akm-cli 0.9.15 → 0.9.16-alpha.2

package/dist/commands/sources/source-add.js

@@ -6,7 +6,7 @@ import path from "node:path";
 import { detectAdapterId } from "../../core/adapter/detect-adapter.js";
 import { isBundleSlug } from "../../core/asset/asset-ref.js";
 import { isHttpUrl, resolveStashDir } from "../../core/common.js";
-import { bundleEntryToSourceEntry, getSources, installedSourceDescriptor, loadConfig, mutateConfig, } from "../../core/config/config.js";
+import { bundleEntryToSourceEntry, getSources, installedSourceDescriptor, loadConfig, mutateConfig, resolveSecret, } from "../../core/config/config.js";
 import { ConfigError, UsageError } from "../../core/errors.js";
 import { akmIndex } from "../../indexer/indexer.js";
 import { deriveBundleId } from "../../indexer/installations.js";
@@ -16,7 +16,8 @@ import { detectStashRoot } from "../../sources/providers/provider-utils.js";
 import { syncFromRef } from "../../sources/providers/sync-from-ref.js";
 import { storeSecretResolver } from "../../sources/snapshot-fetchers/secret-seam.js";
 import { ensureWebsiteMirror, shouldAllowPrivateWebsiteUrlForTests, validateWebsiteInputUrl, } from "../../sources/snapshot-fetchers/website-ingest.js";
-import { bundleKeyForPath, bundleKeyForUrl, nextBundleKey } from "./bundle-config-ops.js";
+import { revokeSchedulerActivationsForBundle } from "../../tasks/activation-config.js";
+import { bundleKeyForPath, bundleKeyForUrl, nextBundleKey, placeBundle, } from "./bundle-config-ops.js";
 export async function akmAdd(input) {
     const ref = input.ref.trim();
     if (!ref)
@@ -24,23 +25,23 @@ export async function akmAdd(input) {
             "Examples: `akm bundle add @scope/stash`, `akm bundle add github:owner/repo`, `akm bundle add ./local/path`");
     const stashDir = resolveStashDir();
     if (shouldAddAsWebsiteUrl(ref)) {
-        return addWebsiteSource(ref, stashDir, input.name, input.options);
+        return addWebsiteSource(ref, stashDir, input.name, input.options, input);
     }
     // Local directories become filesystem bundles; registry refs use the
     // registry-backed bundle installer below.
     try {
         const parsed = parseRegistryRef(ref);
         if (parsed.source === "local") {
-            return addLocalSource(ref, parsed.sourcePath, stashDir, input.name, input.adapter);
+            return addLocalSource(ref, parsed.sourcePath, stashDir, input.name, input.adapter, input);
         }
     }
     catch {
         // Not a local ref — fall through to registry install
     }
-    return addRegistryStash(ref, stashDir, input.writable);
+    return addRegistryStash(ref, stashDir, input.writable, input, input.credential);
 }
 /** Add a local directory as a filesystem bundle. */
-async function addLocalSource(ref, sourcePath, stashDir, explicitName, explicitAdapter) {
+async function addLocalSource(ref, sourcePath, stashDir, explicitName, explicitAdapter, position = {}) {
     const stashRoot = detectStashRoot(sourcePath);
     const resolvedPath = path.resolve(stashRoot);
     const adapter = explicitAdapter ?? detectAdapterId(resolvedPath);
@@ -62,11 +63,11 @@ async function addLocalSource(ref, sourcePath, stashDir, explicitName, explicitA
         }
         const bundles = { ...(config.bundles ?? {}) };
         bundleKey = nextBundleKey(bundles, explicitName, resolvedPath);
-        bundles[bundleKey] = {
+        const entry = {
             path: resolvedPath,
             components: { main: { root: ".", adapter } },
         };
-        return { ...config, bundles };
+        return { ...config, bundles: placeBundle(bundles, bundleKey, entry, position) };
