akm-cli 0.9.16 → 0.9.17-alpha.10

package/dist/setup/registry-stash-loader.js

@@ -12,9 +12,8 @@
  * target below so a configured registry cannot preselect a different source
  * merely by reusing a trusted display ID.
  */
-import { jsonWithByteCap } from "../core/common.js";
 import { hasRegistryUrlCredentials } from "../core/registry-url.js";
-import { allowPrivateRegistryFixtureForTests, cancelRegistryResponse, fetchRegistryResponse, } from "../registry/network.js";
+import { fetchRegistryJson } from "../registry/network.js";
 import { parseRegistryRef } from "../registry/resolve.js";
 // ── Default selections ──────────────────────────────────────────────────────
 const AUTHENTICATED_DEFAULT_TARGETS = {
@@ -74,20 +73,12 @@ export async function loadSetupStashes(registryUrl, timeoutMs = 4000) {
 }
 async function loadSetupStashesReal(registryUrl, timeoutMs = 4000) {
     try {
-        const response = await fetchRegistryResponse(registryUrl, { headers: { Accept: "application/json" } }, {
-            policy: { kind: "public-registry" },
+        const raw = await fetchRegistryJson(registryUrl, {
+            headers: { Accept: "application/json" },
             timeoutMs,
             retries: 0,
-            allowPrivateHostsForTesting: allowPrivateRegistryFixtureForTests(registryUrl),
         });
-        if (!response.ok) {
-            await cancelRegistryResponse(response);
-            return FALLBACK_STASHES;
-        }
-        const raw = await jsonWithByteCap(response, 10 * 1024 * 1024, {
-            bodyTimeoutMs: timeoutMs,
-        });
-        if (!Array.isArray(raw.stashes) || raw.stashes.length === 0)
+        if (!Array.isArray(raw?.stashes) || raw.stashes.length === 0)
             return FALLBACK_STASHES;
         const entries = raw.stashes.flatMap((item) => {
             if (!item || typeof item !== "object")

package/dist/setup/semantic-assets.js

@@ -4,21 +4,13 @@
 /**
  * Semantic-search asset preparation for the setup wizard. Transformers.js is
  * a normal external package dependency; setup never mutates the installed CLI.
- * This module only prepares the model and probes sqlite-vec.
+ * This module only prepares the model.
  */
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
 import * as p from "../cli/clack.js";
 import { isHttpUrl } from "../core/common.js";
 import { checkEmbeddingAvailability, DEFAULT_LOCAL_MODEL, isTransformersAvailable } from "../llm/embedder.js";
-import { closeDatabase, openIndexDatabase } from "../storage/repositories/index-connection.js";
-import { isVecAvailable } from "../storage/repositories/index-vec-repository.js";
-// Approximate first-download sizes used in the setup note.
-// LOCAL_MODEL_APPROX_SIZE_MB tracks the default local model (DEFAULT_LOCAL_MODEL).
+// Approximate first-download size of the default local model (DEFAULT_LOCAL_MODEL), used in the setup note.
 const LOCAL_MODEL_APPROX_SIZE_MB = 130;
-// SQLITE_VEC_APPROX_SIZE_MB reflects the optional sqlite-vec install footprint.
-const SQLITE_VEC_APPROX_SIZE_MB = 5;
 export function isRemoteEmbeddingConfig(embedding) {
     return isHttpUrl(embedding?.endpoint);
 }
@@ -27,14 +19,10 @@ export function isRemoteEmbeddingConfig(embedding) {
  */
 export function describeSemanticSearchAssets(embedding) {
     if (isRemoteEmbeddingConfig(embedding)) {
-        return [
-            `• Embedding endpoint: ${embedding?.provider ?? "custom"} / ${embedding?.model} (no local model download)`,
-            `• sqlite-vec acceleration: optional native extension (~${SQLITE_VEC_APPROX_SIZE_MB} MB when installed separately)`,
-        ];
+        return [`• Embedding endpoint: ${embedding?.provider ?? "custom"} / ${embedding?.model} (no local model download)`];
     }
     return [
         `• Local embedding model: ${embedding?.localModel ?? DEFAULT_LOCAL_MODEL} (~${LOCAL_MODEL_APPROX_SIZE_MB} MB download on first use)`,
-        `• sqlite-vec acceleration: optional native extension (~${SQLITE_VEC_APPROX_SIZE_MB} MB when installed separately)`,
     ];
 }
 export async function prepareSemanticSearchAssets(config) {
@@ -69,34 +57,5 @@ export async function prepareSemanticSearchAssets(config) {
         }
     }
     spin.stop(remote ? "Remote embedding endpoint is ready." : "Local embedding model downloaded and ready.");
-    let db;
-    let probeDir;
-    try {
-        probeDir = fs.mkdtempSync(path.join(os.tmpdir(), "akm-setup-vec-probe-"));
-        db = openIndexDatabase(path.join(probeDir, "probe.db"), config.embedding?.dimension ? { embeddingDim: config.embedding.dimension } : undefined);
-        if (isVecAvailable(db)) {
-            p.log.info("sqlite-vec is available for fast vector search.");
-        }
-        else {
-            p.log.info("sqlite-vec is not available. Semantic search will use the JS fallback until the optional extension is installed.");
-        }
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        p.log.warn(`Could not open the local database or check for sqlite-vec. Semantic search will use the JS fallback. (${message})\n` +
-            "Check file permissions and available disk space in the cache directory, or run `akm index --full --verbose` to diagnose.");
-    }
-    finally {
-        if (db)
-            closeDatabase(db);
-        if (probeDir) {
-            try {
-                fs.rmSync(probeDir, { recursive: true, force: true });
-            }
-            catch {
-                /* ignore cleanup failure */
-            }
-        }
-    }
     return { ok: true };
 }

