akm-cli 0.9.1-beta.1 → 0.9.1-beta.2

package/CHANGELOG.md

@@ -6,7 +6,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
-## [0.9.1-beta.1] - 2026-08-13
+## [0.9.1-beta.2] - 2026-08-17
 
 ### Breaking changes & migration
 
@@ -361,6 +361,23 @@ what an upgrader reads first.
 
 ### Fixed
 
+- **Upgrading Node after installing akm now explains itself.** A native binding
+  is built for the Node ABI present at install time, so upgrading Node major
+  versions afterwards leaves akm reporting a bare Node internals message —
+  *"The module … was compiled against a different Node.js version"*, or on a
+  second attempt the even less helpful *"Module did not self-register"*. akm now
+  recognises that failure and answers with the one command that fixes it
+  (`npm rebuild better-sqlite3`), names the ABI actually running, and says
+  plainly that this is not a broken install.
+
+  The diagnostic had to move to do this. It wrapped the `require`, but
+  `require("better-sqlite3")` **succeeds** against a mismatched binding — the
+  package resolves its `.node` file lazily — so the error lands at
+  `new Database(...)` and the loader's handler never saw it. The previous text
+  telling the user to look for a version mismatch "in the error below" was
+  unreachable. Found by installing the published build under Node 22 and running
+  it under Node 24.
+
 - **akm's Node fallback no longer aborts at teardown on Node 24.** On Node
   24.19.0 and later, any command that opened a database could intermittently
   die with `node::RemoveEnvironmentCleanupHook … Assertion (env) != nullptr`

package/dist/cli/parse-args.js

@@ -45,8 +45,14 @@ export function parsePositiveIntFlag(raw, flagName = "--limit") {
     const trimmed = raw.trim();
     if (!trimmed)
         return undefined;
+    // Strict digits, matching parseNonNegativeIntFlag below. parseInt stops at the
+    // first non-digit, so "10x" silently became 10, "3.5" became 3, and
+    // "5 apples" became 5 — accepted rather than rejected as invalid.
+    if (!/^\d+$/.test(trimmed)) {
+        throw new UsageError(`Invalid ${flagName} value: "${raw}". Must be a positive integer.`, "INVALID_FLAG_VALUE");
+    }
     const parsed = parseInt(trimmed, 10);
-    if (Number.isNaN(parsed) || parsed <= 0) {
+    if (parsed <= 0) {
         throw new UsageError(`Invalid ${flagName} value: "${raw}". Must be a positive integer.`, "INVALID_FLAG_VALUE");
     }
     return parsed;

package/dist/commands/env/child-env.js

@@ -1,6 +1,7 @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
+import { WIN32_SPAWN_ENV_FLOOR } from "../../core/spawn-env.js";
 const CLEAN_ENV_ALLOWLIST = [
     "HOME",
     "PATH",
@@ -38,6 +39,19 @@ export function buildChildEnv(parentEnv, options) {
             if (parentEnv[key] !== undefined)
                 base[key] = parentEnv[key];
         }
+        // The allowlist above is POSIX-shaped. On Windows a child started without
+        // SystemRoot/COMSPEC/PATHEXT and friends frequently cannot start at all —
+        // which is why every other spawn path in the codebase applies this floor
+        // (see spawnEnvNamesFor). `env run --clean` / `secret run --clean` did not,
+        // so clean-mode injection was unusable there. The floor is names the OS
+        // requires of any child, not user configuration, so it does not weaken what
+        // "clean" means about inherited secrets.
+        if (process.platform === "win32") {
+            for (const key of WIN32_SPAWN_ENV_FLOOR) {
+                if (parentEnv[key] !== undefined)
+                    base[key] = parentEnv[key];
+            }
+        }
     }
     for (const key of options.inherit) {
         if (parentEnv[key] !== undefined)

