akm-cli 0.9.2-alpha.4 → 0.9.2

package/dist/setup/steps/tasks.js

@@ -14,7 +14,7 @@ import { commitWriteTargetBoundary, deleteAssetFromSource, prepareWriteTargetFor
 import { backendNameForPlatform } from "../../tasks/backends/index.js";
 import { listEmbeddedTasks } from "../../tasks/embedded.js";
 import { parseSchedule } from "../../tasks/schedule.js";
-import { parseTaskV3Yaml } from "../../tasks/source-v3.js";
+import { parseTaskSource } from "../../tasks/source/parse-task-source.js";
 import { prompt } from "../prompt.js";
 /**
  * A scheduled server-only nightly full sweep exists among the embedded
@@ -71,13 +71,28 @@ export function detectServerDefault() {
 function normaliseTaskIdForMatch(raw) {
     return raw.trim().replace(/\.(yml|md)$/, "");
 }
-function setTaskV3EnabledInYaml(yaml, enabled) {
+/**
+ * Toggle a task source v4 file's enabled state via a full parse/render
+ * round-trip (setup's own edits are infrequent and not comment-preservation-
+ * sensitive, unlike `commands/tasks/tasks.ts`'s `setEnabledInYaml` line
+ * splice). Broadcasts `enabled` across every `schedule[]` entry — the
+ * closest v4 equivalent of v3's single document-level flag. `src` no longer
+ * accepts a task v3 file at all (P4 §3.2) — `listSetupTaskDefinitions` below
+ * already fails closed on one before this function is ever reached, so
+ * there is no legacy `akm.enabled` shape left to handle here.
+ */
+function setTaskEnabledInYaml(yaml, enabled) {
     const document = yamlParse(yaml);
-    const akm = document.akm;
-    if (!akm || typeof akm !== "object" || Array.isArray(akm)) {
-        throw new UsageError("Task v3 source must declare an akm mapping before setup can change enabled state.");
+    const schedule = document.schedule;
+    if (typeof schedule === "string") {
+        document.schedule = [{ cron: schedule, enabled }];
+    }
+    else if (Array.isArray(schedule) && schedule.length > 0) {
+        document.schedule = schedule.map((entry) => entry && typeof entry === "object" && !Array.isArray(entry) ? { ...entry, enabled } : entry);
+    }
+    else {
+        throw new UsageError("Task source v4 must declare a schedule before setup can change enabled state.");
     }
-    akm.enabled = enabled;
     return yamlStringify(document);
 }
 export function listSetupTaskDefinitions() {
@@ -93,20 +108,24 @@ export function listSetupTaskDefinitions() {
         const id = file.slice(0, -4);
         const filePath = path.join(taskDir, file);
         try {
-            const task = parseTaskV3Yaml({
+            const parsed = parseTaskSource({
                 yaml: fs.readFileSync(filePath, "utf8"),
                 filePath,
                 workspaceRoot: target.source.path,
             });
-            if (task.triggers.schedules.length === 0)
+            const document = parsed.v4;
+            if (document.schedule.length === 0)
                 continue;
-            const schedules = task.triggers.schedules.map((schedule) => schedule.cron);
+            const schedules = document.schedule.map((entry) => entry.cron);
             tasks.push({
                 id,
                 schedule: schedules[0],
                 schedules: Object.freeze(schedules),
-                enabled: task.akm?.enabled !== false,
-                ...(task.akm?.description !== undefined ? { description: task.akm.description } : {}),
+                // task source v4 has no document-level enabled (P4-N6) — a task is
+                // considered enabled for review purposes when at least one of its
+                // schedule bindings will actually fire.
+                enabled: document.schedule.some((entry) => entry.enabled),
+                ...(document.description !== undefined ? { description: document.description } : {}),
             });
         }
         catch (error) {
@@ -128,17 +147,15 @@ export async function prepareSetupTaskDefinitions(tasks, deps = {}) {
         const original = fs.existsSync(filePath) ? fs.readFileSync(filePath, "utf8") : undefined;
         let yaml;
         if (original !== undefined) {
-            yaml = setTaskV3EnabledInYaml(original, plan.enabled);
+            yaml = setTaskEnabledInYaml(original, plan.enabled);
         }
         else {
             const document = yamlParse(plan.task.yaml);
-            const akm = document.akm;
-            akm.schedule = plan.schedule;
-            akm.enabled = plan.enabled;
+            document.schedule = plan.enabled ? plan.schedule : [{ cron: plan.schedule, enabled: false }];
             yaml = yamlStringify(document);
         }
-        const parsed = parseTaskV3Yaml({ yaml, filePath, workspaceRoot: target.source.path });
-        for (const schedule of parsed.triggers.schedules) {
+        const parsed = parseTaskSource({ yaml, filePath, workspaceRoot: target.source.path });
+        for (const schedule of parsed.v4.schedule) {
             parseSchedule(schedule.cron, backendNameForPlatform());
         }
         return { filePath, original, yaml, ref: { type: "task", name: plan.task.id } };

