akm-cli 0.9.0-rc.2 → 0.9.0-rc.4

package/dist/commands/tasks/tasks.js

@@ -19,13 +19,15 @@ import { getTaskHistoryDir, getTaskLogDir } from "../../core/paths.js";
 import { commitWriteTargetBoundary, deleteAssetFromSource, resolveWriteTarget, writeAssetToSource, } from "../../core/write-source.js";
 import { resolveAssetPath } from "../../sources/resolve.js";
 import { backendNameForPlatform, selectBackend } from "../../tasks/backends/index.js";
+import { findBareAkmExecutableIndex } from "../../tasks/command-executable.js";
 import { parseTaskDocument } from "../../tasks/parser.js";
 import { resolveAkmInvocation } from "../../tasks/resolve-akm-bin.js";
-import { exitCodeForStatus, readTaskHistory, runTask } from "../../tasks/runner.js";
+import { exitCodeForStatus, INVALID_TASK_ATTEMPT_ID, readTaskHistory, recordTaskAttemptFailure, runTask, } from "../../tasks/runner.js";
 import { parseSchedule, SCHEDULE_SUPPORTED_SUBSET_HINT, translateToCron } from "../../tasks/schedule.js";
+import { normaliseTaskId } from "../../tasks/task-id.js";
 import { validateTaskDocument } from "../../tasks/validator.js";
 import { resolveImproveStrategy } from "../improve/improve-strategies.js";
-export async function akmTasksAdd(input) {
+export async function akmTasksAdd(input, deps = {}) {
     const id = normaliseTaskId(input.id);
     const hasCommand = input.command !== undefined &&
         input.command !== null &&
@@ -47,7 +49,6 @@ export async function akmTasksAdd(input) {
     const target = resolveTaskWriteTarget();
     const stashDir = target.source.path;
     const typeRoot = path.join(stashDir, "tasks");
-    fs.mkdirSync(typeRoot, { recursive: true });
     const assetPath = resolveAssetPathFromName("task", typeRoot, id);
     if (!isWithin(assetPath, typeRoot)) {
         throw new UsageError(`Resolved task path escapes the stash: "${id}".`, "PATH_ESCAPE_VIOLATION");
@@ -73,25 +74,103 @@ export async function akmTasksAdd(input) {
     });
     const task = parseTaskDocument({ yaml, filePath: assetPath, id });
     await validateTaskDocument(task, { backend, stashDir });
+    const obsoleteReason = obsoleteBackupTaskReason(task);
+    if (obsoleteReason)
+        throw new UsageError(obsoleteReason, "INVALID_FLAG_VALUE");
     const ref = taskAssetRef(id);
-    await writeAssetToSource(target.source, target.config, ref, yaml);
-    // Install in the OS scheduler. If install fails after the file was written,
-    // delete the file so the on-disk state never claims a task is registered
-    // when it isn't.
+    const previousYaml = fs.existsSync(assetPath) ? fs.readFileSync(assetPath, "utf8") : undefined;
+    let previousTask;
+    let previousTaskError;
+    if (previousYaml !== undefined) {
+        try {
+            previousTask = parseTaskDocument({ yaml: previousYaml, filePath: assetPath, id });
+        }
+        catch (err) {
+            previousTaskError = err;
+        }
+    }
+    const sched = deps.backend ?? selectBackend();
+    const writeAsset = deps.writeAsset ?? writeAssetToSource;
+    const deleteAsset = deps.deleteAsset ?? deleteAssetFromSource;
+    const commitBoundary = deps.commitBoundary ?? commitWriteTargetBoundary;
+    const wasInstalled = previousYaml !== undefined && (await sched.list()).some((entry) => entry.id === id);
+    let sourceRestoreArmed = false;
+    let installSucceeded = false;
     try {
-        const sched = selectBackend();
+        sourceRestoreArmed = true;
+        await writeAsset(target.source, target.config, ref, yaml);
         await sched.install(task);
+        installSucceeded = true;
+        commitBoundary(target, `Update task:${id}`);
     }
     catch (err) {
-        try {
-            await deleteAssetFromSource(target.source, target.config, ref);
+        const rollbackErrors = [];
+        let sourceRestored = false;
+        if (sourceRestoreArmed) {
+            try {
+                if (previousYaml === undefined) {
+                    if (fs.existsSync(assetPath)) {
+                        await deleteAsset(target.source, target.config, ref);
+                        sourceRestored = true;
