akm-cli 0.9.15 → 0.9.16-alpha.2

package/dist/core/config/config.js

@@ -11,8 +11,8 @@ import { ConfigError } from "../errors.js";
 import { liftLegacyEngineExtraParams } from "../extra-params.js";
 import { formatRegistryLabel, hasRegistryUrlCredentials } from "../registry-url.js";
 import { acquireConfigLock, backupExistingConfig, parseConfigText, readConfigText, withConfigLock, writeConfigAtomic, } from "./config-io.js";
-import { AkmConfigSchema, CURRENT_CONFIG_VERSION } from "./config-schema.js";
-import { bundleComponentConfig, bundleContentRoot, bundlesToSourceEntries } from "./config-sources.js";
+import { AkmConfigSchema, CURRENT_CONFIG_VERSION, listTopLevelConfigKeys } from "./config-schema.js";
+import { bundleComponentConfig, bundleContentRoot, bundleContentRoots, bundlesToSourceEntries } from "./config-sources.js";
 import { upgradeConfigVersion } from "./config-version-shim.js";
 import { deepMergeConfig, isPlainObject } from "./deep-merge.js";
 import { migrateLegacySourceShape } from "./legacy-source-shape-shim.js";
@@ -192,21 +192,60 @@ function liftExtraParamsOrThrow(parsedRaw, sourcePath) {
  * keeps around, instead of only getting the final merged `AkmConfig` back.
  */
 function buildEffectiveConfig(liftedLocalRaw, sourcePath) {
+    warnUnknownTopLevelConfigKeys(liftedLocalRaw, sourcePath);
     const withExtends = resolveExtendsChain(liftedLocalRaw, sourcePath);
     const where = sourcePath ? ` at ${sourcePath}` : "";
     const parsed = AkmConfigSchema.safeParse(withExtends);
     if (!parsed.success) {
         const lines = parsed.error.issues.map((i) => `  - ${i.path.join(".") || "(root)"}: ${i.message}`).join("\n");
-        throw new ConfigError(`Invalid config${where}:\n${lines}`, "INVALID_CONFIG_FILE");
+        const needsSchedulerMigration = parsed.error.issues.some((issue) => issue.path[0] === "scheduler" && issue.path.at(-1) === "sourceId");
+        throw new ConfigError(`Invalid config${where}:\n${lines}`, "INVALID_CONFIG_FILE", needsSchedulerMigration
+            ? "Run `akm migrate apply` to bind existing scheduler grants to their source."
+            : undefined);
     }
     const merged = deepMergeConfig(DEFAULT_CONFIG, parsed.data);
     const finalResult = AkmConfigSchema.safeParse(merged);
     if (!finalResult.success) {
         const lines = finalResult.error.issues.map((i) => `  - ${i.path.join(".") || "(root)"}: ${i.message}`).join("\n");
-        throw new ConfigError(`Invalid merged config${sourcePath ? ` at ${sourcePath}` : ""}:\n${lines}`, "INVALID_CONFIG_FILE");
+        const needsSchedulerMigration = finalResult.error.issues.some((issue) => issue.path[0] === "scheduler" && issue.path.at(-1) === "sourceId");
+        throw new ConfigError(`Invalid merged config${sourcePath ? ` at ${sourcePath}` : ""}:\n${lines}`, "INVALID_CONFIG_FILE", needsSchedulerMigration
+            ? "Run `akm migrate apply` to bind existing scheduler grants to their source."
+            : undefined);
     }
+    assertUniquePhysicalBundleRoots(finalResult.data, sourcePath);
     return finalResult.data;
 }
+const RETIRED_TOP_LEVEL_CONFIG_KEYS = new Set([
+    "agent",
+    "bindings",
+    "features",
+    "installed",
+    "llm",
+    "modelAliases",
+    "profiles",
+    "sources",
+    "stashDir",
+    "stashes",
+    "writable",
+]);
+function warnUnknownTopLevelConfigKeys(raw, sourcePath) {
+    const known = new Set(listTopLevelConfigKeys());
+    for (const key of Object.keys(raw).sort()) {
+        if (known.has(key) || RETIRED_TOP_LEVEL_CONFIG_KEYS.has(key))
+            continue;
+        warnOnce(`config:unknown-key:${sourcePath ?? "inline"}:${key}`, `Unknown config key ${JSON.stringify(key)}${sourcePath ? ` at ${sourcePath}` : ""} has no defined akm behavior. Check the spelling or remove it.`);
+    }
+}
+function assertUniquePhysicalBundleRoots(config, sourcePath) {
+    const owners = new Map();
+    for (const { id, contentRoot } of bundleContentRoots(config)) {
+        const prior = owners.get(contentRoot);
+        if (prior !== undefined) {
+            throw new ConfigError(`Invalid config${sourcePath ? ` at ${sourcePath}` : ""}: bundles ${JSON.stringify(prior)} and ${JSON.stringify(id)} resolve to the same physical content root ${contentRoot}.`, "INVALID_CONFIG_FILE", "Configure one bundle id per physical source root; symbolic-link aliases are not separate bundles.");
+        }
+        owners.set(contentRoot, id);
+    }
+}
 /**
  * Parse raw config text and validate via Zod.
  * ({@link AkmConfigSchema}). Returns the merged-with-defaults AkmConfig.
@@ -233,6 +272,7 @@ function collectExtendsLayers(localRaw, configPath) {
     const visited = new Set(configPath ? [path.resolve(configPath)] : []);
     let current = localRaw;
     let currentPath = configPath;
+    let containmentRoot;