package/dist/storage/repositories/task-history-repository.js

@@ -39,7 +39,7 @@ export function decodeTaskHistoryMetadata(input) {
         metadataError("root must be an object");
     if (parsed.metadataVersion !== 2)
         metadataError(`unsupported metadataVersion: ${String(parsed.metadataVersion)}`);
-    const allowed = new Set(["metadataVersion", "durationMs", "detail", "engine"]);
+    const allowed = new Set(["metadataVersion", "durationMs", "detail", "engine", "targetVocab"]);
     const unknown = Object.keys(parsed).filter((key) => !allowed.has(key));
     if (unknown.length > 0)
         metadataError(`unknown fields: ${unknown.sort().join(", ")}`);
@@ -50,12 +50,16 @@ export function decodeTaskHistoryMetadata(input) {
     if (parsed.engine !== undefined && parsed.engine !== null && typeof parsed.engine !== "string") {
         metadataError("engine must be a string or null");
     }
+    if (parsed.targetVocab !== undefined && parsed.targetVocab !== 2) {
+        metadataError("targetVocab must be 2 when present");
+    }
     validateDetail(parsed.detail);
     return {
         metadataVersion: 2,
         durationMs: parsed.durationMs,
         detail: parsed.detail ?? null,
         ...(parsed.engine !== undefined ? { engine: parsed.engine } : {}),
+        ...(parsed.targetVocab === 2 ? { targetVocab: 2 } : {}),
     };
 }
 /**

