akm-cli 0.9.0 → 0.9.1-beta.1

package/dist/sources/providers/git-stash.js

@@ -56,6 +56,21 @@ export class GitStashPushError extends Error {
 }
 const GIT_PUSH_TIMEOUT_MS = 120_000;
 const ZERO_OID = "0000000000000000000000000000000000000000";
+let exactCommitHookForTests;
+/**
+ * TEST-ONLY. Interleave work into the exact-path commit sequence; `undefined`
+ * restores. Exists because the CAS window is a few microseconds wide between
+ * two synchronous `git` invocations — a wall-clock race would be
+ * non-deterministic, and every earlier pre-check would swallow a commit that
+ * landed before the window opened. Inert in production.
+ */
+export function _setGitExactCommitHookForTests(hook) {
+    exactCommitHookForTests = hook;
+}
+/** Fire a named exact-path-commit race point (no-op outside tests). */
+function gitExactCommitHook(point) {
+    exactCommitHookForTests?.(point);
+}
 /**
  * Resolve the writable flag for an end-of-run / `akm sync` commit from the
  * configured default bundle.
@@ -523,6 +538,10 @@ function createExactPathCommit(repoDir, options) {
             throw new Error(`Git target changed before its exact commit could be attached.`);
         }
         assertWorktreeMatchesExpected(repoDir, options.paths, expected);
+        // Race window: everything below this line is defended only by the
+        // update-ref compare-and-swap. See
+        // tests/integration/sync-exact-commit-cas.test.ts.
+        gitExactCommitHook("before-update-ref");
         const update = runGit(["-C", repoDir, "update-ref", branchRef, commitOid, options.baseHead ?? ZERO_OID]);
         if (update.status !== 0) {
             throw new Error(`Git target advanced before its exact commit could be attached.`);

package/dist/sources/providers/git.js

@@ -10,4 +10,4 @@
 // keeps importing from a single module namespace.
 export { classifyCloneFailure, cloneRepo, inspectGitUpstream, runGit, syncExistingWritableCheckout, } from "./git-install.js";
 export { ensureGitMirror, GitSourceProvider, getCachePaths, parseGitRepoUrl, syncMirroredRepo, } from "./git-provider.js";
-export { GitStashPushError, isGitBackedStash, listGitChangedPaths, resolveWritableOverride, saveGitStash, } from "./git-stash.js";
+export { _setGitExactCommitHookForTests, GitStashPushError, isGitBackedStash, listGitChangedPaths, resolveWritableOverride, saveGitStash, } from "./git-stash.js";

