:{{WIKI_NAME}}/pages/<page>` — read the top hits.
 3. Compose the answer from the wiki; cite raw sources only when the wiki
    points at them.
 

package/dist/cli/parse-args.js

@@ -8,7 +8,52 @@
  * main CLI file focused on command definitions and routing.
  */
 import { UsageError } from "../core/errors.js";
-// ── Subcommand detection ─────────────────────────────────────────────────────
+function cittyComparableName(name) {
+    return name.replace(/[-_]+([a-zA-Z0-9])/g, (_match, char) => char.toUpperCase());
+}
+function toAliasArray(alias) {
+    if (Array.isArray(alias))
+        return alias;
+    return typeof alias === "string" ? [alias] : [];
+}
+function isCittyValueFlag(flag, argsDef) {
+    const name = flag.replace(/^-{1,2}/, "");
+    const normalized = cittyComparableName(name);
+    for (const [key, def] of Object.entries(argsDef)) {
+        if (def.type !== "string" && def.type !== "enum")
+            continue;
+        if (normalized === cittyComparableName(key))
+            return true;
+        if (toAliasArray(def.alias).includes(name))
+            return true;
+    }
+    return false;
+}
+/**
+ * Match citty's top-level subcommand scan (`findSubCommandIndex`).
+ *
+ * Citty does not assume `rawArgs[0]` is the command: global string flags may
+ * appear first and consume the following token. The CLI startup guard uses this
+ * to classify the requested command before any command handler can run.
+ */
+export function findCittyTopLevelCommandIndex(rawArgs, argsDef) {
+    for (let i = 0; i < rawArgs.length; i += 1) {
+        const arg = rawArgs[i];
+        if (arg === "--")
+            return -1;
+        if (arg.startsWith("-")) {
+            if (!arg.includes("=") && isCittyValueFlag(arg, argsDef))
+                i += 1;
+            continue;
+        }
+        return i;
+    }
+    return -1;
+}
+export function findCittyTopLevelCommand(rawArgs, argsDef) {
+    const index = findCittyTopLevelCommandIndex(rawArgs, argsDef);
+    return index >= 0 ? rawArgs[index] : undefined;
+}
 /**
  * Return true when `args._[0]` is a member of `validSet`.
  *

package/dist/cli.js

@@ -8,18 +8,21 @@
 // `dist/cli-node.mjs` wrapper, which registers the text-import loader hook
 // before this module graph loads; running `node dist/cli.js` directly still
 // works for code paths that touch no embedded text asset, but the wrapper is
-// the supported entry. The hard floor is Node 20: `@clack/core` (prompts) imports
+// the supported entry. The hard floor is Node 20.12: `@clack/core` (prompts) imports
 // `node:util`'s `styleText` (added in Node 20.12) — Node 18 (EOL) throws at import.
 {
     const isBun = typeof globalThis.Bun !== "undefined";
     if (!isBun) {
-        const major = Number.parseInt((process.versions.node ?? "0").split(".")[0], 10);
-        if (Number.isNaN(major) || major < 20) {
-            console.error("\n  ERROR: akm-cli requires the Bun runtime (https://bun.sh) or Node.js >= 20.\n" +
+        const [major = 0, minor = 0, patch = 0] = (process.versions.node ?? "0")
+            .split(".")
+            .map((part) => Number.parseInt(part, 10) || 0);
+        const nodeOk = major > 20 || (major === 20 && (minor > 12 || (minor === 12 && patch >= 0)));
+        if (!nodeOk) {
+            console.error("\n  ERROR: akm-cli requires the Bun runtime (https://bun.sh) or Node.js >= 20.12.\n" +
                 `  Detected Node.js ${process.versions.node ?? "unknown"}.\n` +
                 "  Install options:\n" +
                 "    1. Bun:    curl -fsSL https://bun.sh/install | bash  &&  bun install -g akm-cli\n" +
-                "    2. Node:   upgrade to Node.js 20 or newer (https://nodejs.org)\n" +
+                "    2. Node:   upgrade to Node.js 20.12 or newer (https://nodejs.org)\n" +
                 "    3. Binary: curl -fsSL https://github.com/itlackey/akm/releases/latest/download/install.sh | bash\n");
             process.exit(1);
         }
@@ -57,6 +60,7 @@ process.on("uncaughtException", (err) => {
 import fs from "node:fs";
 import path from "node:path";
 import { defineCommand, runMain } from "citty";
+import { findCittyTopLevelCommand } from "./cli/parse-args.js";
 import { EXIT_CODES, emitJsonError, output, parseAllFlagValues, runWithJsonErrors } from "./cli/shared.js";
 import { agentCommand, lintCommand, proposeCommand } from "./commands/agent/contribute-cli.js";
 import { generateBashCompletions, installBashCompletions } from "./commands/completions.js";
@@ -520,6 +524,7 @@ export const main = defineCommand({
         tasks: tasksCommand,
     },
 });
+const MAIN_TOP_LEVEL_ARGS = main.args;
 // ── Exit codes ──────────────────────────────────────────────────────────────
 // Canonical table lives in `src/cli/shared.ts` (EXIT_CODES). These aliases keep
 // the local call sites terse. EXIT_HEALTH_WARN (4) is the `akm health` "warn"
@@ -567,7 +572,8 @@ if (import.meta.main || process.env.AKM_NODE_ENTRY === "1") {
     // output-shaping time after the side effect has already happened. The
     // shape-registry gate in shapeForCommand() remains as defense-in-depth (and
     // covers the in-process test harness, which skips this startup block).
-    if (getOutputMode().shape === "summary" && process.argv[2] !== "show") {
+    const topLevelCommand = findCittyTopLevelCommand(process.argv.slice(2), MAIN_TOP_LEVEL_ARGS);
+    if (getOutputMode().shape === "summary" && topLevelCommand !== "show") {
         emitJsonError(new UsageError("'--shape summary' is only valid on 'akm show'.", "INVALID_SHAPE_VALUE"));
     }
     // One-time cleanup of stale 0.7.x index file at the old cache location.

