akm-cli 0.9.0-rc.0 → 0.9.0-rc.2

package/dist/commands/improve/extract.js

@@ -15,7 +15,7 @@
  *     never touch a real platform.
  *   - Bounded LLM call wrapped by {@link tryLlmFeature} under the
  *     `session_extraction` gate (default-on; opt out via
- *     `profiles.improve.default.processes.extract.enabled: false`).
+ *     `improve.strategies.<name>.processes.extract.enabled: false`).
  *   - Proposals routed via `createProposal({ source: "extract", ... })` — the
  *     same review queue as reflect / distill / consolidate. Never direct-write.
  *   - Per-candidate body assembly merges description (+ when_to_use for lessons)
@@ -27,16 +27,18 @@ import fs from "node:fs";
 import path from "node:path";
 import { assembleAsset } from "../../core/asset/asset-serialize.js";
 import { resolveStashDir, timestampForFilename } from "../../core/common.js";
-import { getDefaultLlmConfig, getImproveProcessConfig, loadConfig } from "../../core/config/config.js";
+import { getImproveProcessConfig, loadConfig } from "../../core/config/config.js";
 import { ConfigError, UsageError } from "../../core/errors.js";
 import { appendEvent } from "../../core/events.js";
-import { probeLock, releaseLock, tryAcquireLockSync } from "../../core/file-lock.js";
+import { createLockPayload, probeLock, reclaimStaleLock, releaseLock, tryAcquireLockSync, } from "../../core/file-lock.js";
+import { tryAcquireMaintenanceBarrier } from "../../core/maintenance-barrier.js";
 import { resolveStashStandards } from "../../core/standards/resolve-stash-standards.js";
 import { getStateDbPath, openStateDatabase, withStateDb } from "../../core/state-db.js";
 import { repairTruncatedDescription } from "../../core/text-truncation.js";
 import { warn } from "../../core/warn.js";
 import { indexWrittenAssets } from "../../indexer/index-written-assets.js";
-import { resolveImproveProcessRunnerFromProfile, runnerIsLlm } from "../../integrations/agent/runner.js";
+import { resolveLlmEngineUse } from "../../integrations/agent/engine-resolution.js";
+import { materializeLlmRunnerConnection, resolveImproveProcessRunner, } from "../../integrations/agent/runner.js";
 import { normalizeHarnessId } from "../../integrations/harnesses/index.js";
 import { getAvailableHarnesses } from "../../integrations/session-logs/index.js";
 import { preFilterSession } from "../../integrations/session-logs/pre-filter.js";
@@ -48,7 +50,7 @@ import { getExtractedSessionsMap, getLastExtractRunAt, shouldSkipAlreadyExtracte
 import { createProposal, isProposalSkipped } from "../proposal/repository.js";
 import { buildExtractPrompt, EXTRACT_JSON_SCHEMA, parseExtractPayload } from "./extract-prompt.js";
 import { buildHotProbationFrontmatter } from "./hot-probation.js";
-import { resolveProcessEnabled } from "./improve-profiles.js";
+import { resolveImproveStrategy, resolveProcessEnabled } from "./improve-strategies.js";
 import { applySchemaSimilarityPenalty, loadDerivedLayerEmbeddings, } from "./schema-similarity-gate.js";
 import { buildSessionSummaryPrompt, parseSessionSummary, SESSION_SUMMARY_JSON_SCHEMA, sessionMeetsDurationGate, writeSessionAsset, } from "./session-asset.js";
 import { resolveTriageConfig, scoreSessionTriage } from "./triage.js";
@@ -123,20 +125,75 @@ function getExtractSessionLockPath(harness, sessionId, stateDbPath) {
  * extraction outright.
  */
 function acquireExtractSessionLock(lockPath) {
+    const releaseBarrier = tryAcquireMaintenanceBarrier();
+    if (!releaseBarrier)
+        return { proceed: false };
     try {
         fs.mkdirSync(path.dirname(lockPath), { recursive: true });
-        if (tryAcquireLockSync(lockPath, String(process.pid)))
-            return true;
+        let ownership = tryAcquireLockSync(lockPath, createLockPayload());
+        if (ownership)
+            return { proceed: true, ownership };
         const probe = probeLock(lockPath, { staleAfterMs: EXTRACT_SESSION_LOCK_STALE_MS });
         if (probe.state === "held")
-            return false;
-        // absent (released between attempt + probe) or stale → reclaim and retry once.
