akm-cli 0.9.1-beta.1 → 0.9.1-beta.2

package/dist/scripts/akm-migrate.js

@@ -7075,6 +7075,7 @@ var init_platform = __esm(() => {
 });
 
 // src/core/paths.ts
+import os from "os";
 import path from "path";
 function isUnderBunTest(env) {
   return env.BUN_TEST === "1" || env.NODE_ENV === "test";
@@ -7153,9 +7154,13 @@ function getCacheDir(env = process.env) {
   }
   const home = env.HOME?.trim();
   if (!home)
-    return path.join("/tmp", "akm-cache");
+    return homelessFallbackDir("akm-cache");
   return path.join(home, ".cache", "akm");
 }
+function homelessFallbackDir(kind) {
+  const uid = typeof process.getuid === "function" ? process.getuid() : undefined;
+  return path.join(os.tmpdir(), uid === undefined ? kind : `${kind}-${uid}`);
+}
 function getDataDir(env = process.env, platform = process.platform) {
   const override = env.AKM_DATA_DIR?.trim();
   if (override)
@@ -7181,7 +7186,7 @@ function getDataDir(env = process.env, platform = process.platform) {
     return path.join(xdgDataHome, "akm");
   const home = env.HOME?.trim();
   if (!home)
-    return path.join("/tmp", "akm-data");
+    return homelessFallbackDir("akm-data");
   return path.join(home, ".local", "share", "akm");
 }
 function getDbPath(env = process.env) {
@@ -7261,6 +7266,59 @@ function readTextFileWithLimit(filePath, maxBytes, label = "File") {
     fs.closeSync(fd);
   }
 }
+function stripJsonComments(text) {
+  let result = "";
+  let i = 0;
+  let inString = false;
+  while (i < text.length) {
+    if (inString) {
+      if (text[i] === "\\") {
+        result += text[i] + (text[i + 1] ?? "");
+        i += 2;
+        continue;
+      }
+      if (text[i] === '"') {
+        inString = false;
+      }
+      result += text[i];
+      i++;
+      continue;
+    }
+    if (text[i] === '"') {
+      inString = true;
+      result += text[i];
+      i++;
+      continue;
+    }
+    if (text[i] === "/" && text[i + 1] === "/") {
+      while (i < text.length && text[i] !== `
+`)
+        i++;
+      continue;
+    }
+    if (text[i] === "/" && text[i + 1] === "*") {
+      i += 2;
+      while (i < text.length && !(text[i] === "*" && text[i + 1] === "/"))
+        i++;
+      i += 2;
+      continue;
+    }
+    result += text[i];
+    i++;
+  }
+  return result;
+}
+function existingFileMode(filePath) {
+  try {
+    return fs.statSync(filePath).mode & 511;
+  } catch {
+    try {
+      return 438 & ~process.umask();
+    } catch {
+      return 420;
+    }
+  }
+}
 function writeFileAtomic(target, content, mode) {
   const tmp = `${target}.tmp.${process.pid}.${crypto.randomBytes(8).toString("hex")}`;
   const data = typeof content === "string" ? Buffer.from(content) : content;
@@ -7373,7 +7431,7 @@ function readStashDirFromConfig() {
   try {
     const configPath = getConfigPath();
     const text = readTextFileWithLimit(configPath, MAX_CONFIG_FILE_BYTES, "Config file");
-    const raw = JSON.parse(text);
+    const raw = JSON.parse(stripJsonComments(text));
     if (typeof raw !== "object" || raw === null)
       return;
     const bundles = raw.bundles;
@@ -7662,8 +7720,8 @@ function isProcessAlive(pid) {
   try {
     process.kill(pid, 0);
     return true;
-  } catch {
-    return false;
+  } catch (err) {
+    return err?.code === "EPERM";
   }
 }
 var MAX_CONFIG_FILE_BYTES, MAX_LOCAL_METADATA_BYTES, MAX_LOCK_METADATA_BYTES, DEFAULT_RESPONSE_BYTE_CAP, ResponseTooLargeError, BodyReadTimeoutError;
@@ -7828,7 +7886,7 @@ var init_runtime = __esm(() => {
 var require_main = __commonJS((exports, module) => {
   var fs3 = __require("fs");
   var path7 = __require("path");
-  var os = __require("os");
+  var os2 = __require("os");
   var crypto2 = __require("crypto");
   var TIPS = [
     "\u25C8 encrypted .env [www.dotenvx.com]",
@@ -7976,7 +8034,7 @@ var require_main = __commonJS((exports, module) => {
     return null;
   }
   function _resolveHome(envPath) {
-    return envPath[0] === "~" ? path7.join(os.homedir(), envPath.slice(1)) : envPath;
+    return envPath[0] === "~" ? path7.join(os2.homedir(), envPath.slice(1)) : envPath;
   }
   function _configVault(options) {
     const debug = parseBoolean(process.env.DOTENV_CONFIG_DEBUG || options && options.debug);
@@ -8288,21 +8346,32 @@ function loadBunSqlite() {
   }
   return bunSqliteModule;
 }
+function abiMismatchRemedy(message) {
+  const ABI_MISMATCH_SHAPES = [
+    "did not self-register",
+    "NODE_MODULE_VERSION",
+    "was compiled against a different",
+    "invalid ELF header"
+  ];
+  if (!ABI_MISMATCH_SHAPES.some((shape) => message.includes(shape)))
+    return;
+  return `akm could not load 'better-sqlite3': its native binding was built for a different
+` + `Node.js version than the one now running (this Node is ABI ${process.versions.modules}).
+` + `This is what happens when Node is upgraded after akm is installed. It is NOT a
+` + `broken install, and reinstalling akm is not required.
+` + `  Fix: npm rebuild better-sqlite3        # in akm's install directory
+` + `  Or:  npm install -g akm-cli            # reinstall, rebuilding against this Node
+` + "  Or:  run akm under Bun, whose built-in SQLite driver needs no native binding.";
+}
 function loadBetterSqlite3() {
   if (!betterSqlite3Ctor) {
     let mod;
     try {
       mod = nodeRequire2("better-sqlite3");
     } catch (err) {
-      throw new Error(`akm could not load 'better-sqlite3', the SQLite driver it needs on Node.js.
-` + `  \u2022 If the error below says the module was compiled against a DIFFERENT Node.js
-` + `    version, you upgraded Node after installing akm. Reinstall akm (or run
-` + "    `npm rebuild better-sqlite3` in its install directory) so the binding is\n" + `    rebuilt for the Node you are now running. This is the common case after a
-` + `    Node major upgrade, and it is NOT a broken install.
-` + `  \u2022 Otherwise, reinstall akm with a working C/C++ build toolchain so its optional
-` + "    'better-sqlite3' native binding rebuilds (a global `npm i -g better-sqlite3`\n" + `    will NOT be resolved \u2014 Node loads it from akm's own node_modules).
-` + `  \u2022 Or run akm under Bun, which has a built-in SQLite driver and needs no native build.
-` + `  Underlying load error: ${err instanceof Error ? err.message : String(err)}`);
+      const raw = err instanceof Error ? err.message : String(err);
+      throw new Error(`${abiMismatchRemedy(raw) ?? MISSING_BINDING_REMEDY}
+  Underlying load error: ${raw}`);
     }
     betterSqlite3Ctor = mod.default ?? mod;
   }
@@ -8315,11 +8384,22 @@ function openNodeDatabase(path10, opts) {
     options.readonly = opts.readonly;
   if (opts?.create === false)
     options.fileMustExist = true;
-  const db = opts ? new BetterSqlite3(path10, options) : new BetterSqlite3(path10);
+  let db;
+  try {
+    db = opts ? new BetterSqlite3(path10, options) : new BetterSqlite3(path10);
+  } catch (err) {
+    const raw = err instanceof Error ? err.message : String(err);
+    const remedy = abiMismatchRemedy(raw);
+    if (!remedy)
+      throw err;
+    throw new Error(`${remedy}
+  Underlying error: ${raw}`);
+  }
   return {
     prepare: db.prepare.bind(db),
     exec: db.exec.bind(db),
     run: (sql, ...params) => db.prepare(sql).run(...params),
+    loadExtension: db.loadExtension.bind(db),
     transaction: db.transaction.bind(db),
     get inTransaction() {
       return db.inTransaction;
@@ -8327,7 +8407,7 @@ function openNodeDatabase(path10, opts) {
     close: db.close.bind(db)
   };
 }
-var isBun2, nodeRequire2, bunSqliteProvider, nodeSqliteProvider, PROVIDERS, bunSqliteModule, betterSqlite3Ctor;
+var isBun2, nodeRequire2, bunSqliteProvider, nodeSqliteProvider, PROVIDERS, bunSqliteModule, betterSqlite3Ctor, MISSING_BINDING_REMEDY;
 var init_database = __esm(() => {
   isBun2 = !!process.versions?.bun;
   nodeRequire2 = createRequire2(import.meta.url);
@@ -8342,6 +8422,10 @@ var init_database = __esm(() => {
     open: openNodeDatabase
   };
   PROVIDERS = [bunSqliteProvider, nodeSqliteProvider];
+  MISSING_BINDING_REMEDY = `akm could not load 'better-sqlite3', the SQLite driver it needs on Node.js.
+` + `  \u2022 Reinstall akm with a working C/C++ build toolchain so its optional
+` + "    'better-sqlite3' native binding builds (a global `npm i -g better-sqlite3`\n" + `    will NOT be resolved \u2014 Node loads it from akm's own node_modules).
+` + "  \u2022 Or run akm under Bun, which has a built-in SQLite driver and needs no native build.";
 });
 
