akm-cli 0.9.16-alpha.1 → 0.9.16

package/dist/core/config/config.js

@@ -11,8 +11,8 @@ import { ConfigError } from "../errors.js";
 import { liftLegacyEngineExtraParams } from "../extra-params.js";
 import { formatRegistryLabel, hasRegistryUrlCredentials } from "../registry-url.js";
 import { acquireConfigLock, backupExistingConfig, parseConfigText, readConfigText, withConfigLock, writeConfigAtomic, } from "./config-io.js";
-import { AkmConfigSchema, CURRENT_CONFIG_VERSION } from "./config-schema.js";
-import { bundleComponentConfig, bundleContentRoot, bundlesToSourceEntries } from "./config-sources.js";
+import { AkmConfigSchema, CURRENT_CONFIG_VERSION, listTopLevelConfigKeys } from "./config-schema.js";
+import { bundleComponentConfig, bundleContentRoot, bundleContentRoots, bundlesToSourceEntries } from "./config-sources.js";
 import { upgradeConfigVersion } from "./config-version-shim.js";
 import { deepMergeConfig, isPlainObject } from "./deep-merge.js";
 import { migrateLegacySourceShape } from "./legacy-source-shape-shim.js";
@@ -192,21 +192,60 @@ function liftExtraParamsOrThrow(parsedRaw, sourcePath) {
  * keeps around, instead of only getting the final merged `AkmConfig` back.
  */
 function buildEffectiveConfig(liftedLocalRaw, sourcePath) {
+    warnUnknownTopLevelConfigKeys(liftedLocalRaw, sourcePath);
     const withExtends = resolveExtendsChain(liftedLocalRaw, sourcePath);
     const where = sourcePath ? ` at ${sourcePath}` : "";
     const parsed = AkmConfigSchema.safeParse(withExtends);
     if (!parsed.success) {
         const lines = parsed.error.issues.map((i) => `  - ${i.path.join(".") || "(root)"}: ${i.message}`).join("\n");
-        throw new ConfigError(`Invalid config${where}:\n${lines}`, "INVALID_CONFIG_FILE");
+        const needsSchedulerMigration = parsed.error.issues.some((issue) => issue.path[0] === "scheduler" && issue.path.at(-1) === "sourceId");
+        throw new ConfigError(`Invalid config${where}:\n${lines}`, "INVALID_CONFIG_FILE", needsSchedulerMigration
+            ? "Run `akm migrate apply` to bind existing scheduler grants to their source."
+            : undefined);
     }
     const merged = deepMergeConfig(DEFAULT_CONFIG, parsed.data);
     const finalResult = AkmConfigSchema.safeParse(merged);
     if (!finalResult.success) {
         const lines = finalResult.error.issues.map((i) => `  - ${i.path.join(".") || "(root)"}: ${i.message}`).join("\n");
-        throw new ConfigError(`Invalid merged config${sourcePath ? ` at ${sourcePath}` : ""}:\n${lines}`, "INVALID_CONFIG_FILE");
+        const needsSchedulerMigration = finalResult.error.issues.some((issue) => issue.path[0] === "scheduler" && issue.path.at(-1) === "sourceId");
+        throw new ConfigError(`Invalid merged config${sourcePath ? ` at ${sourcePath}` : ""}:\n${lines}`, "INVALID_CONFIG_FILE", needsSchedulerMigration
+            ? "Run `akm migrate apply` to bind existing scheduler grants to their source."
+            : undefined);
     }
+    assertUniquePhysicalBundleRoots(finalResult.data, sourcePath);
     return finalResult.data;
 }
+const RETIRED_TOP_LEVEL_CONFIG_KEYS = new Set([
+    "agent",
+    "bindings",
+    "features",
+    "installed",
+    "llm",
+    "modelAliases",
+    "profiles",
+    "sources",
+    "stashDir",
+    "stashes",
+    "writable",
+]);
+function warnUnknownTopLevelConfigKeys(raw, sourcePath) {
+    const known = new Set(listTopLevelConfigKeys());
+    for (const key of Object.keys(raw).sort()) {
+        if (known.has(key) || RETIRED_TOP_LEVEL_CONFIG_KEYS.has(key))
+            continue;
+        warnOnce(`config:unknown-key:${sourcePath ?? "inline"}:${key}`, `Unknown config key ${JSON.stringify(key)}${sourcePath ? ` at ${sourcePath}` : ""} has no defined akm behavior. Check the spelling or remove it.`);
+    }
+}
+function assertUniquePhysicalBundleRoots(config, sourcePath) {
+    const owners = new Map();
+    for (const { id, contentRoot } of bundleContentRoots(config)) {
+        const prior = owners.get(contentRoot);
+        if (prior !== undefined) {
+            throw new ConfigError(`Invalid config${sourcePath ? ` at ${sourcePath}` : ""}: bundles ${JSON.stringify(prior)} and ${JSON.stringify(id)} resolve to the same physical content root ${contentRoot}.`, "INVALID_CONFIG_FILE", "Configure one bundle id per physical source root; symbolic-link aliases are not separate bundles.");
+        }
+        owners.set(contentRoot, id);
+    }
+}
 /**
  * Parse raw config text and validate via Zod.
  * ({@link AkmConfigSchema}). Returns the merged-with-defaults AkmConfig.
@@ -233,6 +272,7 @@ function collectExtendsLayers(localRaw, configPath) {
     const visited = new Set(configPath ? [path.resolve(configPath)] : []);
     let current = localRaw;
     let currentPath = configPath;
+    let containmentRoot;