package/dist/sources/snapshot-fetchers/website-ingest.js

@@ -1,7 +1,7 @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
-import { createHash } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { fetchWithRetry, isWithin, ResponseTooLargeError, readBodyWithByteCap, resolveStashDir, todayIso, } from "../../core/common.js";
@@ -201,19 +201,111 @@ async function fetchSnapshotViaRegistry(startUrl, stashDir, allowPrivateHosts, r
     };
     return dispatchSnapshotFetchers(parsed, context, stashDir);
 }
+let snapshotWriteHookForTests;
+/**
+ * TEST-ONLY. Interrupt a refresh partway through its page-write loop;
+ * `undefined` restores. Exists because "a process killed mid-refresh" cannot
+ * be staged from outside the module — the whole loop is a single synchronous
+ * burst between two awaits. Inert in production (one `undefined?.()` per page).
+ */
+export function _setWebsiteSnapshotWriteHookForTests(hook) {
+    snapshotWriteHookForTests = hook;
+}
+function snapshotWriteHook(event) {
+    snapshotWriteHookForTests?.(event);
+}
+function snapshotSiblingPrefix(stashDir, kind) {
+    return `.${path.basename(stashDir)}.${kind}-`;
+}
+function snapshotSiblingPath(stashDir, kind) {
+    const unique = `${process.pid}-${randomBytes(6).toString("hex")}`;
+    return path.join(path.dirname(stashDir), `${snapshotSiblingPrefix(stashDir, kind)}${unique}`);
+}
+/**
+ * Age gate for the staging sweep. Nothing enforces one refresh at a time for a
+ * given website source, so a sibling directory may belong to a refresh that is
+ * still running in another process; deleting it would break a healthy run
+ * instead of cleaning up after a dead one. Only clearly-abandoned directories
+ * (untouched for an hour — far longer than the 10-minute crawl wall-clock cap)
+ * are swept. Leftovers are inert until then: they are dot-prefixed, so the
+ * indexer's walk skips them.
+ */
+const SNAPSHOT_STAGING_SWEEP_AGE_MS = 60 * 60 * 1000;
+/** Remove staging/retired directories abandoned by an earlier interrupted run. */
+function sweepSnapshotStaging(stashDir) {
+    const parent = path.dirname(stashDir);
+    let entries;
+    try {
+        entries = fs.readdirSync(parent);
+    }
+    catch {
+        return;
+    }
+    const prefixes = [snapshotSiblingPrefix(stashDir, "staging"), snapshotSiblingPrefix(stashDir, "retired")];
+    const cutoff = Date.now() - SNAPSHOT_STAGING_SWEEP_AGE_MS;
+    for (const entry of entries) {
+        if (!prefixes.some((prefix) => entry.startsWith(prefix)))
+            continue;
+        const abandoned = path.join(parent, entry);
+        try {
+            if (fs.statSync(abandoned).mtimeMs > cutoff)
+                continue;
+        }
+        catch {
+            continue;
+        }
+        fs.rmSync(abandoned, { recursive: true, force: true });
+    }
+}
+function beginSnapshotStaging(stashDir) {
+    fs.mkdirSync(path.dirname(stashDir), { recursive: true });
+    sweepSnapshotStaging(stashDir);
+    const dir = snapshotSiblingPath(stashDir, "staging");
+    fs.mkdirSync(dir, { recursive: true });
+    return { dir, target: stashDir };
+}
+/**
+ * Swap the staged snapshot in. POSIX cannot atomically exchange two non-empty
+ * directories, so the previous snapshot is renamed ASIDE first and deleted
+ * afterwards: the window in which the target does not exist is one syscall
+ * wide instead of an entire write loop.
+ */
+function publishSnapshotStaging(staging) {
+    let retired;
+    if (fs.existsSync(staging.target)) {
+        retired = snapshotSiblingPath(staging.target, "retired");
+        fs.renameSync(staging.target, retired);
+    }
+    fs.renameSync(staging.dir, staging.target);
+    if (retired)
+        fs.rmSync(retired, { recursive: true, force: true });
+}
+/** Drop an unpublished staging directory (no-op once it has been renamed). */
+function discardSnapshotStaging(staging) {
+    fs.rmSync(staging.dir, { recursive: true, force: true });
+}
 /** Materialize a single fetcher snapshot as the source's whole stash. */