package/dist/commands/improve/eval-cases.js

@@ -4,6 +4,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { writeFileAtomic } from "../../core/common.js";
+import { recordWrittenPath } from "../../core/write-provenance.js";
 export function writeEvalCase(stashDir, evalCase) {
     const evalDir = path.join(stashDir, ".akm", "eval-cases");
     fs.mkdirSync(evalDir, { recursive: true });
@@ -28,6 +29,7 @@ Use it as a regression test: future improve runs on this ref should not produce
 output that would be rejected for the same reason.
 `;
     writeFileAtomic(filePath, content);
+    recordWrittenPath(filePath);
     return filePath;
 }
 export function countEvalCases(stashDir) {

package/dist/commands/improve/memory/memory-improve.js

@@ -543,6 +543,7 @@ function appendBeliefStateTransitionLog(stashDir, transitions) {
     }))
         .join("\n");
     fs.appendFileSync(logPath, `${lines}\n`, "utf8");
+    recordWrittenPath(logPath);
     return logPath;
 }
 function priorBeliefStateForArchive(candidate) {

package/dist/commands/lint/index.js

@@ -502,7 +502,11 @@ function lintAkmSweep(stashRoot, extraStashRoots, cfg, sources, options) {
         }
         for (const filePath of assetFiles) {
             // Skip registry-cached read-only files — --fix must not mutate them.
-            if (filePath.includes("/.cache/") || filePath.includes("/registry/"))
+            // Compare on a separator-normalized copy: on Windows these paths carry
+            // backslashes, so the forward-slash substring never matched and --fix
+            // rewrote files inside the registry cache.
+            const posixPath = filePath.replace(/\\/g, "/");
+            if (posixPath.includes("/.cache/") || posixPath.includes("/registry/"))
                 continue;
             const relPath = path.relative(stashRoot, filePath);
             let raw;

package/dist/commands/sources/add-cli.js

@@ -10,6 +10,7 @@ import { decideDangerousKeyInstall } from "../../core/activation-policy.js";
 import { UsageError } from "../../core/errors.js";
 import { appendEvent } from "../../core/events.js";
 import { warn } from "../../core/warn.js";
+import { sanitizeString } from "../../sources/providers/provider-utils.js";
 import { akmRemove } from "./installed-stashes.js";
 import { akmAdd } from "./source-add.js";
 import { addStash } from "./source-manage.js";
@@ -180,9 +181,14 @@ export async function auditInstalledStashForDangerousKeys(opts) {
             groupedByEnv.set(f.envRef, existing);
         }
         for (const [envRef, keys] of groupedByEnv) {
-            warn(`[warn] Env "${envRef}" in stash "${stashLabel}" contains potentially dangerous keys:`);
+            // envRef and keys come from filenames and KEY names inside a downloaded or
+            // cloned bundle, i.e. attacker-controllable. Tar validation rejects NUL but
+            // not ESC/CSI, and git checkout allows them in filenames on Linux/macOS —
+            // so printing them raw let a crafted bundle rewrite this security prompt
+            // with terminal escapes right before an "Install anyway?" confirmation.
+            warn(`[warn] Env "${sanitizeString(envRef)}" in stash "${sanitizeString(stashLabel)}" contains potentially dangerous keys:`);
             for (const key of keys) {
-                warn(`  - ${key}: can hijack process execution via \`akm env run\``);
+                warn(`  - ${sanitizeString(key)}: can hijack process execution via \`akm env run\``);
             }
         }
         const confirmed = await p.confirm({

