akm-cli 0.9.0-beta.50 → 0.9.0-beta.52

package/dist/core/asset/asset-registry.js

@@ -41,7 +41,7 @@ export const ACTION_BUILDERS = {
     lesson: (ref) => `akm show ${ref} -> read the lesson and apply when_to_use`,
     memory: (ref) => `akm show ${ref} -> recall context`,
     workflow: (ref) => buildWorkflowAction(ref),
-    env: (ref) => `akm show ${ref} -> inspect key names; akm env run ${ref} -- <command> -> run with the whole .env injected (the agent-safe path — values never reach stdout). akm env export ${ref} --out <file> writes a sourceable script (values to a file, not stdout).`,
+    env: (ref) => `akm show ${ref} -> inspect key names; akm env run ${ref} -- <command> -> run with the whole .env injected (prefer --clean to minimize inherited parent env; child stdout is not redacted). akm env export ${ref} --out <file> writes a sourceable script (values to a file, not stdout).`,
     secret: (ref) => `akm show ${ref} -> name only (value never shown); akm secret path ${ref} -> file path; akm secret run ${ref} <VAR> -- <command> -> run with value injected into $VAR`,
     wiki: (ref) => `akm show ${ref} -> read the wiki page`,
     task: (ref) => `akm tasks show ${ref.replace(/^task:/, "")} -> inspect; akm tasks run <id> -> run now; akm tasks remove <id> -> unschedule`,

package/dist/core/asset/asset-spec.js

@@ -3,8 +3,10 @@
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import path from "node:path";
 import { buildWorkflowAction } from "../../output/renderers.js";
-import { toPosix } from "../common.js";
 import { registerActionBuilder, registerTypeRenderer } from "./asset-registry.js";
+function toPosix(input) {
+    return input.replace(/\\/g, "/");
+}
 const buildTaskAction = (ref) => `akm tasks show ${ref.replace(/^task:/, "")} -> inspect; akm tasks run <id> -> run now; akm tasks remove <id> -> unschedule`;
 const markdownSpec = {
     isRelevantFile: (fileName) => path.extname(fileName).toLowerCase() === ".md",
@@ -89,7 +91,7 @@ const ASSET_SPECS_INTERNAL = {
             return path.join(typeRoot, name.endsWith(".env") ? name : `${name}.env`);
         },
         rendererName: "env-file",
-        actionBuilder: (ref) => `akm show ${ref} -> inspect key names; akm env run ${ref} -- <command> -> run with the whole .env injected (values never reach stdout); akm env export ${ref} --out <file> -> write a sourceable script to a file`,
+        actionBuilder: (ref) => `akm show ${ref} -> inspect key names; akm env run ${ref} -- <command> -> run with the whole .env injected (prefer --clean to minimize inherited parent env; child stdout is not redacted); akm env export ${ref} --out <file> -> write a sourceable script to a file`,
     },
     // Secrets — a single sensitive value used on its own for authentication (a
     // PEM key, API token, TLS cert). Unlike `env` (a group of related .env

