akm-cli 0.9.1-beta.1 → 0.9.1-beta.3

package/dist/core/adapter/adapters/agent-skills-adapter.js

@@ -138,13 +138,25 @@ function skillFieldDiagnostics(relPath, dirName, data) {
  * sweep into a full recursive walk.
  */
 const MAX_PACKAGE_PROBE_DEPTH = 3;
-/** True when `SKILL.md` exists at `dir` or anywhere within {@link MAX_PACKAGE_PROBE_DEPTH} below it. */
-async function subtreeHasManifest(dir, entries, ctx, depth) {
+function missingManifestDiagnostic(dir) {
+    return { file: dir, issue: "missing-skill-md", detail: `no SKILL.md in ${dir}/`, fixed: false };
+}
+/**
+ * Classify one directory as a package, a grouping directory, or one broken
+ * package candidate. Once a real package root is found, its resource
+ * directories are never descended into. If manifests exist only below this
+ * directory, it is a group and each sibling candidate is checked independently.
+ */
+async function scanPackageCandidate(dir, entries, ctx, depth) {
     if (entries.includes(SKILL_MANIFEST))
-        return true;
-    if (depth >= MAX_PACKAGE_PROBE_DEPTH)
-        return false;
+        return { containsManifest: true, diagnostics: [] };
+    if (depth >= MAX_PACKAGE_PROBE_DEPTH) {
+        return { containsManifest: false, diagnostics: [missingManifestDiagnostic(dir)] };
+    }
+    const children = [];
     for (const entry of entries) {
+        if (entry.startsWith("."))
+            continue;
         const child = `${dir}/${entry}`;
         // `list` on a FILE yields `[]` (the read throws and is swallowed), so an
         // empty listing is the "not a directory worth descending" signal — no
@@ -152,10 +164,17 @@ async function subtreeHasManifest(dir, entries, ctx, depth) {
         const childEntries = await ctx.list(child);
         if (childEntries.length === 0)
             continue;
-        if (await subtreeHasManifest(child, childEntries, ctx, depth + 1))
-            return true;
+        children.push(await scanPackageCandidate(child, childEntries, ctx, depth + 1));
+    }
+    if (children.some((child) => child.containsManifest)) {
+        return {
+            containsManifest: true,
+            diagnostics: children.flatMap((child) => child.diagnostics),
+        };
     }
-    return false;
+    // No descendant establishes this as a grouping directory. Diagnose the
+    // candidate itself, not its resource subdirectories.
+    return { containsManifest: false, diagnostics: [missingManifestDiagnostic(dir)] };
 }
 /**
  * The directory-level `missing-skill-md` check (issue #774).
@@ -167,11 +186,10 @@ async function subtreeHasManifest(dir, entries, ctx, depth) {
  * component root through {@link ValidateContext.list} instead, so the case is
  * actually reported.
  *
- * Deliberately TOP-LEVEL only: a package's own resource dirs
- * (`pdf-processing/reference/`) are part of the item, not candidate packages,
- * and flagging them would turn every conformant bundle red. A top-level dir
- * that holds a manifest ANYWHERE beneath it is a grouping dir, not a broken
- * package, so it is left alone too.
+ * A package's own resource dirs (`pdf-processing/reference/`) are part of the
+ * item, not candidate packages. Grouping directories are supported too, but
+ * their children are classified independently so one valid package cannot hide
+ * a manifest-less sibling.
  */
 async function missingManifestDiagnostics(ctx) {
     const diagnostics = [];
@@ -181,9 +199,7 @@ async function missingManifestDiagnostics(ctx) {
         const entries = await ctx.list(name);
         if (entries.length === 0)
             continue; // a root file (README.md), or an untrackable empty dir
-        if (await subtreeHasManifest(name, entries, ctx, 1))
-            continue;
-        diagnostics.push({ file: name, issue: "missing-skill-md", detail: `no SKILL.md in ${name}/`, fixed: false });
+        diagnostics.push(...(await scanPackageCandidate(name, entries, ctx, 1)).diagnostics);
     }
     return diagnostics;
 }

