akm-cli 0.9.14 → 0.9.15-beta.2

package/dist/akm

@@ -117,6 +117,10 @@ if (contextIndex !== -1) {
 if (contextValid) {
   process.env.AKM_LAUNCHER_NODE = process.execPath;
   process.env.AKM_LAUNCHER_PATH = fileURLToPath(import.meta.url);
+  // #956: lets the child (and its lock payloads) name the launcher pid
+  // alongside its own, and lets the child's parent-death watchdog tell a
+  // real launcher-managed run apart from a direct `bun src/cli.ts` run.
+  process.env.AKM_LAUNCHER_PID = String(process.pid);
 
   if (!process.versions.bun) {
     const [major = 0, minor = 0] = process.versions.node.split(".").map(Number);
@@ -145,7 +149,56 @@ if (contextValid) {
     const entry = useBun ? bunEntry : nodeEntry;
     const runtime = useBun ? "Bun" : "Node.js";
     const result = await new Promise((resolve) => {
-      const child = spawn(command, [entry, ...process.argv.slice(2)], { stdio: "inherit", env: process.env });
+      const child = spawn(command, [entry, ...process.argv.slice(2)], {
+        stdio: "inherit",
+        env: process.env,
+        // #956: give the child its OWN process group on POSIX (`setsid()` —
+        // does not touch its inherited stdio; see `spawnsOwnProcessGroup` in
+        // src/core/subprocess.ts for the Windows caveat that rules this out
+        // there). Without this, a spawned child shares the launcher's
+        // process group by default, so a signal delivered to that GROUP (a
+        // terminal's Ctrl-C, or `kill -SIGINT -<pgid>`) reaches the child
+        // directly AND the launcher, which then also forwards it — a real
+        // second signal lands microseconds after the first. The child's
+        // `process.once(signal, ...)` handler has already unregistered
+        // itself for its first (direct) copy, so the second falls through
+        // to the runtime's default disposition (immediate termination) and
+        // the child's graceful shutdown (lock release, in-flight abort)
+        // never runs. Detaching the child's process group makes the
+        // launcher's forward below the SOLE delivery path to the child, so
+        // it is always exactly one signal.
+        detached: process.platform !== "win32",
+      });
+      // A `kill <launcher-pid>` (a scheduler timeout, a supervisor, an
+      // operator) used to end only this wrapper, orphaning the bun child —
+      // it kept running (and holding locks) for as long as its own work took.
+      // Forward the same signal so the child dies with its parent. Never
+      // forward once the child has already exited: forwarding to a
+      // dead/replaced pid would be at best a no-op and at worst a signal to
+      // an unrelated process that reused the pid.
+      let childExited = false;
+      child.once("exit", () => {
+        childExited = true;
+      });
+      const forwardSignal = (signal) => {
+        if (childExited) return;
+        try {
+          child.kill(signal);
+        } catch {
+          // Child exited in the race between the check above and here.
+        }
+      };
+      // `.once`, not `.on`: Node/Bun suppress a signal's default
+      // (process-terminating) disposition for as long as ANY listener stays
+      // registered for it. A persistent `.on` listener would still be
+      // registered when the `process.kill(process.pid, result.signal)`
+      // re-raise below runs at shutdown, swallowing it and leaving this
+      // launcher exiting 0 instead of reflecting the child's signal. `.once`
+      // consumes only the externally-delivered signal that triggers the
+      // forward, so the re-raise correctly falls through to the OS default.
+      for (const signal of ["SIGTERM", "SIGINT", "SIGHUP"]) {
+        process.once(signal, () => forwardSignal(signal));
+      }
       child.once("error", (error) => resolve({ error }));
       child.once("exit", (code, signal) => resolve({ code, signal }));
     });

package/dist/akm-migrate

@@ -27,10 +27,43 @@ const bunEntry = fileURLToPath(new URL("./scripts/akm-migrate.js", import.meta.u
 const nodeEntry = fileURLToPath(new URL("./scripts/akm-migrate-node.js", import.meta.url));
 