package/dist/commands/sources/migration-help.js

@@ -3,6 +3,7 @@
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import fs from "node:fs";
 import path from "node:path";
+import embeddedChangelog from "../../../CHANGELOG.md" with { type: "text" };
 import { getDirname } from "../../runtime.js";
 const CHANGELOG_URL = "https://github.com/itlackey/akm/blob/main/CHANGELOG.md";
 const MIGRATION_DOC_URL = "https://github.com/itlackey/akm/blob/main/docs/migration/v0.5-to-v0.6.md";
@@ -24,9 +25,13 @@ function loadChangelog() {
         }
     }
     catch {
-        // fall through to bundled notes
+        // fall through to the embedded copy
     }
-    return undefined;
+    // In the `bun build --compile` standalone binary, import.meta.url points into
+    // the virtual /$bunfs tree and every existsSync above misses, so `akm help
+    // migrate <version>` degraded to the generic "no dedicated note" message for
+    // EVERY version. Only assets imported `with { type: "text" }` are embedded.
+    return embeddedChangelog.length > 0 ? embeddedChangelog : undefined;
 }
 /**
  * Load the bundled migration note for a specific version, if one exists.
@@ -87,7 +92,11 @@ function resolveLatestVersion(changelog) {
     return undefined;
 }
 function extractChangelogSection(changelog, version) {
-    const pattern = new RegExp(`^## \\[${escapeRegexString(version)}\\][^\\n]*\\n([\\s\\S]*?)(?=^## \\[|\\Z)`, "m");
+    // `\Z` is not a JavaScript anchor — it matches a literal "Z", which truncated
+    // the section at the first capital Z in the body (and failed outright for the
+    // last entry). `$` with the `m` flag would stop at the first line end, so the
+    // end-of-input alternative has to be an explicit lookahead for the input end.
+    const pattern = new RegExp(`^## \\[${escapeRegexString(version)}\\][^\\n]*\\n([\\s\\S]*?)(?=^## \\[|$(?![\\s\\S]))`, "m");
     const match = changelog.match(pattern);
     if (!match)
         return undefined;

package/dist/commands/sources/self-update.js

@@ -10,6 +10,7 @@ import { ConfigError } from "../../core/errors.js";
 import { warn } from "../../core/warn.js";
 import { githubHeaders } from "../../integrations/github.js";
 import { getDirname, mainPath, semverOrder } from "../../runtime.js";
+import { resolveAkmInvocation } from "../../tasks/resolve-akm-bin.js";
 const REPO = "itlackey/akm";
 const DEFAULT_PACKAGE_NAME = "akm-cli";
 const NODE_MODULES_SEGMENT = "/node_modules/";
@@ -474,7 +475,14 @@ function readInstalledCliVersion(akmBin) {
     return match?.[0];
 }
 function runRequiredCommand(akmBin, args, label) {
-    const result = childProcess.spawnSync(akmBin, args, {
+    // A bare "akm" is not spawnable on Windows: npm/pnpm/yarn install a global CLI
+    // as akm.cmd / akm.ps1 shims, and spawnSync without a shell does not apply
+    // PATHEXT — so the package-manager upgrade arm died with ENOENT before it ever
+    // ran. resolveAkmInvocation returns a concrete argv (launcher, runtime + main
+    // script, or a standalone binary) for however this install actually runs.
+    // An explicit path (the standalone arm passes one) is used as given.
+    const [command, ...prefixArgs] = path.isAbsolute(akmBin) ? [akmBin] : resolveAkmInvocation().argv;
+    const result = childProcess.spawnSync(command ?? akmBin, [...prefixArgs, ...args], {
         encoding: "utf8",
         env: process.env,
         stdio: "pipe",