package/dist/setup/setup.js

@@ -117,7 +117,7 @@ export function assertSetupConfigPreflight() {
     catch (error) {
         if (!(error instanceof ConfigError))
             throw error;
-        if (error.code !== "UNSUPPORTED_CONFIG_VERSION" && error.code !== "INVALID_CONFIG_FILE")
+        if (error.code !== "INVALID_CONFIG_FILE")
             throw error;
         throw new ConfigError(`\`akm setup\` cannot run: the config at ${configPath} did not load (${error.message}). ` +
             "It was left untouched — setup never writes over a config it cannot first read cleanly.", error.code, "Rewrite the file using the current config schema, or move it aside to start fresh " +

package/dist/setup/steps/connection.js

@@ -122,7 +122,8 @@ const LLM_PRESETS = [
     },
 ];
 /**
- * Step 3a: pick an LLM provider. Used for indexing-time metadata enhancement.
+ * Step 3a: pick an LLM provider. Used for LLM-gated background features
+ * (e.g. memory inference).
  *
  * @internal Exported for testing only.
  */
@@ -151,14 +152,14 @@ export async function stepLlm(current, ollamaEndpoint, ollamaChatModels, lmStudi
     }
     options.push({ value: "lmstudio", label: "LM Studio / local server", hint: lmStudioOptionHint(lmStudio) });
     options.push({ value: "custom", label: "Custom OpenAI-compatible endpoint" });
-    options.push({ value: "none", label: "Skip LLM", hint: "no metadata enhancement during indexing" });
+    options.push({ value: "none", label: "Skip LLM", hint: "LLM-gated background features stay disabled" });
     const currentLlm = readCurrentLlmEngine(current);
     if (currentLlm) {
         options.push(keepCurrentOption(currentLlm));
     }
     const initialValue = currentLlm ? "keep" : ollamaAvailable ? "ollama" : (LLM_PRESETS[0]?.value ?? "none");
     const choice = await prompt(() => p.select({
-        message: "Configure an LLM for richer metadata during indexing:",
+        message: "Configure an LLM for background features:",
         options,
         initialValue,
     }));
@@ -251,7 +252,7 @@ export async function stepLlm(current, ollamaEndpoint, ollamaChatModels, lmStudi
     return llm;
 }
 /**
- * Step 1/2: Configure the small model connection used for metadata and bounded LLM features.
+ * Step 1/2: Configure the small model connection used for bounded LLM features.
  *
  * Detects Ollama automatically and pre-selects it. The user may also choose
  * OpenAI, LM Studio, a custom endpoint, or skip the step entirely.
@@ -260,7 +261,6 @@ export async function stepSmallModelConnection(current) {
     p.log.step("Step 1/2: Configure your small model connection");
     p.note([
         "This connection is used for background processing:",
-        "  • akm index           (metadata enhancement)",
         "  • akm improve         (lesson distillation)",
         "  • akm remember --enrich (memory compression)",
     ].join("\n"));
@@ -301,7 +301,6 @@ export async function stepSmallModelConnection(current) {
     if (providerChoice === "skip") {
         p.note([
             "Enrichment features disabled:",
-            "  • akm index           — metadata enhancement disabled",
             "  • akm improve         — lesson generation",
             "  • akm remember --enrich",
             "",

