akm-cli 0.9.1 → 0.9.2-alpha.1

package/CHANGELOG.md

@@ -6,6 +6,94 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.9.2-alpha.1] - 2026-08-24
+
+### Breaking changes & migration
+
+- **Node.js 22 is no longer supported by the npm package.** `akm-cli` now
+  requires Node.js >= 24 to bootstrap its command. A working Bun >= 1.0 remains
+  optional and preferred for execution after that bootstrap; the standalone
+  binary remains runtime-free. Upgrade Node before installing or running the
+  npm package.
+- The `inherit_env` option is a breaking removal: new durable-v4 workflow starts reject it.
+  Replace ambient whole-process inheritance with exact named environment bindings and
+  `exec.pass_env` names. Pre-v4 stored workflow plans are not executable in
+  0.9.2; start a new run from current source.
+- `improve.strategies.*.processes.triage.judgment` now accepts `true`/`false`
+  and honors `enabled` on object values; existing `{}` and configured objects
+  remain enabled. Unknown object keys are now rejected instead of ignored, so
+  correct typos such as `egnine`, `judgement`, or other unrecognized fields
+  before upgrading. Use `judgment: false` to disable the tier explicitly.
+
+### Added
+
+- **WP0 — characterization and release contracts:** pinned direct-agent,
+  command, task, workflow-freeze, model-alias, and harness-lowering behavior;
+  added cross-entry-point equivalence fixtures and immutable release-surface
+  gates.
+- **WP1 — shared execution contracts:** introduced adapter-rendered source
+  identity and one resolved-request representation carrying final content,
+  engine/model/inference selection, authorization, runtime settings, source
+  hashes, and structured lowering notices.
+- **WP2 — layered model maps:** ship a versioned installed `models.json`, merge
+  an optional user overlay from the config directory, expand known aliases by
+  engine, pass unknown identifiers through exactly, and provide guarded model
+  map initialization.
+- **WP3 — common cascade and authorization:** resolve far-to-near defaults once,
+  preserve explicit false/zero/empty values, authorize selected tools before
+  dispatch, and expose stable field-level provenance without resolved values.
+- **WP4 — portable command execution:** added canonical
+  `akm command run <ref>`, implemented one-pass `$ARGUMENTS` substitution, and
+  reject unsupported native template constructs before dispatch. Stored
+  commands have one execution surface; `akm agent --command` is not retained.
+- **WP6 — task v3:** added the strict shipped task schema, command/workflow/script
+  targets, closed shell and working-directory rules, portable schedules, and a
+  fail-closed task-v2 migrator with no-write preview, per-file status, backups,
+  validation, and blocked argv-array handling.
+- **WP7 — peer workflow sources and durable v4:** compile Markdown and the
+  approved GitHub-shaped `.yml` subset through source IR v1; new runs atomically
+  persist immutable v4 targets, guarded source reads, symbolic environments,
+  and durable dispatch attempts. Pre-v4 stored plans are rejected rather than
+  maintaining a second runtime.
+- **WP8 — release diagnostics:** added zero-write, secret-safe command dry-run
+  output, stderr-only verbose provenance, offline `selected-model-aliases` and
+  `configured-engines` health advisories, self-contained migration guidance,
+  and npm tar/install/link release gates.
+
+### Changed
+
+- **WP5 — engine lowering convergence:** direct command/agent execution,
+  improve/proposal dispatch, tasks, and workflows now share the resolved-request
+  boundary and implementation-derived lowerers. Exact model and inference
+  settings reach registered harnesses; unsupported fields produce safe notices,
+  while provider capability rejection remains a runtime result.
+- Scheduled workflow fires re-read the current peer source and create a fresh
+  durable-v4 freeze. Resume remains journaled replay, and crash recovery uses
+  at-least-once attempt semantics with stable reclaim identities.
+- Task scheduler synchronization is transactional across supported adapters and
+  preserves exact ownership, rollback evidence, enabled state, parameters,
+  timeouts, redaction metadata, and resolver overrides.
