akm-cli 0.8.0-rc1 → 0.8.0

package/dist/integrations/session-logs/providers/opencode.js

@@ -1,52 +1,258 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-function getOpenCodeLogDir() {
+import { extractInlineRefMentions } from "../inline-refs";
+function getOpenCodeBaseDir() {
     if (process.platform === "darwin") {
         return path.join(os.homedir(), "Library", "Application Support", "opencode");
     }
     return path.join(os.homedir(), ".local", "share", "opencode");
 }
+/**
+ * Opencode storage layout (observed 2026-05):
+ *   <base>/storage/session/<projectId>/<sessionId>.json    — metadata
+ *   <base>/storage/message/<sessionId>/<messageId>.json    — one per message
+ *
+ * Older builds wrote logs directly into `<base>/log/` and `<base>/*.log`;
+ * those are still scanned by {@link OpenCodeProvider.readEvents} for
+ * backward compatibility with the existing failure-pattern aggregator.
+ */
 export class OpenCodeProvider {
     name = "opencode";
-    #logDir = getOpenCodeLogDir();
+    #baseDir = getOpenCodeBaseDir();
     isAvailable() {
-        return fs.existsSync(this.#logDir);
+        return fs.existsSync(this.#baseDir);
     }
     *readEvents(input) {
+        // Legacy behavior: stream raw log lines from the top-level dir and `log/`
+        // subdirectory. Kept to keep `getExecutionLogCandidates` working without
+        // a coordinated change to its caller. New code should use
+        // {@link listSessions} + {@link readSession} instead.
+        const candidates = [this.#baseDir, path.join(this.#baseDir, "log")];
+        for (const dir of candidates) {
+            if (!fs.existsSync(dir))
+                continue;
+            try {
+                for (const file of fs.readdirSync(dir)) {
+                    const full = path.join(dir, file);
+                    let stat;
+                    try {
+                        stat = fs.statSync(full);
+                    }
+                    catch {
+                        continue;
+                    }
+                    if (!stat.isFile())
+                        continue;
+                    if (stat.mtimeMs < input.sinceMs)
+                        continue;
+                    if (!file.endsWith(".json") && !file.endsWith(".jsonl") && !file.endsWith(".log"))
+                        continue;
+                    const content = fs.readFileSync(full, "utf8");
+                    const lines = content.includes("\n") ? content.split("\n") : [content];
+                    for (const line of lines) {
+                        try {
+                            const entry = JSON.parse(line);
+                            const text = entry?.content ?? entry?.message ?? entry?.text ?? "";
+                            if (typeof text !== "string" || text.length < 10)
+                                continue;
+                            yield {
+                                harness: this.name,
+                                text,
+                                ts: typeof entry?.timestamp === "number" ? entry.timestamp : stat.mtimeMs,
+                                sessionId: typeof entry?.sessionId === "string" ? entry.sessionId : undefined,
+                                role: typeof entry?.role === "string" ? entry.role : "unknown",
+                                filePath: full,
+                            };
+                        }
+                        catch {
+                            // skip malformed
+                        }
+                    }
+                }
+            }
+            catch {
+                // unreadable dir — skip
+            }
+        }
+    }
+    listSessions(input = {}) {
+        const base = input.location ?? this.#baseDir;
+        const sinceMs = input.sinceMs ?? 0;
+        const sessionRoot = path.join(base, "storage", "session");
+        if (!fs.existsSync(sessionRoot))
+            return [];
+        const summaries = [];
         try {
-            for (const file of fs.readdirSync(this.#logDir)) {
-                const full = path.join(this.#logDir, file);
-                const stat = fs.statSync(full);