-        releaseLock(lockPath);
-        return tryAcquireLockSync(lockPath, String(process.pid));
+            return { proceed: false };
+        // Absent (released between attempt + probe) or successfully reclaimed stale lock → retry once.
+        if (probe.state === "stale" && !reclaimStaleLock(lockPath, probe))
+            return { proceed: false };
+        ownership = tryAcquireLockSync(lockPath, createLockPayload());
+        return ownership ? { proceed: true, ownership } : { proceed: false };
     }
     catch {
-        return true;
+        return { proceed: true };
     }
+    finally {
+        releaseBarrier();
+    }
+}
+function cloneAndFreeze(value) {
+    const clone = structuredClone(value);
+    const freeze = (item) => {
+        if (typeof item !== "object" || item === null || Object.isFrozen(item))
+            return;
+        for (const child of Object.values(item))
+            freeze(child);
+        Object.freeze(item);
+    };
+    freeze(clone);
+    return clone;
+}
+/** Resolve standalone extract selection once before discovery, auto iteration, or watch startup. */
+export function resolveStandaloneExtractPlan(config, selection) {
+    if (selection.engine && selection.strategy) {
+        throw new UsageError("--engine and --strategy are mutually exclusive. Pick one.", "INVALID_FLAG_VALUE");
+    }
+    const selected = resolveImproveStrategy(selection.strategy, config);
+    const process = cloneAndFreeze(getImproveProcessConfig(config, "extract", selected.config) ?? {});
+    const invocation = {
+        ...(selection.engine ? { engine: selection.engine } : {}),
+        ...(Object.hasOwn(selection, "timeoutMs") ? { timeoutMs: selection.timeoutMs ?? null } : {}),
+    };
+    const resolved = resolveLlmEngineUse(config, [selected.config, process, invocation], { optional: true });
+    if (!resolved) {
+        throw new ConfigError("No LLM engine configured for extract. Set defaults.llmEngine, pass --engine, or select an improve strategy with processes.extract.engine.", "LLM_NOT_CONFIGURED");
+    }
+    const runner = {
+        kind: "llm",
+        engine: resolved.engine,
+        connection: resolved.connection,
+        ...(resolved.credential ? { credential: resolved.credential } : {}),
+        timeoutMs: resolved.timeoutMs,
+    };
+    return Object.freeze({
+        strategy: selected.name,
+        engine: resolved.engine,
+        // `akm extract` is an explicit operation. The strategy supplies behavior,
+        // but its improve-stage enablement gate does not disable this command.
+        enabled: true,
+        process,
+        runner: cloneAndFreeze(runner),
+        timeoutMs: resolved.timeoutMs,
+        embeddingConfig: cloneAndFreeze(config.embedding),
+    });
 }
 // ── Helpers ──────────────────────────────────────────────────────────────────
 /**
@@ -245,11 +302,11 @@ export function hashSessionContent(data) {
  * proposal validation failure) the session result records a warning and
  * keeps going — one session's bad luck never aborts a multi-session run.
  */
-async function processSession(harness, sessionRef, stashDir, config, llmConfig, chat, ctx, sourceRun, dryRun, timeoutMs, maxTotalChars, minContentChars, 
+async function processSession(harness, sessionRef, stashDir, config, getLlmConfig, chat, ctx, sourceRun, dryRun, timeoutMs, maxTotalChars, minContentChars, 
 // #626 — pre-LLM heuristic triage gate. Default-off (enabled:false) takes the
 // exact pre-change path (no scorer call, no new skipReason).
 // #641 — proceduralAwareFloor is opt-in, DEFAULT OFF.
