akm-cli 0.9.0-rc.9 → 0.9.0

package/dist/commands/remember.js

@@ -8,11 +8,11 @@
  * heuristic derivation, LLM enrichment) is testable in isolation and the
  * CLI entry point stays focused on argument parsing + output routing.
  */
-import { getParsedInvocation } from "../cli/invocation.js";
 import { serializeFrontmatter } from "../core/asset/asset-serialize.js";
 import { toErrorMessage, tryReadStdinText } from "../core/common.js";
 import { loadConfig } from "../core/config/config.js";
 import { UsageError } from "../core/errors.js";
+import { parseEmbeddedJsonResponse } from "../core/parse.js";
 import { DURATION_UNITS, parseDuration as parseDurationSpec } from "../core/time.js";
 import { warn } from "../core/warn.js";
 import { SCOPE_KEYS } from "../indexer/passes/metadata.js";
@@ -150,7 +150,7 @@ export async function runLlmEnrich(body) {
         warn("Warning: --enrich requires an LLM to be configured. Run `akm setup` to configure one.");
         return { tags: [] };
     }
-    const { chatCompletion, parseEmbeddedJsonResponse: parseJsonResponse } = await import("../llm/client.js");
+    const { chatCompletion } = await import("../llm/client.js");
     // #576: attribute this entry point's LLM call to the `remember` stage. The
     // wrapper is ambient — if a usage sink is active it tags the record; if not,
     // it is a no-op.
@@ -185,7 +185,7 @@ Return ONLY the JSON object, no prose, no markdown fences.`;
                 }
             }
         })();
-        const parsed = parseJsonResponse(result);
+        const parsed = parseEmbeddedJsonResponse(result);
         if (!parsed) {
             warn("Warning: --enrich received invalid JSON from the LLM. Writing memory without enrichment.");
             return { tags: [] };
@@ -204,57 +204,14 @@ Return ONLY the JSON object, no prose, no markdown fences.`;
         return { tags: [] };
     }
 }
-// ── Content-arg disambiguation ───────────────────────────────────────────────
-/**
- * Guard against citty consuming a global flag value as the `content` positional.
- *
- * When the user runs `akm remember --format json` without a content argument,
- * citty may assign `"json"` to the `content` positional because of how it
- * handles flag order. This helper detects that case and returns `undefined`
- * so `readMemoryContent` falls through to stdin.
- */
-export function resolveRememberContentArg(content) {
-    if (content === undefined)
-        return undefined;
-    const invocation = getParsedInvocation();
-    const parsedFormat = invocation.getFlagValue("--format");
-    if (parsedFormat !== undefined &&
-        content === parsedFormat &&
-        wasRememberFlagValueConsumedAsContent(content, parsedFormat, "--format")) {
-        return undefined;
-    }
-    const parsedDetail = invocation.getFlagValue("--detail");
-    if (parsedDetail !== undefined &&
-        content === parsedDetail &&
-        wasRememberFlagValueConsumedAsContent(content, parsedDetail, "--detail")) {
-        return undefined;
-    }
-    return content;
-}
-function wasRememberFlagValueConsumedAsContent(content, flagValue, flagName) {
-    const argv = getParsedInvocation().userArgs;
-    const rememberIndex = argv.indexOf("remember");
-    const tokens = rememberIndex >= 0 ? argv.slice(rememberIndex + 1) : argv;
-    let flagIndex = -1;
-    let flagConsumesNextToken = false;
-    for (let i = 0; i < tokens.length; i += 1) {
-        const token = tokens[i];
-        if (token === flagName) {
-            flagIndex = i;
-            flagConsumesNextToken = true;
-            break;
-        }
-        if (token === `${flagName}=${flagValue}`) {
-            flagIndex = i;
-            break;
-        }
-    }
-    if (flagIndex === -1)
-        return false;
-    if (tokens.slice(0, flagIndex).includes(content))
-        return false;
-    const firstTokenAfterFlag = flagIndex + (flagConsumesNextToken ? 2 : 1);
-    if (tokens.slice(firstTokenAfterFlag).includes(content))
-        return false;
-    return true;
-}
+// R-061(c): `resolveRememberContentArg` / `wasRememberFlagValueConsumedAsContent`
+// used to live here — a heuristic guarding against citty consuming a global
+// flag's value (`--format`/`--detail`) as the `content` positional. That guard
+// predated `rememberCommand` declaring `GLOBAL_OUTPUT_ARGS` (via
+// `defineJsonCommand`): once the leaf command itself declares `format`/
+// `detail` args, citty's parser consumes their space-separated values as the
+// flag's own value and never assigns them to `content` in the first place, so
+// the heuristic no longer has anything to guard against. Verified: `akm
+// remember "yaml" --format yaml` and `akm remember "brief" --detail brief`
+// both write the literal content unchanged. Deleted rather than kept as
+// defense-in-depth per the cleanup program's dead-code policy.

