akm-cli 0.9.16-alpha.1 → 0.9.16-alpha.2

package/dist/commands/sources/add-cli.js

@@ -8,9 +8,9 @@ import { UsageError } from "../../core/errors.js";
 import { appendEvent } from "../../core/events.js";
 import { warn } from "../../core/warn.js";
 import { auditStashForDangerousKeys } from "./dangerous-env-audit.js";
-import { akmRemove } from "./installed-stashes.js";
+import { akmRemove, akmUpdate } from "./installed-stashes.js";
 import { akmAdd } from "./source-add.js";
-import { addStash } from "./source-manage.js";
+import { addStash, removeStash } from "./source-manage.js";
 // ── Shared website-options helper ──────────
 export function buildWebsiteOptions(args) {
     // getStringArg maps absent/blank to undefined; parsePositiveIntFlag maps
@@ -86,28 +86,41 @@ export const addCommand = defineJsonCommand({
             description: "Mark a git bundle as writable so changes can be pushed back",
             default: false,
         },
+        before: { type: "string", description: "Insert the new bundle before this configured bundle" },
+        after: { type: "string", description: "Insert the new bundle after this configured bundle" },
+        credential: {
+            type: "string",
+            description: "Git HTTPS bearer credential reference ($VAR or secret://name); never a literal token",
+        },
         "max-pages": { type: "string", description: "Maximum pages to crawl for website sources (default: 50)" },
         "max-depth": { type: "string", description: "Maximum crawl depth for website sources (default: 3)" },
-        "allow-insecure": {
+        "allow-insecure-transport": {
+            type: "boolean",
+            description: "Allow a plain HTTP source URL after explicitly accepting transport substitution risk.",
+            default: false,
+        },
+        "allow-dangerous-env-keys": {
             type: "boolean",
-            description: "Allow a plain HTTP source URL and skip confirmation for dangerous env keys (e.g. LD_PRELOAD, PATH). Use only after explicitly reviewing the bundle.",
+            description: "Allow reviewed process-hijacking env keys (e.g. LD_PRELOAD, PATH) in the installed bundle.",
             default: false,
         },
     },
     async run({ args }) {
         const ref = args.ref.trim();
-        const allowInsecure = args["allow-insecure"];
-        const allowDangerousKeys = allowInsecure;
+        const allowInsecureTransport = args["allow-insecure-transport"];
+        const allowDangerousKeys = args["allow-dangerous-env-keys"];
+        if (args.before && args.after)
+            throw new UsageError("Only one of --before or --after may be used.");
         // --provider → declarative bundle source (URL for git/website; bare
-        // package spec for npm — R-013). Config-only write; content is not
-        // synced until a later `akm update`.
+        // package spec for npm — R-013). Git is materialized below before success;
+        // other providers remain declarative until bundle update.
         if (args.provider) {
             if (shouldWarnOnPlainHttp(ref)) {
-                if (!allowInsecure) {
+                if (!allowInsecureTransport) {
                     throw new UsageError("Source URL uses plain HTTP (not HTTPS). An on-path attacker could substitute a malicious payload. " +
-                        "Use https:// or pass --allow-insecure if you have explicitly accepted the risk.", "INVALID_FLAG_VALUE", "Re-run with `--allow-insecure` only after confirming the URL is trusted.");
+                        "Use https:// or pass --allow-insecure-transport if you have explicitly accepted the risk.", "INVALID_FLAG_VALUE", "Re-run with `--allow-insecure-transport` only after confirming the URL is trusted.");
                 }
-                warn("Warning: source URL uses plain HTTP (not HTTPS). --allow-insecure was set; an on-path attacker could substitute a malicious payload.");
+                warn("Warning: source URL uses plain HTTP (not HTTPS). --allow-insecure-transport was set; an on-path attacker could substitute a malicious payload.");