 // src/core/file-lock.ts
@@ -8760,12 +8844,43 @@ function runMigrations(db, migrations, opts) {
     if (applied.has(migration.id))
       continue;
     opts?.beforeMigration?.(migration);
-    db.transaction(() => {
+    withImmediateWriteLock(db, () => {
+      const already = db.prepare("SELECT 1 FROM schema_migrations WHERE id = ?").get(migration.id);
+      if (already)
+        return;
       db.exec(migration.up);
       db.prepare("INSERT INTO schema_migrations (id) VALUES (?)").run(migration.id);
-    })();
+    });
+    applied.add(migration.id);
+  }
+}
+function withImmediateWriteLock(db, fn) {
+  if (db.inTransaction) {
+    fn();
+    return;
+  }
+  let lastBeginErr;
+  for (let attempt = 1;attempt <= IMMEDIATE_LOCK_MAX_ATTEMPTS; attempt++) {
+    try {
+      db.exec("BEGIN IMMEDIATE");
+    } catch (err) {
+      lastBeginErr = err;
+      continue;
+    }
+    try {
+      fn();
+      db.exec("COMMIT");
+      return;
+    } catch (err) {
+      try {
+        db.exec("ROLLBACK");
+      } catch {}
+      throw err;
+    }
   }
+  throw lastBeginErr instanceof Error ? lastBeginErr : new Error(`could not acquire the migration write lock after ${IMMEDIATE_LOCK_MAX_ATTEMPTS} attempts`);
 }
+var IMMEDIATE_LOCK_MAX_ATTEMPTS = 5;
 
