akm-cli 0.9.0-rc.1 → 0.9.0-rc.13

package/dist/integrations/session-logs/index.js

@@ -13,20 +13,29 @@ export { extractInlineRefMentions } from "./inline-refs.js";
 // ([claude-code, opencode] — visible in e.g. `extract --auto` result order)
 // is preserved deterministically, independent of HARNESS_REGISTRY declaration
 // order (which is pinned for JSON-schema enum stability).
+//
+// WI-9.7 (H1): `SESSION_LOG_HARNESSES` is `HARNESS_REGISTRY` narrowed by the
+// `isSessionLogHarness` type-predicate (see `../harnesses/types.ts`), so every
+// element's `capabilities.sessionLogs` is the literal `true` and
+// `sessionLogProvider` is a required (non-optional) field — a harness
+// declaring `sessionLogs: true` without a provider is now a compile error at
+// its `HARNESS_REGISTRY` entry, not a throw here. The load-time throw this
+// used to guard (`h.sessionLogProvider?.()` returning undefined) is gone;
+// `h.sessionLogProvider()` cannot be called with no provider to invoke.
 const HARNESSES = [...SESSION_LOG_HARNESSES]
     .sort((a, b) => a.id.localeCompare(b.id))
-    .map((h) => {
-    const provider = h.sessionLogProvider?.();
-    if (!provider) {
-        throw new Error(`[akm] harness "${h.id}" declares capabilities.sessionLogs but no sessionLogProvider factory (src/integrations/harnesses). Add one to its descriptor.`);
-    }
-    return provider;
-});
-// Reverse invariant (kept from #562): every derived provider's runtime name
-// must resolve back — via the id-normalization bridge, so a provider named
-// "claude-code" still maps to the canonical "claude" harness — to a registry
-// harness whose `sessionLogs` capability is set. Catches a descriptor whose
-// factory returns a provider named for a different/unregistered harness.
+    .map((h) => h.sessionLogProvider());
+// Reverse invariant (kept from #562): every derived provider's runtime `name`
+// — a plain string the provider implementation sets independently of the
+// harness registry (e.g. `ClaudeCodeProvider`'s `"claude-code"`) — must
+// resolve back, via the id-normalization bridge, to a registry harness whose
+// `sessionLogs` capability is set. This is NOT expressible as a compile-time
+// type constraint: `SessionLogHarness.name` is a runtime string with no
+// static link to the `AkmHarness` that produced it, so a typo'd or
+// stale `name` (e.g. copy-pasted from another provider, or renamed on one
+// side only) would only ever surface as a wrong/silent lookup miss much later
+// (health scans, `extract --auto` attribution) rather than here at load time.
+// Kept as a runtime guard for that reason.
 for (const provider of HARNESSES) {
     const harness = getHarness(provider.name);
     if (!harness?.capabilities.sessionLogs) {
@@ -41,22 +50,6 @@ const ERROR_PATTERNS = /error|failed|exception|cannot|undefined|null pointer|ENO
 export function getAvailableHarnesses() {
     return HARNESSES.filter((harness) => harness.isAvailable());
 }
-/**
- * Map each available harness to its `{ harnessName, roots }` watch target,
- * skipping harnesses that expose no roots (absent `watchRoots()` or an empty
- * result). This is the one stable entry point the watcher uses so it never
- * reaches into providers directly.
- */
-export function getWatchTargets() {
-    const targets = [];
-    for (const harness of getAvailableHarnesses()) {
-        const roots = harness.watchRoots?.() ?? [];
-        if (roots.length === 0)
-            continue;
-        targets.push({ harnessName: harness.name, roots });
-    }
-    return targets;
-}
 export function normalizeSessionTopic(text) {
     const normalized = text.replace(/\s+/g, " ").trim().toLowerCase();
     if (normalized.length < 10)
@@ -98,16 +91,13 @@ export function aggregateSessionEvents(events) {
  * Collect normalized session events from a set of harnesses for the health
  * candidate scan (#568).