 function writeSnapshotToStash(stashDir, snapshot) {
     const preferredName = snapshot.preferredName ?? deriveImportPath(snapshot.url);
     const relPath = avoidReservedBasename(preferredName);
+    // Validate against the FINAL location so the guarantee (and the error text)
+    // is independent of where the file is staged.
     const knowledgeDir = path.join(stashDir, "knowledge");
-    const filePath = path.resolve(knowledgeDir, `${relPath}.md`);
-    if (!isWithin(filePath, knowledgeDir)) {
+    if (!isWithin(path.resolve(knowledgeDir, `${relPath}.md`), knowledgeDir)) {
         throw new UsageError(`Snapshot fetcher returned an unsafe preferred name: ${JSON.stringify(preferredName)}`);
     }
-    fs.rmSync(stashDir, { recursive: true, force: true });
-    fs.mkdirSync(path.dirname(filePath), { recursive: true });
-    const slug = relPath.split("/").pop() ?? "index";
-    fs.writeFileSync(filePath, buildMarkdownSnapshot({ url: snapshot.url, title: snapshot.title, markdown: snapshot.markdown }, slug, snapshot.tags), "utf8");
+    const staging = beginSnapshotStaging(stashDir);
+    try {
+        const filePath = path.resolve(path.join(staging.dir, "knowledge"), `${relPath}.md`);
+        fs.mkdirSync(path.dirname(filePath), { recursive: true });
+        const slug = relPath.split("/").pop() ?? "index";
+        fs.writeFileSync(filePath, buildMarkdownSnapshot({ url: snapshot.url, title: snapshot.title, markdown: snapshot.markdown }, slug, snapshot.tags), "utf8");
+        snapshotWriteHook({ point: "page-written", index: 1, total: 1, relPath: `knowledge/${relPath}.md` });
+        publishSnapshotStaging(staging);
+    }
+    finally {
+        discardSnapshotStaging(staging);
+    }
 }
 async function scrapeWebsiteToStash(startUrl, stashDir, options) {
     // Offer the URL to the specialized fetchers before falling back to a crawl.
@@ -229,19 +321,33 @@ async function scrapeWebsiteToStash(startUrl, stashDir, options) {
     if (pages.length === 0) {
         throw new Error(`No content could be scraped from ${startUrl}`);
     }
-    fs.rmSync(stashDir, { recursive: true, force: true });
-    const knowledgeDir = path.join(stashDir, "knowledge");
-    fs.mkdirSync(knowledgeDir, { recursive: true });
-    const usedPaths = new Set();
-    for (const page of pages) {
-        const relPath = avoidReservedBasename(urlToRelativePath(page.url));
-        const uniquePath = uniqueSlug(relPath, usedPaths);
-        const filePath = path.join(knowledgeDir, `${uniquePath}.md`);
-        const dir = path.dirname(filePath);
-        if (dir !== knowledgeDir)
-            fs.mkdirSync(dir, { recursive: true });
-        const slug = uniquePath.split("/").pop() ?? "index";
-        fs.writeFileSync(filePath, buildMarkdownSnapshot(page, slug), "utf8");
+    const staging = beginSnapshotStaging(stashDir);
+    try {
+        const knowledgeDir = path.join(staging.dir, "knowledge");
+        fs.mkdirSync(knowledgeDir, { recursive: true });
+        const usedPaths = new Set();
+        let written = 0;
+        for (const page of pages) {
+            const relPath = avoidReservedBasename(urlToRelativePath(page.url));
+            const uniquePath = uniqueSlug(relPath, usedPaths);
+            const filePath = path.join(knowledgeDir, `${uniquePath}.md`);
+            const dir = path.dirname(filePath);
+            if (dir !== knowledgeDir)
+                fs.mkdirSync(dir, { recursive: true });
+            const slug = uniquePath.split("/").pop() ?? "index";
+            fs.writeFileSync(filePath, buildMarkdownSnapshot(page, slug), "utf8");
+            written++;
+            snapshotWriteHook({
+                point: "page-written",
+                index: written,
+                total: pages.length,
+                relPath: `knowledge/${uniquePath}.md`,
+            });
+        }
+        publishSnapshotStaging(staging);
+    }
+    finally {
+        discardSnapshotStaging(staging);
     }
 }
 export async function fetchWebsiteMarkdownSnapshot(rawUrl, options) {