+                    }
+                }
+                else {
+                    await restoreTaskSourceBytes(writeAsset, target.source, target.config, ref, assetPath, previousYaml);
+                    sourceRestored = true;
+                }
+            }
+            catch (rollbackError) {
+                rollbackErrors.push(rollbackError);
+            }
         }
-        catch {
-            /* ignore */
+        if (installSucceeded && !wasInstalled) {
+            try {
+                await sched.uninstall(id);
+            }
+            catch (rollbackError) {
+                rollbackErrors.push(rollbackError);
+            }
+        }
+        else if (installSucceeded && previousTask) {
+            try {
+                await sched.install(previousTask);
+            }
+            catch (rollbackError) {
+                rollbackErrors.push(rollbackError);
+                try {
+                    if (typeof sched.setEnabled !== "function") {
+                        throw new Error(`Scheduler backend "${sched.name}" cannot disable task "${id}".`);
+                    }
+                    await sched.setEnabled(id, false);
+                }
+                catch (disableError) {
+                    rollbackErrors.push(disableError);
+                    try {
+                        await sched.uninstall(id);
+                    }
+                    catch (uninstallError) {
+                        rollbackErrors.push(uninstallError);
+                    }
+                }
+            }
+        }
+        else if (installSucceeded && wasInstalled) {
+            rollbackErrors.push(previousTaskError ?? new Error(`Prior task "${id}" could not be restored.`));
+        }
+        if (sourceRestored) {
+            try {
+                commitBoundary(target, `Restore task:${id}`);
+            }
+            catch (rollbackError) {
+                rollbackErrors.push(rollbackError);
+            }
+        }
+        if (rollbackErrors.length > 0) {
+            const message = err instanceof Error ? err.message : String(err);
+            throw new AggregateError([err, ...rollbackErrors], `${message}; rollback for task "${id}" was incomplete.`);
         }
         throw err;
     }
-    commitWriteTargetBoundary(target, `Update task:${id}`);
     return {
         id,
         ref: `task:${id}`,
@@ -206,38 +285,68 @@ export async function akmTasksShow(id) {
         tags: task.tags,
     };
 }
-export async function akmTasksRemove(id) {
+export async function akmTasksRemove(id, deps = {}) {
     const normalised = normaliseTaskId(id);
     const target = resolveTaskWriteTarget();
     const stashDir = target.source.path;
     const typeRoot = path.join(stashDir, "tasks");
     if (fs.existsSync(typeRoot))
         warnLegacyMdTaskFiles(typeRoot);
-    await resolveAssetPath(stashDir, "task", normalised);
+    const filePath = await resolveAssetPath(stashDir, "task", normalised);
+    const yaml = fs.readFileSync(filePath, "utf8");
     const ref = taskAssetRef(normalised);
-    const sched = selectBackend();
-    let uninstallError;
-    let deleteError;
+    const sched = deps.backend ?? selectBackend();
+    const writeAsset = deps.writeAsset ?? writeAssetToSource;
+    const deleteAsset = deps.deleteAsset ?? deleteAssetFromSource;
+    const commitBoundary = deps.commitBoundary ?? commitWriteTargetBoundary;
+    const wasInstalled = (await sched.list()).some((entry) => entry.id === normalised);
+    const previousTask = wasInstalled ? parseTaskDocument({ yaml, filePath, id: normalised }) : undefined;
+    let uninstallAttempted = false;
+    let deleteAttempted = false;
     try {
+        uninstallAttempted = true;
         await sched.uninstall(normalised);
+        deleteAttempted = true;
+        await deleteAsset(target.source, target.config, ref);
+        commitBoundary(target, `Remove task:${normalised}`);
     }
     catch (err) {
-        uninstallError = err;
-    }
-    try {
-        await deleteAssetFromSource(target.source, target.config, ref);
-    }
-    catch (err) {
