akm-cli 0.9.16-alpha.1 → 0.9.16

package/dist/commands/sources/source-manage.js

@@ -6,7 +6,8 @@ import { detectAdapterId } from "../../core/adapter/detect-adapter.js";
 import { isRemoteUrl } from "../../core/common.js";
 import { bundleEntryToSourceEntry, bundlesToSourceEntries, getSources, mutateConfig } from "../../core/config/config.js";
 import { ConfigError, UsageError } from "../../core/errors.js";
-import { bundleKeyForPath, bundleKeyForUrl, nextBundleKey } from "./bundle-config-ops.js";
+import { revokeSchedulerActivationsForBundle } from "../../tasks/activation-config.js";
+import { bundleKeyForPath, bundleKeyForUrl, nextBundleKey, placeBundle, } from "./bundle-config-ops.js";
 // ── Operations ──────────────────────────────────────────────────────────────
 /**
  * Add a stash source (filesystem path or remote provider URL) to config.
@@ -16,13 +17,16 @@ import { bundleKeyForPath, bundleKeyForUrl, nextBundleKey } from "./bundle-confi
  * (e.g. "website", "git").
  */
 export function addStash(opts) {
-    const { target, name, providerType, options: providerOptions, writable } = opts;
+    const { target, name, providerType, options: providerOptions, writable, credential, before, after } = opts;
     if (providerType === "openviking") {
         throw new ConfigError("openviking is not supported in akm v1.", "INVALID_CONFIG_FILE");
     }
     if (writable === true && providerType && providerType !== "filesystem" && providerType !== "git") {
         throw new ConfigError("writable: true is only supported on filesystem and git sources", "INVALID_CONFIG_FILE");
     }
+    if (credential && providerType !== "git") {
+        throw new ConfigError("credential is only supported on git sources", "INVALID_CONFIG_FILE");
+    }
     let result;
     const targetIsUrl = isRemoteUrl(target);
     if (targetIsUrl && !providerType) {
@@ -53,7 +57,15 @@ export function addStash(opts) {
                 return config;
             }
             key = nextBundleKey(bundles, name, target);
-            bundles[key] = urlBundleDescriptor(providerType, target, providerOptions, writable === true);
+            const entry = urlBundleDescriptor(providerType, target, providerOptions, writable === true, credential);
+            const nextBundles = placeBundle(bundles, key, entry, { before, after });
+            const next = { ...config, bundles: nextBundles };
+            result = {
+                sources: bundlesToSourceEntries(next) ?? [],
+                added: true,
+                entry: bundleEntryToSourceEntry(key, entry),
+            };
+            return next;
         }
         else {
             const resolvedPath = path.resolve(target);
@@ -62,18 +74,22 @@ export function addStash(opts) {
                 return config;
             }
             key = nextBundleKey(bundles, name, resolvedPath);
-            bundles[key] = {
+            const entry = {
                 path: resolvedPath,
                 ...(writable === true ? { writable: true } : {}),
                 components: {
                     main: { root: ".", adapter: detectAdapterId(resolvedPath), writable: writable ?? true },
                 },
             };
+            const nextBundles = placeBundle(bundles, key, entry, { before, after });
+            const next = { ...config, bundles: nextBundles };
+            result = {
+                sources: bundlesToSourceEntries(next) ?? [],
+                added: true,
+                entry: bundleEntryToSourceEntry(key, entry),
+            };
+            return next;
         }
-        const next = { ...config, bundles };
-        const entry = bundleEntryToSourceEntry(key, bundles[key]);
-        result = { sources: bundlesToSourceEntries(next) ?? [], added: true, entry };
-        return next;
     });
     return result;
 }
@@ -83,7 +99,7 @@ export function addStash(opts) {
  * package spec (e.g. "lodash", "@scope/pkg@^2") — never a URL (R-013,
  * rejected earlier in {@link addStash}).
  */
-function urlBundleDescriptor(providerType, locator, options, writable) {
+function urlBundleDescriptor(providerType, locator, options, writable, credential) {
     if (providerType === "website") {
         // Website provider options ride on the (passthrough) website descriptor and
         // round-trip back to `entry.options` via bundleEntryToSourceEntry.
