akm-cli 0.9.17-alpha.3 → 0.9.17-alpha.5

package/dist/core/redaction.js

@@ -317,6 +317,85 @@ function addPlainMatches(coverageDelta, text, needle) {
         offset = match + needle.length;
     }
 }
+/**
+ * Name components (after splitting an identifier on `_`/`-` and camelCase
+ * boundaries) that mark a `NAME=value` / `NAME: value` pair as
+ * credential-shaped regardless of length — the free-text-pattern sibling of
+ * `isInferredSecretName` in `src/tasks/log-redaction.ts`, which does the same
+ * job for environment variable names. Bare-word matching only: this
+ * deliberately does NOT flag "author" ("auth" is not a whole word/component
+ * of "author", the same anchoring reasoning `isInferredSecretName` documents)
+ * nor prose like "token budget" (no `=`/`:` for the pattern below to anchor
+ * on in the first place).
+ */
+const CREDENTIAL_KEY_WORDS = new Set(["password", "passwd", "secret", "token", "auth", "credential", "credentials"]);
+/** Split an identifier into lowercase words at `_`/`-` and camelCase boundaries. */
+function identifierWords(identifier) {
+    return identifier
+        .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
+        .toLowerCase()
+        .split(/[_-]+/)
+        .filter(Boolean);
+}
+/**
+ * True when `identifier` names a credential by shape: a whole word from
+ * {@link CREDENTIAL_KEY_WORDS}, or `api[_-]?key` / `private[_-]?key` in any
+ * of their glued, snake_case, kebab-case or camelCase spellings.
+ */
+function isCredentialLikeKeyName(identifier) {
+    const lower = identifier.toLowerCase();
+    if (lower.includes("apikey") || lower.includes("privatekey"))
+        return true;
+    const words = identifierWords(identifier);
+    for (let i = 0; i < words.length; i++) {
+        const word = words[i];
+        if (CREDENTIAL_KEY_WORDS.has(word))
+            return true;
+        if ((word === "api" || word === "private") && words[i + 1] === "key")
+            return true;
+    }
+    return false;
+}
+/**
+ * `NAME=value` / `NAME: value`, name captured in group 1, separator in group
+ * 2. Source string (not a shared `RegExp`, which would carry `lastIndex`
+ * state across calls) for {@link redactNamedCredentialValues} to instantiate
+ * fresh each call.
+ */
+const NAMED_CREDENTIAL_VALUE_SOURCE = String.raw `\b([A-Za-z][A-Za-z0-9_-]*)(\s*[:=]\s*)(?:"[^"]*"|'[^']*'|[^\s,;"']+)`;
+/**
+ * Redact `NAME=value` / `NAME: value` pairs whose name is credential-shaped
+ * (see {@link isCredentialLikeKeyName}).
+ *
+ * Not a plain `input.replace(re, fn)`: the greedy unquoted-value alternative
+ * happily matches straight through a NESTED assignment when a non-credential
+ * name comes first with no separator of its own — `"config: DB_PASSWORD=…"`
+ * matches name `config` with value `DB_PASSWORD=…` (one contiguous
+ * whitespace-free run), and a plain global replace treats that as ONE
+ * consumed, non-matching span and never revisits `DB_PASSWORD=…` on its own,
+ * silently leaking the credential. Rejecting a non-credential candidate here
+ * instead rewinds the scan to one character past where IT started, so the
+ * engine keeps looking and still finds the real assignment nested inside.
+ */
+function redactNamedCredentialValues(input) {
+    const re = new RegExp(NAMED_CREDENTIAL_VALUE_SOURCE, "g");
+    let result = "";
+    let cursor = 0;
+    let match = re.exec(input);
+    while (match !== null) {
+        const [full, name, sep] = match;
+        if (isCredentialLikeKeyName(name)) {