-        deleteError = err;
+        const rollbackErrors = [];
+        let sourceRestored = false;
+        if (deleteAttempted) {
+            try {
+                await restoreTaskSourceBytes(writeAsset, target.source, target.config, ref, filePath, yaml);
+                sourceRestored = true;
+            }
+            catch (rollbackError) {
+                rollbackErrors.push(rollbackError);
+            }
+        }
+        if (uninstallAttempted && previousTask) {
+            try {
+                await sched.install(previousTask);
+            }
+            catch (rollbackError) {
+                rollbackErrors.push(rollbackError);
+            }
+        }
+        if (sourceRestored) {
+            try {
+                commitBoundary(target, `Restore task:${normalised}`);
+            }
+            catch (rollbackError) {
+                rollbackErrors.push(rollbackError);
+            }
+        }
+        if (rollbackErrors.length > 0) {
+            const message = err instanceof Error ? err.message : String(err);
+            throw new AggregateError([err, ...rollbackErrors], `${message}; rollback for task "${normalised}" was incomplete.`);
+        }
+        throw err;
     }
-    if (uninstallError !== undefined)
-        throw uninstallError;
-    if (deleteError !== undefined)
-        throw deleteError;
-    commitWriteTargetBoundary(target, `Remove task:${normalised}`);
     return { id: normalised, removed: true, backend: sched.name };
 }
-export async function akmTasksSetEnabled(id, enabled) {
+export async function akmTasksSetEnabled(id, enabled, deps = {}) {
     const normalised = normaliseTaskId(id);
     const target = resolveTaskWriteTarget();
     const stashDir = target.source.path;
@@ -246,42 +355,111 @@ export async function akmTasksSetEnabled(id, enabled) {
         warnLegacyMdTaskFiles(typeRoot);
     const filePath = await resolveAssetPath(stashDir, "task", normalised);
     const yaml = fs.readFileSync(filePath, "utf8");
-    // Parse before writing so stale v1 tasks are diagnosed without changing the
-    // source file or its installed scheduler entry.
-    parseTaskDocument({ yaml, filePath, id: normalised });
+    // Parse before writing so unsupported tasks are diagnosed without changing
+    // the source file or its installed scheduler entry.
+    const previousTask = parseTaskDocument({ yaml, filePath, id: normalised });
     const updated = setEnabledInYaml(yaml, enabled);
+    const task = parseTaskDocument({ yaml: updated, filePath, id: normalised });
+    const obsoleteReason = obsoleteBackupTaskReason(task);
+    if (obsoleteReason)
+        throw new UsageError(obsoleteReason, "INVALID_FLAG_VALUE");
     const ref = taskAssetRef(normalised);
-    await writeAssetToSource(target.source, target.config, ref, updated);
-    const sched = selectBackend();
+    const sched = deps.backend ?? selectBackend();
+    const writeAsset = deps.writeAsset ?? writeAssetToSource;
+    const commitBoundary = deps.commitBoundary ?? commitWriteTargetBoundary;
+    const wasInstalled = (await sched.list()).some((entry) => entry.id === normalised);
+    let sourceRestoreArmed = false;
+    let installSucceeded = false;
     try {
+        sourceRestoreArmed = true;
+        await writeAsset(target.source, target.config, ref, updated);
         // Reinstall from the (just-updated) definition rather than only toggling
         // the comment. A plain toggle leaves a stale schedule in place if the
         // .yml's `schedule:` changed while the task was disabled — re-enabling
         // would silently keep the old cron line. install() renders the block with
         // both the current schedule and the new enabled state, and is idempotent.
-        const task = parseTaskDocument({ yaml: updated, filePath, id: normalised });
         await sched.install(task);
+        installSucceeded = true;
+        commitBoundary(target, `Update task:${normalised}`);
     }
     catch (err) {
-        // Roll the file back so the YAML source-of-truth and the OS
-        // scheduler don't diverge silently when the backend call fails.