-                if (stat.mtimeMs < input.sinceMs)
+            for (const projectId of fs.readdirSync(sessionRoot)) {
+                const projectDir = path.join(sessionRoot, projectId);
+                let pstat;
+                try {
+                    pstat = fs.statSync(projectDir);
+                }
+                catch {
                     continue;
-                if (!file.endsWith(".json") && !file.endsWith(".jsonl") && !file.endsWith(".log"))
+                }
+                if (!pstat.isDirectory())
                     continue;
-                const content = fs.readFileSync(full, "utf8");
-                const lines = content.includes("\n") ? content.split("\n") : [content];
-                for (const line of lines) {
+                for (const file of fs.readdirSync(projectDir)) {
+                    if (!file.endsWith(".json"))
+                        continue;
+                    const filePath = path.join(projectDir, file);
+                    let stat;
                     try {
-                        const entry = JSON.parse(line);
-                        const text = entry?.content ?? entry?.message ?? entry?.text ?? "";
-                        if (typeof text !== "string" || text.length < 10)
-                            continue;
-                        yield {
-                            harness: this.name,
-                            text,
-                            ts: typeof entry?.timestamp === "number" ? entry.timestamp : stat.mtimeMs,
-                            sessionId: typeof entry?.sessionId === "string" ? entry.sessionId : undefined,
-                            role: typeof entry?.role === "string" ? entry.role : "unknown",
-                            filePath: full,
-                        };
+                        stat = fs.statSync(filePath);
                     }
                     catch {
-                        // skip malformed
+                        continue;
+                    }
+                    if (stat.mtimeMs < sinceMs)
+                        continue;
+                    let meta;
+                    try {
+                        meta = JSON.parse(fs.readFileSync(filePath, "utf8"));
                     }
+                    catch {
+                        continue;
+                    }
+                    const sessionId = typeof meta?.id === "string" ? meta.id : path.basename(file, ".json");
+                    const time = meta?.time ?? undefined;
+                    const startedAt = typeof time?.created === "number" ? time.created : stat.ctimeMs;
+                    const endedAt = typeof time?.updated === "number" ? time.updated : stat.mtimeMs;
+                    const title = typeof meta?.title === "string" ? meta.title : undefined;
+                    const projectHint = typeof meta?.directory === "string" ? meta.directory : projectId;
+                    summaries.push({
+                        harness: this.name,
+                        sessionId,
+                        filePath,
+                        startedAt,
+                        endedAt,
+                        projectHint,
+                        ...(title ? { title } : {}),
+                    });
                 }
             }
         }
         catch {
-            return;
+            // unreadable session root — return what we have
+        }
+        return summaries.sort((a, b) => (b.endedAt ?? 0) - (a.endedAt ?? 0));
+    }
+    readSession(ref) {
+        let meta = {};
+        try {
+            meta = JSON.parse(fs.readFileSync(ref.filePath, "utf8"));
+        }
+        catch {
+            // metadata missing — proceed with empty defaults
+        }
+        const time = meta.time ?? undefined;
+        const startedAt = typeof time?.created === "number" ? time.created : undefined;
+        const endedAt = typeof time?.updated === "number" ? time.updated : undefined;
+        const title = typeof meta.title === "string" ? meta.title : undefined;
+        const projectHint = typeof meta.directory === "string" ? meta.directory : undefined;
+        const events = [];
+        const inlineRefs = [];
