akm-cli 0.9.0-rc.1 → 0.9.0-rc.13

package/README.md

@@ -1,44 +1,44 @@
-# akm -- Agent Knowledge Management
+# akm -- Agent Knowledge Manager
 
-> **akm** (Agent Knowledge Management) -- A package manager for AI agent skills, commands, tools, and knowledge.
+> **akm** (Agent Knowledge Manager) -- A knowledge toolkit for AI agents.
 
 [![npm version](https://img.shields.io/npm/v/akm-cli)](https://www.npmjs.com/package/akm-cli)
 [![npm downloads](https://img.shields.io/npm/dm/akm-cli)](https://www.npmjs.com/package/akm-cli)
 [![license](https://img.shields.io/github/license/itlackey/akm)](https://github.com/itlackey/akm/blob/main/LICENSE)
 
-`akm` is a package manager for AI agent capabilities -- scripts, skills, commands,
-agents, knowledge, memories, workflows, wikis, env files, secrets, lessons, and
-scheduled tasks. It works with any AI coding assistant that can run shell commands,
+`akm` is a knowledge toolkit for AI agent capabilities -- scripts, skills, commands,
+agents, knowledge, instructions, memories, workflows, env files, secrets, lessons,
+tasks, sessions, and facts. It can discover and install bundles from npm, git, local
+directories, and configured registries. It works with any AI coding assistant that can run shell commands,
 including [Claude Code](https://claude.ai/code),
 [OpenCode](https://opencode.ai), [Cursor](https://cursor.com), and more.
 
 ## Install
 
-**Option 1 — Prebuilt binary (recommended, no runtime required):**
+**Option 1 — npm package (recommended; requires [Node.js](https://nodejs.org) >= 22):**
 
 ```sh
-# Linux / macOS
-curl -fsSL https://github.com/itlackey/akm/releases/latest/download/install.sh | bash
-
-# Windows (PowerShell)
-irm https://github.com/itlackey/akm/releases/latest/download/install.ps1 | iex
+npm install -g akm-cli
 ```
 
-**Option 2 — Bun (requires [Bun](https://bun.sh) >= 1.0):**
+**Option 2 — Prebuilt binary (no runtime required):**
 
 ```sh
-bun install -g akm-cli
-```
-
-**Option 3 — Node.js (requires Node.js >= 20.12):**
+# Linux / macOS
+curl -fsSL https://github.com/itlackey/akm/releases/latest/download/install.sh | bash
 
-```sh
-npm install -g akm-cli
+# Windows (PowerShell)
+irm https://github.com/itlackey/akm/releases/latest/download/install.ps1 | iex
 ```
 
 Upgrade in place with `akm upgrade`.
 
-> **AKM 0.9.0 supports three install paths:** prebuilt binary, Bun, or Node.js >= 20.12.
+The npm package always uses Node.js to bootstrap its cross-platform command.
+If a working [Bun](https://bun.sh) >= 1.0 is also on `PATH`, the launcher
+prefers Bun for execution; old, unusable, or absent Bun installations fall back
+to Node.js. Node.js remains required for the npm package. The standalone
+binaries are runtime-free.
+
 > The old `vault` asset type was removed in 0.9.0; use `env` for whole `.env`
 > groups and `secret` for standalone sensitive values.
 
@@ -46,16 +46,41 @@ Upgrade in place with `akm upgrade`.
 
 ```sh
 akm setup                         # Guided setup: configure, initialize, and index
-akm add github:owner/repo         # Add a stash from GitHub
+akm task doctor                    # Verify scheduler and installed runtime
+akm bundle add github:owner/repo         # Add a bundle from GitHub
 akm search "deploy"               # Find assets across all sources
-akm show script:deploy.sh         # View details and run command
+akm show scripts/deploy.sh        # View details and run command
 ```
 
+Non-interactive setup never activates schedules.
+
+## Schedule Tasks Safely
+
+```sh
+akm setup                 # Review definitions, schedules, and enabled state
+# Confirm scheduler activation only after reviewing the complete task summary.
+akm task doctor           # Verify backend, runtime, task state, and warnings
+```
+
+Setup shows the complete task review — both the general-purpose core
+templates and the maintainer-oriented improve cadence — before asking one
+explicit question about changing task files and the OS scheduler. Only
+confirmation prepares the definitions and syncs the scheduler. Declining, or
+running setup non-interactively, leaves both unchanged. A scheduled entry
+captures the installed akm runtime used during activation. Ordinary
+`akm task sync` preserves that runtime; after moving or replacing the
+installation, use `akm task sync --rebind` explicitly to migrate or repair
+scheduler entries, then run `akm task doctor` again.
+
+Rerunning setup preserves existing scheduler bindings. If setup changes the AKM
+storage path, or the installed runtime path changes, run
+`akm task sync --rebind` explicitly.
+
 ## Why akm?
 
