akm-cli 0.9.0-beta.50 → 0.9.0-beta.52

package/dist/scripts/migrations/import-fs-improve-runs-to-db.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env bun
 // @bun
+import { createRequire } from "node:module";
 var __create = Object.create;
 var __getProtoOf = Object.getPrototypeOf;
 var __defProp = Object.defineProperty;
@@ -32,10 +33,10 @@ var __toESM = (mod, isNodeMode, target) => {
 };
 var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
-var __require = import.meta.require;
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // src/core/warn.ts
-import fs from "fs";
+import fs from "node:fs";
 function appendToLogFile(level, args) {
   if (!logFilePath)
     return;
@@ -67,14 +68,14 @@ var require_main = __commonJS((exports, module) => {
   var os = __require("os");
   var crypto = __require("crypto");
   var TIPS = [
-    "\u25C8 encrypted .env [www.dotenvx.com]",
-    "\u25C8 secrets for agents [www.dotenvx.com]",
-    "\u2301 auth for agents [www.vestauth.com]",
-    "\u2318 custom filepath { path: '/custom/path/.env' }",
-    "\u2318 enable debugging { debug: true }",
-    "\u2318 override existing { override: true }",
-    "\u2318 suppress logs { quiet: true }",
-    "\u2318 multiple files { path: ['.env.local', '.env'] }"
+    "◈ encrypted .env [www.dotenvx.com]",
+    "◈ secrets for agents [www.dotenvx.com]",
+    "⌁ auth for agents [www.vestauth.com]",
+    "⌘ custom filepath { path: '/custom/path/.env' }",
+    "⌘ enable debugging { debug: true }",
+    "⌘ override existing { override: true }",
+    "⌘ suppress logs { quiet: true }",
+    "⌘ multiple files { path: ['.env.local', '.env'] }"
   ];
   function _getRandomTip() {
     return TIPS[Math.floor(Math.random() * TIPS.length)];
@@ -141,13 +142,13 @@ var require_main = __commonJS((exports, module) => {
     return DotenvModule.parse(decrypted);
   }
   function _warn(message) {
-    console.error(`\u26A0 ${message}`);
+    console.error(`⚠ ${message}`);
   }
   function _debug(message) {
-    console.log(`\u2506 ${message}`);
+    console.log(`┆ ${message}`);
   }
   function _log(message) {
-    console.log(`\u25C7 ${message}`);
+    console.log(`◇ ${message}`);
   }
   function _dotenvKey(options) {
     if (options && options.DOTENV_KEY && options.DOTENV_KEY.length > 0) {
@@ -389,7 +390,7 @@ var init_errors = __esm(() => {
     EMBEDDING_NOT_CONFIGURED: 'Run `akm config set embedding \'{"endpoint":"...","model":"..."}\'` to enable embeddings.',
     LLM_NOT_CONFIGURED: 'Run `akm setup` or `akm config set profiles.llm.default \'{"endpoint":"...","model":"..."}\' to configure an LLM profile.',
     TEST_ISOLATION_MISSING: "Under bun test, when AKM_STASH_DIR is set you MUST also set XDG_DATA_HOME (or AKM_DATA_DIR) and XDG_STATE_HOME (or AKM_STATE_DIR) to temp directories so the test does not touch the developer's real ~/.local/share/akm or ~/.local/state/akm.",
-    SETUP_TMP_STASH_REFUSED: "Use a persistent directory, or set AKM_FORCE_SETUP_TMP_STASH=1 to opt in to a sandboxed setup (setup also pre-sets AKM_STASH_DIR so config and cache writes auto-isolate into $stashDir/.akm/ \u2014 host config is preserved).",
+    SETUP_TMP_STASH_REFUSED: "Use a persistent directory, or set AKM_FORCE_SETUP_TMP_STASH=1 to opt in to a sandboxed setup (setup also pre-sets AKM_STASH_DIR so config and cache writes auto-isolate into $stashDir/.akm/ — host config is preserved).",
     UNSAFE_STASH_DIR: "Choose a path inside your home directory (e.g. ~/akm) or another empty workspace. The stash directory cannot be the filesystem root, your home directory itself, or a sensitive system path like /etc, /var, ~/.config, or ~/.ssh."
   };
   USAGE_HINTS = {
@@ -438,7 +439,7 @@ var init_errors = __esm(() => {
 });
 