+        // Resolve message directory: <baseDir>/storage/message/<sessionId>/
+        const inferredBase = this.#inferBaseFromSessionPath(ref.filePath) ?? this.#baseDir;
+        const msgDir = path.join(inferredBase, "storage", "message", ref.sessionId);
+        if (fs.existsSync(msgDir)) {
+            try {
+                const files = fs.readdirSync(msgDir).filter((f) => f.endsWith(".json"));
+                for (const file of files) {
+                    const full = path.join(msgDir, file);
+                    let msg;
+                    try {
+                        msg = JSON.parse(fs.readFileSync(full, "utf8"));
+                    }
+                    catch {
+                        continue;
+                    }
+                    if (!msg)
+                        continue;
+                    const evt = this.#messageToEvent(msg, ref.sessionId, full);
+                    if (evt) {
+                        events.push(evt);
+                        inlineRefs.push(...extractInlineRefMentions(evt.text, evt.ts));
+                    }
+                }
+            }
+            catch {
+                // unreadable msg dir — skip
+            }
+        }
+        events.sort((a, b) => (a.ts ?? 0) - (b.ts ?? 0));
+        return {
+            ref: {
+                harness: this.name,
+                sessionId: ref.sessionId,
+                filePath: ref.filePath,
+                ...(startedAt !== undefined ? { startedAt } : {}),
+                ...(endedAt !== undefined ? { endedAt } : {}),
+                ...(projectHint ? { projectHint } : {}),
+                ...(title ? { title } : {}),
+            },
+            events,
+            inlineRefs,
+        };
+    }
+    /**
+     * Derive opencode base dir from a session metadata file path so a caller
+     * passing a custom `--location` can still find the message dir.
+     * Layout: `<base>/storage/session/<projectId>/<id>.json` → base.
+     */
+    #inferBaseFromSessionPath(filePath) {
+        // Walk up: <id>.json → <projectId> → session → storage → <base>
+        const dir = path.dirname(filePath);
+        const parts = dir.split(path.sep);
+        if (parts.length < 3)
+            return undefined;
+        const last = parts[parts.length - 1];
+        const sndLast = parts[parts.length - 2];
+        const thirdLast = parts[parts.length - 3];
+        if (sndLast !== "session" || thirdLast !== "storage" || !last)
+            return undefined;
+        return parts.slice(0, parts.length - 3).join(path.sep);
+    }
+    #messageToEvent(msg, sessionId, filePath) {
+        const time = msg.time ?? undefined;
+        const ts = typeof time?.created === "number" ? time.created : typeof msg.timestamp === "number" ? msg.timestamp : 0;
+        const role = typeof msg.role === "string" ? msg.role : "unknown";
+        // Opencode message bodies live in summary.title / summary.diffs[].before/after /
+        // parts (referenced from storage/part/<msg-id>/). For listing+extraction
+        // purposes the summary block is sufficient — it's what the platform itself
+        // surfaces as the message preview.
+        const summary = msg.summary;
+        const parts = [];
+        if (typeof summary?.title === "string")
+            parts.push(summary.title);
+        if (Array.isArray(summary?.parts)) {
+            for (const p of summary.parts) {
+                if (typeof p === "string")
+                    parts.push(p);
+                else if (p && typeof p === "object") {
+                    const text = p.text;
+                    if (typeof text === "string")
+                        parts.push(text);
+                }
+            }
         }
+        // content field for some opencode versions
+        if (typeof msg.content === "string")
+            parts.push(msg.content);
+        const text = parts.join("\n").trim();
+        if (text.length < 1)
+            return undefined;
+        return {
+            harness: this.name,
+            text,
+            ts: ts || undefined,
+            sessionId,
+            role,
+            filePath,
+        };
     }
 }

