akm-cli 0.9.0-rc.13 → 0.9.0-rc.14

package/dist/commands/agent/contribute-cli.js

@@ -25,6 +25,7 @@ import { getStringArg, parsePositiveIntFlag } from "../../cli/parse-args.js";
 import { EXIT_CODES, GLOBAL_OUTPUT_ARGS, output, runWithJsonErrors } from "../../cli/shared.js";
 import { loadConfig } from "../../core/config/config.js";
 import { resolveUsageEventSource } from "../../indexer/usage/usage-events.js";
+import { getHyphenatedBoolean } from "../../output/context.js";
 import { akmLint } from "../lint/index.js";
 import { akmAgentDispatch } from "./agent-dispatch.js";
 const EXIT_GENERAL = EXIT_CODES.GENERAL;
@@ -132,8 +133,19 @@ export const lintCommand = defineCommand({
         ...GLOBAL_OUTPUT_ARGS,
         fix: {
             type: "boolean",
-            alias: "auto-fix",
-            description: "Apply auto-fixes in place (alias: --auto-fix)",
+            description: "Apply auto-fixes in place",
+            default: false,
+        },
+        // Declared as its own arg rather than `alias: "auto-fix"`: citty's alias
+        // handling (node:util parseArgs `short` options) only supports
+        // SINGLE-character aliases. A
+        // multi-char alias rendered in help as `-auto-fix` (one dash) and parsed
+        // as a pile of junk single-char flags, so BOTH advertised spellings —
+        // `-auto-fix` and `--auto-fix` — silently ran a plain lint while claiming
+        // to fix. Two real boolean args, OR'd at the call site, work and render.
+        "auto-fix": {
+            type: "boolean",
+            description: "Apply auto-fixes in place (same as --fix)",
             default: false,
         },
         dir: { type: "string", description: "Override bundle root directory (default: from config)" },
@@ -151,7 +163,7 @@ export const lintCommand = defineCommand({
     async run({ args }) {
         await runWithJsonErrors(async () => {
             const result = akmLint({
-                fix: args.fix ?? false,
+                fix: args.fix === true || getHyphenatedBoolean(args, "auto-fix"),
                 dir: getStringArg(args, "dir"),
                 typeFilter: getStringArg(args, "type"),
             });

package/dist/commands/feedback-cli.js

@@ -9,7 +9,7 @@ import { parseFrontmatter, parseFrontmatterBlock } from "../core/asset/frontmatt
 import { conceptIdFromTypeName, parseRefInput } from "../core/asset/resolve-ref.js";
 import { isWithin, writeFileAtomic } from "../core/common.js";
 import { FEEDBACK_FAILURE_MODES, loadConfig } from "../core/config/config.js";
-import { UsageError } from "../core/errors.js";
+import { NotFoundError, UsageError } from "../core/errors.js";
 import { appendEvent } from "../core/events.js";
 import { resolveMutationTarget } from "../core/mutation-target.js";
 import { getDbPath } from "../core/paths.js";
@@ -311,8 +311,11 @@ export const feedbackCommand = defineJsonCommand({
             const lookupRef = makeBundleRef(parsedRef.bundle, parsedRef.conceptId);
             const entryId = findEntryIdByRef(db, lookupRef, requestedSource?.path);
             if (entryId === undefined) {
-                throw new UsageError(`Ref "${ref}" is not in the index. ` +
-                    "Run 'akm search' to verify the asset exists, then 'akm index' if it was recently added.");
+                // NotFoundError (exit 1), not UsageError (exit 2): the flags parsed
+                // fine, the asset just isn't there. The documented exit-code table
+                // reserves 1 for "requested resource missing", and scripts branch on it.
+                throw new NotFoundError(`Ref "${ref}" is not in the index. ` +
+                    "Run 'akm search' to verify the asset exists, then 'akm index' if it was recently added.", "ASSET_NOT_FOUND");
             }
             // Persist the feedback signal into usage_events. Both positive and
             // negative signals apply the EMA utility update immediately — no

