akm-cli 0.9.6 → 0.9.8-beta.1

package/dist/commands/proposal/proposal.js

@@ -15,7 +15,7 @@ import { resolveStashDir } from "../../core/common.js";
 import { loadConfig } from "../../core/config/config.js";
 import { resolveWriteTarget } from "../../core/write-source.js";
 import { withAssetMutationLease } from "../../indexer/index-writer-lock.js";
-import { createProposal, diffProposal, isProposalSkipped, listProposals, preflightProposalPromotion, promoteProposal, proposalContent, recoverProposalTransactionsForStash, rejectProposalDurably, resolveProposalId, revertProposal, } from "./repository.js";
+import { diffProposal, listProposals, preflightProposalPromotion, promoteProposal, proposalContent, recoverProposalTransactionsForStash, rejectProposalDurably, resolveProposalId, revertProposal, } from "./repository.js";
 import { validateProposal } from "./validators/proposals.js";
 // ── Shared helpers ──────────────────────────────────────────────────────────
 function resolveStash(stashDir) {
@@ -131,26 +131,6 @@ export function akmProposalDiff(options) {
         ...(diff.targetPath ? { targetPath: diff.targetPath } : {}),
     };
 }
-export function akmProposalCreate(options) {
-    const queue = resolveProposalQueue(options.stashDir, options.queue, options.config);
-    const stash = queue.stashDir;
-    const target = options.target ?? (queue.target ? { source: queue.target.source.name, root: queue.target.source.path } : undefined);
-    // Manual proposal creation (via `akm proposal create`) always bypasses
-    // dedup/cooldown guards — the operator is explicitly requesting a proposal.
-    const result = createProposal(stash, {
-        ref: options.ref,
-        source: options.source,
-        ...(target !== undefined ? { target } : {}),
-        ...(options.sourceRun !== undefined ? { sourceRun: options.sourceRun } : {}),
-        payload: options.payload,
-        force: true,
-    }, options.ctx);
-    if (isProposalSkipped(result)) {
-        // Should never happen with force:true — defensive only.
-        throw new Error(`Unexpected proposal skip: ${result.message}`);
-    }
-    return { schemaVersion: 1, ok: true, proposal: result };
-}
 /**
  * Restore an accepted proposal's prior content from the backup captured at
  * promotion time (Advantage D6c / Phase 6C).

package/dist/commands/proposal/repository.js

@@ -563,9 +563,6 @@ export function listProposalsReadOnly(stashDir, options = {}, ctx) {
             }
         });
     }
-    catch {
-        return [];
-    }
     finally {
         db?.close();
     }
@@ -1013,7 +1010,6 @@ async function finalizeProposalTransaction(txn, target, proposal, ctx) {
             paths: [commitPath],
             snapshots: p.gitSnapshots ?? {},
             onCommitRecorded: (commit) => {
-                // biome-ignore lint/style/noNonNullAssertion: publishWriteTargetTransaction throws when absent
                 const publication = p.gitPublication;
                 if (publication.commit !== commit) {
                     publication.commit = commit;

package/dist/commands/proposal/validators/proposal-quality-validators.js

@@ -190,12 +190,6 @@ export function hasHotCaptureMode(frontmatter) {
     return frontmatter?.captureMode === "hot";
 }
 // ── Consolidate merge size gate ──────────────────────────────────────────────
-/**
- * Ratio lower-bound for merged body vs. the larger source body.
- * Lower than reflect (0.5) because deduplication is expected — two memories
- * with 80-90% overlap legitimately compress to well under 50% of the larger.
- */
-export const MERGE_SHRINK_RATIO_MIN = 0.3;
 // ── Reflect size gate ────────────────────────────────────────────────────────
 /** Ratio lower-bound: proposed body must be at least this fraction of source. */
 export const REFLECT_SHRINK_RATIO_MIN = 0.5;