-triage, sessionIndexing, schemaSimilarityCtx, 
+triage, sessionIndexing, schemaSimilarityCtx, hotProbationEnabled, 
 // #602 — already-extracted skip moved INSIDE processSession: the content hash
 // can only be computed after readSession, so the skip decision lives here. The
 // prior row + bypass flags are threaded in from the caller. Skipping here still
@@ -390,7 +447,7 @@ standardsContext) {
     };
     let llmRaw = "";
     const llmResult = await tryLlmFeature("session_extraction", config, async () => {
-        llmRaw = await chat(llmConfig, [{ role: "user", content: prompt }], {
+        llmRaw = await chat(getLlmConfig(), [{ role: "user", content: prompt }], {
             timeoutMs,
             responseSchema: EXTRACT_JSON_SCHEMA,
         });
@@ -451,12 +508,7 @@ standardsContext) {
     // When enabled, system-generated extractions enter captureMode: hot-probation
     // so they spend ONE consolidation cycle in probation before the deterministic
     // dedup+quality pass promotes them. Default OFF.
-    // Reads the `default` profile deliberately: this per-session hot-probation
-    // flag lives inside the 18-arg `processSession`, which has no handle to the
-    // active profile, and threading a 19th positional arg for a DEFAULT-OFF flag
-    // isn't worth the param bloat. The extract STAGE toggle (in `akmExtract`,
-    // below) already honors `--profile`.
-    const hotProbationEnabled = getImproveProcessConfig(config, "extract")?.hotProbation?.enabled === true;
+    // The invocation boundary resolves this from the frozen extract process.
     for (const candidate of payload.candidates) {
         if (dryRun) {
             proposalIds.push(`dry-run:${candidate.type}:${candidate.name}`);
@@ -555,20 +607,19 @@ export async function akmExtract(options) {
     const stashDir = options.stashDir ?? resolveStashDir();
     const dryRun = options.dryRun ?? false;
     const sourceRun = options.sourceRun ?? `extract-${timestampForFilename()}`;
-    // Read the per-process extract config + enabled-state from the ACTIVE improve
-    // profile when `akmImprove` threaded it; otherwise fall back to the `default`
-    // profile (the explicit `akm extract` path, which has no active profile). This
-    // is what stops a non-default profile's `extract.enabled` from being silently
-    // overridden by the default profile and vice-versa.
-    const activeProfile = options.improveProfile;
-    const extractProcess = activeProfile ? activeProfile.processes?.extract : getImproveProcessConfig(config, "extract");
+    // Read process behavior from the frozen standalone plan or the active improve
+    // strategy. This prevents config changes during watch mode from changing later
+    // triggers and prevents one improve strategy from overriding another.
+    const activeProfile = options.improveProfile ?? (options.resolvedPlan ? undefined : resolveImproveStrategy(undefined, config).config);
+    const extractProcess = options.resolvedPlan?.process ?? getImproveProcessConfig(config, "extract", activeProfile);
     // The `extract.enabled` process toggle gates extract as a STAGE of `akm improve`
     // (the activeProfile path) — consistent with #593/#594 where the active profile,
     // not `default`, is the source of truth. An EXPLICIT `akm extract` invocation
     // (no activeProfile) is a direct user/cron action and always runs; gating it on
     // the default improve profile's stage toggle was a footgun — dropping extract
     // from the daily improve profile would silently disable the standalone command.
-    const extractEnabled = activeProfile ? resolveProcessEnabled("extract", activeProfile) : true;
+    const extractEnabled = options.resolvedPlan?.enabled ??
+        (options.improveProfile ? resolveProcessEnabled("extract", options.improveProfile) : true);
     // Feature-gate early so we get a clean "skipped because disabled" envelope.
     if (!extractEnabled) {
         return {
@@ -582,35 +633,29 @@ export async function akmExtract(options) {
             candidatesCreated: 0,
             proposals: [],
             sessions: [],
-            warnings: [
-                "session_extraction feature disabled — set profiles.improve.default.processes.extract.enabled: true to use",
-            ],
+            warnings: ["extract is disabled by the selected improve strategy"],
             durationMs: Date.now() - startMs,
         };
     }
-    // Resolve the LLM connection. Priority order:
-    //   1. Options.config.profiles.improve.default.processes.extract.profile
-    //      (per-process override, matches reflect/distill/consolidate)
-    //   2. config.defaults.llm (the default LLM profile)
-    //   3. throw — extract requires an LLM.