 {
+  // #956: same shape as scripts/node-runtime/akm — the child names the
+  // launcher pid, and a `kill <launcher-pid>` forwards to the child instead
+  // of orphaning it.
+  const env = { ...process.env, AKM_LAUNCHER_PID: String(process.pid) };
   const command = process.versions.bun ? process.execPath : useBun ? "bun" : process.execPath;
   const entry = process.versions.bun || useBun ? bunEntry : nodeEntry;
   const result = await new Promise((resolve) => {
-    const child = spawn(command, [entry, ...process.argv.slice(2)], { stdio: "inherit" });
+    const child = spawn(command, [entry, ...process.argv.slice(2)], {
+      stdio: "inherit",
+      env,
+      // #956: own process group on POSIX so the launcher's forward below is
+      // the SOLE delivery path to the child instead of a redundant second
+      // copy landing on top of a group-wide broadcast the child already got
+      // directly — see the matching comment in scripts/node-runtime/akm.
+      detached: process.platform !== "win32",
+    });
+    let childExited = false;
+    child.once("exit", () => {
+      childExited = true;
+    });
+    const forwardSignal = (signal) => {
+      if (childExited) return;
+      try {
+        child.kill(signal);
+      } catch {
+        // Child exited in the race between the check above and here.
+      }
+    };
+    // `.once`, not `.on`: see the matching comment in
+    // scripts/node-runtime/akm — a persistent `.on` listener would still be
+    // registered when the `process.kill(process.pid, result.signal)`
+    // re-raise below runs, suppressing the OS default disposition and
+    // leaving this launcher exiting 0 instead of reflecting the child's
+    // signal.
+    for (const signal of ["SIGTERM", "SIGINT", "SIGHUP"]) {
+      process.once(signal, () => forwardSignal(signal));
+    }
     child.once("error", (error) => resolve({ error }));
     child.once("exit", (code, signal) => resolve({ code, signal }));
   });

package/dist/assets/prompts/reflect-feedback-framing.md

@@ -0,0 +1 @@
+Feedback describes what a reader found missing or wrong. It is a signal to investigate, not a fact to insert. Do not add claims, numbers, dates, paths, ports, or incidents that are not already present in the asset content. If feedback asks for information the asset lacks, add a clearly marked `TODO: verify …` placeholder or leave the section unchanged.

package/dist/assets/prompts/reflect-llm-framed-contract.md

@@ -9,3 +9,5 @@ AKM_REFLECT_CONTENT_END
 The first begin marker and final end marker delimit the body; marker lines between them are literal content. Put the complete markdown body between those outer markers. Quotes, Markdown fences, and backslashes inside the body are literal content; do not JSON-escape them. Emit the body only, without YAML frontmatter, because AKM preserves and merges the source frontmatter itself.
 
 The frontmatter patch must be a one-line JSON object with exactly `description` and `when_to_use`. Keep a field `null` when it should not change. Supply a non-empty string only when adding or correcting that field; AKM merges those values through its existing sanitizer.
+
+Never include the truncation marker (the literal text `{{TRUNCATION_MARKER}}`) or any other text from outside the fenced asset content shown to you, anywhere in the body.

package/dist/assets/prompts/reflect-llm-schema-contract.md

@@ -1,3 +1,5 @@
 Respond only through the provider's native JSON schema. {{FIELD_RULE}}
 
 `content` must contain the complete improved markdown body only, without YAML frontmatter. `frontmatterPatch` must contain exactly `description` and `when_to_use`; set either field to `null` when it should not change, or to a non-empty string when adding or correcting it. AKM merges that narrow patch with the source frontmatter and preserves target identity itself. `confidence` is your honest self-rated quality confidence from 0 to 1. Do not add prose or Markdown fences around the JSON response.
+
+Never include the truncation marker (the literal text `{{TRUNCATION_MARKER}}`) or any other text from outside the quoted asset content shown to you, anywhere in `content`.

