akm-cli 0.9.0-rc.8 → 0.9.0

package/dist/integrations/github.js

@@ -14,7 +14,7 @@ function readGithubTokenFromEnv() {
     return undefined;
 }
 function readGithubTokenFromGhCli() {
-    const result = childProcess.spawnSync("gh", ["auth", "token"], {
+    const result = childProcess.spawnSync("gh", ["auth", "token", "--hostname", "github.com"], {
         encoding: "utf8",
         timeout: 5_000,
         stdio: ["ignore", "pipe", "ignore"],

package/dist/integrations/harnesses/aider/agent-builder.js

@@ -60,10 +60,12 @@
  * - **effort** — stays unconsumed (reserved; the shared request contract's
  *   "no builder consumes it yet" note stays true).
  *
- * NOT registered anywhere: `builders.ts` / `harnesses/index.ts` wiring is a
- * follow-up integration task (as is the registry entry declaring
- * `structuredOutput: "none"`). Exported standalone so that
- * task only adds a registry entry.
+ * Registered: `aiderBuilder` is `AiderHarness.agentBuilder` (`./index.ts`),
+ * one of the ten harnesses `HARNESS_REGISTRY` constructs
+ * (`harnesses/index.ts`); `agent/builders.ts` derives `BUILTIN_BUILDERS` from
+ * that registry, so this builder is reachable under the `"aider"` platform
+ * name without any further wiring. The registry entry also declares
+ * `structuredOutput: "none"` alongside it (`./index.ts`).
  */
 import { assertNotFlag, resolveDispatchModel, } from "../../agent/builder-shared.js";
 /** Canonical harness/platform id used for model-alias resolution. */

package/dist/integrations/harnesses/amazonq/agent-builder.js

@@ -54,10 +54,13 @@
  * - **effort** — stays unconsumed (reserved; the shared request contract's
  *   "no builder consumes it yet" note stays true).
  *
- * NOT registered anywhere: `builders.ts` / `harnesses/index.ts` wiring is a
- * follow-up integration task (as is the registry-side capability entry —
- * pattern `local-runner`, structuredOutput `none`). Exported standalone so
- * that task only adds a registry entry.
+ * Registered: `amazonqBuilder` is `AmazonqHarness.agentBuilder`
+ * (`./index.ts`), one of the ten harnesses `HARNESS_REGISTRY` constructs
+ * (`harnesses/index.ts`); `agent/builders.ts` derives `BUILTIN_BUILDERS` from
+ * that registry, so this builder is reachable under the `"amazonq"` platform
+ * name without any further wiring. The registry-side capability entry —
+ * pattern `local-runner`, structuredOutput `none` — is declared alongside it
+ * (`./index.ts`).
  */
 import { assertNotFlag, resolveDispatchModel, } from "../../agent/builder-shared.js";
 /** Canonical harness/platform id used for model-alias resolution. */

package/dist/integrations/harnesses/claude/session-log.js

@@ -108,16 +108,6 @@ export class ClaudeCodeProvider extends AbstractSessionLogProvider {
     availabilityRoot() {
         return claudeProjectsDir();
     }
-    /**
-     * Directory holding Claude Code's per-project session JSONL files
-     * (`~/.claude/projects`, honoring `AKM_CLAUDE_PROJECTS_DIR`). Returns `[]`
-     * when the directory does not exist on this machine. See {@link
-     * SessionLogHarness.watchRoots}.
-     */
-    watchRoots() {
-        const dir = claudeProjectsDir();
-        return fs.existsSync(dir) ? [dir] : [];
-    }
     *readEvents(input) {
         try {
             for (const jsonlPath of this.#walkJsonl(claudeProjectsDir())) {

package/dist/integrations/harnesses/codex/agent-builder.js

@@ -46,8 +46,11 @@
  *     `-c model_reasoning_effort=<v>` — left to the integration task so the
  *     shared request contract's "no builder consumes it yet" note stays true).
  *
- * NOT registered anywhere yet: `HARNESS_REGISTRY` / `BUILTIN_BUILDERS` wiring
- * is a follow-up integration task. Exported cleanly for that task to import.
+ * Registered: `codexBuilder` is `CodexHarness.agentBuilder` (`./index.ts`),
+ * one of the ten harnesses `HARNESS_REGISTRY` constructs
+ * (`harnesses/index.ts`); `agent/builders.ts` derives `BUILTIN_BUILDERS` from
+ * that registry, so this builder is reachable under the `"codex"` platform
+ * name without any further wiring.
  */
 import { mkdtempSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";