package/dist/core/adapter/adapters/agent-skills-adapter.js

@@ -138,13 +138,25 @@ function skillFieldDiagnostics(relPath, dirName, data) {
  * sweep into a full recursive walk.
  */
 const MAX_PACKAGE_PROBE_DEPTH = 3;
-/** True when `SKILL.md` exists at `dir` or anywhere within {@link MAX_PACKAGE_PROBE_DEPTH} below it. */
-async function subtreeHasManifest(dir, entries, ctx, depth) {
+function missingManifestDiagnostic(dir) {
+    return { file: dir, issue: "missing-skill-md", detail: `no SKILL.md in ${dir}/`, fixed: false };
+}
+/**
+ * Classify one directory as a package, a grouping directory, or one broken
+ * package candidate. Once a real package root is found, its resource
+ * directories are never descended into. If manifests exist only below this
+ * directory, it is a group and each sibling candidate is checked independently.
+ */
+async function scanPackageCandidate(dir, entries, ctx, depth) {
     if (entries.includes(SKILL_MANIFEST))
-        return true;
-    if (depth >= MAX_PACKAGE_PROBE_DEPTH)
-        return false;
+        return { containsManifest: true, diagnostics: [] };
+    if (depth >= MAX_PACKAGE_PROBE_DEPTH) {
+        return { containsManifest: false, diagnostics: [missingManifestDiagnostic(dir)] };
+    }
+    const children = [];
     for (const entry of entries) {
+        if (entry.startsWith("."))
+            continue;
         const child = `${dir}/${entry}`;
         // `list` on a FILE yields `[]` (the read throws and is swallowed), so an
         // empty listing is the "not a directory worth descending" signal — no
@@ -152,10 +164,17 @@ async function subtreeHasManifest(dir, entries, ctx, depth) {
         const childEntries = await ctx.list(child);
         if (childEntries.length === 0)
             continue;
-        if (await subtreeHasManifest(child, childEntries, ctx, depth + 1))
-            return true;
+        children.push(await scanPackageCandidate(child, childEntries, ctx, depth + 1));
+    }
+    if (children.some((child) => child.containsManifest)) {
+        return {
+            containsManifest: true,
+            diagnostics: children.flatMap((child) => child.diagnostics),
+        };
     }
-    return false;
+    // No descendant establishes this as a grouping directory. Diagnose the
+    // candidate itself, not its resource subdirectories.
+    return { containsManifest: false, diagnostics: [missingManifestDiagnostic(dir)] };
 }
 /**
  * The directory-level `missing-skill-md` check (issue #774).
@@ -167,11 +186,10 @@ async function subtreeHasManifest(dir, entries, ctx, depth) {
  * component root through {@link ValidateContext.list} instead, so the case is
  * actually reported.
  *
- * Deliberately TOP-LEVEL only: a package's own resource dirs
- * (`pdf-processing/reference/`) are part of the item, not candidate packages,
- * and flagging them would turn every conformant bundle red. A top-level dir
- * that holds a manifest ANYWHERE beneath it is a grouping dir, not a broken
- * package, so it is left alone too.
+ * A package's own resource dirs (`pdf-processing/reference/`) are part of the
+ * item, not candidate packages. Grouping directories are supported too, but
+ * their children are classified independently so one valid package cannot hide
+ * a manifest-less sibling.
  */
 async function missingManifestDiagnostics(ctx) {
     const diagnostics = [];
@@ -181,9 +199,7 @@ async function missingManifestDiagnostics(ctx) {
         const entries = await ctx.list(name);
         if (entries.length === 0)
             continue; // a root file (README.md), or an untrackable empty dir
-        if (await subtreeHasManifest(name, entries, ctx, 1))
-            continue;
-        diagnostics.push({ file: name, issue: "missing-skill-md", detail: `no SKILL.md in ${name}/`, fixed: false });
+        diagnostics.push(...(await scanPackageCandidate(name, entries, ctx, 1)).diagnostics);
     }
     return diagnostics;
 }