package/dist/commands/config-cli.js

@@ -64,7 +64,10 @@ function rewriteKey(config, key) {
 // ── Public API ──────────────────────────────────────────────────────────────
 export function getConfigValue(config, key) {
     const k = rewriteKey(config, key);
-    return configGet(config, k);
+    const value = configGet(config, k);
+    if (k.split(".").at(-1) === "apiKey")
+        return null;
+    return omitApiKeysForOutput(value);
 }
 export function setConfigValue(config, key, rawValue) {
     // #454: reject the legacy aliases up front so the error message names the
@@ -154,7 +157,20 @@ export function listConfig(config) {
         result.archiveRetentionDays = config.archiveRetentionDays;
     if (config.configVersion !== undefined)
         result.configVersion = config.configVersion;
-    return result;
+    return omitApiKeysForOutput(result);
+}
+function omitApiKeysForOutput(value) {
+    if (Array.isArray(value))
+        return value.map(omitApiKeysForOutput);
+    if (!value || typeof value !== "object")
+        return value;
+    const out = {};
+    for (const [key, child] of Object.entries(value)) {
+        if (key === "apiKey")
+            continue;
+        out[key] = omitApiKeysForOutput(child);
+    }
+    return out;
 }
 export { unknownKeyHint };
 // ── `akm config` command surface ────────────────────────────────────────────

package/dist/commands/env/child-env.js

@@ -0,0 +1,47 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+const CLEAN_ENV_ALLOWLIST = [
+    "HOME",
+    "PATH",
+    "PWD",
+    "SHELL",
+    "TERM",
+    "TMPDIR",
+    "TEMP",
+    "TMP",
+    "USER",
+    "LOGNAME",
+    "LANG",
+    "LANGUAGE",
+    "LC_ALL",
+    "LC_CTYPE",
+    "LC_COLLATE",
+    "LC_MESSAGES",
+    "LC_MONETARY",
+    "LC_NUMERIC",
+    "LC_TIME",
+    "LC_PAPER",
+    "LC_NAME",
+    "LC_ADDRESS",
+    "LC_TELEPHONE",
+    "LC_MEASUREMENT",
+    "LC_IDENTIFICATION",
+    "TZ",
+    "NO_COLOR",
+    "COLORTERM",
+];
+export function buildChildEnv(parentEnv, options) {
+    const base = options.clean ? {} : { ...parentEnv };
+    if (options.clean) {
+        for (const key of CLEAN_ENV_ALLOWLIST) {
+            if (parentEnv[key] !== undefined)
+                base[key] = parentEnv[key];
+        }
+    }
+    for (const key of options.inherit) {
+        if (parentEnv[key] !== undefined)
+            base[key] = parentEnv[key];
+    }
+    return base;
+}