package/dist/integrations/harnesses/copilot/agent-builder.js

@@ -39,9 +39,11 @@
  *   programmatic mode Copilot then denies unapproved tool calls, which is the
  *   conservative failure mode.
  *
- * NOT registered anywhere: `builders.ts` / `harnesses/index.ts` wiring is a
- * follow-up integration task. Exported standalone so that task only adds a
- * registry entry.
+ * Registered: `copilotBuilder` is `CopilotHarness.agentBuilder`
+ * (`./index.ts`), one of the ten harnesses `HARNESS_REGISTRY` constructs
+ * (`harnesses/index.ts`); `agent/builders.ts` derives `BUILTIN_BUILDERS` from
+ * that registry, so this builder is reachable under the `"copilot"` platform
+ * name without any further wiring.
  */
 import { assertNotFlag, resolveDispatchModel, } from "../../agent/builder-shared.js";
 /** Canonical harness/platform id used for model-alias resolution. */

package/dist/integrations/harnesses/gemini/agent-builder.js

@@ -43,9 +43,11 @@
  *   `gemini -p "<p>"`; autonomy flags (`--yolo`, `--approval-mode`) belong in
  *   `profile.args` where the operator opts in explicitly.
  *
- * NOT registered anywhere: `builders.ts` / `harnesses/index.ts` wiring is a
- * follow-up integration task. Exported standalone so that task only adds a
- * registry entry.
+ * Registered: `geminiBuilder` is `GeminiHarness.agentBuilder` (`./index.ts`),
+ * one of the ten harnesses `HARNESS_REGISTRY` constructs
+ * (`harnesses/index.ts`); `agent/builders.ts` derives `BUILTIN_BUILDERS` from
+ * that registry, so this builder is reachable under the `"gemini"` platform
+ * name without any further wiring.
  */
 import { assertNotFlag, resolveDispatchModel, } from "../../agent/builder-shared.js";
 /** Canonical harness/platform id used for model-alias resolution. */

package/dist/integrations/harnesses/index.js

@@ -12,10 +12,6 @@
  * This module is a dependency-graph LEAF: it imports nothing from
  * `core/config`. `core/config/config-types.ts` derives `VALID_HARNESS_IDS`
  * from here, which keeps the import direction acyclic (config ← harnesses).
- *
- * Implementations (session-log readers, agent profiles) are migrated under each
- * harness in #563/#564; this step only owns ids + capability membership and
- * wires the existing call sites to consult it (behaviour-preserving).
  */
 import { AiderHarness } from "./aider/index.js";
 import { AmazonqHarness } from "./amazonq/index.js";
@@ -51,9 +47,9 @@ export { isSessionLogHarness } from "./types.js";
 // Order is significant: VALID_HARNESS_IDS derives from this array and feeds the
 // committed JSON-schema enum order. The original [opencode, claude,
 // opencode-sdk] prefix is preserved so the pre-unification portion of the
-// generated schema enum does not reorder (#562); the seven P2 harness adapters
-// (plan §"Capability matrix") are appended after it, which extends the enum
-// additively (schemas/akm-config.json is regenerated in lockstep).
+// generated schema enum does not reorder; the seven P2 harness adapters are
+// appended after it, which extends the enum additively (schemas/akm-config.json
+// is regenerated in lockstep).
 export const HARNESS_REGISTRY = Object.freeze([
     new OpencodeHarness(),
     new ClaudeHarness(),