package/dist/commands/improve/collapse-detector.js

@@ -15,9 +15,8 @@
  * hardcoded 0 from the 0.9.0 confidence-gate deletion onward), so the alert
  * could never fire. See the design doc's status note for the removal
  * rationale. `improve_cycle_metrics.accepted_actions` stays in the schema and
- * is written as 0: its migration body is released, and 0.8 ships `state.db`,
- * so a deployed ledger may already have sealed that body's checksum. Editing
- * it would fail those installs closed.
+ * is written as 0 because deployed `state.db` files already contain it and
+ * removing it would be a destructive schema change.
  *
  * Hard invariants: deterministic only (FTS BM25 + hashing — never an LLM,
  * never an embedding model); bounded storage (< 2 KB per qualifying cycle,

package/dist/commands/lint/base-linter.js

@@ -35,15 +35,11 @@ import fs from "node:fs";
 import path from "node:path";
 import { assetPathForName, stashDirFor } from "../../core/asset/asset-placement.js";
 import { BUNDLE_REF_RE } from "../../core/asset/asset-ref.js";
+import { spliceFrontmatterLine } from "../../core/asset/frontmatter.js";
 import { typeNameFromConceptId } from "../../core/asset/resolve-ref.js";
+import { localDateStamp } from "../../core/common.js";
 import { findFenceRegions } from "./markdown-insertion.js";
 // ── Helpers ───────────────────────────────────────────────────────────────────
-function formatDate(d) {
-    const y = d.getFullYear();
-    const m = String(d.getMonth() + 1).padStart(2, "0");
-    const day = String(d.getDate()).padStart(2, "0");
-    return `${y}-${m}-${day}`;
-}
 function checkUnquotedColon(frontmatterText) {
     if (!frontmatterText)
         return null;
@@ -86,15 +82,7 @@ function checkMissingUpdated(data, frontmatterText) {
     return frontmatterText !== null && !("updated" in data);
 }
 function fixMissingUpdated(raw, mtime) {
-    const dateStr = formatDate(mtime);
-    const lines = raw.split(/\r?\n/);
-    if (lines[0]?.trim() !== "---")
-        return raw;
-    const closeIdx = lines.findIndex((l, i) => i > 0 && l.trim() === "---");
-    if (closeIdx === -1)
-        return raw;
-    lines.splice(closeIdx, 0, `updated: ${dateStr}`);
-    return lines.join("\n");
+    return spliceFrontmatterLine(raw, `updated: ${localDateStamp(mtime)}`) ?? raw;
 }
 // ── stale-path helpers ────────────────────────────────────────────────────────
 function checkStalePath(body) {
@@ -529,7 +517,7 @@ export function runBaseChecks(ctx) {
             issues.push({
                 file: ctx.relPath,
                 issue: "missing-updated",
-                detail: `stamped updated: ${formatDate(mtime)}`,
+                detail: `stamped updated: ${localDateStamp(mtime)}`,
                 fixed: true,
             });
         }

package/dist/commands/lint/index.js

@@ -6,7 +6,9 @@ import path from "node:path";
 import { parse as parseYaml } from "yaml";
 import { factDiagnostics, matchWorkflowPlaceholder, memoryOrphanStubApplies, nameOrTypeDiagnostics, ORPHANED_STUB_DETAIL, taskDiagnostics, workflowStructureDiagnostics, } from "../../core/adapter/adapters/akm-lint.js";
 import { detectAdapterId } from "../../core/adapter/detect-adapter.js";
+import { stashDirFor } from "../../core/asset/asset-placement.js";
 import { parseFrontmatter, parseFrontmatterBlock } from "../../core/asset/frontmatter.js";
+import { conceptIdForStashFile, displayRefForConceptId } from "../../core/asset/resolve-ref.js";
 import { resolveStashDir } from "../../core/common.js";
 import { loadConfig, primaryBundlePath } from "../../core/config/config.js";
 import { resolveSourceEntries } from "../../indexer/search/search-source.js";
@@ -321,23 +323,21 @@ export function akmLint(options = {}) {
     // keys that are known to enable process-execution hijacking. Warn-only —
     // findings go into `flagged`, never `fixed`.
     const envRoots = [stashRoot, ...extraStashRoots];
+    const bundleIdByRoot = new Map(sources.map((source) => [path.resolve(source.path), source.registryId]));
     for (const root of envRoots) {
-        // The `env` assets live under `env/` (ref prefix `env:`); whole-file
-        // `secret` assets live under `secrets/` (canonical ref prefix `secret:`,
-        // singular). Map the scan directory to its canonical ref prefix so the
-        // finding's `Ref:` field matches what `akm show`/`akm secret` accept.
-        for (const { scanSubdir, refPrefix } of [
-            { scanSubdir: "env", refPrefix: "env" },
-            { scanSubdir: "secrets", refPrefix: "secret" },
-        ]) {
-            const dir = path.join(root, scanSubdir);
+        const bundleId = bundleIdByRoot.get(path.resolve(root));
+        // `env` assets live under `env/`, whole-file `secret` assets under
+        // `secrets/`. `displayRefForConceptId` owns the short-default /
+        // qualified-secondary `Ref:` spelling `akm show` emits — the old
+        // hand-built `env:<base>` colon grammar is rejected by the 0.9.0 ref
+        // parser, which dead-ended a user copying the ref off a security finding.
+        for (const assetType of ["env", "secret"]) {
+            const dir = path.join(root, stashDirFor(assetType));
             if (!fs.existsSync(dir))
                 continue;
             for (const envPath of collectEnvFiles(dir)) {
-                const baseName = path.basename(envPath, ".env");
-                // A dotfile literally named `.env` has an empty baseName — use the full
-                // basename so it doesn't collide with `default.env` → refPrefix:default.
-                const ref = baseName === "" ? `${refPrefix}:.env` : `${refPrefix}:${baseName}`;
+                const conceptId = conceptIdForStashFile(assetType, root, envPath);
+                const ref = displayRefForConceptId(conceptId, bundleId, cfg.defaultBundle);
                 const relPath = path.relative(root, envPath);
                 for (const issue of checkEnvForDangerousKeys(envPath, relPath, ref)) {
                     flagged.push(issue);