package/dist/setup/steps/platforms.js

@@ -53,10 +53,10 @@ export function printCapabilitySummary(smallModelSkipped, agentConfigured) {
     const lines = ["Setup complete. Here's what's enabled:", ""];
     lines.push("  ✓ akm search, akm curate, akm show, akm index, akm remember — always available");
     if (!smallModelSkipped) {
-        lines.push("  ✓ index metadata enhancement, akm improve, akm remember --enrich — small model configured");
+        lines.push("  ✓ akm improve, akm remember --enrich — small model configured");
     }
     else {
-        lines.push("  ✗ index metadata enhancement, akm improve, akm remember --enrich — run `akm setup` to enable");
+        lines.push("  ✗ akm improve, akm remember --enrich — run `akm setup` to enable");
     }
     if (agentConfigured) {
         lines.push("  ✓ akm proposal new, akm improve, akm task — agent configured");

package/dist/setup/steps/tasks.js

@@ -9,11 +9,11 @@ import { parse as yamlParse, stringify as yamlStringify } from "yaml";
 import * as p from "../../cli/clack.js";
 import { akmTasksSync } from "../../commands/tasks/tasks.js";
 import { makeBundleRef } from "../../core/asset/asset-ref.js";
-import { loadConfig, mutateConfig } from "../../core/config/config.js";
+import { loadConfig, mutateConfig, resetConfigCache } from "../../core/config/config.js";
 import { UsageError } from "../../core/errors.js";
 import { commitWriteTargetBoundary, deleteAssetFromSource, prepareWriteTargetForMutation, resolveWriteTarget, writeAssetToSource, } from "../../core/write-source.js";
-import { schedulerActivationSourceId, schedulerActivations } from "../../tasks/activation-config.js";
-import { backendNameForPlatform } from "../../tasks/backends/index.js";
+import { enabledRefsFromInstalled, isSchedulerBundleActive, schedulerEnabledRefs } from "../../tasks/activation-config.js";
+import { backendNameForPlatform, selectBackend } from "../../tasks/backends/index.js";
 import { listEmbeddedTasks } from "../../tasks/embedded.js";
 import { parseSchedule } from "../../tasks/schedule.js";
 import { parseTaskSource } from "../../tasks/source/parse-task-source.js";
@@ -77,9 +77,7 @@ export function listSetupTaskDefinitions() {
     const config = loadConfig();
     const target = resolveWriteTarget(config, config.defaultBundle, { requireWritable: false });
     const taskDir = path.join(target.source.path, "tasks");
-    const enabledRefs = new Set(schedulerActivations(config)
-        .filter((activation) => activation.kind === "task")
-        .map((activation) => activation.ref));
+    const enabledRefs = new Set(schedulerEnabledRefs(config) ?? []);
     if (!fs.existsSync(taskDir))
         return [];
     const tasks = [];
@@ -178,17 +176,14 @@ export async function prepareSetupTaskDefinitions(tasks, deps = {}) {
     const selected = new Set(tasks.filter((plan) => plan.enabled).map((plan) => makeBundleRef(target.source.name, `tasks/${plan.task.id}`)));
     const managed = new Set(tasks.map((plan) => makeBundleRef(target.source.name, `tasks/${plan.task.id}`)));
     mutateConfig((current) => {
-        const existing = schedulerActivations(current);
-        const next = existing.filter((activation) => activation.kind !== "task" || !managed.has(activation.ref));
-        const sourceId = schedulerActivationSourceId(current, target.source.name);
-        if (selected.size > 0 && !sourceId) {
+        const existing = schedulerEnabledRefs(current) ?? [];
+        const next = existing.filter((ref) => !managed.has(ref));
+        if (selected.size > 0 && !isSchedulerBundleActive(current, target.source.name)) {
             throw new UsageError(`Cannot activate setup tasks from disabled bundle ${JSON.stringify(target.source.name)}.`);