 // src/commands/env/env.ts
-import fs3 from "fs";
+import fs3 from "node:fs";
 function scanKeys(text) {
   const keys = [];
   const seen = new Set;
@@ -3909,15 +3910,15 @@ var require_errors = __commonJS((exports) => {
     let lineStr = src.substring(lc.lineStarts[line - 1], lc.lineStarts[line]).replace(/[\n\r]+$/, "");
     if (ci >= 60 && lineStr.length > 80) {
       const trimStart = Math.min(ci - 39, lineStr.length - 79);
-      lineStr = "\u2026" + lineStr.substring(trimStart);
+      lineStr = "…" + lineStr.substring(trimStart);
       ci -= trimStart - 1;
     }
     if (lineStr.length > 80)
-      lineStr = lineStr.substring(0, 79) + "\u2026";
+      lineStr = lineStr.substring(0, 79) + "…";
     if (line > 1 && /^ *$/.test(lineStr.substring(0, ci))) {
       let prev = src.substring(lc.lineStarts[line - 2], lc.lineStarts[line - 1]);
       if (prev.length > 80)
-        prev = prev.substring(0, 79) + `\u2026
+        prev = prev.substring(0, 79) + `…
 `;
       lineStr = prev + lineStr;
     }
@@ -4972,8 +4973,8 @@ var require_resolve_flow_scalar = __commonJS((exports) => {
     r: "\r",
     t: "\t",
     v: "\v",
-    N: "\x85",
-    _: "\xA0",
+    N: "…",
+    _: " ",
     L: "\u2028",
     P: "\u2029",
     " ": " ",
@@ -7583,7 +7584,7 @@ var init_metadata_contributors = __esm(() => {
 });
 
 // src/indexer/passes/metadata.ts
-import fs4 from "fs";
+import fs4 from "node:fs";
 function extractDescriptionFromComments(filePath) {
   let content;
   try {
@@ -8062,7 +8063,7 @@ function loadDocument(ctx) {
   const result = parseWorkflow(ctx.content(), { path: ctx.relPath });
   if (result.ok)
     return result.document;
-  const summary = result.errors.map((e) => `${ctx.relPath}:${e.line} \u2014 ${e.message}`).join(`
+  const summary = result.errors.map((e) => `${ctx.relPath}:${e.line} — ${e.message}`).join(`
 `);
   throw new UsageError(`Workflow has errors:
 ${summary}`);
@@ -8304,19 +8305,21 @@ var init_asset_registry = __esm(() => {
 });
 