package/dist/commands/log.js

@@ -16,6 +16,7 @@
  * other caller and was removed with it.
  */
 import { makeBundleRef, parseBundleRef } from "../core/asset/asset-ref.js";
+import { loadConfig } from "../core/config/config.js";
 import { UsageError } from "../core/errors.js";
 import { readEvents } from "../core/events.js";
 import { parseSinceToIso } from "../core/time.js";
@@ -49,7 +50,11 @@ function validateRef(ref) {
         throw new UsageError("--ref cannot be empty.", "INVALID_FLAG_VALUE");
     }
     const parsed = parseBundleRef(trimmed);
-    return makeBundleRef(parsed.bundle, parsed.conceptId);
+    // Deliberately shallow qualification: a bare conceptId is assumed to mean
+    // the default bundle, without the full priority-walk `resolveRef` performs —
+    // event refs are recorded fully qualified, so the default is the only
+    // spelling a short --ref can usefully mean here.
+    return makeBundleRef(parsed.bundle ?? loadConfig().defaultBundle, parsed.conceptId);
 }
 function validateRunId(run) {
     if (run === undefined)

package/dist/commands/migration-tool.js

@@ -7,8 +7,8 @@ import { fileURLToPath } from "node:url";
 import { NotFoundError } from "../core/errors.js";
 function migrationEntryPoint() {
     const candidates = [
-        fileURLToPath(new URL("../../scripts/akm-migrate.ts", import.meta.url)),
-        fileURLToPath(new URL("../scripts/akm-migrate.js", import.meta.url)),
+        fileURLToPath(new URL(process.versions.bun ? "../scripts/akm-migrate.js" : "../scripts/akm-migrate-node.js", import.meta.url)),
+        ...(process.versions.bun ? [fileURLToPath(new URL("../../scripts/akm-migrate.ts", import.meta.url))] : []),
     ];
     return candidates.find((candidate) => fs.existsSync(candidate));
 }
@@ -27,14 +27,13 @@ export async function runMigrationTool(args) {
     // `scripts/akm-standalone.ts`, which embeds the migrator and dispatches to
     // it when `AKM_MIGRATE_ENTRY=1` — so re-exec ourselves with the marker.
     // (src must not import scripts/: the dist build's tsc has `rootDir: src`.)
-    const runtime = process.versions.bun ? process.execPath : "bun";
-    const result = spawnSync(runtime, entry ? [entry, ...args] : [...args], {
+    const result = spawnSync(process.execPath, entry ? [entry, ...args] : [...args], {
         encoding: "utf8",
         env: entry ? process.env : { ...process.env, AKM_MIGRATE_ENTRY: "1" },
         maxBuffer: 16 * 1024 * 1024,
     });
     if (result.error) {
-        throw new NotFoundError(`Cannot start the standalone akm-migrate tool: ${result.error.message}`, "FILE_NOT_FOUND", "Install Bun, then run akm-migrate directly.");
+        throw new NotFoundError(`Cannot start the standalone akm-migrate tool: ${result.error.message}`, "FILE_NOT_FOUND", "Reinstall akm-cli, or use a runtime-free standalone release binary.");
     }
     if (result.stdout)
         process.stdout.write(result.stdout);