package/dist/core/config/config-migration.js

@@ -169,7 +169,8 @@ function migrateProcessEntryToImprove(result, processName, legacy) {
  * (canonical string sentinel for this release) or when `configVersion` is a
  * number ≥ 2 AND the config carries no recognized legacy keys.
  */
-export function migrateConfigShape(raw) {
+export function migrateConfigShape(raw, opts) {
+    const emitWarn = opts?.warn ?? warn;
     const hasLegacyKeys = Object.hasOwn(raw, "features") ||
         (isObj(raw.llm) && (Object.hasOwn(raw.llm, "endpoint") || Object.hasOwn(raw.llm, "features"))) ||
         isObj(raw.agent) ||
@@ -199,11 +200,11 @@ export function migrateConfigShape(raw) {
     if (Array.isArray(result.stashes)) {
         if (!Array.isArray(result.sources)) {
             result.sources = result.stashes;
-            console.warn("[akm config-migrate] Legacy `stashes[]` config key renamed to `sources[]`. " +
+            emitWarn("[akm config-migrate] Legacy `stashes[]` config key renamed to `sources[]`. " +
                 "Re-save your config to remove the deprecation notice.");
         }
         else {
-            console.warn("[akm config-migrate] Both `stashes[]` and `sources[]` present; `stashes[]` dropped (sources takes precedence).");
+            emitWarn("[akm config-migrate] Both `stashes[]` and `sources[]` present; `stashes[]` dropped (sources takes precedence).");
         }
         delete result.stashes;
         changed = true;
@@ -218,7 +219,7 @@ export function migrateConfigShape(raw) {
         for (const entry of sources) {
             if (isObj(entry) && entry.type === "openviking") {
                 const name = typeof entry.name === "string" && entry.name ? entry.name : "unnamed";
-                console.warn(`[akm config-migrate] Source "${name}" (type: openviking) is no longer supported. ` +
+                emitWarn(`[akm config-migrate] Source "${name}" (type: openviking) is no longer supported. ` +
                     "Remove it from your config, or replace with a `website`/`git` source. " +
                     "Entry dropped from sources[].");
                 renamed = true;
@@ -349,11 +350,11 @@ export function migrateConfigShape(raw) {
                 const camelKey = toCamelCase(legacyKey);
                 if (typeof legacyVal === "boolean" || isObj(legacyVal)) {
                     migrateProcessEntryToImprove(result, camelKey, legacyVal);
-                    warn(`[akm config-migrate] Unknown features.improve.${legacyKey} migrated to ` +
+                    emitWarn(`[akm config-migrate] Unknown features.improve.${legacyKey} migrated to ` +
                         `profiles.improve.default.processes.${camelKey}. Please verify the new location.`);
                 }
                 else {
-                    warn(`[akm config-migrate] features.improve.${legacyKey} has an unrecognized value type ` +
+                    emitWarn(`[akm config-migrate] features.improve.${legacyKey} has an unrecognized value type ` +
                         `(${typeof legacyVal}); dropping. Please re-add it under profiles.improve.* manually.`);
                 }
             }
@@ -404,11 +405,11 @@ export function migrateConfigShape(raw) {
                 const camelKey = toCamelCase(legacyKey);
                 const ok = migrateGenericGateToSection(result, "index", camelKey, legacyVal);
                 if (ok) {
-                    warn(`[akm config-migrate] Unknown features.index.${legacyKey} migrated to ` +
+                    emitWarn(`[akm config-migrate] Unknown features.index.${legacyKey} migrated to ` +
                         `index.${camelKey}. Please verify the new location is correct.`);
                 }
                 else {
-                    warn(`[akm config-migrate] features.index.${legacyKey} has an unrecognized value shape; ` +
+                    emitWarn(`[akm config-migrate] features.index.${legacyKey} has an unrecognized value shape; ` +
                         `dropping. Please re-add it under index.${camelKey} manually if needed.`);
                 }
             }
@@ -434,11 +435,11 @@ export function migrateConfigShape(raw) {
                 const camelKey = toCamelCase(legacyKey);
                 const ok = migrateGenericGateToSection(result, "search", camelKey, legacyVal);
                 if (ok) {
-                    warn(`[akm config-migrate] Unknown features.search.${legacyKey} migrated to ` +
+                    emitWarn(`[akm config-migrate] Unknown features.search.${legacyKey} migrated to ` +
                         `search.${camelKey}. Please verify the new location is correct.`);
                 }
                 else {
-                    warn(`[akm config-migrate] features.search.${legacyKey} has an unrecognized value shape; ` +
+                    emitWarn(`[akm config-migrate] features.search.${legacyKey} has an unrecognized value shape; ` +
                         `dropping. Please re-add it under search.${camelKey} manually if needed.`);
                 }
             }
@@ -555,7 +556,7 @@ export function migrateConfigShape(raw) {
                 changed = true;
             }
             if (improveObj.preset !== undefined) {
-                console.warn("[akm config-migrate] defaults.improve.preset is no longer supported. " +
+                emitWarn("[akm config-migrate] defaults.improve.preset is no longer supported. " +
                     "Use `--profile <name>` (built-ins: default, quick, thorough, memory-focus) instead.");
             }
             delete defaultsRaw.improve;