  *
- * Pipeline selection per harness (capability-gated):
- *   - readSession-capable harness (`supportsReadSession !== false`): drive the
- *     richer `listSessions()` + `readSession()` pipeline. `readSession` flattens
+ * Pipeline selection per harness:
+ *   - Drive the richer `listSessions()` + `readSession()` pipeline. `readSession` flattens
  *     structured content — tool calls, assistant content blocks, thinking,
  *     tool_result — into event text (e.g. ClaudeCodeProvider's `parseClaudeEvent`
  *     surfaces `[tool:*]` / `[tool_result]` blocks that the legacy flat
  *     `readEvents` scan drops entirely). This is what lets health advisories see
  *     repeated tool failures / long runs that the flat scan hid.
- *   - legacy-only harness (`supportsReadSession === false`): fall back to the
- *     legacy flat `readEvents()` scan (behaviour-preserving).
  *
  * Extracted as a pure function (harnesses injected) so it is unit-testable
  * without touching the real on-disk session-log locations.
@@ -120,19 +110,13 @@ export function aggregateSessionEvents(events) {
  * health command (`akm health`, which calls this synchronously) blow past its
  * latency budget. `listSessions()` returns summaries sorted newest-first, so
  * capping to the most-recent N sessions per harness keeps the richer signal
- * for what actually matters (recent activity) while bounding cost. The legacy
- * flat-scan path is naturally cheaper and is left uncapped.
+ * for what actually matters (recent activity) while bounding cost.
  */
 const DEFAULT_MAX_SESSIONS_PER_HARNESS = 50;
 export function collectSessionEvents(harnesses, sinceMs, maxSessionsPerHarness = DEFAULT_MAX_SESSIONS_PER_HARNESS) {
     const events = [];
     for (const harness of harnesses) {
         try {
-            if (harness.supportsReadSession === false) {
-                // Legacy-only harness: only the flat event scan is available.
-                events.push(...harness.readEvents({ sinceMs }));
-                continue;
-            }
             // Rich path: enumerate sessions cheaply, then read each one's full
             // structured event stream. Falls back to readEvents if listSessions
             // surfaces nothing (e.g. a harness that wired readSession but whose

package/dist/integrations/session-logs/provider-base.js

@@ -0,0 +1,113 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/**
+ * Shared skeleton for {@link SessionLogHarness} providers (§4.6 dedup).
+ *
+ * Holds only what the concrete providers genuinely share: safe stat'ing,
+ * recursive directory walking, the mtime-filtered file→summary listing loop,
+ * the flat JSONL/log line→event scan, and conditional-spread assembly of
+ * {@link SessionSummary} refs stamped with the provider's runtime name.
+ * Everything platform-specific — file layouts, metadata peeking, SQLite
+ * stores, message flattening — stays in the subclasses.
+ */
+import fs from "node:fs";
+import path from "node:path";
+export class AbstractSessionLogProvider {
+    isAvailable() {
+        return fs.existsSync(this.availabilityRoot());
+    }
+    /** `fs.statSync` that returns `undefined` instead of throwing. */
+    statSafe(target) {
+        try {
+            return fs.statSync(target);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /** Recursively yield files under `dir` whose basename passes `matches`. */
+    *walkFiles(dir, matches) {
+        try {
+            for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+                const full = path.join(dir, entry.name);
+                if (entry.isDirectory())
+                    yield* this.walkFiles(full, matches);
+                else if (matches(entry.name))
+                    yield full;
+            }
+        }
+        catch {
+            // permission errors etc.
+        }
+    }
+    /**
+     * Assemble a {@link SessionSummary} stamped with this provider's name.
+     * Timestamps are included whenever defined (0 is valid); `projectHint` /
+     * `title` only when non-empty, so absent metadata stays absent.