@@ -94,8 +110,9 @@ function urlBundleDescriptor(providerType, locator, options, writable) {
     }
     if (providerType === "npm")
         return { npm: locator };
-    if (providerType === "git")
-        return { git: locator, ...(writable ? { writable: true } : {}) };
+    if (providerType === "git") {
+        return { git: locator, ...(writable ? { writable: true } : {}), ...(credential ? { credential } : {}) };
+    }
     throw new ConfigError(`unsupported source type "${providerType}"; expected filesystem, git, website, or npm`, "INVALID_CONFIG_FILE");
 }
 /**
@@ -120,7 +137,12 @@ export function removeStash(target) {
         }
         const removed = bundleEntryToSourceEntry(key, bundles[key]);
         delete bundles[key];
-        const next = { ...config, bundles: Object.keys(bundles).length > 0 ? bundles : undefined };
+        const next = revokeSchedulerActivationsForBundle({
+            ...config,
+            bundles: Object.keys(bundles).length > 0 ? bundles : undefined,
+            ...(config.defaultBundle === key ? { defaultBundle: undefined } : {}),
+            ...(config.defaultWriteTarget === key ? { defaultWriteTarget: undefined } : {}),
+        }, key);
         result = { sources: bundlesToSourceEntries(next) ?? [], removed: true, entry: removed };
         return next;
     });

package/dist/commands/sources/stash-cli.js

@@ -28,9 +28,10 @@
  * SIGINT/SIGTERM handlers in a try/finally — left byte-for-byte untouched.
  */
 import path from "node:path";
+import { defineCommand } from "citty";
 import * as p from "../../cli/clack.js";
 import { getParsedInvocation } from "../../cli/invocation.js";
-import { defineGroupCommand, defineJsonCommand, GLOBAL_OUTPUT_ARGS, output, parseAllFlagValues, } from "../../cli/shared.js";
+import { defineJsonCommand, GLOBAL_OUTPUT_ARGS, output, parseAllFlagValues, runWithJsonErrors } from "../../cli/shared.js";
 import { assertFlatAssetName } from "../../core/asset/asset-create.js";
 import { parseFrontmatter } from "../../core/asset/frontmatter.js";
 import { isHttpUrl, resolveStashDir } from "../../core/common.js";
@@ -39,51 +40,17 @@ import { UsageError } from "../../core/errors.js";
 import { appendEvent } from "../../core/events.js";
 import { resolveBundleWriteTarget } from "../../core/mutation-target.js";
 import { getCacheDir } from "../../core/paths.js";
-import { clearLogFile, info, isVerbose, setLogFile, warn } from "../../core/warn.js";
+import { clearLogFile, info, isVerbose, setLogFile } from "../../core/warn.js";
 import { resolveWriteTarget } from "../../core/write-source.js";
-import { DRAIN_BATCH_PROGRESS_PREFIX } from "../../indexer/drain.js";
+import { releaseIndexRebuildLock, tryAcquireIndexRebuildLock } from "../../indexer/index-rebuild-lock.js";
 import { akmIndex } from "../../indexer/indexer.js";
-import { RECONCILE_ROOT_PROGRESS_PREFIX } from "../../indexer/reconcile.js";
 import { getHyphenatedBoolean, getOutputMode } from "../../output/context.js";
 import { inferAssetName, mergeXrefsIntoContent, readKnowledgeInput, resolveSupersedesForWrite, resolveSupersedesWriteTarget, resolveXrefsForWrite, writeMarkdownAsset, } from "../read/knowledge.js";
-import { assembleIndexStatus } from "./index-status.js";
 import { assembleInfo } from "./info.js";
-/**
- * The two high-frequency, one-line-per-unit-of-work progress lines (#954) —
- * drain's per-batch commit line and reconcile's per-root "done" line —
- * excluded from non-verbose, non-text (JSON/yaml/etc) stderr. Matched by the
- * exact prefix each producer exports, not a re-derived regex, so the two
- * never drift apart (index-redesign B5g): this used to be a regex tuned to
- * the deleted per-entry pipeline's `Embedded N/M entries.` line, which never
- * matched either replacement line, so every progress line reached stderr
- * regardless of `--verbose`.