     while (true) {
         const ref = current.extends;
         if (ref === undefined)
@@ -240,15 +280,18 @@ function collectExtendsLayers(localRaw, configPath) {
         if (typeof ref !== "string" || !ref.trim()) {
             throw new ConfigError(`Invalid "extends"${currentPath ? ` at ${currentPath}` : ""}: expected a non-empty string (a file path or bundle//path ref), got ${JSON.stringify(ref)}.`, "INVALID_CONFIG_FILE");
         }
-        const { text, resolvedPath } = resolveConfigRefSource(ref, current, currentPath);
+        const resolved = resolveConfigRefSource(ref, current, currentPath, containmentRoot);
+        const { text, resolvedPath } = resolved;
         if (visited.has(resolvedPath)) {
             throw new ConfigError(`Config "extends" cycle detected: "${ref}"${currentPath ? ` (from ${currentPath})` : ""} resolves back to an already-visited config at ${resolvedPath}.`, "INVALID_CONFIG_FILE");
         }
         visited.add(resolvedPath);
         const baseRaw = runConfigFilePipeline(text, resolvedPath);
+        warnUnknownTopLevelConfigKeys(baseRaw, resolvedPath);
         layers.push({ ref, raw: baseRaw });
         current = baseRaw;
         currentPath = resolvedPath;
+        containmentRoot = resolved.containmentRoot;
     }
 }
 /**
@@ -274,10 +317,84 @@ function resolveExtendsChain(localRaw, configPath) {
     const layers = collectExtendsLayers(localRaw, configPath);
     let merged = {};
     for (let i = layers.length - 1; i >= 0; i--) {
-        merged = deepMergeConfig(merged, layers[i].raw);
+        const layer = layers[i];
+        merged = deepMergeConfig(merged, i > 0 ? sanitizeInheritedConfig(layer.raw, layer.ref ?? String(i)) : layer.raw);
     }
     return merged;
 }
+const HOST_LOCAL_CONFIG_KEYS = new Set([
+    "bundles",
+    "defaultBundle",
+    "defaultWriteTarget",
+    "embedding",
+    "execution",
+    "experimental",
+    "registries",
+    "scheduler",
+    "setup",
+]);
+/**
+ * Shared config contributes portable behavior only. Source ownership,
+ * credentials, executable paths/arguments, and activation remain in the
+ * host's top-level config even when a bundle supplies the inherited file.
+ * LLM endpoints and model selection remain portable; their credentials never
+ * do.
+ */
+function sanitizeInheritedConfig(raw, label) {
+    const inherited = { ...raw };
+    for (const key of HOST_LOCAL_CONFIG_KEYS) {
+        if (!Object.hasOwn(inherited, key))
+            continue;
+        delete inherited[key];
+        warnOnce(`config:inherited-host-local:${label}:${key}`, `Ignoring inherited config key ${JSON.stringify(key)} from ${label}; it is host-local and must be declared in the top-level config file.`);
+    }
+    if (isPlainObject(inherited.engines)) {
+        const engines = {};
+        let strippedAuthority = false;
+        for (const [name, engine] of Object.entries(inherited.engines)) {
+            if (!isPlainObject(engine)) {
+                engines[name] = engine;
+                continue;
+            }
+            const portable = { ...engine };
+            for (const key of ["apiKey", "apiKeyFile", "bin", "args", "workspace"]) {
+                if (!Object.hasOwn(portable, key))
+                    continue;
+                delete portable[key];
+                strippedAuthority = true;
+            }
+            engines[name] = portable;
+        }
+        inherited.engines = engines;
+        if (strippedAuthority) {
+            warnOnce(`config:inherited-host-local:${label}:engines-authority`, `Ignoring inherited engine credentials, executable arguments, or workspace from ${label}; those fields are host-local.`);
+        }
+    }
+    if (isPlainObject(inherited.search) && Object.hasOwn(inherited.search, "curateRerank")) {
+        const { curateRerank: _curateRerank, ...portableSearch } = inherited.search;
+        inherited.search = portableSearch;
+        warnOnce(`config:inherited-host-local:${label}:search.curateRerank`, `Ignoring inherited config key "search.curateRerank" from ${label}; network endpoints and credentials are host-local.`);
+    }
+    if (isPlainObject(inherited.improve) && isPlainObject(inherited.improve.strategies)) {
+        const strategies = {};
+        let strippedSync = false;
+        for (const [name, profile] of Object.entries(inherited.improve.strategies)) {
+            if (isPlainObject(profile) && Object.hasOwn(profile, "sync")) {
+                const { sync: _sync, ...portableProfile } = profile;
+                strategies[name] = portableProfile;
+                strippedSync = true;
+            }
+            else {
+                strategies[name] = profile;
+            }
+        }
+        inherited.improve = { ...inherited.improve, strategies };
+        if (strippedSync) {