package/dist/integrations/harnesses/opencode/agent-builder.js

@@ -27,13 +27,32 @@ export const opencodeBuilder = {
     build(profile, req) {
         assertNotFlag(req.systemPrompt, "systemPrompt");
         assertNotFlag(req.model, "model");
-        const args = [...profile.args]; // starts with ["run"]
+        let configuredModel;
+        const args = req.model ? [] : [...profile.args];
+        if (req.model) {
+            for (let index = 0; index < profile.args.length; index += 1) {
+                const arg = profile.args[index];
+                if (arg === undefined)
+                    continue;
+                if (arg === "--model") {
+                    configuredModel = profile.args[index + 1];
+                    index += 1;
+                }
+                else if (arg.startsWith("--model=")) {
+                    configuredModel = arg.slice("--model=".length);
+                }
+                else {
+                    args.push(arg);
+                }
+            }
+        }
         if (req.systemPrompt) {
             args.push("--system-prompt", req.systemPrompt);
         }
         if (req.model) {
             const resolved = resolveDispatchModel(req, profile, "opencode");
-            args.push("--model", resolved);
+            const provider = configuredModel?.split("/", 1)[0];
+            args.push("--model", provider && !resolved.includes("/") ? `${provider}/${resolved}` : resolved);
         }
         args.push("--");
         args.push(req.prompt);

package/dist/integrations/harnesses/opencode/session-log.js

@@ -42,21 +42,6 @@ export class OpenCodeProvider extends AbstractSessionLogProvider {
     #dbPath(base) {
         return path.join(base, OPENCODE_DB_FILENAME);
     }
-    /**
-     * Directories/files opencode writes session data under. Returns the base dir
-     * when the SQLite store (`opencode.db`) exists, the legacy JSON session root
-     * (`<base>/storage/session`) when present, or both during a migration overlap.
-     * Empty when neither exists. See {@link SessionLogHarness.watchRoots}.
-     */
-    watchRoots() {
-        const roots = [];
-        if (fs.existsSync(this.#dbPath(this.#baseDir)))
-            roots.push(this.#baseDir);
-        const sessionRoot = path.join(this.#baseDir, "storage", "session");
-        if (fs.existsSync(sessionRoot))
-            roots.push(sessionRoot);
-        return roots;
-    }
     *readEvents(input) {
         // Legacy behavior: stream raw log lines from the top-level dir and `log/`
         // subdirectory. Kept to keep `getExecutionLogCandidates` working without

package/dist/integrations/harnesses/opencode-sdk/sdk-runner.js

@@ -4,9 +4,13 @@
 /**
  * OpenCode SDK agent runner (migrated from `agent/sdk-runner.ts`, #564).
  *
- * Uses the embedded `@opencode-ai/sdk` instead of `Bun.spawn`. Requires no
- * agent CLI binary to be installed. The user provides an OpenAI-compatible
- * endpoint (or inherits from the selected fallback LLM engine) for the SDK.
+ * Uses the embedded `@opencode-ai/sdk` instead of `Bun.spawn` for dispatch, so
+ * no agent CLI argv is ever constructed — but the SDK is not self-contained:
+ * {@link createManagedOpencode} spawns `opencode serve` and talks HTTP to it,
+ * so the `opencode` binary must be on PATH (which is why setup's
+ * `detectHarness` gates this harness on that probe). The user provides an
+ * OpenAI-compatible endpoint (or inherits from the selected fallback LLM
+ * engine) for the SDK.
  *
  * This is the runtime surface of the {@link OpencodeSdkHarness} (`id =
  * 'opencode-sdk'`). It is the dispatch path for SDK runner specs; it exposes
@@ -70,7 +74,12 @@
  * until the child ACTUALLY exits — and a real `opencode serve` (a live HTTP
  * server with provider children) can outlive SIGTERM long enough to hang the
  * caller indefinitely. {@link createManagedOpencode} therefore owns the spawn
- * (the SDK package is used only for `createOpencodeClient`):
+ * (the SDK package is used only for `createOpencodeClient`).
+ *
+ * Owning the spawn changes the LIFECYCLE, not the REQUIREMENT: the SDK's
+ * `createOpencodeServer` is itself a `spawn("opencode", ["serve", ...])`, and
+ * the package declares `"dependencies": {}`, so `opencode` must be on PATH
+ * either way. akm's version differs only in how it supervises the child:
  *
  *   - after the URL handshake, the child and its stdio are `unref()`ed /
  *     destroyed, so the handle can never hold akm open;