     while (true) {
         const ref = current.extends;
         if (ref === undefined)
@@ -240,15 +280,18 @@ function collectExtendsLayers(localRaw, configPath) {
         if (typeof ref !== "string" || !ref.trim()) {
             throw new ConfigError(`Invalid "extends"${currentPath ? ` at ${currentPath}` : ""}: expected a non-empty string (a file path or bundle//path ref), got ${JSON.stringify(ref)}.`, "INVALID_CONFIG_FILE");
         }
-        const { text, resolvedPath } = resolveConfigRefSource(ref, current, currentPath);
+        const resolved = resolveConfigRefSource(ref, current, currentPath, containmentRoot);
+        const { text, resolvedPath } = resolved;
         if (visited.has(resolvedPath)) {
             throw new ConfigError(`Config "extends" cycle detected: "${ref}"${currentPath ? ` (from ${currentPath})` : ""} resolves back to an already-visited config at ${resolvedPath}.`, "INVALID_CONFIG_FILE");
         }
         visited.add(resolvedPath);
         const baseRaw = runConfigFilePipeline(text, resolvedPath);
+        warnUnknownTopLevelConfigKeys(baseRaw, resolvedPath);
         layers.push({ ref, raw: baseRaw });
         current = baseRaw;
         currentPath = resolvedPath;
+        containmentRoot = resolved.containmentRoot;
     }
 }
 /**
@@ -274,10 +317,84 @@ function resolveExtendsChain(localRaw, configPath) {
     const layers = collectExtendsLayers(localRaw, configPath);
     let merged = {};
     for (let i = layers.length - 1; i >= 0; i--) {
-        merged = deepMergeConfig(merged, layers[i].raw);
+        const layer = layers[i];
+        merged = deepMergeConfig(merged, i > 0 ? sanitizeInheritedConfig(layer.raw, layer.ref ?? String(i)) : layer.raw);
     }
     return merged;
 }
+const HOST_LOCAL_CONFIG_KEYS = new Set([
+    "bundles",
+    "defaultBundle",
+    "defaultWriteTarget",
+    "embedding",
+    "execution",
+    "experimental",
+    "registries",
+    "scheduler",
+    "setup",
+]);
+/**
+ * Shared config contributes portable behavior only. Source ownership,
+ * credentials, executable paths/arguments, and activation remain in the
+ * host's top-level config even when a bundle supplies the inherited file.
+ * LLM endpoints and model selection remain portable; their credentials never
+ * do.
+ */
+function sanitizeInheritedConfig(raw, label) {
+    const inherited = { ...raw };
+    for (const key of HOST_LOCAL_CONFIG_KEYS) {
+        if (!Object.hasOwn(inherited, key))
+            continue;
+        delete inherited[key];
+        warnOnce(`config:inherited-host-local:${label}:${key}`, `Ignoring inherited config key ${JSON.stringify(key)} from ${label}; it is host-local and must be declared in the top-level config file.`);
+    }
+    if (isPlainObject(inherited.engines)) {
+        const engines = {};
+        let strippedAuthority = false;
+        for (const [name, engine] of Object.entries(inherited.engines)) {
+            if (!isPlainObject(engine)) {
+                engines[name] = engine;
+                continue;
+            }
+            const portable = { ...engine };
+            for (const key of ["apiKey", "apiKeyFile", "bin", "args", "workspace"]) {
+                if (!Object.hasOwn(portable, key))
+                    continue;
+                delete portable[key];
+                strippedAuthority = true;
+            }
+            engines[name] = portable;
+        }
+        inherited.engines = engines;
+        if (strippedAuthority) {
+            warnOnce(`config:inherited-host-local:${label}:engines-authority`, `Ignoring inherited engine credentials, executable arguments, or workspace from ${label}; those fields are host-local.`);
+        }
+    }
+    if (isPlainObject(inherited.search) && Object.hasOwn(inherited.search, "curateRerank")) {
+        const { curateRerank: _curateRerank, ...portableSearch } = inherited.search;
+        inherited.search = portableSearch;
+        warnOnce(`config:inherited-host-local:${label}:search.curateRerank`, `Ignoring inherited config key "search.curateRerank" from ${label}; network endpoints and credentials are host-local.`);
+    }
+    if (isPlainObject(inherited.improve) && isPlainObject(inherited.improve.strategies)) {
+        const strategies = {};
+        let strippedSync = false;
+        for (const [name, profile] of Object.entries(inherited.improve.strategies)) {
+            if (isPlainObject(profile) && Object.hasOwn(profile, "sync")) {
+                const { sync: _sync, ...portableProfile } = profile;
+                strategies[name] = portableProfile;
+                strippedSync = true;
+            }
+            else {
+                strategies[name] = profile;
+            }
+        }
+        inherited.improve = { ...inherited.improve, strategies };
+        if (strippedSync) {