         }
-        for (const ref of selected) {
-            next.push({ kind: "task", ref, sourceId: sourceId });
-        }
-        next.sort((left, right) => left.ref.localeCompare(right.ref) || left.kind.localeCompare(right.kind));
-        if (JSON.stringify(existing) === JSON.stringify(next))
+        next.push(...selected);
+        next.sort((left, right) => left.localeCompare(right));
+        if (current.scheduler?.enabled !== undefined && JSON.stringify([...existing]) === JSON.stringify(next))
             return current;
         return { ...current, scheduler: { ...current.scheduler, enabled: next } };
     });
@@ -198,6 +193,7 @@ const DEFAULT_SCHEDULED_TASKS_DEPS = {
     list: listSetupTaskDefinitions,
     prepare: prepareSetupTaskDefinitions,
     sync: akmTasksSync,
+    inspectInstalled: async () => ({ installed: await selectBackend().list() }),
 };
 export async function stepScheduledTasks(deps = DEFAULT_SCHEDULED_TASKS_DEPS, options = {}) {
     if (options.nonInteractive || isCiEnvironment()) {
@@ -212,6 +208,20 @@ export async function stepScheduledTasks(deps = DEFAULT_SCHEDULED_TASKS_DEPS, op
     const embedded = listEmbeddedTasks();
     if (embedded.length === 0)
         return;
+    // A config that predates `scheduler.enabled` means "keep what is installed":
+    // make that explicit before the review below reads and edits the list.
+    if (schedulerEnabledRefs(loadConfig()) === undefined) {
+        try {
+            const inspection = await deps.inspectInstalled();
+            const refs = enabledRefsFromInstalled(inspection.installed, loadConfig());
+            mutateConfig((current) => ({ ...current, scheduler: { ...current.scheduler, enabled: [...refs] } }));
+            resetConfigCache();
+        }
+        catch (cause) {
+            const message = cause instanceof Error ? cause.message : String(cause);
+            p.log.warn(`Native scheduler bindings could not be inspected: ${message}`);
+        }
+    }
     const installed = await deps.list();
     const byId = new Map();
     for (const task of installed)

package/dist/sources/provider-factory.js

@@ -1,23 +1,22 @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
-/**
- * Source provider factory map.
- *
- * Maps source kind identifiers (e.g. "filesystem", "git", "website", "npm")
- * to factory functions that build {@link SourceProvider} instances from a
- * {@link SourceConfigEntry}.
- *
- * Distinct from the registry-discovery factory (`registry/factory.ts`).
- * Both share `create-provider-registry.ts` for the underlying string→factory
- * map.
- */
-import { createProviderRegistry } from "../registry/create-provider-registry.js";
-// ── Factory map ─────────────────────────────────────────────────────────────
-const registry = createProviderRegistry();
-export function registerSourceProvider(type, factory) {
-    registry.register(type, factory);
-}
+import { createFilesystemProvider } from "./providers/filesystem.js";
+import { GitSourceProvider } from "./providers/git-provider.js";
+import { NpmSourceProvider } from "./providers/npm.js";
+import { createWebsiteProvider } from "./providers/website.js";
+/** The factory for a configured source kind, or null for a kind akm does not support. */
 export function resolveSourceProviderFactory(type) {
-    return registry.resolve(type);
+    switch (type) {
+        case "filesystem":
+            return createFilesystemProvider;
+        case "git":
+            return (config) => new GitSourceProvider(config);
+        case "npm":
+            return (config) => new NpmSourceProvider(config);
+        case "website":
+            return createWebsiteProvider;
+        default:
+            return null;
+    }
 }