+
+### Fixed
+
+- Ordinary managed database opens no longer silently apply released migration
+  `018-drop-dead-lane-schema`, which drops retired tables and a column. Every
+  state migration now has an explicit safety classification; migration 002's
+  row-preserving table rebuild remains automatic, while migration 018 requires
+  a successful `akm upgrade` and a verified sibling SQLite snapshot created
+  immediately before its immutable SQL runs. The ledger recheck, WAL-inclusive
+  snapshot, and 018 transaction now share one writer-exclusion window; fresh
+  files and randomized backup paths are atomically reserved and inode-verified.
+  Pre-existing unversioned files—including an absent or empty migration
+  ledger—are rejected without writes by ordinary opens and snapshotted before
+  migration 001 by explicit upgrade. That snapshot, ledger initialization, and
+  migrations 001–002 share one writer-exclusion transaction, preventing an old
+  schema writer from landing data between the snapshot and the 002 rebuild.
+  Migration locks now reject phantom `BEGIN IMMEDIATE` results before running
+  SQL and fail clearly if the transaction disappears after a body. Snapshot
+  source and target handles are inode-bound, and failed reserved paths are
+  retained rather than removed by raced cleanup.
+
 ## [0.9.1] - 2026-08-18
 
 ### Fixed

package/README.md

@@ -16,7 +16,7 @@ assistant, including [Claude Code](https://claude.ai/code),
 
 ## Install
 
-**Option 1 — npm package (recommended; requires [Node.js](https://nodejs.org) >= 22):**
+**Option 1 — npm package (recommended; requires [Node.js](https://nodejs.org) >= 24):**
 
 ```sh
 npm install -g akm-cli
@@ -85,6 +85,8 @@ Full docs, CLI reference, and guides are available on [GitHub](https://github.co
 - [Getting Started](https://github.com/itlackey/akm/blob/main/docs/guides/getting-started.md)
 - [Supported Formats](https://github.com/itlackey/akm/blob/main/docs/reference/supported-formats.md)
 - [CLI Reference](https://github.com/itlackey/akm/blob/main/docs/reference/cli.md)
+- [Task v3 Reference](https://github.com/itlackey/akm/blob/main/docs/reference/tasks.md)
+- [0.9.2 Migration Guide](https://github.com/itlackey/akm/blob/main/docs/migration/v0.9.1-to-v0.9.2.md)
 - [Configuration](https://github.com/itlackey/akm/blob/main/docs/reference/configuration.md)
 - [Bundle Authoring Guide](https://github.com/itlackey/akm/blob/main/docs/guides/author-bundles.md)
 - [Registry](https://github.com/itlackey/akm/blob/main/docs/reference/registry.md)

package/SECURITY.md

@@ -96,7 +96,7 @@ containing secrets or private notes.
 
 ## Known non-issues
 
-- **The `akm-cli` npm package requires Node.js >= 22 as its bootstrap.** A
+- **The `akm-cli` npm package requires Node.js >= 24 as its bootstrap.** A
   working Bun >= 1.0 is preferred for execution when it is also on `PATH`; old,
   unusable, or absent Bun installations fall back to Node.js. Bun does not
   remove the package's Node.js requirement. Standalone binaries are

package/STABILITY.md

@@ -218,7 +218,7 @@ enumeration of the whole `proposal` noun group.
   | `78` | Configuration error |
 - **Install scripts** — `install.sh` and `install.ps1` URLs; the `--prefix`
   / `AKM_INSTALL_DIR` environment override.
-- **Runtime** — the npm package requires Node.js >= 22 as its bootstrap and
+- **Runtime** — the npm package requires Node.js >= 24 as its bootstrap and
   prefers a working Bun >= 1.0 for execution when both are available; old,
   unusable, or absent Bun installations fall back to Node.js. Standalone
   binaries are runtime-free.