package/dist/commands/sources/add-cli.js

@@ -4,6 +4,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import * as p from "../../cli/clack.js";
+import { getStringArg, parsePositiveIntFlag } from "../../cli/parse-args.js";
 import { defineJsonCommand, output } from "../../cli/shared.js";
 import { decideDangerousKeyInstall } from "../../core/activation-policy.js";
 import { UsageError } from "../../core/errors.js";
@@ -14,12 +15,11 @@ import { akmAdd } from "./source-add.js";
 import { addStash } from "./source-manage.js";
 // ── Shared website-options helper ──────────
 export function buildWebsiteOptions(args) {
-    const websiteOptions = {};
-    if (typeof args["max-pages"] === "string" && args["max-pages"].length > 0)
-        websiteOptions.maxPages = args["max-pages"];
-    if (typeof args["max-depth"] === "string" && args["max-depth"].length > 0)
-        websiteOptions.maxDepth = args["max-depth"];
-    return websiteOptions;
+    // getStringArg maps absent/blank to undefined; parsePositiveIntFlag maps
+    // undefined to undefined — so an unsupplied flag simply omits the key.
+    const maxPages = parsePositiveIntFlag(getStringArg(args, "max-pages"), "--max-pages");
+    const maxDepth = parsePositiveIntFlag(getStringArg(args, "max-depth"), "--max-depth");
+    return { ...(maxPages !== undefined ? { maxPages } : {}), ...(maxDepth !== undefined ? { maxDepth } : {}) };
 }
 // ── HTTP safety check ─────────────────────────────────────────────────────────
 export function shouldWarnOnPlainHttp(ref) {
@@ -38,24 +38,84 @@ export function shouldWarnOnPlainHttp(ref) {
         return true;
     }
 }
-/** Scan every env file in the freshly-installed stash for dangerous env keys. */
+/**
+ * Recursively enumerate every real env FILE under `rootDir` (a stash's
+ * `env/` directory). "Real env file" is the SAME test used everywhere else
+ * in akm decides what `akm env run` / `akm env list` / the indexer will
+ * actually load as environment variables — `fileName === ".env" ||
+ * fileName.endsWith(".env")` — see `src/indexer/walk/matchers.ts` and
+ * `listEnvsRecursive` in `src/commands/env/env-cli.ts`. Reusing that exact
+ * rule here (rather than inventing a second, possibly-divergent one) is what
+ * closes the nested-directory bypass: `env/nested/inner.env` IS loaded by
+ * `akm env run` today via that same recursive walk, so it must be scanned
+ * too (previously only a flat, non-recursive `env/*.env` listing was
+ * scanned).
+ *
+ * Deliberately excludes files that do NOT end in `.env` (e.g.
+ * `env/notes.txt`). Such a file is never sourced as environment variables by
+ * any akm codepath, so a dangerous key sitting in its contents cannot hijack
+ * process execution via `akm env run` — there is no live attack through this
+ * gate for it. Residual gap: this scanner does not protect against an
+ * operator later renaming/copying that file to a `*.env` name, or feeding it
+ * into `akm env run` through some other mechanism outside akm; closing that
+ * would mean content-sniffing every byte of every file in the stash (README,
+ * lockfiles, binaries, …) for a vector that requires a subsequent human
+ * action to become live, which is a materially different and much more
+ * expensive check than "is this a file `akm` will actually source".
