akm-cli 0.9.0-beta.56 → 0.9.0-beta.58

package/dist/scripts/migrate-storage.js

@@ -7452,6 +7452,11 @@ var init_dist = __esm(() => {
   $visitAsync = visit.visitAsync;
 });
 
+// src/core/asset/asset-serialize.ts
+var init_asset_serialize = __esm(() => {
+  init_dist();
+});
+
 // src/core/asset/frontmatter.ts
 function parseFrontmatter(raw) {
   const parsedBlock = parseFrontmatterBlock(raw);
@@ -7538,6 +7543,7 @@ function countLines(text) {
 }
 var init_frontmatter = __esm(() => {
   init_dist();
+  init_asset_serialize();
 });
 
 // src/core/asset/markdown.ts
@@ -8602,8 +8608,8 @@ function getConfigDir(env = process.env, platform = process.platform) {
   }
   return path3.join(home, ".config", "akm");
 }
-function getConfigPath() {
-  return path3.join(getConfigDir(), "config.json");
+function getConfigPath(env = process.env) {
+  return path3.join(getConfigDir(env), "config.json");
 }
 function getCacheDir(env = process.env) {
   const override = env.AKM_CACHE_DIR?.trim();
@@ -8665,8 +8671,8 @@ function getDataDir(env = process.env, platform = process.platform) {
     return path3.join("/tmp", "akm-data");
   return path3.join(home, ".local", "share", "akm");
 }
-function getDbPath() {
-  return path3.join(getDataDir(), "index.db");
+function getDbPath(env = process.env) {
+  return path3.join(getDataDir(env), "index.db");
 }
 var init_paths = __esm(() => {
   init_common();
@@ -8684,11 +8690,7 @@ function writeFileAtomic(target, content, mode) {
   const tmp = `${target}.tmp.${process.pid}.${crypto.randomBytes(8).toString("hex")}`;
   const fd = fs4.openSync(tmp, "w", mode ?? 384);
   try {
-    if (typeof content === "string") {
-      fs4.writeSync(fd, content);
-    } else {
-      fs4.writeSync(fd, content);
-    }
+    fs4.writeSync(fd, typeof content === "string" ? Buffer.from(content) : content);
     try {
       fs4.fdatasyncSync(fd);
     } catch {}
@@ -9838,6 +9840,29 @@ function ensureUsageEventsSchema(db) {
   `);
 }
 