 // src/core/state/migrations.ts
 function runMigrations2(db, options) {
@@ -27019,7 +27134,7 @@ function applyStandardPragmas(db, opts = {}) {
       warnNetworkFallbackOnce(opts.dataDir);
     }
   }
-  db.exec("PRAGMA busy_timeout = 30000");
+  db.exec(`PRAGMA busy_timeout = ${SQLITE_BUSY_TIMEOUT_MS}`);
   db.exec(`PRAGMA journal_mode = ${mode}`);
   if (opts.foreignKeys !== false) {
     db.exec("PRAGMA foreign_keys = ON");
@@ -27035,7 +27150,7 @@ function warnNetworkFallbackOnce(dataDir) {
   warnedNetworkFallback = true;
   warn(`[akm] network filesystem detected at ${dataDir} \u2014 WAL unsupported, using DELETE journal mode`);
 }
-var VALID_MODES, warnedInvalid = false, warnedNetworkFallback = false, FS_MAGIC_NFS = 26985, FS_MAGIC_SMB = 20859, FS_MAGIC_CIFS = 4283649346, FS_MAGIC_SMB2 = 4266872130, FS_MAGIC_FUSE = 1702057286, NETWORK_FS_MAGICS;
+var VALID_MODES, warnedInvalid = false, warnedNetworkFallback = false, FS_MAGIC_NFS = 26985, FS_MAGIC_SMB = 20859, FS_MAGIC_CIFS = 4283649346, FS_MAGIC_SMB2 = 4266872130, FS_MAGIC_FUSE = 1702057286, NETWORK_FS_MAGICS, SQLITE_BUSY_TIMEOUT_MS = 30000;
 var init_sqlite_pragmas = __esm(() => {
   init_warn();
   init_runtime();
@@ -27128,6 +27243,7 @@ function openStateDatabase(dbPath) {
       exec: db.exec.bind(db),
       run: db.run.bind(db),
       transaction: db.transaction.bind(db),
+      loadExtension: db.loadExtension.bind(db),
       get inTransaction() {
         return db.inTransaction;
       },
@@ -27600,13 +27716,14 @@ function purgeEmbeddings(db, opts) {
   }
   setMeta(db, "hasEmbeddings", "0");
 }
-var vecStatus, VEC_DOCS_URL = "https://github.com/itlackey/akm/blob/main/docs/reference/configuration.md#sqlite-vec-extension", VEC_FALLBACK_THRESHOLD = 1e4, vecInitWarnedDbs;
+var vecStatus, vecTablePresent, VEC_DOCS_URL = "https://github.com/itlackey/akm/blob/main/docs/reference/configuration.md#sqlite-vec-extension", VEC_FALLBACK_THRESHOLD = 1e4, vecInitWarnedDbs;
 var init_index_vec_repository = __esm(() => {
   init_best_effort();
   init_warn();
   init_types();
   init_index_meta_repository();
   vecStatus = new WeakMap;
+  vecTablePresent = new WeakMap;
   vecInitWarnedDbs = new WeakSet;
 });
 