package/dist/akm

@@ -120,8 +120,8 @@ if (contextValid) {
 
   if (!process.versions.bun) {
     const [major = 0, minor = 0] = process.versions.node.split(".").map(Number);
-    if (major < 22) {
-      console.error("The akm-cli npm package requires Node.js >= 22 to bootstrap.");
+    if (major < 24) {
+      console.error("The akm-cli npm package requires Node.js >= 24 to bootstrap.");
       process.exit(1);
     }
   }

package/dist/akm-migrate

@@ -8,8 +8,8 @@ import { fileURLToPath } from "node:url";
 
 if (!process.versions.bun) {
   const [major = 0, minor = 0] = process.versions.node.split(".").map(Number);
-  if (major < 22) {
-    console.error("The akm-cli npm package requires Node.js >= 22 to bootstrap.");
+  if (major < 24) {
+    console.error("The akm-cli npm package requires Node.js >= 24 to bootstrap.");
     process.exit(1);
   }
 }

package/dist/assets/hints/cli-hints-full.md

@@ -92,7 +92,7 @@ akm import - --name scratch-notes < notes.md   # Import stdin as a knowledge doc
 akm import https://example.com/docs/auth       # Fetch one URL and import it as knowledge
 akm import ./doc.md --target my-other-bundle    # Route import to a named writable bundle source
 akm workflow create ship-release               # Create a workflow asset in the bundle
-akm lint --type workflows                      # Parse and compile every unified markdown workflow; list every error
+akm lint --type workflows                      # Parse and compile every .md/.yml workflow source; list every error
 akm workflow run workflows/ship-release        # Start or resume and execute the workflow
 akm feedback skills/code-review --positive     # Record that an asset helped
 akm feedback agents/reviewer --negative --reason "wrong framework" # Record why an asset missed the mark
@@ -160,7 +160,9 @@ akm secret run secrets/deploy-token GITHUB_TOKEN -- gh release create v1.0.0  #
 
 ## Workflows
 
-Workflows live under `<bundle>/workflows/` as unified markdown assets.
+Workflows live under `<bundle>/workflows/` as peer `.md` and `.yml` sources.
+Both compile to the same source IR; see `docs/reference/workflow-schema.md` for
+the bounded GitHub-shaped YAML subset.
 
 Ref-based workflow commands are scoped to the current project/worktree/directory,
 so one active run does not block unrelated directories from starting the same
@@ -269,6 +271,7 @@ akm bundle list --kind git                           # Filter by provider (files
 akm bundle remove <target>                           # Remove by id, ref, path, or name
 akm bundle update --all                              # Update all managed sources
 akm bundle update <target> --force                   # Force re-download
+akm bundle update <target> --allow-insecure          # Approve reviewed dangerous env keys
 ```
 
 ## Registries
@@ -336,7 +339,7 @@ akm proposal reject <id> --reason "..."                 # Archive with a reason
 akm proposal revert <id>                                # Restore the pre-promotion content
 akm proposal new <type> <name> --task "..."             # Agent-author a NEW asset as a proposal
 akm proposal extract --auto                             # Mine native session files into proposals
-akm proposal extract --type claude-code                 # Restrict extraction to one harness
+akm proposal extract --type claude                 # Restrict extraction to one harness
 ```
 
 The flat verbs `akm proposals` / `akm show proposal` / `akm accept` /
@@ -353,7 +356,7 @@ file plus one `sync` is a complete workflow.
 
 ```sh
 akm task add nightly-improve --schedule "@daily" --command "akm improve --strategy frequent"
-akm task add briefing --schedule "0 9 * * *" --prompt agents/briefer  # Agent-target task
+akm task add briefing --schedule "0 9 * * *" --prompt "Draft the morning briefing"  # Inline command task
 akm task sync                                  # Reconcile task files with the OS scheduler
 akm task sync --rebind                         # Also re-pin the scheduler's akm binary/spelling
 akm task doctor                                # Scheduler binding + runtime eligibility diagnosis
@@ -362,18 +365,20 @@ akm task run <id>                              # Run one task immediately (works
 akm search --type task                         # Enumerate task assets (there is no `task list`)
 ```
 
-To disable a task, set `enabled: false` in its YAML and run `akm task sync`
+Task files use strict task v3 (`version: 3`). To disable one, set
+`akm.enabled: false` and run `akm task sync`
 (the cron line stays, commented). To remove one, delete the YAML and run
-`akm task sync` — the scheduler entry is unbound. Per-task `timeoutMs` in
-the YAML may be `null` (disable the agent kill timer for long local-model
-runs) or a number of milliseconds overriding the selected engine invocation timeout.
+`akm task sync` — the scheduler entry is unbound. Per-task `akm.timeout` may
+be `null` (disable the invocation timer) or a duration/number overriding the
+selected engine invocation timeout. Preview old task-v2 conversion with
+`akm migrate apply --dry-run`.