+     */
+    sessionRef(input) {
+        return {
+            harness: this.name,
+            sessionId: input.sessionId,
+            filePath: input.filePath,
+            ...(input.startedAt !== undefined ? { startedAt: input.startedAt } : {}),
+            ...(input.endedAt !== undefined ? { endedAt: input.endedAt } : {}),
+            ...(input.projectHint ? { projectHint: input.projectHint } : {}),
+            ...(input.title ? { title: input.title } : {}),
+        };
+    }
+    /**
+     * The shared listing loop: enumerate candidate session files, drop the
+     * unstat'able and the ones older than `sinceMs`, summarize the rest, and
+     * sort newest-ended first. An enumeration failure (root missing or
+     * unreadable) returns what was collected so far rather than throwing.
+     */
+    listSessionsFromFiles(input) {
+        const summaries = [];
+        try {
+            for (const filePath of input.enumerate()) {
+                const stat = this.statSafe(filePath);
+                if (!stat)
+                    continue;
+                if (stat.mtimeMs < input.sinceMs)
+                    continue;
+                const summary = input.summarize(filePath, stat);
+                if (summary)
+                    summaries.push(summary);
+            }
+        }
+        catch {
+            // Root missing or unreadable — return what we have.
+        }
+        return summaries.sort((a, b) => (b.endedAt ?? 0) - (a.endedAt ?? 0));
+    }
+    /**
+     * The legacy flat line scan shared by both providers' `readEvents`: parse
+     * each line as JSON, pull text/session-id through the per-provider
+     * selectors, skip entries whose text is missing or under 10 chars, and
+     * fall back to the file mtime when the entry carries no numeric timestamp.
+     */
+    *logLineEvents(input) {
+        for (const line of input.lines) {
+            try {
+                const entry = JSON.parse(line);
+                const text = input.selectText(entry);
+                if (typeof text !== "string" || text.length < 10)
+                    continue;
+                const sessionId = input.selectSessionId(entry);
+                yield {
+                    harness: this.name,
+                    text,
+                    ts: typeof entry?.timestamp === "number" ? entry.timestamp : input.fallbackTsMs,
+                    sessionId: typeof sessionId === "string" ? sessionId : undefined,
+                    role: typeof entry?.role === "string" ? entry.role : "unknown",
+                    filePath: input.filePath,
+                };
+            }
+            catch {
+                // skip malformed lines
+            }
+        }
+    }
+}

package/dist/llm/client.js

@@ -4,45 +4,34 @@
 /**
  * Low-level OpenAI-compatible chat completions client and capability probing.
  *
- * Split out of `llm.ts` to keep the transport-layer concerns (HTTP request,
- * response parsing, JSON-fence stripping, capability probe, availability
- * check) separate from higher-level metadata-enhancement workflows.
- *
- * `llm.ts` re-exports everything from this module for backward compatibility.
+ * Keeps transport-layer concerns (HTTP request, response parsing, capability
+ * probing, and availability checks) separate from higher-level workflows.
  */
-import { fetchWithTimeout } from "../core/common.js";
+import { fetchWithTimeout, readBodyWithByteCap } from "../core/common.js";
 import { resolveSecret } from "../core/config/config.js";
-import { escapeJsonStringControls, parseJsonResponse, stripCodeFences, stripThinkBlocks } from "../core/parse.js";
+import { formatExtraParamsIssue, validateExtraParams } from "../core/extra-params.js";
+import { parseJsonResponse } from "../core/parse.js";
+import { redactCredentialPatterns, redactSensitiveText } from "../core/redaction.js";
 import { warnVerbose } from "../core/warn.js";
-import { emitLlmUsage, extractUsageTokens } from "./usage-telemetry.js";
-// Re-export shared parse utilities so existing importers of `client.ts` continue
-// to resolve `parseJsonResponse` and `parseEmbeddedJsonResponse` from this module.