-        await writeAssetToSource(target.source, target.config, ref, yaml);
+        const rollbackErrors = [];
+        let sourceRestored = false;
+        if (sourceRestoreArmed) {
+            try {
+                await restoreTaskSourceBytes(writeAsset, target.source, target.config, ref, filePath, yaml);
+                sourceRestored = true;
+            }
+            catch (rollbackError) {
+                rollbackErrors.push(rollbackError);
+            }
+        }
+        if (installSucceeded) {
+            try {
+                if (wasInstalled)
+                    await sched.install(previousTask);
+                else
+                    await sched.uninstall(normalised);
+            }
+            catch (rollbackError) {
+                rollbackErrors.push(rollbackError);
+            }
+        }
+        if (sourceRestored) {
+            try {
+                commitBoundary(target, `Restore task:${normalised}`);
+            }
+            catch (rollbackError) {
+                rollbackErrors.push(rollbackError);
+            }
+        }
+        if (rollbackErrors.length > 0) {
+            const message = err instanceof Error ? err.message : String(err);
+            throw new AggregateError([err, ...rollbackErrors], `${message}; rollback for task "${normalised}" was incomplete.`);
+        }
         throw err;
     }
-    commitWriteTargetBoundary(target, `Update task:${normalised}`);
     return { id: normalised, enabled, backend: sched.name };
 }
-export async function akmTasksRun(id) {
-    const normalised = normaliseTaskId(id);
-    const stashDir = resolveStashDir();
+export async function akmTasksRun(id, options = {}) {
+    const startedAt = new Date();
+    let normalised;
+    try {
+        normalised = parseTaskRef(id).id;
+    }
+    catch (failure) {
+        recordTaskAttemptFailure({
+            taskId: INVALID_TASK_ATTEMPT_ID,
+            reason: "invalid_task_id",
+            failure,
+            startedAt,
+        });
+        throw failure;
+    }
+    let stashDir;
+    try {
+        stashDir = resolveStashDir();
+    }
+    catch (failure) {
+        recordTaskAttemptFailure({
+            taskId: normalised,
+            reason: "task_load_failed",
+            failure,
+            startedAt,
+        });
+        throw failure;
+    }
     const typeRoot = path.join(stashDir, "tasks");
     if (fs.existsSync(typeRoot))
         warnLegacyMdTaskFiles(typeRoot);
-    const result = await runTask(normalised);
+    const result = await runTask(normalised, { stashDir, scheduled: options.scheduled === true });
+    const exitCode = result.status === "failed" && result.target.kind === "command" && result.detail?.exitCode === 78
+        ? 78
+        : exitCodeForStatus(result.status);
     return {
         ok: result.status === "completed" || result.status === "disabled",
         result,
-        exitCode: exitCodeForStatus(result.status),
+        exitCode,
     };
 }
 export async function akmTasksHistory(input) {
@@ -314,7 +492,7 @@ export async function akmTasksSync(deps = {}) {
             .map((f) => f.slice(0, -4))
         : [];
     const sched = deps.backend ?? selectBackend();
-    const backend = backendNameForPlatform();
+    const backend = sched.name;
     // Map id → installed signature so sync can detect schedule/enabled drift on
     // tasks that already exist in the scheduler, not just presence/absence.
     const present = new Map((await sched.list()).map((t) => [t.id, t.signature]));
@@ -327,16 +505,26 @@ export async function akmTasksSync(deps = {}) {
         let task;
         try {
             task = parseTaskDocument({ yaml: fs.readFileSync(filePath, "utf8"), filePath, id });
-        }
-        catch (err) {
-            skipped.push({ id, reason: err instanceof Error ? err.message : String(err) });
-            continue;
-        }
-        try {
             await validateTaskDocument(task, { backend, stashDir });
+            const obsoleteReason = obsoleteBackupTaskReason(task);
+            if (obsoleteReason)
+                throw new UsageError(obsoleteReason, "INVALID_FLAG_VALUE");
         }
         catch (err) {
             skipped.push({ id, reason: err instanceof Error ? err.message : String(err) });
+            if (present.has(id)) {
+                try {
+                    await sched.setEnabled(id, false);
+                }
+                catch (disableError) {
+                    try {
+                        await sched.uninstall(id);
+                    }
+                    catch (uninstallError) {
+                        throw new AggregateError([err, disableError, uninstallError], `Task "${id}" is invalid and its installed scheduler entry could not be disabled or removed.`);
+                    }
+                }
+            }
             continue;
         }
         if (!present.has(id)) {
@@ -368,6 +556,19 @@ export async function akmTasksSync(deps = {}) {
     }
     return { installed, updated, removed, unchanged, skipped, backend: sched.name };
 }
+function obsoleteBackupTaskReason(task) {
+    if (!task.enabled || task.target.kind !== "command")
+        return undefined;
+    const executableIndex = findBareAkmExecutableIndex(task.target.cmd);
+    if (executableIndex === undefined)
+        return undefined;
+    const args = task.target.cmd.slice(executableIndex + 1);
+    if (args.length !== 2 || args[0] !== "db" || args[1] !== "backups")
+        return undefined;
+    return (`Task "${task.id}" invokes obsolete \`akm db backups\`, which only listed legacy backups and is not a 0.9 backup command. ` +
+        "AKM will not install or enable it; sync will keep any existing scheduler entry disabled, and the task file is unchanged. " +
+        "Use `akm backup create --for 0.9.0` for an explicit migration recovery snapshot.");
+}
 export async function akmTasksDoctor() {
     const warnings = [];
     let invocation = { argv: [], via: "unresolved" };
@@ -417,22 +618,14 @@ export async function akmTasksDoctor() {
     };
 }
 // ── helpers ─────────────────────────────────────────────────────────────────
-const VALID_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
-function normaliseTaskId(raw) {
-    // Accept both .yml and .md suffixes from users so muscle memory from the
-    // pre-0.8.0 markdown task format doesn't produce a confusing "task not found".
