akm-cli 0.9.0-rc.3 → 0.9.0-rc.4

package/dist/scripts/migrations/import-fs-improve-runs-to-db.js

@@ -16963,8 +16963,26 @@ var COMMON_FIELDS = [
   "sync",
   "terminated"
 ];
-var V1_FIELDS = new Set([...COMMON_FIELDS, "profile", "profileFilteredRefs"]);
+var V1_FIELDS = new Set([...COMMON_FIELDS, "profile", "profileFilteredRefs", "stalenessDetection"]);
 var V2_FIELDS = new Set([...COMMON_FIELDS, "strategy", "strategyFilteredRefs"]);
+var STALENESS_DETECTION_FIELDS = new Set([
+  "considered",
+  "deprecated",
+  "confirmed",
+  "skipped",
+  "durationMs",
+  "warnings"
+]);
+var INTERRUPTED_V1_FIELDS = new Set([
+  "schemaVersion",
+  "ok",
+  "profile",
+  "scope",
+  "dryRun",
+  "plannedRefs",
+  "actions",
+  "terminated"
+]);
 function fail(message) {
   throw new Error(`invalid improve-result envelope: ${message}`);
 }
@@ -16976,6 +16994,33 @@ function requireExactFields(value, allowed) {
   if (unknown.length > 0)
     fail(`unknown field${unknown.length === 1 ? "" : "s"}: ${unknown.sort().join(", ")}`);
 }
+function isKnownInterruptedV1Partial(value) {
+  if (Object.keys(value).some((key) => !INTERRUPTED_V1_FIELDS.has(key)))
+    return false;
+  if (value.ok !== false || typeof value.dryRun !== "boolean")
+    return false;
+  if (value.profile !== undefined && typeof value.profile !== "string")
+    return false;
+  if (!Array.isArray(value.plannedRefs) || value.plannedRefs.length !== 0)
+    return false;
+  if (!Array.isArray(value.actions) || value.actions.length !== 0)
+    return false;
+  if (!isRecord(value.scope))
+    return false;
+  if (Object.keys(value.scope).some((key) => key !== "mode" && key !== "value"))
+    return false;
+  if (value.scope.mode !== "all" && value.scope.mode !== "type" && value.scope.mode !== "ref")
+    return false;
+  if (value.scope.value !== undefined && typeof value.scope.value !== "string")
+    return false;
+  if (!isRecord(value.terminated))
+    return false;
+  if (Object.keys(value.terminated).some((key) => !["reason", "at", "errorMessage"].includes(key)))
+    return false;
+  if (typeof value.terminated.reason !== "string" || typeof value.terminated.at !== "string")
+    return false;
+  return value.terminated.errorMessage === undefined || typeof value.terminated.errorMessage === "string";
+}
 function validateCommon(value) {
   if (typeof value.ok !== "boolean")
     fail("ok must be a boolean");
@@ -17050,6 +17095,32 @@ function validateCommon(value) {
     if (value[field] !== undefined && !isRecord(value[field]))
       fail(`${field} must be an object`);
   }
+  if (isRecord(value.terminated)) {
+    requireExactFields(value.terminated, new Set(["reason", "at", "errorMessage"]));
+    if (typeof value.terminated.reason !== "string" || typeof value.terminated.at !== "string") {
+      fail("terminated.reason and terminated.at must be strings");
+    }
+    if (value.terminated.errorMessage !== undefined && typeof value.terminated.errorMessage !== "string") {
+      fail("terminated.errorMessage must be a string when present");
+    }
+  }
+}
+function validateV1StalenessDetection(value) {
+  if (value === undefined)
+    return;
+  if (!isRecord(value))
+    fail("stalenessDetection must be an object");
+  const unknown = Object.keys(value).filter((key) => !STALENESS_DETECTION_FIELDS.has(key));
+  if (unknown.length > 0) {
+    fail(`stalenessDetection has unknown field${unknown.length === 1 ? "" : "s"}: ${unknown.sort().join(", ")}`);
+  }
+  for (const field of ["considered", "deprecated", "confirmed", "skipped", "durationMs"]) {
+    if (typeof value[field] !== "number")
+      fail(`stalenessDetection.${field} must be a number`);
+  }
+  if (!Array.isArray(value.warnings) || value.warnings.some((warning) => typeof warning !== "string")) {
+    fail("stalenessDetection.warnings must be an array of strings");
+  }
 }
 function decodeImproveResult(input) {
   let parsed = input;
