akm-cli 0.9.15 → 0.9.16-alpha.2

package/CHANGELOG.md

@@ -4,6 +4,58 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [Unreleased]
+
+## [0.9.16-alpha.2] - 2026-09-21
+
+### Added
+
+- **Scheduled execution is now granted by host-local config and bound to the
+  approved source installation.** `scheduler.enabled` records
+  `{kind, ref, sourceId}` entries written by `akm task enable`; authored task
+  frontmatter cannot enable itself. `akm migrate apply` performs the explicit,
+  backed-up conversion of older grants, and runtime config points unmigrated
+  installations to that command instead of silently inventing authority.
+- **Executable assets now run beneath a host-owned tool ceiling.** Local
+  `execution.allowedTools` config caps asset tool requests. Workspace,
+  environment, and opaque runtime selection are no longer accepted from asset
+  frontmatter, and a transport that cannot enforce a non-empty resolved tool
+  policy fails before dispatch.
+
+### Changed
+
+- **Unscoped `akm task sync` reconciles every enabled bundle.** It refreshes
+  the native scheduler from the latest locally enabled task/workflow sources
+  and removes attributable bindings for bundles that have been disabled.
+  Removing a bundle also revokes its scheduler grants.
+- **Bundle activation and identity are consistent across the CLI.** A disabled
+  bundle is inert for reads, writes, indexing, execution, and scheduling;
+  explicit lifecycle updates remain available. Physical-root identity rejects
+  duplicate or symlink-aliased bundle registrations and prevents an
+  `AKM_BUNDLE_DIR` alias from reactivating disabled content.
+- **Shared config inheritance now separates portable policy from host
+  authority.** Source/default ownership, registries, scheduler and execution
+  grants, credentials, executable arguments/workspace, setup/experimental
+  state, reranker connections, and publication hooks stay local. Every
+  bundle-relative `extends` hop is checked by real path containment.
+- **Unsafe overrides now name one risk each.** Use
+  `--allow-insecure-transport` for reviewed plain HTTP and
+  `--allow-dangerous-env-keys` for reviewed process-hijacking environment
+  keys; the former combined `--allow-insecure` switch is removed.
+- **Bundle/source resolution carries explicit default and priority state.**
+  Search, show, write targeting, registry installation, and configuration
+  mutation no longer infer ownership or trust from array position.
+
+### Fixed
+
+- Protected generated improve content from credential echoes, redacted bodies,
+  and run-only scaffolding, while exercising the real bounded engine probe.
+- Repaired degraded sqlite-vec mirrors, preserved scheduler intent across
+  synchronization, kept explicit setup choices and rollback serialization
+  stable, and tolerated valid sharded startup contention.
+- Made git, website, npm, and filesystem bundle add/update/remove workflows
+  converge on the same lifecycle and dangerous-environment audit behavior.
+
 ## [0.9.15] - 2026-09-10
 
 ### Added

package/dist/assets/hints/cli-hints-full.md

@@ -264,6 +264,7 @@ akm bundle add @scope/pkg                            # From npm (managed)
 akm bundle add owner/repo                            # From GitHub (managed)
 akm bundle add ./path/to/local/bundle                   # Local directory
 akm bundle add git@github.com:org/repo.git --provider git --name my-skills --writable
+akm bundle add https://github.com/org/private.git --provider git --credential '$GIT_READ_TOKEN'
 akm registry add https://skills.sh --name skills.sh --provider skills-sh  # Add the skills.sh registry
 akm registry remove skills.sh                 # Remove the skills.sh registry
 akm bundle list                                      # List all sources
@@ -271,9 +272,13 @@ akm bundle list --kind git                           # Filter by provider (files
 akm bundle remove <target>                           # Remove by id, ref, path, or name
 akm bundle update --all                              # Update all managed sources
 akm bundle update <target> --force                   # Force re-download
-akm bundle update <target> --allow-insecure          # Approve reviewed dangerous env keys
+akm bundle update <target> --allow-dangerous-env-keys # Approve reviewed dangerous env keys
+akm bundle update --all --skip-if-locked             # Scheduled refresh; exit 0 on DB contention
 ```
 
+Git bundles refresh only when `akm bundle update` runs. Schedule that command
+when automatic refresh is desired.