package/dist/core/adapter/adapters/akm-lint.js

@@ -52,7 +52,7 @@
  */
 import path from "node:path";
 import { isDangerousEnvKey } from "../../../commands/lint/env-key-rules.js";
-import { taskFieldProblems } from "../../../tasks/schema.js";
+import { isPresentTarget, taskFieldProblems } from "../../../tasks/schema.js";
 import { compileWorkflowPlan } from "../../../workflows/ir/compile.js";
 import { parseWorkflow } from "../../../workflows/parser.js";
 import { conceptIdForStashFile } from "../../asset/resolve-ref.js";
@@ -283,7 +283,11 @@ export function taskDiagnostics(relPath, data) {
     if (data === null || Object.keys(data).length === 0)
         return [];
     const missing = taskFieldProblems(data);
-    const hasTarget = "prompt" in data || "workflow" in data || "command" in data;
+    // Presence, matching the runtime parser's rule (src/tasks/parser.ts): an
+    // empty string is NOT a target there, so a `workflow: ""` that linted clean
+    // here failed at run time with MISSING_REQUIRED_ARGUMENT — a file the linter
+    // called valid but that could never run.
+    const hasTarget = ["prompt", "workflow", "command"].some((key) => isPresentTarget(data[key]));
     if (!hasTarget)
         missing.push("prompt, workflow, or command");
     if (missing.length > 0) {

package/dist/core/adapter/adapters/akm-task-adapter.js

@@ -30,7 +30,7 @@
  */
 import fs from "node:fs";
 import path from "node:path";
-import { parseTaskYaml, TASK_EXTENSION, TASK_NEAR_MISS_EXTENSION, taskExtensionDetail, taskFieldProblems, taskYamlParseDetail, } from "../../../tasks/schema.js";
+import { isPresentTarget, parseTaskYaml, TASK_EXTENSION, TASK_NEAR_MISS_EXTENSION, taskExtensionDetail, taskFieldProblems, taskYamlParseDetail, } from "../../../tasks/schema.js";
 import { hashContent } from "./shared.js";
 /** A native task bundle is single-component; its one component is `main`. */
 const COMPONENT_ID = "main";
@@ -71,7 +71,9 @@ function taskDiagnostics(relPath, data) {
     if (Object.keys(data).length === 0)
         return [];
     const problems = taskFieldProblems(data);
-    const targets = TARGET_KEYS.filter((k) => k in data && data[k] !== undefined && data[k] !== null);
+    // Shared presence rule (src/tasks/schema.ts): an empty string or empty array
+    // is not a target, matching the runtime parser.
+    const targets = TARGET_KEYS.filter((k) => isPresentTarget(data[k]));
     if (targets.length === 0)
         problems.push("exactly one target (prompt, workflow, or command)");
     else if (targets.length > 1)

package/dist/core/adapter/adapters/dotenv-adapter.js

@@ -61,6 +61,25 @@ function classify(relPath) {
     }
     return null;
 }
+/**
+ * True when `--sensitive` marked this asset, via the sibling marker file that
+ * `akm env create --sensitive` / `akm secret create --sensitive` writes:
+ * `env/<name>.sensitive` for `env/<name>.env`, `secrets/<name>.sensitive` for
+ * `secrets/<name>`.
+ *
+ * The flag documents itself as excluding the asset from BOTH `env list` output
+ * and the search index. Indexing filters are adapter-owned (the walk no longer
+ * pre-filters), and the akm adapter abstains on the marker — but this adapter
+ * only skipped files whose OWN name ended in `.sensitive`. A dotenv bundle is a
+ * legal env/secret write target, so a marked `env/prod.env` there was still
+ * indexed with every KEY NAME as a hint and a marked secret still indexed by
+ * name, while `env list` / `secret list` correctly hid them. The two surfaces
+ * disagreed about a documented promise.
+ */
+function hasSensitiveMarker(absPath, type) {
+    const marker = type === "env" ? absPath.replace(/\.env$/i, ".sensitive") : `${absPath}.sensitive`;
+    return marker !== absPath && fs.existsSync(marker);
+}
 /** Extract KEY NAMES (never values) from an env file's raw content, first-appearance order, deduped. */
 function scanKeyNames(raw) {
     const keys = [];
@@ -81,6 +100,8 @@ function recognize(c, file) {
     const type = classify(file.relPath);
     if (type === null)
         return null;
+    if (hasSensitiveMarker(file.absPath, type))
+        return null;
     const posix = toPosix(file.relPath);
     const raw = file.content();
     if (type === "env") {

