akm-cli 0.9.0-rc.8 → 0.9.0

package/dist/commands/sources/schema-repair.js

@@ -19,10 +19,11 @@ import { parseFrontmatter } from "../../core/asset/frontmatter.js";
 import { parseRefInput } from "../../core/asset/resolve-ref.js";
 import { authoringRulesForType } from "../../core/authoring-rules.js";
 import { appendEvent, readEvents } from "../../core/events.js";
+import { parseEmbeddedJsonResponse } from "../../core/parse.js";
 import { resolveStandardsContext } from "../../core/standards/resolve-standards-context.js";
 import { info } from "../../core/warn.js";
 import { resolveAssetPath } from "../../indexer/walk/path-resolver.js";
-import { chatCompletion, parseEmbeddedJsonResponse } from "../../llm/client.js";
+import { chatCompletion } from "../../llm/client.js";
 import { createProposal, isProposalSkipped } from "../proposal/repository.js";
 // ── Constants ────────────────────────────────────────────────────────────────
 /** Minimum gap between schema-repair attempts on the same asset. */
@@ -55,7 +56,7 @@ export async function runSchemaRepairPass(failures, options) {
         // Cooldown: skip repair if we ran it successfully recently.
         const recentRepairs = readEvents({ type: "schema_repair_invoked", ref: failure.ref });
         const lastRepair = recentRepairs.events
-            .filter((e) => e.metadata?.outcome === "written")
+            .filter((e) => e.metadata?.outcome === "queued")
             .sort((a, b) => new Date(b.ts ?? 0).getTime() - new Date(a.ts ?? 0).getTime())[0];
         if (lastRepair?.ts && Date.now() - new Date(lastRepair.ts).getTime() < SCHEMA_REPAIR_COOLDOWN_MS) {
             repairs.push({ ref: failure.ref, reason: failure.reason, outcome: "skipped" });

package/dist/commands/sources/self-update.js

@@ -5,7 +5,7 @@ import * as childProcess from "node:child_process";
 import { createHash } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
-import { fetchWithRetry, IS_WINDOWS, ResponseTooLargeError, readBodyWithByteCap } from "../../core/common.js";
+import { fetchWithRetry, IS_WINDOWS, ResponseTooLargeError, readBodyWithByteCap, readChunkWithDeadline, } from "../../core/common.js";
 import { ConfigError } from "../../core/errors.js";
 import { warn } from "../../core/warn.js";
 import { githubHeaders } from "../../integrations/github.js";
@@ -29,7 +29,19 @@ export function defaultMigrationCommand(preparedConfigPath) {
         apply: (akmBin) => runRequiredCommand(akmBin, ["migrate", "apply", ...configArgs], "Migration apply"),
     };
 }
-async function streamResponseToFile(response, destination, maxBytes) {
+/**
+ * Bounds on the binary body read. `fetchWithTimeout`'s timer only covers
+ * time-to-HEADERS — it is cleared the moment `fetch` resolves — so without
+ * these a compromised or misconfigured endpoint could dribble bytes forever
+ * and hang `akm upgrade` with no output and no way out but Ctrl-C. Two
+ * bounds, because either alone is evadable: a per-chunk STALL deadline (a
+ * connection making no progress dies quickly, while a slow-but-progressing
+ * one is left alone) and an OVERALL deadline (a trickle that sends one byte
+ * per stall-window can't stretch the download indefinitely).
+ */
+const BINARY_STALL_TIMEOUT_MS = 60_000;
+const BINARY_TOTAL_TIMEOUT_MS = 30 * 60_000;
+export async function streamResponseToFile(response, destination, maxBytes, limits) {
     const declaredText = response.headers.get("content-length");
     if (declaredText) {
         const declared = Number(declaredText);
@@ -40,22 +52,30 @@ async function streamResponseToFile(response, destination, maxBytes) {
     }
     if (!response.body)
         throw new Error("Binary download response did not provide a streaming body.");
+    const url = response.url || "binary download";
+    const stallTimeoutMs = limits?.stallTimeoutMs ?? BINARY_STALL_TIMEOUT_MS;
+    const totalTimeoutMs = limits?.totalTimeoutMs ?? BINARY_TOTAL_TIMEOUT_MS;
+    const overallDeadlineAt = Date.now() + totalTimeoutMs;
     const fd = fs.openSync(destination, "w", 0o600);
     const reader = response.body.getReader();
     const hash = createHash("sha256");
     let byteSize = 0;
     try {
         while (true) {
-            const { done, value } = await reader.read();
+            // Whichever bound bites first wins, and the error reports THAT bound —
+            // "no data for 60s" and "download exceeded 30m" are different diagnoses.