package/dist/integrations/harnesses/openhands/agent-builder.js

@@ -63,10 +63,13 @@
  * - **effort** — stays unconsumed (reserved; the shared request contract's
  *   "no builder consumes it yet" note stays true).
  *
- * NOT registered anywhere: `builders.ts` / `harnesses/index.ts` wiring is a
- * follow-up integration task (as is the registry entry declaring
- * `pattern: "local-runner"`, `structuredOutput: "native-json"`).
- * Exported standalone so that task only adds a registry entry.
+ * Registered: `openhandsBuilder` is `OpenhandsHarness.agentBuilder`
+ * (`./index.ts`), one of the ten harnesses `HARNESS_REGISTRY` constructs
+ * (`harnesses/index.ts`); `agent/builders.ts` derives `BUILTIN_BUILDERS` from
+ * that registry, so this builder is reachable under the `"openhands"`
+ * platform name without any further wiring. The registry entry also declares
+ * `pattern: "local-runner"`, `structuredOutput: "native-json"` alongside it
+ * (`./index.ts`).
  */
 import { assertNotFlag, resolveDispatchModel, } from "../../agent/builder-shared.js";
 /** Canonical harness/platform id used for model-alias resolution. */
@@ -74,8 +77,8 @@ export const OPENHANDS_PLATFORM = "openhands";
 /**
  * Env var OpenHands reads its LLM model from — the platform's documented
  * model-selection channel for headless runs (there is no headless model
- * flag). Exported so the follow-up integration task and tests share the one
- * constant.
+ * flag). Exported (re-exported from `./index.ts`) so this harness's tests
+ * share the one constant.
  */
 export const OPENHANDS_MODEL_ENV = "LLM_MODEL";
 /**

package/dist/integrations/harnesses/pi/agent-builder.js

@@ -43,10 +43,12 @@
  * - **effort** — stays unconsumed (reserved; the shared request contract's
  *   "no builder consumes it yet" note stays true).
  *
- * NOT registered anywhere: `builders.ts` / `harnesses/index.ts` wiring is a
- * follow-up integration task (as are the `PI_*` identity-env markers, which
- * are registry-side). Exported standalone so that task only adds a registry
- * entry.
+ * Registered: `piBuilder` is `PiHarness.agentBuilder` (`./index.ts`), one of
+ * the ten harnesses `HARNESS_REGISTRY` constructs (`harnesses/index.ts`);
+ * `agent/builders.ts` derives `BUILTIN_BUILDERS` from that registry, so this
+ * builder is reachable under the `"pi"` platform name without any further
+ * wiring. The `PI_SESSION_ID` identity-env marker is declared alongside it
+ * (`./index.ts`).
  */
 import { assertNotFlag, resolveDispatchModel, } from "../../agent/builder-shared.js";
 /** Canonical harness/platform id used for model-alias resolution. */

