akm-cli 0.10.261012-beta → 0.10.261014-beta

package/dist/commands/health/checks.js

@@ -1,812 +1,13 @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
-import { spawnSync } from "node:child_process";
-import { loadConfig } from "../../core/config/config.js";
-import { listEnvsRecursive } from "../../core/env-secret-ref.js";
-import { ConfigError } from "../../core/errors.js";
 import { EXTRACT_INFRASTRUCTURE_SKIP_REASONS } from "../../core/improve-types.js";
 import { listPendingStateMigrations } from "../../core/state-db.js";
-import { withEngineFallback } from "../../integrations/agent/engine-fallback.js";
-import { isLlmCredentialAvailable, resolveEngine, } from "../../integrations/agent/engine-resolution.js";
-import { executionEngineDefinitionsFromConfig } from "../../integrations/agent/execution.js";
-import { loadModelMap, mergeModelMapLayers, parseModelMapLayer, readInstalledModelMapText, resolveModelMapAlias, userModelMapPath, } from "../../integrations/agent/model-map.js";
-import { detectOpencodeMajor, resolveOpencodeBin, } from "../../integrations/harnesses/opencode/version.js";
-import { OPENCODE_CLIENT_PACKAGE } from "../../integrations/harnesses/opencode-sdk/wire.js";
-import { probeEndpointOnce } from "../../llm/client.js";
 import { STATE_DB_FREELIST_WARN_RATIO, } from "../../storage/state-db-integrity.js";
-import { listKeys } from "../env/env.js";
-import { MODEL_CALLING_PROCESSES, resolveImprovePlan } from "../improve/improve-strategies.js";
-import { ENGINE_LAST_USED_LOOKBACK_DAYS } from "./engine-usage.js";
-import { ACTIVE_RUN_WARN_MS, TASK_FAIL_RATE_WARN, } from "./types.js";
-/** Probe one connection's reachability, once per endpoint; `undefined` when no probe seam is supplied. */
-function probeConnectionReachable(connection, deps, cache) {
-    if (!deps.probeReachable)
-        return Promise.resolve(undefined);
-    return probeEndpointOnce(connection, cache, deps.probeReachable);
-}
-function reachabilityEvidence(reach) {
-    return reach
-        ? { probed: true, reachable: reach.reachable, ...(reach.error ? { error: reach.error } : {}) }
-        : { probed: false, reachable: null };
-}
-/**
- * #914: an unreachable LLM engine is a hard `fail` when it is the resolved
- * `default-llm-engine` (extraction and improve depend on it) but only a
- * `warn` elsewhere. Only a reachability warn escalates; a credential warn
- * stays a warn.
- */
-function escalateDefaultLlmEngineFailure(result) {
-    if (result.status === "warn" && result.evidence?.reachable === false) {
-        return { ...result, status: "fail" };
-    }
-    return result;
-}
+import { semanticSearchCheck } from "./semantic-search-check.js";
+import { ACTIVE_RUN_WARN_MS, TASK_FAIL_RATE_WARN } from "./types.js";
 /** Rolling window the `session-extraction` check reads from the extract ledger (#914). */
 export const SESSION_EXTRACTION_LEDGER_WINDOW_DAYS = 7;
-/**
- * Delegates to {@link isLlmCredentialAvailable} (#953) so `akm health` and the
- * improve-strategy probe (#957 builds on this same helper) share one
- * non-throwing "is a credential present" check with the real dispatch
- * boundary — env value, file-backed (#905), or secret-store-backed (#953).
- */
-function credentialAvailable(credential, env, apiKeyFile, apiKeySecretRef) {
-    return isLlmCredentialAvailable({ credential, apiKeyFile, apiKeySecretRef }, env);
-}
-/**
- * #950: when a required `$VAR`-style credential is missing from the shell,
- * find the env asset (if any) whose key names include one of
- * `credential.names` — so the warn can say "run under env/lab" instead of a
- * bare "unavailable". Returns the asset's ref, or `null` when no credential,
- * no candidate names, or no matching env asset. Never returns or logs the
- * variable name itself (only ref/path/keys ever leave `listEnvsRecursive`,
- * and only the ref is read here) — `tests/health-engine-probe.test.ts` pins
- * that a credential's env-var name never appears in health's JSON output.
- * Best-effort: any failure walking env assets (unreadable stash, bad config)
- * degrades to `null`, never a crash. `deps.listEnvAssets` is expected to
- * already be normalised (see {@link withMemoizedEnvAssets}) by the time this
- * runs, so the walk happens at most once per probe run — every caller of
- * this function passes deps that have already gone through
- * {@link withMemoizedEnvAssets}, so there is no separate default to fall
- * back to here.
- */
-function findSuppliedByEnvAsset(credential, deps) {
-    if (!credential || credential.names.length === 0)
-        return null;
-    try {
-        const envs = deps.listEnvAssets?.();
-        if (!envs)
-            return null;
-        for (const envAsset of envs) {
-            if (credential.names.some((name) => envAsset.keys.includes(name)))
-                return envAsset.ref;
-        }
-    }
-    catch {
-        // Best-effort — env-asset discovery must never break a health probe.
