akm-cli 0.9.16 → 0.9.17-alpha.10

package/dist/commands/read/knowledge.js

@@ -612,8 +612,9 @@ export async function writeMarkdownAsset(options) {
     // no longer trigger reindexes, so keeping the index current is the writer's
     // job. Demoted files reindex under their own containing root (usually the
     // write target itself; the working stash when writing to a --target) so
-    // `--belief current` filtering and the beliefState ranking demotion take
-    // effect without waiting for the next full index.
+    // `--belief current` filtering takes effect without waiting for the next
+    // full index. (alpha.4 removed belief weights from ranking; `--belief` is
+    // the only reader of `beliefState` today.)
     const demotedInTargetRoot = demotedByRoot.get(source.path) ?? [];
     demotedByRoot.delete(source.path);
     await indexWrittenAssets(source.path, [result.path, ...demotedInTargetRoot], { bundleId: resolved.ref.origin });

package/dist/commands/read/search-cli.js

@@ -76,36 +76,24 @@ export const searchCommand = defineJsonCommand({
             description: "Memory belief filter: all|current|historical. current keeps active memory beliefs; historical keeps contradicted/superseded/archived memory beliefs.",
             default: "all",
         },
-        // Declared as the POSITIVE name with `default: true` so citty's native
-        // `--no-<name>` negation (it strips a leading `--no-` from ANY token and
-        // negates the remainder BEFORE consulting the declared-args table — see
-        // node_modules/citty/dist/index.mjs) does the work, the same pattern
-        // `sync --push/--no-push` uses. A flag DECLARED as `no-project-context`
-        // can never be negated: `--no-project-context` parses as "negate
-        // `project-context`", a name nothing declared, leaving the real key at
-        // its default `false` forever (F1/A1).
-        "project-context": {
-            type: "boolean",
-            default: true,
-            description: "Automatic project-context ranking boost: assets whose name/tags/aliases match the current working " +
-                "directory's project get a small score boost, and this search's usage also feeds the scoped-utility " +
-                "ranking signal. Default: on. Use --no-project-context to disable BOTH the project-context boost and " +
-                "the scoped-utility signal for this search only.",
-        },
         "include-sessions": {
             type: "boolean",
             description: "Include session assets (excluded from default search results via config.search.defaultExcludeTypes).",
             default: false,
         },
-        // Declared as the POSITIVE name with `default: true` for the same reason
-        // as `project-context` above — never declare a flag whose NAME starts
-        // with `no-`.
+        // Declared as the POSITIVE name with `default: true` so citty's native
+        // `--no-<name>` negation (it strips a leading `--no-` from ANY token and
+        // negates the remainder BEFORE consulting the declared-args table — see
+        // node_modules/citty/dist/index.mjs) does the work, the same pattern
+        // `sync --push/--no-push` uses. A flag DECLARED as `no-track-usage` could
+        // never be negated: `--no-track-usage` parses as "negate `track-usage`",
+        // a name nothing declared, leaving the real key at its default forever
+        // (F1/A1).
         "track-usage": {
             type: "boolean",
             default: true,
-            description: "A successful search updates ranking signals (usage-events telemetry and the MemRL utility-score bump " +
-                "used to prioritize future results). Default: on. Use --no-track-usage to run a read-only search that " +
-                "does not influence future ranking.",
+            description: "A successful search records usage-events telemetry. Default: on. Use --no-track-usage to run a " +
+                "search that records nothing.",
         },
     },
     async run({ args }) {
@@ -120,7 +108,6 @@ export const searchCommand = defineJsonCommand({
         const filters = parseScopeFilterFlags(filterTokens, "--filter");
         const includeProposed = args["include-proposed"] === true;
         const belief = parseBeliefFilterMode(typeof args.belief === "string" ? args.belief : undefined);
-        const disableProjectContext = args["project-context"] === false;
         const skipLogging = args["track-usage"] === false;
         const includeSessions = args["include-sessions"];
         const assets = args.assets === true;
@@ -134,8 +121,6 @@ export const searchCommand = defineJsonCommand({
             includeProposed,
             belief,
             includeSessions,
-            disableProjectContext,
-            disableScopedUtility: disableProjectContext,
             skipLogging,
             assets,
             eventSource: resolveUsageEventSource(),
@@ -170,14 +155,13 @@ export const curateCommand = defineJsonCommand({
                 "one curate call.",
         },
         // Declared as the POSITIVE name with `default: true` — see the
-        // `project-context` comment on `searchCommand` above for why a flag NAME
+        // `track-usage` comment on `searchCommand` above for why a flag NAME
         // must never start with `no-`.
         "track-usage": {
             type: "boolean",
             default: true,
-            description: "A successful curate updates ranking signals (usage-events telemetry for the curated items and the " +
-                "underlying search). Default: on. Use --no-track-usage to run a read-only curate that does not " +
-                "influence future ranking.",
+            description: "A successful curate records usage-events telemetry for the curated items. Default: on. Use " +
+                "--no-track-usage to run a curate that records nothing.",
         },
     },
     async run({ args }) {
@@ -302,14 +286,13 @@ export const showCommand = defineJsonCommand({
             description: "Exact context budget in characters. Requires --context lead; mutually exclusive with --max-tokens.",
         },
         // Declared as the POSITIVE name with `default: true` — see the
-        // `project-context` comment on `searchCommand` above for why a flag NAME
+        // `track-usage` comment on `searchCommand` above for why a flag NAME
         // must never start with `no-`.
         "track-usage": {
             type: "boolean",
             default: true,
-            description: "A successful show updates ranking signals (usage-events telemetry, including the search-selection " +
-                "linkage when this show follows a recent search). Default: on. Use --no-track-usage to run a " +
-                "read-only show that does not influence future ranking.",
+            description: "A successful show records usage-events telemetry, including the search-selection linkage when this " +
+                "show follows a recent search. Default: on. Use --no-track-usage to run a show that records nothing.",
         },
     },
     async run({ args }) {

