akm-cli 0.9.1 → 0.9.2-alpha.2

package/dist/setup/registry-stash-loader.js

@@ -8,19 +8,29 @@
  * using a cached result when available. Falls back to FALLBACK_STASHES
  * when the registry is unreachable or returns no results.
  *
- * Adding a new default-selected stash: append its registry ID to
- * DEFAULT_SELECTED_STASH_IDS below. No other change required.
+ * Default-selected registry IDs are also bound to an authenticated install
+ * target below so a configured registry cannot preselect a different source
+ * merely by reusing a trusted display ID.
  */
+import { jsonWithByteCap } from "../core/common.js";
+import { hasRegistryUrlCredentials } from "../core/registry-url.js";
+import { allowPrivateRegistryFixtureForTests, cancelRegistryResponse, fetchRegistryResponse, } from "../registry/network.js";
+import { parseRegistryRef } from "../registry/resolve.js";
 // ── Default selections ──────────────────────────────────────────────────────
 /**
  * Registry stash IDs that are pre-selected by default during setup.
- * To add a new default stash: append its registry ID here.
- * IDs must match the `id` field in the official registry index.
+ * IDs must match the `id` field in the official registry index and have a
+ * matching target in AUTHENTICATED_DEFAULT_TARGETS.
  *
- * This is the single source of truth for which stashes are pre-checked
- * in the setup wizard. No other change is required to adjust defaults.
+ * The target binding is intentionally separate from display metadata.
  */
 export const DEFAULT_SELECTED_STASH_IDS = ["itlackey/akm-stash"];
+const AUTHENTICATED_DEFAULT_TARGETS = {
+    "itlackey/akm-stash": {
+        installType: "git",
+        url: "https://github.com/itlackey/akm-stash",
+    },
+};
 // ── Fallback list ───────────────────────────────────────────────────────────
 /**
  * Hardcoded stash list used when the registry is unreachable.
@@ -32,6 +42,7 @@ const FALLBACK_STASHES = [
         name: "itlackey/akm-stash",
         description: "Official AKM onboarding bundle",
         url: "https://github.com/itlackey/akm-stash",
+        installType: "git",
         source: "fallback",
         defaultSelected: true,
     },
@@ -40,6 +51,7 @@ const FALLBACK_STASHES = [
         name: "andrewyng/context-hub",
         description: "Optional community prompt and context bundle",
         url: "https://github.com/andrewyng/context-hub",
+        installType: "git",
         source: "fallback",
         defaultSelected: false,
     },
@@ -62,19 +74,27 @@ export function _setLoadSetupStashesForTests(fake) {
  * @param timeoutMs    Fetch timeout in ms (default: 4000).
  */
 export async function loadSetupStashes(registryUrl, timeoutMs = 4000) {
+    if (hasRegistryUrlCredentials(registryUrl))
+        return FALLBACK_STASHES;
     if (loadSetupStashesOverride)
         return loadSetupStashesOverride(registryUrl, timeoutMs);
     return loadSetupStashesReal(registryUrl, timeoutMs);
 }
 async function loadSetupStashesReal(registryUrl, timeoutMs = 4000) {
     try {
-        const response = await fetch(registryUrl, {
-            signal: AbortSignal.timeout(timeoutMs),
-            headers: { Accept: "application/json" },
+        const response = await fetchRegistryResponse(registryUrl, { headers: { Accept: "application/json" } }, {