+
 ## Registries
 
 ```sh
@@ -357,7 +362,9 @@ file plus one `sync` is a complete workflow.
 ```sh
 akm task add nightly-improve --schedule "@daily" --command "akm improve --strategy default"
 akm task add briefing --schedule "0 9 * * *" --prompt "Draft the morning briefing"  # Inline command task
-akm task sync                                  # Reconcile task files with the OS scheduler
+akm task enable <bundle>//tasks/<id>           # Enable locally and sync that bundle
+akm task disable <bundle>//tasks/<id>          # Disable locally and unschedule it
+akm task sync                                  # Reconcile activated refs from every enabled configured bundle
 akm task sync --rebind                         # Also re-pin the scheduler's akm binary/spelling
 akm task doctor                                # Scheduler binding + runtime eligibility diagnosis
 akm task history                               # Recent run rows (status, timing)
@@ -370,10 +377,10 @@ Task files use task source v4 (`version: 4`). There is no `akm:` options bag
 or `on:` block — every control (`schedule`, `timeout`, `engine`, `model`,
 `redact`, `maxSteps`, `maxRetries`, …) is a top-level key now. Typed
 `inputs:` declarations and a bounded `output:` schema work like a
-workflow's (`output:` replaces v3's `akm.outputSchema`). To disable one
-schedule entry, set that entry's `enabled: false` under `schedule:` and run
-`akm task sync` (the cron line stays, commented); to remove one, delete the
-YAML and run `akm task sync` — the scheduler entry is unbound. Top-level
+workflow's (`output:` replaces v3's `akm.outputSchema`). Task source never
+controls activation: use `akm task enable` / `disable`, which update the
+host-local config allow-list and sync. To remove one, delete the YAML and run
+`akm task sync` — the scheduler entry is unbound. Top-level
 `timeout:` may be `null` (disable the invocation timer) or a duration/number
 overriding the selected engine invocation timeout. Preview old task-v2/v3
 conversion with `akm migrate apply --dry-run`.

package/dist/assets/tasks/improve/akm-improve-catchup.yml

@@ -1,9 +1,6 @@
 version: 4
 run: akm improve --strategy catchup --skip-if-locked --require-engines
 description: Manual recovery — consolidation + triage drain (run on demand via `akm task run akm-improve-catchup`)
-# Manual-recovery task: ships disabled (the retired registerDefaultTasks
-# marked it enableMode: "manual"). `akm task run` works while disabled;
-# opting into the schedule is `schedule[].enabled: true` + `akm task sync`.
-schedule:
-  - cron: "0 4 * * *"
-    enabled: false
+# Manual-recovery task: setup offers it disabled by default. `akm task run`
+# still works manually; `akm task enable` opts this host into the schedule.
+schedule: "0 4 * * *"

package/dist/cli/retired-commands.js

@@ -62,8 +62,6 @@ const RETIRED_COMMAND_HINTS = {
     "workflow report": "`akm workflow report` was removed — the external-driver protocol is gone; `akm workflow run <target>` dispatches and records units itself.",
     "config show": "`akm config show` was removed in 0.9 — use `akm config list`.",
     "config validate": "`akm config validate` was removed in 0.9 — the config file is validated on every load.",
-    "task enable": "`akm task enable` was removed in 0.9 — set `enabled: true` in the task YAML, then `akm task sync`.",
-    "task disable": "`akm task disable` was removed in 0.9 — set `enabled: false` in the task YAML, then `akm task sync`.",
     "task init": "`akm task init` was removed in 0.9 — `akm setup` seeds the default schedules.",
     "task show": "there is no `task show` — task files are indexed assets; use `akm show <ref>`.",
     "task remove": "there is no `task remove` — delete the task YAML, then run `akm task sync` to unbind it.",

package/dist/commands/env/env-binding.js

@@ -87,16 +87,16 @@ export function resolveEnvBinding(target, options = {}) {
         const decision = decideDangerousEnvInjection({
             dangerousKeys: dangerous,
             thirdParty: Boolean(source.registryId),
-            allowInsecure: options.allowInsecure,