package/dist/sources/providers/filesystem.js

@@ -3,14 +3,13 @@
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import { resolveStashDir } from "../../core/common.js";
 import { ConfigError } from "../../core/errors.js";
-import { registerSourceProvider } from "../provider-factory.js";
 /**
  * Filesystem source — points at a directory the user already manages.
  *
  * Implements {@link SourceProvider} with `{ name, kind, path }`. No `sync()`:
  * content is the user's own directory, never refreshed by akm.
  */
-registerSourceProvider("filesystem", (entry) => {
+export function createFilesystemProvider(entry) {
     if (entry.type !== "filesystem") {
         throw new ConfigError(`filesystem source invoked with type="${entry.type}"`);
     }
@@ -26,4 +25,4 @@ registerSourceProvider("filesystem", (entry) => {
             return stashDir;
         },
     };
-});
+}

package/dist/sources/providers/git-install.js

@@ -114,8 +114,14 @@ function normalizeRemoteUrl(value) {
         .replace(/\/+$/, "")
         .replace(/\.git$/i, "");
 }
-function replaceDirectory(stagedDir, destination) {
+/**
+ * Move a fully materialized directory into place. POSIX cannot rename over a
+ * non-empty directory, so the old one is renamed aside first and restored if
+ * the second rename fails; the destination is missing for one syscall at most.
+ */
+export function replaceDirectory(stagedDir, destination) {
     const backup = `${destination}.backup-${randomBytes(4).toString("hex")}`;
+    fs.mkdirSync(path.dirname(destination), { recursive: true });
     const hadDestination = fs.existsSync(destination);
     if (hadDestination)
         fs.renameSync(destination, backup);

package/dist/sources/providers/git-provider.js

@@ -11,7 +11,6 @@ import { ConfigError, UsageError } from "../../core/errors.js";
 import { getRegistryIndexCacheDir } from "../../core/paths.js";
 import { validateGitUrl } from "../../registry/resolve.js";
 import { withFreshnessCache } from "../freshness.js";
-import { registerSourceProvider } from "../provider-factory.js";
 import { assertNoIgnoredPathOverwrite, cloneRepo, inspectGitUpstream, runGit } from "./git-install.js";
 import { sanitizeString } from "./provider-utils.js";
 /** Cache TTL before refreshing the mirrored repo (12 hours). */
@@ -60,8 +59,6 @@ function resolveGitContentDir(config) {
     }
     throw new ConfigError("git source entry must have either `path` or `url`");
 }
-// ── Self-register ───────────────────────────────────────────────────────────
-registerSourceProvider("git", (config) => new GitSourceProvider(config));
 // ── Cache management ────────────────────────────────────────────────────────
 export function getCachePaths(repoUrl, cacheRootOverride) {
     const key = createHash("sha256").update(repoUrl).digest("hex").slice(0, 16);

