akm-cli 0.9.10 → 0.9.11

package/dist/commands/tasks/validate.js

@@ -0,0 +1,186 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/**
+ * `akm task validate <path>` (#907) — parse ONE task file by filesystem
+ * path, not a concept ref/id, and report the same diagnostic `akm task
+ * sync` would produce for it. The file need not live in any configured
+ * bundle: unlike every other `akm task` subcommand, this one never resolves
+ * a bundle/adapter/concept id at all — it reads exactly the path it was
+ * given and classifies it.
+ *
+ * Reuses the exact version-routing shim `parseTaskSource`
+ * (`src/tasks/source/parse-task-source.ts`) already applies for every other
+ * task-source reader (`akm task sync`'s `compileTaskSources` included) —
+ * this module never forks a second parser or a second v2/v3 migration
+ * planner. `readBoundedTaskSourceYaml` / `peekTaskSourceVersion` / `own` are
+ * the SAME front-end helpers that shim itself calls first; they are used
+ * here only to recover the file's ORIGINALLY DECLARED schema version for
+ * the report, because `parseTaskSource`'s own `ParsedTaskSource.version` is
+ * always `4` post-shim — it cannot answer "was this a v2/v3/v4 file?" on
+ * its own once a v2/v3 source has been converted in memory.
+ *
+ * Beyond parsing, this module also runs the SAME two per-source gates
+ * `akm task sync`'s `compileTaskSources` runs before it ever installs a
+ * schedule — `assertTaskScheduleInputsSatisfyContract` and
+ * `assertTaskScheduleCronValid` (both extracted from `scheduler-sync.ts` for
+ * exactly this reuse) — so a file `sync` would reject can never
+ * be reported `valid`/`converts` here. Cron dialect is checked against
+ * `backendNameForPlatform()`, the same platform default `sync` falls back
+ * to whenever it has no injected/native-inspected backend to hand (see
+ * `akmTasksAdd`, `src/commands/tasks/tasks.ts`); a bare file was never
+ * installed anywhere; there is no native scheduler state to inspect for it.
+ *
+ * Deliberately DOES NOT call `prepareTaskV3Execution` (the function
+ * `compileTaskSources` calls between those two gates) or resolve an
+ * execution engine: that path resolves a composed command/persona ref
+ * against the local index and lowers the task's cascade-composed
+ * engine/model — both of which assume a real, indexed bundle and a
+ * configured engine. A bare file passed to `validate` has neither, so
+ * running that step would make an otherwise-valid command-kind task report
+ * `invalid` on any machine with no engine configured. `resolved`
+ * is therefore the compiled task shape `sync` itself would build a
+ * scheduler binding from — id, the compiled v4 `version`, `target`
+ * (`uses`/`run`), the declared `inputs` contract, and `schedule` bindings —
+ * never an execution-lowered plan.
+ *
+ * Outcome classification (mirrors `parse-task-source.ts`'s own routing
+ * table in its header, extended for the two gates above):
+ *   - `valid`       — parses as task source v4 directly (declared `version: 4`)
+ *                      and passes both sync gates.
+ *   - `converts`    — declared `version: 2` or `3`; the deterministic
+ *                      in-memory migrator produced a valid v4 document that
+ *                      passes both sync gates.
+ *   - `blocked`     — declared `version: 2` or `3`; the migrator itself
+ *                      could not convert it (an ambiguous/unmigratable
+ *                      shape) — the ONLY way `parseTaskSource` ever throws
+ *                      for those two version numbers, so no message-text
+ *                      sniffing is needed to tell this apart from `invalid`.
+ *   - `invalid`     — the document declares SOME version (`4`, or anything
+ *                      other than 2/3/4) but fails to parse/validate, OR it
+ *                      parsed (directly or via a SUCCESSFUL v2/v3
+ *                      conversion) but fails one of the two sync gates
+ *                      above, OR the YAML itself does not parse at all
+ *                      (a genuine syntax error, not merely a non-task
+ *                      shape) — reported with the parser's own reason.
+ *   - `not-a-task`  — the document parses as YAML but never declares a
+ *                      `version:` field at all (or isn't a YAML mapping) —
+ *                      the strongest signal available that the file was
+ *                      never intended as a task source in the first place.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { UsageError } from "../../core/errors.js";
+import { backendNameForPlatform } from "../../tasks/backends/index.js";
+import { assertTaskScheduleCronValid, assertTaskScheduleInputsSatisfyContract } from "../../tasks/scheduler-sync.js";
+import { own, readBoundedTaskSourceYaml } from "../../tasks/source/bounded-document.js";