package/dist/assets/tasks/core/improve.yml

@@ -1,4 +1,4 @@
 version: 4
-run: akm improve
+run: akm improve --require-engines
 description: Run improve pipeline nightly
 schedule: "0 2 * * *"

package/dist/assets/tasks/core/index-refresh.yml

@@ -1,4 +1,4 @@
 version: 4
-run: akm index
+run: akm index --skip-if-locked
 description: Nightly incremental index refresh
 schedule: "0 4 * * *"

package/dist/assets/tasks/improve/akm-graph-refresh-weekly.yml

@@ -1,4 +1,4 @@
 version: 4
-run: akm improve --strategy graph-refresh --skip-if-locked
+run: akm improve --strategy graph-refresh --skip-if-locked --require-engines
 description: Full-corpus graph rebuild (weekly Sunday 3:10am)
 schedule: "10 3 * * 0"

package/dist/assets/tasks/improve/akm-improve-catchup.yml

@@ -1,5 +1,5 @@
 version: 4
-run: akm improve --strategy catchup --skip-if-locked
+run: akm improve --strategy catchup --skip-if-locked --require-engines
 description: Manual recovery — consolidation + triage drain (run on demand via `akm task run akm-improve-catchup`)
 # Manual-recovery task: ships disabled (the retired registerDefaultTasks
 # marked it enableMode: "manual"). `akm task run` works while disabled;

package/dist/assets/tasks/improve/akm-improve-consolidate.yml

@@ -1,4 +1,4 @@
 version: 4
-run: akm improve --strategy consolidate --skip-if-locked
+run: akm improve --strategy consolidate --skip-if-locked --require-engines
 description: Consolidation-only pass (every 4h at :20)
 schedule: "20 */4 * * *"

package/dist/assets/tasks/improve/akm-improve-frequent.yml

@@ -1,4 +1,4 @@
 version: 4
-run: akm improve --strategy reflect-distill --skip-if-locked
+run: akm improve --strategy reflect-distill --skip-if-locked --require-engines
 description: Frequent learning pass (hourly at :40) — reflect, distill, memory inference, judged triage
 schedule: "40 * * * *"

package/dist/assets/tasks/improve/akm-improve-nightly.yml

@@ -1,4 +1,4 @@
 version: 4
-run: akm improve --strategy thorough --skip-if-locked
+run: akm improve --strategy thorough --skip-if-locked --require-engines
 description: Full nightly quality sweep (daily 2:15am; suggested for server installs)
 schedule: "15 2 * * *"

package/dist/cli/retired-commands.js

@@ -65,7 +65,6 @@ const RETIRED_COMMAND_HINTS = {
     "task enable": "`akm task enable` was removed in 0.9 — set `enabled: true` in the task YAML, then `akm task sync`.",
     "task disable": "`akm task disable` was removed in 0.9 — set `enabled: false` in the task YAML, then `akm task sync`.",
     "task init": "`akm task init` was removed in 0.9 — `akm setup` seeds the default schedules.",
-    "task list": "there is no `task list` — task files are indexed assets; use `akm search --type task`.",
     "task show": "there is no `task show` — task files are indexed assets; use `akm show <ref>`.",
     "task remove": "there is no `task remove` — delete the task YAML, then run `akm task sync` to unbind it.",
     // `improve canary` is NOT here: `akm improve` is a leaf command (a