package/dist/storage/repositories/workflow-runs-repository.js

@@ -49,25 +49,48 @@ export class WorkflowRunsRepository {
         return withImmediateTransaction(this.db, () => fn(this.db));
     }
     // ── reads (fully materialised) ─────────────────────────────────────────────
+    /**
+     * The top-level start guard `publishWorkflowRunV4` uses to refuse starting
+     * a SECOND active run of the same ref in the same scope. `AND
+     * parent_run_id IS NULL` (B-N10's FOURTH site, code-review round 4 finding
+     * 2 / Review log R2): a child run carries the PARENT's `scope_key` (P3a
+     * §5.2), so once a parent publishes a child of some ref, starting a
+     * TOP-LEVEL run of that same ref in that scope must never resolve to the
+     * child — the child is not "already an active run in this scope" from a
+     * fresh top-level invocation's point of view; the PARENT, if anything, is.
+     * Before this filter, `publishWorkflowRunV4` refused with
+     * `RESOURCE_ALREADY_EXISTS` naming the CHILD's own run id, instructing the
+     * operator to `akm workflow abandon` a child a parent is actively driving.
+     * For any database with no child rows the result is byte-identical, same
+     * as the other three B-N10 sites below.
+     */
     findActiveRunForScope(workflowRefs, scopeKey) {
         const refs = typeof workflowRefs === "string" ? [workflowRefs] : [...workflowRefs];
         if (refs.length === 0)
             return undefined;
         return this.db
-            .prepare(`SELECT id, current_step_id FROM workflow_runs WHERE workflow_ref IN (${refs.map(() => "?").join(", ")}) AND scope_key = ? AND status = 'active' ORDER BY updated_at DESC, created_at DESC LIMIT 1`)
+            .prepare(`SELECT id, current_step_id FROM workflow_runs WHERE workflow_ref IN (${refs.map(() => "?").join(", ")}) AND scope_key = ? AND status = 'active' AND parent_run_id IS NULL ORDER BY updated_at DESC, created_at DESC LIMIT 1`)
             .get(...refs, scopeKey);
     }
     getRunById(runId) {
         return (this.db.prepare("SELECT * FROM workflow_runs WHERE id = ?").get(runId) ??
             undefined);
     }
+    /**
+     * The scope-attach lookup `akm workflow run <ref>` uses to find an
+     * in-progress top-level run to resume instead of starting a new one.
+     * `AND parent_run_id IS NULL` (B-N10): a child run must never be attached
+     * to directly through this path — a parent-driven child would then have
+     * TWO drivers. For any database with no child rows the result is
+     * byte-identical.
+     */
     getActiveRunRowForScope(workflowRefs, scopeKey) {
         const refs = typeof workflowRefs === "string" ? [workflowRefs] : [...workflowRefs];
         if (refs.length === 0)
             return undefined;
-        return this.db
-            .prepare(`SELECT * FROM workflow_runs WHERE workflow_ref IN (${refs.map(() => "?").join(", ")}) AND scope_key = ? AND status = 'active' ORDER BY updated_at DESC, created_at DESC LIMIT 1`)
-            .get(...refs, scopeKey);
+        return (this.db
+            .prepare(`SELECT * FROM workflow_runs WHERE workflow_ref IN (${refs.map(() => "?").join(", ")}) AND scope_key = ? AND status = 'active' AND parent_run_id IS NULL ORDER BY updated_at DESC, created_at DESC LIMIT 1`)
+            .get(...refs, scopeKey) ?? undefined);
     }
     hasRun(runId) {
         const row = this.db.prepare("SELECT 1 FROM workflow_runs WHERE id = ? LIMIT 1").get(runId);
@@ -99,6 +122,12 @@ export class WorkflowRunsRepository {
             // into this shared list filter.
             filters.push("status = 'active'");
         }
+        // B-N10: a child run is invisible to this scope query unless the caller
+        // explicitly opts in (`akm workflow list --children`). For any database
+        // with no child rows the result set is byte-identical either way.
+        if (!filter.includeChildren) {
+            filters.push("parent_run_id IS NULL");
+        }
         const where = filters.length > 0 ? `WHERE ${filters.join(" AND ")}` : "";
         return this.db
             .prepare(`SELECT * FROM workflow_runs ${where} ORDER BY updated_at DESC, created_at DESC`)
@@ -112,13 +141,26 @@ export class WorkflowRunsRepository {
     getStep(runId, stepId) {
         return this.db.prepare("SELECT * FROM workflow_run_steps WHERE run_id = ? AND step_id = ?").get(runId, stepId);