-    }
-    return null;
-}
-/**
- * #950: normalise `deps.listEnvAssets` once per probe run so
- * {@link findSuppliedByEnvAsset}'s env-asset walk happens at most once even
- * when a run probes several engines with missing credentials — the walk is
- * real IO (or config-injected IO in tests) with no reason to repeat per
- * engine. Wraps whatever seam is already present (test-injected or the
- * config-honouring default) in a memoising closure; called once by each of
- * the four probe entry points that share {@link runConfiguredEngineProbe}
- * (`runDefaultEngineProbe`, `runDefaultLlmEngineProbe`,
- * `runConfiguredEnginesProbe`, `runHealthEngineProbes`).
- */
-function withMemoizedEnvAssets(deps) {
-    const listEnvAssets = deps.listEnvAssets ?? (() => listEnvsRecursive(listKeys, (deps.loadConfig ?? loadConfig)()));
-    let cached;
-    return { ...deps, listEnvAssets: () => (cached ??= listEnvAssets()) };
-}
-async function runConfiguredEngineProbe(checkName, engineName, config, deps, reachabilityCache) {
-    if (!engineName) {
-        return {
-            name: checkName,
-            kind: "deterministic",
-            status: "unknown",
-            confidence: "high",
-            message: checkName === "default-llm-engine"
-                ? "No default LLM engine is configured."
-                : "No default engine is configured.",
-        };
-    }
-    const env = deps.env ?? process.env;
-    const configuredEngine = config.engines?.[engineName];
-    if (configuredEngine?.kind === "agent" && configuredEngine.platform === "opencode-sdk") {
-        const binary = resolveOpencodeBin(configuredEngine.bin);
-        let detected;
-        try {
-            detected = detectOpencodeMajor(binary, {
-                probe: (bin) => {
-                    const run = (deps.spawnSync ?? spawnSync)(bin, ["--version"], { encoding: "utf8", timeout: 5_000 });
-                    return (run.status ?? 1) === 0 ? String(run.stdout ?? "").trim() : undefined;
-                },
-            });
-        }
-        catch {
-            return {
-                name: checkName,
-                kind: "deterministic",
-                status: "warn",
-                confidence: "high",
-                message: `SDK engine "${engineName}" executable availability could not be checked.`,
-                evidence: { engine: engineName, runtimeKind: "sdk", binaryAvailable: false },
-            };
-        }
-        const binaryAvailable = detected.runnable;
-        // The client package of the OpenCode major the binary reports; never the other major's.
-        const clientPackage = OPENCODE_CLIENT_PACKAGE[detected.major];
-        let packageAvailable = false;
-        try {
-            const resolvePackage = deps.resolvePackage ?? ((name) => import.meta.resolve(name));
-            resolvePackage(clientPackage);
-            packageAvailable = true;
-        }
-        catch {
-            packageAvailable = false;
-        }
-        const fallbackEngine = configuredEngine.llmEngine;
-        let fallback;
-        let fallbackCredential;
-        let fallbackApiKeyFile;
-        let fallbackApiKeySecretRef;
-        let sdkRunner;
-        const resolve = deps.resolveEngine ?? resolveEngine;
-        try {
-            const resolved = resolve(engineName, config);
-            if (resolved.kind === "sdk")
-                sdkRunner = resolved;
-        }
-        catch {
-            sdkRunner = undefined;
-        }
-        if (sdkRunner?.fallbackConnection && fallbackEngine) {
-            fallback = { kind: "llm", engine: fallbackEngine, connection: sdkRunner.fallbackConnection };
-            fallbackCredential = sdkRunner.fallbackCredential;
-            fallbackApiKeyFile = sdkRunner.fallbackApiKeyFile;
-            fallbackApiKeySecretRef = sdkRunner.fallbackApiKeySecretRef;
-        }
-        else if (fallbackEngine) {
-            try {
-                const resolved = resolve(fallbackEngine, config);
-                if (resolved.kind === "llm") {
-                    fallback = resolved;
-                    fallbackCredential = resolved.credential;
-                    fallbackApiKeyFile = resolved.apiKeyFile;
-                    fallbackApiKeySecretRef = resolved.apiKeySecretRef;
-                }
-            }
-            catch {
-                fallback = undefined;
-            }
-        }
-        const configuredModel = configuredEngine.model;
-        const effectiveModel = sdkRunner?.profile.model ?? configuredModel ?? fallback?.connection.model;
-        const fallbackCredentialAvailable = credentialAvailable(fallbackCredential, env, fallbackApiKeyFile, fallbackApiKeySecretRef);
-        const fallbackSuppliedByEnvAsset = !fallbackCredentialAvailable
-            ? findSuppliedByEnvAsset(fallbackCredential, deps)
-            : null;
-        const missing = [
-            !packageAvailable ? `${clientPackage} package` : undefined,
-            !binaryAvailable ? `${binary} binary` : undefined,
-            fallbackEngine && !fallback ? "configured fallback LLM connection" : undefined,
-            !fallbackCredentialAvailable
-                ? fallbackSuppliedByEnvAsset
-                    ? `required fallback credential (available via env asset ${fallbackSuppliedByEnvAsset}; run under it: akm env run ${fallbackSuppliedByEnvAsset} -- ...)`
-                    : "required fallback credential"
-                : undefined,
-        ].filter((value) => value !== undefined);
-        const sdkEvidence = {
-            engine: engineName,
-            platform: configuredEngine.platform,
-            runtimeKind: "sdk",
-            binary,
-            binaryAvailable,
-            package: clientPackage,
-            detectedVersion: detected.version || null,
-            detectedMajor: detected.major,
-            packageAvailable,
-            model: effectiveModel ?? null,
-            configuredModel: configuredModel ?? null,
-            modelSource: configuredModel ? "sdk" : effectiveModel ? "fallback" : null,
-            fallbackEngine: fallbackEngine ?? null,
-            fallbackEndpoint: fallback?.connection.endpoint ?? null,
-            fallbackModel: fallback?.connection.model ?? null,
-            requiredCredentialAvailable: fallbackCredentialAvailable,
-            suppliedByEnvAsset: fallbackSuppliedByEnvAsset,
-        };
-        if (missing.length > 0) {
-            return {
-                name: checkName,
-                kind: "deterministic",
-                status: "warn",
-                confidence: "high",
-                message: `SDK engine "${engineName}" is incomplete: missing ${missing.join(", ")}.`,
-                evidence: sdkEvidence,
-            };
-        }
-        // The SDK's LLM fallback is the only endpoint this engine talks to;
-        // probe it once every local precondition above is satisfied (#914).