-export { escapeJsonStringControls, parseEmbeddedJsonResponse, parseJsonResponse, stripCodeFences, stripThinkBlocks, } from "../core/parse.js";
+import { DEFAULT_LLM_TIMEOUT_MS } from "../integrations/agent/config.js";
+import { emitLlmUsage, extractUsageTokens, } from "./usage-telemetry.js";
 /** Maximum length of an LLM error response body included in thrown errors. */
 const ERROR_BODY_MAX_LEN = 200;
+/** Stable OpenAI-compatible response-schema name used for every structured call. */
+const JSON_SCHEMA_RESPONSE_NAME = "akm_response";
 /**
  * Redact credential-shaped substrings from an upstream error body before
  * including it in a thrown Error. The body is also trimmed to a fixed length
  * so that a verbose provider response cannot leak large amounts of context.
  *
- * Targets:
- *  - `Bearer <token>` headers echoed back by the provider
- *  - `sk-…` / `sk_…` style API keys (OpenAI / Anthropic-shaped)
- *  - `key-…` / `key_…` shorthand keys
- *  - `"api_key": "…"` / `"apiKey": "…"` JSON fields
+ * The pattern set itself lives in {@link redactCredentialPatterns}
+ * (src/core/redaction.ts) so other output paths (e.g. task run logs) can
+ * reuse it without this function's length cap.
  */
 export function redactErrorBody(input) {
     if (!input)
         return "";
-    let out = input
-        // Bearer tokens (case-insensitive)
-        .replace(/\bBearer\s+[A-Za-z0-9._\-+/=]+/gi, "Bearer [REDACTED]")
-        // sk-/sk_ style keys
-        .replace(/\bsk[-_][A-Za-z0-9._-]{6,}/g, "[REDACTED]")
-        // key-/key_ shorthand keys
-        .replace(/\bkey[-_][A-Za-z0-9._-]{6,}/g, "[REDACTED]")
-        // JSON-style "api_key": "...", "apiKey": "...", "api-key": "..."
-        .replace(/("(?:api[_-]?key|apiKey|authorization|token)"\s*:\s*")([^"]*)(")/gi, "$1[REDACTED]$3");
+    let out = redactCredentialPatterns(input);
     if (out.length > ERROR_BODY_MAX_LEN) {
         out = `${out.slice(0, ERROR_BODY_MAX_LEN)}…`;
     }
@@ -98,6 +87,19 @@ const RETRY_BUDGET_FRACTION = 0.9;
 export function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
+async function waitForRetry(ms, wait, signal) {
+    if (!signal)
+        return wait(ms);
+    if (signal.aborted)
+        throw new LlmCallError("LLM request aborted", "aborted");
+    await new Promise((resolve, reject) => {
+        const onAbort = () => reject(new LlmCallError("LLM request aborted", "aborted"));
+        signal.addEventListener("abort", onAbort, { once: true });
+        wait(ms)
+            .then(resolve, reject)
+            .finally(() => signal.removeEventListener("abort", onAbort));
+    });
+}
 /** Compute a uniform jittered backoff in the [200, 800)ms range. */
 function retryBackoffMs() {
     return RETRY_BACKOFF_MIN_MS + Math.random() * (RETRY_BACKOFF_MAX_MS - RETRY_BACKOFF_MIN_MS);
@@ -178,7 +180,11 @@ export async function chatCompletion(config, messages, options) {
     return chatCompletionReal(config, messages, options);
 }
 async function chatCompletionReal(config, messages, options) {
-    const effectiveTimeoutMs = options?.timeoutMs ?? config.timeoutMs ?? 120_000;
+    const effectiveTimeoutMs = options && Object.hasOwn(options, "timeoutMs")
+        ? (options.timeoutMs ?? null)
+        : Object.hasOwn(config, "timeoutMs")
+            ? (config.timeoutMs ?? null)
+            : DEFAULT_LLM_TIMEOUT_MS;
     const started = Date.now();
     try {
         return await chatCompletionAttempt(config, messages, options, effectiveTimeoutMs);
@@ -189,8 +195,9 @@ async function chatCompletionReal(config, messages, options) {
         // Timeout-budget guard: if the first attempt already burned most of the
         // budget, a second attempt cannot complete — skip the retry.
         const elapsed = Date.now() - started;
-        const remaining = effectiveTimeoutMs - elapsed;
-        if (elapsed >= effectiveTimeoutMs * RETRY_BUDGET_FRACTION || remaining <= 0) {
+        const remaining = effectiveTimeoutMs === null ? null : effectiveTimeoutMs - elapsed;
+        if (effectiveTimeoutMs !== null &&
+            (elapsed >= effectiveTimeoutMs * RETRY_BUDGET_FRACTION || (remaining !== null && remaining <= 0))) {
             throw err;
         }
         // Signal the caller so it can bump `retryAttempts` (NOT `failureCount`).