+            policy: { kind: "public-registry" },
+            timeoutMs,
+            retries: 0,
+            allowPrivateHostsForTesting: allowPrivateRegistryFixtureForTests(registryUrl),
         });
-        if (!response.ok)
+        if (!response.ok) {
+            await cancelRegistryResponse(response);
             return FALLBACK_STASHES;
-        const raw = (await response.json());
+        }
+        const raw = await jsonWithByteCap(response, 10 * 1024 * 1024, {
+            bodyTimeoutMs: timeoutMs,
+        });
         if (!Array.isArray(raw.stashes) || raw.stashes.length === 0)
             return FALLBACK_STASHES;
         const entries = raw.stashes.flatMap((item) => {
@@ -84,22 +104,17 @@ async function loadSetupStashesReal(registryUrl, timeoutMs = 4000) {
             const id = typeof s.id === "string" ? s.id : "";
             const name = typeof s.name === "string" ? s.name : id;
             const description = typeof s.description === "string" ? s.description : "";
-            // Prefer github/git source URL built from the ref; fall back to homepage
-            const url = (s.source === "github" || s.source === "git") && typeof s.ref === "string"
-                ? `https://github.com/${s.ref.replace(/^github:/, "")}`
-                : typeof s.homepage === "string"
-                    ? s.homepage
-                    : "";
-            if (!id || !url)
+            const target = setupInstallTarget(s.source, s.ref);
+            if (!id || !target)
                 return [];
             return [
                 {
                     id,
                     name,
                     description,
-                    url,
+                    ...target,
                     source: "registry",
-                    defaultSelected: DEFAULT_SELECTED_STASH_IDS.includes(id),
+                    defaultSelected: authenticatedDefaultTarget(id, target),
                 },
             ];
         });
@@ -109,3 +124,32 @@ async function loadSetupStashesReal(registryUrl, timeoutMs = 4000) {
         return FALLBACK_STASHES;
     }
 }
+function authenticatedDefaultTarget(id, target) {
+    const expected = AUTHENTICATED_DEFAULT_TARGETS[id];
+    return expected?.installType === target.installType && expected.url === target.url;
+}
+function setupInstallTarget(source, ref) {
+    if (typeof ref !== "string")
+        return undefined;
+    try {
+        if (source === "npm") {
+            const candidate = ref.startsWith("npm:") ? ref : `npm:${ref}`;
+            const parsed = parseRegistryRef(candidate);
+            return parsed.source === "npm" ? { installType: "npm", url: candidate } : undefined;
+        }
+        if (source === "github") {
+            const candidate = ref.startsWith("github:") ? ref : `github:${ref}`;
+            const parsed = parseRegistryRef(candidate);
+            if (parsed.source !== "github")
+                return undefined;
+            return {
+                installType: "git",
+                url: `https://github.com/${encodeURIComponent(parsed.owner)}/${encodeURIComponent(parsed.repo)}`,
+            };
+        }
+    }
+    catch {
+        // Malformed registry install refs are omitted without breaking setup.
+    }
+    return undefined;
+}