 // src/core/asset/asset-spec.ts
-import path2 from "path";
+import path2 from "node:path";
+function toPosix2(input) {
+  return input.replace(/\\/g, "/");
+}
 function getAssetTypes() {
   return Object.keys(ASSET_SPECS_INTERNAL);
 }
 var buildTaskAction = (ref) => `akm tasks show ${ref.replace(/^task:/, "")} -> inspect; akm tasks run <id> -> run now; akm tasks remove <id> -> unschedule`, markdownSpec, SCRIPT_EXTENSIONS, scriptSpec, ASSET_SPECS_INTERNAL, TYPE_DIRS;
 var init_asset_spec = __esm(() => {
   init_renderers();
-  init_common();
   init_asset_registry();
   markdownSpec = {
     isRelevantFile: (fileName) => path2.extname(fileName).toLowerCase() === ".md",
     toCanonicalName: (typeRoot, filePath) => {
-      const rel = toPosix(path2.relative(typeRoot, filePath));
+      const rel = toPosix2(path2.relative(typeRoot, filePath));
       return rel.endsWith(".md") ? rel.slice(0, -3) : rel;
     },
     toAssetPath: (typeRoot, name) => {
@@ -8344,7 +8347,7 @@ var init_asset_spec = __esm(() => {
   ]);
   scriptSpec = {
     isRelevantFile: (fileName) => SCRIPT_EXTENSIONS.has(path2.extname(fileName).toLowerCase()),
-    toCanonicalName: (typeRoot, filePath) => toPosix(path2.relative(typeRoot, filePath)),
+    toCanonicalName: (typeRoot, filePath) => toPosix2(path2.relative(typeRoot, filePath)),
     toAssetPath: (typeRoot, name) => path2.join(typeRoot, name)
   };
   ASSET_SPECS_INTERNAL = {
@@ -8352,7 +8355,7 @@ var init_asset_spec = __esm(() => {
       stashDir: "skills",
       isRelevantFile: (fileName) => fileName === "SKILL.md",
       toCanonicalName: (typeRoot, filePath) => {
-        const relDir = toPosix(path2.dirname(path2.relative(typeRoot, filePath)));
+        const relDir = toPosix2(path2.dirname(path2.relative(typeRoot, filePath)));
         if (!relDir || relDir === ".")
           return;
         return relDir;
@@ -8374,7 +8377,7 @@ var init_asset_spec = __esm(() => {
       stashDir: "env",
       isRelevantFile: (fileName) => fileName === ".env" || fileName.endsWith(".env"),
       toCanonicalName: (typeRoot, filePath) => {
-        const rel = toPosix(path2.relative(typeRoot, filePath));
+        const rel = toPosix2(path2.relative(typeRoot, filePath));
         const fileName = path2.basename(rel);
         if (fileName === ".env") {
           const dir = path2.dirname(rel);
@@ -8389,12 +8392,12 @@ var init_asset_spec = __esm(() => {
         return path2.join(typeRoot, name.endsWith(".env") ? name : `${name}.env`);
       },
       rendererName: "env-file",
-      actionBuilder: (ref) => `akm show ${ref} -> inspect key names; akm env run ${ref} -- <command> -> run with the whole .env injected (values never reach stdout); akm env export ${ref} --out <file> -> write a sourceable script to a file`
+      actionBuilder: (ref) => `akm show ${ref} -> inspect key names; akm env run ${ref} -- <command> -> run with the whole .env injected (prefer --clean to minimize inherited parent env; child stdout is not redacted); akm env export ${ref} --out <file> -> write a sourceable script to a file`
     },
     secret: {
       stashDir: "secrets",
       isRelevantFile: (fileName) => !fileName.endsWith(".lock") && !fileName.endsWith(".sensitive"),
-      toCanonicalName: (typeRoot, filePath) => toPosix(path2.relative(typeRoot, filePath)),
+      toCanonicalName: (typeRoot, filePath) => toPosix2(path2.relative(typeRoot, filePath)),
       toAssetPath: (typeRoot, name) => path2.join(typeRoot, name),
       rendererName: "secret-file",
       actionBuilder: (ref) => `akm show ${ref} -> name only (value never shown); akm secret path ${ref} -> file path; akm secret run ${ref} <VAR> -- <command> -> run with value injected into $VAR`
@@ -8415,7 +8418,7 @@ var init_asset_spec = __esm(() => {
       stashDir: "tasks",
       isRelevantFile: (fileName) => path2.extname(fileName).toLowerCase() === ".yml",
       toCanonicalName: (typeRoot, filePath) => {
-        const rel = toPosix(path2.relative(typeRoot, filePath));
+        const rel = toPosix2(path2.relative(typeRoot, filePath));
         return rel.endsWith(".yml") ? rel.slice(0, -4) : rel;
       },
       toAssetPath: (typeRoot, name) => {
@@ -8442,9 +8445,6 @@ var init_asset_spec = __esm(() => {
 });
 
 // src/core/common.ts
-function toPosix(input) {
-  return input.replace(/\\/g, "/");
-}
 function asNonEmptyString(value) {
   if (typeof value !== "string")
     return;
@@ -8463,7 +8463,7 @@ var init_common = __esm(() => {
 });
 
 // src/core/paths.ts
-import path3 from "path";
+import path3 from "node:path";
 function isUnderBunTest(env) {
   return env.BUN_TEST === "1" || env.NODE_ENV === "test";
 }
@@ -8508,16 +8508,16 @@ import fs5 from "fs";
 import path5 from "path";
 
 // src/core/state-db.ts
-import path4 from "path";
+import path4 from "node:path";
 
 // src/storage/managed-db.ts
-import fs2 from "fs";
-import path from "path";
+import fs2 from "node:fs";
+import path from "node:path";
 