+            warnOnce(`config:inherited-host-local:${label}:improve.sync`, `Ignoring inherited improve strategy sync policy from ${label}; publication policy is host-local.`);
+        }
+    }
+    return inherited;
+}
 /** `~` expands to the home directory, mirroring `apiKeyFile`'s resolution (engine-resolution.ts). */
 function expandExtendsHomePath(p) {
     return p.startsWith("~") ? path.join(os.homedir(), p.slice(1)) : p;
@@ -299,12 +416,12 @@ function looksLikeBundleAssetRef(ref) {
  * a missing file/bundle throws {@link ConfigError} naming the ref, as does an
  * empty, absolute, or content-root-escaping path after `//`.
  */
-function resolveConfigRefSource(ref, context, fromConfigPath) {
+function resolveConfigRefSource(ref, context, fromConfigPath, containmentRoot) {
     return looksLikeBundleAssetRef(ref)
-        ? resolveConfigBundleRefSource(ref, context)
-        : resolveConfigFileRefSource(ref, fromConfigPath);
+        ? resolveConfigBundleRefSource(ref, context, containmentRoot)
+        : resolveConfigFileRefSource(ref, fromConfigPath, containmentRoot);
 }
-function resolveConfigFileRefSource(ref, fromConfigPath) {
+function resolveConfigFileRefSource(ref, fromConfigPath, containmentRoot) {
     const expanded = expandExtendsHomePath(ref);
     let resolvedPath;
     if (path.isAbsolute(expanded)) {
@@ -316,13 +433,15 @@ function resolveConfigFileRefSource(ref, fromConfigPath) {
     else {
         throw new ConfigError(`extends "${ref}" is a relative path, but the current config has no known file location to resolve it against.`, "INVALID_CONFIG_FILE");
     }
+    if (containmentRoot !== undefined)
+        assertConfigExtendsPhysicalContainment(containmentRoot, resolvedPath, ref);
     const text = readConfigText(resolvedPath);
     if (text === undefined) {
         throw new ConfigError(`extends "${ref}" resolves to ${resolvedPath}, which does not exist. Create the file first, or point "extends" at an existing config.`, "INVALID_CONFIG_FILE");
     }
-    return { text, resolvedPath };
+    return { text, resolvedPath, ...(containmentRoot ? { containmentRoot } : {}) };
 }
-function resolveConfigBundleRefSource(ref, context) {
+function resolveConfigBundleRefSource(ref, context, outerContainmentRoot) {
     // Split by hand rather than through `parseBundleRef`: the part after `//`
     // is a plain file path here, not an asset conceptId, so it must not be run
     // through conceptId validation (which, for instance, rejects every `..`
@@ -360,11 +479,31 @@ function resolveConfigBundleRefSource(ref, context) {
     if (relativeToRoot === ".." || relativeToRoot.startsWith(`..${path.sep}`) || path.isAbsolute(relativeToRoot)) {
         throw new ConfigError(`extends "${ref}" escapes bundle "${bundleId}"'s content root.`, "INVALID_CONFIG_FILE");
     }
+    const containmentRoot = fs.realpathSync.native(bundleRoot);
+    assertConfigExtendsPhysicalContainment(containmentRoot, resolvedPath, ref);
+    if (outerContainmentRoot !== undefined) {
+        assertConfigExtendsPhysicalContainment(outerContainmentRoot, resolvedPath, ref);
+    }
     const text = readConfigText(resolvedPath);
     if (text === undefined) {
         throw new ConfigError(`extends "${ref}" resolves to ${resolvedPath}, which does not exist locally. Sync the bundle first, or point "extends" at an existing file.`, "INVALID_CONFIG_FILE");
     }
-    return { text, resolvedPath };
+    return { text, resolvedPath, containmentRoot: outerContainmentRoot ?? containmentRoot };
+}
+function assertConfigExtendsPhysicalContainment(root, candidate, ref) {
+    let physicalRoot;
+    let physicalCandidate;
+    try {
+        physicalRoot = fs.realpathSync.native(root);
+        physicalCandidate = fs.realpathSync.native(candidate);
+    }
+    catch (cause) {
+        throw new ConfigError(`Unable to verify physical containment for extends ${JSON.stringify(ref)}: ${cause instanceof Error ? cause.message : String(cause)}`, "INVALID_CONFIG_FILE");
+    }
+    const relative = path.relative(physicalRoot, physicalCandidate);
+    if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+        throw new ConfigError(`extends ${JSON.stringify(ref)} resolves through a symbolic link outside its bundle content root.`, "INVALID_CONFIG_FILE");
+    }
 }
 /**
  * `akm config get --show-source` (#945): which raw layer the dotted path's
@@ -382,7 +521,8 @@ export function getConfigValueSource(dotted) {
     const liftedConfig = runConfigFilePipeline(text, configPath);
     const segments = dotted.split(".").filter((s) => s.length > 0);
     for (const layer of collectExtendsLayers(liftedConfig, configPath)) {
-        if (hasRawPath(layer.raw, segments)) {
+        const effectiveLayer = layer.ref === undefined ? layer.raw : sanitizeInheritedConfig(layer.raw, layer.ref);