     }
+    /**
+     * The `akm show` active-run guard: which run (if any) currently occupies
+     * this scope. `AND parent_run_id IS NULL` (B-N10) — a child a parent is
+     * driving must never be reported as "the" active run; the PARENT is. For
+     * any database with no child rows the result is byte-identical.
+     */
     findActiveOrBlockedRunForScope(scopeKey) {
         return (this.db
-            .prepare("SELECT id, current_step_id, workflow_ref FROM workflow_runs WHERE scope_key = ? AND status IN ('active', 'blocked') ORDER BY updated_at DESC LIMIT 1")
+            .prepare("SELECT id, current_step_id, workflow_ref FROM workflow_runs WHERE scope_key = ? AND status IN ('active', 'blocked') AND parent_run_id IS NULL ORDER BY updated_at DESC LIMIT 1")
             .get(scopeKey) ?? null);
     }
     // ── writes ─────────────────────────────────────────────────────────────────
     insertRun(input) {
+        // R-R3 (P3a Review log; docs/plans/specs/p4-deletions-closeout.md §8):
+        // this 13-column list is hand-duplicated by publishChildWorkflowRun's own
+        // INSERT below, which extends it with parent_run_id/parent_unit_id/
+        // invocation_key. A signature refactor to share one INSERT builder was
+        // considered and deliberately deferred — see
+        // docs/architecture/decisions/0009-child-run-publication-column-parity.md.
+        // Keep both column lists in sync by hand.
         this.db
             .prepare(`INSERT INTO workflow_runs (
           id, workflow_ref, scope_key, workflow_entry_id, workflow_title, status, params_json, current_step_id, created_at, updated_at,
@@ -190,7 +232,7 @@ export class WorkflowRunsRepository {
             }
             this.insertRun(input.run);
             this.insertSteps(input.steps);
-            db.prepare("UPDATE workflow_runs SET plan_json = ?, plan_hash = ?, plan_ir_version = 4 WHERE id = ?").run(input.planJson, input.planHash, input.run.id);
+            db.prepare("UPDATE workflow_runs SET plan_json = ?, plan_hash = ?, plan_ir_version = 5 WHERE id = ?").run(input.planJson, input.planHash, input.run.id);
             insertEventOnce(db, {
                 eventType: "workflow_started",
                 ts: input.run.createdAt,
@@ -201,6 +243,102 @@ export class WorkflowRunsRepository {
             });
         });
     }
+    // ── child workflow run publication (migration 023, P3a §5.2-§5.3) ─────────
+    //
+    // No production caller exists in P3a (§5.5) — dispatch is P3b's. These
+    // three methods are reachable only from tests until then.
+    /**
+     * Idempotently publish a child workflow run underneath the parent unit
+     * that spawned it. ONE `immediateTransaction`: SELECT by
+     * `(parent_run_id, invocation_key)` and return the existing child if
+     * present; otherwise INSERT the child run row (parentage columns +
+     * `invocation_key`), its step rows, attach the embedded frozen child plan
+     * (`plan_ir_version = 5`), and append its `workflow_started` event — then
+     * return the freshly-inserted row.
+     *
+     * Deliberately does NOT: call {@link findActiveRunForScope} or raise
+     * `RESOURCE_ALREADY_EXISTS` (top-level scope-conflict rules do not apply to
+     * a child, C-10); call `revalidateSources` or read the filesystem in any
+     * way (the child plan was frozen and CAS'd into the PARENT's read set at
+     * parent freeze, C-11); or touch {@link publishWorkflowRunV4} /
+     * `startWorkflowRun` (untouched, C-12).
+     *
+     * This method's serialization guarantee holds only when it is the
+     * OUTERMOST transaction on the connection (spec Review log R10,
+     * docs/plans/specs/p3a-plan-v5-child-freeze.md). `withImmediateTransaction`
+     * (src/core/state-db.ts) has a re-entrancy guard: if a transaction is
+     * already open on the connection, it SILENTLY JOINS that transaction
+     * instead of issuing its own `BEGIN IMMEDIATE`.
+     * `WorkflowRunsRepository.transaction()` is DEFERRED (`db.transaction(fn)()`)
+     * and is already used in production at `resumeWorkflowRun`
+     * (src/workflows/runtime/runs.ts:506) and `completeWorkflowStep` (:782) —
+     * a caller that wires this call inside one of those outer transactions
+     * loses the guarantee below: the SELECT can read a stale snapshot, both