@@ -17063,17 +17134,25 @@ function decodeImproveResult(input) {
   if (!isRecord(parsed))
     fail("root must be an object");
   if (parsed.schemaVersion === 1) {
-    requireExactFields(parsed, V1_FIELDS);
-    validateCommon(parsed);
-    if (parsed.profile !== undefined && typeof parsed.profile !== "string")
+    let normalized = parsed;
+    let normalizedLegacyPartial = false;
+    if (normalized.memorySummary === undefined && isKnownInterruptedV1Partial(normalized)) {
+      normalized = { ...normalized, memorySummary: { eligible: 0, derived: 0 } };
+      normalizedLegacyPartial = true;
+    }
+    requireExactFields(normalized, V1_FIELDS);
+    validateCommon(normalized);
+    validateV1StalenessDetection(normalized.stalenessDetection);
+    if (normalized.profile !== undefined && typeof normalized.profile !== "string")
       fail("profile must be a string");
-    if (parsed.profileFilteredRefs !== undefined && !Array.isArray(parsed.profileFilteredRefs)) {
+    if (normalized.profileFilteredRefs !== undefined && !Array.isArray(normalized.profileFilteredRefs)) {
       fail("profileFilteredRefs must be an array");
     }
     return {
-      envelope: parsed,
+      envelope: normalized,
       strategy: null,
-      legacyProfile: typeof parsed.profile === "string" ? parsed.profile : null
+      legacyProfile: typeof normalized.profile === "string" ? normalized.profile : null,
+      normalizedLegacyPartial
     };
   }
   if (parsed.schemaVersion === 2) {
@@ -17088,7 +17167,8 @@ function decodeImproveResult(input) {
     return {
       envelope: parsed,
       strategy: parsed.strategy,
-      legacyProfile: null
+      legacyProfile: null,
+      normalizedLegacyPartial: false
     };
   }
   fail(`unsupported schemaVersion: ${String(parsed.schemaVersion)}`);
@@ -17845,6 +17925,7 @@ function openStateDatabase(dbPath) {
     if (existed) {
       const preflight = openDatabase(resolvedPath, { readonly: true });
       try {
+        preflight.exec("PRAGMA busy_timeout = 30000");
         if (isCanonical)
           assertCurrentMigrationLedger(preflight, STATE_MIGRATIONS);
         else

package/dist/storage/repositories/task-history-repository.js

@@ -79,6 +79,33 @@ export function decodeTaskHistoryMetadata(input) {
     }
     metadataError(`unsupported metadataVersion: ${String(version)}`);
 }
+/**
+ * Atomically reserve one task-attempt identity.
+ *
+ * The existing unique `(task_id, started_at)` index arbitrates concurrent
+ * processes: exactly one caller receives `true` for a candidate timestamp.
+ * Callers can advance by one millisecond and retry without a schema change.
+ */
+export function reserveTaskHistoryAttempt(db, row) {
+    const result = db
+        .prepare(`INSERT OR IGNORE INTO task_history
+         (task_id, status, started_at, completed_at, failed_at, log_path,
+          target_kind, target_ref, metadata_json)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`)
+        .run(row.task_id, row.status, row.started_at, row.completed_at ?? null, row.failed_at ?? null, row.log_path ?? null, row.target_kind ?? null, row.target_ref ?? null, row.metadata_json);
+    return Number(result.changes) === 1;
+}
+/** Finalize a row previously created by {@link reserveTaskHistoryAttempt}. */
+export function finalizeTaskHistoryAttempt(db, row) {
+    const result = db
+        .prepare(`UPDATE task_history
+       SET status = ?, completed_at = ?, failed_at = ?, log_path = ?,
+           target_kind = ?, target_ref = ?, metadata_json = ?
+       WHERE task_id = ? AND started_at = ?
+         AND status = 'active' AND completed_at IS NULL`)
+        .run(row.status, row.completed_at ?? null, row.failed_at ?? null, row.log_path ?? null, row.target_kind ?? null, row.target_ref ?? null, row.metadata_json, row.task_id, row.started_at);
+    return Number(result.changes) === 1;
+}
 /**
  * Upsert a task history row.