 
 ## Agent Dispatch
 
 ```sh
 akm agent --prompt "summarize open proposals"   # Dispatch the configured agent CLI
 akm agent agents/architect --prompt "..."       # Embody a bundle agent asset (system prompt, model, tool policy)
-akm agent --workflow workflows/ship-release     # Load the task from a workflow asset
+akm command run commands/release                # Canonical reusable-command dispatch
 akm agent --model sonnet --prompt "..."         # Model override (aliases or exact IDs)
 ```
 

package/dist/assets/improve-strategies/proactive-maintenance.json

@@ -17,7 +17,7 @@
       "policy": "personal-stash",
       "maxAcceptsPerRun": 100,
       "maxDiffLines": 200,
-      "judgment": {}
+      "judgment": true
     },
     "proactiveMaintenance": { "enabled": true, "dueDays": 30, "maxPerRun": 100 }
   },

package/dist/assets/improve-strategies/reflect-distill.json

@@ -22,7 +22,7 @@
       "policy": "personal-stash",
       "maxAcceptsPerRun": 15,
       "maxDiffLines": 200,
-      "judgment": {}
+      "judgment": true
     },
     "proactiveMaintenance": { "enabled": false, "dueDays": 30, "maxPerRun": 15 }
   },

package/dist/assets/models.json

@@ -0,0 +1,35 @@
+{
+  "version": 1,
+  "aliases": {
+    "fast": {
+      "claude": "claude-haiku-4-5-20251001",
+      "opencode": "opencode/claude-haiku-4-5",
+      "opencode-sdk": "anthropic/claude-haiku-4-5"
+    },
+    "balanced": {
+      "claude": "claude-sonnet-4-6",
+      "opencode": "opencode/claude-sonnet-4-6",
+      "opencode-sdk": "anthropic/claude-sonnet-4-6"
+    },
+    "reasoning": {
+      "claude": {
+        "model": "claude-opus-4-7",
+        "inference": {
+          "effort": "high"
+        }
+      },
+      "opencode": {
+        "model": "opencode/claude-opus-4-7",
+        "inference": {
+          "effort": "high"
+        }
+      },
+      "opencode-sdk": {
+        "model": "anthropic/claude-opus-4-7",
+        "inference": {
+          "effort": "high"
+        }
+      }
+    }
+  }
+}

package/dist/assets/tasks/core/extract.yml

@@ -1,5 +1,6 @@
-version: 2
-schedule: "*/30 * * * *"
-command: akm proposal extract --auto
-enabled: true
-description: Opt-in all-harness session extraction every 30 min
+version: 3
+run: akm proposal extract --auto
+akm:
+  schedule: "*/30 * * * *"
+  enabled: true
+  description: Opt-in all-harness session extraction every 30 min

package/dist/assets/tasks/core/improve.yml

@@ -1,5 +1,6 @@
-version: 2
-schedule: "0 2 * * *"
-command: akm improve
-enabled: true
-description: Run improve pipeline nightly
+version: 3
+run: akm improve
+akm:
+  schedule: "0 2 * * *"
+  enabled: true
+  description: Run improve pipeline nightly

package/dist/assets/tasks/core/index-refresh.yml

@@ -1,5 +1,6 @@
-version: 2
-schedule: "0 4 * * *"
-command: akm index
-enabled: true
-description: Nightly incremental index refresh
+version: 3
+run: akm index
+akm:
+  schedule: "0 4 * * *"
+  enabled: true
+  description: Nightly incremental index refresh

package/dist/assets/tasks/core/sync.yml

@@ -1,5 +1,6 @@
-version: 2
-schedule: "*/15 * * * *"
-command: akm sync
-enabled: true
-description: Sync stash changes to git remote every 15 min
+version: 3
+run: akm sync
+akm:
+  schedule: "*/15 * * * *"
+  enabled: true
+  description: Sync stash changes to git remote every 15 min

package/dist/assets/tasks/core/version-check.yml

@@ -1,5 +1,6 @@
-version: 2
-schedule: "0 9 * * 1"
-command: akm upgrade --check
-enabled: true
-description: Weekly check for new akm releases
+version: 3