+import { parseTaskSource, peekTaskSourceVersion } from "../../tasks/source/parse-task-source.js";
+/** True when `root` is a YAML mapping that itself declares a `version:` key, regardless of that key's type/value. */
+function declaresVersionKey(root) {
+    return root !== null && typeof root === "object" && !Array.isArray(root) && own(root, "version");
+}
+function buildResolved(id, v4) {
+    return {
+        id,
+        version: v4.version,
+        ...(v4.name !== undefined ? { name: v4.name } : {}),
+        ...(v4.description !== undefined ? { description: v4.description } : {}),
+        target: v4.target,
+        inputs: v4.inputs ?? {},
+        schedule: v4.schedule,
+    };
+}
+export async function akmTaskValidate(filePath) {
+    const resolvedPath = path.resolve(filePath);
+    let stat;
+    try {
+        stat = fs.statSync(resolvedPath);
+    }
+    catch {
+        throw new UsageError(`Task file not found: ${JSON.stringify(filePath)}.`, "INVALID_FLAG_VALUE");
+    }
+    if (!stat.isFile()) {
+        throw new UsageError(`${JSON.stringify(filePath)} is not a regular file.`, "INVALID_FLAG_VALUE");
+    }
+    let yaml;
+    try {
+        yaml = fs.readFileSync(resolvedPath, "utf8");
+    }
+    catch (cause) {
+        throw new UsageError(`Task file ${JSON.stringify(filePath)} could not be read: ${cause instanceof Error ? cause.message : String(cause)}`, "INVALID_FLAG_VALUE");
+    }
+    // Peek the declared version BEFORE the real parse, using the identical
+    // bounded YAML front end `parseTaskSource` calls internally — never a
+    // second/looser YAML reader. A front-end failure here (unparseable YAML,
+    // not a mapping, exceeds a resource bound) means the document itself does
+    // not parse at all — tracked as `peekFailed` so that case reports
+    // `invalid`, never `not-a-task` (`not-a-task` is reserved for
+    // YAML that DOES parse but never declared a task shape). The real parse
+    // below throws the identical error either way, so nothing is lost by
+    // swallowing it here.
+    let root;
+    let peekFailed = false;
+    try {
+        root = readBoundedTaskSourceYaml({ yaml, filePath: resolvedPath }, { sourceLabel: "task source" }).root;
+    }
+    catch {
+        peekFailed = true;
+    }
+    const declaredVersion = peekFailed ? undefined : peekTaskSourceVersion(root);
+    const hasVersionKey = !peekFailed && declaresVersionKey(root);
+    const workspaceRoot = path.dirname(resolvedPath);
+    const backend = backendNameForPlatform();
+    let parsed;
+    try {
+        parsed = parseTaskSource({ yaml, filePath: resolvedPath, workspaceRoot });
+    }
+    catch (cause) {
+        if (!(cause instanceof UsageError))
+            throw cause;
+        const reason = cause.message;
+        // `parseTaskSource` only ever throws for a declared version 2/3 via the
+        // unmigratable-conversion branch (see this file's header) — no separate
+        // message check needed to recognize "blocked" here.
+        if (declaredVersion === 2 || declaredVersion === 3) {
+            return { ok: false, path: resolvedPath, sourceVersion: declaredVersion, outcome: "blocked", reason };
+        }
+        if (peekFailed) {
+            return { ok: false, path: resolvedPath, outcome: "invalid", reason };
+        }
+        if (!hasVersionKey) {
+            return { ok: false, path: resolvedPath, outcome: "not-a-task", reason };
+        }
+        return {
+            ok: false,
+            path: resolvedPath,
+            ...(declaredVersion !== undefined ? { sourceVersion: declaredVersion } : {}),
+            outcome: "invalid",
+            reason,
+        };
+    }
+    // Success is unreachable from any path that leaves `declaredVersion`
+    // undefined — the router requires a numeric 2/3/4 version to reach here.
+    const sourceVersion = declaredVersion ?? 4;
+    // The document itself parsed (directly, or via a successful v2/v3
+    // conversion) — now the two gates `compileTaskSources` runs before
+    // accepting it. A violation here is `invalid`, never `blocked`: the
+    // migrator already succeeded, so this is the same kind of defect a
+    // native v4 document with the identical schedule would have.
+    try {
+        assertTaskScheduleInputsSatisfyContract(parsed.v4, resolvedPath);
+        assertTaskScheduleCronValid(parsed.v4, backend);
+    }
+    catch (cause) {
+        if (!(cause instanceof UsageError))
+            throw cause;
+        return { ok: false, path: resolvedPath, sourceVersion, outcome: "invalid", reason: cause.message };
+    }
+    const id = path.parse(resolvedPath).name;
+    return {
+        ok: true,
+        path: resolvedPath,
+        sourceVersion,
+        outcome: sourceVersion === 2 || sourceVersion === 3 ? "converts" : "valid",
+        resolved: buildResolved(id, parsed.v4),
+    };
+}