-        const reach = fallback ? await probeConnectionReachable(fallback.connection, deps, reachabilityCache) : undefined;
-        return {
-            name: checkName,
-            kind: "deterministic",
-            status: reach && !reach.reachable ? "warn" : "pass",
-            confidence: "high",
-            message: !fallback
-                ? `SDK engine "${engineName}" is available.`
-                : !reach
-                    ? `SDK engine "${engineName}" is available. Reachability was not probed.`
-                    : reach.reachable
-                        ? `SDK engine "${engineName}" is available and its LLM fallback is reachable.`
-                        : `SDK engine "${engineName}" is available, but its LLM fallback is not reachable: ${reach.error ?? "unknown error"}`,
-            evidence: fallback ? { ...sdkEvidence, ...reachabilityEvidence(reach) } : sdkEvidence,
-        };
-    }
-    try {
-        const runner = (deps.resolveEngine ?? resolveEngine)(engineName, config);
-        if (runner.kind === "llm") {
-            const requiredCredentialAvailable = credentialAvailable(runner.credential, env, runner.apiKeyFile, runner.apiKeySecretRef);
-            const llmEvidence = {
-                engine: engineName,
-                platform: null,
-                runtimeKind: "llm",
-                model: runner.connection.model,
-                endpoint: runner.connection.endpoint,
-                requiredCredentialAvailable,
-            };
-            if (!requiredCredentialAvailable) {
-                // #950: a missing-in-shell credential is common when the operator's
-                // real workflow is `akm env run env/lab -- akm improve` — name the env
-                // asset that supplies it (never the variable name) so the warn is
-                // actionable instead of looking like a broken engine.
-                const suppliedByEnvAsset = findSuppliedByEnvAsset(runner.credential, deps);
-                return {
-                    name: checkName,
-                    kind: "deterministic",
-                    status: "warn",
-                    confidence: "high",
-                    message: suppliedByEnvAsset
-                        ? `LLM engine "${engineName}" is configured, but its required credential is not available in this shell; env asset ${suppliedByEnvAsset} supplies it — run under it (akm env run ${suppliedByEnvAsset} -- ...).`
-                        : `LLM engine "${engineName}" is configured, but its required credential is unavailable.`,
-                    evidence: { ...llmEvidence, suppliedByEnvAsset },
-                };
-            }
-            const reach = await probeConnectionReachable(runner.connection, deps, reachabilityCache);
-            return {
-                name: checkName,
-                kind: "deterministic",
-                status: reach && !reach.reachable ? "warn" : "pass",
-                confidence: "high",
-                message: !reach
-                    ? `LLM engine "${engineName}" is configured. Reachability was not probed.`
-                    : reach.reachable
-                        ? `LLM engine "${engineName}" is configured and reachable.`
-                        : `LLM engine "${engineName}" is not reachable: ${reach.error ?? "unknown error"}`,
-                evidence: { ...llmEvidence, ...reachabilityEvidence(reach) },
-            };
-        }
-        const profile = runner.profile;
-        if (runner.kind === "sdk")
-            throw new Error(`SDK engine "${engineName}" has no matching SDK config.`);
-        const version = (deps.spawnSync ?? spawnSync)(profile.bin, ["--version"], { encoding: "utf8", timeout: 5_000 });
-        if ((version.status ?? 1) !== 0) {
-            return {
-                name: checkName,
-                kind: "deterministic",
-                status: "warn",
-                confidence: "medium",
-                message: `Agent engine "${engineName}" was found but \`--version\` failed.`,
-                evidence: {
-                    engine: engineName,
-                    platform: profile.platform ?? null,
-                    runtimeKind: "agent",
-                    model: profile.model ?? null,
-                },
-            };
-        }
-        return {
-            name: checkName,
-            kind: "deterministic",
-            status: "pass",
-            confidence: "high",
-            message: `Agent engine "${engineName}" is available.`,
-            evidence: {
-                engine: engineName,
-                platform: profile.platform ?? null,
-                runtimeKind: "agent",
-                model: profile.model ?? null,
-            },
-        };
-    }
-    catch (error) {
-        return {
-            name: checkName,
-            kind: "deterministic",
-            status: "warn",
-            confidence: "high",