@@ -27897,8 +28014,13 @@ function ensureBundleRefColumns(db) {
   }, "entries table may not exist on a brand-new DB before CREATE \u2014 caller is responsible");
 }
 function ensureUniqueItemRefIndex(db) {
-  db.exec("DROP INDEX IF EXISTS idx_entries_item_ref");
-  db.exec("CREATE UNIQUE INDEX idx_entries_item_ref ON entries(item_ref)");
+  const existing = db.prepare("SELECT sql FROM sqlite_master WHERE type = 'index' AND name = 'idx_entries_item_ref'").get();
+  if (existing?.sql && /\bUNIQUE\b/i.test(existing.sql))
+    return;
+  db.transaction(() => {
+    db.exec("DROP INDEX IF EXISTS idx_entries_item_ref");
+    db.exec("CREATE UNIQUE INDEX IF NOT EXISTS idx_entries_item_ref ON entries(item_ref)");
+  })();
 }
 function tableExists2(db, name) {
   const row = db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name=? LIMIT 1").get(name);
@@ -28033,7 +28155,9 @@ function openReadonlyExistingDatabase(dbPath) {
   assertIndexPathReadable(resolvedPath);
   if (classifyPathAccess(resolvedPath).access === "absent")
     return;
-  return openDatabase(resolvedPath, { readonly: true, create: false });
+  const db = openDatabase(resolvedPath, { readonly: true, create: false });
+  db.exec(`PRAGMA busy_timeout = ${SQLITE_BUSY_TIMEOUT_MS}`);
+  return db;
 }
 function closeDatabase(db) {
   db.close();
@@ -28044,6 +28168,7 @@ var init_index_connection = __esm(() => {
   init_paths();
   init_database();
   init_managed_db();
+  init_sqlite_pragmas();
   init_index_schema();
   init_index_vec_repository();
 });
@@ -28405,7 +28530,7 @@ __export(exports_migrate_storage, {
   MIGRATIONS: () => MIGRATIONS
 });
 import fs46 from "fs";
-import os7 from "os";
+import os8 from "os";
 import path52 from "path";
 import readline from "readline";
 function parseFromArg(args) {
@@ -29230,8 +29355,8 @@ async function main(args = process.argv.slice(2)) {
 var MIGRATED_MARKER = ".migrated", dataDir, stateDir, cacheDir, configDir, stateDbPath, indexDbPath, PATHS, versionReports, v07To08Migration, v08To09Migration, MIGRATIONS;
 var init_migrate_storage = __esm(() => {
   init_paths();
-  dataDir = process.env.AKM_DATA_DIR?.trim() ?? (process.env.XDG_DATA_HOME?.trim() ? path52.join(process.env.XDG_DATA_HOME.trim(), "akm") : path52.join(os7.homedir(), ".local", "share", "akm"));
-  stateDir = process.env.AKM_STATE_DIR?.trim() ?? (process.env.XDG_STATE_HOME?.trim() ? path52.join(process.env.XDG_STATE_HOME.trim(), "akm") : path52.join(os7.homedir(), ".local", "state", "akm"));
+  dataDir = process.env.AKM_DATA_DIR?.trim() ?? (process.env.XDG_DATA_HOME?.trim() ? path52.join(process.env.XDG_DATA_HOME.trim(), "akm") : path52.join(os8.homedir(), ".local", "share", "akm"));
+  stateDir = process.env.AKM_STATE_DIR?.trim() ?? (process.env.XDG_STATE_HOME?.trim() ? path52.join(process.env.XDG_STATE_HOME.trim(), "akm") : path52.join(os8.homedir(), ".local", "state", "akm"));
   cacheDir = getCacheDir();
   configDir = getConfigDir();
   stateDbPath = path52.join(dataDir, "state.db");
@@ -29377,8 +29502,8 @@ function flattenForText(value, path, lines) {
 }
 
 // src/output/html-render.ts
-init_runtime();
 import path4 from "path";
+init_runtime();
 var TEMPLATES_DIR = path4.join(getDirname(import.meta.url), "../assets/templates/html");
 
 // src/output/command-registry.ts
@@ -31854,7 +31979,7 @@ init_errors();
 // scripts/akm-migrate/config-migrate.ts
 import { randomUUID as randomUUID5 } from "crypto";
 import fs43 from "fs";
-import os6 from "os";
+import os7 from "os";
 import path49 from "path";
 
 // src/core/adapter/adapters/akm-lint.ts
@@ -31993,6 +32118,15 @@ var TASK_EXTENSION = ".yml";
 var TASK_NEAR_MISS_EXTENSION = ".yaml";
 var TASK_MAX_TIMEOUT_MS = WORKFLOW_MAX_TIMEOUT_MS;
 var TASK_MAX_REDACT_NAMES = WORKFLOW_MAX_EXEC_PASS_ENV;
+function isPresentTarget(value) {
+  if (value === undefined || value === null)
+    return false;
+  if (typeof value === "string")
+    return value.trim() !== "";
+  if (Array.isArray(value))
+    return value.length > 0;
+  return true;
+}
 function taskFieldProblems(data) {
   const problems = [];
   if (data.version !== TASK_SCHEMA_VERSION)
@@ -32341,6 +32475,7 @@ function collectWorkflowWarnings(document) {
 
 // src/core/asset/frontmatter.ts
 import fs4 from "fs";
+init_common();
 