package/dist/core/adapter/adapters/akm-lint.js

@@ -52,7 +52,7 @@
  */
 import path from "node:path";
 import { isDangerousEnvKey } from "../../../commands/lint/env-key-rules.js";
-import { taskFieldProblems } from "../../../tasks/schema.js";
+import { isPresentTarget, taskFieldProblems } from "../../../tasks/schema.js";
 import { compileWorkflowPlan } from "../../../workflows/ir/compile.js";
 import { parseWorkflow } from "../../../workflows/parser.js";
 import { conceptIdForStashFile } from "../../asset/resolve-ref.js";
@@ -283,7 +283,11 @@ export function taskDiagnostics(relPath, data) {
     if (data === null || Object.keys(data).length === 0)
         return [];
     const missing = taskFieldProblems(data);
-    const hasTarget = "prompt" in data || "workflow" in data || "command" in data;
+    // Presence, matching the runtime parser's rule (src/tasks/parser.ts): an
+    // empty string is NOT a target there, so a `workflow: ""` that linted clean
+    // here failed at run time with MISSING_REQUIRED_ARGUMENT — a file the linter
+    // called valid but that could never run.
+    const hasTarget = ["prompt", "workflow", "command"].some((key) => isPresentTarget(data[key]));
     if (!hasTarget)
         missing.push("prompt, workflow, or command");
     if (missing.length > 0) {

package/dist/core/adapter/adapters/akm-task-adapter.js

@@ -30,7 +30,7 @@
  */
 import fs from "node:fs";
 import path from "node:path";
-import { parseTaskYaml, TASK_EXTENSION, TASK_NEAR_MISS_EXTENSION, taskExtensionDetail, taskFieldProblems, taskYamlParseDetail, } from "../../../tasks/schema.js";
+import { isPresentTarget, parseTaskYaml, TASK_EXTENSION, TASK_NEAR_MISS_EXTENSION, taskExtensionDetail, taskFieldProblems, taskYamlParseDetail, } from "../../../tasks/schema.js";
 import { hashContent } from "./shared.js";
 /** A native task bundle is single-component; its one component is `main`. */
 const COMPONENT_ID = "main";
@@ -71,7 +71,9 @@ function taskDiagnostics(relPath, data) {
     if (Object.keys(data).length === 0)
         return [];
     const problems = taskFieldProblems(data);
-    const targets = TARGET_KEYS.filter((k) => k in data && data[k] !== undefined && data[k] !== null);
+    // Shared presence rule (src/tasks/schema.ts): an empty string or empty array
+    // is not a target, matching the runtime parser.
+    const targets = TARGET_KEYS.filter((k) => isPresentTarget(data[k]));
     if (targets.length === 0)
         problems.push("exactly one target (prompt, workflow, or command)");
     else if (targets.length > 1)

package/dist/core/adapter/adapters/dotenv-adapter.js

@@ -61,6 +61,25 @@ function classify(relPath) {
     }
     return null;
 }
+/**
+ * True when `--sensitive` marked this asset, via the sibling marker file that
+ * `akm env create --sensitive` / `akm secret create --sensitive` writes:
+ * `env/<name>.sensitive` for `env/<name>.env`, `secrets/<name>.sensitive` for
+ * `secrets/<name>`.
+ *
+ * The flag documents itself as excluding the asset from BOTH `env list` output
+ * and the search index. Indexing filters are adapter-owned (the walk no longer
+ * pre-filters), and the akm adapter abstains on the marker — but this adapter
+ * only skipped files whose OWN name ended in `.sensitive`. A dotenv bundle is a
+ * legal env/secret write target, so a marked `env/prod.env` there was still
+ * indexed with every KEY NAME as a hint and a marked secret still indexed by
+ * name, while `env list` / `secret list` correctly hid them. The two surfaces
+ * disagreed about a documented promise.
+ */
+function hasSensitiveMarker(absPath, type) {
+    const marker = type === "env" ? absPath.replace(/\.env$/i, ".sensitive") : `${absPath}.sensitive`;
+    return marker !== absPath && fs.existsSync(marker);
+}
 /** Extract KEY NAMES (never values) from an env file's raw content, first-appearance order, deduped. */
 function scanKeyNames(raw) {
     const keys = [];
@@ -81,6 +100,8 @@ function recognize(c, file) {
     const type = classify(file.relPath);
     if (type === null)
         return null;
+    if (hasSensitiveMarker(file.absPath, type))
+        return null;
     const posix = toPosix(file.relPath);
     const raw = file.content();
     if (type === "env") {