-    let llmConfig;
-    const runnerSpec = resolveImproveProcessRunnerFromProfile(extractProcess, config);
-    if (runnerSpec) {
-        if (!runnerIsLlm(runnerSpec)) {
-            throw new ConfigError(`Extract only supports mode: "llm" (in-tree LLM call). Got mode: "${runnerSpec.kind}" from profiles.improve.default.processes.extract — change it to "llm" or remove the override.`, "INVALID_CONFIG_FILE");
-        }
-        llmConfig = runnerSpec.connection;
-    }
-    else {
-        llmConfig = getDefaultLlmConfig(config) ?? undefined;
-    }
-    if (!llmConfig) {
-        throw new ConfigError("No LLM connection configured for extract. Set profiles.llm + defaults.llm, or set profiles.improve.default.processes.extract.profile to a configured LLM profile.");
+    // Improve supplies its invocation-owned connection. Standalone extract
+    // resolves the selected process engine, then defaults.llmEngine.
+    const runnerSpec = options.resolvedPlan
+        ? options.resolvedPlan.runner
+        : resolveImproveProcessRunner(activeProfile, "extract", config);
+    const fixedLlmConfig = options.resolvedPlan ? undefined : options.llmConfig;
+    if (!runnerSpec && !fixedLlmConfig) {
+        throw new ConfigError("No LLM engine configured for extract. Set defaults.llmEngine or improve.strategies.<name>.processes.extract.engine.", "LLM_NOT_CONFIGURED");
     }
-    // Honor per-process timeoutMs override; fall back to options.timeoutMs; then 60s.
-    const timeoutMs = options.timeoutMs ??
-        (typeof extractProcess?.timeoutMs === "number" ? extractProcess.timeoutMs : undefined) ??
-        60_000;
+    const timeoutMs = options.resolvedPlan
+        ? options.resolvedPlan.timeoutMs
+        : Object.hasOwn(options, "timeoutMs")
+            ? (options.timeoutMs ?? null)
+            : runnerSpec?.timeoutMs !== undefined
+                ? runnerSpec.timeoutMs
+                : fixedLlmConfig && Object.hasOwn(fixedLlmConfig, "timeoutMs")
+                    ? (fixedLlmConfig.timeoutMs ?? null)
+                    : 600_000;
+    const getLlmConfig = () => runnerSpec ? materializeLlmRunnerConnection(runnerSpec) : fixedLlmConfig;
     // Pre-filter budget — process config can raise it for large-context models.
     const maxTotalChars = typeof extractProcess?.maxTotalChars === "number" ? extractProcess.maxTotalChars : undefined;
     // #595/#596 — minimum raw session size; sessions below it skip the LLM call
@@ -643,7 +688,7 @@ export async function akmExtract(options) {
     const defaultSessionSummaryGenerator = async (data) => {
         let raw = "";
         await tryLlmFeature("session_extraction", config, async () => {
-            raw = await chatForSummary(llmConfig, [{ role: "user", content: buildSessionSummaryPrompt(data) }], {
+            raw = await chatForSummary(getLlmConfig(), [{ role: "user", content: buildSessionSummaryPrompt(data) }], {
                 timeoutMs,
                 responseSchema: SESSION_SUMMARY_JSON_SCHEMA,
             });
@@ -768,13 +813,14 @@ export async function akmExtract(options) {
     // processes.extract.schemaSimilarity.enabled: false. The gate is inert in
     // practice when no derived-layer embeddings exist (empty ctx → no penalty).
     const schemaSimilarityCfg = extractProcess?.schemaSimilarity;
+    const hotProbationEnabled = extractProcess?.hotProbation?.enabled === true;
     let schemaSimilarityCtx = null;
     if (schemaSimilarityCfg?.enabled !== false) {
         const derivedEmbeddings = options.schemaSimilarityEmbeddings ?? loadDerivedLayerEmbeddings();
         schemaSimilarityCtx = {
             config: { ...schemaSimilarityCfg, enabled: true },
             derivedEmbeddings,
-            embeddingConfig: config.embedding,
+            embeddingConfig: options.resolvedPlan?.embeddingConfig ?? config.embedding,
             embedFn: options.schemaSimilarityEmbedFn,
         };
     }
@@ -802,10 +848,11 @@ export async function akmExtract(options) {
         // runs (those that open their own state.db): dry-run is read-only, an
         // injected `stateDb` handle is an in-process/test scenario with no cross-
         // process race, and skip-tracking-off opts out entirely.