package/dist/indexer/passes/memory-inference.js

@@ -72,6 +72,7 @@ const FM_CAPTURE_MODE = "captureMode";
  */
 export async function runMemoryInferencePass(ctx) {
     const { config, sources, signal, db, reEnrich, onProgress, options = {} } = ctx;
+    const compressMemoryToDerivedMemory = options.compressMemoryToDerivedMemory ?? memoryInfer.compressMemoryToDerivedMemory;
     const result = {
         considered: 0,
         cacheHits: 0,
@@ -172,14 +173,14 @@ export async function runMemoryInferencePass(ctx) {
             retryAttempts += 1;
         };
         const derived = db
-            ? await withLlmCache(db, record.filePath, record.body, reEnrich ?? false, () => memoryInfer.compressMemoryToDerivedMemory(llmConfig, record.body, signal, config, (evt) => {
+            ? await withLlmCache(db, record.filePath, record.body, reEnrich ?? false, () => compressMemoryToDerivedMemory(llmConfig, record.body, signal, config, (evt) => {
                 warn(`[akm] LLM fallback for ${evt.feature}: ${evt.reason}`);
             }, inferTelemetry, onRetryAttempt), validate, undefined, "", {
                 onCacheHit: () => {
                     fromCache = true;
                 },
             })
-            : await memoryInfer.compressMemoryToDerivedMemory(llmConfig, record.body, signal, config, (evt) => {
+            : await compressMemoryToDerivedMemory(llmConfig, record.body, signal, config, (evt) => {
                 warn(`[akm] LLM fallback for ${evt.feature}: ${evt.reason}`);
             }, inferTelemetry, onRetryAttempt);
         if (!derived) {

package/dist/indexer/search/db-search.js

@@ -66,6 +66,8 @@ export async function searchLocal(input) {
     const beliefFilter = input.beliefFilter ?? "all";
     const restrictToSources = input.restrictToSources === true;
     const includeExcludedTypes = input.includeExcludedTypes === true;
+    const disableProjectContext = input.disableProjectContext === true;
+    const disableScopedUtility = input.disableScopedUtility === true;
     const rendererRegistry = input.rendererRegistry ?? defaultRendererRegistry;
     const allSourceDirs = sources.map((s) => s.path);
     const rawStatus = readSemanticStatus();
@@ -115,7 +117,7 @@ export async function searchLocal(input) {
                 mode: "keyword",
             };
         }
-        const { hits, embedMs, rankMs } = await searchDatabase(db, query, searchType, limit, stashDir, allSourceDirs, config, sources, rendererRegistry, filters, includeProposed, beliefFilter, restrictToSources, includeExcludedTypes);
+        const { hits, embedMs, rankMs } = await searchDatabase(db, query, searchType, limit, stashDir, allSourceDirs, config, sources, rendererRegistry, filters, includeProposed, beliefFilter, restrictToSources, includeExcludedTypes, disableProjectContext, disableScopedUtility);
         return {
             hits,
             tip: hits.length === 0
@@ -132,7 +134,7 @@ export async function searchLocal(input) {
     }
 }
 // ── Database search ─────────────────────────────────────────────────────────
-async function searchDatabase(db, query, searchType, limit, stashDir, allSourceDirs, config, sources, rendererRegistry = defaultRendererRegistry, filters, includeProposed = false, beliefFilter = "all", restrictToSources = false, includeExcludedTypes = false) {
+async function searchDatabase(db, query, searchType, limit, stashDir, allSourceDirs, config, sources, rendererRegistry = defaultRendererRegistry, filters, includeProposed = false, beliefFilter = "all", restrictToSources = false, includeExcludedTypes = false, disableProjectContext = false, disableScopedUtility = false) {
     const hasSearchableTokens = query.length > 0 && sanitizeFtsQuery(query).length > 0;
     // #627 — resolve the default type-exclusion policy. It applies ONLY on the
     // untyped ('any') path and only when the caller did not opt back in via
@@ -247,7 +249,7 @@ async function searchDatabase(db, query, searchType, limit, stashDir, allSourceD
     // Resolve project-context tokens from the current working directory once
     // per search invocation. Returns null when running from home dir / /tmp,
     // or when the caller has set AKM_DISABLE_PROJECT_CONTEXT=1.
-    const projectContext = process.env.AKM_DISABLE_PROJECT_CONTEXT === "1" ? null : resolveProjectContext(process.cwd());
+    const projectContext = disableProjectContext ? null : resolveProjectContext(process.cwd());
     // Phase 2A / Rec 5: resolve forgetting-curve config and skip the feedback
     // count query when the boost cannot make a difference (default ≤ 1.0 means
     // boost^count == 1 — zero overhead for the common case).
@@ -267,7 +269,7 @@ async function searchDatabase(db, query, searchType, limit, stashDir, allSourceD
     // AKM_DISABLE_SCOPED_UTILITY=1 opts out (e.g. for registry searches or tests).
     let scopeKey;
     try {
-        scopeKey = process.env.AKM_DISABLE_SCOPED_UTILITY === "1" ? undefined : getCurrentWorkflowScopeKey();
+        scopeKey = disableScopedUtility ? undefined : getCurrentWorkflowScopeKey();
     }
     catch {
         // Non-fatal — ranking proceeds without scoped utility on any error.