+            const stallDeadlineAt = Date.now() + stallTimeoutMs;
+            const deadlineAt = Math.min(stallDeadlineAt, overallDeadlineAt);
+            const reportedTimeoutMs = deadlineAt === overallDeadlineAt ? totalTimeoutMs : stallTimeoutMs;
+            const { done, value } = await readChunkWithDeadline(reader, deadlineAt, undefined, url, reportedTimeoutMs);
             if (done)
                 break;
             if (!value)
                 continue;
             byteSize += value.byteLength;
-            if (byteSize > maxBytes) {
-                await reader.cancel().catch(() => undefined);
-                throw new ResponseTooLargeError(response.url || "binary download", maxBytes, byteSize);
-            }
+            // The catch block cancels the reader for every throw path, this included.
+            if (byteSize > maxBytes)
+                throw new ResponseTooLargeError(url, maxBytes, byteSize);
             hash.update(value);
             let written = 0;
             while (written < value.byteLength)
@@ -65,6 +85,9 @@ async function streamResponseToFile(response, destination, maxBytes) {
         return { byteSize, sha256: hash.digest("hex") };
     }
     catch (error) {
+        // Cancel so a timed-out (still-open) connection releases its socket rather
+        // than lingering until process exit. Already-cancelled readers no-op.
+        await reader.cancel().catch(() => undefined);
         removeFileBestEffort(destination);
         throw error;
     }
@@ -141,6 +164,21 @@ export async function checkForUpdate(currentVersion) {
         installMethod,
     };
 }
+/**
+ * Whether the operator has asked to bypass upgrade checksum verification.
+ *
+ * Deliberately NOT a CLI flag (C6): STABILITY.md states checksum verification
+ * is not optional, so the recovery hatch for a genuinely broken `checksums.txt`
+ * is this internal, undocumented-on-purpose env var — not something
+ * discoverable in `--help` or offered by tab completion.
+ *
+ * Extracted rather than read inline so `performUpgrade` stays under the
+ * function-size bar (`scripts/lint-src-fn-size.ts`), whose baseline only
+ * shrinks.
+ */
+function checksumBypassRequested() {
+    return process.env.AKM_UPGRADE_SKIP_CHECKSUM === "1";
+}
 export async function performUpgrade(check, opts, dependencies) {
     const { currentVersion, latestVersion, installMethod } = check;
     const force = opts?.force === true;
@@ -163,31 +201,14 @@ export async function performUpgrade(check, opts, dependencies) {
     }
     const packageManagerCommand = getPackageManagerUpgradeCommand(installMethod);
     if (packageManagerCommand) {
-        if (!latestVersion) {
-            throw new Error("Unable to determine latest version from GitHub releases. Check https://github.com/itlackey/akm/releases");
-        }
-        migration.preflight("akm");
-        const result = childProcess.spawnSync(packageManagerCommand.command, packageManagerCommand.args, {
-            encoding: "utf8",
-            env: process.env,
-            stdio: "pipe",
-        });
-        if (result.error) {
-            throw new Error(`Failed to run '${packageManagerCommand.displayCommand}': ${result.error.message}`);
-        }
-        if (result.status !== 0) {
-            const details = (result.stderr ?? "").trim() || (result.stdout ?? "").trim() || `exit code ${result.status}`;
-            throw new Error(`Failed to upgrade akm via ${installMethod}: ${details}\nRun manually: ${packageManagerCommand.displayCommand}`);
-        }
-        migration.apply("akm");
-        return {
+        return runPackageManagerUpgrade({
+            packageManagerCommand,
             currentVersion,
-            newVersion: latestVersion,
-            upgraded: true,
+            latestVersion,
             installMethod,
-            message: `akm upgraded via ${installMethod}`,
-            postUpgrade: runPostUpgradeTasks("akm", { skip: skipPostUpgrade }),
-        };
+            migration,
+            skipPostUpgrade,
+        });
     }
     if (installMethod === "unknown") {
         return {
@@ -234,18 +255,18 @@ export async function performUpgrade(check, opts, dependencies) {
         }
         throw err;
     }
-    // Download and verify checksum (mandatory — upgrade is blocked if checksums cannot be fetched)
+    // Download and verify checksum (mandatory — upgrade is blocked if checksums cannot be fetched).