+// src/storage/repositories/registry-index-cache-repository.ts
+function upsertRegistryIndexCache(db, registryUrl, indexJson, opts) {
+  db.prepare(`
+    INSERT INTO registry_index_cache (registry_url, fetched_at, etag, last_modified, index_json)
+    VALUES (?, ?, ?, ?, ?)
+    ON CONFLICT(registry_url) DO UPDATE SET
+      fetched_at    = excluded.fetched_at,
+      etag          = excluded.etag,
+      last_modified = excluded.last_modified,
+      index_json    = excluded.index_json
+  `).run(registryUrl, new Date().toISOString(), opts?.etag ?? null, opts?.lastModified ?? null, indexJson);
+}
+function getRegistryIndexCache(db, registryUrl, maxAgeMs = 3600000) {
+  const row = db.prepare(`SELECT fetched_at, etag, last_modified, index_json
+       FROM registry_index_cache WHERE registry_url = ?`).get(registryUrl);
+  if (!row)
+    return;
+  const fetchedAt = Date.parse(row.fetched_at);
+  if (Number.isNaN(fetchedAt) || Date.now() - fetchedAt > maxAgeMs)
+    return;
+  return { indexJson: row.index_json, etag: row.etag, lastModified: row.last_modified };
+}
+
 // src/indexer/db/db.ts
 import { createRequire as createRequire4 } from "node:module";
 function openExistingDatabase(dbPath) {
@@ -10322,12 +10347,15 @@ function backupExistingConfig(configPath) {
   if (!fs7.existsSync(configPath))
     return;
   const backupDir = path8.join(getCacheDir(), "config-backups");
-  fs7.mkdirSync(backupDir, { recursive: true });
+  fs7.mkdirSync(backupDir, { recursive: true, mode: 448 });
+  fs7.chmodSync(backupDir, 448);
   const timestamp = new Date().toISOString().replace(/[.:]/g, "-");
   const timestamped = path8.join(backupDir, `config-${timestamp}.json`);
   const latest = path8.join(backupDir, "config.latest.json");
   fs7.copyFileSync(configPath, timestamped);
   fs7.copyFileSync(configPath, latest);
+  fs7.chmodSync(timestamped, 384);
+  fs7.chmodSync(latest, 384);
   pruneOldBackups(backupDir);
   return { timestamped, latest };
 }
@@ -11179,7 +11207,7 @@ var init_opencode = __esm(() => {
 // src/integrations/agent/profiles.ts
 var COMMON_PASSTHROUGH, BUILTINS, HEADLESS_BUILTINS, BUILTIN_AGENT_PROFILE_NAMES;
 var init_profiles = __esm(() => {
-  COMMON_PASSTHROUGH = ["HOME", "PATH", "USER", "LANG", "LC_ALL", "TERM", "TMPDIR"];
+  COMMON_PASSTHROUGH = ["HOME", "PATH", "USER", "LANG", "LC_ALL", "TERM", "TMPDIR", "AKM_EVENT_SOURCE"];
   BUILTINS = {
     opencode: {
       name: "opencode",
@@ -11524,12 +11552,6 @@ function migrateConfigShape(raw, opts) {
         if (typeof llmFeatures.metadata_enhance === "boolean")
           me.enabled = llmFeatures.metadata_enhance;
       }
-      if ("curate_rerank" in llmFeatures) {
-        const search = getObj(result, "search");
-        const cr = getObj(search, "curateRerank");
-        if (typeof llmFeatures.curate_rerank === "boolean")
-          cr.enabled = llmFeatures.curate_rerank;
-      }
       if ("lesson_quality_gate" in llmFeatures) {
         const distill = getImproveProcess(result, "distill");
         const qg = getObj(distill, "qualityGate");
@@ -11657,15 +11679,6 @@ function migrateConfigShape(raw, opts) {
     }
     if (isObj(features.search)) {
       const fsearch = features.search;
-      if ("curate_rerank" in fsearch) {
-        const search = getObj(result, "search");
-        const cr = getObj(search, "curateRerank");
-        const val = fsearch.curate_rerank;
-        if (typeof val === "boolean")
-          cr.enabled = val;
-        else if (isObj(val) && typeof val.enabled === "boolean")
-          cr.enabled = val.enabled;
-      }
       const knownSearchKeys = new Set(["curate_rerank"]);
       for (const [legacyKey, legacyVal] of Object.entries(fsearch)) {
         if (knownSearchKeys.has(legacyKey))
@@ -15800,7 +15813,7 @@ var init_config_types = __esm(() => {
 });
 