package/dist/sources/providers/git-stash.js

@@ -25,11 +25,18 @@ import { getCachePaths, parseGitRepoUrl } from "./git-provider.js";
 export function isGitBackedStash(stashDir) {
     return fs.existsSync(path.join(stashDir, ".git"));
 }
-/** Return repo-relative dirty/staged paths without changing the index. */
-export function listGitChangedPaths(repoDir) {
+/**
+ * Return repo-relative dirty/staged paths without changing the index, and
+ * whether `git status` itself succeeded. A broken submodule, a detached
+ * `GIT_DIR`, or git simply not being on `PATH` all exit nonzero here — a
+ * caller that would otherwise read the empty `paths` as "nothing is dirty"
+ * must check `ok` first (see {@link listGitChangedPaths}'s callers that
+ * cannot, and the archive purge sweep, which can and does).
+ */
+export function tryListGitChangedPaths(repoDir) {
     const result = runGit(["-C", repoDir, "status", "--porcelain", "-z", "--untracked-files=all"]);
     if (result.status !== 0)
-        return [];
+        return { paths: [], ok: false };
     const records = result.stdout.split("\0");
     const paths = [];
     for (let i = 0; i < records.length; i++) {
@@ -44,7 +51,79 @@ export function listGitChangedPaths(repoDir) {
                 paths.push(previousPath);
         }
     }
-    return paths;
+    return { paths, ok: true };
+}
+/** Return repo-relative dirty/staged paths without changing the index. `[]` on any git failure — see {@link tryListGitChangedPaths} for a caller that must tell that apart from "nothing is dirty". */
+export function listGitChangedPaths(repoDir) {
+    return tryListGitChangedPaths(repoDir).paths;
+}
+/**
+ * Return repo-relative paths git tracks at HEAD/index under `pathspec` (or
+ * the whole repo when omitted), and whether `git ls-files` itself
+ * succeeded — see {@link tryListGitChangedPaths}, the same contract.
+ */
+export function tryListGitTrackedPaths(repoDir, pathspec) {
+    const args = ["-C", repoDir, "ls-files", "-z"];
+    if (pathspec)
+        args.push("--", pathspec);
+    const result = runGit(args);
+    if (result.status !== 0)
+        return { paths: [], ok: false };
+    return { paths: result.stdout.split("\0").filter((record) => record.length > 0), ok: true };
+}
+/**
+ * Return repo-relative paths under `pathspec` that `git ls-files -v` tags as
+ * NOT verifiable against the worktree: `assume-unchanged` (a lowercase tag —
+ * `ls-files -v` lowercases a file's normal tag letter when that bit is set)
+ * or `skip-worktree` (the literal `S`). `git status` silently omits an edit
+ * to either kind of file — the index is telling git not to compare it — so a
+ * caller that trusts {@link tryListGitChangedPaths} alone would read a
+ * genuinely modified file as clean.
+ */
+export function tryListGitUnverifiablePaths(repoDir, pathspec) {
+    const args = ["-C", repoDir, "ls-files", "-v", "-z"];
+    if (pathspec)
+        args.push("--", pathspec);
+    const result = runGit(args);
+    if (result.status !== 0)
+        return { paths: [], ok: false };
+    const paths = [];
+    for (const record of result.stdout.split("\0")) {
+        if (!record)
+            continue;
+        const tag = record.slice(0, 1);
+        if (tag === "S" || (tag >= "a" && tag <= "z"))
+            paths.push(record.slice(2));
+    }
+    return { paths, ok: true };
+}
+/**
+ * The three-part git cleanliness check shared by the archive purge sweep
+ * (`purgeGracedArchive` in `commands/improve/memory/memory-improve.ts`) and
+ * the `memory-cleanup-archive` health advisory (`collectArchiveUsageAdvisory`
+ * in `commands/health/archive-usage.ts`): a path is safe to treat as
+ * committed only if it is tracked ({@link tryListGitTrackedPaths}), not dirty
+ * ({@link tryListGitChangedPaths}), and not assume-unchanged/skip-worktree
+ * ({@link tryListGitUnverifiablePaths} — those hide their own edits from
+ * `git status`, so an unverifiable file is never trusted as clean either).
+ *
+ * Each of the three git calls can fail independently (a broken submodule, or
+ * git missing from `PATH`); `ok` is `false` if any one does, and `isSafe`
+ * then returns `false` for every path rather than guessing — callers that
+ * need to short-circuit before doing other work still check `ok` themselves.
+ */
+export function checkGitPathSafety(repoDir, pathspec) {
+    const dirtyQuery = tryListGitChangedPaths(repoDir);
+    const trackedQuery = tryListGitTrackedPaths(repoDir, pathspec);
+    const unverifiableQuery = tryListGitUnverifiablePaths(repoDir, pathspec);
+    const ok = dirtyQuery.ok && trackedQuery.ok && unverifiableQuery.ok;
+    const dirty = new Set(dirtyQuery.paths);
+    const tracked = new Set(trackedQuery.paths);
+    const unverifiable = new Set(unverifiableQuery.paths);
+    return {
+        ok,
+        isSafe: (repoRelativePath) => ok && tracked.has(repoRelativePath) && !dirty.has(repoRelativePath) && !unverifiable.has(repoRelativePath),
+    };
 }
 export class GitStashPushError extends Error {
     commit;
@@ -204,9 +283,6 @@ export function saveGitStash(name, message, writableOverride, options) {
     }
     assertNoIgnoredExactPaths(repoDir, requestedPaths);
     const baseHead = readOptionalHead(repoDir);
-    if (options?.expectedBaseHead !== undefined && (baseHead ?? null) !== options.expectedBaseHead) {
-        throw new Error(`Git target advanced before its exact-path commit could be created.`);
-    }
     const remoteResult = runGit(["-C", repoDir, "remote"]);
     if (remoteResult.status !== 0) {
         throw new Error(`git remote failed: ${remoteResult.stderr?.trim() || "unknown error"}`);
@@ -300,20 +376,6 @@ export function assertNoIgnoredExactPaths(repoDir, paths) {
         throw new UsageError(`Exact Git publication path is ignored: ${ignored[0]}. Update .gitignore or choose a tracked destination before writing.`);
     }
 }
-/** Reject exact staged/unstaged paths before an AKM filesystem mutation. */
-export function assertGitExactPathsClean(repoDir, paths) {
-    const normalized = normalizeExactPaths(repoDir, paths);
-    assertNoIgnoredExactPaths(repoDir, normalized);
-    for (const result of runExactPathChunks(repoDir, ["status", "--porcelain=v1", "-z", "--untracked-files=all"], normalized)) {
-        if (result.status !== 0) {
-            throw new Error(`git status failed: ${result.stderr.trim() || "unknown error"}`);
-        }
-        if (result.stdout.length > 0) {
-            const record = result.stdout.split("\0").find(Boolean) ?? "";
-            throw new UsageError(`Exact Git operation path has staged or unstaged work: ${record.slice(3)}. Commit, stash, or discard that path before retrying.`);
-        }
-    }
-}
 function readOptionalHead(repoDir) {
     const result = runGit(["-C", repoDir, "rev-parse", "--verify", "HEAD"]);
     return result.status === 0 && result.stdout.trim() ? result.stdout.trim() : undefined;

