akm-cli 0.9.0-rc.0 → 0.9.0-rc.13

package/dist/commands/registry-cli.js

@@ -1,23 +1,20 @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
-import { defineCommand } from "citty";
-import { parsePositiveIntFlag } from "../cli/parse-args.js";
-import { defineJsonCommand, output } from "../cli/shared.js";
-import { DEFAULT_CONFIG, loadUserConfig, saveConfig } from "../core/config/config.js";
+import { defineGroupCommand, defineJsonCommand, output } from "../cli/shared.js";
+import { getEffectiveRegistries, loadUserConfig, mutateConfig } from "../core/config/config.js";
 import { UsageError } from "../core/errors.js";
 import { warn } from "../core/warn.js";
-import { buildRegistryIndex, writeRegistryIndex } from "../registry/build-index.js";
-import { searchRegistry } from "./read/registry-search.js";
-export const registryCommand = defineCommand({
-    meta: { name: "registry", description: "Manage stash registries" },
+export const registryCommand = defineGroupCommand({
+    meta: { name: "registry", description: "Manage bundle registries" },
     subCommands: {
         list: defineJsonCommand({
             meta: { name: "list", description: "List configured registries" },
             async run() {
                 const config = loadUserConfig();
-                const registries = config.registries ?? DEFAULT_CONFIG.registries;
-                output("registry-list", { registries });
+                // R-066 #5: mirror the shared config↔default-fallback helper instead
+                // of re-deriving it inline.
+                output("registry-list", { registries: getEffectiveRegistries(config) });
             },
         }),
         add: defineJsonCommand({
@@ -45,13 +42,6 @@ export const registryCommand = defineCommand({
                     }
                     warn("Warning: registry URL uses plain HTTP (not HTTPS). --allow-insecure was set; an on-path attacker could substitute a malicious index.");
                 }
-                const config = loadUserConfig();
-                const registries = [...(config.registries ?? [])];
-                // Deduplicate by URL
-                if (registries.some((r) => r.url === args.url)) {
-                    output("registry-add", { registries, added: false, message: "Registry URL already configured" });
-                    return;
-                }
                 const entry = { url: args.url };
                 if (args.name)
                     entry.name = args.name;
@@ -65,9 +55,20 @@ export const registryCommand = defineCommand({
                         throw new UsageError("--options must be valid JSON");
                     }
                 }
-                registries.push(entry);
-                saveConfig({ ...config, registries });
-                output("registry-add", { registries, added: true });
+                let added = false;
+                const updated = mutateConfig((config) => {
+                    const registries = [...(config.registries ?? [])];
+                    if (registries.some((registry) => registry.url === args.url))
+                        return config;
+                    registries.push(entry);
+                    added = true;
+                    return { ...config, registries };
+                }).config;
+                output("registry-add", {
+                    registries: updated.registries ?? [],
+                    added,
+                    ...(!added ? { message: "Registry URL already configured" } : {}),
+                });
             },
         }),
         remove: defineJsonCommand({
@@ -92,46 +93,19 @@ export const registryCommand = defineCommand({
                     process.stderr.write("Aborted.\n");
                     return;
                 }
-                const removed = registries.splice(idx, 1)[0];
-                saveConfig({ ...config, registries });
-                output("registry-remove", { registries, removed: true, entry: removed });
-            },
-        }),
-        search: defineJsonCommand({
-            meta: { name: "search", description: "Search enabled registries for stashes" },
-            args: {
-                query: { type: "positional", description: "Search query", required: true },
-                limit: { type: "string", description: "Maximum number of results" },
-                assets: { type: "boolean", description: "Include asset-level search results", default: false },
-            },
-            async run({ args }) {
-                const limitRaw = parsePositiveIntFlag(args.limit ?? undefined);
-                const result = await searchRegistry(args.query, { limit: limitRaw, includeAssets: args.assets });
-                output("registry-search", result);
-            },
-        }),
-        "build-index": defineJsonCommand({
-            meta: { name: "build-index", description: "Build a v2 registry index from discovery and manual entries" },