+            warnOnce(`config:inherited-host-local:${label}:improve.sync`, `Ignoring inherited improve strategy sync policy from ${label}; publication policy is host-local.`);
+        }
+    }
+    return inherited;
+}
 /** `~` expands to the home directory, mirroring `apiKeyFile`'s resolution (engine-resolution.ts). */
 function expandExtendsHomePath(p) {
     return p.startsWith("~") ? path.join(os.homedir(), p.slice(1)) : p;
@@ -299,12 +416,12 @@ function looksLikeBundleAssetRef(ref) {
  * a missing file/bundle throws {@link ConfigError} naming the ref, as does an
  * empty, absolute, or content-root-escaping path after `//`.
  */
-function resolveConfigRefSource(ref, context, fromConfigPath) {
+function resolveConfigRefSource(ref, context, fromConfigPath, containmentRoot) {
     return looksLikeBundleAssetRef(ref)
-        ? resolveConfigBundleRefSource(ref, context)
-        : resolveConfigFileRefSource(ref, fromConfigPath);
+        ? resolveConfigBundleRefSource(ref, context, containmentRoot)
+        : resolveConfigFileRefSource(ref, fromConfigPath, containmentRoot);
 }
-function resolveConfigFileRefSource(ref, fromConfigPath) {
+function resolveConfigFileRefSource(ref, fromConfigPath, containmentRoot) {
     const expanded = expandExtendsHomePath(ref);
     let resolvedPath;
     if (path.isAbsolute(expanded)) {
@@ -316,13 +433,15 @@ function resolveConfigFileRefSource(ref, fromConfigPath) {
     else {
         throw new ConfigError(`extends "${ref}" is a relative path, but the current config has no known file location to resolve it against.`, "INVALID_CONFIG_FILE");
     }
+    if (containmentRoot !== undefined)
+        assertConfigExtendsPhysicalContainment(containmentRoot, resolvedPath, ref);
     const text = readConfigText(resolvedPath);
     if (text === undefined) {
         throw new ConfigError(`extends "${ref}" resolves to ${resolvedPath}, which does not exist. Create the file first, or point "extends" at an existing config.`, "INVALID_CONFIG_FILE");
     }
-    return { text, resolvedPath };
+    return { text, resolvedPath, ...(containmentRoot ? { containmentRoot } : {}) };
 }
-function resolveConfigBundleRefSource(ref, context) {
+function resolveConfigBundleRefSource(ref, context, outerContainmentRoot) {
     // Split by hand rather than through `parseBundleRef`: the part after `//`
     // is a plain file path here, not an asset conceptId, so it must not be run
     // through conceptId validation (which, for instance, rejects every `..`
@@ -360,11 +479,31 @@ function resolveConfigBundleRefSource(ref, context) {
     if (relativeToRoot === ".." || relativeToRoot.startsWith(`..${path.sep}`) || path.isAbsolute(relativeToRoot)) {
         throw new ConfigError(`extends "${ref}" escapes bundle "${bundleId}"'s content root.`, "INVALID_CONFIG_FILE");
     }
+    const containmentRoot = fs.realpathSync.native(bundleRoot);
+    assertConfigExtendsPhysicalContainment(containmentRoot, resolvedPath, ref);
+    if (outerContainmentRoot !== undefined) {
+        assertConfigExtendsPhysicalContainment(outerContainmentRoot, resolvedPath, ref);
+    }
     const text = readConfigText(resolvedPath);
     if (text === undefined) {
         throw new ConfigError(`extends "${ref}" resolves to ${resolvedPath}, which does not exist locally. Sync the bundle first, or point "extends" at an existing file.`, "INVALID_CONFIG_FILE");
     }
-    return { text, resolvedPath };
+    return { text, resolvedPath, containmentRoot: outerContainmentRoot ?? containmentRoot };
+}
+function assertConfigExtendsPhysicalContainment(root, candidate, ref) {
+    let physicalRoot;
+    let physicalCandidate;
+    try {
+        physicalRoot = fs.realpathSync.native(root);
+        physicalCandidate = fs.realpathSync.native(candidate);
+    }
+    catch (cause) {
+        throw new ConfigError(`Unable to verify physical containment for extends ${JSON.stringify(ref)}: ${cause instanceof Error ? cause.message : String(cause)}`, "INVALID_CONFIG_FILE");
+    }
+    const relative = path.relative(physicalRoot, physicalCandidate);
+    if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+        throw new ConfigError(`extends ${JSON.stringify(ref)} resolves through a symbolic link outside its bundle content root.`, "INVALID_CONFIG_FILE");
+    }
 }
 /**
  * `akm config get --show-source` (#945): which raw layer the dotted path's
@@ -382,7 +521,8 @@ export function getConfigValueSource(dotted) {
     const liftedConfig = runConfigFilePipeline(text, configPath);
     const segments = dotted.split(".").filter((s) => s.length > 0);
     for (const layer of collectExtendsLayers(liftedConfig, configPath)) {
-        if (hasRawPath(layer.raw, segments)) {
+        const effectiveLayer = layer.ref === undefined ? layer.raw : sanitizeInheritedConfig(layer.raw, layer.ref);