  */
@@ -102,7 +129,7 @@ export function getTaskHistory(db, taskId) {
     return db
         .prepare(`SELECT id, task_id, status, started_at, completed_at, failed_at, log_path,
               target_kind, target_ref, metadata_json
-       FROM task_history WHERE task_id = ? ORDER BY started_at DESC LIMIT 1`)
+       FROM task_history WHERE task_id = ? ORDER BY started_at DESC, id DESC LIMIT 1`)
         .get(taskId);
 }
 /**
@@ -112,7 +139,7 @@ export function getTaskHistoryRuns(db, taskId, limit = 50) {
     return db
         .prepare(`SELECT id, task_id, status, started_at, completed_at, failed_at, log_path,
               target_kind, target_ref, metadata_json
-       FROM task_history WHERE task_id = ? ORDER BY started_at DESC LIMIT ?`)
+       FROM task_history WHERE task_id = ? ORDER BY started_at DESC, id DESC LIMIT ?`)
         .all(taskId, limit);
 }
 /**
@@ -145,7 +172,7 @@ export function queryTaskHistory(db, options = {}) {
     return db
         .prepare(`SELECT task_id, status, started_at, completed_at, failed_at, log_path,
               target_kind, target_ref, metadata_json
-       FROM task_history ${where} ORDER BY started_at DESC`)
+       FROM task_history ${where} ORDER BY started_at DESC, id DESC`)
         .all(...params);
 }
 /**

package/dist/tasks/backends/cron.js

@@ -25,60 +25,70 @@
 //
 // Tests inject a fake exec so unit tests don't touch the real crontab.
 import { spawnSync } from "node:child_process";
-import fs from "node:fs";
 import path from "node:path";
 import { ConfigError } from "../../core/errors.js";
 import { getTaskLogDir } from "../../core/paths.js";
 import { resolveAkmInvocation } from "../resolve-akm-bin.js";
 import { parseSchedule, translateToCron } from "../schedule.js";
-const BEGIN = (id) => `# akm:task ${id} BEGIN`;
-const END = (id) => `# akm:task ${id} END`;
+import { buildScheduledTaskInvocation, resolveScheduledTaskContext, } from "../scheduler-invocation.js";
+import { nodeFs } from "./exec-utils.js";
+const BEGIN = (id) => `# akm:task ${assertCronValue(id)} BEGIN`;
+const END = (id) => `# akm:task ${assertCronValue(id)} END`;
 const DISABLED_PREFIX = "# akm:disabled ";
 const BLOCK_RE = /^# akm:task ([\w.@:_-]+) BEGIN$/;
+const BLOCK_END_RE = /^# akm:task ([\w.@:_-]+) END$/;
 export function CRON_BACKEND(options = {}) {
     const exec = options.exec ?? defaultCronExec();
+    const fsLike = options.fs ?? nodeFs();
     const logDir = options.logDir ?? getTaskLogDir();
     const akmArgv = options.akmArgv ?? resolveAkmInvocation().argv;
+    const envPath = options.envPath === false ? undefined : (options.envPath ?? process.env.PATH);
+    const scheduledContext = options.scheduledContext ?? resolveScheduledTaskContext();
     return {
         name: "cron",
         install(task) {
             // Create the log directory before writing the crontab line — cron
             // appends with `>>` and the surrounding shell will fail the entire
             // entry if the parent directory doesn't exist.
-            ensureDir(logDir);
-            const cronLine = buildCronLine(task, akmArgv, logDir);
+            fsLike.ensureDir(logDir);
+            const cronLine = buildCronLine(task, akmArgv, logDir, envPath, scheduledContext);
             const existing = readCrontab(exec);
             const block = renderBlock(task.id, cronLine, task.enabled);
             const next = upsertBlock(existing, task.id, block);
-            writeCrontab(exec, next);
+            replaceCrontab(exec, existing, next);
         },
         uninstall(id) {
             const existing = readCrontab(exec);
             const next = removeBlock(existing, id);
-            writeCrontab(exec, next);
+            replaceCrontab(exec, existing, next);
         },
         setEnabled(id, enabled) {
             const existing = readCrontab(exec);
             const next = toggleBlock(existing, id, enabled);
-            writeCrontab(exec, next);
+            replaceCrontab(exec, existing, next);
         },
         list() {
             const existing = readCrontab(exec);
             return listBlocks(existing).map(({ id, body }) => ({ id, signature: normalizeSignature(body) }));
         },
         expectedSignature(task) {
-            const cronLine = buildCronLine(task, akmArgv, logDir);
+            const cronLine = buildCronLine(task, akmArgv, logDir, envPath, scheduledContext);
             return normalizeSignature(cronBlockBody(cronLine, task.enabled));
         },
     };
 }
 // ── helpers (exported for tests) ────────────────────────────────────────────
-export function buildCronLine(task, akmArgv, logDir) {
+export function buildCronLine(task, akmArgv, logDir, envPath, scheduledContext) {
     const spec = parseSchedule(task.schedule, "cron");
     const cronExpr = translateToCron(spec);
     const logPath = path.join(logDir, `${task.id}.log`);
-    const cmd = [...akmArgv, "tasks", "run", task.id].map((part) => quoteForCron(part)).join(" ");
-    return `${cronExpr} ${cmd} >> ${quoteForCron(logPath)} 2>&1`;
+    const invocation = buildScheduledTaskInvocation(akmArgv, task.id, scheduledContext);
+    const cmd = invocation.argv.map((part) => quoteForCron(part)).join(" ");
+    const contextPrefix = Object.entries(invocation.environment)
+        .map(([key, value]) => `${key}=${quoteForCron(value)}`)
+        .join(" ");
+    const pathPrefix = envPath === undefined ? "" : `PATH=${quoteForCron(envPath)} `;
+    return `${cronExpr} ${contextPrefix} ${pathPrefix}${cmd} >> ${quoteForCron(logPath)} 2>&1`;
 }
 /** The crontab line as it appears inside a block — commented when disabled. */
 export function cronBlockBody(cronLine, enabled) {
@@ -93,28 +103,44 @@ export function renderBlock(id, cronLine, enabled) {
  * drift signature, and exported for tests.