+        if (hasRawPath(effectiveLayer, segments)) {
             return layer.ref === undefined ? "local" : `extends:${layer.ref}`;
         }
     }
@@ -487,15 +627,41 @@ function pruneUnchangedInheritedFields(before, after, localRaw) {
 }
 /**
  * What to persist for a `mutateConfig`/`mutateConfigWithPrecommit` write:
- * the full effective `next` when the local file has no `extends` (unchanged
- * pre-#945 behavior), otherwise only the changed-or-already-local fields
- * (#945 finding above).
+ * only the changed-or-already-local fields. This applies both to inherited
+ * configs and ordinary configs: lifecycle mutations must not serialize every
+ * schema default merely because validation materialized it in memory (#972).
  */
-function configWriteBody(localRaw, current, next) {
-    const usesExtends = typeof localRaw?.extends === "string" && localRaw.extends.trim().length > 0;
-    if (!usesExtends)
+function configWriteBody(localRaw, current, next, persistTopLevelKeys = []) {
+    // A first write keeps the established full-default scaffold. Besides being
+    // useful to a new user, the add -> rejected-install -> remove lifecycle
+    // relies on that symmetry to return a pristine install to DEFAULT_CONFIG.
+    if (localRaw === undefined)
         return next;
-    return pruneUnchangedInheritedFields(current, next, localRaw);
+    const pruned = pruneUnchangedInheritedFields(current, next, localRaw);
+    // A caller may need to persist an explicit user choice even when it equals
+    // the schema default. Interactive setup uses this for semanticSearchMode:
+    // "off" means the user declined the opt-in, not an incidental default that
+    // should disappear from the saved configuration.
+    for (const key of persistTopLevelKeys) {
+        if (Object.hasOwn(next, key))
+            pruned[key] = next[key];
+    }
+    pruned.configVersion = CURRENT_CONFIG_VERSION;
+    // Keep existing top-level keys in their authored order. Lifecycle rollback
+    // writes the same logical object twice (add, then remove); reordering those
+    // surviving keys would violate its byte-parity guarantee even though the
+    // parsed JSON is equivalent. Newly changed keys follow in `next` order,
+    // while nested maps (notably `bundles`) retain mutation-selected ordering.
+    const ordered = {};
+    for (const key of Object.keys(localRaw)) {
+        if (Object.hasOwn(pruned, key))
+            ordered[key] = pruned[key];
+    }
+    for (const [key, value] of Object.entries(pruned)) {
+        if (!Object.hasOwn(ordered, key))
+            ordered[key] = value;
+    }
+    return ordered;
 }
 /**
  * Mutate config under one fail-closed lock spanning read, merge, validation,
@@ -527,7 +693,7 @@ export function mutateConfig(mutate, options) {
  * side effect. Setup uses this to reject a three-way conflict before creating
  * its stash, while preventing another config writer from racing the final save.
  */
-export async function mutateConfigWithPrecommit(mutate, precommit) {
+export async function mutateConfigWithPrecommit(mutate, precommit, options) {
     cachedConfig = undefined;
     const configPath = getConfigPath();
     const release = acquireConfigLock();
@@ -543,7 +709,7 @@ export async function mutateConfigWithPrecommit(mutate, precommit) {
         if (mutated === current)
             return { config: current, written: false, precommit: precommitResult };
         fs.mkdirSync(path.dirname(configPath), { recursive: true });
-        writeConfigAtomic(configPath, sanitizeConfigForWrite(configWriteBody(localRaw, current, next)));
+        writeConfigAtomic(configPath, sanitizeConfigForWrite(configWriteBody(localRaw, current, next, options?.persistTopLevelKeys)));
         return { config: next, written: true, precommit: precommitResult };
     }
     finally {
@@ -682,7 +848,7 @@ export function getIndexPassConfig(config, passName) {
     return entry;
 }
 // Re-export source runtime helpers — implementation lives in config-sources.ts.
-export { bundleComponentConfig, bundleContentRoot, bundleContentRoots, bundleEntryToSourceEntry, bundleKeyForContentRoot, bundlesToSourceEntries, installedSourceDescriptor, parseSourceSpec, primaryBundlePath, resolveConfiguredSources, } from "./config-sources.js";
+export { bundleComponentConfig, bundleContentRoot, bundleContentRoots, bundleEntryToSourceEntry, bundleKeyForContentRoot, bundlePhysicalContentRoot, bundleSourceId, bundlesToSourceEntries, installedSourceDescriptor, isBundleEnabled, parseSourceSpec, primaryBundlePath, resolveActiveConfiguredSources, resolveConfiguredSources, } from "./config-sources.js";
 /**
  * Merge a partial user-config override onto a base config. Used by
  * {@link loadUserConfig} (DEFAULT_CONFIG + on-disk) and {@link updateConfig}