 - **Works with any AI agent** -- No plugins or SDKs required. Any model that can run shell commands can use `akm`.
-- **One command to search everything** -- Local stash, registries, and community skills from [skills.sh](https://skills.sh) in a single query.
-- **Install stashes from anywhere** -- npm, GitHub, GitLab, local directories.
+- **One command to search your knowledge** -- Local assets are searched by default. Add `--from registry` or `--from all` for configured registry results; [skills.sh](https://skills.sh) participates only when enabled.
+- **Install bundles from anywhere** -- npm, GitHub, GitLab, local directories.
 - **Semantic search** -- Optional local embeddings (via Ollama or HuggingFace) for finding assets by meaning, not just keywords.
 - **Private registries** -- Host your own registry for team or enterprise use.
 
@@ -67,22 +92,22 @@ Add this to your `AGENTS.md`, `CLAUDE.md`, or system prompt:
 ## Resources & Capabilities
 
 You have access to a searchable library of scripts, skills, commands, agents,
-knowledge, memories, workflows, wikis, env files, secrets, lessons, and scheduled tasks
-via the `akm` CLI. Use `akm -h` for details.
+knowledge, instructions, memories, workflows, env files, secrets, lessons, tasks,
+sessions, and facts via the `akm` CLI. Use `akm -h` for details.
 ```
 
-## Install Stashes from Anywhere
+## Install Bundles from Anywhere
 