+     * publishers can miss the existing row, and the loser's INSERT hits
+     * `idx_workflow_runs_invocation_key` with a raw `SQLiteError` instead of
+     * returning the winner's row.
+     *
+     * As the outermost transaction, the whole SELECT-else-INSERT sequence runs
+     * inside one `BEGIN IMMEDIATE`, so two concurrent callers racing on the
+     * same `(parentRunId, invocationKey)` serialize on SQLite's write lock: the
+     * first to acquire it inserts and commits, and the second's own SELECT —
+     * which can only run once it has acquired the lock in turn — finds and
+     * returns the first's row rather than inserting a duplicate or throwing
+     * (C-09). Calling this twice with the same key, including across a crash
+     * between publish and parent-side recording, is therefore safe and returns
+     * the same child both times, with exactly one event and one step set
+     * (C-08).
+     */
+    publishChildWorkflowRun(input) {
+        return this.immediateTransaction((db) => {
+            const existing = db
+                .prepare("SELECT * FROM workflow_runs WHERE parent_run_id = ? AND invocation_key = ?")
+                .get(input.parentRunId, input.invocationKey);
+            if (existing)
+                return existing;
+            // R-R3 (P3a Review log; docs/plans/specs/p4-deletions-closeout.md §8):
+            // the first 13 columns here must stay byte-identical to insertRun's own
+            // column list above (hand-duplicated, not shared, by deliberate choice
+            // — see docs/architecture/decisions/0009-child-run-publication-column-parity.md).
+            // Keep both column lists in sync by hand.
+            db.prepare(`INSERT INTO workflow_runs (
+          id, workflow_ref, scope_key, workflow_entry_id, workflow_title, status, params_json, current_step_id, created_at, updated_at,
+          agent_harness, agent_session_id, checkin_armed_at, parent_run_id, parent_unit_id, invocation_key
+        ) VALUES (?, ?, ?, ?, ?, 'active', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(input.run.id, input.run.workflowRef, input.run.scopeKey, input.run.workflowEntryId, input.run.workflowTitle, input.run.paramsJson, input.run.currentStepId, input.run.createdAt, input.run.updatedAt, input.run.agentHarness, input.run.agentSessionId, input.run.checkinArmedAt, input.parentRunId, input.spawnedByUnitId, input.invocationKey);
+            this.insertSteps(input.steps);
+            db.prepare("UPDATE workflow_runs SET plan_json = ?, plan_hash = ?, plan_ir_version = 5 WHERE id = ?").run(input.planJson, input.planHash, input.run.id);
+            insertEventOnce(db, {
+                eventType: "workflow_started",
+                ts: input.run.createdAt,
+                ref: input.run.workflowRef,
+                metadata: { runId: input.run.id, status: "active" },
+                idempotencyKey: input.run.id,
+                idempotencyMetadataKey: "runId",
+            });
+            return db.prepare("SELECT * FROM workflow_runs WHERE id = ?").get(input.run.id);
+        });
+    }
+    /**
+     * Persist a run's resolved declared `outputs:` (migration 024, P3b §4.3).
+     * Called from INSIDE `completeWorkflowStep`'s own write transaction — this
+     * method opens none of its own, matching `updateStepCompletion` /
+     * `updateRunState` immediately above.
+     */
+    setRunOutputs(runId, outputsJson) {
+        this.db.prepare("UPDATE workflow_runs SET outputs_json = ? WHERE id = ?").run(outputsJson, runId);
+    }
+    /** Every child run published under `parentRunId`, oldest first. `[]` when none. */
+    childRunsOf(parentRunId) {
+        return this.db
+            .prepare("SELECT * FROM workflow_runs WHERE parent_run_id = ? ORDER BY created_at ASC, id ASC")
+            .all(parentRunId);
+    }
+    /** The child run published under `(parentRunId, key)`, or undefined if none has been published yet. */
+    getRunByInvocationKey(parentRunId, key) {
+        return (this.db
+            .prepare("SELECT * FROM workflow_runs WHERE parent_run_id = ? AND invocation_key = ?")
+            .get(parentRunId, key) ?? undefined);
+    }
     // ── engine run lease (migration 006 columns, R2 enforcement) ──────────────
     //
     // Single-driver invariant: at most one `akm workflow run` invocation drives