+        if (hasRawPath(effectiveLayer, segments)) {
             return layer.ref === undefined ? "local" : `extends:${layer.ref}`;
         }
     }
@@ -487,15 +627,41 @@ function pruneUnchangedInheritedFields(before, after, localRaw) {
 }
 /**
  * What to persist for a `mutateConfig`/`mutateConfigWithPrecommit` write:
- * the full effective `next` when the local file has no `extends` (unchanged
- * pre-#945 behavior), otherwise only the changed-or-already-local fields
- * (#945 finding above).
+ * only the changed-or-already-local fields. This applies both to inherited
+ * configs and ordinary configs: lifecycle mutations must not serialize every
+ * schema default merely because validation materialized it in memory (#972).
  */
-function configWriteBody(localRaw, current, next) {
-    const usesExtends = typeof localRaw?.extends === "string" && localRaw.extends.trim().length > 0;
-    if (!usesExtends)
+function configWriteBody(localRaw, current, next, persistTopLevelKeys = []) {
+    // A first write keeps the established full-default scaffold. Besides being
+    // useful to a new user, the add -> rejected-install -> remove lifecycle
+    // relies on that symmetry to return a pristine install to DEFAULT_CONFIG.
+    if (localRaw === undefined)
         return next;
-    return pruneUnchangedInheritedFields(current, next, localRaw);
+    const pruned = pruneUnchangedInheritedFields(current, next, localRaw);
+    // A caller may need to persist an explicit user choice even when it equals
+    // the schema default. Interactive setup uses this for semanticSearchMode:
+    // "off" means the user declined the opt-in, not an incidental default that
+    // should disappear from the saved configuration.
+    for (const key of persistTopLevelKeys) {
+        if (Object.hasOwn(next, key))
+            pruned[key] = next[key];
+    }
+    pruned.configVersion = CURRENT_CONFIG_VERSION;
+    // Keep existing top-level keys in their authored order. Lifecycle rollback
+    // writes the same logical object twice (add, then remove); reordering those
+    // surviving keys would violate its byte-parity guarantee even though the
+    // parsed JSON is equivalent. Newly changed keys follow in `next` order,
+    // while nested maps (notably `bundles`) retain mutation-selected ordering.
+    const ordered = {};
+    for (const key of Object.keys(localRaw)) {
+        if (Object.hasOwn(pruned, key))
+            ordered[key] = pruned[key];
+    }
+    for (const [key, value] of Object.entries(pruned)) {
+        if (!Object.hasOwn(ordered, key))
+            ordered[key] = value;
+    }
+    return ordered;
 }
 /**
  * Mutate config under one fail-closed lock spanning read, merge, validation,
@@ -527,7 +693,7 @@ export function mutateConfig(mutate, options) {
  * side effect. Setup uses this to reject a three-way conflict before creating
  * its stash, while preventing another config writer from racing the final save.
  */
-export async function mutateConfigWithPrecommit(mutate, precommit) {
+export async function mutateConfigWithPrecommit(mutate, precommit, options) {
     cachedConfig = undefined;
     const configPath = getConfigPath();
     const release = acquireConfigLock();
@@ -543,7 +709,7 @@ export async function mutateConfigWithPrecommit(mutate, precommit) {
         if (mutated === current)
             return { config: current, written: false, precommit: precommitResult };
         fs.mkdirSync(path.dirname(configPath), { recursive: true });
-        writeConfigAtomic(configPath, sanitizeConfigForWrite(configWriteBody(localRaw, current, next)));
+        writeConfigAtomic(configPath, sanitizeConfigForWrite(configWriteBody(localRaw, current, next, options?.persistTopLevelKeys)));
         return { config: next, written: true, precommit: precommitResult };
     }
     finally {
@@ -682,7 +848,7 @@ export function getIndexPassConfig(config, passName) {
     return entry;
 }
 // Re-export source runtime helpers — implementation lives in config-sources.ts.
-export { bundleComponentConfig, bundleContentRoot, bundleContentRoots, bundleEntryToSourceEntry, bundleKeyForContentRoot, bundlesToSourceEntries, installedSourceDescriptor, parseSourceSpec, primaryBundlePath, resolveConfiguredSources, } from "./config-sources.js";
+export { bundleComponentConfig, bundleContentRoot, bundleContentRoots, bundleEntryToSourceEntry, bundleKeyForContentRoot, bundlePhysicalContentRoot, bundleSourceId, bundlesToSourceEntries, installedSourceDescriptor, isBundleEnabled, parseSourceSpec, primaryBundlePath, resolveActiveConfiguredSources, resolveConfiguredSources, } from "./config-sources.js";
 /**
  * Merge a partial user-config override onto a base config. Used by
  * {@link loadUserConfig} (DEFAULT_CONFIG + on-disk) and {@link updateConfig}