package/dist/commands/observability-cli.js

@@ -72,7 +72,7 @@ export const logCommand = defineJsonCommand({
         ref: { type: "string", description: "Filter by asset ref ([bundle//]conceptId)" },
         run: {
             type: "string",
-            description: "Filter to a workflow run's events (metadata.runId), e.g. the id from `akm workflow start`",
+            description: "Filter to a workflow run's events (metadata.runId), e.g. the id from `akm workflow run`",
         },
         "exclude-tags": {
             type: "string",

package/dist/commands/proposal/repository.js

@@ -168,7 +168,7 @@ function persistProposalUpdate(db, proposal, stashDir) {
         .prepare("SELECT metadata_json FROM proposals WHERE id = ? AND stash_dir = ?")
         .get(proposal.id, stashDir);
     if (!row)
-        throw new NotFoundError(`Proposal "${proposal.id}" not found.`, "FILE_NOT_FOUND");
+        throw new NotFoundError(`Proposal "${proposal.id}" not found.`, "PROPOSAL_NOT_FOUND");
     const metadata = JSON.parse(row.metadata_json);
     for (const field of [
         "sourceRun",
@@ -572,7 +572,7 @@ export function getProposal(stashDir, id, ctx) {
 function requireProposal(db, stashDir, id) {
     const proposal = getStateProposal(db, id, stashDir);
     if (!proposal) {
-        throw new NotFoundError(`Proposal "${id}" not found.`, "FILE_NOT_FOUND");
+        throw new NotFoundError(`Proposal "${id}" not found.`, "PROPOSAL_NOT_FOUND");
     }
     return proposal;
 }
@@ -588,7 +588,7 @@ function requireProposal(db, stashDir, id) {
 function requireProposalLenient(db, stashDir, id) {
     const proposal = getStateProposalLenient(db, id, stashDir);
     if (!proposal) {
-        throw new NotFoundError(`Proposal "${id}" not found.`, "FILE_NOT_FOUND");
+        throw new NotFoundError(`Proposal "${id}" not found.`, "PROPOSAL_NOT_FOUND");
     }
     return proposal;
 }
@@ -623,7 +623,7 @@ export function resolveProposalId(stashDir, idOrRef, ctx) {
             const archived = byRecency(forConcept());
             if (archived)
                 return archived;
-            throw new NotFoundError(`No proposal found for ref "${idOrRef}".`, "FILE_NOT_FOUND");
+            throw new NotFoundError(`No proposal found for ref "${idOrRef}".`, "PROPOSAL_NOT_FOUND");
         }
         // 3. UUID prefix (pending queue only).
         const prefixMatches = listStateProposalIdsByPrefix(db, stashDir, idOrRef);
@@ -632,7 +632,7 @@ export function resolveProposalId(stashDir, idOrRef, ctx) {
         if (prefixMatches.length > 1) {
             throw new UsageError(`Ambiguous prefix "${idOrRef}" — matches: ${prefixMatches.join(", ")}`, "INVALID_FLAG_VALUE");
         }
-        throw new NotFoundError(`Proposal "${idOrRef}" not found.`, "FILE_NOT_FOUND");
+        throw new NotFoundError(`Proposal "${idOrRef}" not found.`, "PROPOSAL_NOT_FOUND");
     });
 }
 /**