 ```sh
-akm add @scope/my-stash                     # npm
-akm add github:owner/repo#v1.2.3            # GitHub with tag
-akm add git+https://gitlab.com/org/stash    # Any git repo
-akm add ./path/to/local/stash               # Local directory
+akm bundle add @scope/pkg                          # npm
+akm bundle add github:owner/repo#v1.2.3            # GitHub with tag
+akm bundle add git+https://gitlab.com/org/repo     # Any git repo
+akm bundle add ./path/to/local/dir                 # Local directory
 ```
 
-Manage stashes with `akm list`, `akm update --all`, and `akm remove`.
+Manage bundles with `akm bundle list`, `akm bundle update --all`, and `akm bundle remove`.
 
-## Publish Your Own Stash
+## Publish Your Own Bundle
 
 1. Organize your assets into a directory
 2. Add `"akm"` to `keywords` in `package.json`
@@ -93,11 +118,11 @@ Manage stashes with `akm list`, `akm update --all`, and `akm remove`.
 
 Full docs, CLI reference, and guides are available on [GitHub](https://github.com/itlackey/akm):
 
-- [Getting Started](https://github.com/itlackey/akm/blob/main/docs/getting-started.md)
-- [CLI Reference](https://github.com/itlackey/akm/blob/main/docs/cli.md)
-- [Configuration](https://github.com/itlackey/akm/blob/main/docs/configuration.md)
-- [Stash Maker's Guide](https://github.com/itlackey/akm/blob/main/docs/stash-makers.md)
-- [Registry](https://github.com/itlackey/akm/blob/main/docs/registry.md)
+- [Getting Started](https://github.com/itlackey/akm/blob/main/docs/guides/getting-started.md)
+- [CLI Reference](https://github.com/itlackey/akm/blob/main/docs/reference/cli.md)
+- [Configuration](https://github.com/itlackey/akm/blob/main/docs/reference/configuration.md)
+- [Bundle Maker's Guide](https://github.com/itlackey/akm/blob/main/docs/guides/stash-makers.md)
+- [Registry](https://github.com/itlackey/akm/blob/main/docs/reference/registry.md)
 
 ## License
 

package/SECURITY.md

@@ -7,9 +7,9 @@ Security fixes are made on the latest minor release line of `akm-cli`. The
 
 | Version | Supported |
 | --- | --- |
-| 0.8.x  | ✅ active |
-| 0.7.x  | ❌ no longer maintained |
-| < 0.7  | ❌ no longer maintained |
+| 0.9.x | ✅ active |
+| 0.8.x | ❌ no longer maintained |
+| < 0.8 | ❌ no longer maintained |
 
 ## Reporting a vulnerability
 
@@ -31,7 +31,7 @@ shell commands (via scripts, workflows, and agent dispatch), and talks to
 explicitly configured external services (LLM endpoints, git remotes, npm,
 HTTP sources). It does **not** ship telemetry, send data to anyone by
 default, or open network listeners. See
-[`docs/data-and-telemetry.md`](docs/data-and-telemetry.md) for the on-disk
+[`docs/reference/data-and-telemetry.md`](docs/reference/data-and-telemetry.md) for the on-disk
 inventory.
 
 Several akm surfaces execute user-controlled code or data with the full
@@ -42,52 +42,67 @@ bugs, but you should be aware of them:
 
 Workflow steps run in your shell with your PATH and your environment
 variables — including any secrets you have exported or loaded via
-`akm vault load`. **Only add workflow sources you trust.** See
-[`docs/features/workflows.md` — "Security: workflow sources are executed
-code"](docs/features/workflows.md#security-workflow-sources-are-executed-code)
+`akm env run` / `akm secret run`. **Only add workflow sources you trust.** See
+[`docs/reference/workflows.md` — "Security: workflow sources are executed
+code"](docs/reference/workflows.md#security-workflow-sources-are-executed-code)
 for the full discussion.
 
 ### Scripts execute shell commands
 
-`akm show script:<name>` returns a `run:` command line the user (or an
+`akm show scripts/<name>` returns a `run:` command line the user (or an
 integrating agent) then executes. The same trust model applies: scripts you
 install from third-party stashes are third-party code.
 
 ### Agents and commands embed user-authored prompts
 
-`akm show agent:<name>` and `akm show command:<name>` return prompt
+`akm show agents/<name>` and `akm show commands/<name>` return prompt
 templates and system prompts that an LLM will execute. A malicious stash
 maintainer could write a system prompt that instructs the LLM to read
 sensitive files in your working tree and exfiltrate them via the LLM
 response. Audit the prompt body the same way you'd audit a script.
 
-### Vaults are plaintext on disk
+### Installing a stash means trusting its code
 
-`akm vault` files are `0o600`-permissioned plaintext at
-`<stash>/vaults/<name>.env`. They are protected against other local users
-by filesystem permissions but not encrypted at rest. Do not commit vault
-files to source control — they are `.gitignore`d in the default stash