 // src/core/write-provenance.ts
 import path7 from "path";
@@ -32459,7 +32594,7 @@ function mutateFrontmatter(filePath, mutator) {
 ${serializeFrontmatter(nextFrontmatter)}
 ---
 ${parsed.content}` : assembleAsset(nextFrontmatter, parsed.content);
-  fs4.writeFileSync(filePath, next, "utf8");
+  writeFileAtomic(filePath, next, existingFileMode(filePath));
   recordWrittenPath(filePath);
   return true;
 }
@@ -32547,8 +32682,12 @@ function validateExtraParams(value) {
     return [{ path: [], message: "must be an object" }];
   }
   const issues = [];
+  const seen = new WeakSet;
   const visit2 = (entry, path8) => {
     if (Array.isArray(entry)) {
+      if (seen.has(entry))
+        return;
+      seen.add(entry);
       entry.forEach((child, index) => {
         visit2(child, [...path8, index]);
       });
@@ -32556,6 +32695,9 @@ function validateExtraParams(value) {
     }
     if (!entry || typeof entry !== "object")
       return;
+    if (seen.has(entry))
+      return;
+    seen.add(entry);
     for (const [key, child] of Object.entries(entry)) {
       const normalized = normalizeExtraParamKey(key);
       if (path8.length === 0 && PROTECTED_TOP_LEVEL_KEYS.has(normalized)) {
@@ -32650,6 +32792,9 @@ function pushIssue(issues, path8, keyword, kind, message) {
 function isPlainObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function isSupportedEnumValue(value) {
+  return value === null || typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value);
+}
 function checkDefinitionNode(schema, path8, issues, depth) {
   if (depth > MAX_DEFINITION_DEPTH) {
     pushIssue(issues, path8, "(depth)", "malformed", `schema nesting exceeds the depth limit of ${MAX_DEFINITION_DEPTH}`);
@@ -32676,8 +32821,16 @@ function checkDefinitionNode(schema, path8, issues, depth) {
       }
     }
   }
-  if (schema.enum !== undefined && (!Array.isArray(schema.enum) || schema.enum.length === 0)) {
-    pushIssue(issues, [...path8, "enum"], "enum", "malformed", `"enum" must be a non-empty array of allowed values`);
+  if (schema.enum !== undefined) {
+    if (!Array.isArray(schema.enum) || schema.enum.length === 0) {
+      pushIssue(issues, [...path8, "enum"], "enum", "malformed", `"enum" must be a non-empty array of allowed values`);
+    } else {
+      schema.enum.forEach((value, index) => {
+        if (isSupportedEnumValue(value))
+          return;
+        pushIssue(issues, [...path8, "enum", index], "enum", "unsupported", `"enum" values must be JSON primitives (string, finite number, boolean, or null) in the workflow ` + `schema subset \u2014 object and array enum members cannot be matched by the runtime subset`);
+      });
+    }
   }
   for (const keyword of ["allOf", "anyOf", "oneOf"]) {
     const branches = schema[keyword];
@@ -33358,7 +33511,13 @@ function parseUnit(ctx, raw, path8, stepLabel) {
     unit.output = output;
   if (raw.env !== undefined) {
     if (Array.isArray(raw.env) && raw.env.every((entry) => typeof entry === "string" && entry.trim() !== "")) {
-      unit.env = raw.env.map((entry) => entry.trim());
+      const envRefs = raw.env.map((entry) => entry.trim());
+      const duplicate = envRefs.find((ref, i) => envRefs.indexOf(ref) !== i);
+      if (duplicate !== undefined) {
+        ctx.err([...path8, "env"], `${stepLabel} "env" contains a duplicate entry: "${duplicate}".`);
+      } else {
+        unit.env = envRefs;
+      }
     } else {
       ctx.err([...path8, "env"], `${stepLabel} "env" must be a list of non-empty env asset refs.`);
     }
@@ -33526,6 +33685,10 @@ function parseRoute(ctx, raw, path8, stepLabel, stepIndex, routeChecks) {
         return;
       }
       const match = String(branch.match);
+      if (match === "") {
+        ctx.errAtLine(matchLine, `${stepLabel} "when[${i}].match" must not be empty.`);
+        return;
+      }
       if (typeof branch.step !== "string" || branch.step.trim() === "") {
         ctx.err([...branchPath, "step"], `${stepLabel} "when[${i}].step" must be a step id string.`);
         return;
@@ -33567,12 +33730,18 @@ function parseInputs(ctx, raw, path8, stepLabel) {
     ctx.err(path8, `${stepLabel} "inputs" must contain at most ${WORKFLOW_MAX_INPUTS} entries.`);
   }
   const out = [];
+  const seen = new Set;
   raw.forEach((entry, i) => {
     if (typeof entry !== "string" || entry.trim() === "") {
       ctx.err([...path8, i], `${stepLabel} "inputs[${i}]" must be a non-empty reference string.`);
       return;
     }
     const value = entry.trim();
+    if (seen.has(value)) {
+      ctx.err([...path8, i], `${stepLabel} "inputs[${i}]" duplicates an earlier entry: "${value}".`);
+      return;
+    }
+    seen.add(value);
     checkReferenceSyntax(ctx, value, [...path8, i], `${stepLabel} "inputs[${i}]"`);
     out.push(value);
   });
@@ -33960,7 +34129,7 @@ function taskDiagnostics(relPath, data) {
   if (data === null || Object.keys(data).length === 0)
     return [];
   const missing = taskFieldProblems(data);
-  const hasTarget = "prompt" in data || "workflow" in data || "command" in data;
+  const hasTarget = ["prompt", "workflow", "command"].some((key) => isPresentTarget(data[key]));
   if (!hasTarget)
     missing.push("prompt, workflow, or command");
   if (missing.length > 0) {
@@ -34078,6 +34247,7 @@ init_common();
 init_errors();
 init_file_lock();
 init_paths();
+init_common();
 import fs7 from "fs";
 import path11 from "path";
 function readConfigText(configPath) {
@@ -34157,48 +34327,6 @@ function withConfigLock(fn) {
     release();
   }
 }
-function stripJsonComments(text) {
-  let result = "";
-  let i = 0;
-  let inString = false;
-  while (i < text.length) {
-    if (inString) {
-      if (text[i] === "\\") {
-        result += text[i] + (text[i + 1] ?? "");
-        i += 2;
-        continue;
-      }
-      if (text[i] === '"') {
-        inString = false;
-      }
-      result += text[i];
-      i++;
-      continue;
-    }
-    if (text[i] === '"') {
-      inString = true;
-      result += text[i];
-      i++;
-      continue;
-    }
-    if (text[i] === "/" && text[i + 1] === "/") {
-      while (i < text.length && text[i] !== `
-`)
-        i++;
-      continue;
-    }
-    if (text[i] === "/" && text[i + 1] === "*") {
-      i += 2;
-      while (i < text.length && !(text[i] === "*" && text[i + 1] === "/"))
-        i++;
-      i += 2;
-      continue;
-    }
-    result += text[i];
-    i++;
-  }
-  return result;
-}
 
