akm-cli 0.9.17-alpha.2 → 0.9.17-alpha.4

package/dist/tasks/scheduler-invocation.js

@@ -7,7 +7,7 @@ import path from "node:path";
 import { bundleRefToString, parseBundleRef } from "../core/asset/asset-ref.js";
 import { resolveStashDir } from "../core/common.js";
 import { ConfigError } from "../core/errors.js";
-import { getCacheDir, getConfigDir, getDataDir, getTaskContextDir } from "../core/paths.js";
+import { getTaskContextDir } from "../core/paths.js";
 import { INPUT_NAME_PATTERN } from "../execution/input-contract.js";
 import { normaliseTaskConceptId } from "./task-id.js";
 export const SCHEDULED_TASK_CONTEXT_KEYS = [
@@ -17,6 +17,17 @@ export const SCHEDULED_TASK_CONTEXT_KEYS = [
     "AKM_CACHE_DIR",
     "AKM_STATE_DIR",
 ];
+/**
+ * Directories a descriptor carries ONLY when the process that ran `task sync`
+ * had them set explicitly in its environment. They are never resolved from
+ * defaults: a descriptor written from inside an app whose environment pointed
+ * `$STATE` somewhere private (an OpenCode desktop session, 2026-08 → 2026-09)
+ * froze that directory into eight cron rows, and the scheduled improve runs
+ * then held their locks in a `locks/` directory no interactive command could
+ * see. At fire time an absent key resolves exactly as it does for an
+ * interactive command on the same host.
+ */
+const EXPLICIT_CONTEXT_KEYS = ["AKM_CONFIG_DIR", "AKM_DATA_DIR", "AKM_CACHE_DIR", "AKM_STATE_DIR"];
 /**
  * The AKM directory context currently restored from a scheduler descriptor.
  * Child environments that are built from an allowlist must forward this
@@ -32,16 +43,20 @@ export function scheduledTaskContextEnv(env = process.env) {
     return out;
 }
 export const SCHEDULER_CONTEXT_ARG = "--scheduler-context";
-/** Resolve the complete non-secret AKM directory context captured by schedulers. */
-export function resolveScheduledTaskContext(env = process.env, platform = process.platform) {
-    return canonicalContext({
-        AKM_BUNDLE_DIR: path.resolve(resolveStashDir(env)),
-        AKM_CONFIG_DIR: path.resolve(getConfigDir(env, platform)),
-        AKM_DATA_DIR: path.resolve(getDataDir(env, platform)),
-        AKM_CACHE_DIR: path.resolve(getCacheDir(env)),
-        // Capture the complete process directory context used by scheduled commands.
-        AKM_STATE_DIR: path.resolve(resolveStateDir(env, platform)),
-    });
+/**
+ * The directory context a scheduler descriptor carries: the resolved bundle
+ * path, plus whichever `AKM_*_DIR` overrides the syncing process had set
+ * explicitly. Resolved defaults are deliberately not captured — see
+ * {@link EXPLICIT_CONTEXT_KEYS}.
+ */
+export function resolveScheduledTaskContext(env = process.env) {
+    const context = { AKM_BUNDLE_DIR: path.resolve(resolveStashDir(env)) };
+    for (const key of EXPLICIT_CONTEXT_KEYS) {
+        const value = env[key]?.trim();
+        if (value)
+            context[key] = path.resolve(value);
+    }
+    return canonicalContext(context);
 }
 /** Build an installed argv from one already-validated public scheduler tail. */
 export function buildScheduledBindingInvocation(akmArgv, contextPath, invocation) {
@@ -52,16 +67,15 @@ export function buildScheduledBindingInvocation(akmArgv, contextPath, invocation
         argv: [...akmArgv, SCHEDULER_CONTEXT_ARG, assertAbsolutePath(contextPath), ...parsed.invocation],
     };
 }
-export function schedulerContextDescriptor(context = resolveScheduledTaskContext(), envPath = process.env.PATH ?? "") {
-    return {
-        version: 1,
-        environment: { ...canonicalContext(context), PATH: validatePathValue(envPath) },
-    };
+export function schedulerContextDescriptor(context = resolveScheduledTaskContext()) {
+    return { version: 1, environment: canonicalContext(context) };
 }
 export function schedulerContextPath(descriptor) {
     const bytes = serializeDescriptor(descriptor);
     const digest = createHash("sha256").update(bytes).digest("hex");
-    return path.join(getTaskContextDir(descriptor.environment), `${digest}.json`);
+    // The descriptor lives under the data directory it names when it names
+    // one, otherwise under this process's own.
+    return path.join(getTaskContextDir({ ...process.env, ...descriptor.environment }), `${digest}.json`);
 }
 /** Write a content-addressed descriptor without ever replacing existing content. */
 export function writeSchedulerContextDescriptor(descriptor = schedulerContextDescriptor()) {
@@ -96,9 +110,13 @@ export function writeSchedulerContextDescriptor(descriptor = schedulerContextDes
 }
 export function loadSchedulerContextDescriptor(file, env = process.env) {
     const descriptor = validateSchedulerContextDescriptor(file);
-    for (const key of SCHEDULED_TASK_CONTEXT_KEYS)
-        env[key] = descriptor.environment[key];
-    env.PATH = descriptor.environment.PATH;
+    for (const key of SCHEDULED_TASK_CONTEXT_KEYS) {
+        const value = descriptor.environment[key];
+        if (value !== undefined)
+            env[key] = value;
+    }
+    if (descriptor.environment.PATH !== undefined)
+        env.PATH = descriptor.environment.PATH;
 }
 export function validateSchedulerContextDescriptor(file) {
     const absolute = assertAbsolutePath(file);
@@ -291,14 +309,17 @@ function isValidSchedulerInputFlagTail(tail) {
     return true;
 }
 function canonicalContext(input) {
-    const inputKeys = Object.keys(input);
-    if (inputKeys.length !== SCHEDULED_TASK_CONTEXT_KEYS.length ||
-        inputKeys.some((key) => !SCHEDULED_TASK_CONTEXT_KEYS.includes(key))) {
+    if (Object.keys(input).some((key) => !SCHEDULED_TASK_CONTEXT_KEYS.includes(key))) {
         throw invalidSchedulerContext();
     }
     const context = {};
     for (const key of SCHEDULED_TASK_CONTEXT_KEYS) {
         const value = input[key];
+        if (value === undefined) {
+            if (key === "AKM_BUNDLE_DIR")
+                throw invalidSchedulerContext();
+            continue;
+        }
         if (typeof value !== "string" ||
             value.trim().length === 0 ||
             containsControlCharacter(value) ||
@@ -319,12 +340,12 @@ function canonicalDescriptor(input) {
     if (typeof rawEnvironment !== "object" || rawEnvironment === null || Array.isArray(rawEnvironment)) {
         throw invalidSchedulerContext();
     }
-    const environment = rawEnvironment;
-    if (Object.keys(environment).length !== SCHEDULED_TASK_CONTEXT_KEYS.length + 1)
-        throw invalidSchedulerContext();
-    const PATH = validatePathValue(environment.PATH);
-    const { PATH: _, ...rawContext } = environment;
-    return { version: 1, environment: { ...canonicalContext(rawContext), PATH } };
+    const { PATH, ...rawContext } = rawEnvironment;
+    const context = canonicalContext(rawContext);
+    return {
+        version: 1,
+        environment: PATH === undefined ? context : { ...context, PATH: validatePathValue(PATH) },
+    };
 }
 function serializeDescriptor(descriptor) {
     return `${JSON.stringify(canonicalDescriptor(descriptor))}\n`;
@@ -365,30 +386,9 @@ function containsControlCharacter(value) {
     }
     return false;
 }
-function resolveStateDir(env, platform) {
-    const override = env.AKM_STATE_DIR?.trim();
-    if (override)
-        return override;
-    if (platform === "win32") {
-        const localAppData = env.LOCALAPPDATA?.trim();
-        if (localAppData)
-            return path.join(localAppData, "akm", "state");
-        const userProfile = env.USERPROFILE?.trim();
-        if (userProfile)
-            return path.join(userProfile, "AppData", "Local", "akm", "state");
-        const appData = env.APPDATA?.trim();
-        if (appData)
-            return path.join(appData, "..", "Local", "akm", "state");
-        throw new ConfigError("Unable to determine state directory. Set LOCALAPPDATA, USERPROFILE, or APPDATA.", "CONFIG_DIR_UNRESOLVABLE");
-    }
-    const xdgStateHome = env.XDG_STATE_HOME?.trim();
-    if (xdgStateHome)
-        return path.join(xdgStateHome, "akm");
-    const home = env.HOME?.trim();
-    return home ? path.join(home, ".local", "state", "akm") : path.join("/tmp", "akm-state");
-}
 function invalidSchedulerContext() {
-    return new ConfigError(`Invalid scheduler context; expected exactly ${SCHEDULED_TASK_CONTEXT_KEYS.join(", ")} as absolute paths.`, "INVALID_CONFIG_FILE");
+    return new ConfigError("Invalid scheduler context; expected AKM_BUNDLE_DIR as an absolute path, " +
+        `optionally with ${EXPLICIT_CONTEXT_KEYS.join(", ")} as absolute paths.`, "INVALID_CONFIG_FILE");
 }
 function invalidSchedulerInvocation() {
     return new ConfigError("Invalid scheduler invocation; expected public " +