+            allowDangerousEnvKeys: options.allowDangerousEnvKeys,
         });
         if (decision === "block") {
             throw new UsageError(`Refusing to inject env from a third-party stash. ${detail}\n` +
                 `       Review the file, then copy the values into a first-party env if you trust them, ` +
-                `or pass --allow-insecure once you have.`, "INVALID_FLAG_VALUE");
+                `or pass --allow-dangerous-env-keys once you have.`, "INVALID_FLAG_VALUE");
         }
         if (decision === "warn") {
-            warn(options.allowInsecure && source.registryId
-                ? `${detail} Injecting anyway (--allow-insecure).`
+            warn(options.allowDangerousEnvKeys && source.registryId
+                ? `${detail} Injecting anyway (--allow-dangerous-env-keys).`
                 : `${detail} Injecting anyway (first-party stash).`);
         }
     }

package/dist/commands/env/env-cli.js

@@ -214,7 +214,7 @@ async function runEnvInjected(target, opts) {
     const { values: envValues } = resolveEnvBinding(target, {
         only: opts.only,
         except: opts.except,
-        allowInsecure: opts.allowInsecure,
+        allowDangerousEnvKeys: opts.allowDangerousEnvKeys,
     });
     const mergedEnv = buildChildEnv(process.env, {
         clean: opts.clean === true,
@@ -283,7 +283,7 @@ const envRunCommand = defineJsonCommand({
             type: "string",
             description: "When used with --clean, also inherit these parent env vars (comma-separated). Ignored without --clean.",
         },
-        "allow-insecure": {
+        "allow-dangerous-env-keys": {
             type: "boolean",
             description: "Allow injecting a process-hijacking variable (e.g. LD_PRELOAD, GIT_SSH_COMMAND) from a third-party stash, which otherwise blocks. Use only after explicitly reviewing the env file.",
             default: false,
@@ -295,7 +295,7 @@ const envRunCommand = defineJsonCommand({
             except: parseKeyListFlag(args.except),
             clean: args.clean === true,
             inherit: parseKeyListFlag(args.inherit) ?? [],
-            allowInsecure: args["allow-insecure"] === true,
+            allowDangerousEnvKeys: args["allow-dangerous-env-keys"] === true,
         });
     },
 });

package/dist/commands/improve/improve-cli.js

@@ -15,7 +15,7 @@ import { redactSensitiveText } from "../../core/redaction.js";
 import { clearLogFile, setLogFile, warn } from "../../core/warn.js";
 import { resolveWriteTarget } from "../../core/write-source.js";
 import { collectEngineCredentialValues } from "../../integrations/agent/engine-resolution.js";
-import { probeEndpointOnce, probeLlmEndpoint } from "../../llm/client.js";
+import { probeLlmReachable } from "../../llm/client.js";
 import { getOutputMode } from "../../output/context.js";
 import { deliverRendered } from "../../output/html-render.js";
 import { akmImprove, resolveImproveReadSource } from "./improve.js";
@@ -122,27 +122,32 @@ function collectRequiredEngineTargets(plan) {
  * `--require-engines` field re-test (#957): the static check above only
  * proves an engine is configured and credentialed — it cannot see a dead
  * endpoint. A field run against an unreachable engine sat silent for
- * minutes instead of hitting the documented exit-78 path. Reuse the SAME
- * bounded reachability probe `akm health`'s `default-llm-engine` /
- * `configured-engines` checks already run (`probeLlmEndpoint`, a single
- * `/models` GET bounded by its own default timeout) once per distinct
- * endpoint (via the shared `probeEndpointOnce` memoization health/checks.ts
- * also uses), so a dead engine is caught here instead of during dispatch.
+ * minutes instead of hitting the documented exit-78 path. Exercise the real
+ * model completion path with a tiny response and a three-second bound. The
+ * `/models` endpoint used by the lightweight health check is deliberately
+ * insufficient here: a gateway can list a model while its upstream completion
+ * route is dead (#980). Deduplicate by endpoint + model, not endpoint alone,
+ * because model backends behind one gateway can fail independently.