package/dist/core/config/legacy-source-shape-shim.js

@@ -1,3 +1,4 @@
+import path from "node:path";
 import { isBundleSlug } from "../asset/asset-ref.js";
 import { warnOnce } from "../warn.js";
 function isPlainRecord(value) {
@@ -49,6 +50,11 @@ function bundleFromLegacySource(entry, index) {
     const key = name && isBundleSlug(name) ? name : `source-${index + 1}`;
     return [key, bundle];
 }
+function filesystemLocator(bundle) {
+    if (!isPlainRecord(bundle) || typeof bundle.path !== "string" || bundle.path.length === 0)
+        return undefined;
+    return path.resolve(bundle.path);
+}
 export function migrateLegacySourceShape(raw, sourcePath) {
     const hasStashDir = typeof raw.stashDir === "string" && raw.stashDir.trim().length > 0;
     const hasSources = Array.isArray(raw.sources) && raw.sources.length > 0;
@@ -68,6 +74,9 @@ export function migrateLegacySourceShape(raw, sourcePath) {
             if (!converted)
                 return;
             const [key, bundle] = converted;
+            const locator = filesystemLocator(bundle);
+            if (locator && Object.values(bundles).some((candidate) => filesystemLocator(candidate) === locator))
+                return;
             bundles[key] = bundle;
             defaultBundle ??= key;
         });