     let checksumVerified = false;
-    const skipChecksum = opts?.skipChecksum === true;
+    const skipChecksum = checksumBypassRequested();
     try {
         const checksumsResponse = await fetchWithRetry(checksumsUrl);
         if (!checksumsResponse.ok) {
             if (skipChecksum) {
-                warn(`WARNING: checksums.txt fetch failed (HTTP ${checksumsResponse.status}). Proceeding without verification because --skip-checksum was provided.`);
+                warn(`WARNING: checksums.txt fetch failed (HTTP ${checksumsResponse.status}). Proceeding without verification because AKM_UPGRADE_SKIP_CHECKSUM=1 was set.`);
             }
             else {
                 throw new Error(`Checksum verification failed: could not fetch ${checksumsUrl} (HTTP ${checksumsResponse.status}). ` +
-                    `Use --skip-checksum to bypass (not recommended).`);
+                    `Set AKM_UPGRADE_SKIP_CHECKSUM=1 to bypass (not recommended).`);
             }
         }
         else {
@@ -260,11 +281,11 @@ export async function performUpgrade(check, opts, dependencies) {
             }
             else {
                 if (skipChecksum) {
-                    warn(`WARNING: ${binaryName} not found in checksums.txt. Proceeding without verification because --skip-checksum was provided.`);
+                    warn(`WARNING: ${binaryName} not found in checksums.txt. Proceeding without verification because AKM_UPGRADE_SKIP_CHECKSUM=1 was set.`);
                 }
                 else {
                     throw new Error(`Checksum verification failed: ${binaryName} not listed in checksums.txt. ` +
-                        `Use --skip-checksum to bypass (not recommended).`);
+                        `Set AKM_UPGRADE_SKIP_CHECKSUM=1 to bypass (not recommended).`);
                 }
             }
         }
@@ -277,12 +298,12 @@ export async function performUpgrade(check, opts, dependencies) {
         }
         // Network or parse failure
         if (skipChecksum) {
-            warn(`WARNING: Could not fetch or parse checksums: ${err instanceof Error ? err.message : String(err)}. Proceeding because --skip-checksum was provided.`);
+            warn(`WARNING: Could not fetch or parse checksums: ${err instanceof Error ? err.message : String(err)}. Proceeding because AKM_UPGRADE_SKIP_CHECKSUM=1 was set.`);
         }
         else {
             removeFileBestEffort(stagedPath);
             throw new Error(`Checksum verification failed: ${err instanceof Error ? err.message : String(err)}. ` +
-                `Use --skip-checksum to bypass (not recommended).`);
+                `Set AKM_UPGRADE_SKIP_CHECKSUM=1 to bypass (not recommended).`);
         }
     }
     try {
@@ -380,6 +401,78 @@ function runPostUpgradeTasks(akmBin, opts) {
         };
     }
 }
+/**
+ * The package-manager arm of {@link performUpgrade}: preflight → install →
+ * post-install version verification → migrate apply → post-upgrade tasks.
+ * Extracted whole so performUpgrade stays under its fn-size baseline.
+ */
+function runPackageManagerUpgrade(input) {
+    const { packageManagerCommand, currentVersion, latestVersion, installMethod, migration, skipPostUpgrade } = input;
+    if (!latestVersion) {
+        throw new Error("Unable to determine latest version from GitHub releases. Check https://github.com/itlackey/akm/releases");
+    }
+    migration.preflight("akm");
+    const result = childProcess.spawnSync(packageManagerCommand.command, packageManagerCommand.args, {
+        encoding: "utf8",
+        env: process.env,
+        stdio: "pipe",
+    });
+    if (result.error) {
+        throw new Error(`Failed to run '${packageManagerCommand.displayCommand}': ${result.error.message}`);
+    }
+    if (result.status !== 0) {
+        const details = (result.stderr ?? "").trim() || (result.stdout ?? "").trim() || `exit code ${result.status}`;
+        throw new Error(`Failed to upgrade akm via ${installMethod}: ${details}\nRun manually: ${packageManagerCommand.displayCommand}`);
+    }
+    // The package manager exiting 0 does not prove it delivered
+    // `latestVersion`: a lagging `@latest` dist-tag (partial publish,
+    // registry mirror lag) "succeeds" while leaving the old version on PATH.