-        let sessionLockPath;
+        let sessionLockOwnership;
         if (trackingEnabled && !dryRun && !options.stateDb) {
-            sessionLockPath = getExtractSessionLockPath(harness.name, summary.sessionId, options.stateDbPath ?? getStateDbPath());
-            if (!acquireExtractSessionLock(sessionLockPath)) {
+            const sessionLockPath = getExtractSessionLockPath(harness.name, summary.sessionId, options.stateDbPath ?? getStateDbPath());
+            const sessionLock = acquireExtractSessionLock(sessionLockPath);
+            if (!sessionLock.proceed) {
                 sessions.push({
                     sessionId: summary.sessionId,
                     harness: harness.name,
@@ -819,9 +866,10 @@ export async function akmExtract(options) {
                 skippedCount += 1;
                 continue;
             }
+            sessionLockOwnership = sessionLock.ownership;
         }
         try {
-            const result = await processSession(harness, summary, stashDir, config, llmConfig, chat, options.ctx, sourceRun, dryRun, timeoutMs, maxTotalChars, minContentChars, triage, sessionIndexing, schemaSimilarityCtx, prior, options.force === true, extractStandardsContext);
+            const result = await processSession(harness, summary, stashDir, config, getLlmConfig, chat, options.ctx, sourceRun, dryRun, timeoutMs, maxTotalChars, minContentChars, triage, sessionIndexing, schemaSimilarityCtx, hotProbationEnabled, prior, options.force === true, extractStandardsContext);
             sessions.push(result);
             // #626 — triage aggregation. A session reached the triage gate only when it
             // was NOT already preempted by an earlier skip (read_failed / too_short /
@@ -916,8 +964,8 @@ export async function akmExtract(options) {
             skippedCount += 1;
         }
         finally {
-            if (sessionLockPath)
-                releaseLock(sessionLockPath);
+            if (sessionLockOwnership)
+                releaseLock(sessionLockOwnership);
         }
     }
     // Close the state.db connection we opened. Callers that injected stateDb

package/dist/commands/improve/improve-cli.js

@@ -8,16 +8,24 @@ import { output, runWithJsonErrors } from "../../cli/shared.js";
 import { loadConfig } from "../../core/config/config.js";
 import { UsageError } from "../../core/errors.js";
 import { getCacheDir } from "../../core/paths.js";
+import { redactSensitiveText } from "../../core/redaction.js";
 import { withStateDb } from "../../core/state-db.js";
 import { clearLogFile, setLogFile } from "../../core/warn.js";
 import { closeDatabase, openExistingDatabase } from "../../indexer/db/db.js";
 import { resolveSourceEntries } from "../../indexer/search/search-source.js";
+import { collectEngineCredentialValues } from "../../integrations/agent/engine-resolution.js";
 import { parseFlagValue } from "../../output/context.js";
 import { getActiveCanaries, queryRecentCycleMetrics } from "../../storage/repositories/canaries-repository.js";
 import { refreshCanarySet } from "./collapse-detector.js";
 import { akmImprove } from "./improve.js";
 import { buildImproveRunId, recordTerminatedImproveRun, relativeImproveResultPath, writeImproveResultFile, } from "./improve-result-file.js";
 import { runImproveSession } from "./improve-session.js";
+import { resolveImprovePlan } from "./improve-strategies.js";
+let akmImproveForRun = akmImprove;
+/** Swap the CLI's improve work implementation in deterministic subprocess tests. */
+export function _setAkmImproveForTests(fake) {
+    akmImproveForRun = fake ?? akmImprove;
+}
 // R5 — collapse-detector canary set inspection / explicit refresh. The
 // detector NEVER auto-refreshes the canary set (silent re-baselining is how a
 // slow collapse hides); this verb is the only refresh path.