package/dist/storage/database.js

@@ -162,7 +162,12 @@ function loadBetterSqlite3() {
         }
         catch (err) {
             throw new Error("akm could not load 'better-sqlite3', the SQLite driver it needs on Node.js.\n" +
-                "  • Reinstall akm with a working C/C++ build toolchain so its optional\n" +
+                "  • If the error below says the module was compiled against a DIFFERENT Node.js\n" +
+                "    version, you upgraded Node after installing akm. Reinstall akm (or run\n" +
+                "    `npm rebuild better-sqlite3` in its install directory) so the binding is\n" +
+                "    rebuilt for the Node you are now running. This is the common case after a\n" +
+                "    Node major upgrade, and it is NOT a broken install.\n" +
+                "  • Otherwise, reinstall akm with a working C/C++ build toolchain so its optional\n" +
                 "    'better-sqlite3' native binding rebuilds (a global `npm i -g better-sqlite3`\n" +
                 "    will NOT be resolved — Node loads it from akm's own node_modules).\n" +
                 "  • Or run akm under Bun, which has a built-in SQLite driver and needs no native build.\n" +

package/dist/storage/managed-db.js

@@ -26,6 +26,25 @@ import { applyStandardPragmas } from "./sqlite-pragmas.js";
  * Open a managed SQLite database: ensure the parent dir exists, open the handle,
  * apply standard pragmas, then run the schema initializer. The single home for
  * the open→pragmas→migrate recipe.
+ *
+ * ── On file permissions (reverted, issue #791) ──
+ *
+ * This function briefly chmodded the database, its `-wal`/`-shm` sidecars, and
+ * THE CONTAINING DIRECTORY to owner-only on every open (#756). That was a
+ * mistake and is deliberately not coming back:
+ *
+ *   - It mutated state akm did not create. The data directory belongs to the
+ *     operator; a read of the index is not consent to re-permission their disk.
+ *   - It ran on the most-traveled path in the CLI, including `create: false`
+ *     (read-only) opens, so any command at all silently converted a legacy
+ *     `0755` directory to `0700` with no prompt, warning, or migration note.
+ *   - It therefore broke installs that share `$XDG_DATA_HOME` across uids —
+ *     agent sandboxes, containers, service accounts — which worked in 0.9.0.
+ *     Worse, the read path answers an unreadable index with a false
+ *     "No search index available" at exit 0 rather than an error (#791).
+ *
+ * Files akm creates here get the process umask, which is the operator's lever
+ * for this and always was. akm neither sets these modes nor reports on them.
  */
 export function openManagedDatabase(spec) {
     const dir = path.dirname(spec.path);

package/dist/storage/repositories/index-connection.js

@@ -10,8 +10,9 @@
  * import their opener from a sibling here instead of reaching up into the
  * indexer — inverting the old storage→indexer arrow.
  */
-import fs from "node:fs";
 import { createRequire } from "node:module";
+import { ConfigError } from "../../core/errors.js";
+import { classifyPathAccess, describeInaccessiblePath } from "../../core/path-access.js";
 import { getDbPath } from "../../core/paths.js";
 import { openDatabase } from "../database.js";
 import { openManagedDatabase } from "../managed-db.js";
@@ -71,18 +72,42 @@ export function openExistingDatabase(dbPath) {
     // tests/storage/open-existing-database-no-create.test.ts. `create: false`
     // below is the race-free backstop for this pre-check.
     const resolvedPath = dbPath ?? getDbPath();
-    if (!fs.existsSync(resolvedPath)) {
+    assertIndexPathReadable(resolvedPath);
+    if (classifyPathAccess(resolvedPath).access === "absent") {
         throw new Error(`Index database not found at ${resolvedPath}. Run 'akm index' to build it.`);
     }
     return openManagedDatabase({ path: resolvedPath, init: loadVecExtension, create: false });
 }
+/**
+ * Refuse to treat an UNREADABLE index as a missing one (#791).
+ *
+ * `fs.existsSync()` — which every one of these gates used to call — returns
+ * `false` for `EACCES` exactly as for `ENOENT`, so an index this process cannot
+ * read looked identical to one that had never been built. Callers then took
+ * their "no index yet" branch: `search`/`curate` returned no hits at exit 0 and
+ * told the user to run `akm index`, which would not have helped and which they
+ * may not have permission to do either.
+ *
+ * A `ConfigError` here exits 78 through the standard `{ok:false, error, code}`
+ * envelope, so both a human and a machine caller can tell "nothing indexed"
+ * from "I cannot see the index".
+ */
+export function assertIndexPathReadable(resolvedPath) {
+    const { access, code } = classifyPathAccess(resolvedPath);
+    if (access !== "inaccessible")
+        return;
+    throw new ConfigError(`Index database exists but is not readable: ${describeInaccessiblePath(resolvedPath, code)}.`, "DATA_DIR_UNREADABLE");
+}
 /**
  * Open an existing index for queries without creating directories, a database
  * file, journals, or running write-capable pragmas/schema initialization.
  */
 export function openReadonlyExistingDatabase(dbPath) {
     const resolvedPath = dbPath ?? getDbPath();
-    if (!fs.existsSync(resolvedPath))
+    // `undefined` means "no index" — reserve it for a genuinely absent one, and
+    // let an unreadable index raise instead of masquerading as absent (#791).
+    assertIndexPathReadable(resolvedPath);
+    if (classifyPathAccess(resolvedPath).access === "absent")
         return undefined;
     return openDatabase(resolvedPath, { readonly: true, create: false });
 }