-            args: {
-                out: { type: "string", description: "Output path for the generated index" },
-                manual: { type: "string", description: "Manual entries JSON file" },
-                "npm-registry": { type: "string", description: "Override npm registry base URL" },
-                "github-api": { type: "string", description: "Override GitHub API base URL" },
-            },
-            async run({ args }) {
-                const result = await buildRegistryIndex({
-                    manualEntriesPath: args.manual,
-                    npmRegistryBase: args["npm-registry"],
-                    githubApiBase: args["github-api"],
-                });
-                const outPath = writeRegistryIndex(result.index, args.out);
-                output("registry-build-index", {
-                    outPath,
-                    version: result.index.version,
-                    updatedAt: result.index.updatedAt,
-                    totalKits: result.counts.total,
-                    counts: result.counts,
-                    manualEntriesPath: result.paths.manualEntriesPath,
+                let removed;
+                const updated = mutateConfig((latest) => {
+                    const current = [...(latest.registries ?? [])];
+                    const currentIndex = current.findIndex((registry) => registry.url === args.target || registry.name === args.target);
+                    if (currentIndex < 0)
+                        return latest;
+                    removed = current.splice(currentIndex, 1)[0];
+                    return { ...latest, registries: current };
+                }).config;
+                output("registry-remove", {
+                    registries: updated.registries ?? [],
+                    removed: removed !== undefined,
+                    ...(removed ? { entry: removed } : { message: "No matching registry found" }),
                 });
             },
         }),

package/dist/commands/remember.js

@@ -10,12 +10,13 @@
  */
 import { serializeFrontmatter } from "../core/asset/asset-serialize.js";
 import { toErrorMessage, tryReadStdinText } from "../core/common.js";
-import { getDefaultLlmConfig, loadConfig } from "../core/config/config.js";
+import { loadConfig } from "../core/config/config.js";
 import { UsageError } from "../core/errors.js";
+import { parseEmbeddedJsonResponse } from "../core/parse.js";
 import { DURATION_UNITS, parseDuration as parseDurationSpec } from "../core/time.js";
 import { warn } from "../core/warn.js";
 import { SCOPE_KEYS } from "../indexer/passes/metadata.js";
-import { parseFlagValue } from "../output/context.js";
+import { getDefaultLlmConfig } from "../integrations/agent/engine-resolution.js";
 /**
  * Parse a shorthand duration string to a number of milliseconds.
  * Supports the CLI-wide canonical grammar: `30d` (days), `12h` (hours),
@@ -50,6 +51,8 @@ export function buildMemoryFrontmatter(fields) {
         obj.tags = fields.tags;
     if (fields.source?.trim())
         obj.source = fields.source;
+    if (fields.xrefs && fields.xrefs.length > 0)
+        obj.xrefs = fields.xrefs;
     if (fields.observed_at?.trim())
         obj.observed_at = fields.observed_at;
     if (fields.expires?.trim())
@@ -147,7 +150,7 @@ export async function runLlmEnrich(body) {
         warn("Warning: --enrich requires an LLM to be configured. Run `akm setup` to configure one.");
         return { tags: [] };
     }
-    const { chatCompletion, parseEmbeddedJsonResponse: parseJsonResponse } = await import("../llm/client.js");
+    const { chatCompletion } = await import("../llm/client.js");
     // #576: attribute this entry point's LLM call to the `remember` stage. The
     // wrapper is ambient — if a usage sink is active it tags the record; if not,
     // it is a no-op.
@@ -182,7 +185,7 @@ Return ONLY the JSON object, no prose, no markdown fences.`;
                 }
             }
         })();
-        const parsed = parseJsonResponse(result);
+        const parsed = parseEmbeddedJsonResponse(result);
         if (!parsed) {
             warn("Warning: --enrich received invalid JSON from the LLM. Writing memory without enrichment.");
             return { tags: [] };
@@ -201,56 +204,14 @@ Return ONLY the JSON object, no prose, no markdown fences.`;
         return { tags: [] };
     }
 }
-// ── Content-arg disambiguation ───────────────────────────────────────────────
-/**
- * Guard against citty consuming a global flag value as the `content` positional.
- *
- * When the user runs `akm remember --format json` without a content argument,
- * citty may assign `"json"` to the `content` positional because of how it
- * handles flag order. This helper detects that case and returns `undefined`
- * so `readMemoryContent` falls through to stdin.