package/dist/commands/read/search.js

@@ -14,22 +14,20 @@
 import { getSources, loadConfig } from "../../core/config/config.js";
 import { rethrowIfTestIsolationError, UsageError } from "../../core/errors.js";
 import { appendEvent } from "../../core/events.js";
+import { redactCredentialPatterns } from "../../core/redaction.js";
+import { withStateDbTelemetry } from "../../core/state-db.js";
 import { resolveReadSources } from "../../indexer/read-preflight.js";
 import { searchLocal } from "../../indexer/search/db-search.js";
 import { getSearchHitAttribution, usageEventAttributionMetadata, } from "../../indexer/search/search-attribution.js";
-import { getEntryIdByFilePath, getItemRefById } from "../../storage/repositories/index-entries-repository.js";
-// Eagerly import source providers to trigger self-registration before the
-// indexer or path-resolution code runs.
-import "../../sources/providers/index.js";
-import { withStateDbTelemetry } from "../../core/state-db.js";
 import { insertUsageEvent } from "../../indexer/usage/usage-events.js";
 import { TELEMETRY_BUSY_TIMEOUT_MS, withIndexDb } from "../../storage/repositories/index-db.js";
+import { getEntryIdByFilePath, getItemRefById } from "../../storage/repositories/index-entries-repository.js";
 import { searchRegistry } from "./registry-search.js";
 const DEFAULT_LIMIT = 20;
 function duplicateConceptWarnings(hits, defaultBundle) {
     const ownersByConcept = new Map();
     for (const hit of hits) {
-        const displayRef = (hit.parentRef ?? hit.ref).split("#", 1)[0] ?? hit.ref;
+        const displayRef = hit.ref.split("#", 1)[0] ?? hit.ref;
         const boundary = displayRef.indexOf("//");
         const conceptId = boundary >= 0 ? displayRef.slice(boundary + 2) : displayRef;
         const owner = hit.origin ?? defaultBundle ?? "working-bundle";
@@ -47,7 +45,6 @@ function duplicateConceptWarnings(hits, defaultBundle) {
 export async function akmSearch(input) {
     const t0 = Date.now();
     const query = input.query.trim();
-    const normalizedQuery = query.toLowerCase();
     const searchType = input.type ?? "any";
     const limit = normalizeLimit(input.limit);
     const parsedSource = parseSearchSource(input.source ?? "local");
@@ -110,7 +107,7 @@ export async function akmSearch(input) {
     const localResult = source === "registry"
         ? undefined
         : await searchLocal({
-            query: normalizedQuery,
+            query,
             searchType,
             limit,
             stashDir,
@@ -126,8 +123,6 @@ export async function akmSearch(input) {
             // would leak hits from sources the caller did not request.
             restrictToSources: namedSourceName !== undefined,
             includeExcludedTypes: input.includeSessions === true,
-            disableProjectContext: input.disableProjectContext === true,
-            disableScopedUtility: input.disableScopedUtility === true,
         });
     const registryResult = source === "local"
         ? undefined
@@ -249,7 +244,13 @@ function resolveEntryIds(db, hits) {
  * Per-entry events are recorded only for stash hits because registry hits
  * have no local entry_id to reference.
  */
-function logSearchEvent(query, response, mode = "keyword", eventSource = "user", attributionProjection = "full") {
+function logSearchEvent(rawQuery, response, mode = "keyword", eventSource = "user", attributionProjection = "full") {
+    // Credentials pasted into a query (e.g. by the Claude Code hook that
+    // curates every user prompt) must never reach state.db verbatim — see
+    // `redactCredentialPatterns`. Redacted once here so every persistence call
+    // below (events.metadata_json via appendEvent, usage_events.query via
+    // insertUsageEvent) gets the same scrubbed text.
+    const query = redactCredentialPatterns(rawQuery);
     // Emit a structured event to events.jsonl so workflow-trace consumers
     // detect akm search invocations without relying on stdout scraping.
     const stashHits = response.hits.filter((h) => h.type !== "registry");
@@ -296,18 +297,11 @@ function logSearchEvent(query, response, mode = "keyword", eventSource = "user",
                     source: eventSource,
                 });
             }, TELEMETRY_BUSY_TIMEOUT_MS);
-            // No live utility_scores/utility_scores_scoped write here (#862): a
-            // search result is an impression, not a signal that the asset was
-            // useful. Rewarding every returned hit created a feedback loop where
-            // merely appearing in results inflated future ranking — assets
-            // surfaced because they'd surfaced before, not because a user acted
-            // on them. Retrieval counts are still recorded above via
-            // insertUsageEvent (search_count) and rolled into utility_scores by
-            // the offline `recomputeUtilityScores` pass (`akm index`), which uses
-            // the show/search *select rate* — a ratio that requires an actual
-            // `show`/select event, not raw impressions. Explicit signal comes
-            // from `akm feedback` (applyFeedbackToUtilityScore) and from
-            // selection (recordShowUsage / the `select` event derived from it).
+            // No live utility_scores write here (#862): a search result is an
+            // impression, not a signal that the asset was useful. Retrieval
+            // counts are recorded above via insertUsageEvent (search_count) and
+            // rolled into utility_scores by the offline `recomputeUtilityScores`
+            // pass (`akm index`).
         }, { busyTimeoutMs: TELEMETRY_BUSY_TIMEOUT_MS });
     }
     catch (err) {