@@ -199,7 +206,7 @@ async function chatCompletionReal(config, messages, options) {
         // authoritative.
         warnVerbose(`[akm] LLM transient failure (${err.code}); retrying once: ${err.message}`);
         const wait = retryBackoffMs();
-        await (options?.sleep ?? sleep)(wait);
+        await waitForRetry(wait, options?.sleep ?? sleep, options?.signal);
         // The retry must not exceed the original budget.
         return await chatCompletionAttempt(config, messages, options, remaining);
     }
@@ -210,6 +217,11 @@ async function chatCompletionReal(config, messages, options) {
  * transient failures.
  */
 async function chatCompletionAttempt(config, messages, options, timeoutMs) {
+    if (config.extraParams !== undefined) {
+        const issue = validateExtraParams(config.extraParams)[0];
+        if (issue)
+            throw new Error(formatExtraParamsIssue("LLM extraParams", issue));
+    }
     const headers = { "Content-Type": "application/json" };
     const resolvedKey = resolveSecret(config.apiKey);
     if (resolvedKey) {
@@ -220,96 +232,142 @@ async function chatCompletionAttempt(config, messages, options, timeoutMs) {
     // guess is wrong. Users who need a cap can set llm.maxTokens in config.
     const resolvedMaxTokens = options?.maxTokens ?? config.maxTokens;
     const responseFormat = options?.responseSchema && config.supportsJsonSchema
-        ? { response_format: { type: "json_schema", json_schema: { schema: options.responseSchema, strict: true } } }
+        ? {
+            response_format: {
+                type: "json_schema",
+                json_schema: { name: JSON_SCHEMA_RESPONSE_NAME, schema: options.responseSchema, strict: true },
+            },
+        }
         : {};
-    // Wall-clock start for per-call usage telemetry (#576). Captured here so the
+    const resolvedEnableThinking = options?.enableThinking ?? config.enableThinking;
+    const thinkingParams = resolvedEnableThinking === undefined
+        ? {}
+        : config.provider === "vllm"
+            ? { chat_template_kwargs: { enable_thinking: resolvedEnableThinking } }
+            : { enable_thinking: resolvedEnableThinking };
+    const requestBody = JSON.stringify({
+        model: config.model,
+        messages,
+        temperature: options?.temperature ?? config.temperature ?? 0.3,
+        ...(resolvedMaxTokens !== undefined ? { max_tokens: resolvedMaxTokens } : {}),
+        ...responseFormat,
+        ...thinkingParams,
+        ...config.extraParams,
+    });
+    // Wall-clock start for per-attempt usage telemetry (#576). Captured here so the
     // emitted duration covers the full request/response/parse cycle of a single
     // attempt, not the retry-wrapping `chatCompletion`.
     const requestStartedAt = Date.now();
-    let response;
+    const requestDeadlineAt = timeoutMs === null ? null : requestStartedAt + timeoutMs;
+    const remainingAttemptMs = () => requestDeadlineAt === null ? undefined : Math.max(0, requestDeadlineAt - Date.now());
+    let terminalFields = {
+        model: config.model,
+        modelSource: "configured",
+    };
     try {
-        response = await fetchWithTimeout(config.endpoint, {
-            method: "POST",
-            headers,
-            body: JSON.stringify({
-                model: config.model,
-                messages,
-                temperature: options?.temperature ?? config.temperature ?? 0.3,
-                ...(resolvedMaxTokens !== undefined ? { max_tokens: resolvedMaxTokens } : {}),
-                ...responseFormat,
-                ...(options?.enableThinking !== undefined
-                    ? { enable_thinking: options.enableThinking }
-                    : config.enableThinking !== undefined
-                        ? { enable_thinking: config.enableThinking }
-                        : {}),
-                ...config.extraParams,
-            }),
-        }, timeoutMs, options?.signal);
-    }
-    catch (err) {
-        // fetchWithTimeout throws a plain Error with a message containing
-        // "timed out" for AbortController-driven timeouts, or "aborted" for
-        // caller-driven cancellations. Map both to typed LlmCallError.