 // src/storage/database.ts
-import { createRequire } from "module";
+import { createRequire as createRequire2 } from "node:module";
 var isBun = !!process.versions?.bun;
-var nodeRequire = createRequire(import.meta.url);
+var nodeRequire = createRequire2(import.meta.url);
 var bunSqliteProvider = {
   name: "bun:sqlite",
   supported: () => isBun,
@@ -8567,9 +8567,9 @@ function loadBetterSqlite3() {
       mod = nodeRequire("better-sqlite3");
     } catch (err) {
       throw new Error(`akm could not load 'better-sqlite3', the SQLite driver it needs on Node.js.
-` + `  \u2022 Reinstall akm with a working C/C++ build toolchain so its optional
-` + "    'better-sqlite3' native binding rebuilds (a global `npm i -g better-sqlite3`\n" + `    will NOT be resolved \u2014 Node loads it from akm's own node_modules).
-` + `  \u2022 Or run akm under Bun, which has a built-in SQLite driver and needs no native build.
+` + `  • Reinstall akm with a working C/C++ build toolchain so its optional
+` + "    'better-sqlite3' native binding rebuilds (a global `npm i -g better-sqlite3`\n" + `    will NOT be resolved — Node loads it from akm's own node_modules).
+` + `  • Or run akm under Bun, which has a built-in SQLite driver and needs no native build.
 ` + `  Underlying load error: ${err instanceof Error ? err.message : String(err)}`);
     }
     betterSqlite3Ctor = mod.default ?? mod;
@@ -8591,10 +8591,10 @@ function openNodeDatabase(path, opts) {
 init_warn();
 
 // src/runtime.ts
-import { createWriteStream, statfsSync } from "fs";
-import { createRequire as createRequire2 } from "module";
+import { createWriteStream, statfsSync } from "node:fs";
+import { createRequire as createRequire3 } from "node:module";
 var isBun2 = !!process.versions?.bun;
-var nodeRequire2 = createRequire2(import.meta.url);
+var nodeRequire2 = createRequire3(import.meta.url);
 function statfsType(path) {
   try {
     return statfsSync(path).type;
@@ -8630,7 +8630,7 @@ function warnInvalidJournalModeOnce(raw) {
   if (warnedInvalid)
     return;
   warnedInvalid = true;
-  warn(`[akm] invalid AKM_SQLITE_JOURNAL_MODE=${JSON.stringify(raw)} \u2014 using WAL (valid: WAL, DELETE, TRUNCATE)`);
+  warn(`[akm] invalid AKM_SQLITE_JOURNAL_MODE=${JSON.stringify(raw)} — using WAL (valid: WAL, DELETE, TRUNCATE)`);
 }
 var FS_MAGIC_NFS = 26985;
 var FS_MAGIC_SMB = 20859;
@@ -8672,7 +8672,7 @@ function warnNetworkFallbackOnce(dataDir) {
   if (warnedNetworkFallback)
     return;
   warnedNetworkFallback = true;
-  warn(`[akm] network filesystem detected at ${dataDir} \u2014 WAL unsupported, using DELETE journal mode`);
+  warn(`[akm] network filesystem detected at ${dataDir} — WAL unsupported, using DELETE journal mode`);
 }
 
 // src/storage/managed-db.ts
@@ -8759,26 +8759,26 @@ var MIGRATIONS = [
   {
     id: "001-initial-schema",
     up: `
-      -- \u2500\u2500 events \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+      -- ── events ──────────────────────────────────────────────────────────────
       --
       -- Replaces events.jsonl. Indexed (query) columns:
-      --   id          INTEGER PK \u2014 monotonic rowid; replaces byte-offset cursor.
+      --   id          INTEGER PK — monotonic rowid; replaces byte-offset cursor.
       --                            Callers store this as "sinceId" for resume.
-      --   event_type  TEXT        \u2014 indexed; replaces the type filter in readEvents().
-      --   ts          TEXT        \u2014 ISO-8601 UTC ms; indexed for range queries.
-      --   ref         TEXT        \u2014 nullable asset ref; indexed for ref-scoped queries.
+      --   event_type  TEXT        — indexed; replaces the type filter in readEvents().
+      --   ts          TEXT        — ISO-8601 UTC ms; indexed for range queries.
+      --   ref         TEXT        — nullable asset ref; indexed for ref-scoped queries.
       --
       -- Extensible (metadata_json) columns:
-      --   metadata_json TEXT      \u2014 JSON object storing all non-indexed payload
+      --   metadata_json TEXT      — JSON object storing all non-indexed payload
       --                             fields (tags, any future structured fields).
       --                             Maps directly to EventEnvelope.metadata.
       --
-      -- schema_version mirrors EventEnvelope.schemaVersion \u2014 always 1 for v1
+      -- schema_version mirrors EventEnvelope.schemaVersion — always 1 for v1
       -- rows. Stored as a column (not in the JSON blob) so future schema
       -- changes can be detected and migrated row-by-row if ever needed.
       --
       -- TTL: rows where ts < NOW() - 90 days can be deleted by a maintenance job.
-      -- No automatic deletion occurs here \u2014 callers call purgeOldEvents().
+      -- No automatic deletion occurs here — callers call purgeOldEvents().
       --
       -- ADD COLUMN extension points (future migrations):
       --   ALTER TABLE events ADD COLUMN stash_dir TEXT DEFAULT NULL;
@@ -8794,38 +8794,38 @@ var MIGRATIONS = [
       );
 