package/dist/setup/semantic-assets.js

@@ -2,18 +2,16 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 /**
- * Semantic-search asset preparation for the setup wizard. Isolates the one
- * `bun add @huggingface/transformers` subprocess and the sqlite-vec probe so
- * the rest of setup stays free of subprocess/DB I/O.
+ * Semantic-search asset preparation for the setup wizard. Transformers.js is
+ * a normal external package dependency; setup never mutates the installed CLI.
+ * This module only prepares the model and probes sqlite-vec.
  */
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import * as p from "../cli/clack.js";
 import { isHttpUrl } from "../core/common.js";
-import { runManagedSubprocess } from "../core/subprocess.js";
 import { checkEmbeddingAvailability, DEFAULT_LOCAL_MODEL, isTransformersAvailable } from "../llm/embedder.js";
-import { getDirname } from "../runtime.js";
 import { closeDatabase, openIndexDatabase } from "../storage/repositories/index-connection.js";
 import { isVecAvailable } from "../storage/repositories/index-vec-repository.js";
 // Approximate first-download sizes used in the setup note.
@@ -41,34 +39,12 @@ export function describeSemanticSearchAssets(embedding) {
 }
 export async function prepareSemanticSearchAssets(config) {
     const remote = isRemoteEmbeddingConfig(config.embedding);
-    // For local embeddings, ensure the required package is installed first.
+    // Local embeddings require the declared Transformers dependency.
     if (!remote) {
         if (!isTransformersAvailable()) {
-            const spin = p.spinner();
-            spin.start("Installing @huggingface/transformers...");
-            try {
-                const pkgRoot = path.resolve(getDirname(import.meta.url), "../..");
-                // Bounded (10 min) so a stalled `bun add` can't hang setup forever.
-                const result = await runManagedSubprocess(["bun", "add", "@huggingface/transformers"], {
-                    capture: true,
-                    cwd: pkgRoot,
-                    timeoutMs: 10 * 60_000,
-                });
-                if (result.spawnError)
-                    throw result.spawnError;
-                if (result.exitCode !== 0) {
-                    throw new Error(result.stderr || `exit code ${result.exitCode}`);
-                }
-                spin.stop("@huggingface/transformers installed.");
-            }
-            catch (err) {
-                const msg = err instanceof Error ? err.message : String(err);
-                spin.stop("Could not install @huggingface/transformers.");
-                p.log.warn(`Automatic install failed: ${msg}\n` +
-                    "Install it manually with: bun add @huggingface/transformers\n" +
-                    "Then re-run `akm setup` or `akm index --full --verbose`.");
-                return { ok: false, reason: "missing-package", message: `Automatic install failed: ${msg}` };
-            }
+            const message = "The @huggingface/transformers dependency is unavailable. Reinstall akm-cli, then re-run `akm setup` or `akm index --full --verbose`.";
+            p.log.warn(message);
+            return { ok: false, reason: "missing-package", message };
         }
     }
     const spin = p.spinner();
@@ -83,9 +59,8 @@ export async function prepareSemanticSearchAssets(config) {
             return { ok: false, reason: "remote-network", message: "The remote embedding endpoint is not reachable." };
         }
         else if (result.reason === "missing-package") {
-            p.log.warn("@huggingface/transformers is not installed. Install it with: bun add @huggingface/transformers\n" +
-                "Then re-run `akm setup` or `akm index --full --verbose`.");
-            return { ok: false, reason: "missing-package", message: "@huggingface/transformers is not installed." };
+            p.log.warn("The @huggingface/transformers dependency is unavailable. Reinstall akm-cli, then re-run `akm setup` or `akm index --full --verbose`.");
+            return { ok: false, reason: "missing-package", message: "The local embedding runtime is unavailable." };
         }
         else {
             p.log.warn(`The local embedding model could not be downloaded: ${result.message}\n` +