package/dist/commands/url-checker.js

@@ -1,34 +1,93 @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
+import { concurrentMap } from "../core/concurrent.js";
+import { systemErrorCode } from "../core/system-error.js";
 const URL_RE = /https?:\/\/[^\s"'<>)\]]+/g;
+/**
+ * URLs are checked `URL_CHECK_CONCURRENCY` at a time via {@link concurrentMap}
+ * rather than all at once: a knowledge bundle can hold thousands of links, and
+ * firing every HEAD request in one `Promise.allSettled` batch is a
+ * self-inflicted denial-of-service against whatever host happens to be linked
+ * most. Bounding concurrency changes only how fast the check runs, never how
+ * much of it happens — every URL still gets checked.
+ */
+const URL_CHECK_CONCURRENCY = 8;
+/**
+ * Per-HEAD-request timeout, matching the old `TIMEOUT_MS` the caps this
+ * checker replaced used. A dead site rarely refuses cleanly — it hangs — so
+ * without this a handful of unresponsive hosts could stall the whole check
+ * indefinitely instead of the timed-out URLs simply showing up as dead.
+ */
+const DEAD_URL_TIMEOUT_MS = 5000;
+/**
+ * DNS/connection-level codes meaning "this machine could not reach the host
+ * right now" — a corporate DNS block, an offline sandbox, a transient blip —
+ * as opposed to "the resource is gone". Same grouping `classifyVectorFailure`
+ * (indexer/search/db-search.ts) uses for its "connection failed" bucket.
+ * These are counted in `coverage.skipped`, never reported as a `DeadUrl`: an
+ * indeterminate result is not evidence a link is dead.
+ */
+const NETWORK_ERROR_CODES = new Set([
+    "ECONNREFUSED",
+    "ECONNRESET",
+    "ENETUNREACH",
+    "EHOSTUNREACH",
+    "ENOTFOUND",
+    "EAI_AGAIN",
+]);
 /**
  * Check every URL in `entries` and report the ones that are dead.
  *
  * No cap, no per-entry slice, no ceiling option. There used to be a
  * `MAX_URLS = 20` plus an undocumented `slice(0, 3)` per entry, so this
  * examined at most twenty links in a bundle holding thousands and reported
- * success. The first attempt at fixing that kept the cap and layered a
- * coverage report, a warning, and an override on top — a constraint plus more
- * code to explain the constraint. Both are gone. It checks what you asked it
- * to check.
+ * success. Both are gone. It checks what you asked it to check, at a bounded
+ * concurrency (see {@link URL_CHECK_CONCURRENCY}) so a large bundle does not
+ * turn into a request flood, and each request is bounded by
+ * {@link DEAD_URL_TIMEOUT_MS} so one unresponsive host cannot stall the rest.
  *
- * A request that fails, times out, or cannot resolve surfaces as a `DeadUrl`
- * rather than being swallowed, so a network problem is visible instead of
- * looking like a clean bill of health.
+ * A `>=400` response or a timeout surfaces as a `DeadUrl` (a timeout as
+ * `status: "timeout"`) rather than being swallowed, so a network problem is
+ * visible instead of looking like a clean bill of health. A DNS/connection
+ * failure (see {@link NETWORK_ERROR_CODES}) is different: it says the check
+ * itself could not run, not that the URL is dead, so it is counted in
+ * `coverage.skipped` instead of either `deadUrls` or a silent success. Any
+ * other thrown error still reports as `status: "error"`. `coverage.checked`
+ * and `coverage.total` are equal only when nothing was skipped this way.
  */
 export async function checkDeadUrls(_stashDir, entries) {
     const urlsToCheck = entries.flatMap((entry) => (entry.body.match(URL_RE) ?? []).map((url) => ({ ref: entry.ref, url })));
-    const results = [];
-    await Promise.allSettled(urlsToCheck.map(async ({ ref, url }) => {
+    const outcomes = await concurrentMap(urlsToCheck, async ({ ref, url }) => {
         try {
-            const res = await fetch(url, { method: "HEAD", redirect: "follow" });
-            if (res.status >= 400)
-                results.push({ ref, url, status: res.status });
+            const res = await fetch(url, {
+                method: "HEAD",
+                redirect: "follow",
+                signal: AbortSignal.timeout(DEAD_URL_TIMEOUT_MS),
+            });
+            return res.status >= 400 ? { dead: { ref, url, status: res.status } } : {};
         }
-        catch {
-            results.push({ ref, url, status: "error" });
+        catch (err) {
+            if (err instanceof DOMException && err.name === "TimeoutError") {
+                return { dead: { ref, url, status: "timeout" } };
+            }
+            const code = systemErrorCode(err);
+            if (code && NETWORK_ERROR_CODES.has(code)) {
+                return { skipped: true };
+            }
+            return { dead: { ref, url, status: "error" } };
         }
-    }));
-    return results;
+    }, URL_CHECK_CONCURRENCY);
+    const deadUrls = [];
+    let skipped = 0;
+    for (const outcome of outcomes) {
+        if (outcome?.dead)
+            deadUrls.push(outcome.dead);
+        if (outcome?.skipped)
+            skipped += 1;
+    }
+    return {
+        deadUrls,
+        coverage: { checked: urlsToCheck.length - skipped, total: urlsToCheck.length, skipped },
+    };
 }

package/dist/core/bundle-id.js

@@ -46,6 +46,12 @@ function ensureUniqueId(preferred, sourcePath, used) {
         n++;
     return `${suffixed}-${n}`;
 }
-function shortHash(input) {
+/**
+ * First 8 hex chars of `input`'s sha256 — deterministic and short enough to
+ * suffix a slug or a path key. Exported so callers needing the same
+ * short-hash-of-a-resolved-path primitive (e.g. `getStashStateKey` in
+ * `paths.ts`) don't grow their own duplicate.
+ */
+export function shortHash(input) {
     return crypto.createHash("sha256").update(input).digest("hex").slice(0, 8);
 }