package/dist/core/asset/frontmatter.js

@@ -10,6 +10,7 @@
  */
 import fs from "node:fs";
 import { parse as yamlParse, stringify as yamlStringify } from "yaml";
+import { existingFileMode, writeFileAtomic } from "../common.js";
 import { recordWrittenPath } from "../write-provenance.js";
 import { assembleAsset, serializeFrontmatter } from "./asset-serialize.js";
 /**
@@ -143,7 +144,11 @@ export function mutateFrontmatter(filePath, mutator) {
     const next = parsed.frontmatter !== null
         ? `---\n${serializeFrontmatter(nextFrontmatter)}\n---\n${parsed.content}`
         : assembleAsset(nextFrontmatter, parsed.content);
-    fs.writeFileSync(filePath, next, "utf8");
+    // Atomic, like the canonical asset write: this rewrites a file the user
+    // authored, and a truncate-in-place left a window where a crash or a
+    // concurrent reader saw a half-written or empty asset. The existing mode is
+    // preserved so stamping frontmatter never changes an asset's permissions.
+    writeFileAtomic(filePath, next, existingFileMode(filePath));
     // #652: in-place frontmatter stamps (belief state, contradiction markers,
     // salience) are real asset mutations — journal them for the run's sync.
     recordWrittenPath(filePath);

package/dist/core/common.js

@@ -83,6 +83,75 @@ export function readTextFileWithLimit(filePath, maxBytes, label = "File") {
  *      don't fail on those mounts. Windows does not support opening a
  *      directory for fsync, so the directory-sync step is skipped there.
  */
+/**
+ * Strip JavaScript-style comments from a JSON string (JSONC support).
+ * Handles `//` line comments and `/* *​/` block comments while preserving
+ * comment-like sequences inside quoted strings.
+ */
+export function stripJsonComments(text) {
+    let result = "";
+    let i = 0;
+    let inString = false;
+    while (i < text.length) {
+        if (inString) {
+            if (text[i] === "\\") {
+                result += text[i] + (text[i + 1] ?? "");
+                i += 2;
+                continue;
+            }
+            if (text[i] === '"') {
+                inString = false;
+            }
+            result += text[i];
+            i++;
+            continue;
+        }
+        if (text[i] === '"') {
+            inString = true;
+            result += text[i];
+            i++;
+            continue;
+        }
+        if (text[i] === "/" && text[i + 1] === "/") {
+            while (i < text.length && text[i] !== "\n")
+                i++;
+            continue;
+        }
+        if (text[i] === "/" && text[i + 1] === "*") {
+            i += 2;
+            while (i < text.length && !(text[i] === "*" && text[i + 1] === "/"))
+                i++;
+            i += 2;
+            continue;
+        }
+        result += text[i];
+        i++;
+    }
+    return result;
+}
+/**
+ * The mode to rewrite an existing USER-owned file with.
+ *
+ * {@link writeFileAtomic} creates its temp file with an explicit mode and
+ * chmods it, so it needs one — and its 0600 default is right for akm's own
+ * state but wrong for a user's asset, where rewriting must never change
+ * permissions. Returns the file's current mode, or the umask-derived default
+ * `fs.writeFileSync` would have produced for a new file.
+ */
+export function existingFileMode(filePath) {
+    try {
+        return fs.statSync(filePath).mode & 0o777;
+    }
+    catch {
+        // Absent (a new asset) or unreadable: fall back to the default create mode.
+        try {
+            return 0o666 & ~process.umask();
+        }
+        catch {
+            return 0o644;
+        }
+    }
+}
 export function writeFileAtomic(target, content, mode) {
     const tmp = `${target}.tmp.${process.pid}.${crypto.randomBytes(8).toString("hex")}`;
     const data = typeof content === "string" ? Buffer.from(content) : content;
@@ -226,7 +295,11 @@ function readStashDirFromConfig() {
     try {
         const configPath = getConfigPath();
         const text = readTextFileWithLimit(configPath, MAX_CONFIG_FILE_BYTES, "Config file");
-        const raw = JSON.parse(text);
+        // The config loader accepts JSONC, so a commented config.json is valid and
+        // in use. Parsing it raw here threw, the catch swallowed it, and every
+        // caller silently fell back — operating on the wrong bundle or failing with
+        // STASH_DIR_NOT_FOUND despite a perfectly good config.
+        const raw = JSON.parse(stripJsonComments(text));
         if (typeof raw !== "object" || raw === null)
             return undefined;
         // 0.9.0 config-shape cutover (spec §10.1): the primary stash is the
@@ -778,14 +851,19 @@ export function stringArray(value) {
  * Return true if a process with the given PID is currently alive.
  * Uses `process.kill(pid, 0)` which does not deliver a signal but
  * throws ESRCH when the process does not exist.
+ *
+ * EPERM means the process EXISTS but belongs to another uid, so it must be
+ * reported alive. Treating it as dead let a lock held by a live process in a
+ * shared data dir (agent sandboxes, containers, service accounts — a
+ * configuration managed-db.ts explicitly supports) be reclaimed as stale.
  */
 export function isProcessAlive(pid) {
     try {
         process.kill(pid, 0);
         return true;
     }
-    catch {
-        return false;
+    catch (err) {
+        return err?.code === "EPERM";
     }
 }
 /**