- */
-export function resolveRememberContentArg(content) {
-    if (content === undefined)
-        return undefined;
-    const parsedFormat = parseFlagValue(process.argv, "--format");
-    if (parsedFormat !== undefined &&
-        content === parsedFormat &&
-        wasRememberFlagValueConsumedAsContent(content, parsedFormat, "--format")) {
-        return undefined;
-    }
-    const parsedDetail = parseFlagValue(process.argv, "--detail");
-    if (parsedDetail !== undefined &&
-        content === parsedDetail &&
-        wasRememberFlagValueConsumedAsContent(content, parsedDetail, "--detail")) {
-        return undefined;
-    }
-    return content;
-}
-function wasRememberFlagValueConsumedAsContent(content, flagValue, flagName) {
-    const argv = process.argv.slice(2);
-    const rememberIndex = argv.indexOf("remember");
-    const tokens = rememberIndex >= 0 ? argv.slice(rememberIndex + 1) : argv;
-    let flagIndex = -1;
-    let flagConsumesNextToken = false;
-    for (let i = 0; i < tokens.length; i += 1) {
-        const token = tokens[i];
-        if (token === flagName) {
-            flagIndex = i;
-            flagConsumesNextToken = true;
-            break;
-        }
-        if (token === `${flagName}=${flagValue}`) {
-            flagIndex = i;
-            break;
-        }
-    }
-    if (flagIndex === -1)
-        return false;
-    if (tokens.slice(0, flagIndex).includes(content))
-        return false;
-    const firstTokenAfterFlag = flagIndex + (flagConsumesNextToken ? 2 : 1);
-    if (tokens.slice(firstTokenAfterFlag).includes(content))
-        return false;
-    return true;
-}
+// R-061(c): `resolveRememberContentArg` / `wasRememberFlagValueConsumedAsContent`
+// used to live here — a heuristic guarding against citty consuming a global
+// flag's value (`--format`/`--detail`) as the `content` positional. That guard
+// predated `rememberCommand` declaring `GLOBAL_OUTPUT_ARGS` (via
+// `defineJsonCommand`): once the leaf command itself declares `format`/
+// `detail` args, citty's parser consumes their space-separated values as the
+// flag's own value and never assigns them to `content` in the first place, so
+// the heuristic no longer has anything to guard against. Verified: `akm
+// remember "yaml" --format yaml` and `akm remember "brief" --detail brief`
+// both write the literal content unchanged. Deleted rather than kept as
+// defense-in-depth per the cleanup program's dead-code policy.

package/dist/commands/sources/add-cli.js

@@ -5,13 +5,14 @@ import fs from "node:fs";
 import path from "node:path";
 import * as p from "../../cli/clack.js";
 import { defineJsonCommand, output } from "../../cli/shared.js";
+import { decideDangerousKeyInstall } from "../../core/activation-policy.js";
 import { UsageError } from "../../core/errors.js";
 import { appendEvent } from "../../core/events.js";
 import { warn } from "../../core/warn.js";
 import { akmRemove } from "./installed-stashes.js";
 import { akmAdd } from "./source-add.js";
 import { addStash } from "./source-manage.js";
-// ── Shared website-options helper (also used by wikiRegisterCommand) ──────────
+// ── Shared website-options helper ──────────
 export function buildWebsiteOptions(args) {
     const websiteOptions = {};
     if (typeof args["max-pages"] === "string" && args["max-pages"].length > 0)
@@ -37,24 +38,84 @@ export function shouldWarnOnPlainHttp(ref) {
         return true;
     }
 }
-/** Scan every env file in the freshly-installed stash for dangerous env keys. */
+/**
+ * Recursively enumerate every real env FILE under `rootDir` (a stash's
+ * `env/` directory). "Real env file" is the SAME test used everywhere else
+ * in akm decides what `akm env run` / `akm env list` / the indexer will
+ * actually load as environment variables — `fileName === ".env" ||
+ * fileName.endsWith(".env")` — see `src/indexer/walk/matchers.ts` and
+ * `listEnvsRecursive` in `src/commands/env/env-cli.ts`. Reusing that exact
+ * rule here (rather than inventing a second, possibly-divergent one) is what
+ * closes the nested-directory bypass: `env/nested/inner.env` IS loaded by
+ * `akm env run` today via that same recursive walk, so it must be scanned
+ * too (previously only a flat, non-recursive `env/*.env` listing was
+ * scanned).
