akm-cli 0.9.0-beta.6 → 0.9.0-rc.0

package/dist/core/concurrent.js

@@ -4,12 +4,21 @@
 /**
  * Maps over items concurrently with a pool size limit.
  * Uses Promise.allSettled semantics — one failure does not cancel others.
+ *
+ * Cooperative cancellation (P0.5 seam for the workflow scheduler): when
+ * `opts.signal` aborts, workers stop CLAIMING new items — in-flight `fn`
+ * calls run to completion (pass the same signal into `fn`'s own work to
+ * preempt those too). Unclaimed items stay `undefined` in the result,
+ * indistinguishable from individual failures by design: callers already
+ * treat `undefined` as "no result".
  */
-export async function concurrentMap(items, fn, concurrency = 1) {
+export async function concurrentMap(items, fn, concurrency = 1, opts) {
     const results = new Array(items.length).fill(undefined);
     let nextIndex = 0;
     async function worker() {
         while (nextIndex < items.length) {
+            if (opts?.signal?.aborted)
+                return;
             const i = nextIndex++;
             try {
                 results[i] = await fn(items[i], i);

package/dist/core/config/config-io.js

@@ -84,12 +84,21 @@ export function backupExistingConfig(configPath) {
     if (!fs.existsSync(configPath))
         return undefined;
     const backupDir = path.join(getCacheDir(), "config-backups");
-    fs.mkdirSync(backupDir, { recursive: true });
+    // 08-F4: lock the backup dir owner-only up front (0700) — matching the
+    // env.ts/secret.ts convention — so no other local user can traverse in during
+    // the copy→chmod window. chmod again to tighten a dir from an older version.
+    fs.mkdirSync(backupDir, { recursive: true, mode: 0o700 });
+    fs.chmodSync(backupDir, 0o700);
     const timestamp = new Date().toISOString().replace(/[.:]/g, "-");
     const timestamped = path.join(backupDir, `config-${timestamp}.json`);
     const latest = path.join(backupDir, "config.latest.json");
     fs.copyFileSync(configPath, timestamped);
     fs.copyFileSync(configPath, latest);
+    // 08-F4: a config backup carries the same sensitive fields as the live config
+    // (endpoints, tokens). `copyFileSync` inherits the source's (often 0644) mode,
+    // so tighten the backups to owner-only — mirrors the env-cli 0600 write floor.
+    fs.chmodSync(timestamped, 0o600);
+    fs.chmodSync(latest, 0o600);
     pruneOldBackups(backupDir);
     return { timestamped, latest };
 }