package/dist/tasks/scheduler-lock.js

@@ -0,0 +1,53 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/**
+ * The one process lock around native scheduler writes.
+ *
+ * `task sync|add|enable|disable|prune --yes` read the installed rows, plan,
+ * and apply under it, so two akm processes never interleave their writes to
+ * the same crontab or LaunchAgents directory. It is an `O_EXCL` lock file
+ * under `$STATE/locks`, reclaimed only from a verifiably dead holder, and
+ * re-entrant within one process (`add` runs `sync` inside it).
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { TransientError } from "../core/errors.js";
+import { createLockPayload, probeLock, reclaimStaleLock, releaseLock, tryAcquireLockSync } from "../core/file-lock.js";
+import { getStateDir } from "../core/paths.js";
+export function schedulerLockPath() {
+    return path.join(getStateDir(), "locks", "scheduler.lock");
+}
+let depth = 0;
+export async function withSchedulerLock(fn) {
+    if (depth > 0) {
+        depth += 1;
+        try {
+            return await fn();
+        }
+        finally {
+            depth -= 1;
+        }
+    }
+    const lockPath = schedulerLockPath();
+    fs.mkdirSync(path.dirname(lockPath), { recursive: true });
+    const acquire = () => tryAcquireLockSync(lockPath, createLockPayload({ purpose: "scheduler" }));
+    let ownership = acquire();
+    if (!ownership) {
+        const probe = probeLock(lockPath);
+        if (probe.state === "absent" || (probe.state === "stale" && reclaimStaleLock(lockPath, probe))) {
+            ownership = acquire();
+        }
+    }
+    if (!ownership) {
+        throw new TransientError("Another akm process is syncing the scheduler right now.", "SCHEDULER_LOCK_HELD");
+    }
+    depth = 1;
+    try {
+        return await fn();
+    }
+    finally {
+        depth = 0;
+        releaseLock(ownership);
+    }
+}