             }
             let parsedOptions;
             if (args.options) {
@@ -130,7 +143,34 @@ export const addCommand = defineJsonCommand({
                 providerType: args.provider,
                 options: parsedOptions,
                 writable: args.writable,
+                before: args.before,
+                after: args.after,
+                credential: args.credential,
             });
+            // Declarative git sources must be materialized and indexed before add
+            // reports success. This also makes --provider git behave consistently
+            // with inferred/registry git installs (#968/#970).
+            if (args.provider === "git" && result.added && result.entry?.name) {
+                let updated;
+                try {
+                    updated = await akmUpdate({ target: result.entry.name, allowDangerousEnvKeys: allowDangerousKeys });
+                }
+                catch (error) {
+                    removeStash(result.entry.name);
+                    throw error;
+                }
+                appendEvent({
+                    eventType: "add",
+                    metadata: {
+                        target: ref,
+                        provider: args.provider,
+                        name: args.name ?? null,
+                        writable: args.writable === true,
+                    },
+                });
+                output("add", { ...result, index: updated.index });
+                return;
+            }
             appendEvent({
                 eventType: "add",
                 metadata: { target: ref, provider: args.provider, name: args.name ?? null, writable: args.writable === true },
@@ -139,11 +179,11 @@ export const addCommand = defineJsonCommand({
             return;
         }
         if (shouldWarnOnPlainHttp(ref)) {
-            if (!allowInsecure) {
+            if (!allowInsecureTransport) {
                 throw new UsageError("Source URL uses plain HTTP (not HTTPS). An on-path attacker could substitute a malicious payload. " +
-                    "Use https:// or pass --allow-insecure if you have explicitly accepted the risk.", "INVALID_FLAG_VALUE", "Re-run with `--allow-insecure` only after confirming the URL is trusted.");
+                    "Use https:// or pass --allow-insecure-transport if you have explicitly accepted the risk.", "INVALID_FLAG_VALUE", "Re-run with `--allow-insecure-transport` only after confirming the URL is trusted.");
             }
-            warn("Warning: source URL uses plain HTTP (not HTTPS). --allow-insecure was set; an on-path attacker could substitute a malicious payload.");
+            warn("Warning: source URL uses plain HTTP (not HTTPS). --allow-insecure-transport was set; an on-path attacker could substitute a malicious payload.");
         }
         const websiteOptions = buildWebsiteOptions(args);
         const result = await akmAdd({
@@ -152,6 +192,9 @@ export const addCommand = defineJsonCommand({
             options: Object.keys(websiteOptions).length > 0 ? websiteOptions : undefined,
             writable: args.writable,
             adapter: args.adapter,
+            before: args.before,
+            after: args.after,
+            credential: args.credential,
         });
         appendEvent({
             eventType: "add",
@@ -165,8 +208,8 @@ export const addCommand = defineJsonCommand({
         // Resolve the stash root from the install result and scan any env files
         // for dangerous env var keys.  When findings are present the install is
         // gated: TTY → interactive confirmation prompt; non-TTY without
-        // --allow-insecure → hard failure (exit 1).  Pass
-        // --allow-insecure to skip the prompt non-interactively.
+        // --allow-dangerous-env-keys → hard failure (exit 1). Pass the dedicated
+        // flag to skip the prompt non-interactively.
         const installedStashRoot = result.installed?.stashRoot ??
             (result.sourceAdded && "stashRoot" in result.sourceAdded ? result.sourceAdded.stashRoot : undefined);
         if (installedStashRoot) {