+ */
+function collectEnvFilePathsRecursive(rootDir) {
+    const results = [];
+    const walk = (dir) => {
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            const full = path.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                walk(full);
+                continue;
+            }
+            if (!entry.isFile())
+                continue;
+            if (entry.name !== ".env" && !entry.name.endsWith(".env"))
+                continue;
+            results.push(full);
+        }
+    };
+    walk(rootDir);
+    return results;
+}
+/** Scan every real env file (recursively, see {@link collectEnvFilePathsRecursive}) in the freshly-installed stash for dangerous env keys. */
 function collectDangerousKeyFindings(installedStashRoot, checkEnvForDangerousKeys) {
     const allFindings = [];
     const subdir = "env";
     const prefix = "env";
     const dir = path.join(installedStashRoot, subdir);
-    const envFiles = fs.existsSync(dir) ? fs.readdirSync(dir).filter((f) => f.endsWith(".env")) : [];
-    for (const envFile of envFiles) {
-        const envPath = path.join(dir, envFile);
-        const baseName = path.basename(envFile, ".env");
-        const vaultRef = baseName === "" ? `${prefix}:default` : `${prefix}:${baseName}`;
-        const relPath = path.join(subdir, envFile);
-        const findings = checkEnvForDangerousKeys(envPath, relPath, vaultRef);
+    if (!fs.existsSync(dir))
+        return allFindings;
+    for (const envPath of collectEnvFilePathsRecursive(dir)) {
+        const relToEnvDir = path.relative(dir, envPath);
+        // Only the LAST path segment carries the ".env" suffix / dotfile-default
+        // naming rule; intermediate directory segments pass through unchanged.
+        // e.g. "nested/inner.env" -> "nested/inner", "nested/.env" ->
+        // "nested/default" (not "nested/", which is what naively stripping the
+        // suffix from the whole relative path would produce).
+        const segments = relToEnvDir.split(path.sep);
+        const lastSegment = segments[segments.length - 1] ?? "";
+        const lastSegmentBase = lastSegment.endsWith(".env") ? lastSegment.slice(0, -".env".length) : lastSegment;
+        const refSegments = [...segments.slice(0, -1), lastSegmentBase === "" ? "default" : lastSegmentBase];
+        const envRef = `${prefix}/${refSegments.join("/")}`;
+        const relPath = path.join(subdir, relToEnvDir);
+        const findings = checkEnvForDangerousKeys(envPath, relPath, envRef);
         for (const finding of findings) {
             // Extract the key name from the detail string for the summary line.
             const keyMatch = finding.detail.match(/Env key `([^`]+)`/);
             const keyName = keyMatch ? keyMatch[1] : finding.file;
-            allFindings.push({ vaultRef, keyName, relPath });
+            allFindings.push({ envRef, keyName, relPath });
         }
     }
     return allFindings;
@@ -91,7 +151,7 @@ export async function auditInstalledStashForDangerousKeys(opts) {
     if (stance === "warn-allow") {
         // Operator has explicitly accepted the risk — warn and continue.
         for (const f of allFindings) {
-            warn(`[dangerous-vault-key] ${f.relPath}: key \`${f.keyName}\` in ${f.vaultRef} can hijack process execution via \`akm env run\`. Proceeding because --allow-insecure was set.`);
+            warn(`[dangerous-env-key] ${f.relPath}: key \`${f.keyName}\` in ${f.envRef} can hijack process execution via \`akm env run\`. Proceeding because --allow-insecure was set.`);
         }
         return { blocked: false };
     }
@@ -105,7 +165,7 @@ export async function auditInstalledStashForDangerousKeys(opts) {
         }
         catch (_rollbackErr) {
             return (`Rollback failed — stash may still be installed at ${installedStashRoot}. ` +
-                `Remove it manually with: akm remove ${rollbackTarget}`);
+                `Remove it manually with: akm bundle remove ${rollbackTarget}`);
         }
     }
     if (isTTY) {
@@ -113,14 +173,14 @@ export async function auditInstalledStashForDangerousKeys(opts) {
         // Guard on stdin (not stdout) because p.confirm() reads from stdin;
         // stdout may be a TTY while stdin is piped, which would cause a hang.