 // src/core/config/config-schema.ts
-var positiveInt, nonNegativeNumber, nonEmptyString, httpUrl, LlmCapabilitiesSchema, LlmConnectionConfigSchema, LlmProfileConfigSchema, EmbeddingOllamaOptionsSchema, EmbeddingConnectionConfigSchema, AgentPlatformSchema, AgentProfileConfigSchema, ImproveProcessConfigSchema, ImproveProfileProcessesSchema, ImproveProfileConfigSchema, ProfilesSchema, DefaultsSchema, SourceConfigEntryOptionsSchema, SourceConfigEntrySchema, RegistryConfigEntrySchema, KitSourceSchema, InstalledStashEntrySchema, OutputConfigSchema, SearchGraphBoostSchema, SearchConfigSchema, FeedbackConfigSchema, ImproveUtilityDecaySchema, ImproveCalibrationSchema, ImproveExplorationSchema, ImproveSalienceSchema, ImproveCollapseDetectorSchema, ImproveConfigSchema, GRAPH_EXTRACTION_INCLUDE_TYPES_ALLOWED, INDEX_PASS_PROVIDER_KEYS, INDEX_PASS_KNOWN_KEYS, IndexPassConfigSchema, MetadataEnhanceSchema, StalenessDetectionSchema, IndexConfigSchema, SetupTaskSchedulesSchema, SetupConfigSchema, AkmConfigShape, AkmConfigBaseSchema, AkmConfigSchema;
+var positiveInt, nonNegativeNumber, nonEmptyString, httpUrl, FEEDBACK_FAILURE_MODES, LlmCapabilitiesSchema, LlmConnectionConfigSchema, LlmProfileConfigSchema, EmbeddingOllamaOptionsSchema, EmbeddingConnectionConfigSchema, AgentPlatformSchema, AgentProfileConfigSchema, ImproveProcessConfigSchema, ImproveProfileProcessesSchema, ImproveProfileConfigSchema, ProfilesSchema, DefaultsSchema, SourceConfigEntryOptionsSchema, SourceConfigEntrySchema, RegistryConfigEntrySchema, KitSourceSchema, InstalledStashEntrySchema, OutputConfigSchema, SearchGraphBoostSchema, SearchConfigSchema, FeedbackConfigSchema, ImproveUtilityDecaySchema, ImproveCalibrationSchema, ImproveExplorationSchema, ImproveSalienceSchema, ImproveCollapseDetectorSchema, ImproveConfigSchema, GRAPH_EXTRACTION_INCLUDE_TYPES_ALLOWED, INDEX_PASS_PROVIDER_KEYS, INDEX_PASS_KNOWN_KEYS, IndexPassConfigSchema, MetadataEnhanceSchema, StalenessDetectionSchema, IndexConfigSchema, SetupTaskSchedulesSchema, SetupConfigSchema, AkmConfigShape, AkmConfigBaseSchema, AkmConfigSchema;
 var init_config_schema = __esm(() => {
   init_zod();
   init_config_types();
@@ -15810,6 +15823,13 @@ var init_config_schema = __esm(() => {
   httpUrl = exports_external.string().refine((v) => v.startsWith("http://") || v.startsWith("https://"), {
     message: "endpoint must start with http:// or https://"
   });
+  FEEDBACK_FAILURE_MODES = [
+    "incorrect",
+    "outdated",
+    "dangerous",
+    "incomplete",
+    "redundant"
+  ];
   LlmCapabilitiesSchema = exports_external.object({
     structuredOutput: exports_external.boolean().optional()
   }).passthrough();
@@ -16047,7 +16067,6 @@ var init_config_schema = __esm(() => {
   SearchConfigSchema = exports_external.object({
     minScore: nonNegativeNumber.optional(),
     defaultExcludeTypes: exports_external.array(nonEmptyString).optional(),
-    curateRerank: exports_external.object({ enabled: exports_external.boolean().optional() }).passthrough().optional(),
     graphBoost: SearchGraphBoostSchema.optional()
   }).passthrough();
   FeedbackConfigSchema = exports_external.object({
@@ -16348,6 +16367,7 @@ __export(exports_config, {
   loadConfig: () => loadConfig,
   getSources: () => getSources,
   getIndexPassConfig: () => getIndexPassConfig,
+  getImproveProcessConfig: () => getImproveProcessConfig,
   getEffectiveRegistries: () => getEffectiveRegistries,
   getDefaultLlmConfig: () => getDefaultLlmConfig,
   _setSaveConfigForTests: () => _setSaveConfigForTests,
@@ -16444,6 +16464,12 @@ function getDefaultLlmConfig(config) {
     return;
   return config.profiles?.llm?.[defaultName];
 }
+function getImproveProcessConfig(config, processName, activeProfile) {
+  const fromActiveProfile = activeProfile?.processes?.[processName];
+  if (fromActiveProfile !== undefined)
+    return fromActiveProfile;
+  return config.profiles?.improve?.default?.processes?.[processName];
+}
 function maybeAutoMigrateConfigFile(configPath, text) {
   let obj;
   try {
@@ -16672,7 +16698,7 @@ function isFile(filePath) {
     return false;
   }
 }
-var FEEDBACK_FAILURE_MODES, DEFAULT_GRAPH_EXTRACTION_BATCH_SIZE = 4, GRAPH_EXTRACTION_CHARS_PER_BODY = 1500, DEFAULT_CONFIG, PROJECT_CONFIG_RELATIVE_PATH, cachedConfig, saveConfigOverride, INDEX_RESERVED_KEYS, PROJECT_CONFIG_DEPRECATION_WARNED;