+ *
+ * Deliberately excludes files that do NOT end in `.env` (e.g.
+ * `env/notes.txt`). Such a file is never sourced as environment variables by
+ * any akm codepath, so a dangerous key sitting in its contents cannot hijack
+ * process execution via `akm env run` — there is no live attack through this
+ * gate for it. Residual gap: this scanner does not protect against an
+ * operator later renaming/copying that file to a `*.env` name, or feeding it
+ * into `akm env run` through some other mechanism outside akm; closing that
+ * would mean content-sniffing every byte of every file in the stash (README,
+ * lockfiles, binaries, …) for a vector that requires a subsequent human
+ * action to become live, which is a materially different and much more
+ * expensive check than "is this a file `akm` will actually source".
+ */
+function collectEnvFilePathsRecursive(rootDir) {
+    const results = [];
+    const walk = (dir) => {
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            const full = path.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                walk(full);
+                continue;
+            }
+            if (!entry.isFile())
+                continue;
+            if (entry.name !== ".env" && !entry.name.endsWith(".env"))
+                continue;
+            results.push(full);
+        }
+    };
+    walk(rootDir);
+    return results;
+}
+/** Scan every real env file (recursively, see {@link collectEnvFilePathsRecursive}) in the freshly-installed stash for dangerous env keys. */
 function collectDangerousKeyFindings(installedStashRoot, checkEnvForDangerousKeys) {
     const allFindings = [];
     const subdir = "env";
     const prefix = "env";
     const dir = path.join(installedStashRoot, subdir);
-    const envFiles = fs.existsSync(dir) ? fs.readdirSync(dir).filter((f) => f.endsWith(".env")) : [];
-    for (const envFile of envFiles) {
-        const envPath = path.join(dir, envFile);
-        const baseName = path.basename(envFile, ".env");
-        const vaultRef = baseName === "" ? `${prefix}:default` : `${prefix}:${baseName}`;
-        const relPath = path.join(subdir, envFile);
-        const findings = checkEnvForDangerousKeys(envPath, relPath, vaultRef);
+    if (!fs.existsSync(dir))
+        return allFindings;
+    for (const envPath of collectEnvFilePathsRecursive(dir)) {
+        const relToEnvDir = path.relative(dir, envPath);
+        // Only the LAST path segment carries the ".env" suffix / dotfile-default
+        // naming rule; intermediate directory segments pass through unchanged.
+        // e.g. "nested/inner.env" -> "nested/inner", "nested/.env" ->
+        // "nested/default" (not "nested/", which is what naively stripping the
+        // suffix from the whole relative path would produce).
+        const segments = relToEnvDir.split(path.sep);
+        const lastSegment = segments[segments.length - 1] ?? "";
+        const lastSegmentBase = lastSegment.endsWith(".env") ? lastSegment.slice(0, -".env".length) : lastSegment;
+        const refSegments = [...segments.slice(0, -1), lastSegmentBase === "" ? "default" : lastSegmentBase];
+        const envRef = `${prefix}/${refSegments.join("/")}`;
+        const relPath = path.join(subdir, relToEnvDir);
+        const findings = checkEnvForDangerousKeys(envPath, relPath, envRef);
         for (const finding of findings) {
             // Extract the key name from the detail string for the summary line.
             const keyMatch = finding.detail.match(/Env key `([^`]+)`/);
             const keyName = keyMatch ? keyMatch[1] : finding.file;
-            allFindings.push({ vaultRef, keyName, relPath });
+            allFindings.push({ envRef, keyName, relPath });
         }
     }
     return allFindings;
@@ -79,12 +140,18 @@ export async function auditInstalledStashForDangerousKeys(opts) {
     catch {
         return { blocked: false };
     }
-    if (allFindings.length === 0)
+    // The workspace activation policy fixes the baseline stance; the interactive
+    // confirm / rollback below is layered on top of the `"gate"` stance only.