package/dist/core/asset/frontmatter.js

@@ -10,6 +10,7 @@
  */
 import fs from "node:fs";
 import { parse as yamlParse, stringify as yamlStringify } from "yaml";
+import { existingFileMode, writeFileAtomic } from "../common.js";
 import { recordWrittenPath } from "../write-provenance.js";
 import { assembleAsset, serializeFrontmatter } from "./asset-serialize.js";
 /**
@@ -143,7 +144,11 @@ export function mutateFrontmatter(filePath, mutator) {
     const next = parsed.frontmatter !== null
         ? `---\n${serializeFrontmatter(nextFrontmatter)}\n---\n${parsed.content}`
         : assembleAsset(nextFrontmatter, parsed.content);
-    fs.writeFileSync(filePath, next, "utf8");
+    // Atomic, like the canonical asset write: this rewrites a file the user
+    // authored, and a truncate-in-place left a window where a crash or a
+    // concurrent reader saw a half-written or empty asset. The existing mode is
+    // preserved so stamping frontmatter never changes an asset's permissions.
+    writeFileAtomic(filePath, next, existingFileMode(filePath));
     // #652: in-place frontmatter stamps (belief state, contradiction markers,
     // salience) are real asset mutations — journal them for the run's sync.
     recordWrittenPath(filePath);

package/dist/core/common.js

@@ -83,6 +83,75 @@ export function readTextFileWithLimit(filePath, maxBytes, label = "File") {
  *      don't fail on those mounts. Windows does not support opening a
  *      directory for fsync, so the directory-sync step is skipped there.
  */
+/**
+ * Strip JavaScript-style comments from a JSON string (JSONC support).
+ * Handles `//` line comments and `/* *​/` block comments while preserving
+ * comment-like sequences inside quoted strings.
+ */
+export function stripJsonComments(text) {
+    let result = "";
+    let i = 0;
+    let inString = false;
+    while (i < text.length) {
+        if (inString) {
+            if (text[i] === "\\") {
+                result += text[i] + (text[i + 1] ?? "");
+                i += 2;
+                continue;
+            }
+            if (text[i] === '"') {
+                inString = false;
+            }
+            result += text[i];
+            i++;
+            continue;
+        }
+        if (text[i] === '"') {
+            inString = true;
+            result += text[i];
+            i++;
+            continue;
+        }
+        if (text[i] === "/" && text[i + 1] === "/") {
+            while (i < text.length && text[i] !== "\n")
+                i++;
+            continue;
+        }
+        if (text[i] === "/" && text[i + 1] === "*") {
+            i += 2;
+            while (i < text.length && !(text[i] === "*" && text[i + 1] === "/"))
+                i++;
+            i += 2;
+            continue;
+        }
+        result += text[i];
+        i++;
+    }
+    return result;
+}
+/**
+ * The mode to rewrite an existing USER-owned file with.
+ *
+ * {@link writeFileAtomic} creates its temp file with an explicit mode and
+ * chmods it, so it needs one — and its 0600 default is right for akm's own
+ * state but wrong for a user's asset, where rewriting must never change
+ * permissions. Returns the file's current mode, or the umask-derived default
+ * `fs.writeFileSync` would have produced for a new file.
+ */
+export function existingFileMode(filePath) {
+    try {
+        return fs.statSync(filePath).mode & 0o777;
+    }
+    catch {
+        // Absent (a new asset) or unreadable: fall back to the default create mode.
+        try {
+            return 0o666 & ~process.umask();
+        }
+        catch {
+            return 0o644;
+        }
+    }
+}
 export function writeFileAtomic(target, content, mode) {
     const tmp = `${target}.tmp.${process.pid}.${crypto.randomBytes(8).toString("hex")}`;
     const data = typeof content === "string" ? Buffer.from(content) : content;
@@ -226,7 +295,11 @@ function readStashDirFromConfig() {
     try {
         const configPath = getConfigPath();
         const text = readTextFileWithLimit(configPath, MAX_CONFIG_FILE_BYTES, "Config file");
-        const raw = JSON.parse(text);
+        // The config loader accepts JSONC, so a commented config.json is valid and
+        // in use. Parsing it raw here threw, the catch swallowed it, and every
+        // caller silently fell back — operating on the wrong bundle or failing with
+        // STASH_DIR_NOT_FOUND despite a perfectly good config.
+        const raw = JSON.parse(stripJsonComments(text));
         if (typeof raw !== "object" || raw === null)
             return undefined;
         // 0.9.0 config-shape cutover (spec §10.1): the primary stash is the
@@ -778,14 +851,19 @@ export function stringArray(value) {
  * Return true if a process with the given PID is currently alive.
  * Uses `process.kill(pid, 0)` which does not deliver a signal but
  * throws ESRCH when the process does not exist.
+ *
+ * EPERM means the process EXISTS but belongs to another uid, so it must be
+ * reported alive. Treating it as dead let a lock held by a live process in a
+ * shared data dir (agent sandboxes, containers, service accounts — a
+ * configuration managed-db.ts explicitly supports) be reclaimed as stale.
  */
 export function isProcessAlive(pid) {
     try {
         process.kill(pid, 0);
         return true;
     }
-    catch {
-        return false;
+    catch (err) {
+        return err?.code === "EPERM";
     }
 }
 /**