package/dist/setup/setup.js

@@ -41,6 +41,7 @@ import { detectHarnessConfigs } from "./harness-config-import.js";
 import { bail, prompt } from "./prompt.js";
 import { PROVIDER_DEFAULTS } from "./providers.js";
 import { prepareSemanticSearchAssets } from "./semantic-assets.js";
+import { canonicalSetupGitUrl } from "./source-identity.js";
 import { createSetupContext, runSetupSteps } from "./steps.js";
 import { stepAgentConnection, stepLlm, stepOllama, stepSmallModelConnection } from "./steps/connection.js";
 import { stepOutputConfig } from "./steps/output.js";
@@ -66,7 +67,7 @@ import { stepScheduledTasks } from "./steps/tasks.js";
  * rules fire and config + cache writes route into `$stashDir/.akm/`
  * instead of the user's host `~/.config/akm`.
  */
-function assertSetupSandbox(stashDir, dirExplicitlyProvided) {
+export function assertSetupSandbox(stashDir, dirExplicitlyProvided) {
     if (!dirExplicitlyProvided)
         return;
     if (process.env.AKM_FORCE_SETUP_TMP_STASH === "1")
@@ -102,28 +103,10 @@ function applyStashIsolationToEnv(stashDir, dirExplicitlyProvided) {
 /**
  * Raw preflight used before setup performs prompts, initialization, or writes.
  *
- * `setup` is allowlisted in `shouldBypassConfigStartup` (src/cli.ts) so it
- * never dies on the CLI's own startup config load — but every entry point
- * below (`runSetupWizard`, `runSetupWithDefaults`, `runSetupFromConfig`,
- * `runResetRecommended`) still needs the CURRENT config as its merge base, so
- * this is the first thing each one calls. When the on-disk config predates
- * 0.9 (or is otherwise unparseable/invalid), `parseAndValidateConfigText`
- * throws `ConfigError`; deliberately let that propagate rather than falling
- * back to a fresh default config here.
- *
- * That fallback was considered and rejected: `mutateConfigWithPrecommit`
- * (src/core/config/config.ts) re-reads and re-validates this SAME file
- * inside its write lock before saving, so a wizard that "survived" this
- * preflight by substituting `DEFAULT_CONFIG` would still crash with the
- * identical error at the final save — after prompting the user through the
- * entire wizard. Worse, making the save path itself tolerate an old config
- * would mean writing a freshly-generated 0.9 config over the live 0.8 file
- * `akm migrate apply` needs to read as ITS OWN input — replacing the user's
- * real engine/source settings with the wizard's placeholder ones, silently,
- * on the one path (`akm migrate ...`) the upgrade docs tell users to run
- * first. Refusing here — before any prompt, detection, or write — is strictly
- * safer: the file is left byte-for-byte untouched and the error message
- * below points straight at the real recovery command.
+ * Setup merges into a current config, so it rejects an unreadable or obsolete
+ * file before prompting or writing. There is no runtime config translator: an
+ * operator who wants a fresh setup moves the old file aside, while an operator
+ * who wants to preserve its values rewrites them into the current schema.
  */
 export function assertSetupConfigPreflight() {
     const configPath = getConfigPath();
@@ -145,8 +128,7 @@ export function assertSetupConfigPreflight() {
         if (error.code !== "UNSUPPORTED_CONFIG_VERSION" && error.code !== "INVALID_CONFIG_FILE")
             throw error;
         throw new ConfigError(`\`akm setup\` cannot run: the config at ${configPath} did not load (${error.message}). ` +
-            "It was left untouched — setup never writes over a config it cannot first read cleanly.", error.code, "Run `akm migrate status` to check what this config needs before continuing, or `akm help migrate 0.9.0` " +
-            "for the full upgrade checklist. To abandon it and start fresh instead, move it aside " +
+            "It was left untouched — setup never writes over a config it cannot first read cleanly.", error.code, "Rewrite the file using the current config schema, or move it aside to start fresh " +
             `(e.g. \`mv ${configPath} ${configPath}.bak\`) and re-run \`akm setup\`.`);
     }
 }
@@ -261,10 +243,10 @@ function setupSourceDescriptor(source) {
 }
 function selectsExistingBundle(source, id, bundle) {
     const configured = bundleEntryToSourceEntry(id, bundle);
-    return (configured !== undefined &&
-        configured.type === source.type &&
-        configured.path === source.path &&
-        configured.url === source.url);
+    const sameUrl = configured?.type === "git" && source.type === "git" && configured.url && source.url
+        ? canonicalSetupGitUrl(configured.url) === canonicalSetupGitUrl(source.url)
+        : configured?.url === source.url;
+    return configured !== undefined && configured.type === source.type && configured.path === source.path && sameUrl;
 }
 /** Convert only the wizard's private drafts, leaving current bundle entries intact. */
 function finalizeSetupDraft(draft) {
@@ -914,7 +896,7 @@ export async function runSetupFromConfig(opts) {
     // Phase 2: Validate — only allow safe top-level keys
     for (const key of ["stashDir", "sources", "installed"]) {
         if (key in incoming) {
-            throw new ConfigError(`${key} is not supported by the current config schema; run the standalone akm-migrate tool first.`, "INVALID_CONFIG_FILE");
+            throw new ConfigError(`${key} is not supported by the current config schema; configure bundles/defaultBundle instead.`, "INVALID_CONFIG_FILE");
         }
     }
     // Derived from AkmConfigShape (via `listTopLevelConfigKeys`) rather than a

package/dist/setup/source-identity.js

@@ -0,0 +1,17 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/**
+ * Canonical identity for Git sources selected by setup.
+ *
+ * Git accepts a terminal `.git` suffix as an optional spelling of the same
+ * remote. Registry, fallback, and historical setup entries have used both
+ * forms, so comparisons must not turn that spelling difference into a second
+ * configured bundle.
+ */
+export function canonicalSetupGitUrl(value) {
+    return value
+        .trim()
+        .replace(/\/+$/, "")
+        .replace(/\.git$/i, "");
+}