package/dist/indexer/search/search-source.js

@@ -5,7 +5,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { resolveStashDir } from "../../core/common.js";
 import { getSources, loadConfig } from "../../core/config/config.js";
-import { resolveSourceProviderFactory, resolveSourceProviders } from "../../sources/provider-factory.js";
+import { resolveSourceProviderFactory } from "../../sources/provider-factory.js";
 // Eager side-effect imports so all built-in source providers self-register
 // before resolveEntryContentDir() runs.
 import "../../sources/providers/index.js";
@@ -264,7 +264,20 @@ export async function ensureSourceCaches(config, options) {
     // refreshes the same way — a bad source warns and is skipped without
     // aborting the others. The git content/-subdir layout convention stays in
     // resolveEntryContentDir.
-    for (const provider of resolveSourceProviders(cfg)) {
+    for (const entry of getSources(cfg)) {
+        if (entry.enabled === false)
+            continue;
+        const factory = resolveSourceProviderFactory(entry.type);
+        if (!factory)
+            continue;
+        let provider;
+        try {
+            provider = factory(entry);
+        }
+        catch (err) {
+            warn(`Warning: failed to construct ${entry.type} source provider for "${entry.name ?? entry.url ?? entry.path}": ${err instanceof Error ? err.message : String(err)}`);
+            continue;
+        }
         if (!provider.sync)
             continue;
         try {

package/dist/integrations/agent/prompts.js

@@ -42,7 +42,7 @@ const TYPE_HINTS = {
     memory: "memory assets are short factual notes the user wants persisted across sessions. Frontmatter usually includes `description`.",
     workflow: "workflow assets are markdown describing a multi-step process. Include `# <Title>` and ordered `## Step N` sections.",
     script: "script assets are executable text files. Include a shebang and minimal usage comment.",
-    env: "env assets are `.env` files holding a group of related CONFIGURATION for an app/service (KEY=VALUE pairs, `#` comments) — URLs, flags, and any credentials it needs. Values may or may not be sensitive; all are protected (key names discoverable, values stay on disk). Inject with `akm env run env:<name> -- <cmd>` (the safe path — values never reach stdout/your context); do NOT run `akm env export` and read its output, as that prints values. For a single sensitive value used on its own for authentication (token, key, cert) use a `secret` instead. Never echo values back to the user.",
+    env: "env assets are `.env` files holding a group of related CONFIGURATION for an app/service (KEY=VALUE pairs, `#` comments) — URLs, flags, and any credentials it needs. Values may or may not be sensitive; all are protected (key names discoverable, values stay on disk). Inject with `akm env run env:<name> -- <cmd>`; prefer `--clean` in agent contexts so the child starts from a minimal inherited environment. AKM itself does not print values, but the child command can print its environment, so do not run `env`, `printenv`, shell tracing, or similar diagnostics when secrets are in scope. For a single sensitive value used on its own for authentication (token, key, cert) use a `secret` instead. Never echo values back to the user.",
     wiki: "wiki assets are markdown reference pages with `# Title` and structured headings.",
     fact: "fact assets are durable stash-level facts (personal/team/project details, coding conventions, stash-meta). Frontmatter SHOULD include `description` and a `category` (personal|team|project|convention|meta); set `pinned: true` only for the small always-injected core. Keep each fact short, high-signal, and self-contained — it is durable context, not an episodic note.",
 };