package/dist/cli/shared.js

@@ -31,6 +31,8 @@ export { parseAllFlagValues };
  *   2  usage error
  *   4  health warn (health command only)
  *  70  internal / unclassified (sysexits EX_SOFTWARE — akm threw unexpectedly)
+ *  75  transient (sysexits EX_TEMPFAIL — retry shortly; another akm process
+ *      holds a lock or is writing state.db right now, not a bad command line)
  *  78  config error
  */
 export const EXIT_CODES = {
@@ -41,6 +43,11 @@ export const EXIT_CODES = {
     // sysexits.h EX_SOFTWARE. Distinct from GENERAL(1) so scripts can tell an
     // expected "not found" outcome from akm itself throwing an unexpected error.
     INTERNAL: 70,
+    // sysexits.h EX_TEMPFAIL (#948 addendum). Distinct from USAGE(2): a
+    // scheduler or cron wrapper classifies 2 as "fix the command line", but a
+    // TransientError means "try again in a few seconds" — a different retry
+    // contract callers can branch on.
+    TEMPFAIL: 75,
     CONFIG: 78,
 };
 // ── Helpers ──────────────────────────────────────────────────────────────────
@@ -64,6 +71,8 @@ function classifyExitCode(error) {
             return EXIT_CODES.CONFIG;
         case "not-found":
             return EXIT_CODES.GENERAL;
+        case "transient":
+            return EXIT_CODES.TEMPFAIL;
         default:
             return assertNever(error.kind, "classifyExitCode");
     }

package/dist/cli/unknown-flags.js

@@ -51,6 +51,7 @@ const SELF_DIAGNOSED_FLAGS = new Map(Object.entries({
     "proposal drain": ["profile"], // retired, points at --strategy
     search: ["source"], // renamed to --from
     curate: ["source"], // renamed to --from
+    "task list": ["source"], // renamed to --from (alias of `search --type task`, #951)
     remember: ["target"], // renamed to --bundle
     clone: ["target"], // renamed to --bundle
     improve: ["auto-accept", "target"], // retired in 0.9.0 / renamed to --bundle

package/dist/cli.js

@@ -87,6 +87,8 @@ import { taskCommand } from "./commands/tasks/tasks-cli.js";
 import { workflowCommand } from "./commands/workflow-cli.js";
 import { DEFAULT_CONFIG, loadConfig } from "./core/config/config.js";
 import { UsageError } from "./core/errors.js";
+import { launcherPidFromEnv } from "./core/file-lock.js";
+import { startParentDeathWatchdog } from "./core/parent-watchdog.js";
 import { getConfigPath } from "./core/paths.js";
 import { DURATION_UNITS, parseDuration } from "./core/time.js";
 import { plainize } from "./core/tty.js";
@@ -293,8 +295,8 @@ const healthCommand = defineCommand({
         probe: {
             type: "boolean",
             default: true,
-            description: "Probe default-llm-engine / configured-engines reachability (on by default).",
-            negativeDescription: "Skip the reachability probes (for an offline or air-gapped host).",
+            description: "Probe default-llm-engine / configured-engines reachability and check for a newer akm release (on by default).",
+            negativeDescription: "Skip the reachability probes and the update check (for an offline or air-gapped host).",
         },
     },
     async run({ args }) {
@@ -554,6 +556,7 @@ export const main = defineCommand({
             "  2   usage error\n" +
             "  4   health warn (akm health only)\n" +
             "  70  internal / unclassified error\n" +
+            "  75  transient (retry shortly — another akm process holds a lock or is writing state.db)\n" +
             "  78  config error",
     },
     args: {
@@ -1077,5 +1080,39 @@ async function runCli() {
 // sets `AKM_STANDALONE_ENTRY=1` before importing this file. The test harness
 // sets neither, so importing cli.ts under Bun stays inert as before.
 if (import.meta.main || process.env.AKM_NODE_ENTRY === "1" || process.env.AKM_STANDALONE_ENTRY === "1") {
-    await runCli();
+    // #956: a launcher that dies WITHOUT delivering a signal
+    // (SIGKILL, an OOM kill, a supervisor that force-removes the process)
+    // still reparents this process to init with nothing to catch — the field
+    // evidence was 40 orphaned `bun …/dist/cli.js` processes in one day, some
+    // from a curate hook killing its own launcher on timeout. Active for
+    // EVERY command (not only `index`), since a hook-invoked `curate`/`search`
+    // child is orphaned the same way. Inert when there is no launcher
+    // (AKM_LAUNCHER_PID unset — a direct `bun src/cli.ts` run, or any test
+    // harness that imports this module without setting it): only a real
+    // launcher-managed run has a parent worth watching.
+    const parentWatchdog = launcherPidFromEnv()
+        ? startParentDeathWatchdog({
+            initialPpid: process.ppid,
+            onOrphaned: () => {
+                // Self-delivers the same signal a real SIGTERM would be. `akm
+                // index`'s own AbortController listens for it
+                // (commands/sources/stash-cli.ts) and gets a graceful, in-process
+                // shutdown. Every other command has no SIGTERM listener of its
+                // own, so this self-signal terminates it directly via the
+                // runtime's default disposition WITHOUT running `exit` handlers
+                // (lock release included) — it stops the orphaned process, which
+                // is the goal here, but any lock it held is left for the next
+                // acquirer's dead-pid stale-reclaim (file-lock.ts) to clear, not
+                // released in-process. No second, parallel abort path to keep in
+                // sync either way.
+                process.kill(process.pid, "SIGTERM");
+            },
+        })
+        : undefined;
+    try {
+        await runCli();
+    }
+    finally {
+        parentWatchdog?.stop();
+    }
 }