+run: akm upgrade --check
+akm:
+  schedule: "0 9 * * 1"
+  enabled: true
+  description: Weekly check for new akm releases

package/dist/assets/tasks/improve/akm-graph-refresh-weekly.yml

@@ -1,5 +1,6 @@
-version: 2
-schedule: "10 3 * * 0"
-command: akm improve --strategy graph-refresh --skip-if-locked
-enabled: true
-description: Full-corpus graph rebuild (weekly Sunday 3:10am)
+version: 3
+run: akm improve --strategy graph-refresh --skip-if-locked
+akm:
+  schedule: "10 3 * * 0"
+  enabled: true
+  description: Full-corpus graph rebuild (weekly Sunday 3:10am)

package/dist/assets/tasks/improve/akm-improve-catchup.yml

@@ -1,8 +1,9 @@
-version: 2
-schedule: "0 4 * * *"
-command: akm improve --strategy catchup --skip-if-locked
+version: 3
+run: akm improve --strategy catchup --skip-if-locked
+akm:
+  schedule: "0 4 * * *"
 # Manual-recovery task: ships disabled (the retired registerDefaultTasks
 # marked it enableMode: "manual"). `akm task run` works while disabled;
 # opting into the schedule is `enabled: true` + `akm task sync`.
-enabled: false
-description: Manual recovery — consolidation + triage drain (run on demand via `akm task run akm-improve-catchup`)
+  enabled: false
+  description: Manual recovery — consolidation + triage drain (run on demand via `akm task run akm-improve-catchup`)

package/dist/assets/tasks/improve/akm-improve-consolidate.yml

@@ -1,5 +1,6 @@
-version: 2
-schedule: "20 */4 * * *"
-command: akm improve --strategy consolidate --skip-if-locked
-enabled: true
-description: Consolidation-only pass (every 4h at :20)
+version: 3
+run: akm improve --strategy consolidate --skip-if-locked
+akm:
+  schedule: "20 */4 * * *"
+  enabled: true
+  description: Consolidation-only pass (every 4h at :20)

package/dist/assets/tasks/improve/akm-improve-frequent.yml

@@ -1,5 +1,6 @@
-version: 2
-schedule: "40 * * * *"
-command: akm improve --strategy frequent --skip-if-locked
-enabled: true
-description: Frequent inference pass (hourly at :40; improve-stage extract off)
+version: 3
+run: akm improve --strategy frequent --skip-if-locked
+akm:
+  schedule: "40 * * * *"
+  enabled: true
+  description: Frequent inference pass (hourly at :40; improve-stage extract off)

package/dist/assets/tasks/improve/akm-improve-nightly.yml

@@ -1,5 +1,6 @@
-version: 2
-schedule: "15 2 * * *"
-command: akm improve --strategy thorough --skip-if-locked
-enabled: true
-description: Full nightly quality sweep (daily 2:15am; suggested for server installs)
+version: 3
+run: akm improve --strategy thorough --skip-if-locked
+akm:
+  schedule: "15 2 * * *"
+  enabled: true
+  description: Full nightly quality sweep (daily 2:15am; suggested for server installs)

package/dist/cli/confirm.js

@@ -32,8 +32,8 @@
  *
  * ## Safety exemptions
  *
- * `--quiet` NEVER suppresses the confirmation prompt — it is safety-critical
- * output. The auto-migration banner is similarly exempt from `--quiet`.
+ * `--quiet` NEVER suppresses the confirmation prompt because it is
+ * safety-critical output.
  */
 import { UsageError } from "../core/errors.js";
 import * as p from "./clack.js";

package/dist/cli/parse-args.js

@@ -45,9 +45,9 @@ export function parsePositiveIntFlag(raw, flagName = "--limit") {
     const trimmed = raw.trim();
     if (!trimmed)
         return undefined;
-    // Strict digits, matching parseNonNegativeIntFlag below. parseInt stops at the
-    // first non-digit, so "10x" silently became 10, "3.5" became 3, and
-    // "5 apples" became 5 — accepted rather than rejected as invalid.
