akm-cli 0.9.0-rc.8 → 0.9.0

package/dist/llm/client.js

@@ -4,23 +4,17 @@
 /**
  * Low-level OpenAI-compatible chat completions client and capability probing.
  *
- * Split out of `llm.ts` to keep the transport-layer concerns (HTTP request,
- * response parsing, JSON-fence stripping, capability probe, availability
- * check) separate from higher-level metadata-enhancement workflows.
- *
- * `llm.ts` re-exports everything from this module for backward compatibility.
+ * Keeps transport-layer concerns (HTTP request, response parsing, capability
+ * probing, and availability checks) separate from higher-level workflows.
  */
-import { fetchWithTimeout } from "../core/common.js";
+import { fetchWithTimeout, readBodyWithByteCap } from "../core/common.js";
 import { resolveSecret } from "../core/config/config.js";
 import { formatExtraParamsIssue, validateExtraParams } from "../core/extra-params.js";
-import { escapeJsonStringControls, parseJsonResponse, stripCodeFences, stripThinkBlocks } from "../core/parse.js";
-import { redactSensitiveText } from "../core/redaction.js";
+import { parseJsonResponse } from "../core/parse.js";
+import { redactCredentialPatterns, redactSensitiveText } from "../core/redaction.js";
 import { warnVerbose } from "../core/warn.js";
 import { DEFAULT_LLM_TIMEOUT_MS } from "../integrations/agent/config.js";
-import { emitLlmUsage, extractUsageTokens } from "./usage-telemetry.js";
-// Re-export shared parse utilities so existing importers of `client.ts` continue
-// to resolve `parseJsonResponse` and `parseEmbeddedJsonResponse` from this module.
-export { escapeJsonStringControls, parseEmbeddedJsonResponse, parseJsonResponse, stripCodeFences, stripThinkBlocks, } from "../core/parse.js";
+import { emitLlmUsage, extractUsageTokens, } from "./usage-telemetry.js";
 /** Maximum length of an LLM error response body included in thrown errors. */
 const ERROR_BODY_MAX_LEN = 200;
 /** Stable OpenAI-compatible response-schema name used for every structured call. */
@@ -30,24 +24,14 @@ const JSON_SCHEMA_RESPONSE_NAME = "akm_response";
  * including it in a thrown Error. The body is also trimmed to a fixed length
  * so that a verbose provider response cannot leak large amounts of context.
  *
- * Targets:
- *  - `Bearer <token>` headers echoed back by the provider
- *  - `sk-…` / `sk_…` style API keys (OpenAI / Anthropic-shaped)
- *  - `key-…` / `key_…` shorthand keys
- *  - `"api_key": "…"` / `"apiKey": "…"` JSON fields
+ * The pattern set itself lives in {@link redactCredentialPatterns}
+ * (src/core/redaction.ts) so other output paths (e.g. task run logs) can
+ * reuse it without this function's length cap.
  */
 export function redactErrorBody(input) {
     if (!input)
         return "";
-    let out = input
-        // Bearer tokens (case-insensitive)
-        .replace(/\bBearer\s+[A-Za-z0-9._\-+/=]+/gi, "Bearer [REDACTED]")
-        // sk-/sk_ style keys
-        .replace(/\bsk[-_][A-Za-z0-9._-]{6,}/g, "[REDACTED]")
-        // key-/key_ shorthand keys
-        .replace(/\bkey[-_][A-Za-z0-9._-]{6,}/g, "[REDACTED]")
-        // JSON-style "api_key": "...", "apiKey": "...", "api-key": "..."
-        .replace(/("(?:api[_-]?key|apiKey|authorization|token)"\s*:\s*")([^"]*)(")/gi, "$1[REDACTED]$3");
+    let out = redactCredentialPatterns(input);
     if (out.length > ERROR_BODY_MAX_LEN) {
         out = `${out.slice(0, ERROR_BODY_MAX_LEN)}…`;
     }
@@ -103,6 +87,19 @@ const RETRY_BUDGET_FRACTION = 0.9;
 export function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
+async function waitForRetry(ms, wait, signal) {
+    if (!signal)
+        return wait(ms);
+    if (signal.aborted)
+        throw new LlmCallError("LLM request aborted", "aborted");
+    await new Promise((resolve, reject) => {
+        const onAbort = () => reject(new LlmCallError("LLM request aborted", "aborted"));
+        signal.addEventListener("abort", onAbort, { once: true });
+        wait(ms)
+            .then(resolve, reject)
+            .finally(() => signal.removeEventListener("abort", onAbort));
+    });
+}
 /** Compute a uniform jittered backoff in the [200, 800)ms range. */
 function retryBackoffMs() {
     return RETRY_BACKOFF_MIN_MS + Math.random() * (RETRY_BACKOFF_MAX_MS - RETRY_BACKOFF_MIN_MS);
@@ -209,7 +206,7 @@ async function chatCompletionReal(config, messages, options) {
         // authoritative.