  */
 export function listBlocks(existing) {
+    return parseBlocks(existing).map(({ id, body }) => ({ id, body }));
+}
+function parseBlocks(existing) {
     const out = [];
     const lines = existing.split(/\r?\n/);
     let currentId = null;
+    let start = -1;
     let body = [];
-    for (const line of lines) {
+    for (const [index, line] of lines.entries()) {
         const begin = line.match(BLOCK_RE);
         if (begin) {
+            if (currentId !== null)
+                throw malformedBlockError(currentId);
             currentId = begin[1];
+            start = index;
             body = [];
             continue;
         }
-        if (currentId !== null && line === END(currentId)) {
-            out.push({ id: currentId, body: body.join("\n") });
+        const end = line.match(BLOCK_END_RE);
+        if (end) {
+            if (currentId === null || end[1] !== currentId)
+                throw malformedBlockError(currentId ?? end[1]);
+            out.push({ id: currentId, body: body.join("\n"), start, end: index });
             currentId = null;
+            start = -1;
             body = [];
             continue;
         }
         if (currentId !== null)
             body.push(line);
     }
+    if (currentId !== null)
+        throw malformedBlockError(currentId);
     return out;
 }
+function malformedBlockError(id) {
+    return new ConfigError(`Crontab contains a malformed akm task block for "${id}"; refusing to modify it.`, "INVALID_CONFIG_FILE");
+}
 /** Collapse incidental whitespace so signature comparison ignores it. */
 function normalizeSignature(body) {
     return body
@@ -131,27 +157,17 @@ export function upsertBlock(existing, id, block) {
 }
 export function removeBlock(existing, id) {
     const lines = existing.split(/\r?\n/);
-    const out = [];
-    let inBlock = false;
-    for (const line of lines) {
-        if (!inBlock && line === BEGIN(id)) {
-            inBlock = true;
-            continue;
-        }
-        if (inBlock && line === END(id)) {
-            inBlock = false;
-            continue;
-        }
-        if (inBlock)
-            continue;
-        out.push(line);
-    }
+    const blocks = parseBlocks(existing).filter((block) => block.id === id);
+    if (blocks.length === 0)
+        return existing;
+    const out = lines.filter((_, index) => !blocks.some((block) => index >= block.start && index <= block.end));
     // Collapse trailing blank lines.
     while (out.length > 0 && out[out.length - 1] === "")
         out.pop();
     return out.join("\n");
 }
 export function toggleBlock(existing, id, enabled) {
+    parseBlocks(existing);
     const lines = existing.split(/\r?\n/);
     const out = [];
     let inBlock = false;
@@ -184,12 +200,23 @@ export function toggleBlock(existing, id, enabled) {
     return out.join("\n");
 }
 function quoteForCron(part) {
+    assertCronValue(part);
     // crontab passes the rest of the line to /bin/sh -c, so quote anything that
     // isn't a plain shell-safe token. Single-quote and escape embedded single
-    // quotes via the standard shell idiom: `'foo'\''bar'`.