package/dist/commands/read/show.js

@@ -24,33 +24,25 @@ import { makeBundleRef, parseBundleRef } from "../../core/asset/asset-ref.js";
 import { parseFrontmatter } from "../../core/asset/frontmatter.js";
 import { extractSection, markdownFragmentSlugs } from "../../core/asset/markdown.js";
 import { buildMarkdownLeadContext, fragmentForSelector, MARKDOWN_FRAGMENT_CONTEXT_DEFAULT_MAX_CHARS, } from "../../core/asset/markdown-fragments.js";
-import { displayRef, typeNameFromConceptId } from "../../core/asset/resolve-ref.js";
+import { displayRef, displayRefForConceptId, typeNameFromConceptId } from "../../core/asset/resolve-ref.js";
 import { META_DIR, parseMetaRef, readMetaFile } from "../../core/asset/stash-meta.js";
 import { asNonEmptyString, isWithin } from "../../core/common.js";
-import { getIndexPassConfig, loadConfig } from "../../core/config/config.js";
+import { loadConfig } from "../../core/config/config.js";
 import { NotFoundError, rethrowIfDataDirUnreadable, rethrowIfTestIsolationError, UsageError } from "../../core/errors.js";
 import { appendEvent } from "../../core/events.js";
 import { SCRIPT_EXTENSIONS } from "../../core/recognition-util.js";
 import { presentationFor } from "../../core/type-presentation.js";
 import { warn, warnOnce } from "../../core/warn.js";
-import { hasGraphData } from "../../indexer/db/graph-db.js";
-import { listRelatedPathsForFile } from "../../indexer/graph/graph-boost.js";
-import { extractGraphForSingleFile } from "../../indexer/graph/graph-extraction.js";
 import { lookupBundleRef, lookupBundleRefWithResolution } from "../../indexer/indexer.js";
 import { projectMarkdownFragmentContent } from "../../indexer/passes/metadata.js";
 import { ensurePrimaryIndexForRead, resolveReadSources } from "../../indexer/read-preflight.js";
 import { buildEditHint, findSourceForPath, isEditable, resolveSourceEntries, } from "../../indexer/search/search-source.js";
 import { recentShowCount, recordShowUsage } from "../../indexer/usage/show-usage.js";
 import { buildFileContext, buildRenderContext, getRenderer, } from "../../indexer/walk/file-context.js";
-import { resolveIndexPassExecution } from "../../llm/index-passes.js";
 import { resolveSourcesForOrigin } from "../../registry/origin-resolve.js";
-import { resolveStorageLocations } from "../../storage/locations.js";
-import { closeDatabase, openExistingDatabase } from "../../storage/repositories/index-connection.js";
-import { TELEMETRY_BUSY_TIMEOUT_MS, withIndexDb } from "../../storage/repositories/index-db.js";
+import { withIndexDb } from "../../storage/repositories/index-db.js";
 import { getIndexedMarkdownFragment } from "../../storage/repositories/index-fts-repository.js";
-import { computeBodyHash } from "../../storage/repositories/index-llm-cache-repository.js";
-// Eagerly import source providers to trigger self-registration.
-import "../../sources/providers/index.js";
+import { readEntryLinks } from "../../storage/repositories/index-links-repository.js";
 import { getCurrentWorkflowScopeKey } from "../../workflows/authoring/scope-key.js";
 import { buildWorkflowAction } from "../../workflows/renderer.js";
 import { getActiveWorkflowRun } from "../../workflows/runtime/runs.js";
@@ -326,12 +318,13 @@ export async function showLocal(input) {
     response.type = indexedEntry.type;
     response.name = indexedEntry.name;
     const isPrimaryStash = source?.isDefault === true;
+    const displayDefaultBundle = config.defaultBundle ?? (isPrimaryStash ? indexedEntry.bundleId : undefined);
     const canonicalRef = displayRef({
         type: indexedEntry.type,
         name: presentedName,
         conceptId: indexedEntry.conceptId,
         bundleId: indexedEntry.bundleId,
-    }, config.defaultBundle ?? (isPrimaryStash ? indexedEntry.bundleId : undefined));