         warnVerbose(`[akm] LLM transient failure (${err.code}); retrying once: ${err.message}`);
         const wait = retryBackoffMs();
-        await (options?.sleep ?? sleep)(wait);
+        await waitForRetry(wait, options?.sleep ?? sleep, options?.signal);
         // The retry must not exceed the original budget.
         return await chatCompletionAttempt(config, messages, options, remaining);
     }
@@ -248,90 +245,129 @@ async function chatCompletionAttempt(config, messages, options, timeoutMs) {
         : config.provider === "vllm"
             ? { chat_template_kwargs: { enable_thinking: resolvedEnableThinking } }
             : { enable_thinking: resolvedEnableThinking };
-    // Wall-clock start for per-call usage telemetry (#576). Captured here so the
+    const requestBody = JSON.stringify({
+        model: config.model,
+        messages,
+        temperature: options?.temperature ?? config.temperature ?? 0.3,
+        ...(resolvedMaxTokens !== undefined ? { max_tokens: resolvedMaxTokens } : {}),
+        ...responseFormat,
+        ...thinkingParams,
+        ...config.extraParams,
+    });
+    // Wall-clock start for per-attempt usage telemetry (#576). Captured here so the
     // emitted duration covers the full request/response/parse cycle of a single
     // attempt, not the retry-wrapping `chatCompletion`.
     const requestStartedAt = Date.now();
-    let response;
+    const requestDeadlineAt = timeoutMs === null ? null : requestStartedAt + timeoutMs;
+    const remainingAttemptMs = () => requestDeadlineAt === null ? undefined : Math.max(0, requestDeadlineAt - Date.now());
+    let terminalFields = {
+        model: config.model,
+        modelSource: "configured",
+    };
     try {
-        response = await fetchWithTimeout(config.endpoint, {
-            method: "POST",
-            headers,
-            body: JSON.stringify({
-                model: config.model,
-                messages,
-                temperature: options?.temperature ?? config.temperature ?? 0.3,
-                ...(resolvedMaxTokens !== undefined ? { max_tokens: resolvedMaxTokens } : {}),
-                ...responseFormat,
-                ...thinkingParams,
-                ...config.extraParams,
-            }),
-        }, timeoutMs, options?.signal);
-    }
-    catch (err) {
-        // fetchWithTimeout throws a plain Error with a message containing
-        // "timed out" for AbortController-driven timeouts, or "aborted" for
-        // caller-driven cancellations. Map both to typed LlmCallError.
-        const msg = err instanceof Error ? err.message : String(err);
-        if (err instanceof DOMException && err.name === "AbortError") {
-            throw new LlmCallError(`Request timed out${timeoutMs === null ? "" : ` after ${timeoutMs}ms`}`, "timeout");
+        let response;
+        try {
+            response = await fetchWithTimeout(config.endpoint, {
+                method: "POST",
+                headers,
+                body: requestBody,
+            }, timeoutMs, options?.signal);
         }
-        if (msg.includes("timed out")) {
-            throw new LlmCallError(`Request timed out${timeoutMs === null ? "" : ` after ${timeoutMs}ms`}`, "timeout");
+        catch (err) {
+            // fetchWithTimeout throws a plain Error with a message containing
+            // "timed out" for AbortController-driven timeouts, or "aborted" for
+            // caller-driven cancellations. Map both to typed LlmCallError.