+    // Strict digits: parseInt stops at the first non-digit, so "10x" silently
+    // became 10, "3.5" became 3, and "5 apples" became 5 — accepted rather than
+    // rejected as invalid.
     if (!/^\d+$/.test(trimmed)) {
         throw new UsageError(`Invalid ${flagName} value: "${raw}". Must be a positive integer.`, "INVALID_FLAG_VALUE");
     }
@@ -57,27 +57,6 @@ export function parsePositiveIntFlag(raw, flagName = "--limit") {
     }
     return parsed;
 }
-/**
- * Parse a non-negative integer flag value (0 is allowed, unlike `parsePositiveIntFlag`).
- *
- * Returns `undefined` when `raw` is `undefined` or empty (flag not supplied).
- * Throws `UsageError` when the raw value is present but not a valid non-negative
- * integer (e.g. contains decimals, letters, or is negative).
- *
- * @param raw       The raw string value (may be undefined).
- * @param flagName  The flag name to include in the error message.
- */
-export function parseNonNegativeIntFlag(raw, flagName) {
-    if (raw === undefined)
-        return undefined;
-    const trimmed = raw.trim();
-    if (!trimmed)
-        return undefined;
-    if (!/^\d+$/.test(trimmed)) {
-        throw new UsageError(`Invalid ${flagName} value: "${raw}". Must be a non-negative integer.`, "INVALID_FLAG_VALUE");
-    }
-    return parseInt(trimmed, 10);
-}
 // ── String flag parsing ──────────────────────────────────────────────────────
 /**
  * Extract a string value from a parsed citty argument object by key.

package/dist/cli/retired-commands.js

@@ -45,7 +45,7 @@ const RETIRED_COMMAND_HINTS = {
     mv: "`akm mv` was removed in 0.9 — move the file, then run `akm index` and `akm lint` (to carry ranking signal: `bun scripts/rekey-asset-ref.ts <old-ref> <new-ref>`).",
     // Pre-0.9 removals agents still trip over.
     wiki: "the `akm wiki` family was removed in 0.9 — wikis are ordinary knowledge assets; ingest with `akm import <url> --path <subdir>`.",
-    backup: "`akm backup` was removed in 0.9 — backups belong to the standalone `akm-migrate backup` tool.",
+    backup: "`akm backup` was removed in 0.9 — stop writers and archive current config, data, state, and writable bundles with your normal backup tooling.",
     vault: "the `akm vault ...` family was removed in 0.9 — use `akm env list`/`akm env create` for a whole `.env` group, or `akm secret set <name>` for a single sensitive value.",
     // Group-scoped retirements.
     "env set": "`akm env set` was removed in 0.9 — edit the `.env` file directly; akm loads it as-is.",

package/dist/cli/shared.js

@@ -172,8 +172,8 @@ export const GLOBAL_OUTPUT_ARGS = {
         type: "boolean",
         alias: "q",
         description: "Suppress non-essential stderr output (banners, spinners, progress info) (global flag). " +
-            "Safety-critical output is never suppressed: errors, destructive-action confirmation prompts, " +
-            "and auto-migration banners always appear regardless of --quiet.",
+            "Safety-critical output is never suppressed: errors and destructive-action confirmation prompts " +
+            "always appear regardless of --quiet.",
         default: false,
     },
     verbose: {

package/dist/cli.js

@@ -2,22 +2,22 @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
-// Runtime guard: the akm-cli npm package bootstraps with Node.js >= 22
+// Runtime guard: the akm-cli npm package bootstraps with Node.js >= 24
 // (#465, #560), then its launcher prefers a working Bun >= 1.0 when available.
 // The runtime boundary (src/runtime.ts, src/storage/database.ts) supports both.
 // Under Node the CLI must be launched via the
 // `dist/cli-node.mjs` wrapper, which registers the text-import loader hook
 // before this module graph loads; running `node dist/cli.js` directly still
 // works for code paths that touch no embedded text asset, but the wrapper is
-// the supported entry. The hard floor is Node 22 (Node 20 support dropped 2026-07; `@clack/core` imports
-// `node:util`'s `styleText` (added in Node 20.12) — Node 18 (EOL) throws at import.
+// the supported entry. The hard floor is Node 24; Node 22 is no longer a
+// supported npm bootstrap runtime.