- */
-function isDetailProgressLine(message) {
-    return message.startsWith(DRAIN_BATCH_PROGRESS_PREFIX) || message.startsWith(RECONCILE_ROOT_PROGRESS_PREFIX);
-}
-export const indexStatusCommand = defineJsonCommand({
-    meta: {
-        name: "status",
-        description: "Show index.db's current state: files, entries, unit coverage, and the last reconcile time.",
-    },
-    run() {
-        output("index-status", assembleIndexStatus());
-    },
-});
-/**
- * `akm index` = reconcile + drain (docs/plans/index-redesign.md). Still a raw
- * group command (not `defineJsonCommand`) because its default body owns a
- * spinner, an AbortController, and SIGINT/SIGTERM handlers in a try/finally;
- * `defineGroupCommand` gives it `status` as a real subcommand while keeping
- * that default body as plain `akm index`'s behavior (S-057 canonical
- * bare-group rule does not apply here — a bare `akm index` has always run the
- * indexer, and that stays).
- */
-export const indexCommand = defineGroupCommand({
-    meta: {
-        name: "index",
-        description: "Reconcile the search index and drain the embedding queue (--full forces a full re-derivation)",
-    },
+/** Matches the high-frequency per-committed-batch progress line (#954), excluded from non-verbose JSON-mode stderr. */
+const EMBEDDED_BATCH_PROGRESS_PATTERN = /^Embedded \d+\/\d+ entries\.$/;
+export const indexCommand = defineCommand({
+    meta: { name: "index", description: "Build search index (incremental by default; --full forces full reindex)" },
     args: {
         // R-051: `index` is a raw `defineCommand` (not `defineJsonCommand`), so it
         // does not get `GLOBAL_OUTPUT_ARGS` for free. `--format`/`--detail`/
@@ -91,99 +58,124 @@ export const indexCommand = defineGroupCommand({
         // extra positional for a stray value to fall into), so this is purely a
         // `--help` visibility / consistency fix, not a behavior change.
         ...GLOBAL_OUTPUT_ARGS,
-        full: {
+        full: { type: "boolean", description: "Force full reindex", default: false },
+        clean: {
+            type: "boolean",
+            description: "After indexing, remove any entries whose source file no longer exists on disk.",
+            default: false,
+        },
+        "dry-run": {
             type: "boolean",
-            description: "Force every file to be re-derived (ignore the unchanged-file shortcut), reconciling in place — " +
-                "existing rows keep their id/embeddings/utility scores; nothing is dropped first.",
+            description: "When combined with --clean, report stale entries without deleting them.",
             default: false,
         },
         reembed: {
             type: "boolean",
-            description: "Drop the active embedding identity's vectors, then re-embed every unit from scratch.",
+            description: "Force re-embedding of every entry, bypassing the embedding-model-rename compatibility check.",
             default: false,
         },
         "skip-if-locked": {
             type: "boolean",
-            description: "Deprecated, no effect. Index runs no longer take a rebuild lock (docs/plans/index-redesign.md) — " +
-                "every write is a short, idempotent, content-addressed transaction, so two concurrent index runs " +
-                "converge instead of contending. Kept only so existing scripts do not fail on an unknown flag.",
+            description: "If another `akm index` run already holds the rebuild lock, skip gracefully (exit 0) instead of contending with it. Use for scheduled/opportunistic index runs so they don't pile up against a longer run in progress.",
             default: false,
         },
     },
-    subCommands: { status: indexStatusCommand },
-    async defaultRun({ args }) {
-        if (getHyphenatedBoolean(args, "enrich") || getParsedInvocation().getFlagValue("--enrich") !== undefined) {
-            throw new UsageError("`akm index --enrich` has been removed. Plain `akm index` now performs metadata enrichment by default.");
-        }
-        if (getHyphenatedBoolean(args, "re-enrich") || getParsedInvocation().getFlagValue("--re-enrich") !== undefined) {
-            throw new UsageError("`akm index --re-enrich` has been removed. Re-enrichment of index-time LLM passes is not exposed in this slice.");
-        }
-        if (args["skip-if-locked"]) {
-            warn("[index] --skip-if-locked is deprecated and has no effect — index runs no longer take a rebuild lock.");
-        }
-        const outputMode = getOutputMode();
-        const controller = new AbortController();
-        const abort = () => controller.abort(new Error("index interrupted"));
-        process.once("SIGINT", abort);
-        process.once("SIGTERM", abort);
-        const indexLogFile = path.join(getCacheDir(), "logs", "index", `${new Date().toISOString().replace(/[:.]/g, "-")}.log`);
-        setLogFile(indexLogFile);
-        const verbose = isVerbose();
-        const spin = !verbose && outputMode.format === "text" ? p.spinner() : null;
-        if (spin) {
-            spin.start(`Building search index${args.full ? " (full rebuild)" : ""}...`);
-        }
-        let latestMessage = "";
-        // Resolve the stash dir once at the `akm index` command boundary and
-        // thread it into the indexer (WI-9.10 CLI-wide sweep) — the indexer leaf
-        // no longer reads the ambient `resolveStashDir()`.