-            message: error instanceof Error ? error.message : String(error),
-        };
-    }
-}
-function projectEngineProbe(result, name) {
-    return result.name === name ? result : { ...result, name };
-}
-function projectSelectedEngineProbe(availability, engineName, checkName) {
-    const result = availability.get(engineName);
-    if (result) {
-        const projected = projectEngineProbe(result, checkName);
-        return checkName === "default-llm-engine" ? escalateDefaultLlmEngineFailure(projected) : projected;
-    }
-    return {
-        name: checkName,
-        kind: "deterministic",
-        status: "warn",
-        confidence: "high",
-        message: `Engine "${engineName}" availability could not be checked.`,
-        evidence: { engine: engineName },
-    };
-}
-function unconfiguredEngineProbe(name) {
-    return {
-        name,
-        kind: "deterministic",
-        status: "unknown",
-        confidence: "high",
-        message: name === "default-llm-engine" ? "No default LLM engine is configured." : "No default engine is configured.",
-    };
-}
-/**
- * #949: `enableThinking: false` is a request an engine's endpoint (or a
- * gateway in front of it) can silently ignore — `chatCompletionAttemptOnce`
- * (src/llm/client.ts) already warns to stderr whenever a response reports
- * reasoning tokens despite it. This makes that same signal visible in
- * `akm health` as a structured finding, purely by re-reading the window's
- * `llm_usage` aggregate already threaded into the context: no extra
- * completion call, no live probe — a cold local model must not be woken just
- * to run `akm health`.
- */
-function projectThinkingControlCheck(thinkingOffEngines, llmUsage, since) {
-    if (thinkingOffEngines.length === 0) {
-        return {
-            name: "thinking-control",
-            kind: "deterministic",
-            status: "unknown",
-            confidence: "high",
-            message: "No configured engine sets enableThinking: false — nothing to verify.",
-            evidence: { engines: [] },
-        };
-    }
-    const engines = [...thinkingOffEngines].sort().map((engine) => {
-        const usage = llmUsage.byEngine[engine];
-        const calls = usage?.calls ?? 0;
-        const reasoningTokens = usage?.reasoningTokens ?? 0;
-        const status = calls === 0 ? "unknown" : reasoningTokens > 0 ? "warn" : "pass";
-        return { engine, status, calls, reasoningTokens };
-    });
-    const warning = engines.filter((e) => e.status === "warn");
-    const status = warning.length > 0 ? "warn" : engines.every((e) => e.status === "unknown") ? "unknown" : "pass";
-    let message;
-    if (warning.length > 0) {
-        message = warning
-            .map((e) => `LLM engine "${e.engine}" returned ${e.reasoningTokens} reasoning tokens since ${since} despite enableThinking: false — the endpoint (or a gateway in front of it) is not honouring the thinking-off control.`)
-            .join(" ");
-    }
-    else if (status === "unknown") {
-        message = `No calls were recorded for the engine(s) configured with enableThinking: false (${engines.map((e) => e.engine).join(", ")}) in the report window.`;
-    }
-    else {
-        message = `${engines.length} engine(s) configured with enableThinking: false (${engines.map((e) => e.engine).join(", ")}) returned no reasoning tokens in the report window.`;
-    }
-    return {
-        name: "thinking-control",
-        kind: "deterministic",
-        status,
-        confidence: "high",
-        message,
-        evidence: { engines },
-    };
-}
-function configuredEnginesProjection(engineNames, availability) {
-    if (engineNames.length === 0) {
-        return {
-            name: "configured-engines",
-            kind: "deterministic",
-            status: "unknown",
-            confidence: "high",
-            message: "No engines are explicitly configured.",
-            evidence: { engines: [] },
-        };
-    }
-    const engines = engineNames.map((engine) => ({
-        engine,
-        status: availability.get(engine)?.status === "pass" ? "pass" : "warn",
-    }));
-    const unavailable = engines.filter((engine) => engine.status === "warn").length;
-    return {
-        name: "configured-engines",
-        kind: "deterministic",
-        status: unavailable === 0 ? "pass" : "warn",
-        confidence: "high",
-        message: unavailable === 0
-            ? `All ${engines.length} explicitly configured engines are available.`
-            : `${unavailable} of ${engines.length} explicitly configured engines ${unavailable === 1 ? "is" : "are"} unavailable.`,
-        evidence: { engines },
-    };
-}
-export async function runDefaultEngineProbe(deps = {}) {
-    // Probe the effective view: an install with no `defaults.engine` but a usable
-    // opencode binary DOES have a working default, and reporting otherwise would
-    // contradict what `workflow run` / `task run` actually do.