package/dist/storage/repositories/index-entries-repository.js

@@ -13,6 +13,7 @@ import path from "node:path";
 import { parseBundleRef } from "../../core/asset/asset-ref.js";
 import { conceptIdFromTypeName } from "../../core/asset/resolve-ref.js";
 import { bestEffort } from "../../core/best-effort.js";
+import { isPathAbsent } from "../../core/path-access.js";
 import { getStateDbPath, withStateDb } from "../../core/state-db.js";
 import { warn } from "../../core/warn.js";
 import { buildSearchText } from "../../indexer/search/search-fields.js";
@@ -278,7 +279,11 @@ export function rekeyEntryInPlace(db, opts) {
  * history (live-asset-wins). Best-effort + guarded on state.db's existence.
  */
 function rewriteUsageEventRefForMove(opts) {
-    if (!fs.existsSync(getStateDbPath()))
+    // Every other failure in here throws (see the catch below) precisely because
+    // a move that quietly drops its usage history is a wrong answer wearing a
+    // success. An unreadable state.db must not be the one silent exception —
+    // only a state.db that was never created skips (#791).
+    if (isPathAbsent(getStateDbPath()))
         return;
     // `usage_events.entry_ref` is the fully-qualified item_ref
     // (`<bundle>//<conceptId>`).