package/dist/setup/steps/sources.js

@@ -11,9 +11,20 @@ import { DEFAULT_CONFIG, getEffectiveRegistries, getSources } from "../../core/c
 import { readLockfile } from "../../integrations/lockfile.js";
 import { prompt, promptOrBack } from "../prompt.js";
 import { loadSetupStashes } from "../registry-stash-loader.js";
+import { canonicalSetupGitUrl } from "../source-identity.js";
 function configuredSourceKey(source) {
     return `${source.type}:${source.path ?? source.url ?? source.name ?? "unknown"}`;
 }
+function configuredSourceTarget(source) {
+    return source.type === "npm" ? source.path : source.url;
+}
+function configuredSourceIdentity(source) {
+    const target = configuredSourceTarget(source);
+    return source.type === "git" && target ? canonicalSetupGitUrl(target) : target;
+}
+function recommendedSourceIdentity(entry) {
+    return entry.installType === "git" ? canonicalSetupGitUrl(entry.url) : entry.url;
+}
 function describeConfiguredSource(source) {
     const target = source.path ?? source.url ?? "(unknown target)";
     const typeLabel = source.type === "git" ? "Git" : source.type === "filesystem" ? "Filesystem" : source.type;
@@ -68,10 +79,13 @@ export async function stepAdditionalSources(currentSources) {
             }));
             if (name === null)
                 continue;
-            const entry = { type: "git", url: url.trim() };
+            const entryUrl = url.trim();
+            const entry = { type: "git", url: entryUrl };
             if (name.trim())
                 entry.name = name.trim();
-            if (!sources.some((s) => s.url === entry.url)) {
+            if (!sources.some((source) => source.type === "git" &&
+                source.url !== undefined &&
+                canonicalSetupGitUrl(source.url) === canonicalSetupGitUrl(entryUrl))) {
                 sources.push(entry);
             }
             else {
@@ -183,16 +197,18 @@ export async function stepAddSources(current, options) {
         "https://raw.githubusercontent.com/itlackey/akm-registry/main/index.json";
     const availableStashes = await loadSetupStashes(registryUrl);
     if (availableStashes.length > 0) {
-        const existingUrls = new Set(sources.map((s) => s.url));
+        const existingTargets = new Set(sources.map(configuredSourceIdentity).filter((value) => !!value));
         const stashOptions = availableStashes.map((s) => ({
-            value: s.url,
+            value: recommendedSourceIdentity(s),
             label: s.name,
-            hint: existingUrls.has(s.url) ? `${s.description} (already added)` : s.description || s.source,
+            hint: existingTargets.has(recommendedSourceIdentity(s))
+                ? `${s.description} (already added)`
+                : s.description || s.source,
         }));
         // Pre-check: already-installed stashes OR default-selected on fresh install
         const initialValues = sources.length > 0
-            ? stashOptions.filter((o) => existingUrls.has(o.value)).map((o) => o.value)
-            : availableStashes.filter((s) => s.defaultSelected).map((s) => s.url);
+            ? stashOptions.filter((o) => existingTargets.has(o.value)).map((o) => o.value)
+            : availableStashes.filter((s) => s.defaultSelected).map(recommendedSourceIdentity);
         const selectedUrls = await prompt(() => p.multiselect({
             message: availableStashes[0]?.source === "registry"
                 ? "Available bundles from the AKM registry — toggle to add or remove:"
@@ -202,20 +218,25 @@ export async function stepAddSources(current, options) {
             required: false,
         }));
         // Add newly selected stashes
-        for (const url of selectedUrls) {
-            if (!existingUrls.has(url)) {
-                const entry = availableStashes.find((s) => s.url === url);
-                sources.push({ type: "git", url, name: entry?.name });
-                existingUrls.add(url);
+        for (const target of selectedUrls) {
+            if (!existingTargets.has(target)) {
+                const entry = availableStashes.find((s) => recommendedSourceIdentity(s) === target);
+                if (!entry)
+                    continue;
+                sources.push(entry.installType === "npm"
+                    ? { type: "npm", path: target, name: entry.name }
+                    : { type: "git", url: target, name: entry.name });
+                existingTargets.add(target);
             }
         }
         // Remove deselected stashes that were previously configured
         for (const entry of availableStashes) {
-            if (existingUrls.has(entry.url) && !selectedUrls.includes(entry.url)) {
-                const idx = sources.findIndex((s) => s.url === entry.url);
+            const target = recommendedSourceIdentity(entry);
+            if (existingTargets.has(target) && !selectedUrls.includes(target)) {
+                const idx = sources.findIndex((source) => configuredSourceIdentity(source) === target);
                 if (idx !== -1) {
                     sources.splice(idx, 1);
-                    existingUrls.delete(entry.url);
+                    existingTargets.delete(target);
                     p.log.info(`Removed ${entry.name}.`);
                 }
             }