 // node_modules/zod/v3/external.js
 var exports_external = {};
@@ -38301,6 +38429,7 @@ var VALID_HARNESS_IDS = Object.freeze(HARNESS_ID_TABLE.map((h) => h.id));
 var HARNESS_AGENT_DISPATCH_IDS = new Set(HARNESS_ID_TABLE.filter((h) => h.agentDispatch).map((h) => h.id));
 
 // src/core/config/schema/engines.ts
+var timeoutMsField = exports_external.union([positiveInt.max(WORKFLOW_MAX_TIMEOUT_MS), exports_external.null()]).optional();
 var LlmConnectionConfigSchema = exports_external.object({
   provider: exports_external.string().optional(),
   endpoint: exports_external.string(),
@@ -38308,7 +38437,7 @@ var LlmConnectionConfigSchema = exports_external.object({
   apiKey: exports_external.string().optional(),
   temperature: exports_external.number().finite().optional(),
   maxTokens: positiveInt.optional(),
-  timeoutMs: exports_external.union([positiveInt, exports_external.null()]).optional(),
+  timeoutMs: timeoutMsField,
   concurrency: positiveInt.optional(),
   capabilities: LlmCapabilitiesSchema.optional(),
   extraParams: ExtraParamsSchema.optional(),
@@ -38327,7 +38456,7 @@ var LlmEngineSchema = exports_external.object({
   apiKey: exports_external.string().regex(ENV_REFERENCE_PATTERN, `apiKey must be $VAR or \${VAR}`).optional(),
   temperature: exports_external.number().finite().optional(),
   maxTokens: positiveInt.optional(),
-  timeoutMs: exports_external.union([positiveInt, exports_external.null()]).optional(),
+  timeoutMs: timeoutMsField,
   concurrency: positiveInt.optional(),
   supportsJsonSchema: exports_external.boolean().optional(),
   extraParams: ExtraParamsSchema.optional(),
@@ -38348,7 +38477,7 @@ var AgentEngineSchema = exports_external.object({
   args: exports_external.array(exports_external.string()).optional(),
   workspace: nonEmptyString.optional(),
   model: nonEmptyString.optional(),
-  timeoutMs: exports_external.union([positiveInt, exports_external.null()]).optional(),
+  timeoutMs: timeoutMsField,
   modelAliases: ModelAliasMapSchema.optional(),
   llmEngine: engineName.optional()
 }).passthrough().superRefine((value, ctx) => {
@@ -39451,7 +39580,7 @@ function inferLegacyBundleIds(sources) {
 
 // scripts/akm-migrate/migrate/legacy/config-source-migration.ts
 import fs24 from "fs";
-import os from "os";
+import os2 from "os";
 import path28 from "path";
 