package/dist/integrations/session-logs/types.js

@@ -1 +1,4 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
 export {};

package/dist/llm/call-ai.js

@@ -1,37 +1,24 @@
-/**
- * Unified AI call adapter: prefers `config.agent` (agent CLI shell-out),
- * falls back to `config.llm` (HTTP chat-completions).
- *
- * NOT for use by background indexer passes — those call `chatCompletion`
- * directly to avoid the agent-CLI overhead and to stay on the HTTP path that
- * the indexer was designed around.
- */
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+import { getDefaultLlmConfig } from "../core/config";
 import { warn } from "../core/warn";
 import { resolveAgentProfile, runAgent } from "../integrations/agent";
 import { chatCompletion } from "./client";
 /**
- * Unified AI call: prefers `config.agent` (agent CLI), falls back to
- * `config.llm` (HTTP). When neither is configured, returns a structured
+ * Unified AI call: prefers the default agent profile, falls back to the
+ * default LLM profile. When neither is configured, returns a structured
  * error pointing the user at `akm setup`.
- *
- * NOT for use by background indexer passes — those call `chatCompletion`
- * directly.
  */
 export async function callAi(config, prompt, opts = {}) {
-    if (config.agent) {
+    const defaultAgentName = config.defaults?.agent;
+    if (defaultAgentName) {
         try {
-            const defaultName = config.agent.default;
-            if (!defaultName) {
-                return {
-                    ok: false,
-                    error: "No default agent profile configured. Set `agent.default` in config.json or run `akm setup`.",
-                };
-            }
-            const profile = resolveAgentProfile(defaultName, config.agent.profiles?.[defaultName]);
+            const profile = resolveAgentProfile(defaultAgentName, config.profiles?.agent?.[defaultAgentName]);
             if (!profile) {
                 return {
                     ok: false,
-                    error: `Agent profile "${defaultName}" is not built-in and has no \`bin\` override.`,
+                    error: `Agent profile "${defaultAgentName}" is not built-in and has no \`bin\` override.`,
                 };
             }
             const result = await runAgent(profile, prompt, {
@@ -47,7 +34,8 @@ export async function callAi(config, prompt, opts = {}) {
             return { ok: false, error: String(e) };
         }
     }
-    if (config.llm) {
+    const llmConfig = getDefaultLlmConfig(config);
+    if (llmConfig) {
         if (opts.draftFilePath) {
             warn("[akm] No agent CLI configured — falling back to LLM API. " +
                 "File-write contract unavailable; expecting JSON in stdout. " +
@@ -58,7 +46,7 @@ export async function callAi(config, prompt, opts = {}) {
             messages.push({ role: "system", content: opts.systemPrompt });
         messages.push({ role: "user", content: prompt });
         try {
-            const content = await chatCompletion(config.llm, messages, {
+            const content = await chatCompletion(llmConfig, messages, {
                 ...(opts.timeoutMs !== undefined ? { timeoutMs: opts.timeoutMs } : {}),
             });
             return { ok: true, content, path: "llm-http" };
@@ -69,6 +57,6 @@ export async function callAi(config, prompt, opts = {}) {
     }
     return {
         ok: false,
-        error: "No AI connection configured. Run `akm setup` or set `agent` or `llm` in your config.",
+        error: "No AI connection configured. Run `akm setup` or set `defaults.agent`/`defaults.llm`.",
     };
 }

package/dist/llm/client.js

@@ -1,3 +1,6 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
 /**
  * Low-level OpenAI-compatible chat completions client and capability probing.
  *
@@ -8,6 +11,7 @@
  * `llm.ts` re-exports everything from this module for backward compatibility.
  */
 import { fetchWithTimeout } from "../core/common";
+import { resolveSecret } from "../core/config";
 import { escapeJsonStringControls, parseJsonResponse, stripCodeFences, stripThinkBlocks } from "../core/parse";
 // Re-export shared parse utilities so existing importers of `client.ts` continue
 // to resolve `parseJsonResponse` and `parseEmbeddedJsonResponse` from this module.
@@ -55,13 +59,17 @@ export class LlmCallError extends Error {
 export async function chatCompletion(config, messages, options) {
     const timeoutMs = options?.timeoutMs ?? config.timeoutMs ?? 120_000;
     const headers = { "Content-Type": "application/json" };
-    if (config.apiKey) {
-        headers.Authorization = `Bearer ${config.apiKey}`;
+    const resolvedKey = resolveSecret(config.apiKey);
+    if (resolvedKey) {
+        headers.Authorization = `Bearer ${resolvedKey}`;
     }
     // Only include max_tokens when explicitly set. The model/API knows its own
     // limits; a hardcoded default creates silent truncation failures when the
     // guess is wrong. Users who need a cap can set llm.maxTokens in config.
     const resolvedMaxTokens = options?.maxTokens ?? config.maxTokens;
+    const responseFormat = options?.responseSchema && config.supportsJsonSchema
+        ? { response_format: { type: "json_schema", json_schema: { schema: options.responseSchema, strict: true } } }
+        : {};
     let response;
     try {
         response = await fetchWithTimeout(config.endpoint, {
@@ -72,6 +80,12 @@ export async function chatCompletion(config, messages, options) {
                 messages,
                 temperature: options?.temperature ?? config.temperature ?? 0.3,
                 ...(resolvedMaxTokens !== undefined ? { max_tokens: resolvedMaxTokens } : {}),
+                ...responseFormat,
+                ...(options?.enableThinking !== undefined
+                    ? { enable_thinking: options.enableThinking }
+                    : config.enableThinking !== undefined
+                        ? { enable_thinking: config.enableThinking }
+                        : {}),
                 ...config.extraParams,
             }),
         }, timeoutMs, options?.signal);