package/dist/commands/read/curate.js

@@ -24,6 +24,7 @@ import { enqueueGraphExtraction, hasGraphData } from "../../indexer/db/graph-db.
 import { copySearchHitAttribution, getSearchHitAttribution, usageEventAttributionMetadata, } from "../../indexer/search/search-attribution.js";
 import { findSourceForPath, resolveSourceEntries } from "../../indexer/search/search-source.js";
 import { insertUsageEvent } from "../../indexer/usage/usage-events.js";
+import { estimateTokenCount } from "../../llm/embedders/remote.js";
 import { truncateDescription } from "../../output/shapes/helpers.js";
 import { TELEMETRY_BUSY_TIMEOUT_MS, withIndexDb } from "../../storage/repositories/index-db.js";
 import { findEntryIdByRef, getItemRefById } from "../../storage/repositories/index-entries-repository.js";
@@ -51,7 +52,9 @@ export const CURATE_SEARCH_LIMIT_MULTIPLIER = 4;
 export const MIN_CURATE_SEARCH_LIMIT = 12;
 const DEFAULT_CURATE_LIMIT = 4;
 const CURATE_CLOSE_SCORE_BAND = 0.12;
-const CURATE_TAIL_SCORE_FLOOR = 0.35;
+// Used by `shouldRunCurateFallback` to judge whether the initial search
+// already returned strong results (a different purpose from ranking/keeping
+// hits — see that function for its own rationale).
 const CURATE_RELATIVE_SCORE_FLOOR = 0.7;
 const CURATE_FALLBACK_TOP_SCORE_THRESHOLD = 0.8;
 const CURATE_FALLBACK_STRONG_SCORE_FLOOR = 0.35;
@@ -163,6 +166,52 @@ export async function curateSearchResults(query, result, limit, selectedType, ev
         ...(result.tip ? { tip: result.tip } : {}),
     };
 }
+/**
+ * Pack a curate result's stash hits into a single token-budgeted blob:
+ * resolve each hit's content via the SAME path `akm show` uses
+ * (`akmShowUnified` — this also means a `ref#fragment` hit packs just the
+ * matched section), then greedily accumulate hits, in the ranking order
+ * `curateSearchResults` already produced, until the next hit would exceed
+ * `budgetTokens`.
+ *
+ * Registry hits are never packed — only `CuratedStashItem`s (locked
+ * contract, AGENTS.md: registry results stay separate/opt-in).
+ *
+ * Truncation policy: drop whole hits from the tail of the ranked list first.
+ * The only exception is a single high-rank hit that alone exceeds the
+ * budget — that one hit is truncated to fit rather than dropping everything.
+ */
+export async function packCuratedHits(result, budgetTokens) {
+    const stashItems = result.items.filter((item) => item.source === "local");
+    const packed = [];
+    let used = 0;
+    for (const item of stashItems) {
+        let shown;
+        try {
+            shown = await akmShowUnified({ ref: item.ref, skipLogging: true });
+        }
+        catch {
+            continue;
+        }
+        const content = shown.content ?? shown.template ?? shown.prompt ?? "";
+        const tokens = estimateTokenCount(content);
+        if (used + tokens <= budgetTokens) {
+            packed.push({ ref: item.ref, tokens, content });
+            used += tokens;
+            continue;
+        }
+        if (packed.length === 0) {
+            const remaining = budgetTokens - used;
+            if (remaining > 0) {
+                const truncated = content.slice(0, remaining * 4);
+                packed.push({ ref: item.ref, tokens: estimateTokenCount(truncated), content: truncated });
+                used += estimateTokenCount(truncated);
+            }
+        }
+        break;
+    }
+    return { query: result.query, budget: budgetTokens, tokens: used, items: packed };
+}
 async function enrichCuratedStashHit(query, hit, supportRefs, selectedRefs, eventSource) {
     let shown;
     try {
@@ -530,11 +579,6 @@ function compareCurateHits(a, b) {
         return rawDiff;
     return a.originalIndex - b.originalIndex;
 }
-function passesCurateScoreFloor(hit, leaderScore) {
-    if (leaderScore === undefined)
-        return true;
-    return hit.rawScore >= Math.max(CURATE_TAIL_SCORE_FLOOR, leaderScore * CURATE_RELATIVE_SCORE_FLOOR);
-}
 function isNarrowReferenceFamilyQuery(query, family) {
     if (!family || family.role !== "reference")
         return false;
@@ -555,19 +599,8 @@ function selectCuratedStashHits(query, hits, limit) {
     const ranked = collapsed.hits
         .map(({ hit, originalIndex }) => annotateCurateHit(query, hit, originalIndex, intent))
         .sort(compareCurateHits);
-    const selected = [];
     const supportRefsByRef = collapsed.supportRefsByRef;
-    let leaderScore;
-    for (const candidate of ranked) {
-        if (!passesCurateScoreFloor(candidate, leaderScore))
-            continue;
-        selected.push(candidate);
-        if (leaderScore === undefined)
-            leaderScore = candidate.rawScore;
-        if (selected.length >= limit)
-            break;
-    }
-    return { selected: selected.map((entry) => entry.hit), supportRefsByRef };
+    return { selected: ranked.slice(0, limit).map((entry) => entry.hit), supportRefsByRef };
 }
 function collapseCurateFamilies(query, hits) {
     const passthrough = [];