     });
     const index = await akmIndex({ stashDir });
     const updatedConfig = loadConfig();
@@ -92,7 +93,7 @@ async function addLocalSource(ref, sourcePath, stashDir, explicitName, explicitA
         },
     };
 }
-async function addWebsiteSource(ref, stashDir, name, options) {
+async function addWebsiteSource(ref, stashDir, name, options, position = {}) {
     const allowPrivateHosts = shouldAllowPrivateWebsiteUrlForTests(ref);
     const normalizedUrl = validateWebsiteInputUrl(ref, { allowPrivateHosts });
     const numberOption = (value) => (typeof value === "number" ? value : undefined);
@@ -124,9 +125,9 @@ async function addWebsiteSource(ref, stashDir, name, options) {
             entry = bundleEntryToSourceEntry(key, bundles[key]);
             return config;
         }
-        bundles[key] = nextBundle;
+        const nextBundles = placeBundle(bundles, key, nextBundle, position);
         entry = bundleEntryToSourceEntry(key, nextBundle);
-        return { ...config, bundles };
+        return { ...config, bundles: nextBundles };
     });
     const cachePaths = await ensureWebsiteMirror(entry, {
         requireStashDir: true,
@@ -161,11 +162,14 @@ async function addWebsiteSource(ref, stashDir, name, options) {
  * Install a stash from a registry (npm, github, git) by dispatching to the
  * matching syncable provider and persisting the lock entry.
  */
-async function addRegistryStash(ref, stashDir, writable) {
+async function addRegistryStash(ref, stashDir, writable, position = {}, credentialRef) {
     const parsedRef = parseRegistryRef(ref);
     if (writable === true && parsedRef.source !== "git" && parsedRef.source !== "github") {
         throw new ConfigError("writable: true is only supported on filesystem and git sources", "INVALID_CONFIG_FILE");
     }
+    if (credentialRef && parsedRef.source !== "git" && parsedRef.source !== "github") {
+        throw new ConfigError("credential is only supported on git sources", "INVALID_CONFIG_FILE");
+    }
     const currentConfig = loadConfig();
     const existingBundleKey = findInstalledBundleKey(currentConfig.bundles ?? {}, parsedRef.id);
     const existingBundle = existingBundleKey ? currentConfig.bundles?.[existingBundleKey] : undefined;
@@ -179,6 +183,11 @@ async function addRegistryStash(ref, stashDir, writable) {
         writable: effectiveWritable,
         ...(effectiveWritable && priorLock?.localRoot ? { writableRoot: priorLock.localRoot } : {}),
         ...(requiredRoots.length > 0 ? { writableRequiredRoots: requiredRoots } : {}),
+        ...(credentialRef
+            ? { credential: resolveSecret(credentialRef, storeSecretResolver.resolveSecret) }
+            : existingBundle?.credential
+                ? { credential: resolveSecret(existingBundle.credential, storeSecretResolver.resolveSecret) }
+                : {}),
     });
     const { config: updatedConfig, bundleId } = upsertInstalledRegistryEntry({
         id: synced.id,
@@ -191,7 +200,7 @@ async function addRegistryStash(ref, stashDir, writable) {
         cacheDir: synced.cacheDir,
         installedAt: synced.syncedAt,
         writable: synced.writable,
-    });
+    }, position, credentialRef);
     // The prior materialized root (if this is a re-install) — read BEFORE the lock
     // upsert overwrites it, so a moved cache root can be cleaned afterwards.
     const priorLocalRoot = priorLock?.localRoot;
@@ -252,7 +261,7 @@ async function addRegistryStash(ref, stashDir, writable) {
  * via {@link upsertLockEntry} with the returned `bundleId`). Returns the config
  * plus the derived bundle id so the caller keys its lock entry identically.