-        const stashDir = resolveStashDir();
-        try {
-            const result = await akmIndex({
-                stashDir,
-                full: args.full,
-                reembed: args.reembed,
-                onProgress: ({ phase, message, processed, total }) => {
-                    latestMessage = message;
-                    const progressPrefix = processed !== undefined && total !== undefined ? `[${processed}/${total}] ` : "";
-                    if (verbose) {
-                        info(`[index:${phase}] ${progressPrefix}${message}`);
-                    }
-                    else if (spin) {
-                        spin.stop(`${progressPrefix}${message}`);
-                        spin.start(`${progressPrefix}${message}`);
-                    }
-                    else if (!isDetailProgressLine(message)) {
-                        // Non-verbose, non-text (JSON/yaml/etc) mode: silence used to be
-                        // total until the run finished (#954) — a stalled
-                        // run looked identical to "nothing written". Phase-start
-                        // messages, the credential diagnostic, and the reconcile/drain
-                        // totals now reach stderr here too; the high-frequency
-                        // per-root `Reconciled "…"` and per-batch `[drain] batch N: …`
-                        // lines are deliberately excluded — that would be spam, not a
-                        // heartbeat. `--verbose` (the `if` branch above) still gets
-                        // every one of them.
-                        info(`[index:${phase}] ${progressPrefix}${message}`);
-                    }
-                },
-                signal: controller.signal,
-            });
-            if (spin) {
-                spin.stop(`Indexed ${result.totalEntries} assets.`);
+    async run({ args }) {
+        await runWithJsonErrors(async () => {
+            if (getHyphenatedBoolean(args, "enrich") || getParsedInvocation().getFlagValue("--enrich") !== undefined) {
+                throw new UsageError("`akm index --enrich` has been removed. Plain `akm index` now performs metadata enrichment by default.");
             }
-            output("index", result);
-        }
-        catch (error) {
+            if (getHyphenatedBoolean(args, "re-enrich") || getParsedInvocation().getFlagValue("--re-enrich") !== undefined) {
+                throw new UsageError("`akm index --re-enrich` has been removed. Re-enrichment of index-time LLM passes is not exposed in this slice.");
+            }
+            // #956: opt-in, non-blocking rebuild lock — never gates a human-typed
+            // `akm index` (it only warns and contends), but a scheduled/opportunistic
+            // caller can pass --skip-if-locked to step aside instead of piling up
+            // behind a run already in progress. Acquired before any other side
+            // effect (log file, spinner) so a skip does neither.
+            const lockAcquisition = tryAcquireIndexRebuildLock(args["skip-if-locked"]);
+            if (lockAcquisition.state === "skipped") {
+                output("index", {
+                    ok: true,
+                    skipped: {
+                        reason: "lock-held",
+                        pid: lockAcquisition.holder.pid,
+                        // #956: the launcher pid (when known) alongside the pid that
+                        // actually holds the lock — every process listing and task log
+                        // shows the launcher pid, not the bun/node child's.