+    // Re-read the version the shim actually reports before claiming an
+    // upgrade — a confirmed mismatch also means `migrate apply` would run
+    // against the OLD binary, so stop before it.
+    const installedVersion = readInstalledCliVersion("akm");
+    if (installedVersion !== undefined && installedVersion !== latestVersion) {
+        return {
+            currentVersion,
+            newVersion: latestVersion,
+            upgraded: false,
+            installMethod,
+            message: `\`${packageManagerCommand.displayCommand}\` succeeded, but \`akm --version\` still reports ` +
+                `v${installedVersion} (expected v${latestVersion}). The ${installMethod} registry's @latest tag ` +
+                `may be lagging the GitHub release — try again shortly, or install the exact version: ` +
+                `${packageManagerCommand.displayCommand.replace(/@latest\b/, `@${latestVersion}`)}`,
+        };
+    }
+    migration.apply("akm");
+    return {
+        currentVersion,
+        newVersion: latestVersion,
+        upgraded: true,
+        installMethod,
+        message: installedVersion === latestVersion
+            ? `akm upgraded via ${installMethod} (verified: akm --version reports v${installedVersion})`
+            : `akm upgraded via ${installMethod} (installed version could not be verified)`,
+        postUpgrade: runPostUpgradeTasks("akm", { skip: skipPostUpgrade }),
+    };
+}
+/**
+ * Read the version the on-PATH `akm` actually reports, or `undefined` when
+ * that cannot be determined (no shim on PATH in a sandbox, unparseable
+ * output). Verification is fail-open on its own infrastructure — only a
+ * CONFIRMED mismatch downgrades an upgrade result (§24.2 Package/release
+ * gate).
+ */
+function readInstalledCliVersion(akmBin) {
+    const result = childProcess.spawnSync(akmBin, ["--version"], {
+        encoding: "utf8",
+        env: process.env,
+        stdio: "pipe",
+    });
+    if (result.error || result.status !== 0)
+        return undefined;
+    const match = (result.stdout ?? "").match(/\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?/);
+    return match?.[0];
+}
 function runRequiredCommand(akmBin, args, label) {
     const result = childProcess.spawnSync(akmBin, args, {
         encoding: "utf8",

package/dist/commands/sources/source-add.js

@@ -3,6 +3,7 @@
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import fs from "node:fs";
 import path from "node:path";
+import { detectAdapterId } from "../../core/adapter/detect-adapter.js";
 import { isBundleSlug } from "../../core/asset/asset-ref.js";
 import { isHttpUrl, resolveStashDir } from "../../core/common.js";
 import { bundleEntryToSourceEntry, getSources, installedSourceDescriptor, loadConfig, mutateConfig, } from "../../core/config/config.js";
@@ -13,13 +14,14 @@ import { readLockfile, removeLockEntry, upsertLockEntry } from "../../integratio
 import { parseRegistryRef } from "../../registry/resolve.js";
 import { detectStashRoot } from "../../sources/providers/provider-utils.js";
 import { syncFromRef } from "../../sources/providers/sync-from-ref.js";
+import { storeSecretResolver } from "../../sources/snapshot-fetchers/secret-seam.js";
 import { ensureWebsiteMirror, shouldAllowPrivateWebsiteUrlForTests, validateWebsiteInputUrl, } from "../../sources/snapshot-fetchers/website-ingest.js";
 import { bundleKeyForPath, bundleKeyForUrl, nextBundleKey } from "./bundle-config-ops.js";
 export async function akmAdd(input) {
     const ref = input.ref.trim();
     if (!ref)
         throw new UsageError("Install ref or local directory is required. " +
-            "Examples: `akm add @scope/stash`, `akm add github:owner/repo`, `akm add ./local/path`");
+            "Examples: `akm bundle add @scope/stash`, `akm bundle add github:owner/repo`, `akm bundle add ./local/path`");
     const stashDir = resolveStashDir();
     if (shouldAddAsWebsiteUrl(ref)) {
         return addWebsiteSource(ref, stashDir, input.name, input.options);
@@ -47,20 +49,31 @@ async function addLocalSource(ref, sourcePath, stashDir, explicitName) {
     mutateConfig((config) => {
         const existing = bundleKeyForPath(config, resolvedPath);
         if (existing) {
-            // Already configured — the bundle key is the stable identity; leave it.