package/dist/llm/embedder.js

@@ -1,22 +1,6 @@
-/**
- * Backward-compatible facade for the embedder module.
- *
- * The implementation has been split into:
- * - `./embedders/types`  — `EmbeddingVector`, `Embedder`, `EmbeddingCheckResult`
- * - `./embedders/local`  — `LocalEmbedder`, `DEFAULT_LOCAL_MODEL`,
- *                          `isTransformersAvailable`
- * - `./embedders/remote` — `RemoteEmbedder`, `hasRemoteEndpoint`
- * - `./embedders/cache`  — LRU `embedCache`, `clearEmbeddingCache`,
- *                          `embedCacheKey`
- *
- * This module wires them together: it picks the right implementation from the
- * (optional) embedding config, applies the cache layer, and re-exports the
- * existing public API so call sites (`db-search.ts`, `indexer.ts`, `db.ts`,
- * `setup.ts`, `semantic-status.ts`, tests) keep working unmodified.
- *
- * Tests can construct fresh `LocalEmbedder` / `RemoteEmbedder` instances
- * directly from their submodules to avoid module-level state pollution.
- */
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import { embedCacheKey, getCachedEmbedding, setCachedEmbedding } from "./embedders/cache";
 import { isTransformersAvailable, LocalEmbedder } from "./embedders/local";
 import { hasRemoteEndpoint, RemoteEmbedder } from "./embedders/remote";
@@ -24,18 +8,25 @@ import { hasRemoteEndpoint, RemoteEmbedder } from "./embedders/remote";
 export { clearEmbeddingCache } from "./embedders/cache";
 export { DEFAULT_LOCAL_MODEL, isTransformersAvailable } from "./embedders/local";
 // ── Singleton local embedder ────────────────────────────────────────────────
-// `localEmbedder` is an intentional module-level singleton. The underlying
-// @huggingface/transformers pipeline is expensive to initialise (model download
-// + WASM compilation) and is safe to share across calls because it is
-// stateless once created. Storing it here avoids re-initialising on every
-// embed() call.
-const localEmbedder = new LocalEmbedder();
+// `_localEmbedder` is an intentional module-level singleton but constructed
+// lazily on first use. The underlying @huggingface/transformers pipeline is
+// expensive to initialise (model download + WASM compilation) and is safe to
+// share across calls because it is stateless once created. Deferring
+// construction to first call keeps the module side-effect-free at import time,
+// which matters for the test suite (single Bun process, ~120 test files).
+let _localEmbedder;
+function getLocalEmbedder() {
+    if (!_localEmbedder) {
+        _localEmbedder = new LocalEmbedder();
+    }
+    return _localEmbedder;
+}
 /**
  * Reset the cached local embedder pipeline. Used by tests that want a fresh
  * pipeline construction (e.g. to assert the dtype-fallback retry logic).
  */
 export function resetLocalEmbedder() {
-    localEmbedder.reset();
+    getLocalEmbedder().reset();
 }
 // ── Public API ──────────────────────────────────────────────────────────────
 /**
@@ -54,7 +45,7 @@ export async function embed(text, embeddingConfig, signal) {
         return cached;
     const result = embeddingConfig && hasRemoteEndpoint(embeddingConfig)
         ? await new RemoteEmbedder(embeddingConfig).embed(text, signal)
-        : await localEmbedder.embed(text, signal);
+        : await getLocalEmbedder().embed(text, signal);
     setCachedEmbedding(key, result);
     return result;
 }
@@ -76,7 +67,7 @@ export async function embedBatch(texts, embeddingConfig, signal) {
         if (signal?.aborted) {
             throw signal.reason instanceof Error ? signal.reason : new Error("embedding interrupted");
         }
-        results.push(await localEmbedder.embedWithModel(text, localModel));
+        results.push(await getLocalEmbedder().embedWithModel(text, localModel));
     }
     return results;
 }
@@ -113,7 +104,7 @@ export async function checkEmbeddingAvailability(embeddingConfig) {
         };
     }
     try {
-        await localEmbedder.getPipeline(embeddingConfig?.localModel);
+        await getLocalEmbedder().getPipeline(embeddingConfig?.localModel);
         return { available: true };
     }
     catch (err) {