       -- Query patterns supported by these indexes:
-      --   SELECT \u2026 WHERE event_type = ?                 \u2192 idx_events_type
-      --   SELECT \u2026 WHERE ref = ?                        \u2192 idx_events_ref
-      --   SELECT \u2026 WHERE ts >= ? AND ts <= ?            \u2192 idx_events_ts
-      --   SELECT \u2026 WHERE event_type = ? AND ref = ?     \u2192 idx_events_type (prefix scan) + filter
-      --   SELECT \u2026 WHERE id > ?                         \u2192 PK (rowid) \u2014 no extra index needed
+      --   SELECT … WHERE event_type = ?                 → idx_events_type
+      --   SELECT … WHERE ref = ?                        → idx_events_ref
+      --   SELECT … WHERE ts >= ? AND ts <= ?            → idx_events_ts
+      --   SELECT … WHERE event_type = ? AND ref = ?     → idx_events_type (prefix scan) + filter
+      --   SELECT … WHERE id > ?                         → PK (rowid) — no extra index needed
       CREATE INDEX IF NOT EXISTS idx_events_type ON events(event_type);
       CREATE INDEX IF NOT EXISTS idx_events_ref  ON events(ref);
       CREATE INDEX IF NOT EXISTS idx_events_ts   ON events(ts);
 
-      -- \u2500\u2500 proposals \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+      -- ── proposals ────────────────────────────────────────────────────────────
       --
       -- Replaces per-uuid JSON directories under <stashDir>/.akm/proposals/.
       --
       -- Indexed (query) columns:
-      --   id          TEXT PK     \u2014 UUID (crypto.randomUUID()); stable directory name.
-      --   stash_dir   TEXT        \u2014 absolute stash root; multi-stash installs need
+      --   id          TEXT PK     — UUID (crypto.randomUUID()); stable directory name.
+      --   stash_dir   TEXT        — absolute stash root; multi-stash installs need
       --                             this to partition proposal lists per stash.
-      --   ref         TEXT        \u2014 target asset ref (e.g. "lesson:alpha");
+      --   ref         TEXT        — target asset ref (e.g. "lesson:alpha");
       --                             indexed for ref-scoped queue views.
-      --   status      TEXT        \u2014 "pending" | "accepted" | "rejected"; indexed
+      --   status      TEXT        — "pending" | "accepted" | "rejected"; indexed
       --                             so pending-queue queries are fast.
-      --   source      TEXT        \u2014 human-readable origin tag (e.g. "reflect").
-      --   created_at  TEXT        \u2014 ISO-8601; used for ORDER BY created_at ASC.
-      --   updated_at  TEXT        \u2014 ISO-8601; updated on accept/reject.
+      --   source      TEXT        — human-readable origin tag (e.g. "reflect").
+      --   created_at  TEXT        — ISO-8601; used for ORDER BY created_at ASC.
+      --   updated_at  TEXT        — ISO-8601; updated on accept/reject.
       --
       -- Large payload columns (NOT indexed):
-      --   content     TEXT        \u2014 full markdown text; the proposal payload body.
-      --   frontmatter_json TEXT   \u2014 JSON of parsed frontmatter (may be NULL when
+      --   content     TEXT        — full markdown text; the proposal payload body.
+      --   frontmatter_json TEXT   — JSON of parsed frontmatter (may be NULL when
       --                             the content has no frontmatter block).
       --
       -- Extensible (metadata_json) columns:
-      --   metadata_json TEXT      \u2014 JSON object for future proposal fields.
+      --   metadata_json TEXT      — JSON object for future proposal fields.
       --                             Current fields stored here: sourceRun,
       --                             review, confidence, gateDecision (#577),
       --                             backupContent, eligibilitySource.
@@ -8851,38 +8851,38 @@ var MIGRATIONS = [
       );
 