@@ -72,7 +80,7 @@ async function runCanaryInspection(refresh) {
 export const improveCommand = defineCommand({
     meta: {
         name: "improve",
-        description: "Analyze existing AKM assets and generate improvement proposals; also consolidates memories when profiles.improve.default.processes.consolidate.enabled is true. `akm improve canary [--refresh]` inspects the collapse-detector canary set.",
+        description: "Analyze existing AKM assets and generate improvement proposals; also consolidates memories when the selected strategy enables consolidate. `akm improve canary [--refresh]` inspects the collapse-detector canary set.",
     },
     args: {
         scope: {
@@ -120,9 +128,9 @@ export const improveCommand = defineCommand({
             description: "If another improve run already holds the lock, skip gracefully (exit 0) instead of failing with 'already running' (exit 78). Use for high-frequency scheduled runs so they don't pile up failures while a longer run is in progress.",
             default: false,
         },
-        profile: {
+        strategy: {
             type: "string",
-            description: "Named improve profile from profiles.improve or built-in profiles (default, quick, thorough, memory-focus, graph-refresh). Controls which sub-processes run and which asset types are processed.",
+            description: "Named improve strategy from improve.strategies or built-in strategies (default, quick, thorough, memory-focus, graph-refresh). Controls which sub-processes run and which asset types are processed.",
         },
         sync: {
             type: "boolean",
@@ -166,7 +174,13 @@ export const improveCommand = defineCommand({
             const minRetrievalCount = parseNonNegativeIntFlag(minRetrievalCountRaw, "--min-retrieval-count");
             const requireFeedbackSignal = args["require-feedback-signal"];
             const skipIfLocked = args["skip-if-locked"];
-            const profileArg = getStringArg(args, "profile");
+            const strategyArg = getStringArg(args, "strategy");
+            const effectiveConfig = loadConfig();
+            // Resolve every enabled model-backed process before logging, signal
+            // lifecycle setup, or any filesystem/database side effect.
+            const resolvedPlan = resolveImprovePlan(strategyArg, effectiveConfig);
+            const selectedStrategyName = resolvedPlan.strategy.name;
+            const sensitiveValues = collectEngineCredentialValues(effectiveConfig);
             // Only set the keys the user actually passed (citty leaves the flag
             // undefined unless `--sync`/`--no-sync` / `--push`/`--no-push` appears),
             // so the resolved profile `sync` block wins by default.
@@ -177,8 +191,10 @@ export const improveCommand = defineCommand({
                 syncOverride.enabled = syncFlag;
             if (pushFlag !== undefined)
                 syncOverride.push = pushFlag;
-            const improveLogFile = path.join(getCacheDir(), "logs", "improve", `${new Date().toISOString().replace(/[:.]/g, "-")}.log`);
-            setLogFile(improveLogFile);
+            if (!dryRun) {
+                const improveLogFile = path.join(getCacheDir(), "logs", "improve", `${new Date().toISOString().replace(/[:.]/g, "-")}.log`);
+                setLogFile(improveLogFile);
+            }
             const startedAtMs = Date.now();
             const startedAtIso = new Date(startedAtMs).toISOString();
             // Mint the run-id up front so signal handlers can persist a partial
@@ -186,7 +202,7 @@ export const improveCommand = defineCommand({
             // was minted at end-of-run, so SIGTERM'd runs (cron timeout) left no
             // row in improve_runs and effectively disappeared from `akm health`.
             const runId = buildImproveRunId();
-            const primaryStashDir = resolveSourceEntries(undefined, loadConfig())[0]?.path;
+            const primaryStashDir = resolveSourceEntries(undefined, effectiveConfig)[0]?.path;
             const scopeArg = getStringArg(args, "scope");
             const inferredScopeMode = (scopeArg ?? "").includes(":") ? "ref" : scopeArg ? "type" : "all";
             // Signal handler + exception path both flow through this helper so
@@ -194,6 +210,8 @@ export const improveCommand = defineCommand({
             // reason in metadata.terminated.