package/dist/llm/embedders/cache.js

@@ -1,10 +1,6 @@
-/**
- * LRU embedding cache shared by the embedder facade.
- *
- * Caches query embeddings to avoid redundant computation for repeated
- * queries. Uses a simple Map with LRU eviction (delete + re-insert to move
- * an entry to the most-recently-used end).
- */
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
 const EMBED_CACHE_MAX = 100;
 const embedCache = new Map();
 /**

package/dist/llm/embedders/local.js

@@ -1,3 +1,6 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
 /**
  * Local @huggingface/transformers embedder.
  *
@@ -25,6 +28,31 @@ const LOCAL_EMBEDDER_FALLBACK_DTYPE = "auto";
 function resolveLocalModelName(overrideModel) {
     return overrideModel || DEFAULT_LOCAL_MODEL;
 }
+/**
+ * Detect whether the current process is running from a Bun-compiled binary
+ * (i.e. `bun build --compile` produced a single executable). Bun marks the
+ * compiled binary with a synthesized `process.execPath` that ends in the
+ * binary name rather than `bun`, AND sets a flag we can probe.
+ *
+ * Used to gate the "install @huggingface/transformers" hint — that advice
+ * is impossible to follow from a single-binary install, so we replace it
+ * with the only working remediation (switch to npm/Bun install, or turn
+ * semantic search off). See #482.
+ */
+function isCompiledBinary() {
+    try {
+        const flag = Bun.embeddedFiles;
+        if (flag !== undefined)
+            return true;
+    }
+    catch {
+        // Bun not available (under Node tests, for example) — treat as not-binary.
+    }
+    const exec = (process.execPath || "").toLowerCase();
+    if (exec.endsWith("/akm") || exec.endsWith("\\akm.exe"))
+        return true;
+    return false;
+}
 export class LocalEmbedder {
     defaultModel;
     /**
@@ -93,7 +121,20 @@ export class LocalEmbedder {
                 catch (importError) {
                     const msg = importError instanceof Error ? importError.message : String(importError);
                     if (/Cannot find module|MODULE_NOT_FOUND|Cannot resolve/i.test(msg)) {
-                        throw new Error("Semantic search requires @huggingface/transformers. Install it with: bun add @huggingface/transformers");
+                        // #482: the prebuilt binary build is invoked with
+                        // `bun install --omit optional` (release.yml), so binary users
+                        // can NEVER load @huggingface/transformers. Telling them to
+                        // `bun add` it is a dead-end — there is no install target.
+                        // Detect the binary execution path and give the only working
+                        // remediation: switch to the npm/Bun install of akm-cli, or
+                        // turn off semantic search.
+                        const isBinary = isCompiledBinary();
+                        const hint = isBinary
+                            ? "You are running the prebuilt akm binary, which cannot load optional native dependencies. " +
+                                "To enable semantic search, install akm-cli via Bun: `curl -fsSL https://bun.sh/install | bash && bun install -g akm-cli`. " +
+                                "To keep using the binary, set `semanticSearchMode: off` in your config and use keyword-only FTS."
+                            : "Install it with: `bun add @huggingface/transformers` (or `npm install @huggingface/transformers`).";
+                        throw new Error(`Semantic search requires @huggingface/transformers. ${hint}`);
                     }
                     throw new Error(`Failed to load embedding runtime: ${msg}. Check platform compatibility.`);
                 }