package/dist/commands/read/search-cli.js

@@ -20,7 +20,8 @@ import { parseMetaRef } from "../../core/asset/stash-meta.js";
 import { UsageError } from "../../core/errors.js";
 import { resolveUsageEventSource } from "../../indexer/usage/usage-events.js";
 import { getOutputMode } from "../../output/context.js";
-import { akmCurate } from "./curate.js";
+import { deliverRendered } from "../../output/html-render.js";
+import { akmCurate, packCuratedHits } from "./curate.js";
 import { akmSearch, parseBeliefFilterMode, parseScopeFilterFlags, parseSearchSource } from "./search.js";
 import { akmShowUnified } from "./show.js";
 /**
@@ -153,6 +154,15 @@ export const curateCommand = defineJsonCommand({
         },
         limit: { type: "string", description: "Maximum number of curated results", default: "4" },
         from: { type: "string", description: "Search source (local|registry|all)", default: "local" },
+        pack: {
+            type: "string",
+            description: "Pack the ranked stash hits' full content into a single token-budgeted blob instead of returning refs " +
+                "to follow up on individually — value is the max token budget, e.g. --pack 4000 (~4 chars/token, same " +
+                "estimator as embedding). Content is resolved the same way `akm show` resolves it, so a ref#fragment " +
+                "hit packs just that section. Registry hits (--from registry|all) are never packed. Not to be confused " +
+                "with a workflow asset's own `budget` field (a run-cost cap) — this is a context-size target for this " +
+                "one curate call.",
+        },
         // Declared as the POSITIVE name with `default: true` — see the
         // `project-context` comment on `searchCommand` above for why a flag NAME
         // must never start with `no-`.
@@ -175,6 +185,7 @@ export const curateCommand = defineJsonCommand({
         const source = parseSearchSource(args.from ?? "local");
         const skipLogging = args["track-usage"] === false;
         const outputMode = getOutputMode();
+        const packBudget = parsePositiveIntFlag(args.pack ?? undefined, "--pack");
         const curated = await akmCurate({
             query: args.query,
             type,
@@ -184,9 +195,21 @@ export const curateCommand = defineJsonCommand({
             eventSource: resolveUsageEventSource(),
             attributionProjection: outputMode.shape === "agent" ? "agent" : outputMode.detail,
         });
+        if (packBudget !== undefined) {
+            const packed = await packCuratedHits(curated, packBudget);
+            deliverRendered(outputMode.format === "text" ? formatCuratePackText(packed) : JSON.stringify(packed.items, null, 2), outputMode.outputPath);
+            return;
+        }
         output("curate", curated);
     },
 });
+/** Human-readable rendering for `akm curate --pack`: concatenated content per hit under a `## <ref>` header. */
+function formatCuratePackText(packed) {
+    if (packed.items.length === 0) {
+        return `No packed content for "${packed.query}" (budget ${packed.budget} tokens).`;
+    }
+    return packed.items.map((item) => `## ${item.ref}\n\n${item.content}`).join("\n\n");
+}
 /**
  * Reject `--scope` (either spelling) on `akm show` (E-3). `--scope` was
  * removed in favor of `--filter` (R-047, guardrail 6 — no alias, must keep