package/dist/core/config/config-io.js

@@ -15,7 +15,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { sleepSync } from "../../runtime.js";
-import { MAX_CONFIG_FILE_BYTES, readTextFileWithLimit, writeFileAtomic } from "../common.js";
+import { MAX_CONFIG_FILE_BYTES, readTextFileWithLimit, stripJsonComments, writeFileAtomic } from "../common.js";
 import { ConfigError } from "../errors.js";
 import { createLockPayload, probeLock, reclaimStaleLock, releaseLock, tryAcquireLockSync } from "../file-lock.js";
 import { getCacheDir, getConfigDir } from "../paths.js";
@@ -233,48 +233,8 @@ export function withConfigLock(fn) {
     }
 }
 /**
- * Strip JavaScript-style comments from a JSON string (JSONC support).
- * Handles `//` line comments and `/* *​/` block comments while preserving
- * comment-like sequences inside quoted strings.
+ * Re-exported from core/common.ts, where it now lives so `resolveStashDir`
+ * can strip comments too without importing this module (common cannot depend
+ * on config-io — config-io already depends on common).
  */
-export function stripJsonComments(text) {
-    let result = "";
-    let i = 0;
-    let inString = false;
-    while (i < text.length) {
-        if (inString) {
-            if (text[i] === "\\") {
-                result += text[i] + (text[i + 1] ?? "");
-                i += 2;
-                continue;
-            }
-            if (text[i] === '"') {
-                inString = false;
-            }
-            result += text[i];
-            i++;
-            continue;
-        }
-        if (text[i] === '"') {
-            inString = true;
-            result += text[i];
-            i++;
-            continue;
-        }
-        if (text[i] === "/" && text[i + 1] === "/") {
-            while (i < text.length && text[i] !== "\n")
-                i++;
-            continue;
-        }
-        if (text[i] === "/" && text[i + 1] === "*") {
-            i += 2;
-            while (i < text.length && !(text[i] === "*" && text[i + 1] === "/"))
-                i++;
-            i += 2;
-            continue;
-        }
-        result += text[i];
-        i++;
-    }
-    return result;
-}
+export { stripJsonComments } from "../common.js";