+            result += `${input.slice(cursor, match.index)}${name}${sep}[REDACTED]`;
+            cursor = match.index + full.length;
+            re.lastIndex = cursor;
+        }
+        else {
+            re.lastIndex = match.index + 1;
+        }
+        match = re.exec(input);
+    }
+    return result + input.slice(cursor);
+}
 /**
  * Redact credential-shaped substrings from arbitrary text by pattern alone —
  * unlike {@link redactSensitiveText}, which requires the exact secret value
@@ -333,11 +412,23 @@ function addPlainMatches(coverageDelta, text, needle) {
  *    is kept, only the token segment is redacted
  *  - Slack incoming-webhook URLs (`hooks.slack.com/services/<team>/<channel>/<token>`)
  *    — the team/channel ids are kept, only the trailing token is redacted
+ *  - PEM private-key blocks (`-----BEGIN … PRIVATE KEY-----…-----END … PRIVATE KEY-----`)
+ *    — the BEGIN/END markers are kept, only the body is redacted
+ *  - JWTs (`eyJ…….…….…`)
+ *  - GitHub tokens (`ghp_`/`gho_`/`ghs_`/`ghu_`/`ghr_…`)
+ *  - Slack tokens (`xoxa-`/`xoxb-`/`xoxp-`/`xoxr-…`)
+ *  - AWS access key ids (`AKIA…`)
+ *  - `scheme://user:pass@host` URLs — the scheme and host are kept, only the
+ *    userinfo is redacted
+ *  - `NAME=value` / `NAME: value` where `NAME` names a credential by shape
+ *    (password, passwd, secret, token, auth, credential(s), api/private key
+ *    — see {@link isCredentialLikeKeyName}) — the name is kept, only the
+ *    value is redacted
  */
 export function redactCredentialPatterns(input) {
     if (!input)
         return "";
-    return (input
+    const patterned = input
         // Bearer tokens (case-insensitive)
         .replace(/\bBearer\s+[A-Za-z0-9._\-+/=]+/gi, "Bearer [REDACTED]")
         // sk-/sk_ style keys
@@ -349,7 +440,23 @@ export function redactCredentialPatterns(input) {
         // Discord webhook URLs: keep the webhook id, redact the token segment.
         .replace(/(discord(?:app)?\.com\/api\/webhooks\/\d+\/)[A-Za-z0-9_-]+/gi, "$1[REDACTED]")
         // Slack incoming-webhook URLs: keep the team/channel ids, redact the token.
-        .replace(/(hooks\.slack\.com\/services\/[A-Za-z0-9]+\/[A-Za-z0-9]+\/)[A-Za-z0-9]+/gi, "$1[REDACTED]"));
+        .replace(/(hooks\.slack\.com\/services\/[A-Za-z0-9]+\/[A-Za-z0-9]+\/)[A-Za-z0-9]+/gi, "$1[REDACTED]")
+        // PEM private-key blocks: keep the BEGIN/END markers, redact the body.
+        .replace(/(-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----)[\s\S]*?(-----END [A-Z0-9 ]*PRIVATE KEY-----)/g, "$1[REDACTED]$2")
+        // JWTs: three dot-separated base64url segments; the header always
+        // starts "eyJ" (base64 of `{"`).
+        .replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, "[REDACTED]")
+        // GitHub tokens (ghp_/gho_/ghs_/ghu_/ghr_...)
+        .replace(/\bgh[posur]_[A-Za-z0-9]{20,255}\b/g, "[REDACTED]")
+        // Slack tokens (xoxa-/xoxb-/xoxp-/xoxr-...)
+        .replace(/\bxox[abpr]-[A-Za-z0-9-]+\b/g, "[REDACTED]")
+        // AWS access key ids
+        .replace(/\bAKIA[0-9A-Z]{16}\b/g, "[REDACTED]")
+        // URLs carrying `user:pass@` userinfo: keep the scheme and host.
+        .replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@]+:[^\s/@]+@/gi, "$1[REDACTED]@");
+    // NAME=value / NAME: value for credential-shaped names. Not a plain
+    // `.replace()` in the chain above — see `redactNamedCredentialValues`.
+    return redactNamedCredentialValues(patterned);
 }
 /**
  * Replace exact sensitive values in text.