package/dist/integrations/lockfile.js

@@ -54,6 +54,48 @@ export function readLockfile() {
         return [];
     }
 }
+/**
+ * Like {@link readLockfile}, but THROWS instead of silently degrading to `[]`
+ * when the on-disk lockfile exists yet is not parseable JSON or not a JSON
+ * array (R-012).
+ *
+ * `readLockfile`'s fail-open contract is intentional for READ paths — a
+ * corrupt lock degrades a managed bundle to "unmanaged" rather than erroring
+ * every read-only command (`list`, `installed-stashes`, …). But
+ * {@link upsertLockEntry} and {@link removeLockEntry} read the current
+ * entries and then WRITE `[...entries, change]` back out; if that read
+ * silently returned `[]` for a corrupt file, the write would silently
+ * replace the corrupt file with one containing only the single new/changed
+ * entry — permanently destroying every other surviving lock record. Write
+ * paths use this strict variant so a corrupt lockfile fails the operation
+ * loudly (matching the guard `mergeLockEntriesSync` already applies) instead
+ * of quietly deleting user state. A missing file is NOT corruption — there
+ * is nothing to preserve, so that case still returns `[]`. Entries that fail
+ * per-entry validation are still tolerated (filtered out), matching
+ * `readLockfile`'s existing shape-tolerant behavior.
+ */
+function readLockfileOrThrow() {
+    const lockfilePath = getLockfilePath();
+    let raw;
+    try {
+        raw = fs.readFileSync(lockfilePath, "utf8");
+    }
+    catch (err) {
+        rethrowIfTestIsolationError(err);
+        return []; // File does not exist (or is otherwise unreadable) — nothing to preserve.
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (error) {
+        throw new ConfigError(`Refusing to modify lockfile ${lockfilePath}: existing content is not valid JSON (${error instanceof Error ? error.message : String(error)}). Fix or remove the file by hand before retrying — every existing lock entry would otherwise be lost.`, "INVALID_CONFIG_FILE");
+    }
+    if (!Array.isArray(parsed)) {
+        throw new ConfigError(`Refusing to modify lockfile ${lockfilePath}: existing content is not a JSON array. Fix or remove the file by hand before retrying — every existing lock entry would otherwise be lost.`, "INVALID_CONFIG_FILE");
+    }
+    return parsed.filter(isValidLockfileEntry);
+}
 /**
  * The materialized content root recorded in the lock for a managed (git/npm)
  * bundle — spec §10.2 desired/resolved split, where the desired config carries
@@ -93,10 +135,27 @@ export async function writeLockfile(entries) {
         release();
     }
 }
+/** Replace one exact parsed lock generation while the lockfile sentinel is held. */
+export async function compareAndSwapLockfile(expected, desired) {
+    const release = await acquireLockSentinel();
+    try {
+        const current = readLockfileOrThrow();
+        if (JSON.stringify(current) !== JSON.stringify(expected))
+            return false;
+        writeLockfileUnlocked(desired);
+        return true;
+    }
+    finally {
+        release();
+    }
+}
 export async function upsertLockEntry(entry) {
     const release = await acquireLockSentinel();
     try {
-        const entries = readLockfile();
+        // R-012: readLockfileOrThrow (not readLockfile) — a corrupt/malformed
+        // lockfile must abort the upsert loudly rather than read as `[]` and get
+        // silently overwritten with just this one entry.
+        const entries = readLockfileOrThrow();
         const withoutExisting = entries.filter((e) => e.id !== entry.id);
         writeLockfileUnlocked([...withoutExisting, entry]);
     }
@@ -110,19 +169,55 @@ export async function upsertLockEntry(entry) {
  * migrate-apply's config lock + maintenance barrier) whose synchronous body
  * cannot await the sentinel's retry loop. No-op for an empty list.
  */
+function readLockEntriesForMigration() {
+    let existing = [];
+    const lockfilePath = getLockfilePath();
+    if (fs.existsSync(lockfilePath)) {
+        let raw;
+        try {
+            raw = JSON.parse(fs.readFileSync(lockfilePath, "utf8"));
+        }
+        catch (error) {
+            throw new ConfigError(`Cannot merge migration lock entries into unreadable lockfile ${lockfilePath}: ${error instanceof Error ? error.message : String(error)}.`, "INVALID_CONFIG_FILE");
+        }
+        if (!Array.isArray(raw) || !raw.every(isValidLockfileEntry)) {
+            throw new ConfigError(`Cannot merge migration lock entries into malformed lockfile ${lockfilePath}.`, "INVALID_CONFIG_FILE");
+        }
+        existing = raw;
+    }
+    return existing;
+}
+/** Validate the current lockfile before migrate-apply creates its backup or sentinel. */
+export function assertMigrationLockfileReadable() {
+    readLockEntriesForMigration();
+}
 export function mergeLockEntriesSync(entries) {
+    const existing = readLockEntriesForMigration();
     if (entries.length === 0)
         return;
-    const existing = readLockfile();
-    const incoming = new Set(entries.map((e) => e.id));
-    writeLockfileUnlocked([...existing.filter((e) => !incoming.has(e.id)), ...entries]);
+    // MERGE per id, never replace: the migrator's entries are sparse (id/source/
+    // ref/localRoot), while an existing row may carry `resolvedVersion`,
+    // `resolvedRevision`, `integrity`, `installedAt`, … from a real install.
+    // Replacing the whole row discarded the user's recorded resolution/pin and
+    // left later update reporting comparing against an unknown prior version.
+    // Incoming DEFINED fields win; existing fields absent from the incoming
+    // entry are preserved.
+    const byId = new Map(existing.map((e) => [e.id, e]));
+    const merged = entries.map((incoming) => {
+        const prior = byId.get(incoming.id);
+        return prior ? { ...prior, ...incoming } : incoming;
+    });
+    const incomingIds = new Set(entries.map((e) => e.id));
+    writeLockfileUnlocked([...existing.filter((e) => !incomingIds.has(e.id)), ...merged]);
 }
 export async function removeLockEntry(id) {
     if (!fs.existsSync(getDataDir()))
         return;
     const release = await acquireLockSentinel();
     try {
-        const entries = readLockfile();
+        // R-012: see upsertLockEntry — same destructive-overwrite risk on a
+        // corrupt lockfile, so the same strict reader is used here.
+        const entries = readLockfileOrThrow();
         writeLockfileUnlocked(entries.filter((e) => e.id !== id));
     }
     finally {
@@ -130,7 +225,7 @@ export async function removeLockEntry(id) {
     }
 }
 // ── Helpers ─────────────────────────────────────────────────────────────────
-function isValidLockfileEntry(value) {
+export function isValidLockfileEntry(value) {
     if (typeof value !== "object" || value === null || Array.isArray(value))
         return false;
     const obj = value;