  */
-async function assertRequiredEnginesReachable(plan, probeReachable = probeLlmEndpoint) {
+async function assertRequiredEnginesReachable(plan, probeReachable = (connection) => probeLlmReachable(connection, 3_000)) {
     const targets = collectRequiredEngineTargets(plan);
     if (targets.length === 0)
         return;
-    const probesByEndpoint = new Map();
-    const probed = await Promise.all(targets.map(async (target) => ({
-        ...target,
-        reach: await probeEndpointOnce(target.connection, probesByEndpoint, probeReachable),
-    })));
+    const probesByConnection = new Map();
+    const probed = await Promise.all(targets.map(async (target) => {
+        const key = `${target.connection.endpoint.replace(/\/+$/, "")}|${target.connection.model}`;
+        let pending = probesByConnection.get(key);
+        if (!pending) {
+            pending = probeReachable(target.connection);
+            probesByConnection.set(key, pending);
+        }
+        return { ...target, reach: await pending };
+    }));
     const unreachable = probed.filter((item) => !item.reach.reachable);
     if (unreachable.length === 0)
         return;
     const lines = unreachable.map((item) => `  - ${item.process} (engine "${item.engine}", ${item.connection.endpoint}): ${item.reach.error ?? "did not respond"}`);
-    throw new ConfigError(`--require-engines: ${unreachable.length} improve process${unreachable.length === 1 ? "" : "es"} cannot run because ${unreachable.length === 1 ? "its" : "their"} engine endpoint is not reachable:\n${lines.join("\n")}`, "LLM_NOT_CONFIGURED");
+    throw new ConfigError(`--require-engines: ${unreachable.length} improve process${unreachable.length === 1 ? "" : "es"} cannot run because ${unreachable.length === 1 ? "its" : "their"} engine completion path is not reachable:\n${lines.join("\n")}`, "LLM_NOT_CONFIGURED");
 }
 /**
  * `--show-prompt` (#952): render the composed reflect prompt for one asset ref

package/dist/commands/improve/reflect.js

@@ -29,6 +29,7 @@ import { parseFrontmatter } from "../../core/asset/frontmatter.js";
 import { conceptIdFromTypeName, parseRefInput } from "../../core/asset/resolve-ref.js";
 import { DESCRIPTION_MAX_CHARS, requiresDescription } from "../../core/authoring-rules.js";
 import { loadConfig } from "../../core/config/config.js";
+import { generatedContentRejection, stripReflectPromptScaffolding } from "../../core/content-safety.js";
 import { ConfigError, UsageError } from "../../core/errors.js";
 import { appendEvent, readEvents } from "../../core/events.js";
 import { lintLessonContent } from "../../core/lesson-lint.js";
@@ -511,7 +512,12 @@ export function sanitizeReflectPayload(payload, sourceContent, targetRef) {
             mergedFm[field] = sourceFm[field];
         }
     }
-    const cleanedBody = stripAppendedFrontmatter(rawLlmBody.replace(/^\s+/, ""));
+    const withoutAppendedFrontmatter = stripAppendedFrontmatter(rawLlmBody.replace(/^\s+/, ""));
+    const promptScaffolding = stripReflectPromptScaffolding(withoutAppendedFrontmatter);
+    const cleanedBody = promptScaffolding.content;
+    if (promptScaffolding.stripped) {
+        warnings.push('Removed echoed run-only "Avoid These Patterns" guidance from the proposed asset body (#963).');
+    }
     // #636 — deterministic description fallback (reflect-side belt-and-suspenders).
     // If the type requires a `description` and the merged frontmatter is still
     // MISSING one (source had none AND the model didn't author one), derive a
@@ -1881,7 +1887,22 @@ export async function akmReflect(options = {}) {
             // draft paths.