-layout for that reason. The `akm vault show` / `akm vault list` commands
-never echo values; `akm vault load` produces shell-eval output meant to be
-piped to `eval`, never displayed.
+Installing a stash is not a data-only operation: **`<stashDir>/scripts/wiki-fetchers/*.{ts,js,mjs}` is imported and EXECUTED during `akm index`** (when a website-snapshot source in that stash is synced), with no gate, no prompt, and no allowlist. Every file in that directory is dynamically `import()`ed, and only *after* the module has fully evaluated does akm check that its default export looks like a fetcher (`{ name, matches, fetch }`) — module-level code (anything outside the exported functions) runs unconditionally before that check ever happens, and a file that fails the check still ran. There is no sandboxing: a wiki-fetcher script executes with the full permissions of the akm process, exactly like the scripts and workflow steps documented above.
 
-### Improve / propose / distill send asset content to the configured LLM
+This is a deliberate design decision (owner ruling), not an oversight, and it will not change without a separate decision to add a gate. **If you install a stash from a source you do not trust, you are trusting its code to run on your machine at index time** — audit `scripts/wiki-fetchers/` the same way you would audit any other executable you're about to run, before installing.
 
-`akm improve`, `akm propose`, `akm distill`, `akm reflect`, and `akm
-consolidate` send asset frontmatter and body to whatever LLM endpoint is
-configured in `~/.config/akm/config.json` (under `llm.endpoint`). If you
-have configured a third-party LLM, your asset content goes to that
-third-party. Use a local model (`http://localhost:11434` via Ollama, etc.)
-for assets containing secrets or private notes.
+The built-in YouTube snapshot fetcher (`src/sources/snapshot-fetchers/youtube.ts`) deliberately **impersonates the YouTube Android app's InnerTube client** (`clientName: "ANDROID"`, a spoofed `clientVersion`) when calling YouTube's private `youtubei/v1/player` endpoint, because the public web client's caption URLs are Proof-of-Origin-Token gated and return empty bodies. This is known, intentional behavior needed to fetch captions at all, not a bug — documented here so it isn't mistaken for one.
+
+### Environment and secret assets are plaintext on disk
+
+`env` and `secret` assets are owner-permissioned plaintext under `<stash>/env/`
+and `<stash>/secrets/`. They are protected against other local users by
+filesystem permissions but are not encrypted at rest. Do not commit these
+files to source control. Normal `akm env` and `akm secret` output never echoes
+values; materialize values only at the command boundary with `akm env run`,
+`akm secret run`, or `akm secret path`.
+
+The knowledge graph extracted from your assets (entities/relations) lives
+only in `$DATA/index.db` and is surfaced as aggregate counts via `akm health`
+(`--report` for the full breakdown) — there is no export command that writes
+graph content to an arbitrary path.
+
+### Improve / propose send asset content to the configured LLM
+
+`akm improve` (whose strategies run processes such as reflect, distill, and
+consolidate) and `akm proposal new` can send asset frontmatter and body to the
+named LLM engine selected by the command, strategy, or current defaults. LLM
+connections live under
+`engines.<name>` in `~/.config/akm/config.json`. If you configure a third-party
+LLM, your asset content goes to that third party. Use a local engine endpoint
+(for example, `http://localhost:11434/v1/chat/completions` via Ollama) for assets
+containing secrets or private notes.
 
 ## Known non-issues
 
-- **`akm` requires Bun or the prebuilt binary** — Node.js is not supported
-  in 0.8.0 because Bun-specific APIs are used in hot paths. This is a
-  compatibility limitation, not a security risk; the prebuilt binary is a
-  Bun-compiled standalone executable.
+- **The `akm-cli` npm package requires Node.js >= 22 as its bootstrap.** A
+  working Bun >= 1.0 is preferred for execution when it is also on `PATH`; old,
+  unusable, or absent Bun installations fall back to Node.js. Bun does not
+  remove the package's Node.js requirement. Standalone binaries are
+  runtime-free. This is a compatibility limitation, not a security risk.
 - **Workflows can read any file the akm process can read.** This is not a
   bug — see "Threat model" above.
-- **`bun install -g akm-cli` runs the preinstall hook.** The hook only
-  emits an error message and exits non-zero on Node.js; it does not phone
-  home or write outside the install directory.