package/dist/commands/config-cli.js

@@ -12,10 +12,12 @@
  * settings use their canonical engine/strategy paths; retired aliases are not
  * rewritten at this boundary.
  */
+import { isDeepStrictEqual } from "node:util";
 import { defineGroupCommand, defineJsonCommand, output } from "../cli/shared.js";
-import { resolveStashDir } from "../core/common.js";
-import { DEFAULT_CONFIG, loadConfig, mutateConfig } from "../core/config/config.js";
+import { isRecord, resolveStashDir } from "../core/common.js";
+import { DEFAULT_CONFIG, getConfigValueSource, loadConfig, mutateConfig, parseAndValidateConfigText, resolveConfigRefSource, } from "../core/config/config.js";
 import { configGet, configSet, configUnset, unknownKeyHint } from "../core/config/config-walker.js";
+import { UsageError } from "../core/errors.js";
 import { getCacheDir, getConfigPath, getDbPath, getDefaultStashDir } from "../core/paths.js";
 import { formatRegistryUrl } from "../core/registry-url.js";
 // ── Public API ──────────────────────────────────────────────────────────────
@@ -53,6 +55,55 @@ function isRegistryUrlPath(path) {
     return path[0] === "registries" && path.at(-1) === "url";
 }
 export { unknownKeyHint };
+/**
+ * Flatten a (redacted) config object down to `{dottedPath: leafValue}`
+ * entries. A plain object descends; an array or scalar is a leaf — matching
+ * `deepMergeConfig`'s own "objects merge, arrays replace wholesale" rule, so
+ * an array difference reports as one row rather than per-index noise.
+ */
+function flattenConfigLeaves(value, prefix, out) {
+    if (isRecord(value) && Object.keys(value).length > 0) {
+        for (const [key, child] of Object.entries(value))
+            flattenConfigLeaves(child, [...prefix, key], out);
+        return;
+    }
+    out.set(prefix.join("."), value);
+}
+/**
+ * Diff two (already redacted) effective config objects into sorted
+ * `{path, local, other}` rows for every leaf that differs — including a leaf
+ * present on only one side (the other's value reads `undefined`).
+ */
+function diffConfigs(local, other) {
+    const localLeaves = new Map();
+    const otherLeaves = new Map();
+    flattenConfigLeaves(local, [], localLeaves);
+    flattenConfigLeaves(other, [], otherLeaves);
+    const paths = new Set([...localLeaves.keys(), ...otherLeaves.keys()]);
+    const rows = [];
+    for (const path of paths) {
+        const localValue = localLeaves.get(path);
+        const otherValue = otherLeaves.get(path);
+        if (!isDeepStrictEqual(localValue, otherValue))
+            rows.push({ path, local: localValue, other: otherValue });
+    }
+    rows.sort((a, b) => a.path.localeCompare(b.path));
+    return rows;
+}
+/**
+ * `akm config diff <path|bundle//path>`: the current effective config
+ * (this instance's `extends` already applied) against another config file or
+ * bundle-relative file (loaded through the same loader, its own `extends`
+ * honoured), secrets redacted on both sides before comparison so a differing
+ * secret never round-trips into the diff.
+ */
+export function akmConfigDiff(ref) {
+    const current = loadConfig();
+    const { text, resolvedPath } = resolveConfigRefSource(ref, current, getConfigPath());
+    const other = parseAndValidateConfigText(text, resolvedPath);