package/dist/core/run-lock.js

@@ -20,11 +20,8 @@
  * absent-race and stale-reclaim retries `improve` established) and reports
  * whether the caller now owns the lock or, if not, who currently holds it.
  * It does not decide what "held" means — skip, throw, or warn-and-proceed is
- * entirely up to the caller — and it does not serialize the attempt itself:
- * every caller must wrap the call in
- * `withMaintenanceStartBarrier`/`tryWithMaintenanceStartBarrier`
- * (`core/maintenance-barrier.ts`) so two racing processes never both create
- * the sentinel in the same window.
+ * entirely up to the caller. Creating the sentinel is an `O_EXCL` write, so
+ * two racing processes never both create it.
  */
 import fs from "node:fs";
 import path from "node:path";

package/dist/core/spawn-env.js

@@ -144,7 +144,7 @@ export function collectAllowlistedEnv(names, source = process.env) {
  * a shell's own command-path caching already does, and the cost of not
  * memoizing is paid on every child-env build: two PATH splits and up to seven
  * SYNCHRONOUS `existsSync` probes, on the event loop a 10 000-unit fan-out
- * shares with the run's lease heartbeat.
+ * shares with every other in-flight unit.
  *
  * Bounded so a caller that somehow varies its PATH cannot grow it without
  * limit; a spawn path only ever sees a handful of distinct PATH strings, so