-    const { config } = withEngineFallback(deps.loadConfig?.() ?? loadConfig(), deps.which);
-    return runConfiguredEngineProbe("default-engine", config.defaults?.engine, config, withMemoizedEnvAssets(deps), new Map());
-}
-export async function runDefaultLlmEngineProbe(deps = {}) {
-    const config = deps.loadConfig?.() ?? loadConfig();
-    const engineName = config.defaults?.llmEngine;
-    if (!engineName)
-        return unconfiguredEngineProbe("default-llm-engine");
-    const result = await runConfiguredEngineProbe("configured-engine", engineName, config, withMemoizedEnvAssets(deps), new Map());
-    return projectSelectedEngineProbe(new Map([[engineName, result]]), engineName, "default-llm-engine");
-}
-/** Probe every explicitly configured engine without exposing connection or model material. */
-export async function runConfiguredEnginesProbe(deps = {}) {
-    const config = deps.loadConfig?.() ?? loadConfig();
-    const engineNames = Object.keys(config.engines ?? {}).sort();
-    const cache = new Map();
-    const runDeps = withMemoizedEnvAssets(deps);
-    const availability = new Map(await Promise.all(engineNames.map(async (engine) => [engine, await runConfiguredEngineProbe("configured-engine", engine, config, runDeps, cache)])));
-    return configuredEnginesProjection(engineNames, availability);
-}
-/**
- * Build the per-health-run availability snapshot. Each distinct selected or
- * explicitly configured engine is probed once (reachability probes further
- * de-duped by endpoint, see {@link ReachabilityCache}); the three public
- * checks are projections of that immutable result set.
- */
-export async function runHealthEngineProbes(deps = {}) {
-    const configured = deps.loadConfig?.() ?? loadConfig();
-    const effective = withEngineFallback(configured, deps.which).config;
-    const defaultEngineName = effective.defaults?.engine;
-    const defaultLlmEngineName = configured.defaults?.llmEngine;
-    const explicitEngineNames = Object.keys(configured.engines ?? {}).sort();
-    const probeNames = [...new Set([...explicitEngineNames, defaultEngineName, defaultLlmEngineName])]
-        .filter((name) => name !== undefined)
-        .sort();
-    const cache = new Map();
-    const runDeps = withMemoizedEnvAssets(deps);
-    const availability = new Map(await Promise.all(probeNames.map(async (engine) => [engine, await runConfiguredEngineProbe("configured-engine", engine, effective, runDeps, cache)])));
-    return Object.freeze({
-        defaultEngine: defaultEngineName
-            ? projectSelectedEngineProbe(availability, defaultEngineName, "default-engine")
-            : unconfiguredEngineProbe("default-engine"),
-        defaultLlmEngine: defaultLlmEngineName
-            ? projectSelectedEngineProbe(availability, defaultLlmEngineName, "default-llm-engine")
-            : unconfiguredEngineProbe("default-llm-engine"),
-        configuredEngines: configuredEnginesProjection(explicitEngineNames, availability),
-    });
-}
-/**
- * #950: probes the active improve strategy and returns both its
- * `HealthCheckResult` and the typed process→engine map, computed once. See
- * {@link runActiveImproveStrategyProbe} for the plain-`HealthCheckResult`
- * wrapper existing callers/tests use.
- */
-export function probeActiveImproveStrategy(deps = {}) {
-    const config = deps.loadConfig?.() ?? loadConfig();
-    const strategyName = config.defaults?.improveStrategy ?? "default";
-    const env = deps.env ?? process.env;
-    try {
-        // #957: credential availability (including the triage-judgment engine) is
-        // now derived once, inside `buildImprovePlan` itself — the same
-        // `plan.engineUnavailable` the real `improve` run reads to skip processes
-        // and populate `AkmImproveResult.skippedProcesses`. This check is a pure
-        // projection of that list rather than its own re-derivation.
-        //
-        // `allowAllDisabled: true` because a strategy left with every process
-        // disabled purely by credential unavailability must still come back as
-        // an inspectable plan here, not a thrown ConfigError — the
-        // `allRequiredUnavailable`/`fail` logic below needs `plan.engineUnavailable`
-        // to run this check's fail path instead of falling into the generic
-        // catch block's warn/unknown fallback (round 2 finding on #957). A
-        // strategy with no engine configured at all still throws (see
-        // `allowAllDisabled`'s doc comment) and keeps hitting that catch block,
-        // unchanged from before this fix.
-        const plan = resolveImprovePlan(strategyName, config, { env, allowAllDisabled: true });
-        const unavailableProcesses = plan.engineUnavailable.map((item) => item.process);
-        // #913: name the engine each process actually resolved to, so a
-        // strategy-level `engine` pin that shadows `defaults.llmEngine` is
-        // visible on `akm health` instead of requiring config archaeology.
-        const engines = {};
-        for (const [name, process] of Object.entries(plan.processes)) {
-            if (process.enabled && process.runner)
-                engines[name] = process.runner.engine;
-        }
-        if (plan.triageJudgment)
-            engines["triage.judgment"] = plan.triageJudgment.engine;
-        const engineList = Object.entries(engines)
-            .sort(([a], [b]) => a.localeCompare(b))
-            .map(([process, engine]) => `${process}: "${engine}"`)
-            .join(", ");
-        // #957: fail only when the strategy's model work would be a total no-op —
-        // every process the strategy actually enabled among the ones that call a
-        // model themselves (MODEL_CALLING_PROCESSES, any engine kind) ended up
-        // unavailable. A partial failure (some processes still have a working
-        // engine) stays a `warn`, matching #914's "a credential warn stays a warn"
-        // policy for the general per-engine probes; this is the strategy-scoped
-        // "is the whole run a no-op" question instead.