package/dist/llm/memory-infer-impl.js

@@ -0,0 +1,138 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/**
+ * LLM helper for the `akm index` memory-inference pass (#201).
+ *
+ * Compresses a single memory body into one higher-signal derived memory. The
+ * pass itself (in `src/indexer/memory-inference.ts`) is responsible for
+ * deciding which memories are pending, persisting the derived memory with the
+ * correct frontmatter (`inferred: true`, `source: <parent-ref>`), and marking
+ * the parent as processed for idempotency.
+ *
+ * This module is intentionally tiny and stateless so tests can stub it via
+ * `mock.module("../src/llm/memory-infer", ...)` without hitting a network.
+ *
+ * Locked v1 contract (#208): the LLM connection always comes from the
+ * shared `akm.llm` block — never from a per-pass override. Callers obtain
+ * the connection via `resolveIndexPassLLM("memory", config)` and pass it
+ * straight through.
+ */
+import memoryInferSystemPrompt from "../assets/prompts/memory-infer-system.md" with { type: "text" };
+import memoryInferUserPrompt from "../assets/prompts/memory-infer-user.md" with { type: "text" };
+import { toErrorMessage } from "../core/common.js";
+import { warn } from "../core/warn.js";
+import { parseEmbeddedJsonResponse } from "./client.js";
+import { callStructured } from "./structured-call.js";
+/** Hard cap on body chars sent to the model — pragmatic and matches `runLlmEnrich`. */
+const MAX_BODY_CHARS = 4000;
+const SYSTEM_PROMPT = memoryInferSystemPrompt;
+const USER_PROMPT_PREFIX = memoryInferUserPrompt;
+/**
+ * Strict JSON Schema for the derived-memory payload. Sent to providers that
+ * opt in via `LlmConnectionConfig.supportsJsonSchema = true`; the client
+ * silently drops the schema for providers that don't.
+ *
+ * Extends the responseSchema lift (PR 1, asset-writers-investigation §5) to
+ * the memory-inference path. Mirrors the validation gate below
+ * (title/description/content + non-empty tags/searchHints) so a
+ * schema-compliant response is guaranteed to pass the downstream check
+ * — no more "incomplete derived memory payload from LLM; skipping memory"
+ * for shape-only failures.
+ */
+const DERIVED_MEMORY_JSON_SCHEMA = {
+    type: "object",
+    properties: {
+        title: { type: "string", minLength: 1 },
+        description: { type: "string", minLength: 1 },
+        content: { type: "string", minLength: 1 },
+        tags: { type: "array", items: { type: "string" }, minItems: 1, maxItems: 8 },
+        searchHints: { type: "array", items: { type: "string" }, minItems: 1, maxItems: 6 },
+    },
+    required: ["title", "description", "content", "tags", "searchHints"],
+    additionalProperties: false,
+};
+/**
+ * Compress a single memory body into one derived memory via the configured LLM.
+ *
+ * Returns `undefined` on any failure (timeout, invalid JSON, empty response).
+ * Errors are logged via `warn()` but never thrown — a failed split for one memory
+ * must not abort the rest of the index pass.
+ *
+ * Routes through `callStructured({ feature: "memory_inference", ... })` so the
+ * feature gate, error classification, and onFallback hook are honoured uniformly
+ * (Fix C5).
+ */
+export async function compressMemoryToDerivedMemory(llmConfig, body, signal, akmConfig, onFallback, telemetry, onRetryAttempt) {
+    const trimmedBody = body.trim();
+    if (!trimmedBody)
+        return undefined;
+    const userPrompt = `${USER_PROMPT_PREFIX}${trimmedBody.slice(0, MAX_BODY_CHARS)}`;
+    // Memory-inference is ALWAYS gated: no `akmConfig` ⇒ gate closed (no chat,
+    // `disabled` fallback), never the seam's ungated/propagate path (which is for
+    // direct callers like `enhanceMetadata`). This is the gate-closed branch
+    // `tryLlmFeature(_, undefined, _)` took before the migration.
+    if (!akmConfig) {
+        onFallback?.({ feature: "memory_inference", reason: "disabled" });
+        return undefined;
+    }
+    return callStructured({
+        feature: "memory_inference",
+        akmConfig,
+        config: llmConfig,
+        messages: [
+            { role: "system", content: SYSTEM_PROMPT },
+            { role: "user", content: userPrompt },
+        ],
+        request: {
+            temperature: 0.1,
+            timeoutMs: llmConfig.timeoutMs,
+            signal,
+            responseSchema: DERIVED_MEMORY_JSON_SCHEMA,
+            onRetryAttempt,
+        },
+        parse: (raw) => {
+            if (!raw)
+                return undefined;
+            const parsed = parseEmbeddedJsonResponse(raw);
+            if (!parsed) {
+                warn("memory inference: invalid JSON response from LLM; skipping memory.");
+                return undefined;
+            }
+            const title = typeof parsed.title === "string" ? parsed.title.trim() : "";
+            const description = typeof parsed.description === "string" ? parsed.description.trim() : "";
+            const content = typeof parsed.content === "string" ? parsed.content.trim() : "";
+            const tags = Array.isArray(parsed.tags)
+                ? parsed.tags
+                    .filter((t) => typeof t === "string")
+                    .map((t) => t.trim())
+                    .filter(Boolean)
+                    .slice(0, 8)
+                : [];
+            const searchHints = Array.isArray(parsed.searchHints)
+                ? parsed.searchHints
+                    .filter((h) => typeof h === "string")
+                    .map((h) => h.trim())
+                    .filter(Boolean)
+                    .slice(0, 6)
+                : [];
+            if (!title || !description || !content || tags.length === 0 || searchHints.length === 0) {
+                warn("memory inference: incomplete derived memory payload from LLM; skipping memory.");
+                return undefined;
+            }
+            return { title, description, tags, searchHints, content };
+        },
+        onError: (cls, err) => {
+            if (cls === "html") {
+                if (telemetry)
+                    telemetry.htmlErrorCount = (telemetry.htmlErrorCount ?? 0) + 1;
+                warn(`memory inference: provider returned HTML instead of JSON; skipping memory: ${toErrorMessage(err)}`);
+                return undefined;
+            }
+            warn(`memory inference failed: ${toErrorMessage(err)}`);
+            return undefined;
+        },
+        fallback: undefined,
+        onFallback,
+    });
+}