+- **Installing `akm-cli` runs the preinstall hook.** The hook only validates
+  the runtime version and exits non-zero when it is unsupported; it does not
+  phone home or write outside the install directory.

package/dist/akm

@@ -1,38 +1,162 @@
-#!/bin/sh
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at https://mozilla.org/MPL/2.0/.
-
-case "$0" in
-	*/*) SCRIPT_PATH=$0 ;;
-	*)
-		SCRIPT_PATH=$(command -v -- "$0" 2>/dev/null || true)
-		if [ -z "$SCRIPT_PATH" ]; then
-			echo "akm launcher could not resolve its own path." >&2
-			exit 127
-		fi
-		;;
-esac
-
-if command -v readlink >/dev/null 2>&1; then
-	while [ -L "$SCRIPT_PATH" ]; do
-		LINK_TARGET=$(readlink "$SCRIPT_PATH")
-		case "$LINK_TARGET" in
-			/*) SCRIPT_PATH=$LINK_TARGET ;;
-			*) SCRIPT_PATH=${SCRIPT_PATH%/*}/$LINK_TARGET ;;
-		esac
-	done
-fi
-
-SCRIPT_DIR=$(CDPATH= cd -- "${SCRIPT_PATH%/*}" && pwd)
-
-if command -v bun >/dev/null 2>&1; then
-	exec bun "$SCRIPT_DIR/cli.js" "$@"
-fi
-
-if command -v node >/dev/null 2>&1; then
-	exec node "$SCRIPT_DIR/cli-node.mjs" "$@"
-fi
-
-echo "akm requires Bun or Node.js >= 20.12.0 on PATH." >&2
-exit 127
+#!/usr/bin/env node
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+import { spawn, spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const CONTEXT_ARG = "--scheduler-context";
+const CONTEXT_KEYS = ["AKM_BUNDLE_DIR", "AKM_CONFIG_DIR", "AKM_DATA_DIR", "AKM_CACHE_DIR", "AKM_STATE_DIR"];
+const CONTROL_CHARACTER = /[\u0000-\u001f\u007f-\u009f]/;
+
+function invalidContext(file, reason) {
+  throw new Error(`Invalid scheduler context descriptor "${file}": ${reason}.`);
+}
+
+function readSchedulerContext(file) {
+  if (CONTROL_CHARACTER.test(file) || (!path.posix.isAbsolute(file) && !path.win32.isAbsolute(file))) {
+    invalidContext(file, "path must be absolute");
+  }
+  let linkStat;
+  try {
+    linkStat = fs.lstatSync(file);
+  } catch (error) {
+    invalidContext(file, error instanceof Error ? error.message : String(error));
+  }
+  if (linkStat.isSymbolicLink()) invalidContext(file, "symbolic links are not allowed");
+  if (!linkStat.isFile()) invalidContext(file, "path is not a regular file");
+
+  let bytes;
+  let fd;
+  try {
+    const noFollow = process.platform === "win32" ? 0 : fs.constants.O_NOFOLLOW;
+    fd = fs.openSync(file, fs.constants.O_RDONLY | noFollow);
+    const stat = fs.fstatSync(fd);
+    if (!stat.isFile()) invalidContext(file, "path is not a regular file");
+    if (process.platform !== "win32") {
+      if (typeof process.getuid !== "function") {
+        invalidContext(file, "current uid is unavailable for ownership verification");
+      }
+      const uid = process.getuid();
+      if (stat.uid !== uid) invalidContext(file, `file owner ${stat.uid} does not match uid ${uid}`);
+      if ((stat.mode & 0o077) !== 0) invalidContext(file, "group or other permissions must be disabled");
+    }
+    bytes = fs.readFileSync(fd);
+  } finally {
+    if (fd !== undefined) fs.closeSync(fd);
+  }
+
+  const match = /^([a-f0-9]{64})\.json$/.exec(path.basename(file));
+  const digest = createHash("sha256").update(bytes).digest("hex");
+  if (!match || match[1] !== digest) {
+    invalidContext(file, "content SHA-256 does not match the descriptor filename");
+  }
+
+  let descriptor;
+  try {
+    descriptor = JSON.parse(bytes.toString("utf8"));
+  } catch (error) {
+    invalidContext(file, error instanceof Error ? error.message : String(error));
+  }
+  if (
+    typeof descriptor !== "object" ||
+    descriptor === null ||
+    Array.isArray(descriptor) ||
+    descriptor.version !== 1 ||
+    Object.keys(descriptor).sort().join("\0") !== "environment\0version"
+  ) {
+    invalidContext(file, "expected the scheduler context v1 schema");
+  }
+  const environment = descriptor.environment;
+  const expected = [...CONTEXT_KEYS, "PATH"].sort();
+  const keys =
+    environment && typeof environment === "object" && !Array.isArray(environment)
+      ? Object.keys(environment).sort()
+      : [];
+  if (keys.length !== expected.length || keys.some((key, index) => key !== expected[index])) {
+    invalidContext(file, "environment keys do not match the scheduler context v1 schema");
+  }
+  for (const key of CONTEXT_KEYS) {
+    const value = environment[key];
+    if (
+      typeof value !== "string" ||
+      value.trim() === "" ||
+      CONTROL_CHARACTER.test(value) ||
+      (!path.posix.isAbsolute(value) && !path.win32.isAbsolute(value))
+    ) {
+      invalidContext(file, `${key} must be an absolute path without control characters`);
+    }
+  }
+  if (typeof environment.PATH !== "string" || CONTROL_CHARACTER.test(environment.PATH)) {