         const stashLabel = ref;
-        const groupedByVault = new Map();
+        const groupedByEnv = new Map();
         for (const f of allFindings) {
-            const existing = groupedByVault.get(f.vaultRef) ?? [];
+            const existing = groupedByEnv.get(f.envRef) ?? [];
             existing.push(f.keyName);
-            groupedByVault.set(f.vaultRef, existing);
+            groupedByEnv.set(f.envRef, existing);
         }
-        for (const [vaultRef, keys] of groupedByVault) {
-            warn(`[warn] Env "${vaultRef}" in stash "${stashLabel}" contains potentially dangerous keys:`);
+        for (const [envRef, keys] of groupedByEnv) {
+            warn(`[warn] Env "${envRef}" in stash "${stashLabel}" contains potentially dangerous keys:`);
             for (const key of keys) {
                 warn(`  - ${key}: can hijack process execution via \`akm env run\``);
             }
@@ -134,7 +194,7 @@ export async function auditInstalledStashForDangerousKeys(opts) {
             console.error(JSON.stringify({
                 ok: false,
                 error: "Install aborted: stash contains dangerous env keys. Remove the keys or re-run with --allow-insecure to bypass.",
-                code: "DANGEROUS_VAULT_KEY",
+                code: "DANGEROUS_ENV_KEY",
                 ...(rollbackWarning ? { rollbackWarning } : {}),
             }, null, 2));
             return { blocked: true, exitCode: 1 };
@@ -144,11 +204,11 @@ export async function auditInstalledStashForDangerousKeys(opts) {
     }
     // Non-interactive path without bypass flag: fail hard.
     const rollbackWarning = await rollback();
-    const keyList = allFindings.map((f) => `  - ${f.keyName} (${f.vaultRef})`).join("\n");
+    const keyList = allFindings.map((f) => `  - ${f.keyName} (${f.envRef})`).join("\n");
     console.error(JSON.stringify({
         ok: false,
         error: `Install blocked: stash "${ref}" contains dangerous env keys that can hijack process execution via \`akm env run\`:\n${keyList}\nRe-run with --allow-insecure to bypass this check after reviewing the env file.`,
-        code: "DANGEROUS_VAULT_KEY",
+        code: "DANGEROUS_ENV_KEY",
         ...(rollbackWarning ? { rollbackWarning } : {}),
     }, null, 2));
     return { blocked: true, exitCode: 1 };
@@ -170,14 +230,14 @@ export const addCommand = defineJsonCommand({
         name: { type: "string", description: "Human-friendly name for the source" },
         writable: {
             type: "boolean",
-            description: "Mark a git stash as writable so changes can be pushed back",
+            description: "Mark a git bundle as writable so changes can be pushed back",
             default: false,
         },
         "max-pages": { type: "string", description: "Maximum pages to crawl for website sources (default: 50)" },
         "max-depth": { type: "string", description: "Maximum crawl depth for website sources (default: 3)" },
         "allow-insecure": {
             type: "boolean",
-            description: "Allow a plain HTTP source URL and skip confirmation for dangerous env keys (e.g. LD_PRELOAD, PATH). Use only after explicitly reviewing the stash.",
+            description: "Allow a plain HTTP source URL and skip confirmation for dangerous env keys (e.g. LD_PRELOAD, PATH). Use only after explicitly reviewing the bundle.",
             default: false,
         },
     },
@@ -185,7 +245,9 @@ export const addCommand = defineJsonCommand({
         const ref = args.ref.trim();
         const allowInsecure = args["allow-insecure"];
         const allowDangerousKeys = allowInsecure;
-        // URL with --provider → stash source (remote or git provider)
+        // --provider → declarative bundle source (URL for git/website; bare
+        // package spec for npm — R-013). Config-only write; content is not
+        // synced until a later `akm update`.
         if (args.provider) {
             if (shouldWarnOnPlainHttp(ref)) {
                 if (!allowInsecure) {
@@ -257,8 +319,14 @@ export const addCommand = defineJsonCommand({
             // Use the canonical installed id (most reliably resolved by akmRemove) rather
             // than the raw user-supplied ref which may not match after URL normalisation.
             const rollbackTarget = result.installed?.id ?? result.sourceAdded?.stashRoot ?? ref;
-            // The audit RETURNS its decision; we decide `process.exit` here, OUTSIDE
-            // any catch, so the abort cannot be lost to a swallowed exception (C3).