package/dist/commands/read/show.js

@@ -27,7 +27,7 @@ import { displayRef, typeNameFromConceptId } from "../../core/asset/resolve-ref.
 import { META_DIR, parseMetaRef, readMetaFile } from "../../core/asset/stash-meta.js";
 import { asNonEmptyString, isWithin } from "../../core/common.js";
 import { getIndexPassConfig, loadConfig } from "../../core/config/config.js";
-import { NotFoundError, rethrowIfTestIsolationError, UsageError } from "../../core/errors.js";
+import { NotFoundError, rethrowIfDataDirUnreadable, rethrowIfTestIsolationError, UsageError } from "../../core/errors.js";
 import { appendEvent } from "../../core/events.js";
 import { SCRIPT_EXTENSIONS } from "../../core/recognition-util.js";
 import { presentationFor } from "../../core/type-presentation.js";
@@ -292,6 +292,7 @@ export async function showLocal(input) {
             }
             catch (err) {
                 rethrowIfTestIsolationError(err);
+                rethrowIfDataDirUnreadable(err);
                 return { total: 0, hits: [] };
             }
         })(),

package/dist/commands/sources/installed-stashes.js

@@ -47,7 +47,11 @@ function canonicalJson(value) {
     if (value && typeof value === "object") {
         const entries = Object.entries(value)
             .filter(([, entry]) => entry !== undefined)
-            .sort(([left], [right]) => left.localeCompare(right));
+            // Codepoint order, NOT localeCompare: this string feeds sha256Hex for the
+            // bundle-audit generation, and localeCompare is ICU/locale-dependent — the
+            // same object could hash differently on two machines. Matches the other
+            // canonicalJson implementations (workflows/ir/plan-hash.ts).
+            .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0));
         return `{${entries.map(([key, entry]) => `${JSON.stringify(key)}:${canonicalJson(entry)}`).join(",")}}`;
     }
     return JSON.stringify(value);

package/dist/commands/sources/self-update.js

@@ -333,7 +333,7 @@ function runPostUpgradeTasks(akmBin, opts, upgradeState) {
             ok: false,
             skipped: opts.skip,
             message: `Upgrade completed, but the state schema was not prepared (${detail}). ` +
-                "Preserve state.db and run `akm upgrade --force` before other AKM commands.",
+                "Preserve state.db and run `akm upgrade --state-only` before other AKM commands (the binary is already current).",
         };
     }
     const stateNote = stateUpgrade.safetyCopyPath ? ` Historical state safety copy: ${stateUpgrade.safetyCopyPath}.` : "";
@@ -520,3 +520,40 @@ export function getPackageManagerUpgradeCommand(installMethod, packageName = get
     }
     return undefined;
 }
+/**
+ * Apply pending historical destructive state.db migrations WITHOUT installing a
+ * new akm — the body of `akm upgrade --state-only`.
+ *
+ * Migrations flagged `historical-destructive` are refused during an ordinary
+ * managed open: they need a verified sibling safety copy taken under the
+ * migration writer lock, and that is deliberate, so an unattended `akm index`
+ * can never quietly drop operator state.
+ *
+ * The bug this fixes is not the guard but its reachability (#895). The only
+ * code path that set `allowHistoricalDestructiveStateUpgrade` ran as a
+ * POST-INSTALL step of a real upgrade, so it sat behind an npm install. Where
+ * akm is installed globally by an image and the runtime user is unprivileged,
+ * that install fails EACCES and throws long before the migration is reached —
+ * leaving the documented remedy impossible to run and `akm index --full`
+ * permanently blocked. Nothing about the migration itself needs the network,
+ * root, or a new binary; it is local, offline, and already verified.
+ *
+ * The safety copy is NOT skipped here. This changes only who may ask for the
+ * migration, never what it does.
+ */
+export function upgradeStateOnly(currentVersion, dependencies) {
+    const upgradeState = dependencies?.upgradeHistoricalStateDatabase ?? upgradeHistoricalStateDatabase;
+    const result = upgradeState();
+    return {
+        currentVersion,
+        newVersion: currentVersion,
+        upgraded: false,
+        installMethod: detectInstallMethod(),
+        message: result.upgraded
+            ? `Applied pending state.db migrations. Safety copy: ${result.safetyCopyPath}`
+            : "state.db is already current; no migration was needed",
+        stateUpgrade: result.safetyCopyPath
+            ? { applied: result.upgraded, safetyCopyPath: result.safetyCopyPath }
+            : { applied: result.upgraded },
+    };
+}