package/dist/sources/providers/npm.js

@@ -13,8 +13,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { ConfigError, UsageError } from "../../core/errors.js";
 import { getRegistryCacheDir } from "../../core/paths.js";
-import { npmArtifactNetworkPolicy, parseRegistryRef, resolveRegistryArtifact } from "../../registry/resolve.js";
-import { registerSourceProvider } from "../provider-factory.js";
+import { parseRegistryRef, resolveRegistryArtifact } from "../../registry/resolve.js";
 import { applyAkmIncludeConfig, buildInstallCacheDir, computeFileHash, detectStashRoot, downloadArchive, isDirectory, } from "./provider-utils.js";
 import { extractTarGzSecure, verifyArchiveIntegrity } from "./tar-utils.js";
 /**
@@ -45,7 +44,6 @@ class NpmSourceProvider {
         await syncNpmRef(ref, { force: options?.force });
     }
 }
-registerSourceProvider("npm", (config) => new NpmSourceProvider(config));
 function npmRefFromConfig(config) {
     const candidate = config.path;
     if (typeof candidate !== "string" || !candidate) {
@@ -108,7 +106,7 @@ async function doSyncNpm(parsed, options) {
     let installRoot;
     let stashRoot;
     try {
-        await downloadArchive(resolved.artifactUrl, archivePath, npmArtifactNetworkPolicy(resolved));
+        await downloadArchive(resolved.artifactUrl, archivePath);
         verifyArchiveIntegrity(archivePath, resolved.resolvedRevision, resolved.source);
         integrity = await computeFileHash(archivePath);
         extractTarGzSecure(archivePath, extractedDir);