-        const msg = err instanceof Error ? err.message : String(err);
-        if (err instanceof DOMException && err.name === "AbortError") {
-            throw new LlmCallError(`Request timed out after ${timeoutMs}ms`, "timeout");
+        let response;
+        try {
+            response = await fetchWithTimeout(config.endpoint, {
+                method: "POST",
+                headers,
+                body: requestBody,
+            }, timeoutMs, options?.signal);
         }
-        if (msg.includes("timed out")) {
-            throw new LlmCallError(`Request timed out after ${timeoutMs}ms`, "timeout");
+        catch (err) {
+            // fetchWithTimeout throws a plain Error with a message containing
+            // "timed out" for AbortController-driven timeouts, or "aborted" for
+            // caller-driven cancellations. Map both to typed LlmCallError.
+            const msg = err instanceof Error ? err.message : String(err);
+            if (options?.signal?.aborted || msg.includes("Request aborted")) {
+                throw new LlmCallError("LLM request aborted", "aborted");
+            }
+            if (err instanceof DOMException && err.name === "AbortError") {
+                throw new LlmCallError(`Request timed out${timeoutMs === null ? "" : ` after ${timeoutMs}ms`}`, "timeout");
+            }
+            if (msg.includes("timed out")) {
+                throw new LlmCallError(`Request timed out${timeoutMs === null ? "" : ` after ${timeoutMs}ms`}`, "timeout");
+            }
+            throw new LlmCallError(`Network error: ${msg}`, "network_error");
         }
-        throw new LlmCallError(`Network error: ${msg}`, "network_error");
-    }
-    if (!response.ok) {
-        const rawBody = await response.text().catch(() => "");
-        const safeBody = redactErrorBody(rawBody);
-        const status = response.status;
-        if (status === 429) {
-            throw new LlmCallError(`LLM request rate limited (429) ${config.endpoint}: ${safeBody}`, "rate_limited", status);
+        if (!response.ok) {
+            const rawBody = await readBodyWithByteCap(response, undefined, {
+                ...(requestDeadlineAt === null ? {} : { bodyTimeoutMs: remainingAttemptMs() }),
+                signal: options?.signal,
+            }).catch((err) => {
+                if (options?.signal?.aborted)
+                    throw new LlmCallError("LLM response read aborted", "aborted");
+                if (err instanceof Error && err.name === "BodyReadTimeoutError") {
+                    throw new LlmCallError("LLM response body read timed out", "timeout");
+                }
+                return "";
+            });
+            const safeBody = redactSensitiveText(redactErrorBody(rawBody), resolvedKey ? [resolvedKey] : []);
+            const status = response.status;
+            if (status === 429) {
+                throw new LlmCallError(`LLM request rate limited (429) ${config.endpoint}: ${safeBody}`, "rate_limited", status);
+            }
+            if (status >= 500 && isHtmlResponse(rawBody)) {
+                throw new LlmCallError(`LLM provider returned HTML instead of JSON (${status}) ${config.endpoint}: ${redactSensitiveText(htmlExcerpt(rawBody), resolvedKey ? [resolvedKey] : [])}`, "provider_html_error", status);
+            }
+            if (status >= 500) {
+                throw new LlmCallError(`LLM provider error (${status}) ${config.endpoint}: ${safeBody}`, "provider_error", status);
+            }
+            throw new LlmCallError(`LLM request failed (${status}) ${config.endpoint}: ${safeBody}`, "provider_error", status);
         }
-        if (status >= 500 && isHtmlResponse(rawBody)) {
-            throw new LlmCallError(`LLM provider returned HTML instead of JSON (${status}) ${config.endpoint}: ${htmlExcerpt(rawBody)}`, "provider_html_error", status);
+        // A 2xx response is still an error if the body is HTML where JSON was
+        // expected (e.g. a provider serving its web UI). Read the raw body first so
+        // we can categorize an HTML page distinctly from a malformed-JSON parse_error.