package/dist/core/config/config-io.js

@@ -15,7 +15,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { sleepSync } from "../../runtime.js";
-import { MAX_CONFIG_FILE_BYTES, readTextFileWithLimit, writeFileAtomic } from "../common.js";
+import { MAX_CONFIG_FILE_BYTES, readTextFileWithLimit, stripJsonComments, writeFileAtomic } from "../common.js";
 import { ConfigError } from "../errors.js";
 import { createLockPayload, probeLock, reclaimStaleLock, releaseLock, tryAcquireLockSync } from "../file-lock.js";
 import { getCacheDir, getConfigDir } from "../paths.js";
@@ -233,48 +233,8 @@ export function withConfigLock(fn) {
     }
 }
 /**
- * Strip JavaScript-style comments from a JSON string (JSONC support).
- * Handles `//` line comments and `/* *​/` block comments while preserving
- * comment-like sequences inside quoted strings.
+ * Re-exported from core/common.ts, where it now lives so `resolveStashDir`
+ * can strip comments too without importing this module (common cannot depend
+ * on config-io — config-io already depends on common).
  */
-export function stripJsonComments(text) {
-    let result = "";
-    let i = 0;
-    let inString = false;
-    while (i < text.length) {
-        if (inString) {
-            if (text[i] === "\\") {
-                result += text[i] + (text[i + 1] ?? "");
-                i += 2;
-                continue;
-            }
-            if (text[i] === '"') {
-                inString = false;
-            }
-            result += text[i];
-            i++;
-            continue;
-        }
-        if (text[i] === '"') {
-            inString = true;
-            result += text[i];
-            i++;
-            continue;
-        }
-        if (text[i] === "/" && text[i + 1] === "/") {
-            while (i < text.length && text[i] !== "\n")
-                i++;
-            continue;
-        }
-        if (text[i] === "/" && text[i + 1] === "*") {
-            i += 2;
-            while (i < text.length && !(text[i] === "*" && text[i + 1] === "/"))
-                i++;
-            i += 2;
-            continue;
-        }
-        result += text[i];
-        i++;
-    }
-    return result;
-}
+export { stripJsonComments } from "../common.js";