package/dist/commands/sources/sources-cli.js

@@ -33,7 +33,7 @@ import { UsageError } from "../../core/errors.js";
 import { appendEvent } from "../../core/events.js";
 import { resolveWritableOverride, saveGitStash } from "../../sources/providers/git.js";
 import { pkgVersion } from "../../version.js";
-import { checkForUpdate, performUpgrade } from "./self-update.js";
+import { checkForUpdate, performUpgrade, upgradeStateOnly } from "./self-update.js";
 import { akmClone } from "./source-clone.js";
 export const upgradeCommand = defineJsonCommand({
     meta: { name: "upgrade", description: "Upgrade akm to the latest release" },
@@ -45,8 +45,24 @@ export const upgradeCommand = defineJsonCommand({
             description: "Skip the post-upgrade index rebuild",
             default: false,
         },
+        "state-only": {
+            type: "boolean",
+            description: "Apply pending state.db migrations without installing a new akm",
+            default: false,
+        },
     },
     async run({ args }) {
+        // Applying a historical destructive state migration used to be reachable
+        // ONLY as a post-install step of a real upgrade, so an install akm cannot
+        // rewrite -- a global npm install owned by root, an image that ships the
+        // CLI -- had no route to it at all: the npm step fails EACCES and throws
+        // long before the migration runs (#895). The migration is a local,
+        // offline, already-verified operation; it does not need the network or a
+        // new binary, and coupling it to one was the bug.
+        if (args["state-only"]) {
+            output("upgrade", upgradeStateOnly(pkgVersion));
+            return;
+        }
         const check = await checkForUpdate(pkgVersion);
         if (args.check) {
             output("upgrade", check);

package/dist/commands/tasks/tasks.js

@@ -875,14 +875,6 @@ function warnIneligibleRebind(runtime, explicitRebind, warnings) {
         return;
     warnings.push(`--rebind bound scheduled tasks to an ineligible ${runtime.kind ?? "unknown"} invocation (${runtime.binding.join(" ")}); scheduled runs will invoke a mutable, unproven binary. Install akm via \`npm install --global akm-cli\` or a standalone release, then re-run \`akm task sync --rebind\`.`);
 }
-export function prepareSchedulerRuntime(explicitRebind, operation, deps = {}) {
-    const invocation = (deps.resolveInvocation ?? resolveAkmInvocation)();
-    if (!invocation.eligible && !explicitRebind) {
-        throw new UsageError(`Refusing to ${operation} from an ineligible ${invocation.kind ?? "unknown"} invocation (${invocation.argv.join(" ")}).`, "INVALID_FLAG_VALUE", "npm-global ownership could not be verified. Run `npm install --global akm-cli` and use that launcher, use a standalone installation, or explicitly repeat the operation with --rebind.");
-    }
-    const contextPath = (deps.writeDescriptor ?? writeSchedulerContextDescriptor)(schedulerContextDescriptor());
-    return { binding: invocation.argv, contextPath, eligible: invocation.eligible, kind: invocation.kind };
-}
 function groupInstalledBindings(entries, invocation) {
     const groups = new Map();
     for (const entry of entries) {