+                        launcherPid: lockAcquisition.holder.launcherPid,
+                        startedAt: lockAcquisition.holder.startedAt,
+                    },
+                });
+                return;
+            }
+            const outputMode = getOutputMode();
+            const controller = new AbortController();
+            const abort = () => controller.abort(new Error("index interrupted"));
+            process.once("SIGINT", abort);
+            process.once("SIGTERM", abort);
+            const indexLogFile = path.join(getCacheDir(), "logs", "index", `${new Date().toISOString().replace(/[:.]/g, "-")}.log`);
+            setLogFile(indexLogFile);
+            const verbose = isVerbose();
+            const spin = !verbose && outputMode.format === "text" ? p.spinner() : null;
             if (spin) {
-                spin.stop(latestMessage ? `Indexing failed after: ${latestMessage}` : "Indexing failed.");
+                spin.start(`Building search index${args.full ? " (full rebuild)" : ""}...`);
             }
-            throw error;
-        }
-        finally {
-            clearLogFile();
-            process.off("SIGINT", abort);
-            process.off("SIGTERM", abort);
-        }
+            let latestMessage = "";
+            // Resolve the stash dir once at the `akm index` command boundary and
+            // thread it into the indexer (WI-9.10 CLI-wide sweep) — the indexer leaf
+            // no longer reads the ambient `resolveStashDir()`.
+            const stashDir = resolveStashDir();
+            try {
+                const result = await akmIndex({
+                    stashDir,
+                    full: args.full,
+                    clean: args.clean,
+                    dryRun: args["dry-run"],
+                    reembed: args.reembed,
+                    onProgress: ({ phase, message, processed, total }) => {
+                        latestMessage = message;
+                        const progressPrefix = processed !== undefined && total !== undefined ? `[${processed}/${total}] ` : "";
+                        if (verbose) {
+                            info(`[index:${phase}] ${progressPrefix}${message}`);
+                        }
+                        else if (spin) {
+                            spin.stop(`${progressPrefix}${message}`);
+                            spin.start(`${progressPrefix}${message}`);
+                        }
+                        else if (!EMBEDDED_BATCH_PROGRESS_PATTERN.test(message)) {
+                            // Non-verbose, non-text (JSON/yaml/etc) mode: silence used to be
+                            // total until the run finished (#954) — a stalled
+                            // run looked identical to "nothing written". Phase-start
+                            // messages and the embedding heartbeat now reach stderr here
+                            // too; the high-frequency per-batch `Embedded N/M entries.`
+                            // line (emitted after every committed batch)
+                            // is deliberately excluded — that would be spam, not a
+                            // heartbeat.
+                            info(`[index:${phase}] ${progressPrefix}${message}`);
+                        }
+                    },
+                    signal: controller.signal,
+                });
+                if (spin) {
+                    spin.stop(`Indexed ${result.totalEntries} assets.`);
+                }
+                output("index", result);
+            }
+            catch (error) {
+                if (spin) {
+                    spin.stop(latestMessage ? `Indexing failed after: ${latestMessage}` : "Indexing failed.");
+                }
+                throw error;
+            }
+            finally {
+                clearLogFile();
+                process.off("SIGINT", abort);
+                process.off("SIGTERM", abort);
+                if (lockAcquisition.state === "acquired")
+                    releaseIndexRebuildLock(lockAcquisition.ownership);
+            }
+        });
     },
 });
 export const infoCommand = defineJsonCommand({

package/dist/commands/sources/stash-skeleton.js

@@ -73,6 +73,8 @@ export function scaffoldStashMeta(stashDir) {
 }
 /** Marks the akm-authored block in a stash `.gitignore` (idempotency anchor). */
 const STASH_GITIGNORE_MARKER = "# akm: keep secret material out of git by default";
+/** Documented opt-out for private bundles that deliberately version env/ and secrets/. */
+export const STASH_GITIGNORE_TRACK_SECRETS_MARKER = "# akm: intentionally track env and secrets";
 const STASH_GITIGNORE_BLOCK = [
     STASH_GITIGNORE_MARKER,
     "# env/ and secrets/ assets hold tokens and keys. They are ignored by default",
@@ -89,14 +91,15 @@ const STASH_GITIGNORE_BLOCK = [
  *
  * Idempotent + non-clobbering: creates the file when absent, appends the akm
  * block when the file exists but lacks it (preserving the user's own rules),
- * and no-ops once the marker is present. The user opts INTO versioning by
- * un-ignoring a path.