package/dist/tasks/backends/launchd.js

@@ -817,97 +817,44 @@ function renderCalendar(calendar, indent) {
 function normalizeSignature(xml) {
     return xml.replace(/\r\n/g, "\n").trim();
 }
-/** Parse only proven loaded-service labels from bounded launchctl domain/list output. */
+/**
+ * Collect the akm-owned service labels present in `launchctl` output.
+ *
+ * This reads the CURRENT USER'S OWN scheduler inventory — the tasks they asked
+ * akm to schedule, on their own machine. It is not an attacker-controlled
+ * document, so it is parsed permissively: scan for labels in our own
+ * `com.akm.task.` namespace and ignore everything else.
+ *
+ * It previously enforced a rigid grammar over the whole document and returned
+ * `undefined` — surfacing as a hard INVALID_CONFIG_FILE that refused to inspect
+ * scheduler state at all — if ANY line failed to match. Real
+ * `launchctl print gui/<uid>` output on macOS is far richer than that grammar
+ * allowed, so on a real Mac this rejected the user's own inventory and broke
+ * every launchd operation. Caught by the gated native-scheduler suite, which
+ * had never been dispatched before.
+ *
+ * The two bounds that remain are real resource bounds, not structural ones: a
+ * cap on how much output we will read, and a cap on how many distinct akm
+ * labels we will track. Exceeding either still returns `undefined`.
+ */
 export function parseLaunchdLoadedLabels(output) {
-    if (Buffer.byteLength(output, "utf8") > MAX_LAUNCHD_DOMAIN_OUTPUT_BYTES || hasUnsafeLaunchdControlCharacter(output)) {
+    if (Buffer.byteLength(output, "utf8") > MAX_LAUNCHD_DOMAIN_OUTPUT_BYTES)
         return undefined;
-    }
-    const lines = output.replace(/\r\n?/gu, "\n").split("\n");
     const labels = new Set();
-    let akmEntryCount = 0;
-    const add = (label) => {
+    // Our own namespace is the only thing we look for. `[^\s"{}=,()]` stops the
+    // token at whatever punctuation the surrounding launchctl syntax uses, so a
+    // label works whether it appears as a bare table cell, a quoted string, or a
+    // dictionary key.
+    const labelPattern = /com\.akm\.task\.[^\s"{}=,()]+/gu;
+    for (const match of output.matchAll(labelPattern)) {
+        const label = match[0];
         if (!LAUNCHD_AKM_LABEL_RE.test(label))
-            return false;
-        akmEntryCount += 1;
-        if (akmEntryCount > MAX_LAUNCHD_AKM_NAMESPACE_ENTRIES || labels.has(label))
-            return false;
-        labels.add(label);
-        return true;
-    };
-    const firstContent = lines.findIndex((line) => line.trim() !== "");
-    if (firstContent >= 0 && /^PID\s+Status\s+Label$/iu.test(lines[firstContent].trim())) {
-        for (const line of lines.slice(firstContent + 1)) {
-            if (!line.trim())
-                continue;
-            const row = /^\s*(?:-|\d+)\s+-?\d+\s+(\S+)\s*$/u.exec(line);
-            if (!row?.[1])
-                return undefined;
-            if (row[1].startsWith(LAUNCHD_LABEL_PREFIX) && !add(row[1]))
-                return undefined;
-        }
-        return labels;
-    }
-    const firstLine = firstContent < 0 ? undefined : lines[firstContent];
-    if (firstLine === undefined || !/^\s*(?:gui|user)\/\d+\s*=\s*\{\s*$/u.test(firstLine))
-        return undefined;
-    let lastContent = lines.length - 1;
-    while (lastContent >= 0 && !lines[lastContent]?.trim())
-        lastContent -= 1;
-    const lastLine = lines[lastContent];
-    if (lastContent <= firstContent || lastLine === undefined || !/^\s*\}\s*$/u.test(lastLine))
-        return undefined;
-    let depth = 1;
-    let servicesSeen = false;
-    let insideServices = false;
-    for (let index = firstContent + 1; index <= lastContent; index += 1) {
-        const line = lines[index];
-        if (index === lastContent) {
-            if (insideServices || depth !== 1)
-                return undefined;
-            depth = 0;
             continue;
-        }
-        const servicesBlock = /^\s*services\s*=\s*\{\s*$/u.test(line);
-        const emptyServicesBlock = /^\s*services\s*=\s*\{\s*\}\s*$/u.test(line);
-        if (servicesBlock || emptyServicesBlock) {
-            if (servicesSeen || insideServices || depth !== 1)
-                return undefined;
-            servicesSeen = true;
-            if (servicesBlock) {
-                insideServices = true;
-                depth += 1;
-            }
-            continue;
-        }
-        if (/^\s*services\s*=/u.test(line))
-            return undefined;
-        if (insideServices && depth === 2) {
-            if (!line.trim())
-                continue;
-            if (/^\s*\}\s*$/u.test(line)) {
-                insideServices = false;
-                depth -= 1;
-                continue;
-            }
-            const assignment = /^\s*-?\d+\s*=\s*"?([^"\s{}=]+)"?\s*$/u.exec(line);
-            const domainTable = /^\s*(?:-|\d+)\s+(?:-|-?\d+)\s+(\S+)\s*$/u.exec(line);
-            const dictionary = /^\s*"?([^"\s{}=]+)"?\s*=\s*\{\s*$/u.exec(line);
-            const candidate = assignment?.[1] ?? domainTable?.[1] ?? dictionary?.[1];
-            if (!candidate)
-                return undefined;
-            if (candidate.startsWith(LAUNCHD_LABEL_PREFIX) && !add(candidate))
-                return undefined;
-            if (dictionary)
-                depth += 1;
-            continue;
-        }
-        if (line.includes(LAUNCHD_LABEL_PREFIX))
-            return undefined;
-        depth += countCharacter(line, "{") - countCharacter(line, "}");
-        if (depth < 1 || (insideServices && depth < 2))
+        labels.add(label);
+        if (labels.size > MAX_LAUNCHD_AKM_NAMESPACE_ENTRIES)
             return undefined;
     }
-    return servicesSeen && depth === 0 ? labels : undefined;
+    return labels;
 }
 function countCharacter(value, needle) {
     let count = 0;