+        let rawOkBody;
+        try {
+            rawOkBody = await readBodyWithByteCap(response, undefined, {
+                ...(requestDeadlineAt === null ? {} : { bodyTimeoutMs: remainingAttemptMs() }),
+                signal: options?.signal,
+            });
         }
-        if (status >= 500) {
-            throw new LlmCallError(`LLM provider error (${status}) ${config.endpoint}: ${safeBody}`, "provider_error", status);
+        catch (err) {
+            if (options?.signal?.aborted)
+                throw new LlmCallError("LLM response read aborted", "aborted");
+            if (err instanceof Error && err.name === "BodyReadTimeoutError") {
+                throw new LlmCallError("LLM response body read timed out", "timeout");
+            }
+            throw err;
         }
-        throw new LlmCallError(`LLM request failed (${status}) ${config.endpoint}: ${safeBody}`, "provider_error", status);
-    }
-    // A 2xx response is still an error if the body is HTML where JSON was
-    // expected (e.g. a provider serving its web UI). Read the raw body first so
-    // we can categorize an HTML page distinctly from a malformed-JSON parse_error.
-    const rawOkBody = await response.text();
-    if (isHtmlResponse(rawOkBody)) {
-        throw new LlmCallError(`LLM provider returned HTML instead of JSON (${response.status}) ${config.endpoint}: ${htmlExcerpt(rawOkBody)}`, "provider_html_error", response.status);
-    }
-    let json;
-    try {
-        json = JSON.parse(rawOkBody);
+        if (isHtmlResponse(rawOkBody)) {
+            throw new LlmCallError(`LLM provider returned HTML instead of JSON (${response.status}) ${config.endpoint}: ${redactSensitiveText(htmlExcerpt(rawOkBody), resolvedKey ? [resolvedKey] : [])}`, "provider_html_error", response.status);
+        }
+        let json;
+        try {
+            json = JSON.parse(rawOkBody);
+        }
+        catch {
+            throw new LlmCallError(`LLM response was not valid JSON ${config.endpoint}: ${redactSensitiveText(redactErrorBody(rawOkBody), resolvedKey ? [resolvedKey] : [])}`, "parse_error", response.status);
+        }
+        const responseModel = typeof json.model === "string" && json.model.trim().length > 0 ? json.model : undefined;
+        terminalFields = {
+            model: responseModel ?? config.model,
+            modelSource: responseModel === undefined ? "configured" : "response",
+            finishReason: typeof json.choices?.[0]?.finish_reason === "string" ? json.choices[0].finish_reason : undefined,
+            ...extractUsageTokens(json.usage),
+        };
+        const content = (json.choices?.[0]?.message?.content ?? "").trim();
+        const reasoning = (json.choices?.[0]?.message?.reasoning_content ?? "").trim();
+        const result = redactSensitiveText(content || reasoning, resolvedKey ? [resolvedKey] : []);
+        emitLlmUsage({
+            ...terminalFields,
+            outcome: "success",
+            durationMs: Date.now() - requestStartedAt,
+        });
+        return result;
     }
-    catch {
-        throw new LlmCallError(`LLM response was not valid JSON ${config.endpoint}: ${redactErrorBody(rawOkBody)}`, "parse_error", response.status);
+    catch (err) {
+        emitLlmUsage({
+            ...terminalFields,
+            outcome: "error",
+            durationMs: Date.now() - requestStartedAt,
+            errorCode: err instanceof LlmCallError ? err.code : "unknown_error",
+        });
+        throw err;
     }
-    // Per-call usage telemetry (#576). Best-effort and fully isolated: a missing
-    // or garbled usage block still records duration + model, and a throwing sink
-    // can never fail the call (emitLlmUsage swallows its own errors). The stage
-    // is supplied ambiently by emitLlmUsage; no `stage` param is threaded here.