             cleanupReflectDrafts(draftPathsToCleanup);
         }
-        payload = { ...payload, content: redactSensitiveText(payload.content, sensitiveValues) };
+        const unsafeContent = generatedContentRejection(payload.content, redactSensitiveText(payload.content, sensitiveValues));
+        if (unsafeContent) {
+            emitReflectFailed("parse_error", "parse_error", options.ref, {
+                ...(result.exitCode !== null ? { exitCode: result.exitCode } : {}),
+            });
+            return {
+                schemaVersion: 2,
+                ok: false,
+                reason: "parse_error",
+                error: unsafeContent,
+                ...(options.ref ? { ref: options.ref } : {}),
+                engine: engineName,
+                exitCode: result.exitCode,
+                ...reflectNoticeFields(executionNotices),
+            };
+        }
         const refFailure = validateReflectPayloadRef({
             payload,
             result,

package/dist/commands/lint/base-linter.js

@@ -41,6 +41,7 @@ import { checkUnquotedDescriptionColon } from "../../core/asset/frontmatter-lint
 import { isArchivedRelPath } from "../../core/asset/memory-archive.js";
 import { conceptIdFromTypeName, typeNameFromConceptId } from "../../core/asset/resolve-ref.js";
 import { localDateStamp } from "../../core/common.js";
+import { containsRedactedContent, REDACTED_CONTENT_MARKER } from "../../core/content-safety.js";
 import { findFenceRegions } from "./markdown-insertion.js";
 // ── Helpers ───────────────────────────────────────────────────────────────────
 /** Fold physically wrapped prose the same way a YAML plain scalar does. */
@@ -603,6 +604,14 @@ export function runBaseChecks(ctx) {
         .map((v) => String(v).trim())
         .filter(Boolean);
     const shouldRun = (issueType) => !lintSkip.includes(issueType);
+    if (shouldRun("redacted-content") && containsRedactedContent(currentRaw)) {
+        issues.push({
+            file: ctx.relPath,
+            issue: "redacted-content",
+            detail: `asset contains ${REDACTED_CONTENT_MARKER}; restore the original non-secret prose from version history`,
+            fixed: false,
+        });
+    }
     // ── 1. unquoted-colon ──────────────────────────────────────────────────
     if (shouldRun("unquoted-colon")) {
         const unquotedColonDetail = checkUnquotedDescriptionColon(ctx.frontmatter);

package/dist/commands/lint/env-key-rules.js

@@ -11,7 +11,7 @@
  *
  * Enforcement scope:
  *   - `akm lint` reports findings as `dangerous-env-key` (non-blocking warn).
- *   - `akm bundle add` BLOCKS install unless `--allow-insecure` is set (or, on TTY,
+ *   - `akm bundle add` BLOCKS install unless `--allow-dangerous-env-keys` is set (or, on TTY,
  *     the user explicitly confirms at the prompt).
  *   - Local env writes do NOT consult this list — by design, the operator may
  *     legitimately store any key locally. The gate exists only for third-party
@@ -22,7 +22,7 @@
  *   invoked by many interactive tools and are a documented RCE vector when
  *   sourced from untrusted environments. They will also flag on benign files
  *   where the operator legitimately wants to set their editor — accept the
- *   FP and bypass with `--allow-insecure` after review.
+ *   FP and bypass with `--allow-dangerous-env-keys` after review.
  */
 import fs from "node:fs";
 import { listKeys } from "../env/env.js";

package/dist/commands/proposal/propose.js

@@ -16,6 +16,7 @@ import fs from "node:fs";
 import { placementTypes, stashDirFor } from "../../core/asset/asset-placement.js";
 import { parseRefInput } from "../../core/asset/resolve-ref.js";
 import { resolveStashDir } from "../../core/common.js";
+import { generatedContentRejection } from "../../core/content-safety.js";
 import { UsageError } from "../../core/errors.js";
 import { appendEvent } from "../../core/events.js";
 import { resolveStandardsContext } from "../../core/standards/resolve-standards-context.js";
@@ -217,7 +218,20 @@ export async function akmPropose(options) {
                 };
             }
         }
-        payload = { ...payload, content: redactWithLoweredExecutionDispatchLease(lease, payload.content) };
+        const unsafeContent = generatedContentRejection(payload.content, redactWithLoweredExecutionDispatchLease(lease, payload.content));
+        if (unsafeContent) {
+            return {
+                schemaVersion: 2,
+                ok: false,
+                reason: "parse_error",
+                error: unsafeContent,
+                type: options.type,
+                name: options.name,
+                engine: engineName,
+                exitCode: result.exitCode,
+                ...noticeFields(notices),
+            };
+        }
         // 6. Insert the proposal. Note: we allow the agent's `ref` to normalise the
         // asset name (e.g. path-cleanup), but only after validating that the ref is
         // well-formed and the type still matches the requested type.