  */
-export function upsertInstalledRegistryEntry(entry) {
+export function upsertInstalledRegistryEntry(entry, position = {}, credential) {
     let bundleId = entry.id;
     const config = mutateConfig((current) => {
         const bundles = { ...(current.bundles ?? {}) };
@@ -271,13 +280,15 @@ export function upsertInstalledRegistryEntry(entry) {
                 },
             };
         const descriptor = installedSourceDescriptor(entry.source, entry.ref, path.resolve(entry.stashRoot));
-        bundles[bundleId] = {
+        const effectiveCredential = credential ?? bundles[bundleId]?.credential;
+        const nextEntry = {
             ...descriptor,
+            ...(effectiveCredential ? { credential: effectiveCredential } : {}),
             ...(entry.writable === true ? { writable: true } : {}),
             ...(entry.id !== bundleId ? { registryId: entry.id } : {}),
             components: components,
         };
-        return { ...current, bundles };
+        return { ...current, bundles: placeBundle(bundles, bundleId, nextEntry, position) };
     }).config;
     return { config, bundleId };
 }
@@ -295,7 +306,12 @@ export async function removeInstalledRegistryEntry(id) {
             return current;
         removedKey = key;
         delete bundles[key];
-        return { ...current, bundles: Object.keys(bundles).length > 0 ? bundles : undefined };
+        return revokeSchedulerActivationsForBundle({
+            ...current,
+            bundles: Object.keys(bundles).length > 0 ? bundles : undefined,
+            ...(current.defaultBundle === key ? { defaultBundle: undefined } : {}),
+            ...(current.defaultWriteTarget === key ? { defaultWriteTarget: undefined } : {}),
+        }, key);
     }).config;
     if (removedKey)
         await removeLockEntry(removedKey);

package/dist/commands/sources/source-manage.js

@@ -6,7 +6,8 @@ import { detectAdapterId } from "../../core/adapter/detect-adapter.js";
 import { isRemoteUrl } from "../../core/common.js";
 import { bundleEntryToSourceEntry, bundlesToSourceEntries, getSources, mutateConfig } from "../../core/config/config.js";
 import { ConfigError, UsageError } from "../../core/errors.js";
-import { bundleKeyForPath, bundleKeyForUrl, nextBundleKey } from "./bundle-config-ops.js";
+import { revokeSchedulerActivationsForBundle } from "../../tasks/activation-config.js";
+import { bundleKeyForPath, bundleKeyForUrl, nextBundleKey, placeBundle, } from "./bundle-config-ops.js";
 // ── Operations ──────────────────────────────────────────────────────────────
 /**
  * Add a stash source (filesystem path or remote provider URL) to config.
@@ -16,13 +17,16 @@ import { bundleKeyForPath, bundleKeyForUrl, nextBundleKey } from "./bundle-confi
  * (e.g. "website", "git").
  */
 export function addStash(opts) {
-    const { target, name, providerType, options: providerOptions, writable } = opts;
+    const { target, name, providerType, options: providerOptions, writable, credential, before, after } = opts;
     if (providerType === "openviking") {
         throw new ConfigError("openviking is not supported in akm v1.", "INVALID_CONFIG_FILE");
     }
     if (writable === true && providerType && providerType !== "filesystem" && providerType !== "git") {
         throw new ConfigError("writable: true is only supported on filesystem and git sources", "INVALID_CONFIG_FILE");
     }
+    if (credential && providerType !== "git") {
+        throw new ConfigError("credential is only supported on git sources", "INVALID_CONFIG_FILE");
+    }
     let result;
     const targetIsUrl = isRemoteUrl(target);
     if (targetIsUrl && !providerType) {
@@ -53,7 +57,15 @@ export function addStash(opts) {
                 return config;
             }
             key = nextBundleKey(bundles, name, target);
-            bundles[key] = urlBundleDescriptor(providerType, target, providerOptions, writable === true);
+            const entry = urlBundleDescriptor(providerType, target, providerOptions, writable === true, credential);
+            const nextBundles = placeBundle(bundles, key, entry, { before, after });
+            const next = { ...config, bundles: nextBundles };
+            result = {