+    const stance = decideDangerousKeyInstall({
+        findingsPresent: allFindings.length > 0,
+        allowInsecure: allowDangerousKeys,
+    });
+    if (stance === "allow")
         return { blocked: false };
-    if (allowDangerousKeys) {
+    if (stance === "warn-allow") {
         // Operator has explicitly accepted the risk — warn and continue.
         for (const f of allFindings) {
-            warn(`[dangerous-vault-key] ${f.relPath}: key \`${f.keyName}\` in ${f.vaultRef} can hijack process execution via \`akm env run\`. Proceeding because --allow-insecure was set.`);
+            warn(`[dangerous-env-key] ${f.relPath}: key \`${f.keyName}\` in ${f.envRef} can hijack process execution via \`akm env run\`. Proceeding because --allow-insecure was set.`);
         }
         return { blocked: false };
     }
@@ -98,7 +165,7 @@ export async function auditInstalledStashForDangerousKeys(opts) {
         }
         catch (_rollbackErr) {
             return (`Rollback failed — stash may still be installed at ${installedStashRoot}. ` +
-                `Remove it manually with: akm remove ${rollbackTarget}`);
+                `Remove it manually with: akm bundle remove ${rollbackTarget}`);
         }
     }
     if (isTTY) {
@@ -106,14 +173,14 @@ export async function auditInstalledStashForDangerousKeys(opts) {
         // Guard on stdin (not stdout) because p.confirm() reads from stdin;
         // stdout may be a TTY while stdin is piped, which would cause a hang.
         const stashLabel = ref;
-        const groupedByVault = new Map();
+        const groupedByEnv = new Map();
         for (const f of allFindings) {
-            const existing = groupedByVault.get(f.vaultRef) ?? [];
+            const existing = groupedByEnv.get(f.envRef) ?? [];
             existing.push(f.keyName);
-            groupedByVault.set(f.vaultRef, existing);
+            groupedByEnv.set(f.envRef, existing);
         }
-        for (const [vaultRef, keys] of groupedByVault) {
-            warn(`[warn] Env "${vaultRef}" in stash "${stashLabel}" contains potentially dangerous keys:`);
+        for (const [envRef, keys] of groupedByEnv) {
+            warn(`[warn] Env "${envRef}" in stash "${stashLabel}" contains potentially dangerous keys:`);
             for (const key of keys) {
                 warn(`  - ${key}: can hijack process execution via \`akm env run\``);
             }
@@ -127,7 +194,7 @@ export async function auditInstalledStashForDangerousKeys(opts) {
             console.error(JSON.stringify({
                 ok: false,
                 error: "Install aborted: stash contains dangerous env keys. Remove the keys or re-run with --allow-insecure to bypass.",
-                code: "DANGEROUS_VAULT_KEY",
+                code: "DANGEROUS_ENV_KEY",
                 ...(rollbackWarning ? { rollbackWarning } : {}),
             }, null, 2));
             return { blocked: true, exitCode: 1 };
@@ -137,11 +204,11 @@ export async function auditInstalledStashForDangerousKeys(opts) {
     }
     // Non-interactive path without bypass flag: fail hard.