+    const rows = diffConfigs(redactConfigValue(current), redactConfigValue(other));
+    return { rows };
+}
 // ── `akm config` command surface ────────────────────────────────────────────
 // Extracted verbatim from src/cli.ts (WS6). The `main.subCommands.config` key
 // and every config subcommand's args/output shape are byte-identical. Leaf
@@ -105,9 +156,16 @@ export const configCommand = defineGroupCommand({
             meta: { name: "get", description: "Get a configuration value by key" },
             args: {
                 key: { type: "positional", required: true, description: "Config key (for example: embedding, defaultBundle)" },
+                "show-source": {
+                    type: "boolean",
+                    description: 'Wrap the value as { value, source }, where source is "local", "extends:<ref>" (the nearest ' +
+                        'extends chain member that sets it), or "default".',
+                    default: false,
+                },
             },
             run({ args }) {
-                output("config", getConfigValue(loadConfig(), args.key));
+                const value = getConfigValue(loadConfig(), args.key);
+                output("config", args["show-source"] ? { value, source: getConfigValueSource(args.key) } : value);
             },
         }),
         set: defineJsonCommand({
@@ -152,6 +210,14 @@ export const configCommand = defineGroupCommand({
                 },
             },
             run({ args }) {
+                // A key only an `extends` base supplies has nothing local to remove:
+                // `unsetConfigValue` would silently no-op and the value comes right
+                // back on the next load. Refuse before mutating rather than pretend
+                // it worked.
+                const source = getConfigValueSource(args.key);
+                if (source.startsWith("extends:")) {
+                    throw new UsageError(`Config key "${args.key}" is inherited from ${source} and cannot be unset here.`, "TARGET_NOT_UPDATABLE", `Override it locally with "akm config set ${args.key} <value>", or edit the base file directly.`);
+                }
                 const result = mutateConfig((current) => unsetConfigValue(current, args.key), { absentNoop: true });
                 const updated = result.config;
                 if (!args.silent) {
@@ -159,6 +225,22 @@ export const configCommand = defineGroupCommand({
                 }
             },
         }),
+        diff: defineJsonCommand({
+            meta: {
+                name: "diff",
+                description: "Show effective-config differences against another config file or bundle-relative file, secrets redacted",
+            },
+            args: {
+                ref: {
+                    type: "positional",
+                    required: true,
+                    description: "Other config: a file path or bundle//path (relative to the bundle's content root)",
+                },
+            },
+            run({ args }) {
+                output("config-diff", akmConfigDiff(args.ref));
+            },
+        }),
     },
     // The bare `akm config` invocation (and `akm config --list`) dumps the
     // current config. defineGroupCommand short-circuits this body when a