+    invalidContext(file, "PATH must be a string without control characters");
+  }
+  return environment;
+}
+
+const contextIndex = process.argv.indexOf(CONTEXT_ARG);
+let contextValid = true;
+if (contextIndex !== -1) {
+  try {
+    const contextPath = process.argv[contextIndex + 1];
+    if (!contextPath) throw new Error(`${CONTEXT_ARG} requires an absolute path.`);
+    const environment = readSchedulerContext(contextPath);
+    const expected = [...CONTEXT_KEYS, "PATH"].sort();
+    for (const key of expected) process.env[key] = environment[key];
+    process.argv.splice(contextIndex, 2);
+  } catch (error) {
+    console.error(`akm: ${error instanceof Error ? error.message : String(error)}`);
+    process.exitCode = 78;
+    contextValid = false;
+  }
+}
+
+if (contextValid) {
+  process.env.AKM_LAUNCHER_NODE = process.execPath;
+  process.env.AKM_LAUNCHER_PATH = fileURLToPath(import.meta.url);
+
+  if (!process.versions.bun) {
+    const [major = 0, minor = 0] = process.versions.node.split(".").map(Number);
+    if (major < 22) {
+      console.error("The akm-cli npm package requires Node.js >= 22 to bootstrap.");
+      process.exit(1);
+    }
+  }
+
+  const bunProbe = process.versions.bun
+    ? { status: 0, stdout: process.versions.bun }
+    : spawnSync("bun", ["--version"], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "ignore"],
+        timeout: 5_000,
+      });
+  const [bunMajor = 0] = (bunProbe.status === 0 ? bunProbe.stdout.trim() : "").split(".").map(Number);
+  const useBun = bunMajor >= 1;
+  const bunEntry = fileURLToPath(new URL("./cli.js", import.meta.url));
+  const nodeEntry = fileURLToPath(new URL("./cli-node.mjs", import.meta.url));
+
+  if (!useBun && !process.versions.bun) {
+    await import("./cli-node.mjs");
+  } else {
+    const command = useBun ? (process.versions.bun ? process.execPath : "bun") : "node";
+    const entry = useBun ? bunEntry : nodeEntry;
+    const runtime = useBun ? "Bun" : "Node.js";
+    const result = await new Promise((resolve) => {
+      const child = spawn(command, [entry, ...process.argv.slice(2)], { stdio: "inherit", env: process.env });
+      child.once("error", (error) => resolve({ error }));
+      child.once("exit", (code, signal) => resolve({ code, signal }));
+    });
+
+    if (result.error) {
+      console.error(`akm launcher could not start ${runtime}: ${result.error.message}`);
+      process.exitCode = 127;
+    } else if (result.signal) {
+      process.kill(process.pid, result.signal);
+    } else {
+      process.exitCode = result.code ?? 1;
+    }
+  }
+}

package/dist/akm-migrate

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+import { spawn, spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+if (!process.versions.bun) {
+  const [major = 0, minor = 0] = process.versions.node.split(".").map(Number);
+  if (major < 22) {
+    console.error("The akm-cli npm package requires Node.js >= 22 to bootstrap.");
+    process.exit(1);
+  }
+}
+
+const bunProbe = process.versions.bun
+  ? { status: 0, stdout: process.versions.bun }
+  : spawnSync("bun", ["--version"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 5_000,
+    });
+const [bunMajor = 0] = (bunProbe.status === 0 ? bunProbe.stdout.trim() : "").split(".").map(Number);
+const useBun = bunMajor >= 1;
+const bunEntry = fileURLToPath(new URL("./scripts/akm-migrate.js", import.meta.url));
+
+{
+  const command = process.versions.bun ? process.execPath : useBun ? "bun" : process.execPath;
+  const result = await new Promise((resolve) => {
+    const child = spawn(command, [bunEntry, ...process.argv.slice(2)], { stdio: "inherit" });
+    child.once("error", (error) => resolve({ error }));
+    child.once("exit", (code, signal) => resolve({ code, signal }));
+  });
+
+  if (result.error) {
+    console.error(`akm-migrate launcher could not start its runtime: ${result.error.message}`);
+    process.exitCode = 127;
+  } else if (result.signal) {
+    process.kill(process.pid, result.signal);
+  } else {
+    process.exitCode = result.code ?? 1;
+  }
+}

package/dist/assets/backends/schtasks-template.xml

@@ -3,6 +3,8 @@
   <RegistrationInfo>
     <Description>akm scheduled task: {{TASK_ID}}</Description>
     <URI>{{FOLDER}}{{TASK_ID}}</URI>
+    <Source>{{SIGNATURE}}</Source>
+    <Documentation>Log target (informational only; schtasks doesn't redirect): {{LOG_PATH}}</Documentation>
   </RegistrationInfo>
   <Triggers>
 {{TRIGGER_XML}}
@@ -25,5 +27,4 @@
       <Arguments>{{ARGS}}</Arguments>
     </Exec>
   </Actions>
-  <!-- Log target (informational only; schtasks doesn't redirect): {{LOG_PATH}} -->
 </Task>