 // src/core/adapter/adapters/agent-skills-adapter.ts
@@ -39700,20 +39829,32 @@ function skillFieldDiagnostics(relPath, dirName, data) {
   return diagnostics;
 }
 var MAX_PACKAGE_PROBE_DEPTH = 3;
-async function subtreeHasManifest(dir, entries, ctx, depth) {
+function missingManifestDiagnostic(dir) {
+  return { file: dir, issue: "missing-skill-md", detail: `no SKILL.md in ${dir}/`, fixed: false };
+}
+async function scanPackageCandidate(dir, entries, ctx, depth) {
   if (entries.includes(SKILL_MANIFEST))
-    return true;
-  if (depth >= MAX_PACKAGE_PROBE_DEPTH)
-    return false;
+    return { containsManifest: true, diagnostics: [] };
+  if (depth >= MAX_PACKAGE_PROBE_DEPTH) {
+    return { containsManifest: false, diagnostics: [missingManifestDiagnostic(dir)] };
+  }
+  const children = [];
   for (const entry of entries) {
+    if (entry.startsWith("."))
+      continue;
     const child = `${dir}/${entry}`;
     const childEntries = await ctx.list(child);
     if (childEntries.length === 0)
       continue;
-    if (await subtreeHasManifest(child, childEntries, ctx, depth + 1))
-      return true;
+    children.push(await scanPackageCandidate(child, childEntries, ctx, depth + 1));
   }
-  return false;
+  if (children.some((child) => child.containsManifest)) {
+    return {
+      containsManifest: true,
+      diagnostics: children.flatMap((child) => child.diagnostics)
+    };
+  }
+  return { containsManifest: false, diagnostics: [missingManifestDiagnostic(dir)] };
 }
 async function missingManifestDiagnostics(ctx) {
   const diagnostics = [];
@@ -39723,9 +39864,7 @@ async function missingManifestDiagnostics(ctx) {
     const entries = await ctx.list(name);
     if (entries.length === 0)
       continue;
-    if (await subtreeHasManifest(name, entries, ctx, 1))
-      continue;
-    diagnostics.push({ file: name, issue: "missing-skill-md", detail: `no SKILL.md in ${name}/`, fixed: false });
+    diagnostics.push(...(await scanPackageCandidate(name, entries, ctx, 1)).diagnostics);
   }
   return diagnostics;
 }
@@ -41466,7 +41605,7 @@ function taskDiagnostics2(relPath, data) {
   if (Object.keys(data).length === 0)
     return [];
   const problems = taskFieldProblems(data);
-  const targets = TARGET_KEYS.filter((k) => (k in data) && data[k] !== undefined && data[k] !== null);
+  const targets = TARGET_KEYS.filter((k) => isPresentTarget(data[k]));
   if (targets.length === 0)
     problems.push("exactly one target (prompt, workflow, or command)");
   else if (targets.length > 1)
@@ -41870,6 +42009,10 @@ function classify2(relPath) {
   }
   return null;
 }
+function hasSensitiveMarker(absPath, type) {
+  const marker = type === "env" ? absPath.replace(/\.env$/i, ".sensitive") : `${absPath}.sensitive`;
+  return marker !== absPath && fs19.existsSync(marker);
+}
 function scanKeyNames(raw) {
   const keys = [];
   const seen = new Set;
@@ -41889,6 +42032,8 @@ function recognize5(c, file) {
   const type = classify2(file.relPath);
   if (type === null)
     return null;
+  if (hasSensitiveMarker(file.absPath, type))
+    return null;
   const posix = toPosix6(file.relPath);
   const raw = file.content();
   if (type === "env") {
@@ -42803,9 +42948,9 @@ function hasOldSourceShape(raw) {
 }
 function expandTilde(p) {
   if (p === "~")
-    return os.homedir();
+    return os2.homedir();
   if (p.startsWith("~/") || p.startsWith("~\\"))
-    return path28.join(os.homedir(), p.slice(2));
+    return path28.join(os2.homedir(), p.slice(2));
   return p;
 }
 function readString(value) {
@@ -43036,14 +43181,14 @@ function generateTargetConfig(raw, currentConfigVersion) {
 // scripts/akm-migrate/migrate/legacy/content-migration.ts
 import { randomBytes } from "crypto";
 import fs27 from "fs";
-import os3 from "os";
+import os4 from "os";
 import path31 from "path";
 init_common();
 init_warn();
 
 // scripts/akm-migrate/migrate/legacy/legacy-layout.ts
 import fs25 from "fs";
-import os2 from "os";
+import os3 from "os";
 import path29 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
@@ -43479,7 +43624,7 @@ function fileUriToPath(ref) {
   return after;
 }
 function toReadableLocalId(absolutePath) {
-  const home = os2.homedir();
+  const home = os3.homedir();
   if (absolutePath === home)
     return "~";
   if (absolutePath.startsWith(home + path29.sep)) {
@@ -43634,7 +43779,7 @@ function runContentMigration(stashRoots, options = {}) {
       rewriteSourceBackrefsInDir(dir, report);
   }
   const operationId = options.operationId ?? `direct-${process.pid}-${randomBytes(8).toString("hex")}`;
-  const batchPath = options.renameBatchPath ?? path31.join(os3.tmpdir(), `akm-reserved-renames-${operationId}-${randomBytes(8).toString("hex")}.json`);
+  const batchPath = options.renameBatchPath ?? path31.join(os4.tmpdir(), `akm-reserved-renames-${operationId}-${randomBytes(8).toString("hex")}.json`);
   let batch;
   try {
     batch = loadReservedRenameBatch(batchPath, operationId);
@@ -43916,7 +44061,7 @@ init_common();
 init_errors();
 import { spawnSync as spawnSync3 } from "child_process";
 import fs28 from "fs";
-import os4 from "os";
+import os5 from "os";
 import path33 from "path";
 import { fileURLToPath as fileURLToPath3, pathToFileURL } from "url";
 