package/dist/core/state/migrations.js

@@ -1,7 +1,12 @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
-import { assertMigrationLedger, assertMigrationRegistry, runMigrations as runSqliteMigrations, } from "../../storage/engines/sqlite-migrations.js";
+// The state.db schema migration registry. The MIGRATIONS array is the single
+// append-only ordered source of truth: new migrations are APPENDED here and an
+// existing fragment is NEVER renumbered or reordered (that would corrupt the
+// schema_migrations ledger on already-deployed databases). The shared runner
+// at src/storage/sqlite-migrations.ts applies them in array order.
+import { assertMigrationRegistry } from "../../storage/sqlite-migrations.js";
 /**
  * Explicit safety classification for every released state migration ID.
  *
@@ -9,6 +14,9 @@ import { assertMigrationLedger, assertMigrationRegistry, runMigrations as runSql
  * released IDs, order, and SQL stay byte-for-byte unchanged. A runtime
  * assertion below requires this key order to match {@link STATE_MIGRATIONS}
  * exactly, so appending a migration also requires an explicit safety decision.
+ * The one consumer of the classification is `openStateDatabase`
+ * (src/core/state-db.ts): before a `historical-destructive` migration runs
+ * against an existing database, the file is copied beside itself first.
  */
 export const STATE_MIGRATION_SAFETY_BY_ID = Object.freeze({
     "001-initial-schema": "additive",
@@ -38,6 +46,7 @@ export const STATE_MIGRATION_SAFETY_BY_ID = Object.freeze({
     "025-task-history-vocabulary-backfill": "data-preserving-rebuild",
     "026-proposals-strip-legacy-fragment-refs": "data-preserving-rebuild",
     "027-extract-sessions-seen-harness-rename": "data-preserving-rebuild",
+    "028-improve-ledger": "historical-destructive",
 });
 export const STATE_MIGRATIONS = [
     // ── Migration 001 — initial schema ──────────────────────────────────────────
@@ -1177,6 +1186,104 @@ export const STATE_MIGRATIONS = [
       UPDATE workflow_runs SET agent_harness = 'claude' WHERE agent_harness = 'claude-code';
     `,
     },
+    // ── Migration 028 — the improve ledger ──
+    //
+    // One table records what improve last did with each (stash, ref, source) and
+    // when it may try again (`src/storage/repositories/improve-ledger-repository.ts`
+    // owns the outcome → cadence rule). Backfilled from the latest proposals row
+    // per (stash_dir, ref, source) so the rejection windows and pending state an
+    // upgrade inherits are the ones the previous release was already honouring:
+    //   pending  → proposed (revisit in 7 d)
+    //   accepted → accepted (eligible)
+    //   rejected → expired when the review reason is the expiry pass's
+    //              ("expired: …", 1 d grace), failed when the drain's
+    //              stale-target auto-reject or the orphan purge (eligible now —
+    //              neither was a content judgement), else rejected (reflect
+    //              14 d, distill 30 d, other 7 d)
+    //   reverted → rejected (the operator undid the content)
+    // `strftime` returns NULL for an unparseable timestamp, which reads as
+    // "eligible now" — the safe direction.
+    //
+    // The same migration drops the tables the ledger supersedes or whose code is
+    // gone: `proposal_fingerprints` was a dedup cache derived from proposals
+    // rows, `improve_gate_thresholds` has had no reader since 0.9.0,
+    // `proposal_fs_imports` lost its importer, `canary_queries` /
+    // `improve_cycle_metrics` belonged to the removed collapse detector, and
+    // `consolidation_judged` was already dropped by 018 (a no-op here for any
+    // ledger that ran it). None holds operator state, but dropping tables is
+    // destructive, so it is classified that way: `openStateDatabase` copies an
+    // existing state.db beside itself before it runs.
+    {
+        id: "028-improve-ledger",
+        up: `
+      CREATE TABLE IF NOT EXISTS improve_ledger (
+        stash_dir TEXT NOT NULL,
+        ref TEXT NOT NULL,
+        source TEXT NOT NULL,
+        last_attempt_at TEXT NOT NULL,
+        outcome TEXT NOT NULL,
+        next_eligible_at TEXT,
+        proposal_id TEXT,
+        detail TEXT,
+        PRIMARY KEY (stash_dir, ref, source)
+      );
+
+      INSERT OR REPLACE INTO improve_ledger
+        (stash_dir, ref, source, last_attempt_at, outcome, next_eligible_at, proposal_id, detail)
+      SELECT
+        p.stash_dir,
+        p.ref,
+        p.source,
+        p.updated_at,
+        o.outcome,
+        CASE o.outcome
+          WHEN 'rejected' THEN strftime('%Y-%m-%dT%H:%M:%fZ', p.updated_at,
+            CASE p.source WHEN 'reflect' THEN '+14 days' WHEN 'distill' THEN '+30 days' ELSE '+7 days' END)
+          WHEN 'expired' THEN strftime('%Y-%m-%dT%H:%M:%fZ', p.updated_at, '+1 days')
+          WHEN 'proposed' THEN strftime('%Y-%m-%dT%H:%M:%fZ', p.updated_at, '+7 days')
+          ELSE NULL
+        END,
+        p.id,
+        CASE WHEN json_valid(p.metadata_json)
+          THEN json_extract(p.metadata_json, '$.review.reason') ELSE NULL END
+      FROM proposals p
+      JOIN (
+        SELECT stash_dir, ref, source, MAX(updated_at) AS latest_updated_at
+        FROM proposals GROUP BY stash_dir, ref, source
+      ) latest
+        ON latest.stash_dir = p.stash_dir AND latest.ref = p.ref AND latest.source = p.source
+       AND latest.latest_updated_at = p.updated_at
+      JOIN (
+        SELECT rowid AS proposal_rowid,
+          CASE status
+            WHEN 'pending' THEN 'proposed'