package/dist/llm/memory-infer.js

@@ -1,138 +1,4 @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
-/**
- * LLM helper for the `akm index` memory-inference pass (#201).
- *
- * Compresses a single memory body into one higher-signal derived memory. The
- * pass itself (in `src/indexer/memory-inference.ts`) is responsible for
- * deciding which memories are pending, persisting the derived memory with the
- * correct frontmatter (`inferred: true`, `source: <parent-ref>`), and marking
- * the parent as processed for idempotency.
- *
- * This module is intentionally tiny and stateless so tests can stub it via
- * `mock.module("../src/llm/memory-infer", ...)` without hitting a network.
- *
- * Locked v1 contract (#208): the LLM connection always comes from the
- * shared `akm.llm` block — never from a per-pass override. Callers obtain
- * the connection via `resolveIndexPassLLM("memory", config)` and pass it
- * straight through.
- */
-import memoryInferSystemPrompt from "../assets/prompts/memory-infer-system.md" with { type: "text" };
-import memoryInferUserPrompt from "../assets/prompts/memory-infer-user.md" with { type: "text" };
-import { toErrorMessage } from "../core/common.js";
-import { warn } from "../core/warn.js";
-import { parseEmbeddedJsonResponse } from "./client.js";
-import { callStructured } from "./structured-call.js";
-/** Hard cap on body chars sent to the model — pragmatic and matches `runLlmEnrich`. */
-const MAX_BODY_CHARS = 4000;
-const SYSTEM_PROMPT = memoryInferSystemPrompt;
-const USER_PROMPT_PREFIX = memoryInferUserPrompt;
-/**
- * Strict JSON Schema for the derived-memory payload. Sent to providers that
- * opt in via `LlmConnectionConfig.supportsJsonSchema = true`; the client
- * silently drops the schema for providers that don't.
- *
- * Extends the responseSchema lift (PR 1, asset-writers-investigation §5) to
- * the memory-inference path. Mirrors the validation gate below
- * (title/description/content + non-empty tags/searchHints) so a
- * schema-compliant response is guaranteed to pass the downstream check
- * — no more "incomplete derived memory payload from LLM; skipping memory"
- * for shape-only failures.
- */
-const DERIVED_MEMORY_JSON_SCHEMA = {
-    type: "object",
-    properties: {
-        title: { type: "string", minLength: 1 },
-        description: { type: "string", minLength: 1 },
-        content: { type: "string", minLength: 1 },
-        tags: { type: "array", items: { type: "string" }, minItems: 1, maxItems: 8 },
-        searchHints: { type: "array", items: { type: "string" }, minItems: 1, maxItems: 6 },
-    },
-    required: ["title", "description", "content", "tags", "searchHints"],
-    additionalProperties: false,
-};
-/**
- * Compress a single memory body into one derived memory via the configured LLM.
- *
- * Returns `undefined` on any failure (timeout, invalid JSON, empty response).
- * Errors are logged via `warn()` but never thrown — a failed split for one memory
- * must not abort the rest of the index pass.
- *
- * Routes through `callStructured({ feature: "memory_inference", ... })` so the
- * feature gate, error classification, and onFallback hook are honoured uniformly
- * (Fix C5).
- */
-export async function compressMemoryToDerivedMemory(llmConfig, body, signal, akmConfig, onFallback, telemetry, onRetryAttempt) {
-    const trimmedBody = body.trim();
-    if (!trimmedBody)
-        return undefined;
-    const userPrompt = `${USER_PROMPT_PREFIX}${trimmedBody.slice(0, MAX_BODY_CHARS)}`;
-    // Memory-inference is ALWAYS gated: no `akmConfig` ⇒ gate closed (no chat,
-    // `disabled` fallback), never the seam's ungated/propagate path (which is for
-    // direct callers like `enhanceMetadata`). This is the gate-closed branch
-    // `tryLlmFeature(_, undefined, _)` took before the migration.
-    if (!akmConfig) {
-        onFallback?.({ feature: "memory_inference", reason: "disabled" });