@@ -44436,7 +44581,7 @@ function fileUriToPath2(ref) {
   return after;
 }
 function toReadableLocalId2(absolutePath) {
-  const home = os4.homedir();
+  const home = os5.homedir();
   if (absolutePath === home)
     return "~";
   if (absolutePath.startsWith(home + path33.sep)) {
@@ -44841,7 +44986,7 @@ function errMsg2(error2) {
 // scripts/akm-migrate/migrate/legacy/task-target-ref-migration.ts
 import crypto4 from "crypto";
 import fs40 from "fs";
-import os5 from "os";
+import os6 from "os";
 import path46 from "path";
 init_errors();
 
@@ -45445,6 +45590,14 @@ function resolveWritable(entry) {
     return entry.writable;
   return entry.type === "filesystem";
 }
+var WINDOWS_RESERVED_DEVICE_NAMES = new Set([
+  "con",
+  "prn",
+  "aux",
+  "nul",
+  ...Array.from({ length: 9 }, (_, i) => `com${i + 1}`),
+  ...Array.from({ length: 9 }, (_, i) => `lpt${i + 1}`)
+]);
 function resolveGitContentRoot(repoPath) {
   const contentPath = path40.join(repoPath, "content");
   return fs35.existsSync(contentPath) && fs35.statSync(contentPath).isDirectory() ? contentPath : repoPath;
@@ -50690,6 +50843,22 @@ function markdownDestination(url) {
   return url.replaceAll("(", "%28").replaceAll(")", "%29");
 }
 var MAX_NESTING_DEPTH = 2000;
+var VOID_ELEMENTS = new Set([
+  "area",
+  "base",
+  "br",
+  "col",
+  "embed",
+  "hr",
+  "img",
+  "input",
+  "link",
+  "meta",
+  "param",
+  "source",
+  "track",
+  "wbr"
+]);
 function exceedsNestingBudget(html) {
   let depth = 0;
   let max = 0;
@@ -50699,6 +50868,8 @@ function exceedsNestingBudget(html) {
     const selfClosing = match[3] === "/";
     if (selfClosing)
       continue;
+    if (VOID_ELEMENTS.has(match[2].toLowerCase()))
+      continue;
     if (closing)
       depth = Math.max(0, depth - 1);
     else {
@@ -50900,8 +51071,33 @@ ${content.trim().replace(/\n\s*\n/g, `
 function escapeResidualMarkup(markdown) {
   return markdown.replace(/<(?=[a-zA-Z/!?])/g, "&lt;");
 }
+function escapeOutsideCodeFences(markdown) {
+  const lines = markdown.split(`
+`);
+  let inFence = false;
+  let fenceMarker = "";
+  for (let i = 0;i < lines.length; i++) {
+    const line = lines[i];
+    const fence = /^\s*(`{3,}|~{3,})/.exec(line);
+    if (fence) {
+      const marker = fence[1];
+      if (!inFence) {
+        inFence = true;
+        fenceMarker = marker[0];
+      } else if (marker[0] === fenceMarker) {
+        inFence = false;
+        fenceMarker = "";
+      }
+      continue;
+    }
+    if (!inFence)
+      lines[i] = escapeResidualMarkup(line);
+  }
+  return lines.join(`
+`);
+}
 function finalizeMarkdown(markdown) {
-  return escapeResidualMarkup(markdown).replace(/\r/g, "").replace(/[ \t]+\n/g, `
+  return escapeOutsideCodeFences(markdown).replace(/\r/g, "").replace(/[ \t]+\n/g, `
 `).replace(/\n{3,}/g, `
 
 `).trim();
@@ -57779,9 +57975,9 @@ function migrationError(filePath, detail) {
 }
 function expandTilde2(value) {
   if (value === "~")
-    return os5.homedir();
+    return os6.homedir();
   if (value.startsWith("~/") || value.startsWith("~\\"))
-    return path46.join(os5.homedir(), value.slice(2));
+    return path46.join(os6.homedir(), value.slice(2));
   return value;
 }
 function bundlesFromConfig(config, pathResolutionBase, migrationLockEntries) {
@@ -59752,9 +59948,9 @@ async function runMigrationStatus(options = {}) {
 }
 function expandTilde4(value) {
   if (value === "~")
-    return os6.homedir();
+    return os7.homedir();
   if (value.startsWith("~/") || value.startsWith("~\\"))
-    return path49.join(os6.homedir(), value.slice(2));
+    return path49.join(os7.homedir(), value.slice(2));
   return value;
 }
 function migrationLockMatchesBundle(lock, bundle) {