+                sources: bundlesToSourceEntries(next) ?? [],
+                added: true,
+                entry: bundleEntryToSourceEntry(key, entry),
+            };
+            return next;
         }
         else {
             const resolvedPath = path.resolve(target);
@@ -62,18 +74,22 @@ export function addStash(opts) {
                 return config;
             }
             key = nextBundleKey(bundles, name, resolvedPath);
-            bundles[key] = {
+            const entry = {
                 path: resolvedPath,
                 ...(writable === true ? { writable: true } : {}),
                 components: {
                     main: { root: ".", adapter: detectAdapterId(resolvedPath), writable: writable ?? true },
                 },
             };
+            const nextBundles = placeBundle(bundles, key, entry, { before, after });
+            const next = { ...config, bundles: nextBundles };
+            result = {
+                sources: bundlesToSourceEntries(next) ?? [],
+                added: true,
+                entry: bundleEntryToSourceEntry(key, entry),
+            };
+            return next;
         }
-        const next = { ...config, bundles };
-        const entry = bundleEntryToSourceEntry(key, bundles[key]);
-        result = { sources: bundlesToSourceEntries(next) ?? [], added: true, entry };
-        return next;
     });
     return result;
 }
@@ -83,7 +99,7 @@ export function addStash(opts) {
  * package spec (e.g. "lodash", "@scope/pkg@^2") — never a URL (R-013,
  * rejected earlier in {@link addStash}).
  */
-function urlBundleDescriptor(providerType, locator, options, writable) {
+function urlBundleDescriptor(providerType, locator, options, writable, credential) {
     if (providerType === "website") {
         // Website provider options ride on the (passthrough) website descriptor and
         // round-trip back to `entry.options` via bundleEntryToSourceEntry.
@@ -94,8 +110,9 @@ function urlBundleDescriptor(providerType, locator, options, writable) {
     }
     if (providerType === "npm")
         return { npm: locator };
-    if (providerType === "git")
-        return { git: locator, ...(writable ? { writable: true } : {}) };
+    if (providerType === "git") {
+        return { git: locator, ...(writable ? { writable: true } : {}), ...(credential ? { credential } : {}) };
+    }
     throw new ConfigError(`unsupported source type "${providerType}"; expected filesystem, git, website, or npm`, "INVALID_CONFIG_FILE");
 }
 /**
@@ -120,7 +137,12 @@ export function removeStash(target) {
         }
         const removed = bundleEntryToSourceEntry(key, bundles[key]);
         delete bundles[key];
-        const next = { ...config, bundles: Object.keys(bundles).length > 0 ? bundles : undefined };
+        const next = revokeSchedulerActivationsForBundle({
+            ...config,
+            bundles: Object.keys(bundles).length > 0 ? bundles : undefined,
+            ...(config.defaultBundle === key ? { defaultBundle: undefined } : {}),
+            ...(config.defaultWriteTarget === key ? { defaultWriteTarget: undefined } : {}),
+        }, key);
         result = { sources: bundlesToSourceEntries(next) ?? [], removed: true, entry: removed };
         return next;
     });

package/dist/commands/sources/stash-skeleton.js

@@ -73,6 +73,8 @@ export function scaffoldStashMeta(stashDir) {
 }
 /** Marks the akm-authored block in a stash `.gitignore` (idempotency anchor). */
 const STASH_GITIGNORE_MARKER = "# akm: keep secret material out of git by default";
+/** Documented opt-out for private bundles that deliberately version env/ and secrets/. */
+export const STASH_GITIGNORE_TRACK_SECRETS_MARKER = "# akm: intentionally track env and secrets";
 const STASH_GITIGNORE_BLOCK = [
     STASH_GITIGNORE_MARKER,
     "# env/ and secrets/ assets hold tokens and keys. They are ignored by default",
@@ -89,14 +91,15 @@ const STASH_GITIGNORE_BLOCK = [
  *
  * Idempotent + non-clobbering: creates the file when absent, appends the akm
  * block when the file exists but lacks it (preserving the user's own rules),
- * and no-ops once the marker is present. The user opts INTO versioning by
- * un-ignoring a path.