package/dist/commands/url-checker.js

@@ -2,40 +2,32 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 const URL_RE = /https?:\/\/[^\s"'<>)\]]+/g;
-const TIMEOUT_MS = 5000;
-const MAX_URLS = 20;
+/**
+ * Check every URL in `entries` and report the ones that are dead.
+ *
+ * No cap, no per-entry slice, no ceiling option. There used to be a
+ * `MAX_URLS = 20` plus an undocumented `slice(0, 3)` per entry, so this
+ * examined at most twenty links in a bundle holding thousands and reported
+ * success. The first attempt at fixing that kept the cap and layered a
+ * coverage report, a warning, and an override on top — a constraint plus more
+ * code to explain the constraint. Both are gone. It checks what you asked it
+ * to check.
+ *
+ * A request that fails, times out, or cannot resolve surfaces as a `DeadUrl`
+ * rather than being swallowed, so a network problem is visible instead of
+ * looking like a clean bill of health.
+ */
 export async function checkDeadUrls(_stashDir, entries) {
-    const urlsToCheck = [];
-    for (const entry of entries) {
-        if (urlsToCheck.length >= MAX_URLS)
-            break;
-        const matches = entry.body.match(URL_RE) ?? [];
-        for (const url of matches.slice(0, 3)) {
-            urlsToCheck.push({ ref: entry.ref, url });
-            if (urlsToCheck.length >= MAX_URLS)
-                break;
-        }
-    }
+    const urlsToCheck = entries.flatMap((entry) => (entry.body.match(URL_RE) ?? []).map((url) => ({ ref: entry.ref, url })));
     const results = [];
     await Promise.allSettled(urlsToCheck.map(async ({ ref, url }) => {
         try {
-            const controller = new AbortController();
-            const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
-            const res = await fetch(url, {
-                method: "HEAD",
-                signal: controller.signal,
-                redirect: "follow",
-            });
-            clearTimeout(timer);
-            if (res.status >= 400) {
+            const res = await fetch(url, { method: "HEAD", redirect: "follow" });
+            if (res.status >= 400)
                 results.push({ ref, url, status: res.status });
-            }
         }
-        catch (e) {
-            if (e.name === "AbortError") {
-                results.push({ ref, url, status: "timeout" });
-            }
-            // network errors (ENOTFOUND etc.) — skip, don't report as dead
+        catch {
+            results.push({ ref, url, status: "error" });
         }
     }));
     return results;

package/dist/core/adapter/adapters/agent-skills-adapter.js

@@ -44,6 +44,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { parseFrontmatter } from "../../asset/frontmatter.js";
+import { toPosix } from "../../common.js";
 import { hashContent, nonEmptyString, readTags } from "./shared.js";
 /** A skills collection is a single-component bundle; its one component is `main`. */
 const COMPONENT_ID = "main";
@@ -56,11 +57,6 @@ const DESCRIPTION_MAX = 1024;
 const RESERVED_NAME_WORDS = ["anthropic", "claude"];
 /** name charset/shape rule (spec §4.5). */
 const NAME_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
-/** Upper bound on the bounded `content` FTS field (mirrors okf-adapter). */
-const MAX_CONTENT_CHARS = 100_000;
-function toPosix(p) {
-    return p.replace(/\\/g, "/");
-}
 /** conceptId + package-dir name for a `<name>/SKILL.md` file, or null when the file is not a skill manifest. */
 function skillPackage(relPath) {
     const posix = toPosix(relPath);
@@ -95,7 +91,7 @@ function recognize(c, file) {
         adapterId: "agent-skills",
         type: "skill",
         name,
-        content: body.length > MAX_CONTENT_CHARS ? body.slice(0, MAX_CONTENT_CHARS) : body,
+        content: body,
     };
     if (description !== undefined)
         doc.description = description;

package/dist/core/adapter/adapters/akm-adapter.js

@@ -88,7 +88,7 @@ import { executionDefaultsFromFrontmatter, renderMarkdownExecutionSource } from
 import { recognizeMatch } from "../recognize-match.js";
 import { perTypeValidateChecks, skillDirectoryDiagnostics, workflowYamlSourceDiagnostics } from "./akm-lint.js";
 import { applyFoldedMetadata, foldRecognizedMetadata } from "./akm-metadata.js";
-import { hashContent, runBaseValidateChecks } from "./shared.js";
+import { hashContent, RESERVED_FILES, runBaseValidateChecks } from "./shared.js";
 // `recognizeMatch` + the builtin matcher list moved to the cycle-free leaf
 // `../recognize-match` (Chunk 5 M-b) so both this adapter AND the indexer
 // metadata pass import it without closing a metadata ↔ adapter cycle. Re-exported
@@ -99,12 +99,11 @@ export { recognizeMatch } from "../recognize-match.js";
  * OKF reserved structural files (ref-grammar decision D-R6, spec §5.1 /
  * adapter-spec §5.1/§6): `index.md` (directory listing) and `log.md` (update
  * history) are bundle structure at EVERY depth — never a concept document. The
- * `okf` / `llm-wiki` adapters already exclude them (`okf-adapter.ts`
+ * `okf` / `llm-wiki` adapters already exclude them (`shared.ts`'s
  * `RESERVED_FILES`); this brings the `akm` adapter into conformance so a
  * `knowledge/index.md` never classifies as a `knowledge` item. Case-insensitive,
  * matched on the bare filename so the exclusion holds at any depth.
  */
-const RESERVED_FILES = new Set(["index.md", "log.md"]);
 /** True when `name` (a bare file name) is an OKF reserved file, case-insensitively (D-R6). */
 function isReservedFileName(name) {
     return RESERVED_FILES.has(name.toLowerCase());