package/dist/core/config/config-migration.js

@@ -169,7 +169,8 @@ function migrateProcessEntryToImprove(result, processName, legacy) {
  * (canonical string sentinel for this release) or when `configVersion` is a
  * number ≥ 2 AND the config carries no recognized legacy keys.
  */
-export function migrateConfigShape(raw) {
+export function migrateConfigShape(raw, opts) {
+    const emitWarn = opts?.warn ?? warn;
     const hasLegacyKeys = Object.hasOwn(raw, "features") ||
         (isObj(raw.llm) && (Object.hasOwn(raw.llm, "endpoint") || Object.hasOwn(raw.llm, "features"))) ||
         isObj(raw.agent) ||
@@ -199,11 +200,11 @@ export function migrateConfigShape(raw) {
     if (Array.isArray(result.stashes)) {
         if (!Array.isArray(result.sources)) {
             result.sources = result.stashes;
-            console.warn("[akm config-migrate] Legacy `stashes[]` config key renamed to `sources[]`. " +
+            emitWarn("[akm config-migrate] Legacy `stashes[]` config key renamed to `sources[]`. " +
                 "Re-save your config to remove the deprecation notice.");
         }
         else {
-            console.warn("[akm config-migrate] Both `stashes[]` and `sources[]` present; `stashes[]` dropped (sources takes precedence).");
+            emitWarn("[akm config-migrate] Both `stashes[]` and `sources[]` present; `stashes[]` dropped (sources takes precedence).");
         }
         delete result.stashes;
         changed = true;
@@ -218,7 +219,7 @@ export function migrateConfigShape(raw) {
         for (const entry of sources) {
             if (isObj(entry) && entry.type === "openviking") {
                 const name = typeof entry.name === "string" && entry.name ? entry.name : "unnamed";
-                console.warn(`[akm config-migrate] Source "${name}" (type: openviking) is no longer supported. ` +
+                emitWarn(`[akm config-migrate] Source "${name}" (type: openviking) is no longer supported. ` +
                     "Remove it from your config, or replace with a `website`/`git` source. " +
                     "Entry dropped from sources[].");
                 renamed = true;
@@ -261,12 +262,6 @@ export function migrateConfigShape(raw) {
                 if (typeof llmFeatures.metadata_enhance === "boolean")
                     me.enabled = llmFeatures.metadata_enhance;
             }
-            if ("curate_rerank" in llmFeatures) {
-                const search = getObj(result, "search");
-                const cr = getObj(search, "curateRerank");
-                if (typeof llmFeatures.curate_rerank === "boolean")
-                    cr.enabled = llmFeatures.curate_rerank;
-            }
             if ("lesson_quality_gate" in llmFeatures) {
                 const distill = getImproveProcess(result, "distill");
                 const qg = getObj(distill, "qualityGate");
@@ -349,11 +344,11 @@ export function migrateConfigShape(raw) {
                 const camelKey = toCamelCase(legacyKey);
                 if (typeof legacyVal === "boolean" || isObj(legacyVal)) {
                     migrateProcessEntryToImprove(result, camelKey, legacyVal);
-                    warn(`[akm config-migrate] Unknown features.improve.${legacyKey} migrated to ` +
+                    emitWarn(`[akm config-migrate] Unknown features.improve.${legacyKey} migrated to ` +
                         `profiles.improve.default.processes.${camelKey}. Please verify the new location.`);
                 }
                 else {
-                    warn(`[akm config-migrate] features.improve.${legacyKey} has an unrecognized value type ` +
+                    emitWarn(`[akm config-migrate] features.improve.${legacyKey} has an unrecognized value type ` +
                         `(${typeof legacyVal}); dropping. Please re-add it under profiles.improve.* manually.`);
                 }
             }
@@ -376,20 +371,10 @@ export function migrateConfigShape(raw) {
                 else if (isObj(val) && typeof val.enabled === "boolean")
                     me.enabled = val.enabled;
             }
-            if ("staleness_detection" in findex) {
-                const index = getObj(result, "index");
-                const sd = getObj(index, "stalenessDetection");
-                const val = findex.staleness_detection;
-                if (typeof val === "boolean")
-                    sd.enabled = val;
-                else if (isObj(val)) {
-                    if (typeof val.enabled === "boolean")
-                        sd.enabled = val.enabled;
-                    if (isObj(val.options) && typeof val.options.thresholdDays === "number") {
-                        sd.thresholdDays = val.options.thresholdDays;
-                    }
-                }
-            }
+            // staleness_detection: the pass was retired (meta-review 10-Q3), so the
+            // legacy features.index.staleness_detection entry is deliberately DROPPED
+            // during migration ("staleness_detection" stays in knownIndexKeys below so
+            // the catch-all does not resurrect it under index.stalenessDetection).
             // Catch-all: unknown features.index.<key> entries land at
             // index.<keyAsCamelCase> (preserving { enabled, options } when present).
             const knownIndexKeys = new Set([
@@ -404,11 +389,11 @@ export function migrateConfigShape(raw) {
                 const camelKey = toCamelCase(legacyKey);
                 const ok = migrateGenericGateToSection(result, "index", camelKey, legacyVal);
                 if (ok) {
-                    warn(`[akm config-migrate] Unknown features.index.${legacyKey} migrated to ` +
+                    emitWarn(`[akm config-migrate] Unknown features.index.${legacyKey} migrated to ` +
                         `index.${camelKey}. Please verify the new location is correct.`);
                 }
                 else {
-                    warn(`[akm config-migrate] features.index.${legacyKey} has an unrecognized value shape; ` +
+                    emitWarn(`[akm config-migrate] features.index.${legacyKey} has an unrecognized value shape; ` +
                         `dropping. Please re-add it under index.${camelKey} manually if needed.`);
                 }
             }
@@ -416,17 +401,10 @@ export function migrateConfigShape(raw) {
         }
         if (isObj(features.search)) {
             const fsearch = features.search;
-            if ("curate_rerank" in fsearch) {
-                const search = getObj(result, "search");
-                const cr = getObj(search, "curateRerank");
-                const val = fsearch.curate_rerank;
-                if (typeof val === "boolean")
-                    cr.enabled = val;
-                else if (isObj(val) && typeof val.enabled === "boolean")
-                    cr.enabled = val.enabled;
-            }
             // Catch-all: unknown features.search.<key> entries land at
             // search.<keyAsCamelCase> (preserving { enabled, options } when present).
+            // `curate_rerank` is a removed dead feature — listed here so the catch-all
+            // skips it and it is simply dropped (not resurrected under search.curateRerank).
             const knownSearchKeys = new Set(["curate_rerank"]);
             for (const [legacyKey, legacyVal] of Object.entries(fsearch)) {
                 if (knownSearchKeys.has(legacyKey))
@@ -434,11 +412,11 @@ export function migrateConfigShape(raw) {
                 const camelKey = toCamelCase(legacyKey);
                 const ok = migrateGenericGateToSection(result, "search", camelKey, legacyVal);
                 if (ok) {
-                    warn(`[akm config-migrate] Unknown features.search.${legacyKey} migrated to ` +
+                    emitWarn(`[akm config-migrate] Unknown features.search.${legacyKey} migrated to ` +
                         `search.${camelKey}. Please verify the new location is correct.`);
                 }
                 else {
-                    warn(`[akm config-migrate] features.search.${legacyKey} has an unrecognized value shape; ` +
+                    emitWarn(`[akm config-migrate] features.search.${legacyKey} has an unrecognized value shape; ` +
                         `dropping. Please re-add it under search.${camelKey} manually if needed.`);
                 }
             }
@@ -555,7 +533,7 @@ export function migrateConfigShape(raw) {
                 changed = true;
             }
             if (improveObj.preset !== undefined) {
-                console.warn("[akm config-migrate] defaults.improve.preset is no longer supported. " +
+                emitWarn("[akm config-migrate] defaults.improve.preset is no longer supported. " +
                     "Use `--profile <name>` (built-ins: default, quick, thorough, memory-focus) instead.");
             }
             delete defaultsRaw.improve;