package/dist/core/config/legacy-source-shape-shim.js

@@ -1,3 +1,4 @@
+import path from "node:path";
 import { isBundleSlug } from "../asset/asset-ref.js";
 import { warnOnce } from "../warn.js";
 function isPlainRecord(value) {
@@ -49,6 +50,11 @@ function bundleFromLegacySource(entry, index) {
     const key = name && isBundleSlug(name) ? name : `source-${index + 1}`;
     return [key, bundle];
 }
+function filesystemLocator(bundle) {
+    if (!isPlainRecord(bundle) || typeof bundle.path !== "string" || bundle.path.length === 0)
+        return undefined;
+    return path.resolve(bundle.path);
+}
 export function migrateLegacySourceShape(raw, sourcePath) {
     const hasStashDir = typeof raw.stashDir === "string" && raw.stashDir.trim().length > 0;
     const hasSources = Array.isArray(raw.sources) && raw.sources.length > 0;
@@ -68,6 +74,9 @@ export function migrateLegacySourceShape(raw, sourcePath) {
             if (!converted)
                 return;
             const [key, bundle] = converted;
+            const locator = filesystemLocator(bundle);
+            if (locator && Object.values(bundles).some((candidate) => filesystemLocator(candidate) === locator))
+                return;
             bundles[key] = bundle;
             defaultBundle ??= key;
         });