-        return undefined;
-    }
-    return callStructured({
-        feature: "memory_inference",
-        akmConfig,
-        config: llmConfig,
-        messages: [
-            { role: "system", content: SYSTEM_PROMPT },
-            { role: "user", content: userPrompt },
-        ],
-        request: {
-            temperature: 0.1,
-            timeoutMs: llmConfig.timeoutMs,
-            signal,
-            responseSchema: DERIVED_MEMORY_JSON_SCHEMA,
-            onRetryAttempt,
-        },
-        parse: (raw) => {
-            if (!raw)
-                return undefined;
-            const parsed = parseEmbeddedJsonResponse(raw);
-            if (!parsed) {
-                warn("memory inference: invalid JSON response from LLM; skipping memory.");
-                return undefined;
-            }
-            const title = typeof parsed.title === "string" ? parsed.title.trim() : "";
-            const description = typeof parsed.description === "string" ? parsed.description.trim() : "";
-            const content = typeof parsed.content === "string" ? parsed.content.trim() : "";
-            const tags = Array.isArray(parsed.tags)
-                ? parsed.tags
-                    .filter((t) => typeof t === "string")
-                    .map((t) => t.trim())
-                    .filter(Boolean)
-                    .slice(0, 8)
-                : [];
-            const searchHints = Array.isArray(parsed.searchHints)
-                ? parsed.searchHints
-                    .filter((h) => typeof h === "string")
-                    .map((h) => h.trim())
-                    .filter(Boolean)
-                    .slice(0, 6)
-                : [];
-            if (!title || !description || !content || tags.length === 0 || searchHints.length === 0) {
-                warn("memory inference: incomplete derived memory payload from LLM; skipping memory.");
-                return undefined;
-            }
-            return { title, description, tags, searchHints, content };
-        },
-        onError: (cls, err) => {
-            if (cls === "html") {
-                if (telemetry)
-                    telemetry.htmlErrorCount = (telemetry.htmlErrorCount ?? 0) + 1;
-                warn(`memory inference: provider returned HTML instead of JSON; skipping memory: ${toErrorMessage(err)}`);
-                return undefined;
-            }
-            warn(`memory inference failed: ${toErrorMessage(err)}`);
-            return undefined;
-        },
-        fallback: undefined,
-        onFallback,
-    });
-}
+export { compressMemoryToDerivedMemory, } from "./memory-infer-impl.js";

package/dist/migrate-storage-node.mjs

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+const { main } = await import("./scripts/migrate-storage.js");
+
+await main();

package/dist/output/renderers.js

@@ -377,7 +377,7 @@ const envFileRenderer = {
             type: "env",
             name,
             path: ctx.absPath,
-            action: "Environment — keys + comments only. Use `akm env run <ref> -- <command>` to run with the whole .env injected (the safe path — values never reach stdout). `akm env export <ref> --out <file>` writes a sourceable script to a file. Never `source` the raw file. Values stay on disk and are never written to akm's stdout.",
+            action: "Environment — keys + comments only. Use `akm env run <ref> -- <command>` to run with the whole .env injected; prefer `--clean` to minimize inherited parent env. AKM itself does not print values, but child stdout/stderr is not redacted. `akm env export <ref> --out <file>` writes a sourceable script to a file. Never `source` the raw file. Values stay on disk and are never written to akm's stdout.",
             description: comments.length > 0 ? comments.join("\n") : undefined,
             keys,
             comments,