package/dist/commands/env/env-cli.js

@@ -32,6 +32,7 @@ import { isQuiet } from "../../core/warn.js";
 import { resolveSourceEntries } from "../../indexer/search/search-source.js";
 import { getHyphenatedArg, parseFlagValue } from "../../output/context.js";
 import { readStdin } from "../../runtime.js";
+import { buildChildEnv } from "./child-env.js";
 /**
  * Walk each stash's env files and return one entry per `.env` file, using the
  * env asset spec's canonical-name logic (e.g. `env/team/prod.env` →
@@ -297,7 +298,10 @@ async function runEnvInjected(target, opts) {
         }
         process.stderr.write(`warning: ${detail} Injecting anyway (first-party stash).\n`);
     }
-    const mergedEnv = { ...process.env };
+    const mergedEnv = buildChildEnv(process.env, {
+        clean: opts.clean === true,
+        inherit: opts.inherit ?? [],
+    });
     for (const [envKey, envValue] of Object.entries(envValues)) {
         mergedEnv[envKey] = envValue;
     }
@@ -341,7 +345,7 @@ const envRunCommand = defineCommand({
         name: "run",
         description: 
         // biome-ignore lint/suspicious/noTemplateCurlyInString: literal `${secret:NAME}` token syntax documented for users, not interpolation
-        "Run a command with the env file injected into its environment: `akm env run <ref> -- <command>`. Use `-- $SHELL` for an interactive session. Restrict which variables are injected with --only / --except. Values may embed `${secret:NAME}` tokens, replaced at run time with the sibling `secret:NAME` value from the same stash.",
+        "Run a command with the env file injected into its environment: `akm env run <ref> -- <command>`. Use `-- $SHELL` for an interactive session. Restrict which variables are injected with --only / --except. Values may embed `${secret:NAME}` tokens, replaced at run time with the sibling `secret:NAME` value from the same stash. Pass --clean to start the child with a minimal inherited environment instead of the full parent environment.",
     },
     args: {
         target: { type: "positional", description: "Env ref", required: true },
@@ -350,11 +354,22 @@ const envRunCommand = defineCommand({
             description: "Inject ONLY these keys (comma-separated). Mutually exclusive with --except.",
         },
         except: { type: "string", description: "Inject all keys EXCEPT these (comma-separated)." },
+        clean: {
+            type: "boolean",
+            description: "Start the child with a minimal inherited environment (PATH/HOME/locale/terminal basics) instead of the full parent environment.",
+            default: false,
+        },
+        inherit: {
+            type: "string",
+            description: "When used with --clean, also inherit these parent env vars (comma-separated). Ignored without --clean.",
+        },
     },
     run({ args }) {
         return runWithJsonErrors(() => runEnvInjected(args.target, {
             only: parseKeyListFlag(getHyphenatedArg(args, "only")),
             except: parseKeyListFlag(getHyphenatedArg(args, "except")),
+            clean: getHyphenatedArg(args, "clean") === true,
+            inherit: parseKeyListFlag(getHyphenatedArg(args, "inherit")) ?? [],
         }));
     },
 });