-        const modelProcessNames = [...MODEL_CALLING_PROCESSES];
-        const requiredModelProcessNames = modelProcessNames.filter((name) => plan.processes[name].enabled || plan.engineUnavailable.some((item) => item.process === name));
-        const availableModelProcessNames = modelProcessNames.filter((name) => plan.processes[name].enabled);
-        const allRequiredUnavailable = requiredModelProcessNames.length > 0 && availableModelProcessNames.length === 0;
-        // No engine configured at all (no unavailable item carries a resolved engine)
-        // is "not set up yet", not a broken credential: it keeps the unknown/warn
-        // result it had when the plan threw for it. Engine-free deterministic triage
-        // (#1143) now lets such a plan resolve, so this has to be explicit.
-        const noEngineConfigured = plan.engineUnavailable.length > 0 && plan.engineUnavailable.every((i) => !i.engine);
-        const explicitlyConfigured = config.defaults?.improveStrategy !== undefined || Object.keys(config.improve?.strategies ?? {}).length > 0;
-        const status = unavailableProcesses.length === 0
-            ? "pass"
-            : allRequiredUnavailable
-                ? noEngineConfigured
-                    ? explicitlyConfigured
-                        ? "warn"
-                        : "unknown"
-                    : "fail"
-                : "warn";
-        return {
-            check: {
-                name: "active-improve-strategy",
-                kind: "deterministic",
-                status,
-                confidence: "high",
-                message: unavailableProcesses.length === 0
-                    ? `Active improve strategy "${plan.strategy.name}" has available process engines${engineList ? ` (${engineList})` : ""}.`
-                    : allRequiredUnavailable
-                        ? `Active improve strategy "${plan.strategy.name}" cannot run any LLM-backed process; the nightly run would be a no-op: ${unavailableProcesses.join(", ")}${engineList ? ` (engines: ${engineList})` : ""}.`
-                        : `Active improve strategy "${plan.strategy.name}" has unavailable required credentials for: ${unavailableProcesses.join(", ")}${engineList ? ` (engines: ${engineList})` : ""}.`,
-                evidence: {
-                    strategy: plan.strategy.name,
-                    unavailableProcesses,
-                    engines,
-                },
-            },
-            processEngines: Object.freeze({ ...engines }),
-        };
-    }
-    catch (error) {
-        const explicitlyConfigured = config.defaults?.improveStrategy !== undefined || Object.keys(config.improve?.strategies ?? {}).length > 0;
-        return {
-            check: {
-                name: "active-improve-strategy",
-                kind: "deterministic",
-                status: explicitlyConfigured ? "warn" : "unknown",
-                confidence: "high",
-                message: `Active improve strategy "${strategyName}" is unavailable: ${error instanceof Error ? error.message : String(error)}`,
-                evidence: { strategy: strategyName, unavailableProcesses: [] },
-            },
-            processEngines: {},
-        };
-    }
-}
-/** Plain-`HealthCheckResult` wrapper around {@link probeActiveImproveStrategy} for existing callers/tests. */
-export function runActiveImproveStrategyProbe(deps = {}) {
-    return probeActiveImproveStrategy(deps).check;
-}
-/**
- * #950: the `engine-last-used` advisory. Pure projection of context computed
- * once in `health.ts` (`activeImproveStrategyEngines`, `engineLastUsed`,
- * `improveRunsInLookbackWindow`) — no IO here, mirrors `thinking-control`.
- *
- * `unknown` (not a noisy `warn`) both when no engine is bound to an enabled
- * process, AND when no improve run has been recorded (started) in the
- * lookback window at all — a fresh install has never been given the chance
- * to use its engines.