-    const id = raw.trim().replace(/\.(yml|md)$/, "");
-    if (!id) {
-        throw new UsageError("Task id must be non-empty.", "MISSING_REQUIRED_ARGUMENT");
-    }
-    if (!VALID_ID_RE.test(id)) {
-        throw new UsageError(`Task id "${id}" is invalid. Use letters, digits, dots, underscores, and dashes only.`, "INVALID_FLAG_VALUE");
-    }
-    return id;
-}
 function taskAssetRef(id) {
     return { type: "task", name: id };
 }
+async function restoreTaskSourceBytes(writeAsset, source, config, ref, filePath, yaml) {
+    await writeAsset(source, config, ref, yaml);
+    // The normal write path adds a trailing newline; rollback restores the raw snapshot exactly.
+    fs.writeFileSync(filePath, yaml, "utf8");
+}
 function resolveTaskWriteTarget() {
     return resolveWriteTarget(loadConfig());
 }
@@ -475,8 +668,8 @@ function isStaleTaskError(err) {
     return err instanceof UsageError && err.code === "TASK_SCHEMA_VERSION_UNSUPPORTED";
 }
 function warnStaleTaskFiles(ids) {
-    process.stderr.write(`WARNING: ${ids.length} task file(s) use retired task schema v1 and were not loaded.\n` +
-        `         Rewrite them with version: 2 and replace profile with engine. See docs/migration/v0.8-to-v0.9.md#task-assets.\n` +
+    process.stderr.write(`WARNING: ${ids.length} task file(s) use an unsupported task schema version and were not loaded.\n` +
+        `         Use version: 2. See docs/migration/v0.8-to-v0.9.md#engine-and-task-assets.\n` +
         `         Affected: ${ids.map((id) => `tasks/${id}.yml`).join(", ")}\n`);
 }
 function collectStaleTaskIds() {

package/dist/core/common.js

@@ -27,6 +27,9 @@ export const ASSET_TYPES = Object.freeze([...getAssetTypes()]);
 export const ASSET_TYPE_SET = new Set(ASSET_TYPES);
 // ── Constants ───────────────────────────────────────────────────────────────
 export const IS_WINDOWS = process.platform === "win32";
+export const MAX_CONFIG_FILE_BYTES = 1024 * 1024;
+export const MAX_LOCAL_METADATA_BYTES = 1024 * 1024;
+export const MAX_LOCK_METADATA_BYTES = 64 * 1024;
 export function isHttpUrl(value) {
     return !!value && /^https?:\/\//.test(value);
 }
@@ -58,6 +61,35 @@ export function isAssetType(type) {
     return Object.hasOwn(TYPE_DIRS, type);
 }
 // ── Utilities ───────────────────────────────────────────────────────────────
+export function readTextFileDescriptorWithLimit(fd, maxBytes, label = "File", displayPath = "(open file)") {
+    const stat = fs.fstatSync(fd);
+    if (!stat.isFile())
+        throw new ConfigError(`${label} is not a regular file: ${displayPath}.`, "INVALID_CONFIG_FILE");
+    if (stat.size > maxBytes) {
+        throw new ConfigError(`${label} exceeds the ${maxBytes}-byte limit: ${displayPath}.`, "INVALID_CONFIG_FILE");
+    }
+    const buffer = Buffer.allocUnsafe(maxBytes + 1);
+    let total = 0;
+    while (total <= maxBytes) {
+        const bytesRead = fs.readSync(fd, buffer, total, maxBytes + 1 - total, null);
+        if (bytesRead === 0)
+            break;
+        total += bytesRead;
+    }
+    if (total > maxBytes) {
+        throw new ConfigError(`${label} exceeds the ${maxBytes}-byte limit: ${displayPath}.`, "INVALID_CONFIG_FILE");
+    }
+    return buffer.subarray(0, total).toString("utf8");
+}
+export function readTextFileWithLimit(filePath, maxBytes, label = "File") {
+    const fd = fs.openSync(filePath, "r");
+    try {
+        return readTextFileDescriptorWithLimit(fd, maxBytes, label, filePath);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
 /**
  * Write content to a file atomically via a temp file + rename.