package/dist/core/config/schema/embedding.js

@@ -33,6 +33,32 @@ export const EmbeddingConnectionConfigSchema = z
     // `akm index` when ensureSchema rejects it (§24.2 "Semantic" gate).
     dimension: positiveInt.max(4096).optional(),
     localModel: z.string().min(1).optional(),
+    /**
+     * Per-document token cap applied BEFORE batching (default 512,
+     * `DEFAULT_MAX_INPUT_TOKENS` in `src/llm/embedders/remote.ts`, #956).
+     * The materializer truncates a document's embedded text to
+     * this cap (head only, unicode-safe) instead of skipping it outright, so
+     * one oversized entry can no longer fail a whole batch. Distinct from
+     * `maxTokens` below, which bounds a whole HTTP REQUEST (many documents);
+     * this bounds one DOCUMENT.
+     */
+    maxInputTokens: positiveInt.optional(),
+    /**
+     * Client-side per-request token budget — how many documents' estimated
+     * tokens fit in one HTTP request (default `DEFAULT_TOKEN_BUDGET` = 6000
+     * in `src/llm/embedders/remote.ts`). With the 512-token `maxInputTokens`
+     * cap above, a request carries about 11 documents by default.
+     */
+    maxTokens: positiveInt.optional(),
+    batchSize: positiveInt.optional(),
+    /**
+     * Ollama's `num_ctx` ONLY (#956) — sent verbatim as
+     * `options.num_ctx` on the native `/api/embed` request. It no longer also
+     * feeds the client-side request token budget (`maxTokens` above): the two
+     * used to share this one field, so setting it for the server's context
+     * window silently changed request batching too.
+     */
+    contextLength: positiveInt.optional(),
     ollamaOptions: EmbeddingOllamaOptionsSchema.optional(),
     /**
      * Per-request timeout in milliseconds for a remote embedding request
@@ -46,13 +72,10 @@ export const EmbeddingConnectionConfigSchema = z
      * Overrides the fixed in-flight request window (#954, added after field
      * evidence from multi-slot local servers). Bounded 1-16. Unset keeps
      * today's default: 1 for a loopback endpoint, 2 for a remote one
-     * (`resolveEmbeddingConcurrency`, `src/llm/embedders/remote.ts`), unless
-     * the provider's own probed slot count overrides it
-     * (`probeProviderLimits`, `src/llm/embedders/provider-limits.ts`, used by
-     * `akm index`'s drain queue). Set it only for an endpoint that genuinely
-     * serves parallel requests (llama.cpp `--parallel N`, vLLM) — request
-     * SIZE, packed against the provider's own probed context window, remains
-     * the first throughput lever.
+     * (`resolveEmbeddingConcurrency`, `src/llm/embedders/remote.ts`). Set it
+     * only for an endpoint that genuinely serves parallel requests (llama.cpp
+     * `--parallel N`, vLLM) — request SIZE (`batchSize`, `maxTokens`/
+     * `contextLength`) remains the first throughput lever.
      */
     concurrency: positiveInt.max(16).optional(),
 })

package/dist/core/config/schema/execution.js

@@ -0,0 +1,23 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+import { z } from "zod";
+const toolName = z.string().trim().min(1, "expected a non-empty tool name");
+/** Host-owned ceiling for capabilities requested by executable assets. */
+export const ExecutionPolicyConfigSchema = z
+    .object({
+    /** Exact tool names an asset may request. `*` is an explicit allow-all ceiling. */
+    allowedTools: z
+        .array(toolName)
+        .default([])
+        .superRefine((tools, ctx) => {
+        const seen = new Set();
+        for (const [index, tool] of tools.entries()) {
+            if (seen.has(tool)) {
+                ctx.addIssue({ code: z.ZodIssueCode.custom, path: [index], message: "duplicates an earlier tool name" });
+            }
+            seen.add(tool);
+        }
+    }),
+})
+    .strict();

package/dist/core/config/schema/experimental.js

@@ -27,4 +27,4 @@ export const ExperimentalConfigSchema = z
      */
     improveAutonomy: z.boolean().optional(),
 })
-    .passthrough();
+    .strict();