package/dist/core/config/schema/engines.js

@@ -68,6 +68,11 @@ const LlmEngineSchema = z
     endpoint: chatCompletionsEndpoint,
     model: nonEmptyString,
     apiKey: z.string().regex(ENV_REFERENCE_PATTERN, `apiKey must be $VAR or \${VAR}`).optional(),
+    // #905: file-backed alternative to `apiKey` for hosts that refuse
+    // secrets in the process environment. A plain filesystem path (`~`
+    // expanded, read at dispatch) — see resolveLlmEngineUse/
+    // materializeLlmConnectionWithCredential in integrations/agent/engine-resolution.ts.
+    apiKeyFile: nonEmptyString.optional(),
     temperature: z.number().finite().optional(),
     maxTokens: positiveInt.optional(),
     timeoutMs: timeoutMsField,
@@ -83,6 +88,17 @@ const LlmEngineSchema = z
         if (key in value)
             ctx.addIssue({ code: z.ZodIssueCode.custom, path: [key], message: `${key} is not valid on an LLM engine` });
     }
+    // #905: apiKey and apiKeyFile are two alternative ways to supply the same
+    // credential; a third (the implicit AKM_ENGINE_<NAME>_API_KEY env var) is
+    // still available when neither is set, so only the both-set case is
+    // rejected here.
+    if (value.apiKey !== undefined && value.apiKeyFile !== undefined) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["apiKeyFile"],
+            message: "apiKey and apiKeyFile cannot both be set",
+        });
+    }
 });
 const AgentEngineSchema = z
     .object({
@@ -103,6 +119,7 @@ const AgentEngineSchema = z
         "provider",
         "endpoint",
         "apiKey",
+        "apiKeyFile",
         "temperature",
         "maxTokens",
         "concurrency",

package/dist/core/improve-result.js

@@ -27,6 +27,7 @@ const COMMON_FIELDS = [
     "coverageGaps",
     "evalCasesWritten",
     "deadUrls",
+    "deadUrlCoverage",
     "reflectsWithErrorContext",
     "memoryInference",
     "graphExtraction",
@@ -440,6 +441,7 @@ function validateCommon(value) {
         "sync",
         "terminated",
         "plan",
+        "deadUrlCoverage",
     ]) {
         if (value[field] !== undefined && !isRecord(value[field]))
             fail(`${field} must be an object`);
@@ -453,6 +455,12 @@ function validateCommon(value) {
             fail("terminated.errorMessage must be a string when present");
         }
     }
+    if (isRecord(value.deadUrlCoverage)) {
+        requireExactFields(value.deadUrlCoverage, new Set(["checked", "total", "skipped"]));
+        for (const field of ["checked", "total", "skipped"]) {
+            requireCount(value.deadUrlCoverage, field, "deadUrlCoverage");
+        }
+    }
 }
 /**
  * Per-`schemaVersion` decoders for the persisted `improve_runs.result_json`