+ * and no-ops once the marker is present. A private bundle that deliberately
+ * versions all secret material can add `# akm: intentionally track env and
+ * secrets`; that explicit marker suppresses this helper entirely (#981).
  */
 export function ensureStashGitignore(stashDir) {
     try {
         const gitignorePath = path.join(stashDir, ".gitignore");
         const existing = fs.existsSync(gitignorePath) ? fs.readFileSync(gitignorePath, "utf8") : "";
-        if (existing.includes(STASH_GITIGNORE_MARKER))
+        if (existing.includes(STASH_GITIGNORE_MARKER) || existing.includes(STASH_GITIGNORE_TRACK_SECRETS_MARKER))
             return;
         const gap = existing.length === 0 ? "" : existing.endsWith("\n") ? "\n" : "\n\n";
         fs.writeFileSync(gitignorePath, `${existing}${gap}${STASH_GITIGNORE_BLOCK}`);

package/dist/commands/tasks/explain.js

@@ -77,12 +77,14 @@
  */
 import fs from "node:fs";
 import { detectAdapterId } from "../../core/adapter/detect-adapter.js";
+import { makeBundleRef } from "../../core/asset/asset-ref.js";
 import { loadConfig } from "../../core/config/config.js";
 import { NotFoundError } from "../../core/errors.js";
 import { applyInputDefaults, materializeInputFlags, } from "../../execution/input-contract.js";
 import { createInlineResolvedCommand } from "../../execution/resolved-request.js";
 import { resolveAdapterConceptOwner } from "../../indexer/lookup/adapter-concept-owner.js";
 import { prepareResolvedExecution } from "../../integrations/agent/execution-preparation.js";
+import { isSchedulerRefEnabled } from "../../tasks/activation-config.js";
 import { parseTaskSource } from "../../tasks/source/parse-task-source.js";
 import { projectTaskSourceV4 } from "../../tasks/source/project-v4.js";
 import { TASK_INPUT_DIAGNOSTICS } from "../../tasks/source/task-input-diagnostics.js";
@@ -270,10 +272,11 @@ export async function akmTaskExplain(ref, options = {}) {
     const materializedInputs = materializeInputFlags(inputContract, options.inputFlags ?? [], TASK_INPUT_DIAGNOSTICS);
     const defaultedInputs = applyInputDefaults(inputContract, materializedInputs);
     const document = projectTaskSourceV4(parsed.v4);
+    const enabled = isSchedulerRefEnabled(loadConfig(), "task", makeBundleRef(bundle.source.name, taskConceptId));
     const schedule = parsed.v4.schedule.map((entry) => ({
         ordinal: entry.ordinal,
         cron: entry.cron,
-        enabled: entry.enabled,
+        enabled,
         source: entry.source,
         inputs: Object.fromEntries(Object.entries(entry.inputs).map(([name, value]) => {
             const redaction = redactIfSecretShaped(name, value);

package/dist/commands/tasks/tasks-cli.js

@@ -12,13 +12,11 @@
  * that would skip pending cleanup).