       -- Query patterns:
-      --   SELECT \u2026 WHERE stash_dir = ? AND status = ?   \u2192 idx_proposals_stash_status
-      --   SELECT \u2026 WHERE ref = ? AND status = ?         \u2192 idx_proposals_ref_status
-      --   SELECT \u2026 WHERE id = ?                         \u2192 PK
+      --   SELECT … WHERE stash_dir = ? AND status = ?   → idx_proposals_stash_status
+      --   SELECT … WHERE ref = ? AND status = ?         → idx_proposals_ref_status
+      --   SELECT … WHERE id = ?                         → PK
       CREATE INDEX IF NOT EXISTS idx_proposals_stash_status
         ON proposals(stash_dir, status);
       CREATE INDEX IF NOT EXISTS idx_proposals_ref_status
         ON proposals(ref, status);
 
-      -- \u2500\u2500 task_history \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+      -- ── task_history ─────────────────────────────────────────────────────────
       --
       -- Replaces per-task JSONL files under <cacheDir>/tasks/history/.
       --
       -- Indexed (query) columns:
-      --   task_id     TEXT PK     \u2014 stable task identifier string.
-      --   status      TEXT        \u2014 terminal status (e.g. "completed", "failed",
+      --   task_id     TEXT PK     — stable task identifier string.
+      --   status      TEXT        — terminal status (e.g. "completed", "failed",
       --                             "cancelled"); indexed for status-scoped queries.
-      --   started_at  TEXT        \u2014 ISO-8601; indexed for time-range queries.
-      --   target_kind TEXT        \u2014 kind of the target entity (e.g. "issue",
+      --   started_at  TEXT        — ISO-8601; indexed for time-range queries.
+      --   target_kind TEXT        — kind of the target entity (e.g. "issue",
       --                             "workflow", "agent"); indexed for kind-scoped queries.
-      --   target_ref  TEXT        \u2014 stable ref of the target entity; indexed for
+      --   target_ref  TEXT        — stable ref of the target entity; indexed for
       --                             per-target history lookups.
       --
       -- Non-indexed time columns:
-      --   completed_at TEXT       \u2014 ISO-8601 or NULL if still running.
-      --   failed_at    TEXT       \u2014 ISO-8601 or NULL.
+      --   completed_at TEXT       — ISO-8601 or NULL if still running.
+      --   failed_at    TEXT       — ISO-8601 or NULL.
       --
       -- Non-indexed diagnostic columns:
-      --   log_path     TEXT       \u2014 absolute path to the task log file, if any.
+      --   log_path     TEXT       — absolute path to the task log file, if any.
       --
       -- Extensible (metadata_json) columns:
-      --   metadata_json TEXT      \u2014 JSON object for future task fields (exit_code,
-      --                             runner, priority, parent_task_id, \u2026).
+      --   metadata_json TEXT      — JSON object for future task fields (exit_code,
+      --                             runner, priority, parent_task_id, …).
       --
       -- ADD COLUMN extension points (future migrations):
       --   ALTER TABLE task_history ADD COLUMN exit_code INTEGER DEFAULT NULL;
@@ -8903,10 +8903,10 @@ var MIGRATIONS = [
       );
 
       -- Query patterns:
-      --   SELECT \u2026 WHERE task_id = ?                    \u2192 PK
-      --   SELECT \u2026 WHERE started_at >= ? AND started_at <= ? \u2192 idx_task_history_started
-      --   SELECT \u2026 WHERE target_kind = ? AND target_ref = ?  \u2192 idx_task_history_target
-      --   SELECT \u2026 WHERE status = ?                     \u2192 idx_task_history_status
+      --   SELECT … WHERE task_id = ?                    → PK
+      --   SELECT … WHERE started_at >= ? AND started_at <= ? → idx_task_history_started
+      --   SELECT … WHERE target_kind = ? AND target_ref = ?  → idx_task_history_target
+      --   SELECT … WHERE status = ?                     → idx_task_history_status
       CREATE INDEX IF NOT EXISTS idx_task_history_started
         ON task_history(started_at);
       CREATE INDEX IF NOT EXISTS idx_task_history_target
@@ -8975,12 +8975,12 @@ var MIGRATIONS = [
       );
 