             bundleKey = existing;
-            return config;
+            const current = config.bundles?.[existing];
+            if (current?.components)
+                return config;
+            const bundles = { ...(config.bundles ?? {}) };
+            bundles[existing] = {
+                ...current,
+                path: resolvedPath,
+                components: { main: { root: ".", adapter: detectAdapterId(resolvedPath) } },
+            };
+            return { ...config, bundles };
         }
         const bundles = { ...(config.bundles ?? {}) };
         bundleKey = nextBundleKey(bundles, explicitName, resolvedPath);
-        bundles[bundleKey] = { path: resolvedPath };
+        bundles[bundleKey] = {
+            path: resolvedPath,
+            components: { main: { root: ".", adapter: detectAdapterId(resolvedPath) } },
+        };
         return { ...config, bundles };
     });
     const index = await akmIndex({ stashDir });
     const updatedConfig = loadConfig();
     return {
         schemaVersion: 1,
-        stashDir,
+        bundleDir: stashDir,
         ref,
         sourceAdded: {
             type: "filesystem",
@@ -70,7 +83,6 @@ async function addLocalSource(ref, sourcePath, stashDir, explicitName) {
         },
         config: {
             sourceCount: getSources(updatedConfig).length,
-            installedKitCount: readLockfile().length,
         },
         index: {
             mode: index.mode,
@@ -84,14 +96,31 @@ async function addLocalSource(ref, sourcePath, stashDir, explicitName) {
 async function addWebsiteSource(ref, stashDir, name, options) {
     const allowPrivateHosts = shouldAllowPrivateWebsiteUrlForTests(ref);
     const normalizedUrl = validateWebsiteInputUrl(ref, { allowPrivateHosts });
-    const maxPages = typeof options?.maxPages === "number" ? options.maxPages : undefined;
+    const numberOption = (value) => (typeof value === "number" ? value : undefined);
+    const maxPages = numberOption(options?.maxPages);
+    const maxDepth = numberOption(options?.maxDepth);
     let entry;
     mutateConfig((config) => {
         const bundles = { ...(config.bundles ?? {}) };
         const existingKey = bundleKeyForUrl(config, normalizedUrl);
         const key = existingKey ?? nextBundleKey(bundles, name ?? toWebsiteName(normalizedUrl), normalizedUrl);
-        const website = { url: normalizedUrl, ...(maxPages !== undefined ? { maxPages } : {}) };
-        const nextBundle = { ...(existingKey ? bundles[key] : {}), website };
+        // Merge onto the existing descriptor rather than replacing it: re-running
+        // `bundle add` for a URL that already has a bundle would otherwise drop
+        // respectRobots / refresh, silently restoring default robots enforcement
+        // and changing what the next update fetches. Explicitly-passed maxPages /
+        // maxDepth still win over the stored values.
+        const existingWebsite = existingKey ? (bundles[key]?.website ?? {}) : {};
+        const website = {
+            ...existingWebsite,
+            url: normalizedUrl,
+            ...(maxPages !== undefined ? { maxPages } : {}),
+            ...(maxDepth !== undefined ? { maxDepth } : {}),
+        };
+        const nextBundle = {
+            ...(existingKey ? bundles[key] : {}),
+            website,
+            components: { main: { root: ".", adapter: "website-snapshot", writable: false } },
+        };
         if (JSON.stringify(bundles[key]) === JSON.stringify(nextBundle)) {
             entry = bundleEntryToSourceEntry(key, bundles[key]);
             return config;
@@ -102,13 +131,14 @@ async function addWebsiteSource(ref, stashDir, name, options) {
     });
     const cachePaths = await ensureWebsiteMirror(entry, {
         requireStashDir: true,
+        resolveSecret: storeSecretResolver.resolveSecret,
         ...(allowPrivateHosts ? { allowPrivateHosts: true } : {}),
     });
     const index = await akmIndex({ stashDir });
     const updatedConfig = loadConfig();
     return {
         schemaVersion: 1,
-        stashDir,
+        bundleDir: stashDir,
         ref,
         sourceAdded: {
             type: "website",
@@ -118,7 +148,6 @@ async function addWebsiteSource(ref, stashDir, name, options) {
         },
         config: {
             sourceCount: getSources(updatedConfig).length,
-            installedKitCount: readLockfile().length,
         },
         index: {
             mode: index.mode,
@@ -135,10 +164,23 @@ async function addWebsiteSource(ref, stashDir, name, options) {
  */
 async function addRegistryStash(ref, stashDir, writable) {
     const parsedRef = parseRegistryRef(ref);
-    if (writable === true && parsedRef.source !== "git") {
+    if (writable === true && parsedRef.source !== "git" && parsedRef.source !== "github") {
         throw new ConfigError("writable: true is only supported on filesystem and git sources", "INVALID_CONFIG_FILE");
     }
-    const synced = await syncFromRef(ref, { writable });
+    const currentConfig = loadConfig();
+    const existingBundleKey = findInstalledBundleKey(currentConfig.bundles ?? {}, parsedRef.id);
+    const existingBundle = existingBundleKey ? currentConfig.bundles?.[existingBundleKey] : undefined;
+    const priorLock = existingBundleKey ? readLockfile().find((entry) => entry.id === existingBundleKey) : undefined;
+    const existingWritable = Object.values(existingBundle?.components ?? {})[0]?.writable ?? existingBundle?.writable === true;
+    const effectiveWritable = writable === true || existingWritable;
+    const requiredRoots = priorLock?.localRoot
+        ? Object.values(existingBundle?.components ?? {}).map((component) => path.resolve(priorLock.localRoot, component.root ?? "."))