+            // The audit RETURNS its decision; we decide the exit outcome here,
+            // OUTSIDE any catch, so the abort cannot be lost to a swallowed
+            // exception (C3). F4: `process.exitCode = …; return;` instead of
+            // `process.exit(...)` — the DANGEROUS_ENV_KEY error envelope has
+            // already been written to stderr by the audit itself (or is about to
+            // be), so an explicit `return` here (skipping the success `output("add",
+            // …)` below) is load-bearing, not merely cosmetic: it is what stops a
+            // blocked install from ALSO printing a success envelope.
             const decision = await auditInstalledStashForDangerousKeys({
                 installedStashRoot,
                 ref,
@@ -267,7 +335,8 @@ export const addCommand = defineJsonCommand({
                 isTTY: process.stdin.isTTY === true,
             });
             if (decision.blocked) {
-                process.exit(decision.exitCode);
+                process.exitCode = decision.exitCode;
+                return;
             }
         }
         output("add", result);

package/dist/commands/sources/bundle-cli.js

@@ -0,0 +1,166 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/**
+ * `akm bundle` command group — 0.9 CLI overhaul (S7).
+ *
+ * Consolidates the five former top-level bundle-lifecycle commands under one
+ * group, hard break, no alias kept at the top level:
+ *   - `create` (= old top-level `init`, src/commands/sources/init.ts)
+ *   - `add`    (= old top-level `add`, src/commands/sources/add-cli.ts — the
+ *     command definition moved here; `add-cli.ts` keeps its exported helpers,
+ *     including `auditInstalledStashForDangerousKeys`, which a test imports
+ *     directly)
+ *   - `list`   (= old top-level `list`)
+ *   - `remove` (= old top-level `remove`)
+ *   - `update` (= old top-level `update`)
+ *   - `show <name>` — NEW: a single-bundle detail view of the `list` payload.
+ *
+ * `add`/`list`/`remove`/`update` are pure relocations (payload and output
+ * shape unchanged: `SourceEntry`/`RemoveResponse`/`UpdateResponse` keep their
+ * bare `add`/`list`/`remove`/`update` output shape). `create` is a genuine
+ * verb rename (was `init`), so its output shape is renamed to `bundle-create`
+ * to match (the same convention S8 used for `propose` -> `proposal new`'s
+ * `proposal-new` shape). `show` is a new shape, `bundle-show`.
+ */
+import { defineGroupCommand, defineJsonCommand, output } from "../../cli/shared.js";
+import { NotFoundError, UsageError } from "../../core/errors.js";
+import { appendEvent } from "../../core/events.js";
+import { addCommand } from "./add-cli.js";
+import { akmInit } from "./init.js";
+import { akmListSources, akmRemove, akmUpdate } from "./installed-stashes.js";
+const VALID_SOURCE_KINDS = new Set(["filesystem", "git", "npm", "website"]);
+function parseKindFilter(raw) {
+    if (!raw)
+        return undefined;
+    const kinds = raw.split(",").map((s) => s.trim());
+    for (const k of kinds) {
+        if (!VALID_SOURCE_KINDS.has(k)) {
+            throw new UsageError(`Invalid --kind value: "${k}". Expected one of: filesystem, git, npm, website`);
+        }
+    }
+    return kinds;
+}
+const createCommand = defineJsonCommand({
+    meta: {
+        name: "create",
+        description: "Initialize akm's working bundle directory and persist it in config",
+    },
+    args: {
+        dir: { type: "string", description: "Custom bundle directory path (default: ~/akm)" },
+        "set-default": {
+            type: "boolean",
+            description: "Make --dir the default bundle. Without this, `akm bundle create --dir X` scaffolds X but leaves your existing default bundle unchanged.",
+            default: false,
+        },
+    },
+    async run({ args }) {
+        const result = await akmInit({
+            dir: args.dir,
+            setDefault: args["set-default"],
+        });
+        output("bundle-create", result);
+    },
+});
+const listCommand = defineJsonCommand({
+    meta: { name: "list", description: "List configured bundles and their resolved source state" },
+    args: {
+        kind: {
+            type: "string",
+            description: "Filter by source provider (filesystem, git, npm, website). Comma-separated.",