package/dist/core/config/schema/execution.js

@@ -0,0 +1,23 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+import { z } from "zod";
+const toolName = z.string().trim().min(1, "expected a non-empty tool name");
+/** Host-owned ceiling for capabilities requested by executable assets. */
+export const ExecutionPolicyConfigSchema = z
+    .object({
+    /** Exact tool names an asset may request. `*` is an explicit allow-all ceiling. */
+    allowedTools: z
+        .array(toolName)
+        .default([])
+        .superRefine((tools, ctx) => {
+        const seen = new Set();
+        for (const [index, tool] of tools.entries()) {
+            if (seen.has(tool)) {
+                ctx.addIssue({ code: z.ZodIssueCode.custom, path: [index], message: "duplicates an earlier tool name" });
+            }
+            seen.add(tool);
+        }
+    }),
+})
+    .strict();

package/dist/core/config/schema/experimental.js

@@ -27,4 +27,4 @@ export const ExperimentalConfigSchema = z
      */
     improveAutonomy: z.boolean().optional(),
 })
-    .passthrough();
+    .strict();

package/dist/core/config/schema/scheduler.js

@@ -0,0 +1,20 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+import { z } from "zod";
+import { nonEmptyString } from "./primitives.js";
+/** One host-local grant allowing an authored asset to create scheduler bindings. */
+export const SchedulerActivationSchema = z
+    .object({
+    kind: z.enum(["task", "workflow"]),
+    ref: nonEmptyString,
+    /** Identity of the configured source this host approved, not merely its mutable bundle name. */
+    sourceId: z.string().regex(/^sha256:[0-9a-f]{64}$/),
+})
+    .strict();
+/** Absence from this allow-list means disabled. */
+export const SchedulerConfigSchema = z
+    .object({
+    enabled: z.array(SchedulerActivationSchema).default([]),
+})
+    .strict();

package/dist/core/config/schema/search.js

@@ -51,7 +51,7 @@ export const CurateRerankConfigSchema = z
     /** How many of curate's already-ranked candidates to send to the reranker. Default 8. */
     topN: positiveInt.max(50).optional(),
 })
-    .passthrough();
+    .strict();
 export const SearchConfigSchema = z
     .object({
     minScore: nonNegativeNumber.optional(),

package/dist/core/config/schema/sources-bundles.js

@@ -13,7 +13,7 @@ import { z } from "zod";
 // and, transitively, the indexer modules they delegate to).
 import { VALID_ADAPTER_IDS } from "../../adapter/adapter-ids.js";
 import { isBundleSlug } from "../../asset/asset-ref.js";
-import { httpUrl, nonEmptyString, positiveInt } from "./primitives.js";
+import { httpUrl, isApiKeyReference, nonEmptyString, positiveInt } from "./primitives.js";
 const VALID_ADAPTER_IDS_SET = new Set(VALID_ADAPTER_IDS);
 // ── Sources / registries / installed ────────────────────────────────────────
 const SourceConfigEntryOptionsSchema = z.record(z.unknown());
@@ -25,6 +25,7 @@ export const SourceConfigEntrySchema = z
     name: z.string().min(1).optional(),
     enabled: z.boolean().optional(),
     writable: z.boolean().optional(),
+    credential: z.string().min(1).optional(),
     primary: z.boolean().optional(),
     options: SourceConfigEntryOptionsSchema.optional(),
 })
@@ -52,6 +53,20 @@ export const SourceConfigEntrySchema = z
                 ").",
         });
     }
+    if (entry.credential !== undefined && entry.type !== "git") {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["credential"],
+            message: "credential is only supported on git sources",
+        });
+    }
+    if (entry.credential !== undefined && !isApiKeyReference(entry.credential)) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["credential"],
+            message: "git credential must be a $VAR or secret://<name> reference",
+        });
+    }
 });
 export const RegistryConfigEntrySchema = z
     .object({
@@ -110,6 +125,8 @@ export const BundleConfigEntrySchema = z
     git: z.string().min(1).optional(),
     website: BundleWebsiteDescriptorSchema.optional(),
     npm: z.string().min(1).optional(),
+    /** Symbolic HTTPS bearer credential; resolved only at the Git subprocess boundary. */
+    credential: z.string().min(1).optional(),
     writable: z.boolean().optional(),
     // Opt a bundle out of indexing, search, refresh, and write targeting
     // without deleting it. The runtime honors the derived value in write and
@@ -150,6 +167,20 @@ export const BundleConfigEntrySchema = z
             message: "writable: true is only supported on path and git bundle sources",
         });
     }
+    if (entry.credential !== undefined && entry.git === undefined) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["credential"],
+            message: "credential is only supported on git bundle sources",
+        });
+    }
+    if (entry.credential !== undefined && !isApiKeyReference(entry.credential)) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["credential"],
+            message: "git credential must be a $VAR or secret://<name> reference",
+        });
+    }
     const componentEntries = entry.components ? Object.entries(entry.components) : [];
     if (entry.components !== undefined && componentEntries.length !== 1) {
         ctx.addIssue({