package/dist/setup/steps/tasks.js

@@ -7,14 +7,14 @@ import os from "node:os";
 import path from "node:path";
 import { parse as yamlParse, stringify as yamlStringify } from "yaml";
 import * as p from "../../cli/clack.js";
-import { akmTasksSync, setEnabledInYaml } from "../../commands/tasks/tasks.js";
+import { akmTasksSync } from "../../commands/tasks/tasks.js";
 import { loadConfig } from "../../core/config/config.js";
 import { UsageError } from "../../core/errors.js";
 import { commitWriteTargetBoundary, deleteAssetFromSource, prepareWriteTargetForMutation, resolveWriteTarget, writeAssetToSource, } from "../../core/write-source.js";
 import { backendNameForPlatform } from "../../tasks/backends/index.js";
 import { listEmbeddedTasks } from "../../tasks/embedded.js";
-import { parseTaskDocument } from "../../tasks/parser.js";
 import { parseSchedule } from "../../tasks/schedule.js";
+import { parseTaskV3Yaml } from "../../tasks/source-v3.js";
 import { prompt } from "../prompt.js";
 /**
  * A scheduled server-only nightly full sweep exists among the embedded
@@ -71,6 +71,15 @@ export function detectServerDefault() {
 function normaliseTaskIdForMatch(raw) {
     return raw.trim().replace(/\.(yml|md)$/, "");
 }
+function setTaskV3EnabledInYaml(yaml, enabled) {
+    const document = yamlParse(yaml);
+    const akm = document.akm;
+    if (!akm || typeof akm !== "object" || Array.isArray(akm)) {
+        throw new UsageError("Task v3 source must declare an akm mapping before setup can change enabled state.");
+    }
+    akm.enabled = enabled;
+    return yamlStringify(document);
+}
 export function listSetupTaskDefinitions() {
     const config = loadConfig();
     const target = resolveWriteTarget(config, config.defaultBundle, { requireWritable: false });
@@ -84,8 +93,21 @@ export function listSetupTaskDefinitions() {
         const id = file.slice(0, -4);
         const filePath = path.join(taskDir, file);
         try {
-            const task = parseTaskDocument({ yaml: fs.readFileSync(filePath, "utf8"), filePath, id });
-            tasks.push({ id: task.id, schedule: task.schedule, enabled: task.enabled, description: task.description });
+            const task = parseTaskV3Yaml({
+                yaml: fs.readFileSync(filePath, "utf8"),
+                filePath,
+                workspaceRoot: target.source.path,
+            });
+            if (task.triggers.schedules.length === 0)
+                continue;
+            const schedules = task.triggers.schedules.map((schedule) => schedule.cron);
+            tasks.push({
+                id,
+                schedule: schedules[0],
+                schedules: Object.freeze(schedules),
+                enabled: task.akm?.enabled !== false,
+                ...(task.akm?.description !== undefined ? { description: task.akm.description } : {}),
+            });
         }
         catch (error) {
             throw new UsageError(`Cannot review task definition ${filePath}: ${error instanceof Error ? error.message : String(error)} ` +
@@ -106,16 +128,19 @@ export async function prepareSetupTaskDefinitions(tasks, deps = {}) {
         const original = fs.existsSync(filePath) ? fs.readFileSync(filePath, "utf8") : undefined;
         let yaml;
         if (original !== undefined) {
-            yaml = setEnabledInYaml(original, plan.enabled);
+            yaml = setTaskV3EnabledInYaml(original, plan.enabled);
         }
         else {
             const document = yamlParse(plan.task.yaml);
-            document.schedule = plan.schedule;
-            document.enabled = plan.enabled;
+            const akm = document.akm;
+            akm.schedule = plan.schedule;
+            akm.enabled = plan.enabled;
             yaml = yamlStringify(document);
         }
-        parseTaskDocument({ yaml, filePath, id: plan.task.id });
-        parseSchedule(plan.schedule, backendNameForPlatform());
+        const parsed = parseTaskV3Yaml({ yaml, filePath, workspaceRoot: target.source.path });
+        for (const schedule of parsed.triggers.schedules) {
+            parseSchedule(schedule.cron, backendNameForPlatform());
+        }
         return { filePath, original, yaml, ref: { type: "task", name: plan.task.id } };
     });
     const changed = prepared.filter((entry) => entry.original !== entry.yaml);
@@ -198,7 +223,7 @@ export async function stepScheduledTasks(deps = DEFAULT_SCHEDULED_TASKS_DEPS, op
         initialValues: preChecked,
         options: embedded.map((task) => {
             const current = byId.get(task.id);
-            const schedule = current?.schedule ?? task.schedule;
+            const schedule = current ? displayTaskSchedules(current) : task.schedule;
             const state = current ? (current.enabled ? "enabled" : "disabled") : "not prepared";
             return {
                 value: task.id,
@@ -241,7 +266,7 @@ export async function stepScheduledTasks(deps = DEFAULT_SCHEDULED_TASKS_DEPS, op
     const custom = installed.filter((task) => !embeddedIds.has(normaliseTaskIdForMatch(task.id)));
     p.note([
         ...plans.map((plan) => `${plan.task.label}: ${plan.enabled ? "enabled" : "disabled"} | ${plan.schedule} | ${plan.task.description}`),
-        ...custom.map((task) => `${task.id}: ${task.enabled ? "enabled" : "disabled"} | ${task.schedule}${task.description ? ` | ${task.description}` : ""}`),
+        ...custom.map((task) => `${task.id}: ${task.enabled ? "enabled" : "disabled"} | ${displayTaskSchedules(task)}${task.description ? ` | ${task.description}` : ""}`),
     ].join("\n"), "Task Schedule Review");
     const activate = await prompt(() => p.confirm({
         message: `Activate these schedules now? This will update task files and sync them to the ${backendNameForPlatform()} scheduler.`,
@@ -267,3 +292,6 @@ export async function stepScheduledTasks(deps = DEFAULT_SCHEDULED_TASKS_DEPS, op
     }
     p.log.success("Task schedules activated. Verify them with `akm task doctor`.");
 }
+function displayTaskSchedules(task) {
+    return task.schedules && task.schedules.length > 0 ? task.schedules.join(", ") : task.schedule;
+}