package/dist/core/adapter/adapters/akm-lint.js

@@ -57,7 +57,7 @@ import { taskSourceErrorDetail } from "../../../tasks/source-v3.js";
 import { compileWorkflowPlan } from "../../../workflows/ir/compile.js";
 import { compileWorkflowSource } from "../../../workflows/source-ir/compile.js";
 import { conceptIdForStashFile } from "../../asset/resolve-ref.js";
-import { isAkmRegistryCachePath } from "../../common.js";
+import { isAkmRegistryCachePath, scanEnvKeyNames } from "../../common.js";
 /** Recommended `category` values for facts — `commands/lint/fact-linter.ts:9`. */
 const KNOWN_CATEGORIES = new Set(["personal", "team", "project", "convention", "meta"]);
 /** Placeholder markers a workflow stub carries — `commands/lint/workflow-linter.ts:10`. */
@@ -118,24 +118,6 @@ export function nameOrTypeDiagnostics(relPath, data, frontmatter, allowedTypes)
     return [];
 }
 // ── env dangerous-key scan (content-based port of env-key-rules.ts) ──────────
-/** Matches a KEY=value assignment line, capturing only the key — `commands/env/env.ts:62`. */
-const ASSIGN_RE = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/;
-/** Port of `commands/env/env.ts#scanKeys` (`:65-77`) — content-based (overlay `raw`, not disk). */
-function scanKeys(text) {
-    const keys = [];
-    const seen = new Set();
-    for (const line of text.split(/\r?\n/)) {
-        const m = line.match(ASSIGN_RE);
-        if (!m)
-            continue;
-        const key = m[1];
-        if (seen.has(key))
-            continue;
-        seen.add(key);
-        keys.push(key);
-    }
-    return keys;
-}
 /** Port of `env-key-rules.ts#collectSuppressedKeys` (`:144-164`) — content-based. */
 function collectSuppressedKeys(raw) {
     const suppressed = new Set();
@@ -171,7 +153,7 @@ export function dangerousEnvKeyDiagnostics(type, relPath, raw) {
         return []; // NARROWNESS: collectEnvFiles only visits *.env
     // `relPath` is already stash-root-relative, so "." IS the stash root here.
     const ref = conceptIdForStashFile(type, ".", relPath);
-    const keys = scanKeys(raw);
+    const keys = scanEnvKeyNames(raw);
     const suppressed = collectSuppressedKeys(raw);
     const diagnostics = [];
     for (const key of keys) {

package/dist/core/adapter/adapters/akm-task-adapter.js

@@ -35,16 +35,12 @@ import fs from "node:fs";
 import path from "node:path";
 import { parseTaskSource } from "../../../tasks/source/parse-task-source.js";
 import { TASK_EXTENSION, TASK_NEAR_MISS_EXTENSION, taskExtensionDetail, taskSourceErrorDetail, } from "../../../tasks/source-v3.js";
+import { toPosix } from "../../common.js";
 import { hashContent } from "./shared.js";
 /** A native task bundle is single-component; its one component is `main`. */
 const COMPONENT_ID = "main";
 /** The task YAML extension (spec §6 task row). */
 const TASK_EXT = TASK_EXTENSION;
-/** Upper bound on the bounded `content` FTS field (mirrors okf-adapter). */
-const MAX_CONTENT_CHARS = 100_000;
-function toPosix(p) {
-    return p.replace(/\\/g, "/");
-}
 function recognize(c, file) {
     if (file.ext !== TASK_EXT)
         return null;
@@ -61,7 +57,7 @@ function recognize(c, file) {
         adapterId: "akm-task",
         type: "task",
         name,
-        content: raw.length > MAX_CONTENT_CHARS ? raw.slice(0, MAX_CONTENT_CHARS) : raw,
+        content: raw,
     };
 }
 async function validate(c, changes, ctx) {