+        : [];
+    const synced = await syncFromRef(ref, {
+        writable: effectiveWritable,
+        ...(effectiveWritable && priorLock?.localRoot ? { writableRoot: priorLock.localRoot } : {}),
+        ...(requiredRoots.length > 0 ? { writableRequiredRoots: requiredRoots } : {}),
+    });
     const { config: updatedConfig, bundleId } = upsertInstalledRegistryEntry({
         id: synced.id,
         source: synced.source,
@@ -153,7 +195,7 @@ async function addRegistryStash(ref, stashDir, writable) {
     });
     // The prior materialized root (if this is a re-install) — read BEFORE the lock
     // upsert overwrites it, so a moved cache root can be cleaned afterwards.
-    const priorLocalRoot = readLockfile().find((e) => e.id === bundleId)?.localRoot;
+    const priorLocalRoot = priorLock?.localRoot;
     await upsertLockEntry({
         id: bundleId,
         source: synced.source,
@@ -166,7 +208,7 @@ async function addRegistryStash(ref, stashDir, writable) {
         installedAt: synced.syncedAt,
     });
     // Clean up the old materialized root on re-install (moved cache).
-    if (priorLocalRoot && path.resolve(priorLocalRoot) !== path.resolve(synced.contentDir)) {
+    if (!effectiveWritable && priorLocalRoot && path.resolve(priorLocalRoot) !== path.resolve(synced.contentDir)) {
         try {
             fs.rmSync(priorLocalRoot, { recursive: true, force: true });
         }
@@ -177,7 +219,7 @@ async function addRegistryStash(ref, stashDir, writable) {
     const index = await akmIndex({ stashDir });
     return {
         schemaVersion: 1,
-        stashDir,
+        bundleDir: stashDir,
         ref,
         installed: {
             id: synced.id,
@@ -193,7 +235,6 @@ async function addRegistryStash(ref, stashDir, writable) {
         },
         config: {
             sourceCount: getSources(updatedConfig).length,
-            installedKitCount: readLockfile().length,
         },
         index: {
             mode: index.mode,
@@ -217,11 +258,25 @@ export function upsertInstalledRegistryEntry(entry) {
     const config = mutateConfig((current) => {
         const bundles = { ...(current.bundles ?? {}) };
         bundleId = resolveInstalledBundleKey(bundles, entry.id, entry.stashRoot);
+        const existingComponents = bundles[bundleId]?.components;
+        const components = existingComponents
+            ? Object.fromEntries(Object.entries(existingComponents).map(([id, component]) => [
+                id,
+                { ...component, writable: entry.writable === true },
+            ]))
+            : {
+                main: {
+                    root: ".",
+                    adapter: detectAdapterId(path.resolve(entry.stashRoot)),
+                    writable: entry.writable === true,
+                },
+            };
         const descriptor = installedSourceDescriptor(entry.source, entry.ref, path.resolve(entry.stashRoot));
         bundles[bundleId] = {
             ...descriptor,
             ...(entry.writable === true ? { writable: true } : {}),
             ...(entry.id !== bundleId ? { registryId: entry.id } : {}),
+            components: components,
         };
         return { ...current, bundles };
     }).config;