+        },
+    },
+    async run({ args }) {
+        const kind = parseKindFilter(args.kind);
+        const result = await akmListSources({ kind });
+        output("list", result);
+    },
+});
+const showCommand = defineJsonCommand({
+    meta: { name: "show", description: "Show detail for a single configured bundle" },
+    args: {
+        name: { type: "positional", description: "Bundle name (as reported by `akm bundle list`)", required: true },
+    },
+    async run({ args }) {
+        const { sources } = await akmListSources();
+        const entry = sources.find((s) => s.name === args.name);
+        if (!entry) {
+            throw new NotFoundError(`No configured bundle named "${args.name}"`, "SOURCE_NOT_FOUND");
+        }
+        output("bundle-show", entry);
+    },
+});
+const removeCommand = defineJsonCommand({
+    meta: { name: "remove", description: "Remove a bundle by id, ref, path, URL, or name" },
+    args: {
+        target: { type: "positional", description: "Bundle to remove (id, ref, path, URL, or name)", required: true },
+        yes: { type: "boolean", alias: "y", description: "Skip confirmation prompt", default: false },
+    },
+    async run({ args }) {
+        const { confirmDestructive } = await import("../../cli/confirm.js");
+        const confirmed = await confirmDestructive(`Remove bundle "${args.target}"? This cannot be undone.`, {
+            yes: args.yes === true,
+        });
+        if (!confirmed) {
+            process.stderr.write("Aborted.\n");
+            return;
+        }
+        const result = await akmRemove({ target: args.target });
+        appendEvent({
+            eventType: "remove",
+            metadata: {
+                target: args.target,
+                ref: typeof result.removed?.ref === "string" ? result.removed.ref : null,
+                id: typeof result.removed?.id === "string" ? result.removed.id : null,
+            },
+        });
+        output("remove", result);
+    },
+});
+const updateCommand = defineJsonCommand({
+    meta: { name: "update", description: "Update one or all managed bundles" },
+    args: {
+        target: { type: "positional", description: "Bundle to update (id or ref)", required: false },
+        all: { type: "boolean", description: "Update all installed entries", default: false },
+        force: { type: "boolean", description: "Force fresh download even if version is unchanged", default: false },
+        // F1/R-058: gates ONLY the rare branch where the resolved content
+        // directory moves and the previous `localRoot` is deleted — a normal
+        // refresh (the overwhelming majority of updates) deletes nothing and
+        // never consults this flag. Mirrors `remove`'s `-y/--yes`.
+        yes: {
+            type: "boolean",
+            alias: "y",
+            description: "Skip the confirmation prompt when an update needs to delete a previous install directory (because the resolved content location moved). No effect on a normal refresh, which deletes nothing.",
+            default: false,
+        },
+    },
+    async run({ args }) {
+        const result = await akmUpdate({ target: args.target, all: args.all, force: args.force, yes: args.yes });
+        appendEvent({
+            eventType: "update",
+            metadata: {
+                target: args.target ?? null,
+                all: args.all === true,
+                force: args.force === true,
+                processed: Array.isArray(result.processed)
+                    ? result.processed.length
+                    : 0,
+            },
+        });
+        output("update", result);
+    },
+});
+export const bundleCommand = defineGroupCommand({
+    meta: {
+        name: "bundle",
+        description: "Create, add to, inspect, and manage your bundles (working bundle + configured sources)",
+    },
+    subCommands: {
+        create: createCommand,
+        add: addCommand,
+        list: listCommand,
+        show: showCommand,
+        remove: removeCommand,
+        update: updateCommand,
+    },
+});

package/dist/commands/sources/bundle-config-ops.js

@@ -6,7 +6,7 @@
  *
  * The `stashDir`/`sources[]`/`installed[]` trio is retired: every source is now
  * a `bundles.<slug>` entry, and the primary working stash is the `defaultBundle`.