package/dist/commands/proposal/validators/proposal-quality-validators.js

@@ -61,6 +61,7 @@
 import { parseFrontmatter } from "../../../core/asset/frontmatter.js";
 import { parseRefInput } from "../../../core/asset/resolve-ref.js";
 import { DESCRIPTION_MAX_CHARS, DESCRIPTION_MIN_CHARS, WHEN_TO_USE_MAX_CHARS, WHEN_TO_USE_MIN_CHARS, } from "../../../core/authoring-rules.js";
+import { containsRedactedContent, containsReflectPromptScaffolding, REDACTED_CONTENT_MARKER, REFLECT_AVOID_PATTERNS_HEADING, } from "../../../core/content-safety.js";
 import { proposalContent } from "../../../core/file-change.js";
 /**
  * The canonical asset NAME an inputRef names, lower-cased — the tail the
@@ -399,6 +400,40 @@ const reflectTruncationMarkerValidator = {
         ];
     },
 };
+/** Never promote proposal text that already contains an output-redaction marker (#962). */
+const redactedContentValidator = {
+    name: "redacted-content",
+    appliesTo(proposal) {
+        return typeof proposal.payload?.content === "string";
+    },
+    validate(proposal) {
+        if (!containsRedactedContent(proposalContent(proposal)))
+            return [];
+        return [
+            {
+                kind: "redacted-content",
+                message: `Proposal ${proposal.id} (${proposal.ref}) contains ${REDACTED_CONTENT_MARKER}. Restore the original non-secret prose and create a clean proposal; redacted output cannot be promoted.`,
+            },
+        ];
+    },
+};
+/** Defense in depth when a reflect proposal bypasses creation-time sanitization (#963). */
+const reflectPromptScaffoldingValidator = {
+    name: "reflect-prompt-scaffolding",
+    appliesTo(proposal) {
+        return proposal.source === "reflect" && typeof proposal.payload?.content === "string";
+    },
+    validate(proposal) {
+        if (!containsReflectPromptScaffolding(proposalContent(proposal)))
+            return [];
+        return [
+            {
+                kind: "reflect-prompt-scaffolding",
+                message: `Proposal ${proposal.id} (${proposal.ref}) still contains the run-only "${REFLECT_AVOID_PATTERNS_HEADING}" prompt section. Reflect the asset again before promotion.`,
+            },
+        ];
+    },
+};
 /**
  * Report a validator's findings as advisory.
  *
@@ -424,9 +459,9 @@ function advisory(validator) {
  * Full set of quality validators in registration order. Appended onto
  * {@link defaultProposalValidators} so they run inside `validateProposal` on
  * `proposal accept` automatically. All prose-quality checks report without
- * blocking (see {@link advisory}); {@link reflectTruncationMarkerValidator} is
- * the one exception and blocks, since it guards against data loss rather than
- * prose quality.
+ * blocking (see {@link advisory}). The truncation-marker, redacted-content,
+ * and reflected-prompt-scaffolding validators block because they protect
+ * durable content rather than judging prose quality.
  */
 export const defaultProposalQualityValidators = [
     ...[
@@ -436,4 +471,6 @@ export const defaultProposalQualityValidators = [
         reflectSizeGuardValidator,
     ].map(advisory),
     reflectTruncationMarkerValidator,
+    redactedContentValidator,
+    reflectPromptScaffoldingValidator,
 ];

package/dist/commands/proposal/validators/proposal-validators.js

@@ -131,14 +131,15 @@ export const defaultProposalValidators = [
  * and was previously safe to run in full there because every quality
  * validator was advisory (`advisory()` downgrades findings to `severity:
  * "warn"`, which {@link runProposalValidators}'s `ok` never treats as
- * failing). #952's `reflect-truncation-marker` validator is deliberately
- * NOT advisory (it guards against data loss), so running the full
- * {@link defaultProposalValidators} list at mint time would throw
+ * failing). Blocking durable-content validators (the #952 truncation marker,
+ * #962 redaction marker, and #963 reflected prompt scaffolding) deliberately
+ * remain outside this subset, so running the full
+ * {@link defaultProposalValidators} list at mint time could throw
  * `invalid_canonical_structure` for any lesson/task/workflow reflect
  * proposal whose body leaks the truncation marker — instead of letting
  * `sanitizeReflectPayload` mint the proposal and defer it with
  * `reflect-truncation-leak`, per the #952 design. Quality validators (prose
- * shape, reflect size ratio, the truncation-marker guard) belong at
+ * shape, reflect size ratio, and durable-content guards) belong at
  * `proposal accept` / drain-promotion time, which already calls
  * {@link validateProposal} (the full list) via `preflightProposalPromotion`
  * / `promoteProposalWithLease`.