package/dist/core/config/schema/scheduler.js

@@ -0,0 +1,20 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+import { z } from "zod";
+import { nonEmptyString } from "./primitives.js";
+/** One host-local grant allowing an authored asset to create scheduler bindings. */
+export const SchedulerActivationSchema = z
+    .object({
+    kind: z.enum(["task", "workflow"]),
+    ref: nonEmptyString,
+    /** Identity of the configured source this host approved, not merely its mutable bundle name. */
+    sourceId: z.string().regex(/^sha256:[0-9a-f]{64}$/),
+})
+    .strict();
+/** Absence from this allow-list means disabled. */
+export const SchedulerConfigSchema = z
+    .object({
+    enabled: z.array(SchedulerActivationSchema).default([]),
+})
+    .strict();

package/dist/core/config/schema/search.js

@@ -23,9 +23,8 @@ const SearchGraphBoostSchema = z
 })
     .passthrough();
 /**
- * `search.rerank` (#951, moved from `search.curateRerank` in 0.9.16 — the
- * pass was always meant for `akm search`, not `akm curate`) — an optional
- * cross-encoder rerank pass over search's already-ranked LOCAL stash hits.
+ * `search.curateRerank` (#951) — an optional cross-encoder rerank pass over
+ * `akm curate`'s already-selected candidates.
  *
  * Deliberately its own small config arm rather than a third member of the
  * `engines` map (`EngineConfigSchema` in ./engines.ts): that union's "llm" /
@@ -38,27 +37,26 @@ const SearchGraphBoostSchema = z
  * connection shape as an LLM engine without inheriting that machinery.
  *
  * `curate_rerank` was removed as a dead `llm.features.*` key in 0.8.0 (no
- * implementation ever sent a request); 0.9.15 shipped a real implementation
- * wired to curate under `search.curateRerank`, disabled by default; 0.9.16
- * moves it to search and renames the key (no compatibility alias — the old
- * key shipped hours earlier, default-off, so nobody has it meaningfully set).
+ * implementation ever sent a request); this is a new, real implementation,
+ * disabled by default.
  */
-export const SearchRerankConfigSchema = z
+export const CurateRerankConfigSchema = z
     .object({
     enabled: z.boolean().optional(),
     /** Full URL of the reranker's rerank endpoint, e.g. `http://host:port/rerank`. */
     endpoint: httpUrl.optional(),
     model: nonEmptyString.optional(),
-    apiKey: symbolicOrWarnApiKey("search.rerank.apiKey").optional(),
+    apiKey: symbolicOrWarnApiKey("search.curateRerank.apiKey").optional(),
     timeoutMs: positiveInt.optional(),
-    /** How many of search's already-ranked LOCAL hits to send to the reranker. Default 8. */
+    /** How many of curate's already-ranked candidates to send to the reranker. Default 8. */
     topN: positiveInt.max(50).optional(),
 })
-    .passthrough();
+    .strict();
 export const SearchConfigSchema = z
     .object({
+    minScore: nonNegativeNumber.optional(),
     defaultExcludeTypes: z.array(nonEmptyString).optional(),
     graphBoost: SearchGraphBoostSchema.optional(),
-    rerank: SearchRerankConfigSchema.optional(),
+    curateRerank: CurateRerankConfigSchema.optional(),
 })
     .passthrough();