  * Prevents partial-write corruption on crash.
@@ -172,7 +204,7 @@ function isValidDirectory(dir) {
 function readStashDirFromConfig() {
     try {
         const configPath = getConfigPath();
-        const text = fs.readFileSync(configPath, "utf8");
+        const text = readTextFileWithLimit(configPath, MAX_CONFIG_FILE_BYTES, "Config file");
         const raw = JSON.parse(text);
         if (typeof raw === "object" && raw !== null && typeof raw.stashDir === "string" && raw.stashDir.trim()) {
             return raw.stashDir.trim();
@@ -370,8 +402,9 @@ export async function readBodyWithByteCap(response, maxBytes = DEFAULT_RESPONSE_
         // No streaming body available (e.g., some mock environments). Fall
         // back to text() but still enforce the cap post-hoc.
         const text = await response.text();
-        if (text.length > maxBytes)
-            throw new ResponseTooLargeError(url, maxBytes, text.length);
+        const byteLength = Buffer.byteLength(text, "utf8");
+        if (byteLength > maxBytes)
+            throw new ResponseTooLargeError(url, maxBytes, byteLength);
         return text;
     }
     const reader = body.getReader();

package/dist/core/config/config-io.js

@@ -15,7 +15,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { sleepSync } from "../../runtime.js";
-import { writeFileAtomic } from "../common.js";
+import { MAX_CONFIG_FILE_BYTES, readTextFileWithLimit, writeFileAtomic } from "../common.js";
 import { ConfigError } from "../errors.js";
 import { createLockPayload, probeLock, reclaimStaleLock, releaseLock, tryAcquireLockSync } from "../file-lock.js";
 import { getCacheDir, getConfigDir } from "../paths.js";
@@ -25,7 +25,7 @@ import { getCacheDir, getConfigDir } from "../paths.js";
  */
 export function readConfigText(configPath) {
     try {
-        return fs.readFileSync(configPath, "utf8");
+        return readTextFileWithLimit(configPath, MAX_CONFIG_FILE_BYTES, "Config file");
     }
     catch (err) {
         if (err.code === "ENOENT")

package/dist/core/config/config-schema.js

@@ -564,9 +564,9 @@ const ImproveProfileProcessesSchema = z
     // 0.8.0 removed the duplicated `feedbackDistillation` process key — it was
     // a thin wrapper around `processes.distill.enabled`. Keep the migration
     // hint so a stale config gets an actionable message rather than silently
-    // doing nothing. All OTHER unknown process keys are tolerated (passthrough)
-    // — see the unknown-key policy in this file's header. Hard-rejecting them
-    // turned benign cross-version skew into INVALID_CONFIG_FILE failures.
+    // doing nothing. Other unknown process keys remain preserved for
+    // cross-version compatibility, but an enabled one is rejected below because
+    // this version cannot execute it.