package/dist/storage/repositories/workflow-runs-repository.js

@@ -2,6 +2,7 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import { openStateDatabase, withImmediateTransaction } from "../../core/state-db.js";
+import { borrowScopedStateDb, withStateDbScope } from "../../core/state-db-scope.js";
 import { resolveStorageLocations } from "../locations.js";
 /**
  * Repository owning every raw SQL statement against `workflow_runs` and
@@ -214,8 +215,10 @@ export class WorkflowRunsRepository {
     //
     // Writes to `workflow_run_units` should go through the serialized writer
     // queue (`src/workflows/exec/unit-writer.ts`) when N units may complete
-    // concurrently — SQLite has a single writer and `withWorkflowRunsRepo`
-    // opens a fresh connection per call.
+    // concurrently — SQLite has a single writer per database FILE, and outside a
+    // {@link withWorkflowRunsConnection} scope `withWorkflowRunsRepo` opens a
+    // fresh connection per call (so N concurrent writers would contend against
+    // each other for the write lock).
     getUnitsForRun(runId) {
         return this.db
             .prepare("SELECT * FROM workflow_run_units WHERE run_id = ? ORDER BY started_at ASC, unit_id ASC")
@@ -323,22 +326,55 @@ export class WorkflowRunsRepository {
                 `recoverable state.`);
         }
     }
+    /**
+     * Finish a unit row ONLY while it is still the exact row a specific dispatch
+     * inserted: `running`, with that dispatch's `started_at`. The native
+     * executor's guarded finish (single-driver invariant): a run stolen by
+     * another engine re-dispatches the unit through {@link insertUnit}, which
+     * REPLACES the row (fresh `started_at`, bumped `attempts`) — the stale
+     * driver's finish then matches NOTHING instead of clobbering the new
+     * driver's live dispatch. Returns whether the row was finished; a zero-row
+     * match is a caller-classified outcome here (the executor distinguishes
+     * "replaced by another driver" from "row vanished"), unlike
+     * {@link finishUnit}'s loud throw, whose callers guarantee their row exists.
+     */
+    finishUnitFromDispatch(input) {
+        const result = this.db
+            .prepare(`UPDATE workflow_run_units
+           SET status = ?, result_json = ?, tokens = ?, failure_reason = ?, session_id = ?, finished_at = ?
+           WHERE run_id = ? AND unit_id = ? AND status = 'running' AND started_at = ?`)
+            .run(input.status, input.resultJson, input.tokens, input.failureReason, input.sessionId ?? null, input.finishedAt, input.runId, input.unitId, input.dispatchStartedAt);
+        return Number(result.changes) === 1;
+    }
 }
 /**
- * Open state.db (bound to {@link StorageLocations.stateDb}, the post-cutover
- * home of the `workflow_runs` / `workflow_run_steps` / `workflow_run_units`
- * tables), run `fn` against a {@link WorkflowRunsRepository}, and close the
- * connection exactly once when `fn` settles.
+ * Run `fn` against a {@link WorkflowRunsRepository} bound to state.db
+ * ({@link StorageLocations.stateDb}, the post-cutover home of the
+ * `workflow_runs` / `workflow_run_steps` / `workflow_run_units` tables).
  *
- * Fresh-connection-per-call, mirroring the former workflow.db loan pattern:
- * `openStateDatabase` acquires its own maintenance activity + asserts the
- * current ledger, and the repository owns all table-scoped SQL, so the merge
- * into state.db is a zero-SQL-rewrite repoint. Repository read methods fully
- * materialise their results, so closing here never truncates lazy iteration
- * (WS5 connection-lifetime rule).
+ * Connection lifetime — BORROW-OR-OWN (mirrors `withStateDb`'s `borrowed`
+ * option and `appendEvent`'s `ctx.db` seam):
+ *
+ *   - Inside a {@link withWorkflowRunsConnection} scope, the ambient handle is
+ *     BORROWED and left open for the rest of the scope. A wide `map` fan-out
+ *     therefore opens ONE connection for the whole step instead of two per unit
+ *     (insert + finish) — `openStateDatabase` registers a maintenance activity
+ *     lockfile and opens a read-only ledger-preflight handle on every call, so
+ *     the per-call cost is milliseconds, not microseconds.
+ *   - Outside a scope the behaviour is unchanged: open a fresh connection, run
+ *     `fn`, close it in a `finally`.
+ *
+ * Repository read methods fully materialise their results, so closing an owned
+ * handle here never truncates lazy iteration (WS5 connection-lifetime rule).
+ * The signature and semantics are identical in both modes — reuse is purely an
+ * internal optimisation and no caller needs to know which mode it is in.
  */
 export async function withWorkflowRunsRepo(fn) {
-    const db = openStateDatabase(resolveStorageLocations().stateDb);
+    const stateDb = resolveStorageLocations().stateDb;
+    const borrowed = borrowScopedStateDb(stateDb);
+    if (borrowed)
+        return await Promise.resolve(fn(new WorkflowRunsRepository(borrowed)));
+    const db = openStateDatabase(stateDb);
     try {
         return await Promise.resolve(fn(new WorkflowRunsRepository(db)));
     }
@@ -346,3 +382,20 @@ export async function withWorkflowRunsRepo(fn) {
         db.close();
     }
 }
+/**
+ * Run `fn` with ONE state.db connection shared by every `withWorkflowRunsRepo`
+ * call (and every {@link import("../../core/events.js").appendEvent}) inside its
+ * async extent. The handle opens on first use and closes when `fn` settles;
+ * nesting joins the outer scope.
+ *
+ * Correctness under concurrency: `bun:sqlite` statements and
+ * `withImmediateTransaction` bodies run synchronously to completion, so
+ * logically concurrent units cannot interleave statements on the shared handle
+ * in a single-threaded event loop — sharing REMOVES in-process writer
+ * contention instead of creating it. Cross-process arbitration (WAL,
+ * `busy_timeout`, the run lease) is untouched. See `core/state-db-scope.ts` for
+ * the escaped-async-work guard.
+ */
+export function withWorkflowRunsConnection(fn) {
+    return withStateDbScope(fn, { path: resolveStorageLocations().stateDb });
+}