+    }, displayDefaultBundle);
     if (parsed.fragment && indexedFragment) {
         const selectedFragmentId = indexedFragment.fragments[indexedFragment.ordinal].fragmentId;
         const selectedRef = `${canonicalRef}#${selectedFragmentId}`;
@@ -390,33 +383,12 @@ export async function showLocal(input) {
         origin: source?.registryId ?? null,
         editable,
         ...(!editable ? { editHint: buildEditHint(canonicalRef) } : {}),
-        related: (() => {
-            try {
-                return withIndexDb((db) => {
-                    const related = listRelatedPathsForFile(sourceStashDir, assetPath, 5, db);
-                    return { total: related.length, hits: related };
-                });
-            }
-            catch (err) {
-                rethrowIfTestIsolationError(err);
-                rethrowIfDataDirUnreadable(err);
-                return { total: 0, hits: [] };
-            }
-        })(),
+        ...showLinks(indexedEntry.itemRef, displayDefaultBundle),
     };
     const activeRun = await getActiveWorkflowRun(getCurrentWorkflowScopeKey());
     if (activeRun) {
         fullResponse.activeRun = activeRun;
     }
-    // #624-P3: opt-in inline graph extraction. Default OFF — when the flag is
-    // unset this whole block is skipped (no hasGraphData check, no LLM call), so
-    // behavior is byte-identical to today. When ON, it extracts graph data for an
-    // ungraphed asset, but ONLY when a model is configured (model-available
-    // guard) and ALWAYS bounded by a 30s timeout so `show` can never hang. Any
-    // timeout/model-unavailable/error path returns the response unchanged.
-    if (getIndexPassConfig(config.index, "graph")?.lazyGraphExtraction === true) {
-        await maybeExtractGraphInline(config, sourceStashDir, assetPath);
-    }
     if (input.detail === "brief") {
         return buildBriefResponse(fullResponse, assetPath);
     }
@@ -425,6 +397,56 @@ export async function showLocal(input) {
     }
     return fullResponse;
 }
+/** Refs listed per kind of declared link; `total` still counts them all (one memory is named by 1,437 others). */
+const LINKS_PER_KIND = 10;
+/**
+ * The declared links (#935) of an indexed asset, grouped by kind: outgoing in
+ * authored order, incoming by ref, and unresolved tokens as authored. Empty
+ * parts are omitted, and the field when nothing links either way.
+ */
+function showLinks(itemRef, defaultBundle) {
+    let rows;
+    try {
+        rows = withIndexDb((db) => readEntryLinks(db, itemRef));
+    }
+    catch (err) {
+        rethrowIfTestIsolationError(err);
+        rethrowIfDataDirUnreadable(err);
+        return {};
+    }
+    const outgoing = [];
+    const unresolved = [];
+    for (const row of rows.outgoing) {
+        if (row.conceptId === undefined)
+            unresolved.push({ kind: row.kind, ref: row.raw ?? "" });
+        else
+            outgoing.push({ kind: row.kind, ref: displayRefForConceptId(row.conceptId, row.bundleId, defaultBundle) });
+    }
+    const incoming = rows.incoming.map((row) => ({
+        kind: row.kind,
+        ref: displayRefForConceptId(row.conceptId ?? "", row.bundleId, defaultBundle),
+    }));
+    const links = {
+        ...groupLinks("outgoing", outgoing),
+        ...groupLinks("incoming", incoming),
+        ...groupLinks("unresolved", unresolved),
+    };
+    return Object.keys(links).length > 0 ? { links } : {};
+}
+function groupLinks(part, rows) {
+    if (rows.length === 0)
+        return {};
+    const groups = {};
+    for (const kind of [...new Set(rows.map((row) => row.kind))].sort())
+        groups[kind] = { total: 0, refs: [] };
+    for (const { kind, ref } of rows) {
+        const group = groups[kind];
+        group.total++;