package/dist/core/config/schema/sources-bundles.js

@@ -13,7 +13,7 @@ import { z } from "zod";
 // and, transitively, the indexer modules they delegate to).
 import { VALID_ADAPTER_IDS } from "../../adapter/adapter-ids.js";
 import { isBundleSlug } from "../../asset/asset-ref.js";
-import { httpUrl, nonEmptyString, positiveInt } from "./primitives.js";
+import { httpUrl, isApiKeyReference, nonEmptyString, positiveInt } from "./primitives.js";
 const VALID_ADAPTER_IDS_SET = new Set(VALID_ADAPTER_IDS);
 // ── Sources / registries / installed ────────────────────────────────────────
 const SourceConfigEntryOptionsSchema = z.record(z.unknown());
@@ -25,6 +25,7 @@ export const SourceConfigEntrySchema = z
     name: z.string().min(1).optional(),
     enabled: z.boolean().optional(),
     writable: z.boolean().optional(),
+    credential: z.string().min(1).optional(),
     primary: z.boolean().optional(),
     options: SourceConfigEntryOptionsSchema.optional(),
 })
@@ -52,6 +53,20 @@ export const SourceConfigEntrySchema = z
                 ").",
         });
     }
+    if (entry.credential !== undefined && entry.type !== "git") {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["credential"],
+            message: "credential is only supported on git sources",
+        });
+    }
+    if (entry.credential !== undefined && !isApiKeyReference(entry.credential)) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["credential"],
+            message: "git credential must be a $VAR or secret://<name> reference",
+        });
+    }
 });
 export const RegistryConfigEntrySchema = z
     .object({
@@ -110,6 +125,8 @@ export const BundleConfigEntrySchema = z
     git: z.string().min(1).optional(),
     website: BundleWebsiteDescriptorSchema.optional(),
     npm: z.string().min(1).optional(),
+    /** Symbolic HTTPS bearer credential; resolved only at the Git subprocess boundary. */
+    credential: z.string().min(1).optional(),
     writable: z.boolean().optional(),
     // Opt a bundle out of indexing, search, refresh, and write targeting
     // without deleting it. The runtime honors the derived value in write and
@@ -150,6 +167,20 @@ export const BundleConfigEntrySchema = z
             message: "writable: true is only supported on path and git bundle sources",
         });
     }
+    if (entry.credential !== undefined && entry.git === undefined) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["credential"],
+            message: "credential is only supported on git bundle sources",
+        });
+    }
+    if (entry.credential !== undefined && !isApiKeyReference(entry.credential)) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["credential"],
+            message: "git credential must be a $VAR or secret://<name> reference",
+        });
+    }
     const componentEntries = entry.components ? Object.entries(entry.components) : [];
     if (entry.components !== undefined && componentEntries.length !== 1) {
         ctx.addIssue({

package/dist/core/content-safety.js

@@ -0,0 +1,52 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/** Marker emitted by output redaction. It must never become durable asset content. */
+export const REDACTED_CONTENT_MARKER = "[REDACTED]";
+/** Reflect prompt section that contains run diagnostics, not proposed asset content. */
+export const REFLECT_AVOID_PATTERNS_HEADING = "Avoid These Patterns";
+const REFLECT_AVOID_PATTERNS_RE = /^##[ \t]+Avoid These Patterns[ \t]*$/i;
+const SECTION_BOUNDARY_RE = /^#{1,2}(?:[ \t]+|$)/;
+export function containsRedactedContent(content) {
+    return content.includes(REDACTED_CONTENT_MARKER);
+}
+export function containsReflectPromptScaffolding(content) {
+    return content.split(/\r?\n/).some((line) => REFLECT_AVOID_PATTERNS_RE.test(line));
+}
+/**
+ * Remove every echoed run-only "Avoid These Patterns" section while preserving
+ * the next peer/top-level section. Reflect alone calls this sanitizer; authored
+ * source assets are never rewritten by this helper.
+ */
+export function stripReflectPromptScaffolding(content) {
+    const newline = content.includes("\r\n") ? "\r\n" : "\n";
+    const lines = content.split(/\r?\n/);
+    const kept = [];
+    let stripped = false;
+    for (let index = 0; index < lines.length;) {
+        if (!REFLECT_AVOID_PATTERNS_RE.test(lines[index] ?? "")) {
+            kept.push(lines[index] ?? "");
+            index += 1;
+            continue;
+        }
+        stripped = true;
+        index += 1;
+        while (index < lines.length && !SECTION_BOUNDARY_RE.test(lines[index] ?? ""))
+            index += 1;
+    }
+    return { content: kept.join(newline).replace(/(?:\r?\n){3,}/g, `${newline}${newline}`), stripped };
+}
+/**
+ * Return a secret-free rejection reason when generated content is unsafe to
+ * persist. `redactedContent` is the same body after applying the dispatch
+ * lease's sensitive-value inventory; comparing it avoids exposing the value.
+ */
+export function generatedContentRejection(content, redactedContent) {
+    if (containsRedactedContent(content)) {
+        return `Agent proposal content contains ${REDACTED_CONTENT_MARKER}; refusing to persist already-redacted text.`;
+    }
+    if (redactedContent !== content) {
+        return "Agent proposal content echoed a configured credential; refusing to persist either the secret or a redacted replacement.";
+    }
+    return undefined;
+}