package/dist/commands/read/search.js

@@ -26,6 +26,24 @@ import { insertUsageEvent } from "../../indexer/usage/usage-events.js";
 import { TELEMETRY_BUSY_TIMEOUT_MS, withIndexDb } from "../../storage/repositories/index-db.js";
 import { searchRegistry } from "./registry-search.js";
 const DEFAULT_LIMIT = 20;
+function duplicateConceptWarnings(hits, defaultBundle) {
+    const ownersByConcept = new Map();
+    for (const hit of hits) {
+        const displayRef = (hit.parentRef ?? hit.ref).split("#", 1)[0] ?? hit.ref;
+        const boundary = displayRef.indexOf("//");
+        const conceptId = boundary >= 0 ? displayRef.slice(boundary + 2) : displayRef;
+        const owner = hit.origin ?? defaultBundle ?? "working-bundle";
+        const owners = ownersByConcept.get(conceptId) ?? [];
+        if (!owners.includes(owner))
+            owners.push(owner);
+        ownersByConcept.set(conceptId, owners);
+    }
+    return [...ownersByConcept]
+        .filter(([, owners]) => owners.length > 1)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([conceptId, owners]) => `Multiple bundles provide "${conceptId}": ${owners.join(", ")}. ` +
+        "Unqualified refs resolve by configured bundle priority; use a bundle-qualified ref to select explicitly.");
+}
 export async function akmSearch(input) {
     const t0 = Date.now();
     const query = input.query.trim();
@@ -116,6 +134,7 @@ export async function akmSearch(input) {
         : await searchRegistry(query, { limit, includeAssets: input.assets === true, registries: config.registries });
     if (source === "local") {
         const localHits = localResult?.hits ?? [];
+        const warnings = [...(localResult?.warnings ?? []), ...duplicateConceptWarnings(localHits, config.defaultBundle)];
         const hasResults = localHits.length > 0;
         const response = {
             schemaVersion: 1,
@@ -123,7 +142,7 @@ export async function akmSearch(input) {
             source,
             hits: localHits,
             tip: hasResults ? undefined : localResult?.tip,
-            warnings: localResult?.warnings?.length ? localResult.warnings : undefined,
+            warnings: warnings.length ? warnings : undefined,
             searchMode: localResult?.mode ?? "keyword",
             timing: { totalMs: Date.now() - t0, rankMs: localResult?.rankMs, embedMs: localResult?.embedMs },
         };
@@ -162,7 +181,11 @@ export async function akmSearch(input) {
     }
     // source === "all"
     const allStashHits = (localResult?.hits ?? []).slice(0, limit);
-    const warnings = [...(localResult?.warnings ?? []), ...(registryResult?.warnings ?? [])];
+    const warnings = [
+        ...(localResult?.warnings ?? []),
+        ...duplicateConceptWarnings(allStashHits, config.defaultBundle),
+        ...(registryResult?.warnings ?? []),
+    ];
     const hasResults = allStashHits.length > 0 || registryHits.length > 0;
     const response = {
         schemaVersion: 1,
@@ -301,9 +324,15 @@ function logSearchEvent(query, response, mode = "keyword", eventSource = "user",
  */
 function assertNamedSourceExists(config, namedSourceName) {
     const configSources = getSources(config);
-    const foundInConfig = configSources.some((s) => s.name === namedSourceName) || configSources.some((s) => s.path === namedSourceName);
+    const foundInConfig = configSources.find((source) => source.name === namedSourceName || source.path === namedSourceName);
+    if (foundInConfig?.enabled === false) {
+        throw new UsageError(`Source "${namedSourceName}" is disabled.`, "INVALID_SOURCE_VALUE");
+    }
     if (!foundInConfig) {
-        const validNames = configSources.map((s) => s.name).filter((n) => Boolean(n));
+        const validNames = configSources
+            .filter((source) => source.enabled !== false)
+            .map((source) => source.name)
+            .filter((name) => Boolean(name));
         const hint = validNames.length > 0
             ? `Known source names: ${validNames.join(", ")}`
             : "No named sources are configured. Run `akm bundle list` to see installed bundles.";

package/dist/commands/read/show.js

@@ -75,6 +75,11 @@ export async function akmShowUnified(input) {
         if (metaRef)
             return showStashMeta(metaRef);
     }
+    const legacyReplacement = legacyColonRefReplacement(ref);
+    if (legacyReplacement) {