       -- Query patterns supported:
-      --   SELECT \u2026 WHERE started_at >= ? AND started_at <= ?
-      --     \u2192 idx_improve_runs_started
-      --   SELECT \u2026 WHERE dry_run = 0
-      --     \u2192 idx_improve_runs_dry_run (productivity audits filter trap)
-      --   SELECT \u2026 WHERE stash_dir = ? AND scope_mode = ?
-      --     \u2192 idx_improve_runs_stash_scope
+      --   SELECT … WHERE started_at >= ? AND started_at <= ?
+      --     → idx_improve_runs_started
+      --   SELECT … WHERE dry_run = 0
+      --     → idx_improve_runs_dry_run (productivity audits filter trap)
+      --   SELECT … WHERE stash_dir = ? AND scope_mode = ?
+      --     → idx_improve_runs_stash_scope
       CREATE INDEX IF NOT EXISTS idx_improve_runs_started
         ON improve_runs(started_at);
       CREATE INDEX IF NOT EXISTS idx_improve_runs_dry_run
@@ -9007,9 +9007,9 @@ var MIGRATIONS = [
       );
 
       -- Query patterns:
-      --   SELECT \u2026 WHERE harness = ?                       \u2192 idx_extract_sessions_harness
-      --   SELECT \u2026 WHERE processed_at >= ?                 \u2192 idx_extract_sessions_processed
-      --   SELECT \u2026 WHERE harness = ? AND session_id = ?    \u2192 PK
+      --   SELECT … WHERE harness = ?                       → idx_extract_sessions_harness
+      --   SELECT … WHERE processed_at >= ?                 → idx_extract_sessions_processed
+      --   SELECT … WHERE harness = ? AND session_id = ?    → PK
       CREATE INDEX IF NOT EXISTS idx_extract_sessions_harness
         ON extract_sessions_seen(harness);
       CREATE INDEX IF NOT EXISTS idx_extract_sessions_processed

package/dist/sources/include.js

@@ -101,10 +101,14 @@ function copyDirectoryContents(sourceDir, destinationDir) {
     }
 }
 function copyPath(sourcePath, destinationPath) {
-    const stat = fs.statSync(sourcePath);
+    const stat = fs.lstatSync(sourcePath);
+    if (stat.isSymbolicLink()) {
+        throw new Error(`Path in akm.include must not be a symlink: ${sourcePath}`);
+    }
     fs.mkdirSync(path.dirname(destinationPath), { recursive: true });
     if (stat.isDirectory()) {
-        fs.cpSync(sourcePath, destinationPath, { recursive: true, force: true });
+        fs.mkdirSync(destinationPath, { recursive: true });
+        copyDirectoryContents(sourcePath, destinationPath);
         return;
     }
     fs.copyFileSync(sourcePath, destinationPath);