+var DEFAULT_GRAPH_EXTRACTION_BATCH_SIZE = 4, GRAPH_EXTRACTION_CHARS_PER_BODY = 1500, DEFAULT_CONFIG, PROJECT_CONFIG_RELATIVE_PATH, cachedConfig, saveConfigOverride, INDEX_RESERVED_KEYS, PROJECT_CONFIG_DEPRECATION_WARNED;
 var init_config2 = __esm(() => {
   init_errors();
   init_config_io();
@@ -16682,14 +16708,8 @@ var init_config2 = __esm(() => {
   init_paths();
   init_warn();
   init_config_types();
+  init_config_schema();
   init_config_sources();
-  FEEDBACK_FAILURE_MODES = [
-    "incorrect",
-    "outdated",
-    "dangerous",
-    "incomplete",
-    "redundant"
-  ];
   DEFAULT_CONFIG = {
     semanticSearchMode: "auto",
     registries: [
@@ -16750,6 +16770,7 @@ __export(exports_db, {
   getEmbeddingCount: () => getEmbeddingCount,
   getEmbeddableEntryCount: () => getEmbeddableEntryCount,
   getDerivedForParent: () => getDerivedForParent,
+  getBaseBeliefStatesForDerivedTwins: () => getBaseBeliefStatesForDerivedTwins,
   getAllEntriesForEmbedding: () => getAllEntriesForEmbedding,
   getAllEntries: () => getAllEntries,
   findEntryIdByRef: () => findEntryIdByRef,
@@ -16917,6 +16938,30 @@ function getDerivedForParent(db, parentRef) {
     return null;
   }
 }
+function getBaseBeliefStatesForDerivedTwins(db, twinIds) {
+  const out = new Map;
+  if (twinIds.length === 0)
+    return out;
+  for (let i = 0;i < twinIds.length; i += SQLITE_CHUNK_SIZE) {
+    const chunk = twinIds.slice(i, i + SQLITE_CHUNK_SIZE);
+    const placeholders = chunk.map(() => "?").join(",");
+    bestEffort(() => {
+      const rows = db.prepare(`SELECT twin.id AS twin_id, json_extract(base.entry_json, '$.beliefState') AS belief
+           FROM entries twin
+           JOIN entries base
+             ON base.entry_type = 'memory'
+            AND base.entry_key = substr(twin.entry_key, 1, length(twin.entry_key) - length('.derived'))
+           WHERE twin.id IN (${placeholders})
+             AND twin.entry_key LIKE '%.derived'
+             AND json_extract(base.entry_json, '$.beliefState') IS NOT NULL`).all(...chunk);
+      for (const r of rows) {
+        if (typeof r.belief === "string" && r.belief.trim().length > 0)
+          out.set(r.twin_id, r.belief.trim());
+      }
+    }, "legacy DB / entry_json without beliefState — treat as no twin inheritance");
+  }
+  return out;
+}
 function getPositiveFeedbackCountsByIds(db, ids) {
   const result = new Map;
   if (ids.length === 0)
@@ -17176,7 +17221,8 @@ function runFtsQuery(db, ftsQuery, limit, entryType, excludeTypes) {
       });
     }
     return results;
-  } catch {
+  } catch (err) {
+    warn("[db] runFtsQuery failed:", err instanceof Error ? err.message : String(err));
     return [];
   }
 }
@@ -17255,8 +17301,7 @@ function getEntryCount(db) {
   return row.cnt;
 }
 function getEmbeddableEntryCount(db) {
-  const row = db.prepare("SELECT COUNT(*) AS cnt FROM entries").get();
-  return row.cnt;
+  return getEntryCount(db);
 }
 function getEmbeddingCount(db) {
   const row = db.prepare("SELECT COUNT(*) AS cnt FROM embeddings").get();
@@ -17588,27 +17633,6 @@ function relinkUsageEvents(db) {
     relinkTx();
   }, "usage_events table may not exist yet during entry_id re-resolution");
 }
-function upsertRegistryIndexCache(db, registryUrl, indexJson, opts) {
-  db.prepare(`
-    INSERT INTO registry_index_cache (registry_url, fetched_at, etag, last_modified, index_json)
-    VALUES (?, ?, ?, ?, ?)
-    ON CONFLICT(registry_url) DO UPDATE SET
-      fetched_at    = excluded.fetched_at,
-      etag          = excluded.etag,
-      last_modified = excluded.last_modified,
-      index_json    = excluded.index_json
-  `).run(registryUrl, new Date().toISOString(), opts?.etag ?? null, opts?.lastModified ?? null, indexJson);
-}
-function getRegistryIndexCache(db, registryUrl, maxAgeMs = 3600000) {
-  const row = db.prepare(`SELECT fetched_at, etag, last_modified, index_json
-       FROM registry_index_cache WHERE registry_url = ?`).get(registryUrl);
-  if (!row)
-    return;
-  const fetchedAt = Date.parse(row.fetched_at);
-  if (Number.isNaN(fetchedAt) || Date.now() - fetchedAt > maxAgeMs)
-    return;
-  return { indexJson: row.index_json, etag: row.etag, lastModified: row.last_modified };
-}
 function collectTagSetFromEntries(db, entryType) {
   const tags = new Set;
   const stmt = entryType ? db.prepare("SELECT entry_json FROM entries WHERE entry_type = ?") : db.prepare("SELECT entry_json FROM entries");