+        throw new NotFoundError(`The legacy colon ref "${ref}" was removed in 0.9.0. Use the slash form instead: ` +
+            `akm show ${legacyReplacement}`);
+    }
     // Env/secret bodies have no safe fragment surface, and a fragment cannot
     // widen what the env/secret renderers expose: both always omit the body
     // (env — key names only; secret — never rendered), fragment or not. Warn
@@ -110,6 +115,20 @@ export async function akmShowUnified(input) {
     }
     return result;
 }
+/** Actionable migration guidance for the retired `[bundle//]type:name` spelling. */
+function legacyColonRefReplacement(ref) {
+    const match = /^(?:(?<bundle>[^/#]+)\/\/)?(?<type>[a-z][a-z0-9-]*):(?<name>[^#]+)(?<fragment>#.*)?$/i.exec(ref);
+    const type = match?.groups?.type?.toLowerCase();
+    const name = match?.groups?.name;
+    if (!type || !name)
+        return undefined;
+    const stashDir = stashDirFor(type);
+    if (!stashDir)
+        return undefined;
+    const bundle = match?.groups?.bundle;
+    const fragment = match?.groups?.fragment ?? "";
+    return `${bundle ? `${bundle}//` : ""}${stashDir}/${name}${fragment}`;
+}
 /**
  * Resolve a stash `.meta/` doc and return it as a lightweight ShowResponse.
  *
@@ -288,7 +307,7 @@ export async function showLocal(input) {
                 throw new UsageError(`Renderer "${match.renderer}" not found for asset: ${makeBundleRef(parsed.bundle, parsed.conceptId)}`);
             }
             const renderBundle = indexedEntry.bundleId;
-            const renderDefaultBundle = config.defaultBundle ?? (source?.path === allSources[0]?.path ? renderBundle : undefined);
+            const renderDefaultBundle = config.defaultBundle ?? (source?.isDefault === true ? renderBundle : undefined);
             const renderCtx = buildRenderContext(fileCtx, match, allSourceDirs, renderBundle, renderDefaultBundle);
             response = renderer.buildShowResponse(renderCtx);
             if (parsed.fragment !== undefined) {
@@ -306,7 +325,7 @@ export async function showLocal(input) {
     }
     response.type = indexedEntry.type;
     response.name = indexedEntry.name;
-    const isPrimaryStash = source !== undefined && source.path === allSources[0]?.path;
+    const isPrimaryStash = source?.isDefault === true;
     const canonicalRef = displayRef({
         type: indexedEntry.type,
         name: presentedName,

package/dist/commands/registry-cli.js

@@ -25,7 +25,7 @@ export const registryCommand = defineGroupCommand({
                 name: { type: "string", description: "Human-friendly name for the registry" },
                 provider: { type: "string", description: "Provider type (e.g. static-index, skills-sh)" },
                 options: { type: "string", description: "Provider-specific options as JSON." },
-                "allow-insecure": {
+                "allow-insecure-transport": {
                     type: "boolean",
                     description: "Allow a plain HTTP registry URL (otherwise rejected)",
                     default: false,
@@ -41,12 +41,12 @@ export const registryCommand = defineGroupCommand({
                     throw new UsageError("Registry URL must start with http:// or https://");
                 }
                 if (args.url.startsWith("http://")) {
-                    const allowInsecure = args["allow-insecure"];
-                    if (!allowInsecure) {
+                    const allowInsecureTransport = args["allow-insecure-transport"];
+                    if (!allowInsecureTransport) {
                         throw new UsageError("Registry URL uses plain HTTP (not HTTPS). An on-path attacker could substitute a malicious index. " +
-                            "Use https:// or pass --allow-insecure if you have explicitly accepted the risk.");
+                            "Use https:// or pass --allow-insecure-transport if you have explicitly accepted the risk.");
                     }
-                    warn("Warning: registry URL uses plain HTTP (not HTTPS). --allow-insecure was set; an on-path attacker could substitute a malicious index.");
+                    warn("Warning: registry URL uses plain HTTP (not HTTPS). --allow-insecure-transport was set; an on-path attacker could substitute a malicious index.");
                 }
                 const entry = { url: args.url };
                 if (args.name)