+        if (group.refs.length < LINKS_PER_KIND)
+            group.refs.push(ref);
+    }
+    return { [part]: groups };
+}
 /**
  * Warn and ignore body fragments for namespaces whose authored bytes are
  * sensitive. `warnOnce`-keyed on the exact ref: `akmShowUnified` calls this
@@ -473,79 +495,6 @@ function findUnrecognizedScriptSource(assetParts, sources) {
     }
     return undefined;
 }
-/**
- * #624-P3 — opt-in inline graph extraction for `akm show`. Best-effort and
- * timeout-bounded: never throws, never hangs, never mutates the response.
- *
- * Preconditions (caller already checked the flag): a model must be configured
- * (model-available guard via {@link resolveIndexPassExecution}) and the asset
- * must be ungraphed ({@link hasGraphData}). Extraction races a 30s timeout so
- * `show` cannot block on a slow provider; any timeout/error/missing-model path
- * is swallowed and `show` returns its already-assembled response unchanged.
- */
-async function maybeExtractGraphInline(config, sourceStashDir, assetPath) {
-    try {
-        // Resolve readiness and the symbolic runner once. The inline dispatch must
-        // consume this same snapshot even if models.json changes while show runs.
-        const graphExecution = resolveIndexPassExecution("graph", config);
-        if (!graphExecution.runner)
-            return;
-        const emittedNoticeKeys = new Set();
-        const reportNotices = (notices) => {
-            for (const notice of notices) {
-                const key = JSON.stringify(notice);
-                if (emittedNoticeKeys.has(key))
-                    continue;
-                emittedNoticeKeys.add(key);
-                const field = typeof notice.field === "string" ? ` field=${notice.field}` : "";
-                warn(`[akm] lazy graph extraction notice ${notice.code} adapter=${notice.adapter}${field}: ${notice.message}`);
-            }
-        };
-        reportNotices(graphExecution.notices);
-        let alreadyGraphed = false;
-        let bodyHash;
-        try {
-            const raw = fs.readFileSync(assetPath, "utf8");
-            bodyHash = computeBodyHash(parseFrontmatter(raw).content.trim());
-        }
-        catch {
-            return; // file gone/unreadable ⇒ nothing to extract
-        }
-        withIndexDb((db) => {
-            alreadyGraphed = hasGraphData(db, sourceStashDir, assetPath);
-        }, { busyTimeoutMs: TELEMETRY_BUSY_TIMEOUT_MS });
-        if (alreadyGraphed)
-            return;
-        // Open the db for the async extraction ourselves: `withIndexDb` is
-        // synchronous and would close the connection the instant the async fn
-        // returns its Promise (before extraction completes). Close it explicitly
-        // after the race settles instead.
-        const db = openExistingDatabase(resolveStorageLocations().indexDb);
-        let timer;
-        const timeout = new Promise((resolve) => {
-            timer = setTimeout(resolve, 30_000);
-        });
-        try {
-            await Promise.race([
-                extractGraphForSingleFile(db, sourceStashDir, assetPath, bodyHash, {
-                    config,
-                    llmRunner: graphExecution.runner,
-                    onNotices: reportNotices,
-                }),
-                timeout,
-            ]);
-        }
-        finally {
-            if (timer)
-                clearTimeout(timer);
-            closeDatabase(db);
-        }
-    }
-    catch (err) {
-        rethrowIfTestIsolationError(err);
-        // Any other failure: silently return the unchanged show response.
-    }
-}
 /**
  * Minimal `show`: ref → indexer lookup → file contents. Used by callers that
  * just need the raw file (e.g. clone, write-source) and don't want the full