+ * and no-ops once the marker is present. A private bundle that deliberately
+ * versions all secret material can add `# akm: intentionally track env and
+ * secrets`; that explicit marker suppresses this helper entirely (#981).
  */
 export function ensureStashGitignore(stashDir) {
     try {
         const gitignorePath = path.join(stashDir, ".gitignore");
         const existing = fs.existsSync(gitignorePath) ? fs.readFileSync(gitignorePath, "utf8") : "";
-        if (existing.includes(STASH_GITIGNORE_MARKER))
+        if (existing.includes(STASH_GITIGNORE_MARKER) || existing.includes(STASH_GITIGNORE_TRACK_SECRETS_MARKER))
             return;
         const gap = existing.length === 0 ? "" : existing.endsWith("\n") ? "\n" : "\n\n";
         fs.writeFileSync(gitignorePath, `${existing}${gap}${STASH_GITIGNORE_BLOCK}`);

package/dist/commands/tasks/explain.js

@@ -77,12 +77,14 @@
  */
 import fs from "node:fs";
 import { detectAdapterId } from "../../core/adapter/detect-adapter.js";
+import { makeBundleRef } from "../../core/asset/asset-ref.js";
 import { loadConfig } from "../../core/config/config.js";
 import { NotFoundError } from "../../core/errors.js";
 import { applyInputDefaults, materializeInputFlags, } from "../../execution/input-contract.js";
 import { createInlineResolvedCommand } from "../../execution/resolved-request.js";
 import { resolveAdapterConceptOwner } from "../../indexer/lookup/adapter-concept-owner.js";
 import { prepareResolvedExecution } from "../../integrations/agent/execution-preparation.js";
+import { isSchedulerRefEnabled } from "../../tasks/activation-config.js";
 import { parseTaskSource } from "../../tasks/source/parse-task-source.js";
 import { projectTaskSourceV4 } from "../../tasks/source/project-v4.js";
 import { TASK_INPUT_DIAGNOSTICS } from "../../tasks/source/task-input-diagnostics.js";
@@ -270,10 +272,11 @@ export async function akmTaskExplain(ref, options = {}) {
     const materializedInputs = materializeInputFlags(inputContract, options.inputFlags ?? [], TASK_INPUT_DIAGNOSTICS);
     const defaultedInputs = applyInputDefaults(inputContract, materializedInputs);
     const document = projectTaskSourceV4(parsed.v4);
+    const enabled = isSchedulerRefEnabled(loadConfig(), "task", makeBundleRef(bundle.source.name, taskConceptId));
     const schedule = parsed.v4.schedule.map((entry) => ({
         ordinal: entry.ordinal,
         cron: entry.cron,
-        enabled: entry.enabled,
+        enabled,
         source: entry.source,
         inputs: Object.fromEntries(Object.entries(entry.inputs).map(([name, value]) => {
             const redaction = redactIfSecretShaped(name, value);

package/dist/commands/tasks/tasks-cli.js

@@ -12,13 +12,11 @@
  * that would skip pending cleanup).