package/dist/core/config/schema/engines.js

@@ -14,7 +14,18 @@ import { z } from "zod";
 // `typeof import("./config-schema")` — routing through config-types would mint
 // a config-schema ↔ config-types type cycle that collapses inference.
 import { HARNESS_AGENT_DISPATCH_IDS, VALID_HARNESS_IDS } from "../../../integrations/harnesses/ids.js";
+import { WORKFLOW_MAX_TIMEOUT_MS } from "../../../workflows/resource-limits.js";
 import { chatCompletionsEndpoint, ENV_REFERENCE_PATTERN, ExtraParamsSchema, engineName, LlmCapabilitiesSchema, ModelAliasMapSchema, nonEmptyString, positiveInt, } from "./primitives.js";
+/**
+ * Engine-config timeouts share the workflow ceiling.
+ *
+ * 0.9.1 bounded workflow-authored timeouts (parser) and frozen invocations
+ * (decoder) at 2^31-1, but the third source — `engines.<name>.timeoutMs` — was
+ * validated only as a positive integer. A larger value passed config validation
+ * and then failed EVERY run of that engine with an unlocated "Invalid frozen
+ * workflow plan: invocation is invalid". Reject it where the value is written.
+ */
+const timeoutMsField = z.union([positiveInt.max(WORKFLOW_MAX_TIMEOUT_MS), z.null()]).optional();
 // ── Connection configs (LLM) ────────────────────────────────────────────────
 /**
  * OpenAI-compatible connection fields shared by named LLM engines and bounded
@@ -32,7 +43,7 @@ export const LlmConnectionConfigSchema = z
     apiKey: z.string().optional(),
     temperature: z.number().finite().optional(),
     maxTokens: positiveInt.optional(),
-    timeoutMs: z.union([positiveInt, z.null()]).optional(),
+    timeoutMs: timeoutMsField,
     concurrency: positiveInt.optional(),
     capabilities: LlmCapabilitiesSchema.optional(),
     extraParams: ExtraParamsSchema.optional(),
@@ -56,7 +67,7 @@ const LlmEngineSchema = z
     apiKey: z.string().regex(ENV_REFERENCE_PATTERN, `apiKey must be $VAR or \${VAR}`).optional(),
     temperature: z.number().finite().optional(),
     maxTokens: positiveInt.optional(),
-    timeoutMs: z.union([positiveInt, z.null()]).optional(),
+    timeoutMs: timeoutMsField,
     concurrency: positiveInt.optional(),
     supportsJsonSchema: z.boolean().optional(),
     extraParams: ExtraParamsSchema.optional(),
@@ -80,7 +91,7 @@ const AgentEngineSchema = z
     args: z.array(z.string()).optional(),
     workspace: nonEmptyString.optional(),
     model: nonEmptyString.optional(),
-    timeoutMs: z.union([positiveInt, z.null()]).optional(),
+    timeoutMs: timeoutMsField,
     modelAliases: ModelAliasMapSchema.optional(),
     llmEngine: engineName.optional(),
 })

package/dist/core/extra-params.js

@@ -33,8 +33,16 @@ export function validateExtraParams(value) {
         return [{ path: [], message: "must be an object" }];
     }
     const issues = [];
+    // A self-referential YAML anchor (`extraParams: &a { nested: *a }`) resolves
+    // to a genuinely cyclic object — the yaml package's alias-count guard does not
+    // catch cycles — so an unguarded walk overflowed the stack with a RangeError
+    // that escaped task parsing. Track visited containers and stop at a revisit.
+    const seen = new WeakSet();
     const visit = (entry, path) => {
         if (Array.isArray(entry)) {
+            if (seen.has(entry))
+                return;
+            seen.add(entry);
             entry.forEach((child, index) => {
                 visit(child, [...path, index]);
             });
@@ -42,6 +50,9 @@ export function validateExtraParams(value) {
         }
         if (!entry || typeof entry !== "object")
             return;
+        if (seen.has(entry))
+            return;
+        seen.add(entry);
         for (const [key, child] of Object.entries(entry)) {
             const normalized = normalizeExtraParamKey(key);
             if (path.length === 0 && PROTECTED_TOP_LEVEL_KEYS.has(normalized)) {

package/dist/core/fs-txn.js

@@ -81,7 +81,11 @@ export function txnFileHash(filePath) {
     return txnHash(fs.readFileSync(filePath));
 }
 export function fsyncTxnFile(filePath) {
-    const fd = fs.openSync(filePath, "r");
+    // Open for WRITE. Windows implements fsync as FlushFileBuffers, which
+    // requires write access on the handle — a read-only descriptor fails with
+    // EACCES/EPERM, so every proposal accept and reject failed on that platform.
+    // POSIX accepts "r+" here just as readily as "r".
+    const fd = fs.openSync(filePath, "r+");
     try {
         fs.fsyncSync(fd);
     }
@@ -91,7 +95,16 @@ export function fsyncTxnFile(filePath) {
 }
 export function fsyncTxnDir(dirPath) {
     try {
-        fsyncTxnFile(dirPath);
+        // Read-only, unlike {@link fsyncTxnFile}: a directory cannot be opened for
+        // write on POSIX (EISDIR), and on Windows this whole operation is
+        // unsupported anyway and falls into the catch.
+        const fd = fs.openSync(dirPath, "r");
+        try {
+            fs.fsyncSync(fd);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
     }
     catch {
         // Directory fsync is unavailable on some platforms.