     if ("feedbackDistillation" in val) {
         ctx.addIssue({
             code: z.ZodIssueCode.custom,
@@ -574,6 +574,18 @@ const ImproveProfileProcessesSchema = z
                 "It now controls both the orchestration gate and the LLM-call gate.",
         });
     }
+    for (const [name, process] of Object.entries(val)) {
+        if (!(name in IMPROVE_PROCESS_ENGINE_CAPABILITIES) &&
+            process !== null &&
+            typeof process === "object" &&
+            process.enabled === true) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: [name],
+                message: `Unknown enabled improve process "${name}"`,
+            });
+        }
+    }
 });
 export const ImproveProfileConfigSchema = z
     .object({

package/dist/core/config/config.js

@@ -4,7 +4,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { ConfigError } from "../errors.js";
-import { ensureMigrationBackupWithConfigLockHeld } from "../migration-backup.js";
+import { assertNoPendingMigrationOperation } from "../migration-operation.js";
 import { acquireConfigLock, backupExistingConfig, parseConfigText, readConfigText, withConfigLock, writeConfigAtomic, } from "./config-io.js";
 import { AkmConfigSchema, CURRENT_CONFIG_VERSION } from "./config-schema.js";
 import { deepMergeConfig } from "./deep-merge.js";
@@ -68,6 +68,7 @@ export function resetConfigCache() {
     cachedConfig = undefined;
 }
 export function loadUserConfig() {
+    assertNoPendingMigrationOperation();
     const configPath = getConfigPath();
     let stat;
     try {
@@ -91,12 +92,12 @@ export function loadUserConfig() {
     }
     let text;
     try {
-        text = fs.readFileSync(configPath, "utf8");
+        text = readConfigText(configPath);
     }
     catch (err) {
-        if (err.code !== "ENOENT") {
-            throw new ConfigError(`Unable to read config at ${configPath}: ${err instanceof Error ? err.message : String(err)}`, "INVALID_CONFIG_FILE");
-        }
+        throw new ConfigError(`Unable to read config at ${configPath}: ${err instanceof Error ? err.message : String(err)}`, "INVALID_CONFIG_FILE");
+    }
+    if (text === undefined) {
         cachedConfig = undefined;
         return { ...DEFAULT_CONFIG };
     }
@@ -191,13 +192,14 @@ export function saveConfig(config) {
     saveConfigReal(currentConfig);
 }
 function saveConfigReal(config) {
+    assertNoPendingMigrationOperation();
     cachedConfig = undefined;
     const configPath = getConfigPath();
     const dir = path.dirname(configPath);
     fs.mkdirSync(dir, { recursive: true });
     withConfigLock(() => {
+        assertNoPendingMigrationOperation();
         const validated = validateCompleteConfig(config);
-        ensureMigrationBackupWithConfigLockHeld();
         backupExistingConfig(configPath);
         writeConfigAtomic(configPath, sanitizeConfigForWrite(validated));
     });
@@ -212,12 +214,14 @@ export function validateCompleteConfig(config) {
 }
 /**
  * Mutate config under one fail-closed lock spanning read, merge, validation,
- * migration backup, ordinary backup, and atomic write.
+ * ordinary backup, and atomic write.
  */
 export function mutateConfig(mutate, options) {
+    assertNoPendingMigrationOperation();
     cachedConfig = undefined;
     const configPath = getConfigPath();
     return withConfigLock(() => {
+        assertNoPendingMigrationOperation();
         const text = readConfigText(configPath);
         if (text === undefined && options?.absentNoop) {
             return { config: { ...DEFAULT_CONFIG }, written: false };
@@ -227,7 +231,6 @@ export function mutateConfig(mutate, options) {
         if (mutated === current)
             return { config: current, written: false };
         const next = validateCompleteConfig({ ...mutated, configVersion: CURRENT_CONFIG_VERSION });
-        ensureMigrationBackupWithConfigLockHeld();
         if (text !== undefined)
             backupExistingConfig(configPath);
         fs.mkdirSync(path.dirname(configPath), { recursive: true });
@@ -241,18 +244,16 @@ export function mutateConfig(mutate, options) {
  * its stash, while preventing another config writer from racing the final save.
  */
 export async function mutateConfigWithPrecommit(mutate, precommit) {
+    assertNoPendingMigrationOperation();
     cachedConfig = undefined;
     const configPath = getConfigPath();
     const release = acquireConfigLock();
     try {
+        assertNoPendingMigrationOperation();
         const text = readConfigText(configPath);
         const current = text === undefined ? { ...DEFAULT_CONFIG } : parseAndValidateConfigText(text, configPath);
         const mutated = mutate(current);
         const next = validateCompleteConfig({ ...mutated, configVersion: CURRENT_CONFIG_VERSION });
-        // Setup's pre-commit may initialize the stash. Prove the rebase and final
-        // config are valid, then require the recovery snapshots before that first
-        // external side effect.
-        ensureMigrationBackupWithConfigLockHeld();
         if (text !== undefined)
             backupExistingConfig(configPath);
         const precommitResult = await precommit(next);
@@ -281,7 +282,7 @@ export async function mutateConfigWithPrecommit(mutate, precommit) {
  * --yes` with an `apiKey` field expected persistence and got a wiped config
  * with no feedback.
  */
-function sanitizeConfigForWrite(config) {
+export function sanitizeConfigForWrite(config) {
     const sanitized = { ...config };
     const stripped = [];
     if (config.embedding?.apiKey !== undefined) {