package/dist/core/config/schema/engines.js

@@ -14,7 +14,18 @@ import { z } from "zod";
 // `typeof import("./config-schema")` — routing through config-types would mint
 // a config-schema ↔ config-types type cycle that collapses inference.
 import { HARNESS_AGENT_DISPATCH_IDS, VALID_HARNESS_IDS } from "../../../integrations/harnesses/ids.js";
+import { WORKFLOW_MAX_TIMEOUT_MS } from "../../../workflows/resource-limits.js";
 import { chatCompletionsEndpoint, ENV_REFERENCE_PATTERN, ExtraParamsSchema, engineName, LlmCapabilitiesSchema, ModelAliasMapSchema, nonEmptyString, positiveInt, } from "./primitives.js";
+/**
+ * Engine-config timeouts share the workflow ceiling.
+ *
+ * 0.9.1 bounded workflow-authored timeouts (parser) and frozen invocations
+ * (decoder) at 2^31-1, but the third source — `engines.<name>.timeoutMs` — was
+ * validated only as a positive integer. A larger value passed config validation
+ * and then failed EVERY run of that engine with an unlocated "Invalid frozen
+ * workflow plan: invocation is invalid". Reject it where the value is written.
+ */
+const timeoutMsField = z.union([positiveInt.max(WORKFLOW_MAX_TIMEOUT_MS), z.null()]).optional();
 // ── Connection configs (LLM) ────────────────────────────────────────────────
 /**
  * OpenAI-compatible connection fields shared by named LLM engines and bounded
@@ -32,7 +43,7 @@ export const LlmConnectionConfigSchema = z
     apiKey: z.string().optional(),
     temperature: z.number().finite().optional(),
     maxTokens: positiveInt.optional(),
-    timeoutMs: z.union([positiveInt, z.null()]).optional(),
+    timeoutMs: timeoutMsField,
     concurrency: positiveInt.optional(),
     capabilities: LlmCapabilitiesSchema.optional(),
     extraParams: ExtraParamsSchema.optional(),
@@ -56,7 +67,7 @@ const LlmEngineSchema = z
     apiKey: z.string().regex(ENV_REFERENCE_PATTERN, `apiKey must be $VAR or \${VAR}`).optional(),
     temperature: z.number().finite().optional(),
     maxTokens: positiveInt.optional(),
-    timeoutMs: z.union([positiveInt, z.null()]).optional(),
+    timeoutMs: timeoutMsField,
     concurrency: positiveInt.optional(),
     supportsJsonSchema: z.boolean().optional(),
     extraParams: ExtraParamsSchema.optional(),
@@ -80,7 +91,7 @@ const AgentEngineSchema = z
     args: z.array(z.string()).optional(),
     workspace: nonEmptyString.optional(),
     model: nonEmptyString.optional(),
-    timeoutMs: z.union([positiveInt, z.null()]).optional(),
+    timeoutMs: timeoutMsField,
     modelAliases: ModelAliasMapSchema.optional(),
     llmEngine: engineName.optional(),
 })

package/dist/core/extra-params.js

@@ -33,8 +33,16 @@ export function validateExtraParams(value) {
         return [{ path: [], message: "must be an object" }];
     }
     const issues = [];
+    // A self-referential YAML anchor (`extraParams: &a { nested: *a }`) resolves
+    // to a genuinely cyclic object — the yaml package's alias-count guard does not
+    // catch cycles — so an unguarded walk overflowed the stack with a RangeError
+    // that escaped task parsing. Track visited containers and stop at a revisit.
+    const seen = new WeakSet();
     const visit = (entry, path) => {
         if (Array.isArray(entry)) {
+            if (seen.has(entry))
+                return;
+            seen.add(entry);
             entry.forEach((child, index) => {
                 visit(child, [...path, index]);
             });
@@ -42,6 +50,9 @@ export function validateExtraParams(value) {
         }
         if (!entry || typeof entry !== "object")
             return;
+        if (seen.has(entry))
+            return;
+        seen.add(entry);
         for (const [key, child] of Object.entries(entry)) {
             const normalized = normalizeExtraParamKey(key);
             if (path.length === 0 && PROTECTED_TOP_LEVEL_KEYS.has(normalized)) {