package/dist/commands/env/secret-cli.js

@@ -29,6 +29,16 @@ import { appendEvent } from "../../core/events.js";
 import { resolveSourceEntries } from "../../indexer/search/search-source.js";
 import { getHyphenatedArg } from "../../output/context.js";
 import { readStdin } from "../../runtime.js";
+import { buildChildEnv } from "./child-env.js";
+function parseKeyListFlag(raw) {
+    if (raw === undefined)
+        return undefined;
+    const keys = raw
+        .split(/[,\s]+/)
+        .map((k) => k.trim())
+        .filter(Boolean);
+    return keys.length > 0 ? keys : undefined;
+}
 /** Walk `secrets/` across all stashes, returning one entry per secret file. */
 function listSecretsRecursive() {
     const result = [];
@@ -152,11 +162,20 @@ const secretPathCommand = defineCommand({
 const secretRunCommand = defineCommand({
     meta: {
         name: "run",
-        description: "Run a command with a secret's value injected into an env var: `akm secret run <ref> <VAR> -- <command>`. The value is set as $VAR in the child process only.",
+        description: "Run a command with a secret's value injected into an env var: `akm secret run <ref> <VAR> -- <command>`. The value is set as $VAR in the child process only. Pass --clean to start the child with a minimal inherited environment instead of the full parent environment.",
     },
     args: {
         ref: { type: "positional", description: "Secret ref", required: true },
         var: { type: "positional", description: "Environment variable name to inject the value into", required: true },
+        clean: {
+            type: "boolean",
+            description: "Start the child with a minimal inherited environment (PATH/HOME/locale/terminal basics) instead of the full parent environment.",
+            default: false,
+        },
+        inherit: {
+            type: "string",
+            description: "When used with --clean, also inherit these parent env vars (comma-separated). Ignored without --clean.",
+        },
     },
     run({ args }) {
         return runWithJsonErrors(async () => {
@@ -181,7 +200,10 @@ const secretRunCommand = defineCommand({
                 throw new NotFoundError(`Secret not found: ${makeSecretRef(name, source)}`);
             }
             const { readValue } = await import("./secret.js");
-            const mergedEnv = { ...process.env };
+            const mergedEnv = buildChildEnv(process.env, {
+                clean: getHyphenatedArg(args, "clean") === true,
+                inherit: parseKeyListFlag(getHyphenatedArg(args, "inherit")) ?? [],
+            });
             mergedEnv[varName] = readValue(absPath).toString("utf8");
             // Audit trail: record access by ref + var name only — never the value.
             appendEvent({

package/dist/commands/health/checks.js

@@ -316,7 +316,7 @@ export const HEALTH_CHECKS = [
                 status: aa.validationFailed > 0 ? "warn" : "pass",
                 confidence: aa.promoted + aa.validationFailed > 0 ? "high" : "low",
                 message: aa.validationFailed > 0
-                    ? `${aa.validationFailed} proposal(s) passed confidence threshold but failed auto-accept validation (truncated description, invalid frontmatter, etc.) — they remain in the queue for manual review.`
+                    ? `${aa.validationFailed} auto-accept validation attempt(s) failed after passing the confidence threshold (truncated description, invalid frontmatter, etc.) — the affected proposals remain pending for manual review.`
                     : aa.promoted > 0
                         ? `Auto-accept healthy: ${aa.promoted} proposal(s) promoted, 0 validation failures.`
                         : "Auto-accept gate did not run (disabled or no proposals above threshold).",