package/dist/tasks/embedded.js

@@ -22,7 +22,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { getDirname } from "../runtime.js";
-import { parseTaskV3Yaml } from "./source-v3.js";
+import { parseTaskSource } from "./source/parse-task-source.js";
 /** Directory holding the bundled task template categories. */
 const TASKS_ASSETS_DIR = path.join(getDirname(import.meta.url), "../assets/tasks");
 /**
@@ -65,22 +65,28 @@ export function listEmbeddedTasks() {
             catch {
                 continue;
             }
-            let task;
+            let parsed;
             try {
-                task = parseTaskV3Yaml({ yaml, filePath, workspaceRoot: TASKS_ASSETS_DIR });
+                parsed = parseTaskSource({ yaml, filePath, workspaceRoot: TASKS_ASSETS_DIR });
             }
             catch {
                 continue;
             }
-            if (task.target.kind !== "run" || task.akm?.schedule === undefined)
+            // Shipped templates are task source v4 (spec docs/plans/specs/p4-deletions-closeout.md
+            // §3.2.6, row B-24): a template's `enabled` is per schedule-binding, so
+            // the single-cron display shape here reads the FIRST schedule entry —
+            // every shipped template authors exactly one.
+            const task = parsed.v4;
+            const [firstSchedule] = task.schedule;
+            if (task.target.kind !== "run" || !firstSchedule)
                 continue;
             tasks.push({
                 id,
                 label: `${category}/${id}`,
                 command: task.target.run,
-                schedule: task.akm.schedule,
-                description: task.akm.description ?? "",
-                enabled: task.akm.enabled !== false,
+                schedule: firstSchedule.cron,
+                description: task.description ?? "",
+                enabled: firstSchedule.enabled,
                 yaml,
             });
         }

package/dist/tasks/model/invocation.js

@@ -0,0 +1,4 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+export {};

package/dist/tasks/prepare/prepare-script-target.js

@@ -0,0 +1,9 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+import { captureScriptTarget } from "./script-capture.js";
+/** Project a script asset's own identity into the frozen shape a workflow script step dispatches. */
+export function prepareScriptTarget(input) {
+    const captured = captureScriptTarget(input.ref, input.file, input.bundleRoot, input.readFile);
+    return Object.freeze({ ref: input.ref, ...captured });
+}