- * These helpers give the source writers (`akm init`, `akm setup`, `akm add`,
+ * These helpers give the source writers (`akm bundle create`, `akm setup`, `akm bundle add`,
  * `akm sources add/remove`) one place to derive slug-legal bundle keys (via the
  * shared {@link deriveBundleId} — D-R5), locate an existing bundle by its source
  * descriptor, and set/repoint the primary bundle — without duplicating the
@@ -28,7 +28,12 @@ export function withPrimaryBundle(config, stashDir) {
     if (!key || !(key in bundles) || typeof bundles[key]?.path !== "string") {
         key = deriveBundleId(undefined, stashDir, new Set(Object.keys(bundles)));
     }
-    bundles[key] = { ...bundles[key], path: stashDir, writable: true };
+    bundles[key] = {
+        ...bundles[key],
+        path: stashDir,
+        writable: true,
+        components: { main: { root: ".", adapter: "akm", writable: true } },
+    };
     return { ...config, bundles, defaultBundle: key };
 }
 /** Existing bundle key whose filesystem descriptor resolves to `resolvedPath`, or `undefined`. */

package/dist/commands/sources/info.js

@@ -3,11 +3,13 @@
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import fs from "node:fs";
 import { placementTypes } from "../../core/asset/asset-placement.js";
+import { resolveStashDir } from "../../core/common.js";
 import { getSources, loadConfig } from "../../core/config/config.js";
 import { getDbPath } from "../../core/paths.js";
+import { error } from "../../core/warn.js";
 import { getEffectiveSemanticStatus, readSemanticStatus } from "../../indexer/search/semantic-status.js";
 import { closeDatabase, openExistingDatabase } from "../../storage/repositories/index-connection.js";
-import { getEntryCount } from "../../storage/repositories/index-entries-repository.js";
+import { getEntryCount, getEntryCountByType } from "../../storage/repositories/index-entries-repository.js";
 import { getMeta } from "../../storage/repositories/index-meta-repository.js";
 import { isVecAvailable } from "../../storage/repositories/index-vec-repository.js";
 import { pkgVersion } from "../../version.js";
@@ -19,6 +21,11 @@ import { pkgVersion } from "../../version.js";
  */
 export function assembleInfo(options) {
     const config = loadConfig();
+    // Primary stash directory + default bundle name — same resolution
+    // `akm sources list` uses (R-057), so `akm info` and `akm sources list`
+    // agree on which stash is primary.
+    const stashDir = resolveStashDir();
+    const defaultBundle = config.defaultBundle ?? null;
     // Asset types (copy into a mutable array — `placementTypes()` returns readonly)
     const assetTypes = [...placementTypes()];
     const semanticRuntime = readSemanticStatus();
@@ -45,14 +52,16 @@ export function assembleInfo(options) {
         ...(s.url ? { url: s.url } : {}),
         ...(s.enabled !== undefined ? { enabled: s.enabled } : {}),
     }));
-    // Index stats — resolve the DB path from config so info reads the same
-    // database that health and search use, rather than a bare getDbPath() call
-    // that ignores XDG_DATA_HOME or per-config overrides.
+    // Index stats — `options.dbPath` is a test-only override (see the param
+    // doc above); real callers fall through to the same `getDbPath()` that
+    // health and search use, so info reads the same database they do.
     const resolvedDbPath = options?.dbPath ?? getDbPath();
     const indexStats = readIndexStats(resolvedDbPath);
     return {
         schemaVersion: 1,
         version: pkgVersion,
+        bundleDir: stashDir,
+        defaultBundle,
         assetTypes,
         searchModes,
         semanticSearch: {
@@ -69,6 +78,7 @@ export function assembleInfo(options) {
 function readIndexStats(resolvedPath) {
     const EMPTY = {
         entryCount: 0,
+        byType: {},
         lastBuiltAt: null,
         hasEmbeddings: false,
         vecAvailable: false,
@@ -80,6 +90,7 @@ function readIndexStats(resolvedPath) {
         db = openExistingDatabase(resolvedPath);
         return {
             entryCount: getEntryCount(db),
+            byType: getEntryCountByType(db),
             lastBuiltAt: getMeta(db, "builtAt") ?? null,
             hasEmbeddings: getMeta(db, "hasEmbeddings") === "1",
             vecAvailable: isVecAvailable(db),
@@ -88,7 +99,9 @@ function readIndexStats(resolvedPath) {
     catch (err) {
         // Surface the error so operators can diagnose mismatches between
         // `akm info` and `akm health` rather than silently returning zeros.
-        process.stderr.write(`[akm info] failed to read index stats from ${resolvedPath}: ${String(err)}\n`);
+        // Routed through core/warn's `error()` (not a raw process.stderr.write)
+        // so `--quiet`/`setQuiet()` actually gate this line (R-057).
+        error(`[akm info] failed to read index stats from ${resolvedPath}: ${String(err)}`);
         return EMPTY;
     }
     finally {