- */
-function projectEngineLastUsedCheck(processEngineMap, lastUsed, improveRunsInLookbackWindow, lookbackDays) {
-    const engineProcesses = new Map();
-    for (const [process, engine] of Object.entries(processEngineMap)) {
-        const processes = engineProcesses.get(engine) ?? [];
-        processes.push(process);
-        engineProcesses.set(engine, processes);
-    }
-    const engines = [...engineProcesses.keys()].sort();
-    if (engines.length === 0) {
-        return {
-            name: "engine-last-used",
-            kind: "deterministic",
-            status: "unknown",
-            confidence: "high",
-            message: "No engine is bound to an enabled improve process.",
-            evidence: { engines: [] },
-        };
-    }
-    if (improveRunsInLookbackWindow === 0) {
-        return {
-            name: "engine-last-used",
-            kind: "deterministic",
-            status: "unknown",
-            confidence: "high",
-            message: `No improve runs in the last ${lookbackDays} days.`,
-            evidence: {
-                engines: engines.map((engine) => ({ engine, processes: (engineProcesses.get(engine) ?? []).sort() })),
-            },
-        };
-    }
-    const entries = engines.map((engine) => ({
-        engine,
-        processes: (engineProcesses.get(engine) ?? []).sort(),
-        lastUsedAt: lastUsed.get(engine)?.lastUsedAt ?? null,
-    }));
-    const idle = entries.filter((entry) => entry.lastUsedAt === null);
-    const status = idle.length > 0 ? "warn" : "pass";
-    const message = idle.length > 0
-        ? idle
-            .map((entry) => {
-            const quoted = entry.processes.map((process) => `"${process}"`).join(", ");
-            const noun = entry.processes.length === 1 ? "process" : "processes";
-            return `Engine "${entry.engine}" is bound to ${noun} ${quoted} but has not been used in the last ${lookbackDays} days.`;
-        })
-            .join(" ")
-        : entries
-            .map((entry) => {
-            const process = lastUsed.get(entry.engine)?.process ?? entry.processes.join(", ");
-            return `Engine "${entry.engine}" last used by "${process}" at ${entry.lastUsedAt}.`;
-        })
-            .join(" ");
-    return {
-        name: "engine-last-used",
-        kind: "deterministic",
-        status,
-        confidence: "high",
-        message,
-        evidence: { engines: entries },
-    };
-}
-/**
- * Validate the immutable installed model map and optional user overlay.
- * Installed corruption is a package defect (fail); a bad optional user file
- * (including an `engine`-backed profile referencing a missing/broken engine,
- * once resolved against real `config.engines` — #946) is operator-fixable
- * configuration (warn); absence is the normal state.
- */
-export function runModelMapProbe(options = {}) {
-    let installedText;
-    try {
-        installedText = readInstalledModelMapText(options);
-        mergeModelMapLayers(parseModelMapLayer(installedText, "installed models.json"));
-    }
-    catch (error) {
-        return {
-            name: "model-map-files",
-            kind: "deterministic",
-            status: "fail",
-            confidence: "high",
-            message: `Installed models.json is invalid; this AKM installation cannot resolve model aliases: ${error instanceof Error ? error.message : String(error)}`,
-            evidence: { installedSource: "package asset" },
-        };
-    }
-    // Load config OUTSIDE the models.json try/catch below: a broken
-    // config.json must surface as a config problem reported by the config
-    // checks, never get misreported as a models.json warning carrying the
-    // config error's own text. When config fails to load, validate the model
-    // map shape-only (no `engine` resolution), matching pre-#946 behavior.
-    let engines;
-    try {
-        engines = (options.loadConfig?.() ?? loadConfig()).engines;
-    }
-    catch {
-        engines = undefined;
-    }
-    try {
-        const loaded = loadModelMap({ ...options, installedText, engines });
-        return {
-            name: "model-map-files",
-            kind: "deterministic",
-            status: "pass",
-            confidence: "high",
-            message: loaded.userStatus === "loaded"
-                ? `Installed defaults and user models.json at ${loaded.userPath} are valid.`
-                : "Installed model defaults are valid; no optional user models.json is present.",
-            evidence: {
-                installedSource: "package asset",
-                userPath: loaded.userPath,
-                userStatus: loaded.userStatus,
-                aliases: Object.keys(loaded.map.aliases).sort(),
-            },
-        };
-    }
-    catch (error) {
-        const hint = error instanceof ConfigError ? error.hint() : undefined;
-        return {
-            name: "model-map-files",
-            kind: "deterministic",
-            status: "warn",
-            confidence: "high",
-            message: `${error instanceof Error ? error.message : String(error)}${hint ? ` ${hint}` : ""}`,
-            evidence: {
-                installedSource: "package asset",
-                userPath: userModelMapPath(options.env),
-                userStatus: "invalid",
-            },
-        };
-    }
-}
-/**
- * Check model selections owned by configured engines against the common model
- * map. Unknown identifiers are deliberate exact-model pass-throughs; only an
- * alias known somewhere in the map but absent for the selected engine warns.