package/dist/commands/improve/improve-auto-accept.js

@@ -5,7 +5,12 @@ import { loadConfig } from "../../core/config/config.js";
 import { appendEvent } from "../../core/events.js";
 import { getPhaseThreshold, withStateDb } from "../../core/state-db.js";
 import { info, warn } from "../../core/warn.js";
-import { promoteProposal, recordGateDecision } from "../proposal/validators/proposals.js";
+import { getProposal, promoteProposal, recordGateDecision } from "../proposal/validators/proposals.js";
+async function sha256Hex(input) {
+    const data = new TextEncoder().encode(input);
+    const digest = await crypto.subtle.digest("SHA-256", data);
+    return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
 /**
  * Derive a stable, low-cardinality reason bucket from an auto-accept promotion
  * error. `promoteProposal` throws a `validateProposal` report formatted as
@@ -36,7 +41,14 @@ function classifyPromoteFailure(err) {
  * @param promoteFn   Injectable override for `promoteProposal` (test seam).
  */
 export async function runAutoAcceptGate(candidates, cfg, promoteFn = promoteProposal) {
-    const result = { promoted: [], skipped: [], failed: [], failedByReason: {} };
+    const result = {
+        promoted: [],
+        skipped: [],
+        failed: [],
+        suppressed: [],
+        failedByReason: {},
+        failedBySource: {},
+    };
     // --- Guard: gate is disabled or context is incomplete ---
     if (cfg.dryRun || cfg.globalThreshold === undefined || !cfg.stashDir) {
         result.skipped = candidates.map((c) => c.proposalId);
@@ -70,6 +82,14 @@ export async function runAutoAcceptGate(candidates, cfg, promoteFn = promoteProp
     };
     for (const candidate of candidates) {
         const { proposalId, confidence } = candidate;
+        let currentProposal;
+        try {
+            currentProposal = cfg.stashDir ? getProposal(cfg.stashDir, proposalId) : undefined;
+        }
+        catch {
+            currentProposal = undefined;
+        }
+        const currentContentHash = currentProposal ? await sha256Hex(currentProposal.payload.content) : undefined;
         // Determine if this candidate is exploration-eligible: below-threshold
         // (would normally be deferred) but with a valid confidence score and budget
         // remaining. No-confidence candidates are never exploration-promoted.
@@ -90,6 +110,12 @@ export async function runAutoAcceptGate(candidates, cfg, promoteFn = promoteProp
         if (isExploration)
             explorationRemaining -= 1;
         const promoteReason = isExploration ? "exploration-budget" : "above-threshold";
+        if (currentProposal?.gateDecision?.outcome === "auto-rejected" &&
+            currentProposal.gateDecision.contentHash !== undefined &&
+            currentProposal.gateDecision.contentHash === currentContentHash) {
+            result.suppressed.push(proposalId);
+            continue;
+        }
         try {
             const promotion = await promoteFn(cfg.stashDir, resolvedConfig, proposalId, {}, undefined);
             stamp(promotion.proposal.id, {
@@ -97,6 +123,7 @@ export async function runAutoAcceptGate(candidates, cfg, promoteFn = promoteProp
                 reason: promoteReason,
                 confidence,
                 thresholds: { autoAccept: effectiveThreshold },
+                ...(currentContentHash !== undefined ? { contentHash: currentContentHash } : {}),
                 gate: gateLabel,
             });
             // Resolve the eligibilitySource: exploration-promoted proposals get
@@ -146,6 +173,7 @@ export async function runAutoAcceptGate(candidates, cfg, promoteFn = promoteProp
                 reason,
                 confidence,
                 thresholds: { autoAccept: effectiveThreshold },
+                ...(currentContentHash !== undefined ? { contentHash: currentContentHash } : {}),
                 gate: gateLabel,
             });
             // If exploration budget was consumed but promotion failed, restore the slot

package/dist/commands/improve/improve-cli.js

@@ -221,7 +221,7 @@ export const improveCommand = defineCommand({
             runRecorded = true; // Suppress any late signal-handler write — the success path owns the row now.
             if (primaryStashDir) {
                 try {
-                    writeImproveResultFile(primaryStashDir, runId, improveResult, startedAtIso);
+                    writeImproveResultFile(primaryStashDir, runId, improveResult, startedAtIso, profileArg ?? null);
                 }
                 catch (err) {
                     // Stderr warning on the failure path is preferable to crashing

package/dist/commands/improve/improve-result-file.js

@@ -72,8 +72,15 @@ export function relativeImproveResultPath(runId) {
  * dry-run column is indexed so productivity audits can filter cleanly
  * (closes the dry-run/real-run artifact-trap recorded in MEMORY.md
  * `feedback_akm_dryrun_artifact_trap`).
+ *
+ * @param profile - The `--profile` value passed to this invocation (e.g.
+ * `quick`, `reflect-distill`), or `null`/`undefined` when no profile was
+ * given. Mirrors {@link recordTerminatedImproveRun}'s `ctx.profile`
+ * convention so successful and terminated runs are equally queryable by
+ * profile. Previously hardcoded to `null` here, which meant only
+ * abnormally-terminated runs recorded their profile in state.db.
  */
-export function writeImproveResultFile(stashDir, runId, result, startedAt) {
+export function writeImproveResultFile(stashDir, runId, result, startedAt, profile) {
     withStateDb((db) => {
         const completedAt = new Date().toISOString();
         // startedAt is the ISO timestamp captured at process launch (passed from the
@@ -87,7 +94,7 @@ export function writeImproveResultFile(stashDir, runId, result, startedAt) {
             completedAt,
             stashDir,
             dryRun: Boolean(result.dryRun),
-            profile: null,
+            profile: profile ?? null,
             scopeMode: result.scope?.mode ?? "all",
             scopeValue: result.scope?.value ?? null,
             guidance: result.guidance ?? null,