package/dist/core/json-schema.js

@@ -171,6 +171,13 @@ function pushIssue(issues, path, keyword, kind, message) {
 function isPlainObject(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+/** Values the runtime's reference-equality `enum` check can enforce correctly. */
+function isSupportedEnumValue(value) {
+    return (value === null ||
+        typeof value === "string" ||
+        typeof value === "boolean" ||
+        (typeof value === "number" && Number.isFinite(value)));
+}
 function checkDefinitionNode(schema, path, issues, depth) {
     if (depth > MAX_DEFINITION_DEPTH) {
         pushIssue(issues, path, "(depth)", "malformed", `schema nesting exceeds the depth limit of ${MAX_DEFINITION_DEPTH}`);
@@ -199,8 +206,18 @@ function checkDefinitionNode(schema, path, issues, depth) {
             }
         }
     }
-    if (schema.enum !== undefined && (!Array.isArray(schema.enum) || schema.enum.length === 0)) {
-        pushIssue(issues, [...path, "enum"], "enum", "malformed", `"enum" must be a non-empty array of allowed values`);
+    if (schema.enum !== undefined) {
+        if (!Array.isArray(schema.enum) || schema.enum.length === 0) {
+            pushIssue(issues, [...path, "enum"], "enum", "malformed", `"enum" must be a non-empty array of allowed values`);
+        }
+        else {
+            schema.enum.forEach((value, index) => {
+                if (isSupportedEnumValue(value))
+                    return;
+                pushIssue(issues, [...path, "enum", index], "enum", "unsupported", `"enum" values must be JSON primitives (string, finite number, boolean, or null) in the workflow ` +
+                    `schema subset — object and array enum members cannot be matched by the runtime subset`);
+            });
+        }
     }
     for (const keyword of ["allOf", "anyOf", "oneOf"]) {
         const branches = schema[keyword];

package/dist/core/paths.js

@@ -160,9 +160,23 @@ export function getCacheDir(env = process.env) {
     }
     const home = env.HOME?.trim();
     if (!home)
-        return path.join("/tmp", "akm-cache");
+        return homelessFallbackDir("akm-cache");
     return path.join(home, ".cache", "akm");
 }
+/**
+ * Last-resort directory when neither the XDG variable nor HOME is set.
+ *
+ * Scoped by uid. A fixed `/tmp/akm-<kind>` path is world-shared and entirely
+ * predictable: on a multi-user host the first uid to run akm owns the
+ * directory and every other user then reads and writes the same databases, and
+ * any local user can pre-create the path (or a symlink at it) and wait. Adding
+ * the uid gives each account its own path; the caller still creates it with
+ * restrictive permissions.
+ */
+function homelessFallbackDir(kind) {
+    const uid = typeof process.getuid === "function" ? process.getuid() : undefined;
+    return path.join(os.tmpdir(), uid === undefined ? kind : `${kind}-${uid}`);
+}
 // ── Data directory ───────────────────────────────────────────────────────────
 /**
  * Returns the XDG data directory for akm (`~/.local/share/akm` on Linux/macOS,
@@ -209,7 +223,7 @@ export function getDataDir(env = process.env, platform = process.platform) {
         return path.join(xdgDataHome, "akm");
     const home = env.HOME?.trim();
     if (!home)
-        return path.join("/tmp", "akm-data");
+        return homelessFallbackDir("akm-data");
     return path.join(home, ".local", "share", "akm");
 }
 export function getDbPath(env = process.env) {

package/dist/core/redaction.js

@@ -322,7 +322,7 @@ function addPlainMatches(coverageDelta, text, needle) {
  * unlike {@link redactSensitiveText}, which requires the exact secret value
  * up front, this catches credentials no caller ever knew to list. No
  * truncation is applied; callers that need a length cap (e.g.
- * {@link redactErrorBody} in src/llm/client.ts) apply it themselves.
+ * {@link redactErrorBody}) apply it themselves.
  *
  * Targets:
  *  - `Bearer <token>` headers echoed back by a provider
@@ -367,6 +367,27 @@ export function redactCredentialPatterns(input) {
  * that is a memory-exhaustion hazard reachable from ordinary command output.
  * The encoded-form path never had the bug because it always worked this way.
  */
+/** Max characters of a provider error body worth surfacing in a message. */
+const ERROR_BODY_MAX_LEN = 200;
+/**
+ * Make an HTTP error body safe to put in an error message: pattern-redact
+ * credential shapes, then clip. Provider bodies can echo the credential that
+ * was sent and can be megabytes of HTML, and these messages travel — into
+ * persisted status files, `--json` output, and agent transcripts.
+ *
+ * Lives here rather than beside one transport because every HTTP client in the
+ * codebase needs it; the embeddings transport originally lacked it and leaked
+ * raw 10 MB bodies into `semantic-status.json`.
+ */
+export function redactErrorBody(input) {
+    if (!input)
+        return "";
+    let out = redactCredentialPatterns(input);
+    if (out.length > ERROR_BODY_MAX_LEN) {
+        out = `${out.slice(0, ERROR_BODY_MAX_LEN)}…`;
+    }
+    return out;
+}
 export function redactSensitiveText(text, sensitiveValues) {
     const values = [...new Set(sensitiveValues)]
         .filter((value) => value.length > 0)