package/dist/sources/providers/git-provider.js

@@ -57,9 +57,9 @@ function resolveGitContentDir(config) {
 // ── Self-register ───────────────────────────────────────────────────────────
 registerSourceProvider("git", (config) => new GitSourceProvider(config));
 // ── Cache management ────────────────────────────────────────────────────────
-export function getCachePaths(repoUrl) {
+export function getCachePaths(repoUrl, cacheRootOverride) {
     const key = createHash("sha256").update(repoUrl).digest("hex").slice(0, 16);
-    const cacheRoot = getRegistryIndexCacheDir();
+    const cacheRoot = cacheRootOverride ?? getRegistryIndexCacheDir();
     const rootDir = path.join(cacheRoot, `git-${key}`);
     return {
         rootDir,
@@ -101,7 +101,7 @@ export async function syncMirroredRepo(config, options) {
         throw new ConfigError("git stash entry requires a URL when no install ref is supplied");
     }
     const repo = parseGitRepoUrl(config.url);
-    const cachePaths = getCachePaths(repo.canonicalUrl);
+    const cachePaths = getCachePaths(repo.canonicalUrl, options?.cacheRootDir);
     await ensureGitMirror(repo, cachePaths, {
         requireRepoDir: true,
         writable: options?.writable ?? config.writable === true,