package/dist/commands/sources/bundle-cli.js

@@ -24,9 +24,11 @@
  * `proposal-new` shape). `show` is a new shape, `bundle-show`.
  */
 import { defineGroupCommand, defineJsonCommand, output } from "../../cli/shared.js";
+import { renameBundle } from "../../core/bundle-rename.js";
 import { NotFoundError, TransientError, UsageError } from "../../core/errors.js";
 import { appendEvent } from "../../core/events.js";
 import { warn } from "../../core/warn.js";
+import { akmTasksSync } from "../tasks/tasks.js";
 import { addCommand } from "./add-cli.js";
 import { akmInit } from "./init.js";
 import { akmListSources, akmRemove, akmUpdate } from "./installed-stashes.js";
@@ -182,9 +184,29 @@ const updateCommand = defineJsonCommand({
         output("update", result);
     },
 });
+const renameCommand = defineJsonCommand({
+    meta: {
+        name: "rename",
+        description: "Rename a configured bundle's key everywhere akm persists it (config, lock, index, and its own proposals/task history). Content inside the bundle that still spells the old ref is reported, not rewritten.",
+    },
+    args: {
+        old: { type: "positional", description: "Current bundle name", required: true },
+        new: { type: "positional", description: "New bundle name (must be a legal, unused slug)", required: true },
+        "dry-run": {
+            type: "boolean",
+            description: "Show the rename plan without writing anything",
+            default: false,
+        },
+    },
+    async run({ args }) {
+        const result = await renameBundle(args.old, args.new, { dryRun: args["dry-run"] }, {
+            syncTasks: (newId, backend) => akmTasksSync({ backend }, newId),
+        });
+        output("bundle-rename", result);
+    },
+});
 export function isSkippableBundleUpdateLock(error) {
-    return (error instanceof TransientError &&
-        ["INDEX_DB_CONTENDED", "STATE_DB_CONTENDED", "MAINTENANCE_BARRIER_BUSY"].includes(error.code));
+    return error instanceof TransientError && ["INDEX_DB_CONTENDED", "STATE_DB_CONTENDED"].includes(error.code);
 }
 export const bundleCommand = defineGroupCommand({
     meta: {
@@ -198,5 +220,6 @@ export const bundleCommand = defineGroupCommand({
         show: showCommand,
         remove: removeCommand,
         update: updateCommand,
+        rename: renameCommand,
     },
 });

package/dist/commands/sources/bundle-config-ops.js

@@ -92,6 +92,10 @@ export function bundleKeyForUrl(config, url) {
  * caller's `preferredName` when it is a legal slug, else slug the seed locator
  * (path/url) — the shared {@link deriveBundleId} rule (D-R5), made unique against
  * the currently-configured bundle keys.
+ *
+ * Every add path validates an explicit `--name` with
+ * {@link validateExplicitBundleName} before calling in (an illegal or taken
+ * name fails loudly), so a `preferredName` that reaches here is returned as is.
  */
 export function nextBundleKey(bundles, preferredName, seedLocator) {
     return deriveBundleId(preferredName, seedLocator, new Set(Object.keys(bundles)));

package/dist/commands/sources/dangerous-env-audit.js

@@ -66,8 +66,7 @@ function collectDangerousKeyFindings(installedStashRoot, checkEnvForDangerousKey
     }
     return allFindings;
 }
-/** Scan only; callers that already obtained approval use this for a final materialization fence. */
-export function scanStashForDangerousKeys(installedStashRoot) {
+function scanStashForDangerousKeys(installedStashRoot) {
     const scanner = scannerOverride ??
         ((envPath, relPath) => scanEnvKeyNames(fs.readFileSync(envPath, "utf8"))
             .filter(isDangerousEnvKey)