package/dist/commands/sources/bundle-cli.js

@@ -24,8 +24,9 @@
  * `proposal-new` shape). `show` is a new shape, `bundle-show`.
  */
 import { defineGroupCommand, defineJsonCommand, output } from "../../cli/shared.js";
-import { NotFoundError, UsageError } from "../../core/errors.js";
+import { NotFoundError, TransientError, UsageError } from "../../core/errors.js";
 import { appendEvent } from "../../core/events.js";
+import { warn } from "../../core/warn.js";
 import { addCommand } from "./add-cli.js";
 import { akmInit } from "./init.js";
 import { akmListSources, akmRemove, akmUpdate } from "./installed-stashes.js";
@@ -118,12 +119,20 @@ const removeCommand = defineJsonCommand({
     },
 });
 const updateCommand = defineJsonCommand({
-    meta: { name: "update", description: "Refresh one or all configured bundles and reconcile their index" },
+    meta: {
+        name: "update",
+        description: "Refresh one or all configured bundles and reconcile their index. Git refresh is explicit; schedule this command for automatic updates.",
+    },
     args: {
         target: { type: "positional", description: "Bundle to update (id or ref)", required: false },
         all: { type: "boolean", description: "Update all configured bundles and report each outcome", default: false },
         force: { type: "boolean", description: "Force fresh download even if version is unchanged", default: false },
-        "allow-insecure": {
+        "skip-if-locked": {
+            type: "boolean",
+            description: "Exit successfully when index/state database contention shows another akm operation is active",
+            default: false,
+        },
+        "allow-dangerous-env-keys": {
             type: "boolean",
             description: "Allow an update containing dangerous env keys (e.g. LD_PRELOAD, PATH). Use only after explicitly reviewing the staged bundle.",
             default: false,
@@ -140,20 +149,31 @@ const updateCommand = defineJsonCommand({
         },
     },
     async run({ args }) {
-        const result = await akmUpdate({
-            target: args.target,
-            all: args.all,
-            force: args.force,
-            yes: args.yes,
-            allowInsecure: args["allow-insecure"],
-        });
+        let result;
+        try {
+            result = await akmUpdate({
+                target: args.target,
+                all: args.all,
+                force: args.force,
+                yes: args.yes,
+                allowDangerousEnvKeys: args["allow-dangerous-env-keys"],
+            });
+        }
+        catch (error) {
+            const skippable = isSkippableBundleUpdateLock(error);
+            if (!args["skip-if-locked"] || !skippable)
+                throw error;
+            warn(`[bundle update] ${error.message}; skipping (--skip-if-locked)`);
+            output("update", { ok: true, skipped: { reason: "lock-held", code: error.code } });
+            return;
+        }
         appendEvent({
             eventType: "update",
             metadata: {
                 target: args.target ?? null,
                 all: args.all === true,
                 force: args.force === true,
-                allowInsecure: args["allow-insecure"] === true,
+                allowDangerousEnvKeys: args["allow-dangerous-env-keys"] === true,
                 processed: Array.isArray(result.processed)
                     ? result.processed.length
                     : 0,
@@ -162,6 +182,10 @@ const updateCommand = defineJsonCommand({
         output("update", result);
     },
 });
+export function isSkippableBundleUpdateLock(error) {
+    return (error instanceof TransientError &&
+        ["INDEX_DB_CONTENDED", "STATE_DB_CONTENDED", "MAINTENANCE_BARRIER_BUSY"].includes(error.code));
+}
 export const bundleCommand = defineGroupCommand({
     meta: {
         name: "bundle",

package/dist/commands/sources/bundle-config-ops.js

@@ -14,8 +14,38 @@
  */
 import path from "node:path";
 import { bundleKeyForContentRoot, primaryBundlePath } from "../../core/config/config.js";
+import { UsageError } from "../../core/errors.js";
 import { deriveBundleId } from "../../indexer/installations.js";
 export { primaryBundlePath };
+/**
+ * Insert or move a bundle at an explicit config-map position. Object insertion
+ * order is bundle resolution priority after `defaultBundle`, which always
+ * remains first. Without a position an existing key keeps its place and a new
+ * key is appended.
+ */
+export function placeBundle(bundles, key, entry, position = {}) {
+    if (position.before && position.after) {
+        throw new UsageError("Only one of --before or --after may be used.");
+    }
+    const target = position.before ?? position.after;
+    if (!target)
+        return { ...bundles, [key]: entry };
+    if (target === key)
+        throw new UsageError(`Bundle "${key}" cannot be positioned relative to itself.`);
+    if (!(target in bundles))
+        throw new UsageError(`Bundle position target "${target}" is not configured.`);
+    const ordered = {};
+    for (const [existingKey, existingEntry] of Object.entries(bundles)) {
+        if (existingKey === key)
+            continue;
+        if (position.before === existingKey)
+            ordered[key] = entry;
+        ordered[existingKey] = existingEntry;
+        if (position.after === existingKey)
+            ordered[key] = entry;
+    }
+    return ordered;
+}
 /**
  * Upsert the primary filesystem bundle (`{ path, writable: true }`) and point
  * `defaultBundle` at it. Reuses the current default key when it already names a