package/dist/sources/providers/npm.js

@@ -13,7 +13,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { ConfigError, UsageError } from "../../core/errors.js";
 import { getRegistryCacheDir } from "../../core/paths.js";
-import { parseRegistryRef, resolveRegistryArtifact } from "../../registry/resolve.js";
+import { npmArtifactNetworkPolicy, parseRegistryRef, resolveRegistryArtifact } from "../../registry/resolve.js";
 import { registerSourceProvider } from "../provider-factory.js";
 import { applyAkmIncludeConfig, buildInstallCacheDir, computeFileHash, detectStashRoot, downloadArchive, isDirectory, } from "./provider-utils.js";
 import { extractTarGzSecure, verifyArchiveIntegrity } from "./tar-utils.js";
@@ -108,7 +108,7 @@ async function doSyncNpm(parsed, options) {
     let installRoot;
     let stashRoot;
     try {
-        await downloadArchive(resolved.artifactUrl, archivePath);
+        await downloadArchive(resolved.artifactUrl, archivePath, npmArtifactNetworkPolicy(resolved));
         verifyArchiveIntegrity(archivePath, resolved.resolvedRevision, resolved.source);
         integrity = await computeFileHash(archivePath);
         extractTarGzSecure(archivePath, extractedDir);

package/dist/sources/providers/provider-utils.js

@@ -6,7 +6,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { getAdapters } from "../../core/adapter/registry.js";
 import { stashDirNames } from "../../core/asset/asset-placement.js";
-import { fetchWithRetry } from "../../core/common.js";
+import { cancelRegistryResponse, fetchRegistryResponse } from "../../registry/network.js";
 import { writeResponseToFileCapped } from "../../runtime.js";
 import { copyIncludedPaths, findNearestIncludeConfig } from "../include.js";
 const REGISTRY_STASH_DIR_NAMES = new Set(stashDirNames());
@@ -99,9 +99,10 @@ export function applyAkmIncludeConfig(sourceRoot, cacheDir, searchRoot = sourceR
     return selectedDir;
 }
 /** Stream a remote archive to disk via the runtime boundary's response writer. */
-export async function downloadArchive(url, destination) {
-    const response = await fetchWithRetry(url, undefined, { timeout: 120_000 });
+export async function downloadArchive(url, destination, networkPolicy) {
+    const response = await fetchRegistryResponse(url, undefined, { policy: networkPolicy, timeoutMs: 120_000 });
     if (!response.ok) {
+        await cancelRegistryResponse(response);
         throw new Error(`Failed to download archive (${response.status}) from ${url}`);
     }
     // Stream to disk with an explicit byte cap + body-read deadline: the fetch

package/dist/sources/providers/website.js

@@ -1,12 +1,11 @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
+import { ConfigError } from "../../core/errors.js";
 import { registerSourceProvider } from "../provider-factory.js";
-import { ensureWebsiteMirror, getWebsiteCachePaths, shouldAllowPrivateWebsiteUrlForTests, validateWebsiteUrl, } from "../snapshot-fetchers/website-ingest.js";
-/**
- * Website source provider — thin adapter over the shared website ingest module.
- */
-registerSourceProvider("website", (config) => {
+import { getWebsiteCachePaths, shouldAllowPrivateWebsiteUrlForTests, validateWebsiteUrl } from "../website-url.js";
+/** Website source provider — URL-derived path plus an injected mirror refresh. */
+export function createWebsiteProvider(config) {
     const allowPrivateHosts = shouldAllowPrivateWebsiteUrlForTests(config.url ?? "");
     const url = validateWebsiteUrl(config.url ?? "", { allowPrivateHosts });
     const name = config.name ?? "website";
@@ -17,10 +16,14 @@ registerSourceProvider("website", (config) => {
             return getWebsiteCachePaths(url).rootDir;
         },
         async sync(options) {
+            const ensureWebsiteMirror = options?.ensureWebsiteMirror;
+            if (!ensureWebsiteMirror) {
+                throw new ConfigError("Website provider sync requires an injected ensureWebsiteMirror capability");
+            }
             await ensureWebsiteMirror(config, {
                 requireStashDir: true,
                 force: options?.force,
-                // Feed the resolver into the EXISTING website-ingest plumbing that
+                // Feed the resolver into the injected mirror plumbing that
                 // already threads `resolveSecret` down to `FetcherContext`. This is the
                 // line that closes the bundle-update / sync() gap: previously the X
                 // fetcher on this path saw only `X_BEARER_TOKEN`, never the store.
@@ -29,4 +32,5 @@ registerSourceProvider("website", (config) => {
             });
         },
     };
-});
+}
+registerSourceProvider("website", createWebsiteProvider);