     const rollbackWarning = await rollback();
-    const keyList = allFindings.map((f) => `  - ${f.keyName} (${f.vaultRef})`).join("\n");
+    const keyList = allFindings.map((f) => `  - ${f.keyName} (${f.envRef})`).join("\n");
     console.error(JSON.stringify({
         ok: false,
         error: `Install blocked: stash "${ref}" contains dangerous env keys that can hijack process execution via \`akm env run\`:\n${keyList}\nRe-run with --allow-insecure to bypass this check after reviewing the env file.`,
-        code: "DANGEROUS_VAULT_KEY",
+        code: "DANGEROUS_ENV_KEY",
         ...(rollbackWarning ? { rollbackWarning } : {}),
     }, null, 2));
     return { blocked: true, exitCode: 1 };
@@ -163,18 +230,14 @@ export const addCommand = defineJsonCommand({
         name: { type: "string", description: "Human-friendly name for the source" },
         writable: {
             type: "boolean",
-            description: "Mark a git stash as writable so changes can be pushed back",
+            description: "Mark a git bundle as writable so changes can be pushed back",
             default: false,
         },
-        type: {
-            type: "string",
-            description: "Override asset type for all files in this stash (currently supports: wiki)",
-        },
         "max-pages": { type: "string", description: "Maximum pages to crawl for website sources (default: 50)" },
         "max-depth": { type: "string", description: "Maximum crawl depth for website sources (default: 3)" },
         "allow-insecure": {
             type: "boolean",
-            description: "Allow a plain HTTP source URL and skip confirmation for dangerous env keys (e.g. LD_PRELOAD, PATH). Use only after explicitly reviewing the stash.",
+            description: "Allow a plain HTTP source URL and skip confirmation for dangerous env keys (e.g. LD_PRELOAD, PATH). Use only after explicitly reviewing the bundle.",
             default: false,
         },
     },
@@ -182,7 +245,9 @@ export const addCommand = defineJsonCommand({
         const ref = args.ref.trim();
         const allowInsecure = args["allow-insecure"];
         const allowDangerousKeys = allowInsecure;
-        // URL with --provider → stash source (remote or git provider)
+        // --provider → declarative bundle source (URL for git/website; bare
+        // package spec for npm — R-013). Config-only write; content is not
+        // synced until a later `akm update`.
         if (args.provider) {
             if (shouldWarnOnPlainHttp(ref)) {
                 if (!allowInsecure) {
@@ -228,25 +293,9 @@ export const addCommand = defineJsonCommand({
             warn("Warning: source URL uses plain HTTP (not HTTPS). --allow-insecure was set; an on-path attacker could substitute a malicious payload.");
         }
         const websiteOptions = buildWebsiteOptions(args);
-        if (args.type === "wiki") {
-            const { registerWikiSource } = await import("./source-add.js");
-            const result = await registerWikiSource({
-                ref,
-                name: args.name,
-                options: Object.keys(websiteOptions).length > 0 ? websiteOptions : undefined,
-                writable: args.writable,
-            });
-            appendEvent({
-                eventType: "add",
-                metadata: { target: ref, type: "wiki", name: args.name ?? null, writable: args.writable === true },
-            });
-            output("add", result);
-            return;
-        }
         const result = await akmAdd({
             ref,
             name: args.name,
-            overrideType: args.type,
             options: Object.keys(websiteOptions).length > 0 ? websiteOptions : undefined,
             writable: args.writable,
         });
@@ -255,7 +304,6 @@ export const addCommand = defineJsonCommand({
             metadata: {
                 target: ref,
                 name: args.name ?? null,
-                overrideType: args.type ?? null,
                 writable: args.writable === true,
             },
         });
@@ -271,8 +319,14 @@ export const addCommand = defineJsonCommand({
             // Use the canonical installed id (most reliably resolved by akmRemove) rather
             // than the raw user-supplied ref which may not match after URL normalisation.
             const rollbackTarget = result.installed?.id ?? result.sourceAdded?.stashRoot ?? ref;
-            // The audit RETURNS its decision; we decide `process.exit` here, OUTSIDE
-            // any catch, so the abort cannot be lost to a swallowed exception (C3).
+            // The audit RETURNS its decision; we decide the exit outcome here,
+            // OUTSIDE any catch, so the abort cannot be lost to a swallowed
+            // exception (C3). F4: `process.exitCode = …; return;` instead of
+            // `process.exit(...)` — the DANGEROUS_ENV_KEY error envelope has
+            // already been written to stderr by the audit itself (or is about to
+            // be), so an explicit `return` here (skipping the success `output("add",
+            // …)` below) is load-bearing, not merely cosmetic: it is what stops a
+            // blocked install from ALSO printing a success envelope.
             const decision = await auditInstalledStashForDangerousKeys({
                 installedStashRoot,
                 ref,
@@ -281,7 +335,8 @@ export const addCommand = defineJsonCommand({
                 isTTY: process.stdin.isTTY === true,
             });
             if (decision.blocked) {
-                process.exit(decision.exitCode);
+                process.exitCode = decision.exitCode;
+                return;
             }
         }
         output("add", result);