  *
  * 0.9 CLI overhaul (S6): the group was renamed from the plural `tasks` to the
- * singular `task` — hard break, no alias. `init`/`enable`/`disable` are
- * dropped: the default improve-schedule task set now ships as embedded
+ * singular `task` — hard break, no alias. `init` was dropped: the default improve-schedule task set now ships as embedded
  * templates under src/assets/tasks/improve/ (see src/tasks/embedded.ts),
  * seeded through the interactive `akm setup` task-review step instead of a
- * separate CLI command, and toggling a task's enabled state is a file edit +
- * `task sync` (tasks-sync.test.ts already proves the flip path). Every
- * subcommand (`add`/`run`/`history`/`sync`) shares one `--bundle <bundle>`
+ * separate CLI command. `enable`/`disable` mutate the host-local scheduler
+ * allow-list, never the task source. Every subcommand shares one `--bundle <bundle>`
  * axis (S8.4 ratified `task add`'s `--target` → `--bundle`; a later Gate-1
  * fix reverted it to match `import`/`proposal accept`, splitting the
  * write-target axis three-vs-one against `remember`/`clone`/`improve` — the
@@ -35,7 +33,7 @@ import { TASK_RUN_BOOLEAN_FLAGS, TASK_RUN_VALUE_FLAGS } from "../../tasks/task-r
 import { akmSearch, parseSearchSource } from "../read/search.js";
 import { rejectRetiredSourceFlag } from "../read/search-cli.js";
 import { akmTaskExplain } from "./explain.js";
-import { akmTasksAdd, akmTasksDoctor, akmTasksHistory, akmTasksPrune, akmTasksRun, akmTasksSync, akmTasksSyncPlan, } from "./tasks.js";
+import { akmTasksAdd, akmTasksDisable, akmTasksDoctor, akmTasksEnable, akmTasksHistory, akmTasksPrune, akmTasksRun, akmTasksSync, akmTasksSyncPlan, } from "./tasks.js";
 import { akmTaskValidate } from "./validate.js";
 /** Shared `--bundle <bundle>` arg wired onto every task subcommand. */
 const bundleArg = {
@@ -294,6 +292,28 @@ const tasksRunCommand = defineCommand({
         });
     },
 });
+const tasksEnableCommand = defineJsonCommand({
+    meta: { name: "enable", description: "Enable a task in this host's scheduler configuration and sync it" },
+    args: {
+        ref: { type: "positional", description: "Task ref or id", required: true },
+        ...bundleArg,
+    },
+    async run({ args }) {
+        rejectRetiredTaskTargetFlag();
+        output("task-enable", await akmTasksEnable(args.ref, { target: args.bundle }));
+    },
+});
+const tasksDisableCommand = defineJsonCommand({
+    meta: { name: "disable", description: "Disable a task in this host's scheduler configuration and sync it" },
+    args: {
+        ref: { type: "positional", description: "Task ref or id", required: true },
+        ...bundleArg,
+    },
+    async run({ args }) {
+        rejectRetiredTaskTargetFlag();
+        output("task-disable", await akmTasksDisable(args.ref, { target: args.bundle }));
+    },
+});
 /**
  * #911: `task run <id>` and `task explain <ref>` take the id positionally, so
  * `task history <id>` is the natural thing to write — and it used to be
@@ -415,8 +435,8 @@ const tasksDoctorCommand = defineJsonCommand({
     },
 });
 /**
- * #907: `akm task validate`'s exit-code contract — `valid`/`converts` are
- * successful outcomes (exit 0); `blocked`/`invalid`/`not-a-task` are
+ * #907: `akm task validate`'s exit-code contract — only current-schema
+ * `valid` is successful (exit 0); `blocked`/`invalid`/`not-a-task` are
  * diagnosed defects the caller must act on (exit 1, mirroring `task sync`'s
  * own `failures.length > 0 -> EXIT_CODES.GENERAL`). A missing path or an
  * unreadable file never reaches this function at all — `akmTaskValidate`
@@ -424,7 +444,7 @@ const tasksDoctorCommand = defineJsonCommand({
  * already maps to exit 2.
  */
 export function taskValidateExitCode(result) {
-    return result.outcome === "valid" || result.outcome === "converts" ? undefined : EXIT_CODES.GENERAL;
+    return result.outcome === "valid" ? undefined : EXIT_CODES.GENERAL;
 }
 const tasksValidateCommand = defineJsonCommand({
     meta: {
@@ -532,6 +552,8 @@ export const taskCommand = defineGroupCommand({
     },
     subCommands: {
         add: tasksAddCommand,
+        enable: tasksEnableCommand,
+        disable: tasksDisableCommand,
         run: tasksRunCommand,
         explain: tasksExplainCommand,
         validate: tasksValidateCommand,