-    emitLlmUsage({
-        model: typeof json.model === "string" && json.model ? json.model : config.model,
-        durationMs: Date.now() - requestStartedAt,
-        finishReason: typeof json.choices?.[0]?.finish_reason === "string" ? json.choices[0].finish_reason : undefined,
-        ...extractUsageTokens(json.usage),
-    });
-    const content = (json.choices?.[0]?.message?.content ?? "").trim();
-    const reasoning = (json.choices?.[0]?.message?.reasoning_content ?? "").trim();
-    return content || reasoning;
-}
-/**
- * Strip `<think>` blocks, code fences, and escape control characters in JSON
- * strings. Thin wrapper kept for backward compatibility with call sites that
- * import `stripJsonFences` from this module. New code should prefer the
- * granular helpers from `../core/parse`.
- */
-export function stripJsonFences(raw) {
-    return escapeJsonStringControls(stripCodeFences(stripThinkBlocks(raw)));
 }
 // ── Availability check ──────────────────────────────────────────────────────
 /**
@@ -325,6 +383,16 @@ export async function isLlmAvailable(config) {
     }
 }
 // ── Capability probe ────────────────────────────────────────────────────────
+const CAPABILITY_PROBE_JSON_SCHEMA = {
+    type: "object",
+    properties: {
+        ok: { type: "boolean", const: true },
+        ingest: { type: "boolean", const: true },
+        lint: { type: "boolean", const: true },
+    },
+    required: ["ok", "ingest", "lint"],
+    additionalProperties: false,
+};
 /**
  * Ask the model to emit a strict JSON object so we know whether the knowledge
  * wiki ingest/lint flows can rely on structured output. Failure is non-fatal —
@@ -332,7 +400,7 @@ export async function isLlmAvailable(config) {
  */
 export async function probeLlmCapabilities(config) {
     try {
-        const raw = await chatCompletion(config, [
+        const raw = await chatCompletion({ ...config, supportsJsonSchema: true }, [
             {
                 role: "system",
                 content: "You return only valid JSON. No prose, no markdown fences.",
@@ -341,13 +409,17 @@ export async function probeLlmCapabilities(config) {
                 role: "user",
                 content: 'Return exactly this JSON object and nothing else: {"ok": true, "ingest": true, "lint": true}',
             },
-        ], { maxTokens: 64, temperature: 0 });
+        ], { maxTokens: 64, temperature: 0, responseSchema: CAPABILITY_PROBE_JSON_SCHEMA });
         if (!raw)
             return { reachable: false, structuredOutput: false, error: "empty response" };
         const parsed = parseJsonResponse(raw);
         return {
             reachable: true,
-            structuredOutput: Boolean(parsed && parsed.ok === true),
+            structuredOutput: Boolean(parsed &&
+                Object.keys(parsed).length === 3 &&
+                parsed.ok === true &&
+                parsed.ingest === true &&
+                parsed.lint === true),
         };
     }
     catch (err) {

package/dist/llm/embedders/deterministic.js

@@ -49,7 +49,7 @@ export function deterministicEmbed(text, dim = DETERMINISTIC_EMBED_DIM) {
         const idx = h % dim;
         // Use a higher bit for the sign so it is independent of the bucket index.
         const sign = (h >>> 16) & 1 ? 1 : -1;
-        vec[idx] += sign;
+        vec[idx] = vec[idx] + sign;
     }
     let norm = 0;
     for (const v of vec)
@@ -61,6 +61,6 @@ export function deterministicEmbed(text, dim = DETERMINISTIC_EMBED_DIM) {
         return vec;
     }
     for (let i = 0; i < dim; i++)
-        vec[i] /= norm;
+        vec[i] = vec[i] / norm;
     return vec;
 }