package/dist/scripts/migrations/import-fs-improve-runs-to-db.js

@@ -7443,6 +7443,11 @@ var init_dist = __esm(() => {
   $visitAsync = visit.visitAsync;
 });
 
+// src/core/asset/asset-serialize.ts
+var init_asset_serialize = __esm(() => {
+  init_dist();
+});
+
 // src/core/asset/frontmatter.ts
 function parseFrontmatter(raw) {
   const parsedBlock = parseFrontmatterBlock(raw);
@@ -7529,6 +7534,7 @@ function countLines(text) {
 }
 var init_frontmatter = __esm(() => {
   init_dist();
+  init_asset_serialize();
 });
 
 // src/core/asset/markdown.ts

package/dist/storage/repositories/registry-cache.js

@@ -2,7 +2,8 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import { rethrowIfTestIsolationError } from "../../core/errors.js";
-import { closeDatabase, getRegistryIndexCache, openIndexDatabase, upsertRegistryIndexCache } from "../../indexer/db/db.js";
+import { closeDatabase, openIndexDatabase } from "../../indexer/db/db.js";
+import { getRegistryIndexCache, upsertRegistryIndexCache } from "./registry-index-cache-repository.js";
 /**
  * RAII-style lifecycle helper for the registry cache DB. Opens the DB (treating
  * a failed open exactly like the legacy fall-through: the bun-test isolation

package/dist/storage/repositories/registry-index-cache-repository.js

@@ -0,0 +1,46 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/**
+ * Upsert a registry index cache entry in index.db.
+ *
+ * @param db          - Open index.db connection (from openDatabase / openExistingDatabase).
+ * @param registryUrl - Canonical URL of the registry (used as primary key).
+ * @param indexJson   - Serialised registry index document (JSON string).
+ * @param opts.etag        - HTTP ETag from the response (optional).
+ * @param opts.lastModified - HTTP Last-Modified from the response (optional).
+ */
+export function upsertRegistryIndexCache(db, registryUrl, indexJson, opts) {
+    db.prepare(`
+    INSERT INTO registry_index_cache (registry_url, fetched_at, etag, last_modified, index_json)
+    VALUES (?, ?, ?, ?, ?)
+    ON CONFLICT(registry_url) DO UPDATE SET
+      fetched_at    = excluded.fetched_at,
+      etag          = excluded.etag,
+      last_modified = excluded.last_modified,
+      index_json    = excluded.index_json
+  `).run(registryUrl, new Date().toISOString(), opts?.etag ?? null, opts?.lastModified ?? null, indexJson);
+}
+/**
+ * Look up a cached registry index entry from index.db.
+ * Returns undefined when not found or when the entry is older than `maxAgeMs`.
+ *
+ * TTL check: if `Date.now() - new Date(fetched_at).getTime() > maxAgeMs` the
+ * entry is considered a cache miss and undefined is returned.
+ *
+ * @param db          - Open index.db connection.
+ * @param registryUrl - Canonical URL of the registry (primary key).
+ * @param maxAgeMs    - Maximum age in milliseconds before the entry is stale (default: 1 hour).
+ */
+export function getRegistryIndexCache(db, registryUrl, maxAgeMs = 3_600_000 /* 1 hour */) {
+    const row = db
+        .prepare(`SELECT fetched_at, etag, last_modified, index_json
+       FROM registry_index_cache WHERE registry_url = ?`)
+        .get(registryUrl);
+    if (!row)
+        return undefined;
+    const fetchedAt = Date.parse(row.fetched_at);
+    if (Number.isNaN(fetchedAt) || Date.now() - fetchedAt > maxAgeMs)
+        return undefined;
+    return { indexJson: row.index_json, etag: row.etag, lastModified: row.last_modified };
+}

package/dist/workflows/runtime/runs.js

@@ -67,10 +67,15 @@ export async function startWorkflowRun(ref, params = {}, options) {
             })));
         });
         const result = await getWorkflowStatus(runId);
+        // 07 P1-B: emit only the run id + status — NOT the raw workflowTitle (which
+        // comes verbatim from the workflow asset's frontmatter and is therefore
+        // attacker-influenceable). Keeping raw titles out of the events stream
+        // shrinks the injectable footprint for any consumer that re-surfaces events
+        // into agent context.
         appendEvent({
             eventType: "workflow_started",
             ref: ref,
-            metadata: { runId: result.run.id, title: result.run.workflowTitle },
+            metadata: { runId: result.run.id, status: result.run.status },
         });
         return result;
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "akm-cli",
-  "version": "0.9.0-beta.56",
+  "version": "0.9.0-beta.58",
   "type": "module",
   "description": "akm (Agent Knowledge Management) — A package manager for AI agent skills, commands, tools, and knowledge. Works with Claude Code, OpenCode, Cursor, and any AI coding assistant.",
   "keywords": [