package/dist/integrations/session-logs/index.js

@@ -50,22 +50,6 @@ const ERROR_PATTERNS = /error|failed|exception|cannot|undefined|null pointer|ENO
 export function getAvailableHarnesses() {
     return HARNESSES.filter((harness) => harness.isAvailable());
 }
-/**
- * Map each available harness to its `{ harnessName, roots }` watch target,
- * skipping harnesses that expose no roots (absent `watchRoots()` or an empty
- * result). This is the one stable entry point the watcher uses so it never
- * reaches into providers directly.
- */
-export function getWatchTargets() {
-    const targets = [];
-    for (const harness of getAvailableHarnesses()) {
-        const roots = harness.watchRoots?.() ?? [];
-        if (roots.length === 0)
-            continue;
-        targets.push({ harnessName: harness.name, roots });
-    }
-    return targets;
-}
 export function normalizeSessionTopic(text) {
     const normalized = text.replace(/\s+/g, " ").trim().toLowerCase();
     if (normalized.length < 10)
@@ -107,16 +91,13 @@ export function aggregateSessionEvents(events) {
  * Collect normalized session events from a set of harnesses for the health
  * candidate scan (#568).
  *
- * Pipeline selection per harness (capability-gated):
- *   - readSession-capable harness (`supportsReadSession !== false`): drive the
- *     richer `listSessions()` + `readSession()` pipeline. `readSession` flattens
+ * Pipeline selection per harness:
+ *   - Drive the richer `listSessions()` + `readSession()` pipeline. `readSession` flattens
  *     structured content — tool calls, assistant content blocks, thinking,
  *     tool_result — into event text (e.g. ClaudeCodeProvider's `parseClaudeEvent`
  *     surfaces `[tool:*]` / `[tool_result]` blocks that the legacy flat
  *     `readEvents` scan drops entirely). This is what lets health advisories see
  *     repeated tool failures / long runs that the flat scan hid.
- *   - legacy-only harness (`supportsReadSession === false`): fall back to the
- *     legacy flat `readEvents()` scan (behaviour-preserving).
  *
  * Extracted as a pure function (harnesses injected) so it is unit-testable
  * without touching the real on-disk session-log locations.
@@ -129,19 +110,13 @@ export function aggregateSessionEvents(events) {
  * health command (`akm health`, which calls this synchronously) blow past its
  * latency budget. `listSessions()` returns summaries sorted newest-first, so
  * capping to the most-recent N sessions per harness keeps the richer signal
- * for what actually matters (recent activity) while bounding cost. The legacy
- * flat-scan path is naturally cheaper and is left uncapped.
+ * for what actually matters (recent activity) while bounding cost.
  */
 const DEFAULT_MAX_SESSIONS_PER_HARNESS = 50;
 export function collectSessionEvents(harnesses, sinceMs, maxSessionsPerHarness = DEFAULT_MAX_SESSIONS_PER_HARNESS) {
     const events = [];
     for (const harness of harnesses) {
         try {
-            if (harness.supportsReadSession === false) {
-                // Legacy-only harness: only the flat event scan is available.
-                events.push(...harness.readEvents({ sinceMs }));
-                continue;
-            }
             // Rich path: enumerate sessions cheaply, then read each one's full
             // structured event stream. Falls back to readEvents if listSessions
             // surfaces nothing (e.g. a harness that wired readSession but whose