package/dist/sources/providers/provider-utils.js

@@ -6,7 +6,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { getAdapters } from "../../core/adapter/registry.js";
 import { stashDirNames } from "../../core/asset/asset-placement.js";
-import { cancelRegistryResponse, fetchRegistryResponse } from "../../registry/network.js";
+import { fetchRegistry } from "../../registry/network.js";
 import { writeResponseToFileCapped } from "../../runtime.js";
 import { copyIncludedPaths, findNearestIncludeConfig } from "../include.js";
 const REGISTRY_STASH_DIR_NAMES = new Set(stashDirNames());
@@ -99,15 +99,10 @@ export function applyAkmIncludeConfig(sourceRoot, cacheDir, searchRoot = sourceR
     return selectedDir;
 }
 /** Stream a remote archive to disk via the runtime boundary's response writer. */
-export async function downloadArchive(url, destination, networkPolicy) {
-    const response = await fetchRegistryResponse(url, undefined, { policy: networkPolicy, timeoutMs: 120_000 });
-    if (!response.ok) {
-        await cancelRegistryResponse(response);
-        throw new Error(`Failed to download archive (${response.status}) from ${url}`);
-    }
-    // Stream to disk with an explicit byte cap + body-read deadline: the fetch
-    // timeout above bounds only the connection/header phase, so an unbounded or
-    // dribbling body could otherwise fill the disk or hang the install forever.
+export async function downloadArchive(url, destination) {
+    const response = await fetchRegistry(url, { timeoutMs: 120_000 });
+    // Stream to disk with an explicit byte cap + body-read deadline so an
+    // unbounded or dribbling body cannot fill the disk or hang the install.
     await writeResponseToFileCapped(destination, response);
 }
 /** SHA-256 of a file, returned as `sha256:<hex>`. */

package/dist/sources/providers/website.js

@@ -2,7 +2,6 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import { ConfigError } from "../../core/errors.js";
-import { registerSourceProvider } from "../provider-factory.js";
 import { getWebsiteCachePaths, shouldAllowPrivateWebsiteUrlForTests, validateWebsiteUrl } from "../website-url.js";
 /** Website source provider — URL-derived path plus an injected mirror refresh. */
 export function createWebsiteProvider(config) {
@@ -33,4 +32,3 @@ export function createWebsiteProvider(config) {
         },
     };
 }
-registerSourceProvider("website", createWebsiteProvider);

package/dist/sources/snapshot-fetchers/website-ingest.js

@@ -76,7 +76,7 @@ function resolveFetcherStashDir(explicitStashDir) {
 export async function ensureWebsiteMirror(config, options) {
     const rawUrl = config.url ?? "";
     const normalizedUrl = validateWebsiteUrl(rawUrl, { allowPrivateHosts: options?.allowPrivateHosts });
-    const cachePaths = getWebsiteCachePaths(normalizedUrl, options?.cacheRootDir);
+    const cachePaths = getWebsiteCachePaths(normalizedUrl);
     const requireStashDir = options?.requireStashDir === true;
     await withFreshnessCache({
         markerPath: cachePaths.manifestPath,

package/dist/sources/website-url.js

@@ -35,9 +35,9 @@ export function shouldAllowPrivateWebsiteUrlForTests(rawUrl) {
     }
     return true;
 }
-export function getWebsiteCachePaths(siteUrl, cacheRootOverride) {
+export function getWebsiteCachePaths(siteUrl) {
     const key = createHash("sha256").update(normalizeSiteUrl(siteUrl)).digest("hex").slice(0, 16);
-    const rootDir = path.join(cacheRootOverride ?? getRegistryIndexCacheDir(), `website-${key}`);
+    const rootDir = path.join(getRegistryIndexCacheDir(), `website-${key}`);
     return {
         rootDir,
         stashDir: path.join(rootDir, "stash"),