package/dist/core/paths.js

@@ -10,6 +10,7 @@
  */
 import os from "node:os";
 import path from "node:path";
+import { shortHash } from "./bundle-id.js";
 import { ConfigError } from "./errors.js";
 import { IS_WINDOWS } from "./platform.js";
 /**
@@ -257,6 +258,117 @@ export function getRegistryCacheDir() {
 export function getRegistryIndexCacheDir() {
     return path.join(getCacheDir(), "registry-index");
 }
+// ── State directory ──────────────────────────────────────────────────────────
+/**
+ * Returns the XDG state directory for akm (`~/.local/state/akm` on
+ * Linux/macOS, `%LOCALAPPDATA%\akm\state` on Windows).
+ *
+ * Per-machine runtime state that is neither durable application data
+ * (`$DATA`), a purely regenerable cache (`$CACHE`), nor state that must
+ * travel with a bundle's own content (`$STASH/.akm`; see "What May Live in
+ * $STASH/.akm" in docs/architecture/internals/storage-locations.md).
+ *
+ * Env overrides (in priority order):
+ *   AKM_STATE_DIR  — point to any directory
+ *   XDG_STATE_HOME — (Linux/macOS) override the XDG base; akm subdir is appended
+ */
+export function getStateDir(env = process.env, platform = process.platform) {
+    const override = env.AKM_STATE_DIR?.trim();
+    if (override)
+        return override;
+    if (platform === "win32") {
+        const localAppData = env.LOCALAPPDATA?.trim();
+        if (localAppData)
+            return path.join(localAppData, "akm", "state");
+        const userProfile = env.USERPROFILE?.trim();
+        if (userProfile)
+            return path.join(userProfile, "AppData", "Local", "akm", "state");
+        const appData = env.APPDATA?.trim();
+        if (!appData) {
+            throw new ConfigError("Unable to determine state directory. Set LOCALAPPDATA, USERPROFILE, or APPDATA.", "CONFIG_DIR_UNRESOLVABLE");
+        }
+        return path.join(appData, "..", "Local", "akm", "state");
+    }
+    const xdgStateHome = env.XDG_STATE_HOME?.trim();
+    if (xdgStateHome)
+        return path.join(xdgStateHome, "akm");
+    const home = env.HOME?.trim();
+    if (!home)
+        return homelessFallbackDir("akm-state");
+    return path.join(home, ".local", "state", "akm");
+}
+// ── Per-stash state under $STATE / $CACHE (itlackey/akm#890) ─────────────────
+/**
+ * Deterministic, filesystem-safe key for machine-local state that belongs to
+ * one stash but must not live under `$STASH` itself. Namespaces `$STATE`/
+ * `$CACHE` writers by the resolved absolute stash directory — the filesystem
+ * counterpart of how `state.db`'s `proposals` table keys per-stash rows by
+ * its `stash_dir` column — so two stashes on one machine never collide.
+ *
+ * Reuses {@link shortHash} (bundle-id.ts) rather than growing a second
+ * sha256-truncated-hex helper. (The other existing option,
+ * `getCurrentWorkflowScopeKey`'s `dir:v1:<sha256>` in
+ * `src/workflows/authoring/scope-key.ts`, is a state.db column value for a
+ * different subsystem — full untruncated hex plus a `dir:v1:` prefix, which