package/dist/core/state-db.js

@@ -150,6 +150,7 @@ export function openStateDatabase(dbPath) {
             exec: db.exec.bind(db),
             run: db.run.bind(db),
             transaction: db.transaction.bind(db),
+            loadExtension: db.loadExtension.bind(db),
             get inTransaction() {
                 return db.inTransaction;
             },

package/dist/core/write-source.js

@@ -33,7 +33,7 @@ import { ensureAkmMarkdownType } from "./asset/akm-markdown.js";
 import { assetPathForName, stashDirFor } from "./asset/asset-placement.js";
 import { conceptIdFromTypeName, displayRef } from "./asset/resolve-ref.js";
 import { deriveBundleId } from "./bundle-id.js";
-import { isWithin, resolveStashDir } from "./common.js";
+import { existingFileMode, isWithin, resolveStashDir, writeFileAtomic } from "./common.js";
 import { resolveConfiguredSources } from "./config/config.js";
 import { ConfigError, UsageError } from "./errors.js";
 import { sanitizeCommitMessage } from "./git-message.js";
@@ -333,7 +333,11 @@ export async function writeAssetToSource(source, config, ref, content) {
     const preflight = preflightGitPathMutation(source, filePath);
     try {
         fs.mkdirSync(path.dirname(filePath), { recursive: true });
-        fs.writeFileSync(filePath, normalized, "utf8");
+        // Atomic: truncate-and-rewrite left a window in which a crash, a full disk,
+        // or a concurrent reader saw a half-written or empty asset — destroying user
+        // content that was fine a moment earlier. writeFileAtomic writes a sibling
+        // temp file, fdatasyncs it, and renames over the target.
+        writeFileAtomic(filePath, normalized, existingFileMode(filePath));
         recordWriteTargetPath(source, filePath);
         // #652: run-scoped write provenance — the canonical asset write is the
         // single largest contributor to an improve run's written-path set.
@@ -1003,11 +1007,31 @@ function ensureWritable(source, config) {
         throw new UsageError(`Source "${source.name}" is not writable. Set \`writable: true\` on the source config entry to enable writes.`, "INVALID_FLAG_VALUE");
     }
 }
+/**
+ * MS-DOS device names Windows still reserves in every directory, with or
+ * without an extension (CON, PRN, AUX, NUL, COM1-9, LPT1-9).
+ */
+const WINDOWS_RESERVED_DEVICE_NAMES = new Set([
+    "con",
+    "prn",
+    "aux",
+    "nul",
+    ...Array.from({ length: 9 }, (_, i) => `com${i + 1}`),
+    ...Array.from({ length: 9 }, (_, i) => `lpt${i + 1}`),
+]);
 function resolveAssetFilePath(source, ref) {
     const basename = path.posix.basename(ref.name.replaceAll("\\", "/")).replace(/\.md$/i, "").toLowerCase();
     if (basename === "index" || basename === "log") {
         throw new UsageError(`Reserved concept name "${basename}" cannot be written.`, "INVALID_FLAG_VALUE");
     }
+    // Windows resolves these names as DEVICES no matter the directory or the
+    // extension, so `CON.md` is not a file — a write goes to the console and a
+    // read blocks on console input. Rejected on every platform so a stash stays
+    // portable: an asset authored on Linux must not become unopenable when the
+    // same bundle is used on Windows.
+    if (WINDOWS_RESERVED_DEVICE_NAMES.has(basename)) {
+        throw new UsageError(`Asset name "${basename}" is a reserved Windows device name and cannot be written.`, "INVALID_FLAG_VALUE");
+    }
     const typeDir = stashDirFor(ref.type);
     if (!typeDir) {
         throw new UsageError(`Unknown asset type "${ref.type}". Cannot resolve a write path.`, "INVALID_FLAG_VALUE");