             let runRecorded = false;
             const persistTerminated = (reason, errorMessage) => {
+                if (dryRun)
+                    return;
                 if (runRecorded)
                     return;
                 if (!primaryStashDir)
@@ -204,8 +222,9 @@ export const improveCommand = defineCommand({
                         scopeMode: inferredScopeMode,
                         scopeValue: scopeArg ?? null,
                         dryRun: Boolean(dryRun),
-                        profile: profileArg ?? null,
-                        ...(errorMessage ? { errorMessage } : {}),
+                        strategy: selectedStrategyName,
+                        ...(errorMessage ? { errorMessage: redactSensitiveText(errorMessage, sensitiveValues) } : {}),
+                        sensitiveValues,
                     });
                 }
                 catch (err) {
@@ -223,10 +242,11 @@ export const improveCommand = defineCommand({
             let improveResult;
             try {
                 improveResult = await runImproveSession({
-                    runWork: () => akmImprove({
+                    runWork: () => akmImproveForRun({
                         scope: scopeArg,
                         task: taskArg,
                         dryRun,
+                        resolvedPlan,
                         target: targetArg,
                         autoAccept,
                         ...(runId !== undefined ? { runId } : {}),
@@ -235,7 +255,7 @@ export const improveCommand = defineCommand({
                         ...(minRetrievalCount !== undefined ? { minRetrievalCount } : {}),
                         ...(requireFeedbackSignal ? { requireFeedbackSignal } : {}),
                         ...(skipIfLocked ? { skipIfLocked } : {}),
-                        ...(profileArg !== undefined ? { profile: profileArg } : {}),
+                        ...(strategyArg !== undefined ? { strategy: strategyArg } : {}),
                         ...(Object.keys(syncOverride).length > 0 ? { sync: syncOverride } : {}),
                         consolidateOptions: {
                             target: targetArg,
@@ -249,7 +269,9 @@ export const improveCommand = defineCommand({
                     signalSource: process,
                     exit: process.exit,
                     onTerminate: (reason) => persistTerminated(reason),
-                    ack: (message) => process.stderr.write(`[improve] ${message}; recorded terminated run ${runId}\n`),
+                    ack: (message) => process.stderr.write(dryRun
+                        ? `[improve] ${message}; dry-run state was not persisted\n`
+                        : `[improve] ${message}; recorded terminated run ${runId}\n`),
                 });
             }
             catch (err) {
@@ -264,9 +286,9 @@ export const improveCommand = defineCommand({
                 clearLogFile();
             }
             const durationMs = Date.now() - startedAtMs;
-            if (jsonToStdout) {
-                // Legacy / escape-hatch mode: full JSON on stdout, no file write.
-                // Kept for scripts/agents that already pipe to jq.
+            if (dryRun || jsonToStdout) {
+                // A dry-run never persists its result, so stdout is its only result
+                // channel. --json-to-stdout remains the live-run escape hatch.
                 output("improve", improveResult);
                 process.exit(0);
             }
@@ -288,7 +310,7 @@ export const improveCommand = defineCommand({
             runRecorded = true; // Suppress any late signal-handler write — the success path owns the row now.
             if (primaryStashDir) {
                 try {
-                    writeImproveResultFile(primaryStashDir, runId, improveResult, startedAtIso, profileArg ?? null);
+                    writeImproveResultFile(primaryStashDir, runId, improveResult, startedAtIso, sensitiveValues);
                 }
                 catch (err) {
                     // Stderr warning on the failure path is preferable to crashing

package/dist/commands/improve/improve-result-file.js

@@ -27,6 +27,8 @@
  */
 import crypto from "node:crypto";
 import path from "node:path";
+import { decodeImproveResult } from "../../core/improve-result.js";
+import { redactSensitiveValue } from "../../core/redaction.js";
 import { withStateDb } from "../../core/state-db.js";
 import { recordImproveRun } from "../../storage/repositories/improve-runs-repository.js";
 /**
@@ -74,14 +76,10 @@ export function relativeImproveResultPath(runId) {
  * (closes the dry-run/real-run artifact-trap recorded in MEMORY.md
  * `feedback_akm_dryrun_artifact_trap`).
  *
- * @param profile - The `--profile` value passed to this invocation (e.g.