+ * is neither filesystem-safe as a directory segment on Windows (`:`) nor
+ * short, so it is not a fit here.) `shortHash` trims to 8 hex chars (32
+ * bits) — fine at its original call site because a collision only ever
+ * shortens a batch-unique slug suffix that a retry loop immediately
+ * re-disambiguates. Here there is no such retry loop, but a machine
+ * realistically has, at most, a handful to a few dozen distinct stash
+ * directories ever registered — 32 bits of digest space makes an accidental
+ * collision between two of them astronomically unlikely.
+ */
+export function getStashStateKey(stashDir) {
+    const resolved = path.resolve(stashDir).replace(/\\/g, "/");
+    const normalized = IS_WINDOWS ? resolved.toLowerCase() : resolved;
+    return shortHash(normalized);
+}
+function stashScopedDir(base, stashDir) {
+    return path.join(base, getStashStateKey(stashDir));
+}
+/**
+ * `$STATE/improve/distill-rejected/<stash>/` — lessons that failed the
+ * distill quality gate. Moved out of `$STASH/.akm/distill-rejected/`
+ * (itlackey/akm#890): nothing reads it to resolve bundle content, so it does
+ * not meet the "must travel with the content" rule.
+ */
+export function getDistillRejectedDir(stashDir) {
+    return stashScopedDir(path.join(getStateDir(), "improve", "distill-rejected"), stashDir);
+}
+/**
+ * `$STATE/improve/eval-cases/<stash>/` — regression eval cases captured from
+ * rejected distill/proposal output. Moved out of `$STASH/.akm/eval-cases/`
+ * (itlackey/akm#890).
+ */
+export function getEvalCasesDir(stashDir) {
+    return stashScopedDir(path.join(getStateDir(), "improve", "eval-cases"), stashDir);
+}
+/**
+ * `$STATE/improve/measurement/verdicts/<stash>/` — `akm-eval-proactive-verdict`
+ * reports. Moved out of `$STASH/.akm/measurement/verdicts/` (itlackey/akm#890);
+ * the pilot treatment file at `$STASH/.akm/measurement/` is manually-authored
+ * measurement input and stays put.
+ */
+export function getMeasurementVerdictsDir(stashDir) {
+    return stashScopedDir(path.join(getStateDir(), "improve", "measurement", "verdicts"), stashDir);
+}
+/**
+ * `$CACHE/index/unresolved-sources/<stash>/` — synthetic placeholder path for
+ * a configured source whose content root did not resolve this run. Never
+ * written to disk; only used as a stable, reportable `SearchSource.path`.
+ * Moved out of `$STASH/.akm/unresolved-sources/` (itlackey/akm#890).
+ */
+export function getUnresolvedSourcesDir(stashDir) {
+    return stashScopedDir(path.join(getCacheDir(), "index", "unresolved-sources"), stashDir);
+}
+/**
+ * `$STATE/locks/<stash>/` — per-stash operational lock files for the improve
+ * pipeline (e.g. `improve.lock`). Moved out of `$STASH/.akm/` (itlackey/akm#890).
+ */
+export function getStashLocksDir(stashDir) {
+    return stashScopedDir(path.join(getStateDir(), "locks"), stashDir);
+}
 // ── Scheduled-task runtime directories (logs + history) ──────────────────────
 export function getTaskLogDir() {
     return path.join(getCacheDir(), "tasks", "logs");