package/dist/sources/providers/git-install.js

@@ -174,33 +174,37 @@ export function cloneRepo(cloneUrl, ref, destDir, writable = false) {
  * and emit a message that names the cause and the fix.
  */
 export function classifyCloneFailure(url, stderr, spawnError) {
+    const safeUrl = redactUrlUserinfo(url);
     const raw = (stderr ?? "").trim();
     const spawnMsg = spawnError?.message ?? "";
     // `git` binary not on PATH.
     if (spawnError?.code === "ENOENT") {
-        return `Failed to clone ${url}: 'git' is not installed or not on PATH. Install git, then re-run.`;
+        return `Failed to clone ${safeUrl}: 'git' is not installed or not on PATH. Install git, then re-run.`;
     }
     // Auth-prompt fall-through (the headline #487 case).
     if (/could not read Username|terminal prompts disabled|Authentication failed|fatal: Authentication/i.test(raw)) {
-        return (`Failed to clone ${url}: repository not found or private. ` +
+        return (`Failed to clone ${safeUrl}: repository not found or private. ` +
             `If the repository is public, double-check the URL and try again. ` +
             `If it is private, set GH_TOKEN (or configure a git credential helper) before re-running.`);
     }
     // 404-style messages from git http.
     if (/repository '.*' not found|HTTP 404|fatal: remote error|not found:|Not Found/i.test(raw)) {
-        return (`Failed to clone ${url}: repository not found. ` +
+        return (`Failed to clone ${safeUrl}: repository not found. ` +
             `Check the URL — for GitHub, the form is 'owner/repo' or 'github:owner/repo'.`);
     }
     // SSH connection issues.
     if (/Permission denied \(publickey\)|kex_exchange_identification|Connection refused|Connection timed out/i.test(raw)) {
-        return (`Failed to clone ${url}: network or SSH failure. ` +
+        return (`Failed to clone ${safeUrl}: network or SSH failure. ` +
             `Check connectivity, your SSH agent, and the remote host's availability.`);
     }
     // Branch / ref-specific failures.
     if (/Remote branch .* not found in upstream origin|couldn't find remote ref/i.test(raw)) {
-        return (`Failed to clone ${url}: the requested branch/tag does not exist on the remote. ` +
+        return (`Failed to clone ${safeUrl}: the requested branch/tag does not exist on the remote. ` +
             `Verify the ref name and re-run.`);
     }
     const detail = raw || spawnMsg || "unknown error";
-    return `Failed to clone ${url}: ${detail}`;
+    return `Failed to clone ${safeUrl}: ${redactUrlUserinfo(detail)}`;
+}
+function redactUrlUserinfo(text) {
+    return text.replace(/\b([A-Za-z][A-Za-z0-9+.-]*:\/\/)([^\s/@]+)@/g, "$1[REDACTED]@");
 }

package/dist/sources/providers/provider-utils.js

@@ -91,14 +91,20 @@ export function copyDirectoryContents(sourceDir, destinationDir) {
             continue;
         const src = path.join(sourceDir, entry.name);
         const dest = path.join(destinationDir, entry.name);
-        fs.mkdirSync(path.dirname(dest), { recursive: true });
-        if (entry.isDirectory()) {
-            fs.cpSync(src, dest, { recursive: true, force: true });
-        }
-        else {
-            fs.copyFileSync(src, dest);
-        }
+        copyPathWithoutSymlinks(src, dest);
+    }
+}
+function copyPathWithoutSymlinks(sourcePath, destinationPath) {
+    const stat = fs.lstatSync(sourcePath);
+    if (stat.isSymbolicLink())
+        return;
+    fs.mkdirSync(path.dirname(destinationPath), { recursive: true });
+    if (stat.isDirectory()) {
+        fs.mkdirSync(destinationPath, { recursive: true });
+        copyDirectoryContents(sourcePath, destinationPath);
+        return;
     }
+    fs.copyFileSync(sourcePath, destinationPath);
 }
 export function isDirectory(target) {
     try {

package/dist/sources/providers/website.js

@@ -2,12 +2,13 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import { registerSourceProvider } from "../provider-factory.js";
-import { ensureWebsiteMirror, getWebsiteCachePaths, validateWebsiteUrl } from "../website-ingest.js";
+import { ensureWebsiteMirror, getWebsiteCachePaths, shouldAllowPrivateWebsiteUrlForTests, validateWebsiteUrl, } from "../website-ingest.js";
 /**
  * Website source provider — thin adapter over the shared website ingest module.
  */
 registerSourceProvider("website", (config) => {
-    const url = validateWebsiteUrl(config.url ?? "");
+    const allowPrivateHosts = shouldAllowPrivateWebsiteUrlForTests(config.url ?? "");
+    const url = validateWebsiteUrl(config.url ?? "", { allowPrivateHosts });
     const name = config.name ?? "website";
     return {
         kind: "website",
@@ -16,7 +17,11 @@ registerSourceProvider("website", (config) => {
             return getWebsiteCachePaths(url).stashDir;
         },
         async sync(options) {
-            await ensureWebsiteMirror(config, { requireStashDir: true, force: options?.force });
+            await ensureWebsiteMirror(config, {
+                requireStashDir: true,
+                force: options?.force,
+                ...(allowPrivateHosts ? { allowPrivateHosts: true } : {}),
+            });
         },
     };
 });