 {
     const isBun = typeof globalThis.Bun !== "undefined";
     if (!isBun) {
         const [major = 0] = (process.versions.node ?? "0").split(".").map((part) => Number.parseInt(part, 10) || 0);
-        const nodeOk = major >= 22;
+        const nodeOk = major >= 24;
         if (!nodeOk) {
-            console.error("\n  ERROR: the akm-cli npm package requires Node.js >= 22.\n" +
+            console.error("\n  ERROR: the akm-cli npm package requires Node.js >= 24.\n" +
                 `  Detected Node.js ${process.versions.node ?? "unknown"}.\n` +
                 "  Bun >= 1.0 is optional for execution; it does not replace the Node.js bootstrap.\n" +
                 "  Upgrade Node.js (https://nodejs.org), or install the runtime-free standalone binary:\n" +
@@ -62,6 +62,7 @@ import { retiredCommandHint } from "./cli/retired-commands.js";
 import { defineGroupCommand, EXIT_CODES, emitJsonError, GLOBAL_OUTPUT_ARGS, output, runWithJsonErrors, } from "./cli/shared.js";
 import { assertKnownFlags, closestMatch } from "./cli/unknown-flags.js";
 import { agentCommand, lintCommand } from "./commands/agent/contribute-cli.js";
+import { commandCommand } from "./commands/command/command-cli.js";
 import { generateBashCompletions, installBashCompletions } from "./commands/completions.js";
 import { configCommand } from "./commands/config-cli.js";
 import { envCommand } from "./commands/env/env-cli.js";
@@ -72,6 +73,7 @@ import "./commands/health/renderers.js";
 import { parseWindowSpec } from "./commands/health/windows.js";
 import { improveCommand } from "./commands/improve/improve-cli.js";
 import { migrateCommand } from "./commands/migrate-cli.js";
+import { modelsCommand } from "./commands/models-cli.js";
 import { logCommand } from "./commands/observability-cli.js";
 import { proposalCommand } from "./commands/proposal/proposal-cli.js";
 import { rememberCommand } from "./commands/read/remember-cli.js";
@@ -85,7 +87,6 @@ import { taskCommand } from "./commands/tasks/tasks-cli.js";
 import { workflowCommand } from "./commands/workflow-cli.js";
 import { DEFAULT_CONFIG, loadConfig } from "./core/config/config.js";
 import { UsageError } from "./core/errors.js";
-import { assertNoPendingMigrationOperation } from "./core/migration-operation.js";
 import { getConfigPath } from "./core/paths.js";
 import { DURATION_UNITS, parseDuration } from "./core/time.js";
 import { plainize } from "./core/tty.js";
@@ -449,6 +450,7 @@ const commands = {
     feedback: feedbackCommand,
     log: logCommand,
     agent: agentCommand,
+    command: commandCommand,
     lint: lintCommand,
     improve: improveCommand,
     proposal: proposalCommand,
@@ -456,6 +458,7 @@ const commands = {
     env: envCommand,
     secret: secretCommand,
     task: taskCommand,
+    models: modelsCommand,
     hints: hintsCommand,
 };
 function commandHelpTopic(name, command) {
@@ -730,7 +733,7 @@ const HELP_SECTIONS = [
         title: "ASSETS",
         commands: ["import", "clone", "bundle", "env", "secret", "sync", "proposal"],
     },
-    { title: "AUTOMATION", commands: ["improve", "agent", "workflow", "task"] },
+    { title: "AUTOMATION", commands: ["improve", "agent", "command", "workflow", "task"] },
     {
         title: "SYSTEM",
         commands: [
@@ -739,6 +742,7 @@ const HELP_SECTIONS = [
             "lint",
             "health",
             "config",
+            "models",
             "registry",
             "info",
             "log",
@@ -927,8 +931,6 @@ async function runCli() {
     // rather than letting the raw exception escape with a stack trace.
     try {
         applyEarlyStderrFlags(process.argv);
-        if (isTaskRunWithId(process.argv))
-            assertNoPendingMigrationOperation();
         const bypassConfig = shouldBypassConfigStartup(process.argv);
         initOutputMode(process.argv, bypassConfig ? (DEFAULT_CONFIG.output ?? {}) : (loadConfig().output ?? {}));
     }