package/dist/indexer/search/search-source.js

@@ -5,6 +5,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { isWithin, resolveStashDir } from "../../core/common.js";
 import { bundleComponentConfig, bundlesToSourceEntries, getSources, loadConfig } from "../../core/config/config.js";
+import { getUnresolvedSourcesDir } from "../../core/paths.js";
 import { resolveGitContentRoot, resolveWritable } from "../../core/write-source.js";
 import { lockContentRootFor } from "../../integrations/lockfile.js";
 import { resolveSourceProviderFactory } from "../../sources/provider-factory.js";
@@ -86,14 +87,14 @@ export function resolveSourceEntries(overrideStashDir, existingConfig) {
         const component = bundleComponentConfig(config.bundles?.[entry.name ?? ""]);
         const contentRoot = resolveEntryContentDir(entry);
         if (contentRoot == null) {
-            const unresolvedPath = path.join(implicitStashDir ?? process.cwd(), ".akm", "unresolved-sources", entry.name ?? entry.type);
+            const unresolvedPath = path.join(getUnresolvedSourcesDir(implicitStashDir ?? process.cwd()), entry.name ?? entry.type);
             addSource(unresolvedPath, entry.name, component?.writable ?? resolveWritable(entry), entry.type, component?.adapter, true);
             continue;
         }
         const dir = path.resolve(contentRoot, component?.root ?? ".");
         if (!isWithin(dir, contentRoot)) {
             warn(`Warning: component root "${component?.root}" escapes bundle "${entry.name}"; skipping source.`);
-            const unresolvedPath = path.join(contentRoot, ".akm", "unresolved-sources", entry.name ?? entry.type);
+            const unresolvedPath = path.join(getUnresolvedSourcesDir(contentRoot), entry.name ?? entry.type);
             addSource(unresolvedPath, entry.name, component?.writable ?? resolveWritable(entry), entry.type, component?.adapter, true);
             continue;
         }