package/dist/tasks/log-redaction.js

@@ -0,0 +1,156 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/**
+ * Decide which exact values must be scrubbed from a task's persisted run log
+ * (issue #755).
+ *
+ * # The gap
+ *
+ * All three task target kinds funnel through `persistRunLog`, which applied
+ * only `redactCredentialPatterns` — credential *shapes* (`Bearer …`, `sk-…`,
+ * webhook URLs). Prompt- and workflow-target runs additionally redact the exact
+ * secret values reachable by the run before their output ever reaches the log.
+ * Command-target runs did not: a scheduled command that echoed a configured
+ * secret whose value is not credential-shaped persisted it verbatim, into both
+ * the `.log` file and `logs.db`, for the whole retention window.
+ *
+ * # Why the obvious fix is wrong
+ *
+ * The issue proposed reusing {@link isEnvPassthroughValueSafeToExpose} — the
+ * filter the prompt path uses — over the env handed to the child. That filter
+ * fails CLOSED for any name outside a 22-entry allowlist, which is right where
+ * it currently runs: the prompt path filters `envPassthrough`, a short list the
+ * operator explicitly declared. A command task inherits the WHOLE ambient
+ * environment, so the same rule classifies essentially everything as secret.
+ * Measured on a developer machine: 127 of 132 variables, 25 of them with
+ * one-character values (`SHLVL=1`, `OLDPWD=/`, `GIT_TERMINAL_PROMPT=0`).
+ * Redaction is substring replacement, so those become live needles:
+ *
+ *     Build finished in 12.4s        ->  Build finished in [REDACTED]2.[REDACTED]s
+ *     3 tests passed, 0 failed       ->  [REDACTED] tests passed, [REDACTED] failed
+ *     wrote dist/index.js (48 KB)    ->  wrote dist[REDACTED]index.js ([REDACTED]8 KB)
+ *
+ * A fix that destroys every command log is not a fix.
+ *
+ * # What this does instead
+ *
+ * Three sources, and the distinction between them is the whole design:
+ *
+ *  1. **Declared by config** — the config names which variables hold
+ *     credentials (`engines.<n>.apiKey: ${VAR}`, `embedding.apiKey`, and the
+ *     implicit `AKM_ENGINE_<NAME>_API_KEY` / `AKM_LLM_API_KEY` /
+ *     `AKM_EMBED_API_KEY` recipes). akm KNOWS these are secret.
+ *  2. **Declared by the task** — the `redact:` list, names only.
+ *  3. **Inferred** — a name-shape heuristic over the remaining environment, for
+ *     the ambient credential akm was never told about.
+ *
+ * Only (3) is a guess, so only (3) carries {@link MIN_INFERRED_SECRET_LENGTH}.
+ * A declared secret is redacted at ANY length, because the operator told us
+ * what it is; applying a floor to declared values would silently stop redacting
+ * short secrets that are scrubbed today. The floor exists solely to stop a
+ * *guess* from mangling a log, and 8 clears every real credential format (AWS
+ * key id 20, GitHub PAT 40, `sk-…` 40+) while excluding the flags and counters
+ * that a name heuristic occasionally catches.
+ *
+ * Note what is deliberately NOT collected: the akm secret store on disk. A
+ * spawned command sees `process.env`, not akm's stores — a stored secret can
+ * only be echoed if it is already in the environment, where the rules above
+ * catch it by name. Walking every bundle's `secrets/` on each task firing would
+ * cost a recursive readdir plus an unbounded read for values the child cannot
+ * reach anyway. `redact:` is the escape hatch for a secret injected under a
+ * name none of the rules recognise.
+ */
+import { collectSensitiveValues, isEnvPassthroughValueSafeToExpose } from "../core/redaction.js";
+import { collectEngineCredentialValues } from "../integrations/agent/engine-resolution.js";
+/**
+ * Shortest value an INFERRED (name-heuristic) match may contribute as a
+ * redaction needle. Declared secrets bypass this entirely.
+ *
+ * Redaction replaces substrings, so a short needle is not merely useless — it
+ * corrupts unrelated output. Below 8 the noise tier is fully intact (`1`, `0`,
+ * `/`, `80`, `true`, `xhigh`, `31999`); at 8 a chance collision with ordinary