package/dist/commands/read/knowledge.js

@@ -27,6 +27,7 @@ import { commitWriteTargetBoundary, formatRefForMessage, recordWriteTargetPath,
 import { indexWrittenAssets } from "../../indexer/index-written-assets.js";
 import { deriveInstallations, slugForPath } from "../../indexer/installations.js";
 import { resolveSourceEntries } from "../../indexer/search/search-source.js";
+import { storeSecretResolver } from "../../sources/snapshot-fetchers/secret-seam.js";
 import { fetchWebsiteMarkdownSnapshot, shouldAllowPrivateWebsiteUrlForTests, } from "../../sources/snapshot-fetchers/website-ingest.js";
 import { writeSupersededEdge } from "../improve/memory/memory-belief.js";
 import { refToRelPath, resolveRefPathInStash } from "../lint/base-linter.js";
@@ -119,6 +120,7 @@ export async function readKnowledgeInput(source, options) {
         return readKnowledgeContent(source);
     const snapshot = await fetchWebsiteMarkdownSnapshot(source, {
         stashDir: options?.stashDir,
+        resolveSecret: storeSecretResolver.resolveSecret,
         allowPrivateHosts: options?.allowPrivateHosts ?? shouldAllowPrivateWebsiteUrlForTests(source),
     });
     return { content: snapshot.content, preferredName: snapshot.preferredName };

package/dist/commands/registry-cli.js

@@ -3,7 +3,7 @@
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import { defineGroupCommand, defineJsonCommand, output } from "../cli/shared.js";
 import { getEffectiveRegistries, loadUserConfig, mutateConfig } from "../core/config/config.js";
-import { UsageError } from "../core/errors.js";
+import { NotFoundError, UsageError } from "../core/errors.js";
 import { warn } from "../core/warn.js";
 export const registryCommand = defineGroupCommand({
     meta: { name: "registry", description: "Manage bundle registries" },
@@ -82,8 +82,10 @@ export const registryCommand = defineGroupCommand({
                 const registries = [...(config.registries ?? [])];
                 const idx = registries.findIndex((r) => r.url === args.target || r.name === args.target);
                 if (idx === -1) {
-                    output("registry-remove", { registries, removed: false, message: "No matching registry found" });
-                    return;
+                    // Was a success envelope with `removed: false` and exit 0, so
+                    // `akm registry remove typo && ...` proceeded as if it had removed
+                    // something. A missing target is exit 1, like every other not-found.
+                    throw new NotFoundError(`No registry matching "${args.target}" is configured.`, "SOURCE_NOT_FOUND", "Run `akm registry list` to see configured registries.");
                 }
                 const { confirmDestructive } = await import("../cli/confirm.js");
                 const confirmed = await confirmDestructive(`Remove registry "${args.target}"? This cannot be undone.`, {

package/dist/commands/sources/add-cli.js

@@ -4,6 +4,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import * as p from "../../cli/clack.js";
+import { getStringArg, parsePositiveIntFlag } from "../../cli/parse-args.js";
 import { defineJsonCommand, output } from "../../cli/shared.js";
 import { decideDangerousKeyInstall } from "../../core/activation-policy.js";
 import { UsageError } from "../../core/errors.js";
@@ -14,12 +15,11 @@ import { akmAdd } from "./source-add.js";
 import { addStash } from "./source-manage.js";
 // ── Shared website-options helper ──────────
 export function buildWebsiteOptions(args) {
-    const websiteOptions = {};
-    if (typeof args["max-pages"] === "string" && args["max-pages"].length > 0)
-        websiteOptions.maxPages = args["max-pages"];
-    if (typeof args["max-depth"] === "string" && args["max-depth"].length > 0)
-        websiteOptions.maxDepth = args["max-depth"];
-    return websiteOptions;
+    // getStringArg maps absent/blank to undefined; parsePositiveIntFlag maps
+    // undefined to undefined — so an unsupplied flag simply omits the key.
+    const maxPages = parsePositiveIntFlag(getStringArg(args, "max-pages"), "--max-pages");
+    const maxDepth = parsePositiveIntFlag(getStringArg(args, "max-depth"), "--max-depth");
+    return { ...(maxPages !== undefined ? { maxPages } : {}), ...(maxDepth !== undefined ? { maxDepth } : {}) };
 }
 // ── HTTP safety check ─────────────────────────────────────────────────────────
 export function shouldWarnOnPlainHttp(ref) {