package/dist/commands/sources/dangerous-env-audit.js

@@ -85,13 +85,13 @@ export async function auditStashForDangerousKeys(opts) {
     }
     const stance = decideDangerousKeyInstall({
         findingsPresent: allFindings.length > 0,
-        allowInsecure: opts.allowDangerousKeys,
+        allowDangerousEnvKeys: opts.allowDangerousKeys,
     });
     if (stance === "allow")
         return { blocked: false, findings: allFindings };
     if (stance === "warn-allow") {
         for (const finding of allFindings) {
-            warn(`[dangerous-env-key] ${finding.relPath}: key \`${finding.keyName}\` in ${finding.envRef} can hijack process execution via \`akm env run\`. Proceeding because --allow-insecure was set.`);
+            warn(`[dangerous-env-key] ${finding.relPath}: key \`${finding.keyName}\` in ${finding.envRef} can hijack process execution via \`akm env run\`. Proceeding because --allow-dangerous-env-keys was set.`);
         }
         return { blocked: false, findings: allFindings };
     }
@@ -113,11 +113,11 @@ export async function auditStashForDangerousKeys(opts) {
         const confirmed = await p.confirm({ message: `${operationTitle} anyway?`, initialValue: false });
         if (!p.isCancel(confirmed) && confirmed === true)
             return { blocked: false, findings: allFindings };
-        error = `${operationTitle} aborted: stash contains dangerous env keys. Remove the keys or re-run with --allow-insecure to bypass.`;
+        error = `${operationTitle} aborted: stash contains dangerous env keys. Remove the keys or re-run with --allow-dangerous-env-keys to bypass.`;
     }
     else {
         const keyList = allFindings.map((finding) => `  - ${finding.keyName} (${finding.envRef})`).join("\n");
-        error = `${operationTitle} blocked: stash "${opts.ref}" contains dangerous env keys that can hijack process execution via \`akm env run\`:\n${keyList}\nRe-run with --allow-insecure to bypass this check after reviewing the env file.`;
+        error = `${operationTitle} blocked: stash "${opts.ref}" contains dangerous env keys that can hijack process execution via \`akm env run\`:\n${keyList}\nRe-run with --allow-dangerous-env-keys to bypass this check after reviewing the env file.`;
     }
     const rollbackWarning = await opts.rollback?.();
     if (opts.renderBlockedError !== false) {

package/dist/commands/sources/info.js

@@ -53,15 +53,15 @@ export function assembleInfo(options) {
     // Semantic status is read live from the index's own state, not a cached
     // verdict — a failed embed attempt at search time falls back to FTS and
     // reports that in the search response, it never disables the mode here.
-    // "ready-js" (a JS-computed cosine-similarity fallback for when the
-    // sqlite-vec extension is unavailable) is retired (index redesign, B5):
-    // the units vector store (`units_vec`) is a vec0 virtual table with no
-    // BLOB fallback, so there is nothing to have embeddings without also
-    // having the extension available — `vecAvailable` false and
-    // `hasEmbeddings` true together is no longer a reachable combination.
-    const semanticStatus = config.semanticSearchMode === "off" ? "disabled" : !indexStats.hasEmbeddings ? "pending" : "ready-vec";
+    const semanticStatus = config.semanticSearchMode === "off"
+        ? "disabled"
+        : !indexStats.hasEmbeddings
+            ? "pending"
+            : indexStats.vecAvailable
+                ? "ready-vec"
+                : "ready-js";
     const searchModes = ["fts"];
-    if (semanticStatus === "ready-vec") {
+    if (semanticStatus === "ready-js" || semanticStatus === "ready-vec") {
         searchModes.push("semantic", "hybrid");
     }
     return {