+            WHEN 'accepted' THEN 'accepted'
+            WHEN 'reverted' THEN 'rejected'
+            WHEN 'rejected' THEN
+              CASE WHEN json_valid(metadata_json) THEN
+                CASE
+                  WHEN json_extract(metadata_json, '$.review.reason') LIKE 'expired:%' THEN 'expired'
+                  WHEN json_extract(metadata_json, '$.gateDecision.reason') = 'stale-target' THEN 'failed'
+                  WHEN json_extract(metadata_json, '$.review.reason') = 'Asset no longer exists on disk' THEN 'failed'
+                  ELSE 'rejected'
+                END
+              ELSE 'rejected' END
+            ELSE NULL
+          END AS outcome
+        FROM proposals
+      ) o ON o.proposal_rowid = p.rowid
+      WHERE o.outcome IS NOT NULL
+      ORDER BY p.rowid ASC;
+
+      DROP INDEX IF EXISTS idx_proposal_fingerprints_ref;
+      DROP TABLE IF EXISTS proposal_fingerprints;
+      DROP TABLE IF EXISTS improve_gate_thresholds;
+      DROP TABLE IF EXISTS proposal_fs_imports;
+      DROP TABLE IF EXISTS consolidation_judged;
+      DROP TABLE IF EXISTS improve_cycle_metrics;
+      DROP TABLE IF EXISTS canary_queries;
+    `,
+    },
 ];
 assertMigrationRegistry(STATE_MIGRATIONS);
 function assertStateMigrationSafetyRegistry() {
@@ -1194,63 +1301,3 @@ export function getStateMigrationSafety(migrationId) {
         throw new Error(`State migration ${migrationId} has no safety classification.`);
     return safety;
 }
-/**
- * Apply every pending migration in a single transaction per migration.
- *
- * Delegates to the shared SQLite migration engine; state.db has no
- * pre-versioning bootstrap step, so no `bootstrap` hook is passed.
- *
- * Called automatically by `openStateDatabase()`.
- */
-export function runMigrations(db, options) {
-    const initialMigration = STATE_MIGRATIONS[0];
-    if (!initialMigration)
-        throw new Error("State migration registry has no initial migration.");
-    let existingUnversionedSnapshotPrepared = false;
-    const prepareExistingUnversionedState = (lockedDb) => {
-        if (existingUnversionedSnapshotPrepared)
-            return;
-        if (!options?.existingUnversionedDatabase) {
-            throw new Error("Refusing state.db initialization because its migration ledger disappeared after preflight.");
-        }
-        if (!options.allowHistoricalDestructiveStateUpgrade) {
-            throw new Error("Refusing to migrate an existing unversioned state.db during an ordinary managed open. " +
-                "Run `akm upgrade` (or `akm migrate apply`) to snapshot it before migration 001 and apply it deliberately.");
-        }
-        const ledger = assertMigrationLedger(lockedDb, STATE_MIGRATIONS);
-        if (ledger.migrationIds.length !== 0) {
-            throw new Error("Refusing an existing unversioned state.db whose migration ledger changed after preflight.");
-        }
-        if (!options.beforeExistingUnversionedStateMigration) {
-            throw new Error("An existing unversioned state.db requires a verified pre-migration safety-copy hook.");
-        }
-        options.beforeExistingUnversionedStateMigration(initialMigration);
-        existingUnversionedSnapshotPrepared = true;
-    };
-    runSqliteMigrations(db, STATE_MIGRATIONS, {
-        lockInitialMigrationPrefixThrough: options?.existingUnversionedDatabase ? "002-task-history-per-run" : undefined,
-        beforeLedgerInitializationLocked(lockedDb) {
-            if (options?.freshDatabase)
-                return;
-            prepareExistingUnversionedState(lockedDb);
-        },
-        beforeMigrationLocked(migration, lockedDb) {
-            if (options?.existingUnversionedDatabase && !existingUnversionedSnapshotPrepared) {
-                prepareExistingUnversionedState(lockedDb);
-            }
-            if (getStateMigrationSafety(migration.id) !== "historical-destructive" || options?.freshDatabase)
-                return;
-            // The writer lock closes the window between this exact-prefix decision,
-            // the recovery snapshot, and the destructive migration transaction.
-            assertMigrationLedger(lockedDb, STATE_MIGRATIONS);
-            if (!options?.allowHistoricalDestructiveStateUpgrade) {
-                throw new Error(`Refusing to apply historical destructive state migration ${migration.id} during an ordinary managed open. ` +
-                    "Run `akm upgrade` (or `akm migrate apply`) to create a sibling state.db safety copy and apply it deliberately.");
-            }
-            if (!options.beforeHistoricalDestructiveMigration) {
-                throw new Error(`Historical destructive state migration ${migration.id} requires a verified safety-copy hook.`);
-            }
-            options.beforeHistoricalDestructiveMigration(migration);
-        },
-    });
-}

package/dist/core/state-db-scope.js

@@ -4,10 +4,8 @@
 /**
  * Ambient, run-scoped state.db connection reuse.
  *
- * `openStateDatabase` is NOT cheap: every call registers a `state-db`
- * maintenance activity (a lockfile create under the maintenance barrier), opens
- * a throwaway read-only preflight handle to assert the migration ledger, then
- * opens the real handle and applies pragmas. Paying that per repository call
+ * `openStateDatabase` is not free: every call opens a handle, applies the
+ * pragmas and reads the migration ledger. Paying that per repository call
  * — twice per dispatched workflow unit (insert + finish), plus once per
  * `appendEvent` (two events per unit) — is the dominant cost of a wide `map`
  * fan-out.