package/dist/commands/sources/self-update.js

@@ -5,7 +5,7 @@ import * as childProcess from "node:child_process";
 import { createHash } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
-import { fetchWithRetry, IS_WINDOWS, ResponseTooLargeError, readBodyWithByteCap } from "../../core/common.js";
+import { fetchWithRetry, IS_WINDOWS, ResponseTooLargeError, readBodyWithByteCap, readChunkWithDeadline, } from "../../core/common.js";
 import { ConfigError } from "../../core/errors.js";
 import { warn } from "../../core/warn.js";
 import { githubHeaders } from "../../integrations/github.js";
@@ -29,7 +29,19 @@ export function defaultMigrationCommand(preparedConfigPath) {
         apply: (akmBin) => runRequiredCommand(akmBin, ["migrate", "apply", ...configArgs], "Migration apply"),
     };
 }
-async function streamResponseToFile(response, destination, maxBytes) {
+/**
+ * Bounds on the binary body read. `fetchWithTimeout`'s timer only covers
+ * time-to-HEADERS — it is cleared the moment `fetch` resolves — so without
+ * these a compromised or misconfigured endpoint could dribble bytes forever
+ * and hang `akm upgrade` with no output and no way out but Ctrl-C. Two
+ * bounds, because either alone is evadable: a per-chunk STALL deadline (a
+ * connection making no progress dies quickly, while a slow-but-progressing
+ * one is left alone) and an OVERALL deadline (a trickle that sends one byte
+ * per stall-window can't stretch the download indefinitely).
+ */
+const BINARY_STALL_TIMEOUT_MS = 60_000;
+const BINARY_TOTAL_TIMEOUT_MS = 30 * 60_000;
+export async function streamResponseToFile(response, destination, maxBytes, limits) {
     const declaredText = response.headers.get("content-length");
     if (declaredText) {
         const declared = Number(declaredText);
@@ -40,22 +52,30 @@ async function streamResponseToFile(response, destination, maxBytes) {
     }
     if (!response.body)
         throw new Error("Binary download response did not provide a streaming body.");
+    const url = response.url || "binary download";
+    const stallTimeoutMs = limits?.stallTimeoutMs ?? BINARY_STALL_TIMEOUT_MS;
+    const totalTimeoutMs = limits?.totalTimeoutMs ?? BINARY_TOTAL_TIMEOUT_MS;
+    const overallDeadlineAt = Date.now() + totalTimeoutMs;
     const fd = fs.openSync(destination, "w", 0o600);
     const reader = response.body.getReader();
     const hash = createHash("sha256");
     let byteSize = 0;
     try {
         while (true) {
-            const { done, value } = await reader.read();
+            // Whichever bound bites first wins, and the error reports THAT bound —
+            // "no data for 60s" and "download exceeded 30m" are different diagnoses.
+            const stallDeadlineAt = Date.now() + stallTimeoutMs;
+            const deadlineAt = Math.min(stallDeadlineAt, overallDeadlineAt);
+            const reportedTimeoutMs = deadlineAt === overallDeadlineAt ? totalTimeoutMs : stallTimeoutMs;
+            const { done, value } = await readChunkWithDeadline(reader, deadlineAt, undefined, url, reportedTimeoutMs);
             if (done)
                 break;
             if (!value)
                 continue;
             byteSize += value.byteLength;
-            if (byteSize > maxBytes) {
-                await reader.cancel().catch(() => undefined);
-                throw new ResponseTooLargeError(response.url || "binary download", maxBytes, byteSize);
-            }
+            // The catch block cancels the reader for every throw path, this included.
+            if (byteSize > maxBytes)
+                throw new ResponseTooLargeError(url, maxBytes, byteSize);
             hash.update(value);
             let written = 0;
             while (written < value.byteLength)
@@ -65,6 +85,9 @@ async function streamResponseToFile(response, destination, maxBytes) {
         return { byteSize, sha256: hash.digest("hex") };
     }
     catch (error) {
+        // Cancel so a timed-out (still-open) connection releases its socket rather
+        // than lingering until process exit. Already-cancelled readers no-op.
+        await reader.cancel().catch(() => undefined);
         removeFileBestEffort(destination);
         throw error;
     }