package/dist/llm/embedders/remote.js

@@ -1,3 +1,6 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
 /**
  * OpenAI-compatible remote embedder.
  *
@@ -5,6 +8,7 @@
  * vectors so the scoring pipeline's L2-to-cosine conversion is correct.
  */
 import { fetchWithTimeout, isHttpUrl } from "../../core/common";
+import { resolveSecret } from "../../core/config";
 const DEFAULT_REMOTE_BATCH_SIZE = 100;
 /** Cheap token estimator: 4 chars ≈ 1 token. Used in verbose logging and error messages. */
 export function estimateTokenCount(text) {
@@ -12,14 +16,21 @@ export function estimateTokenCount(text) {
 }
 export class RemoteEmbedder {
     config;
+    endpoint;
+    model;
     constructor(config) {
         this.config = config;
+        if (!config.endpoint || !config.model) {
+            throw new Error("RemoteEmbedder requires both endpoint and model on the embedding config.");
+        }
+        this.endpoint = config.endpoint;
+        this.model = config.model;
     }
     async embed(text, signal) {
         const headers = this.buildHeaders();
         const body = {
             input: text,
-            model: this.config.model,
+            model: this.model,
         };
         if (this.config.dimension) {
             body.dimensions = this.config.dimension;
@@ -28,7 +39,7 @@ export class RemoteEmbedder {
         if (ollamaOpts) {
             body.options = ollamaOpts;
         }
-        const response = await fetchWithTimeout(normalizeEmbeddingEndpoint(this.config.endpoint), {
+        const response = await fetchWithTimeout(normalizeEmbeddingEndpoint(this.endpoint), {
             method: "POST",
             headers,
             body: JSON.stringify(body),
@@ -40,7 +51,7 @@ export class RemoteEmbedder {
         }
         const json = (await response.json());
         if (!json.data?.[0]?.embedding) {
-            throw new Error(`Unexpected embedding response format: missing data[0].embedding.${embeddingEndpointPathHint(this.config.endpoint)}`);
+            throw new Error(`Unexpected embedding response format: missing data[0].embedding.${embeddingEndpointPathHint(this.endpoint)}`);
         }
         return l2Normalize(json.data[0].embedding);
     }
@@ -55,7 +66,7 @@ export class RemoteEmbedder {
             const batch = texts.slice(i, i + batchSize);
             const body = {
                 input: batch,
-                model: this.config.model,
+                model: this.model,
             };
             if (this.config.dimension) {
                 body.dimensions = this.config.dimension;
@@ -63,7 +74,7 @@ export class RemoteEmbedder {
             if (ollamaOpts) {
                 body.options = ollamaOpts;
             }
-            const response = await fetchWithTimeout(normalizeEmbeddingEndpoint(this.config.endpoint), {
+            const response = await fetchWithTimeout(normalizeEmbeddingEndpoint(this.endpoint), {
                 method: "POST",
                 headers,
                 body: JSON.stringify(body),
@@ -75,7 +86,7 @@ export class RemoteEmbedder {
             }
             const json = (await response.json());
             if (!json.data || json.data.length !== batch.length) {
-                throw new Error(`Unexpected embedding batch response: expected ${batch.length} embeddings, got ${json.data?.length ?? 0}.${embeddingEndpointPathHint(this.config.endpoint)}`);
+                throw new Error(`Unexpected embedding batch response: expected ${batch.length} embeddings, got ${json.data?.length ?? 0}.${embeddingEndpointPathHint(this.endpoint)}`);
             }
             // Sort by index to guarantee correct order (OpenAI API doesn't guarantee order)
             const sorted = [...json.data].sort((a, b) => a.index - b.index);
@@ -90,8 +101,9 @@ export class RemoteEmbedder {
     }
     buildHeaders() {
         const headers = { "Content-Type": "application/json" };
-        if (this.config.apiKey) {
-            headers.Authorization = `Bearer ${this.config.apiKey}`;
+        const resolvedKey = resolveSecret(this.config.apiKey);
+        if (resolvedKey) {
+            headers.Authorization = `Bearer ${resolvedKey}`;
         }
         return headers;
     }