package/dist/core/content-safety.js

@@ -0,0 +1,52 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/** Marker emitted by output redaction. It must never become durable asset content. */
+export const REDACTED_CONTENT_MARKER = "[REDACTED]";
+/** Reflect prompt section that contains run diagnostics, not proposed asset content. */
+export const REFLECT_AVOID_PATTERNS_HEADING = "Avoid These Patterns";
+const REFLECT_AVOID_PATTERNS_RE = /^##[ \t]+Avoid These Patterns[ \t]*$/i;
+const SECTION_BOUNDARY_RE = /^#{1,2}(?:[ \t]+|$)/;
+export function containsRedactedContent(content) {
+    return content.includes(REDACTED_CONTENT_MARKER);
+}
+export function containsReflectPromptScaffolding(content) {
+    return content.split(/\r?\n/).some((line) => REFLECT_AVOID_PATTERNS_RE.test(line));
+}
+/**
+ * Remove every echoed run-only "Avoid These Patterns" section while preserving
+ * the next peer/top-level section. Reflect alone calls this sanitizer; authored
+ * source assets are never rewritten by this helper.
+ */
+export function stripReflectPromptScaffolding(content) {
+    const newline = content.includes("\r\n") ? "\r\n" : "\n";
+    const lines = content.split(/\r?\n/);
+    const kept = [];
+    let stripped = false;
+    for (let index = 0; index < lines.length;) {
+        if (!REFLECT_AVOID_PATTERNS_RE.test(lines[index] ?? "")) {
+            kept.push(lines[index] ?? "");
+            index += 1;
+            continue;
+        }
+        stripped = true;
+        index += 1;
+        while (index < lines.length && !SECTION_BOUNDARY_RE.test(lines[index] ?? ""))
+            index += 1;
+    }
+    return { content: kept.join(newline).replace(/(?:\r?\n){3,}/g, `${newline}${newline}`), stripped };
+}
+/**
+ * Return a secret-free rejection reason when generated content is unsafe to
+ * persist. `redactedContent` is the same body after applying the dispatch
+ * lease's sensitive-value inventory; comparing it avoids exposing the value.
+ */
+export function generatedContentRejection(content, redactedContent) {
+    if (containsRedactedContent(content)) {
+        return `Agent proposal content contains ${REDACTED_CONTENT_MARKER}; refusing to persist already-redacted text.`;
+    }
+    if (redactedContent !== content) {
+        return "Agent proposal content echoed a configured credential; refusing to persist either the secret or a redacted replacement.";
+    }
+    return undefined;
+}

package/dist/core/maintenance-barrier.js

@@ -31,14 +31,14 @@ const MAINTENANCE_BARRIER_STALE_AFTER_MS = 5 * 60 * 1000;
  * very same instant (e.g. two `akm index` runs a scheduler launched back to
  * back) can still collide on it; retrying briefly resolves that ordinary
  * case instead of failing a legitimate concurrent invocation outright
- * (field follow-up to #956, G1). Bounded short so a genuinely wedged holder
- * still surfaces the busy error promptly rather than making a losing
- * process hang — comfortably above the barrier's normal hold time, well
- * below a length that would make this feel like the blocking lock #872
- * removed. Never applies to the rebuild lock itself, which stays
+ * (field follow-up to #956, G1). Five seconds matches the async and
+ * synchronous-activity registration paths below and tolerates a holder being
+ * descheduled under heavy process-shard load; the barrier's normal hold time
+ * remains sub-millisecond. The bound still surfaces a genuinely wedged holder
+ * promptly and never applies to the rebuild lock itself, which stays
  * non-blocking (#872).
  */
-const MAINTENANCE_BARRIER_BUSY_RETRY_BOUND_MS = 1_500;
+const MAINTENANCE_BARRIER_BUSY_RETRY_BOUND_MS = 5_000;
 let busyRetryBoundMsForTests;
 /** Test-only override for {@link MAINTENANCE_BARRIER_BUSY_RETRY_BOUND_MS}, so a unit test can exercise the
  * exhausted-retry throw without a real ~1.5s wait. Restored via tests/_helpers/seams.ts's resetAllSeams(). */