- */
-export function runSelectedModelAliasesProbe(deps = {}) {
-    const config = deps.loadConfig?.() ?? loadConfig();
-    const definitions = executionEngineDefinitionsFromConfig(config);
-    const selected = Object.entries(definitions)
-        .sort(([left], [right]) => left.localeCompare(right))
-        .flatMap(([engine, definition]) => {
-        const model = definition.defaults?.model;
-        const modelMapKey = definition.modelMapKey ?? definition.selection.platform ?? definition.selection.name;
-        return typeof model === "string" ? [{ engine, alias: model, modelMapKey }] : [];
-    });
-    if (selected.length === 0) {
-        return {
-            name: "selected-model-aliases",
-            kind: "deterministic",
-            status: "unknown",
-            confidence: "high",
-            message: "No configured engines select a model.",
-            evidence: { checked: [], missing: [] },
-        };
-    }
-    let modelMap;
-    try {
-        modelMap = (deps.loadModelMap ?? loadModelMap)({
-            env: deps.env,
-            installedText: deps.installedText,
-            engines: config.engines,
-        });
-    }
-    catch {
-        return {
-            name: "selected-model-aliases",
-            kind: "deterministic",
-            status: "unknown",
-            confidence: "high",
-            message: "Configured model selections could not be checked because the model map is invalid.",
-            evidence: { checked: [], missing: [] },
-        };
-    }
-    const outcomes = selected.map(({ engine, alias, modelMapKey }) => {
-        try {
-            const resolution = resolveModelMapAlias(alias, modelMapKey, modelMap.map);
-            if (resolution.interpretation === "alias") {
-                return { kind: "alias", evidence: { engine, alias, modelMapKey } };
-            }
-            return resolution.unmappedForEngine
-                ? { kind: "missing", evidence: { engine, alias, modelMapKey } }
-                : { kind: "exact" };
-        }
-        catch {
-            return { kind: "missing", evidence: { engine, alias, modelMapKey } };
-        }
-    });
-    const checked = outcomes.flatMap((outcome) => (outcome.kind === "exact" ? [] : [outcome.evidence]));
-    const missing = outcomes.flatMap((outcome) => (outcome.kind === "missing" ? [outcome.evidence] : []));
-    return {
-        name: "selected-model-aliases",
-        kind: "deterministic",
-        status: missing.length === 0 ? "pass" : "warn",
-        confidence: "high",
-        message: missing.length === 0
-            ? `All ${selected.length} configured model selections resolve for their selected engines.`
-            : `${missing.length} of ${selected.length} configured model selections ${missing.length === 1 ? "has" : "have"} no mapping for ${missing.length === 1 ? "its" : "their"} selected engine${missing.length === 1 ? "" : "s"}.`,
-        evidence: { checked, missing },
-    };
-}
 /**
  * `state-db-migrations` when the open itself failed: the migrations still
  * pending after a failed apply, from a read-only listing that never applies
@@ -1004,37 +205,14 @@ export const HEALTH_CHECKS = [
         },
     },
     {
-        name: "default-engine",
-        channel: "hard",
-        run: (ctx) => ctx.engineProbes.defaultEngine,
-    },
-    {
-        name: "model-map-files",
-        channel: "hard",
-        run: () => runModelMapProbe(),
-    },
-    {
-        name: "selected-model-aliases",
+        name: "connections-and-harnesses",
         channel: "hard",
-        run: () => runSelectedModelAliasesProbe(),
+        run: (ctx) => ctx.connectionsAndHarnesses,
     },
     {
-        name: "default-llm-engine",
+        name: "semantic-search",
         channel: "hard",
-        run: (ctx) => ctx.engineProbes.defaultLlmEngine,
-    },
-    {
-        name: "configured-engines",
-        channel: "hard",
-        run: (ctx) => ctx.engineProbes.configuredEngines,
-    },
-    {
-        name: "active-improve-strategy",
-        channel: "hard",
-        // #950: projects the context field instead of recomputing, so
-        // `engine-last-used` below can reuse the same process→engine map without
-        // a second `runActiveImproveStrategyProbe()` call.
-        run: (ctx) => ctx.activeImproveStrategy,
+        run: (ctx) => semanticSearchCheck(ctx.semanticSearch),
     },
     {
         // C2 (13-bus-factor): the cron task-failure rate was computed and rendered
@@ -1179,37 +357,20 @@ export const HEALTH_CHECKS = [
             };
         },
     },
-    {
-        // #949: advisory channel, but `kind: "deterministic"` (same as the
-        // pre-existing task-fail-rate advisory) — a warn here DOES flip
-        // AkmHealthResult.status to "warn" and akm health's exit code to
-        // EXIT_HEALTH_WARN, because the overall-status computation ORs
-        // deterministic warns across both hardChecks and advisories.
-        name: "thinking-control",
-        channel: "advisory",
-        run: (ctx) => projectThinkingControlCheck(ctx.thinkingOffEngines, ctx.llmUsage, ctx.since),
-    },
     {
         // #950: best-effort "installed vs latest release" advisory, gated behind
-        // the same --probe/--no-probe flag as engine reachability. Computed once
-        // in health.ts (network IO), projected here like engineProbes.
+        // the same --probe/--no-probe flag as endpoint reachability. Computed once
+        // in health.ts (network IO), projected here like connectionsAndHarnesses.
         name: "cli-version",
         channel: "advisory",
         run: (ctx) => ctx.versionDrift,
     },
-    {
-        // #950: advisory channel, `kind: "deterministic"` — same
-        // exit-code-gating rationale as thinking-control above.
-        name: "engine-last-used",
-        channel: "advisory",
-        run: (ctx) => projectEngineLastUsedCheck(ctx.activeImproveStrategyEngines, ctx.engineLastUsed, ctx.improveRunsInLookbackWindow, ENGINE_LAST_USED_LOOKBACK_DAYS),
-    },
     {
         // #953: registered last — order is load-bearing (see the HEALTH_CHECKS
         // doc comment above). Best-effort scheduler-binary-drift advisory, gated
-        // behind the same --probe/--no-probe flag as engine reachability and
+        // behind the same --probe/--no-probe flag as endpoint reachability and
         // cli-version. Computed once in health.ts (process-spawn IO), projected
-        // here like versionDrift/engineProbes.
+        // here like versionDrift/connectionsAndHarnesses.
         name: "scheduler-binary",
         channel: "advisory",
         run: (ctx) => ctx.schedulerBinaryDrift,