  *
  * 0.9 CLI overhaul (S6): the group was renamed from the plural `tasks` to the
- * singular `task` — hard break, no alias. `init`/`enable`/`disable` are
- * dropped: the default improve-schedule task set now ships as embedded
+ * singular `task` — hard break, no alias. `init` was dropped: the default improve-schedule task set now ships as embedded
  * templates under src/assets/tasks/improve/ (see src/tasks/embedded.ts),
  * seeded through the interactive `akm setup` task-review step instead of a
- * separate CLI command, and toggling a task's enabled state is a file edit +
- * `task sync` (tasks-sync.test.ts already proves the flip path). Every
- * subcommand (`add`/`run`/`history`/`sync`) shares one `--bundle <bundle>`
+ * separate CLI command. `enable`/`disable` mutate the host-local scheduler
+ * allow-list, never the task source. Every subcommand shares one `--bundle <bundle>`
  * axis (S8.4 ratified `task add`'s `--target` → `--bundle`; a later Gate-1
  * fix reverted it to match `import`/`proposal accept`, splitting the
  * write-target axis three-vs-one against `remember`/`clone`/`improve` — the
@@ -35,7 +33,7 @@ import { TASK_RUN_BOOLEAN_FLAGS, TASK_RUN_VALUE_FLAGS } from "../../tasks/task-r
 import { akmSearch, parseSearchSource } from "../read/search.js";
 import { rejectRetiredSourceFlag } from "../read/search-cli.js";
 import { akmTaskExplain } from "./explain.js";
-import { akmTasksAdd, akmTasksDoctor, akmTasksHistory, akmTasksPrune, akmTasksRun, akmTasksSync, akmTasksSyncPlan, } from "./tasks.js";
+import { akmTasksAdd, akmTasksDisable, akmTasksDoctor, akmTasksEnable, akmTasksHistory, akmTasksPrune, akmTasksRun, akmTasksSync, akmTasksSyncPlan, } from "./tasks.js";
 import { akmTaskValidate } from "./validate.js";
 /** Shared `--bundle <bundle>` arg wired onto every task subcommand. */
 const bundleArg = {
@@ -294,6 +292,28 @@ const tasksRunCommand = defineCommand({
         });
     },
 });
+const tasksEnableCommand = defineJsonCommand({
+    meta: { name: "enable", description: "Enable a task in this host's scheduler configuration and sync it" },
+    args: {
+        ref: { type: "positional", description: "Task ref or id", required: true },
+        ...bundleArg,
+    },
+    async run({ args }) {
+        rejectRetiredTaskTargetFlag();
+        output("task-enable", await akmTasksEnable(args.ref, { target: args.bundle }));
+    },
+});
+const tasksDisableCommand = defineJsonCommand({
+    meta: { name: "disable", description: "Disable a task in this host's scheduler configuration and sync it" },
+    args: {
+        ref: { type: "positional", description: "Task ref or id", required: true },
+        ...bundleArg,
+    },
+    async run({ args }) {
+        rejectRetiredTaskTargetFlag();
+        output("task-disable", await akmTasksDisable(args.ref, { target: args.bundle }));
+    },
+});
 /**
  * #911: `task run <id>` and `task explain <ref>` take the id positionally, so
  * `task history <id>` is the natural thing to write — and it used to be
@@ -415,8 +435,8 @@ const tasksDoctorCommand = defineJsonCommand({
     },
 });
 /**
- * #907: `akm task validate`'s exit-code contract — `valid`/`converts` are
- * successful outcomes (exit 0); `blocked`/`invalid`/`not-a-task` are
+ * #907: `akm task validate`'s exit-code contract — only current-schema
+ * `valid` is successful (exit 0); `blocked`/`invalid`/`not-a-task` are
  * diagnosed defects the caller must act on (exit 1, mirroring `task sync`'s
  * own `failures.length > 0 -> EXIT_CODES.GENERAL`). A missing path or an
  * unreadable file never reaches this function at all — `akmTaskValidate`
@@ -424,7 +444,7 @@ const tasksDoctorCommand = defineJsonCommand({
  * already maps to exit 2.
  */
 export function taskValidateExitCode(result) {
-    return result.outcome === "valid" || result.outcome === "converts" ? undefined : EXIT_CODES.GENERAL;
+    return result.outcome === "valid" ? undefined : EXIT_CODES.GENERAL;
 }
 const tasksValidateCommand = defineJsonCommand({
     meta: {
@@ -532,6 +552,8 @@ export const taskCommand = defineGroupCommand({
     },
     subCommands: {
         add: tasksAddCommand,
+        enable: tasksEnableCommand,
+        disable: tasksDisableCommand,
         run: tasksRunCommand,
         explain: tasksExplainCommand,
         validate: tasksValidateCommand,