package/dist/core/adapter/adapters/akm-workflow-adapter.js

@@ -23,17 +23,13 @@ import fs from "node:fs";
 import path from "node:path";
 import { looksLikeGithubWorkflowSource } from "../../../workflows/source-ir/compile.js";
 import { parseFrontmatter } from "../../asset/frontmatter.js";
+import { toPosix } from "../../common.js";
 import { perTypeValidateChecks, workflowYamlSourceDiagnostics } from "./akm-lint.js";
 import { hashContent, nonEmptyString, readTags, runBaseValidateChecks } from "./shared.js";
 /** A native workflow bundle is single-component; its one component is `main`. */
 const COMPONENT_ID = "main";
 /** The two authoritative workflow source formats. `.yaml` is deliberately not accepted. */
 const WORKFLOW_EXTS = new Set([".md", ".yml"]);
-/** Upper bound on the bounded `content` FTS field (mirrors okf-adapter). */
-const MAX_CONTENT_CHARS = 100_000;
-function toPosix(p) {
-    return p.replace(/\\/g, "/");
-}
 /** Strip the recognized workflow extension from a component-root-relative path → conceptId. */
 function conceptIdOf(relPath) {
     return toPosix(relPath).replace(/\.(?:md|yml)$/i, "");
@@ -78,7 +74,7 @@ function recognize(c, file) {
         adapterId: "akm-workflow",
         type: "workflow",
         name,
-        content: body.length > MAX_CONTENT_CHARS ? body.slice(0, MAX_CONTENT_CHARS) : body,
+        content: body,
     };
     if (description !== undefined)
         doc.description = description;

package/dist/core/adapter/adapters/dotenv-adapter.js

@@ -30,6 +30,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { assetPathCandidatesForName, assetPathForName, typeForStashDir } from "../../asset/asset-placement.js";
+import { scanEnvKeyNames, toPosix } from "../../common.js";
 import { dangerousEnvKeyDiagnostics } from "./akm-lint.js";
 import { hashContent } from "./shared.js";
 /** A dotenv bundle is single-component; its one component is `main`. */
@@ -40,11 +41,6 @@ const ENV_DIR = "env";
 const SECRETS_DIR = "secrets";
 /** Non-secret marker suffixes under `secrets/` (spec §6 secret row). */
 const SECRET_SKIP_SUFFIXES = [".lock", ".sensitive"];
-/** Matches a KEY=value assignment line, capturing only the key (mirrors akm-lint scanKeys). */
-const ASSIGN_RE = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/;
-function toPosix(p) {
-    return p.replace(/\\/g, "/");
-}
 /** Classify a component-root-relative file as env / secret, or null (abstain). */
 function classify(relPath) {
     const posix = toPosix(relPath);
@@ -80,22 +76,6 @@ function hasSensitiveMarker(absPath, type) {
     const marker = type === "env" ? absPath.replace(/\.env$/i, ".sensitive") : `${absPath}.sensitive`;
     return marker !== absPath && fs.existsSync(marker);
 }
-/** Extract KEY NAMES (never values) from an env file's raw content, first-appearance order, deduped. */
-function scanKeyNames(raw) {
-    const keys = [];
-    const seen = new Set();
-    for (const line of raw.split(/\r?\n/)) {
-        const m = line.match(ASSIGN_RE);
-        if (!m)
-            continue;
-        const key = m[1];
-        if (seen.has(key))
-            continue;
-        seen.add(key);
-        keys.push(key);
-    }
-    return keys;
-}
 function conceptIdForPath(type, relativePath) {
     const posix = toPosix(relativePath);
     if (type === "secret")
@@ -115,7 +95,7 @@ function recognize(c, file) {
         // env: strip `.env`; surface KEY NAMES only (never values/comments/content).
         const conceptId = conceptIdForPath(type, posix);
         const name = (conceptId.split("/").pop() ?? conceptId) || "default";
-        const keys = scanKeyNames(raw);
+        const keys = scanEnvKeyNames(raw);
         const doc = {
             ref: `${c.id}//${conceptId}`,
             bundle: c.id,