+ * log vocabulary is negligible, and every credential format in real use is far
+ * longer. It also matches the conventional minimum password length, so a
+ * secret shorter than this is already outside normal policy.
+ */
+export const MIN_INFERRED_SECRET_LENGTH = 8;
+/**
+ * Environment names whose VALUE is treated as a credential on shape alone.
+ *
+ * The keyword must be a whole `_`-delimited word. Anchoring on only one side
+ * would drag in ordinary configuration from whichever side is left open:
+ * a leading anchor alone matches `KEYBOARD_LAYOUT` and `AUTHOR`, a trailing one
+ * matches `MONKEY` and `BYPASS`. Whole-word matching gets `GH_TOKEN`,
+ * `NPM_AUTH_TOKEN`, `MY_API_KEY`, `DB_PASS` and `AWS_SECRET_ACCESS_KEY` right.
+ */
+const INFERRED_SECRET_NAME = /(?:^|_)(?:API_?KEY|KEY|TOKEN|SECRET|PASSWORD|PASSWD|PASS|CREDENTIALS?|AUTH)(?:_|$)/i;
+/**
+ * Credential variables whose name is a single glued word, which no
+ * word-boundary rule can see. Enumerated rather than matched: loosening the
+ * pattern enough to catch `PGPASSWORD` also catches `MONKEY`.
+ *
+ * `PWD` cannot be a keyword above for the same reason it appears here as part
+ * of `MYSQL_PWD` — on its own it is the working directory.
+ */
+const KNOWN_SECRET_NAMES = new Set(["PGPASSWORD", "MYSQL_PWD"]);
+/** True when the NAME alone marks this variable as holding a credential. */
+export function isInferredSecretName(name) {
+    return KNOWN_SECRET_NAMES.has(name.toUpperCase()) || INFERRED_SECRET_NAME.test(name);
+}
+/** Resolve `${VAR}` / `$VAR` to the variable NAME, or undefined for anything else. */
+function envRefName(spec) {
+    if (!spec)
+        return undefined;
+    const match = /^\$\{?([A-Za-z_][A-Za-z0-9_]*)\}?$/.exec(spec.trim());
+    return match?.[1];
+}
+/**
+ * Every value that must be scrubbed from one task's persisted output.
+ *
+ * `declaredNames` comes from the task's `redact:` list. A name that is unset in
+ * `env` simply contributes nothing — naming a variable you do not currently
+ * export is not an error.
+ */
+export function collectTaskLogSensitiveValues(input) {
+    const { env, config, declaredNames } = input;
+    const values = new Set();
+    const addDeclared = (value) => {
+        if (value === undefined)
+            return;
+        const trimmed = value.trim();
+        // Both spellings: `resolveSecret` does not trim but `resolveCredentialFromEnv`
+        // does, so a variable with trailing whitespace reaches an output boundary in
+        // either form depending on which path materialized it.
+        if (value.length > 0)
+            values.add(value);
+        if (trimmed.length > 0)
+            values.add(trimmed);
+    };
+    // (1) Declared by config — engine credentials, via the collector the prompt
+    // path already uses, plus the embedding key it does not cover.
+    if (config) {
+        for (const value of collectEngineCredentialValues(config, env))
+            values.add(value);
+        addDeclared(env[envRefName(config.embedding?.apiKey) ?? "AKM_EMBED_API_KEY"]);
+    }
+    // (2) Declared by the task's `redact:` list — names only, never values.
+    for (const name of declaredNames ?? [])
+        addDeclared(env[name]);
+    // (3) Inferred from the name shape. The only guessing tier, so the only one
+    // with a length floor — and still subject to the value-level check that keeps
+    // an allowlisted name from being treated as secret.
+    for (const [name, value] of Object.entries(env)) {
+        if (value === undefined || value.length < MIN_INFERRED_SECRET_LENGTH)
+            continue;
+        if (!isInferredSecretName(name))
+            continue;
+        if (isEnvPassthroughValueSafeToExpose(name, value))
+            continue;
+        values.add(value);
+    }
+    // Expands credential-bearing URLs into their embedded components. Can yield
+    // needles shorter than the floor (a URL's password), which is correct: the
+    // operator's own value implied them.
+    return collectSensitiveValues(values);
+}