+    // quotes via the standard shell idiom: `'foo'\''bar'`. Cron interprets `%`
+    // before the shell, even inside quotes, so close the quote around its escape.
     if (/^[A-Za-z0-9_\-./@:%=+,]+$/.test(part))
-        return part;
-    return `'${part.replace(/'/g, `'\\''`)}'`;
+        return part.replaceAll("%", "\\%");
+    return `'${part.replace(/'/g, `'\\''`).replace(/%/g, `'\\%'`)}'`;
+}
+function assertCronValue(value) {
+    for (const char of value) {
+        const code = char.codePointAt(0) ?? 0;
+        if (code < 0x20 || (code >= 0x7f && code <= 0x9f)) {
+            throw new ConfigError("Cron values must not contain control characters.", "INVALID_CONFIG_FILE");
+        }
+    }
+    return value;
 }
 function readCrontab(exec) {
     const result = exec.read();
@@ -209,13 +236,19 @@ function writeCrontab(exec, content) {
         throw new ConfigError(`crontab - failed (exit ${result.status}): ${result.stderr || result.stdout || "no output"}.`, "INVALID_CONFIG_FILE", "Ensure the `crontab` binary is on PATH and your shell can write the user crontab.");
     }
 }
-function ensureDir(dir) {
+function replaceCrontab(exec, existing, next) {
     try {
-        fs.mkdirSync(dir, { recursive: true });
+        writeCrontab(exec, next);
     }
-    catch {
-        // Best-effort: the install will surface a clearer error if the cron
-        // line later fails at runtime due to a missing redirection target.
+    catch (err) {
+        try {
+            writeCrontab(exec, existing);
+        }
+        catch (rollbackError) {
+            const message = err instanceof Error ? err.message : String(err);
+            throw new AggregateError([err, rollbackError], `${message}; restoring the prior crontab also failed.`);
+        }
+        throw err;
     }
 }
 function defaultCronExec() {

package/dist/tasks/backends/exec-utils.js

@@ -40,13 +40,65 @@ export function nodeFs() {
  */
 export function spawnCommand(args) {
     const [bin, ...rest] = args;
-    const r = spawnSync(bin, rest, { encoding: "utf8" });
+    const r = spawnSync(bin, rest);
     return {
         status: r.status ?? 1,
-        stdout: r.stdout ?? "",
-        stderr: r.stderr ?? "",
+        stdout: decodeCommandOutput(r.stdout),
+        stderr: decodeCommandOutput(r.stderr),
     };
 }
+/** Decode native command output, including the UTF-16 XML emitted by schtasks. */
+export function decodeCommandOutput(output) {
+    if (output === null || output === undefined)
+        return "";
+    if (typeof output === "string")
+        return output.replace(/^\uFEFF/, "");
+    if (output.length === 0)
+        return "";
+    if (output[0] === 0xef && output[1] === 0xbb && output[2] === 0xbf) {
+        return output.toString("utf8", 3);
+    }
+    if (output[0] === 0xff && output[1] === 0xfe) {
+        return output.subarray(2).toString("utf16le");
+    }
+    if (output[0] === 0xfe && output[1] === 0xff) {
+        return decodeUtf16Be(output.subarray(2));
+    }
+    const pairs = Math.floor(output.length / 2);
+    if (pairs > 1) {
+        let evenNuls = 0;
+        let oddNuls = 0;
+        for (let i = 0; i < pairs * 2; i += 2) {
+            if (output[i] === 0)
+                evenNuls += 1;
+            if (output[i + 1] === 0)
+                oddNuls += 1;
+        }
+        if (oddNuls / pairs > 0.6)
+            return output.toString("utf16le");
+        if (evenNuls / pairs > 0.6)
+            return decodeUtf16Be(output);
+    }
+    return output.toString("utf8");
+}
+/** Return XML with the declaration required by Task Scheduler's UTF-16 input. */
+export function normalizeXmlForUtf16File(xml) {
+    const source = xml.replace(/^\uFEFF/, "");
+    const declaration = '<?xml version="1.0" encoding="UTF-16"?>';
+    if (/^<\?xml\b[^?]*\?>/i.test(source)) {
+        return source.replace(/^<\?xml\b[^?]*\?>/i, declaration);
+    }
+    return `${declaration}\n${source}`;
+}
+function decodeUtf16Be(output) {
+    const evenLength = output.length - (output.length % 2);
+    const swapped = Buffer.allocUnsafe(evenLength);
+    for (let i = 0; i < evenLength; i += 2) {
+        swapped[i] = output[i + 1];
+        swapped[i + 1] = output[i];
+    }
+    return swapped.toString("utf16le");
+}
 /**
  * Escape a string for safe embedding in an XML attribute or text node.
  */