package/dist/commands/env/env-cli.js

@@ -22,52 +22,11 @@ import path from "node:path";
 import { getParsedInvocation } from "../../cli/invocation.js";
 import { getStringArg } from "../../cli/parse-args.js";
 import { defineGroupCommand, defineJsonCommand, output } from "../../cli/shared.js";
-import { deriveCanonicalAssetName } from "../../core/asset/asset-placement.js";
 import { writeFileAtomic } from "../../core/common.js";
-import { loadConfig } from "../../core/config/config.js";
-import { makeEnvRef, resolveEnvPath, resolveEnvWriteTarget, withEnvSecretWrite } from "../../core/env-secret-ref.js";
+import { listEnvsRecursive, makeEnvRef, resolveEnvPath, resolveEnvWriteTarget, sensitiveMarkerPath, withEnvSecretWrite, } from "../../core/env-secret-ref.js";
 import { ConfigError, NotFoundError, UsageError } from "../../core/errors.js";
-import { resolveSourceEntries } from "../../indexer/search/search-source.js";
 import { readStdin } from "../../runtime.js";
 import { buildChildEnv } from "./child-env.js";
-import { sensitiveMarkerPath } from "./marker-path.js";
-/**
- * Walk each stash's env files and return one entry per `.env` file, using the
- * env asset spec's canonical-name logic (e.g. `env/team/prod.env` →
- * `env/team/prod`, `env/team/.env` → `env/team/default`).
- */
-function listEnvsRecursive(listKeysFn) {
-    const result = [];
-    for (const source of resolveSourceEntries(undefined, loadConfig())) {
-        const root = path.join(source.path, "env");
-        if (!fs.existsSync(root))
-            continue;
-        const walk = (dir) => {
-            for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-                const full = path.join(dir, entry.name);
-                if (entry.isDirectory()) {
-                    walk(full);
-                    continue;
-                }
-                if (!entry.isFile())
-                    continue;
-                if (entry.name !== ".env" && !entry.name.endsWith(".env"))
-                    continue;
-                const canonical = deriveCanonicalAssetName("env", root, full);
-                if (!canonical)
-                    continue;
-                // Skip sensitive envs: a sibling .sensitive marker file suppresses listing.
-                const markerPath = sensitiveMarkerPath(full, "env");
-                if (fs.existsSync(markerPath))
-                    continue;
-                const { keys } = listKeysFn(full);
-                result.push({ ref: makeEnvRef(canonical, source), path: full, keys });
-            }
-        };
-        walk(root);
-    }
-    return result;
-}
 const envListCommand = defineJsonCommand({
     meta: { name: "list", description: "List all env files across all bundles with their key names (no values)" },
     async run() {

package/dist/commands/env/env.js

@@ -49,7 +49,7 @@ import fs from "node:fs";
 import path from "node:path";
 import dotenv from "dotenv";
 import { scanEnvKeyNames, writeFileAtomic } from "../../core/common.js";
-import { sensitiveMarkerPath } from "./marker-path.js";
+import { sensitiveMarkerPath } from "../../core/sensitive-marker-path.js";
 export { scanEnvKeyNames };
 /**
  * Read and return ONLY non-secret metadata: key names.

package/dist/commands/env/secret-cli.js

@@ -35,14 +35,13 @@ import { defineGroupCommand, defineJsonCommand, output } from "../../cli/shared.
 import { decideDangerousEnvInjection } from "../../core/activation-policy.js";
 import { deriveCanonicalAssetName } from "../../core/asset/asset-placement.js";
 import { loadConfig } from "../../core/config/config.js";
-import { makeSecretRef, resolveSecretPath, resolveSecretWriteTarget, withEnvSecretWrite, } from "../../core/env-secret-ref.js";
+import { makeSecretRef, resolveSecretPath, resolveSecretWriteTarget, sensitiveMarkerPath, withEnvSecretWrite, } from "../../core/env-secret-ref.js";
 import { ConfigError, NotFoundError, UsageError } from "../../core/errors.js";
 import { appendEvent } from "../../core/events.js";
 import { warn } from "../../core/warn.js";
 import { resolveSourceEntries } from "../../indexer/search/search-source.js";
 import { readStdin } from "../../runtime.js";
 import { buildChildEnv } from "./child-env.js";
-import { sensitiveMarkerPath } from "./marker-path.js";
 function parseKeyListFlag(raw) {
     if (raw === undefined)
         return undefined;