- * `quick`, `reflect-distill`), or `null`/`undefined` when no profile was
- * given. Mirrors {@link recordTerminatedImproveRun}'s `ctx.profile`
- * convention so successful and terminated runs are equally queryable by
- * profile. Previously hardcoded to `null` here, which meant only
- * abnormally-terminated runs recorded their profile in state.db.
  */
-export function writeImproveResultFile(stashDir, runId, result, startedAt, profile) {
+export function writeImproveResultFile(stashDir, runId, result, startedAt, sensitiveValues = []) {
+    const decoded = decodeImproveResult(result);
+    const persistedResult = redactSensitiveValue(result, sensitiveValues);
     withStateDb((db) => {
         const completedAt = new Date().toISOString();
         // startedAt is the ISO timestamp captured at process launch (passed from the
@@ -95,12 +93,13 @@ export function writeImproveResultFile(stashDir, runId, result, startedAt, profi
             completedAt,
             stashDir,
             dryRun: Boolean(result.dryRun),
-            profile: profile ?? null,
+            legacyProfile: redactSensitiveValue(decoded.legacyProfile, sensitiveValues),
+            strategy: redactSensitiveValue(decoded.strategy, sensitiveValues),
             scopeMode: result.scope?.mode ?? "all",
-            scopeValue: result.scope?.value ?? null,
-            guidance: result.guidance ?? null,
+            scopeValue: persistedResult.scope?.value ?? null,
+            guidance: persistedResult.guidance ?? null,
             ok: Boolean(result.ok),
-            result,
+            result: persistedResult,
         });
     });
     return relativeImproveResultPath(runId);
@@ -124,37 +123,44 @@ export function writeImproveResultFile(stashDir, runId, result, startedAt, profi
  */
 export function recordTerminatedImproveRun(stashDir, runId, startedAt, reason, ctx) {
     const completedAt = new Date().toISOString();
-    const minimalResult = {
-        schemaVersion: 1,
+    const persistedReason = redactSensitiveValue(reason, ctx.sensitiveValues ?? []);
+    const persistedScopeValue = redactSensitiveValue(ctx.scopeValue, ctx.sensitiveValues ?? []);
+    const persistedStrategy = redactSensitiveValue(ctx.strategy, ctx.sensitiveValues ?? []);
+    const minimalResult = redactSensitiveValue({
+        schemaVersion: 2,
         ok: false,
-        scope: { mode: ctx?.scopeMode ?? "all", ...(ctx?.scopeValue ? { value: ctx.scopeValue } : {}) },
-        dryRun: Boolean(ctx?.dryRun),
+        strategy: persistedStrategy,
+        scope: { mode: ctx.scopeMode ?? "all", ...(persistedScopeValue ? { value: persistedScopeValue } : {}) },
+        dryRun: Boolean(ctx.dryRun),
+        memorySummary: { eligible: 0, derived: 0 },
         actions: [],
         plannedRefs: [],
         terminated: {
-            reason,
+            reason: persistedReason,
             at: completedAt,
-            ...(ctx?.errorMessage ? { errorMessage: ctx.errorMessage } : {}),
+            ...(ctx.errorMessage ? { errorMessage: ctx.errorMessage } : {}),
         },
-    };
+    }, ctx.sensitiveValues ?? []);
     withStateDb((db) => {
         recordImproveRun(db, {
             id: runId,
             startedAt,
             completedAt,
             stashDir,
-            dryRun: Boolean(ctx?.dryRun),
-            profile: ctx?.profile ?? null,
-            scopeMode: ctx?.scopeMode ?? "all",
-            scopeValue: ctx?.scopeValue ?? null,
+            dryRun: Boolean(ctx.dryRun),
+            strategy: persistedStrategy,
+            scopeMode: ctx.scopeMode ?? "all",
+            scopeValue: persistedScopeValue ?? null,
             guidance: null,
             ok: false,
             result: minimalResult,
             metadata: {
                 terminated: {
-                    reason,
+                    reason: persistedReason,
                     at: completedAt,
-                    ...(ctx?.errorMessage ? { errorMessage: ctx.errorMessage } : {}),
+                    ...(ctx.errorMessage
+                        ? { errorMessage: redactSensitiveValue(ctx.errorMessage, ctx.sensitiveValues ?? []) }
+                        : {}),
                 },
             },
         });