package/dist/core/type-presentation.js

@@ -105,7 +105,7 @@ export const TYPE_PRESENTATION = {
     task: {
         label: "Task",
         renderer: "task-yaml",
-        action: (ref) => `akm show ${ref} -> inspect; akm task run <id> -> run now; edit the file + akm task sync -> unschedule`,
+        action: (ref) => `akm show ${ref} -> inspect; akm task run <id> -> run now; akm task enable|disable ${ref} -> change local scheduling`,
         fragmentRef: false,
     },
     session: {

package/dist/core/write-source.js

@@ -34,7 +34,7 @@ import { assetPathForName, stashDirFor } from "./asset/asset-placement.js";
 import { conceptIdFromTypeName, displayRef } from "./asset/resolve-ref.js";
 import { deriveBundleId } from "./bundle-id.js";
 import { existingFileMode, isWithin, resolveStashDir, writeFileAtomic } from "./common.js";
-import { bundleContentRoot, resolveConfiguredSources } from "./config/config.js";
+import { bundleKeyForContentRoot, resolveActiveConfiguredSources, resolveConfiguredSources } from "./config/config.js";
 import { ConfigError, UsageError } from "./errors.js";
 import { sanitizeCommitMessage } from "./git-message.js";
 import { warn, warnOnce } from "./warn.js";
@@ -897,12 +897,16 @@ function gitTargetNotMaterialized(target, contentRoot) {
  * see plan §6 decision 3 for the rationale.
  */
 export function resolveWriteTarget(akmConfig, explicitTarget, options = {}) {
-    const configuredSources = resolveConfiguredSources(akmConfig);
+    const allConfiguredSources = resolveConfiguredSources(akmConfig);
+    const configuredSources = resolveActiveConfiguredSources(akmConfig);
     const requireWritable = options.requireWritable !== false;
     // 1. Explicit --target wins.
     if (explicitTarget) {
         const match = configuredSources.find((s) => s.name === explicitTarget);
         if (!match) {
+            if (allConfiguredSources.some((source) => source.name === explicitTarget)) {
+                throw new UsageError(`Bundle "${explicitTarget}" is disabled.`, "INVALID_FLAG_VALUE");
+            }
             throw new UsageError(`--target must reference a source name from your config. No source named "${explicitTarget}" is configured. Run \`akm bundle list\` to see available sources.`, "INVALID_FLAG_VALUE");
         }
         // Up-front writable check so an explicit --target fails fast with a
@@ -939,15 +943,13 @@ export function resolveWriteTarget(akmConfig, explicitTarget, options = {}) {
 }
 /** Resolve the implicit working stash without consulting `defaultWriteTarget`. */
 export function resolveWorkingStashTarget(akmConfig, options = {}) {
-    const configuredSources = resolveConfiguredSources(akmConfig);
+    const allConfiguredSources = resolveConfiguredSources(akmConfig);
+    const configuredSources = resolveActiveConfiguredSources(akmConfig);
     const requireWritable = options.requireWritable !== false;
     if (process.env.AKM_BUNDLE_DIR?.trim()) {
         const stashDir = resolveStashDir();
-        const resolvedStashDir = path.resolve(stashDir);
-        const configured = configuredSources.find((source) => {
-            const sourcePath = source.source.type === "filesystem" ? source.source.path : undefined;
-            return sourcePath !== undefined && bundleContentRoot(sourcePath, source.componentRoot) === resolvedStashDir;
-        });
+        const configuredBundleId = bundleKeyForContentRoot(akmConfig, stashDir);
+        const configured = configuredSources.find((source) => source.name === configuredBundleId);
         if (configured) {
             const target = adaptConfiguredSource(configured);
             if (requireWritable && !resolveWritable(target.config)) {
@@ -955,6 +957,9 @@ export function resolveWorkingStashTarget(akmConfig, options = {}) {
             }
             return { ...target, selector: undefined };
         }
+        if (allConfiguredSources.some((source) => source.name === configuredBundleId)) {
+            throw new ConfigError("The AKM_BUNDLE_DIR source is disabled in config.", "INVALID_CONFIG_FILE");
+        }
         const bundleId = deriveBundleId(undefined, stashDir, new Set(Object.keys(akmConfig.bundles ?? {})));
         return {
             source: { kind: "filesystem", name: bundleId, path: stashDir, adapterId: detectAdapterId(stashDir) },