package/dist/commands/sources/source-add.js

@@ -14,6 +14,7 @@ import { readLockfile, removeLockEntry, upsertLockEntry } from "../../integratio
 import { parseRegistryRef } from "../../registry/resolve.js";
 import { detectStashRoot } from "../../sources/providers/provider-utils.js";
 import { syncFromRef } from "../../sources/providers/sync-from-ref.js";
+import { storeSecretResolver } from "../../sources/snapshot-fetchers/secret-seam.js";
 import { ensureWebsiteMirror, shouldAllowPrivateWebsiteUrlForTests, validateWebsiteInputUrl, } from "../../sources/snapshot-fetchers/website-ingest.js";
 import { bundleKeyForPath, bundleKeyForUrl, nextBundleKey } from "./bundle-config-ops.js";
 export async function akmAdd(input) {
@@ -95,13 +96,26 @@ async function addLocalSource(ref, sourcePath, stashDir, explicitName) {
 async function addWebsiteSource(ref, stashDir, name, options) {
     const allowPrivateHosts = shouldAllowPrivateWebsiteUrlForTests(ref);
     const normalizedUrl = validateWebsiteInputUrl(ref, { allowPrivateHosts });
-    const maxPages = typeof options?.maxPages === "number" ? options.maxPages : undefined;
+    const numberOption = (value) => (typeof value === "number" ? value : undefined);
+    const maxPages = numberOption(options?.maxPages);
+    const maxDepth = numberOption(options?.maxDepth);
     let entry;
     mutateConfig((config) => {
         const bundles = { ...(config.bundles ?? {}) };
         const existingKey = bundleKeyForUrl(config, normalizedUrl);
         const key = existingKey ?? nextBundleKey(bundles, name ?? toWebsiteName(normalizedUrl), normalizedUrl);
-        const website = { url: normalizedUrl, ...(maxPages !== undefined ? { maxPages } : {}) };
+        // Merge onto the existing descriptor rather than replacing it: re-running
+        // `bundle add` for a URL that already has a bundle would otherwise drop
+        // respectRobots / refresh, silently restoring default robots enforcement
+        // and changing what the next update fetches. Explicitly-passed maxPages /
+        // maxDepth still win over the stored values.
+        const existingWebsite = existingKey ? (bundles[key]?.website ?? {}) : {};
+        const website = {
+            ...existingWebsite,
+            url: normalizedUrl,
+            ...(maxPages !== undefined ? { maxPages } : {}),
+            ...(maxDepth !== undefined ? { maxDepth } : {}),
+        };
         const nextBundle = {
             ...(existingKey ? bundles[key] : {}),
             website,
@@ -117,6 +131,7 @@ async function addWebsiteSource(ref, stashDir, name, options) {
     });
     const cachePaths = await ensureWebsiteMirror(entry, {
         requireStashDir: true,
+        resolveSecret: storeSecretResolver.resolveSecret,
         ...(allowPrivateHosts ? { allowPrivateHosts: true } : {}),
     });
     const index = await akmIndex({ stashDir });

package/dist/commands/tasks/tasks.js

@@ -60,7 +60,12 @@ export async function akmTasksAdd(input, deps = {}) {
     if (!isWithin(assetPath, typeRoot)) {
         throw new UsageError(`Resolved task path escapes the stash: "${id}".`, "PATH_ESCAPE_VIOLATION");
     }
-    if (fs.existsSync(assetPath) && !input.force) {
+    // Pre-0.8.0 tasks were markdown; the 0.8.0 cutover moved them to pure YAML
+    // (see the tasks dir rule in src/indexer/walk/matchers.ts). A leftover
+    // `<id>.md` still names the same task, so creating `<id>.yml` beside it
+    // must collide loudly rather than silently minting a duplicate.
+    const legacyAssetPath = path.join(typeRoot, `${id}.md`);
+    if ((fs.existsSync(assetPath) || fs.existsSync(legacyAssetPath)) && !input.force) {
         throw new UsageError(`Task "${id}" already exists. Pass --force to overwrite, or delete its file and run \`akm task sync\` first.`, "RESOURCE_ALREADY_EXISTS");
     }
     const yaml = renderTaskYaml({
@@ -408,8 +413,8 @@ export async function akmTasksDoctor(deps = {}) {
         configKey: IMPROVE_AUTONOMY_CONFIG_KEY,
         gatedLanes: allGated.map((entry) => ({ lane: entry.lane, reason: entry.reason })),
     };
-    // Q-05 — report the workflow engine gate's state alongside the autonomy
-    // gate: both are `experimental.*` opt-ins doctor exists to surface.
+    // Q-05 — report the external-driver gate alongside the autonomy gate: both
+    // are `experimental.*` opt-ins doctor exists to surface.
     const workflowEngine = {
         enabled: isWorkflowEngineEnabled(config),
         configKey: WORKFLOW_ENGINE_CONFIG_KEY,