+            const msg = err instanceof Error ? err.message : String(err);
+            if (options?.signal?.aborted || msg.includes("Request aborted")) {
+                throw new LlmCallError("LLM request aborted", "aborted");
+            }
+            if (err instanceof DOMException && err.name === "AbortError") {
+                throw new LlmCallError(`Request timed out${timeoutMs === null ? "" : ` after ${timeoutMs}ms`}`, "timeout");
+            }
+            if (msg.includes("timed out")) {
+                throw new LlmCallError(`Request timed out${timeoutMs === null ? "" : ` after ${timeoutMs}ms`}`, "timeout");
+            }
+            throw new LlmCallError(`Network error: ${msg}`, "network_error");
         }
-        throw new LlmCallError(`Network error: ${msg}`, "network_error");
-    }
-    if (!response.ok) {
-        const rawBody = await response.text().catch(() => "");
-        const safeBody = redactSensitiveText(redactErrorBody(rawBody), resolvedKey ? [resolvedKey] : []);
-        const status = response.status;
-        if (status === 429) {
-            throw new LlmCallError(`LLM request rate limited (429) ${config.endpoint}: ${safeBody}`, "rate_limited", status);
+        if (!response.ok) {
+            const rawBody = await readBodyWithByteCap(response, undefined, {
+                ...(requestDeadlineAt === null ? {} : { bodyTimeoutMs: remainingAttemptMs() }),
+                signal: options?.signal,
+            }).catch((err) => {
+                if (options?.signal?.aborted)
+                    throw new LlmCallError("LLM response read aborted", "aborted");
+                if (err instanceof Error && err.name === "BodyReadTimeoutError") {
+                    throw new LlmCallError("LLM response body read timed out", "timeout");
+                }
+                return "";
+            });
+            const safeBody = redactSensitiveText(redactErrorBody(rawBody), resolvedKey ? [resolvedKey] : []);
+            const status = response.status;
+            if (status === 429) {
+                throw new LlmCallError(`LLM request rate limited (429) ${config.endpoint}: ${safeBody}`, "rate_limited", status);
+            }
+            if (status >= 500 && isHtmlResponse(rawBody)) {
+                throw new LlmCallError(`LLM provider returned HTML instead of JSON (${status}) ${config.endpoint}: ${redactSensitiveText(htmlExcerpt(rawBody), resolvedKey ? [resolvedKey] : [])}`, "provider_html_error", status);
+            }
+            if (status >= 500) {
+                throw new LlmCallError(`LLM provider error (${status}) ${config.endpoint}: ${safeBody}`, "provider_error", status);
+            }
+            throw new LlmCallError(`LLM request failed (${status}) ${config.endpoint}: ${safeBody}`, "provider_error", status);
         }
-        if (status >= 500 && isHtmlResponse(rawBody)) {
-            throw new LlmCallError(`LLM provider returned HTML instead of JSON (${status}) ${config.endpoint}: ${redactSensitiveText(htmlExcerpt(rawBody), resolvedKey ? [resolvedKey] : [])}`, "provider_html_error", status);
+        // A 2xx response is still an error if the body is HTML where JSON was
+        // expected (e.g. a provider serving its web UI). Read the raw body first so
+        // we can categorize an HTML page distinctly from a malformed-JSON parse_error.
+        let rawOkBody;
+        try {
+            rawOkBody = await readBodyWithByteCap(response, undefined, {
+                ...(requestDeadlineAt === null ? {} : { bodyTimeoutMs: remainingAttemptMs() }),
+                signal: options?.signal,
+            });
         }
-        if (status >= 500) {
-            throw new LlmCallError(`LLM provider error (${status}) ${config.endpoint}: ${safeBody}`, "provider_error", status);
+        catch (err) {
+            if (options?.signal?.aborted)
+                throw new LlmCallError("LLM response read aborted", "aborted");
+            if (err instanceof Error && err.name === "BodyReadTimeoutError") {
+                throw new LlmCallError("LLM response body read timed out", "timeout");
+            }
+            throw err;
         }
-        throw new LlmCallError(`LLM request failed (${status}) ${config.endpoint}: ${safeBody}`, "provider_error", status);
-    }
-    // A 2xx response is still an error if the body is HTML where JSON was
-    // expected (e.g. a provider serving its web UI). Read the raw body first so
-    // we can categorize an HTML page distinctly from a malformed-JSON parse_error.
-    const rawOkBody = await response.text();
-    if (isHtmlResponse(rawOkBody)) {
-        throw new LlmCallError(`LLM provider returned HTML instead of JSON (${response.status}) ${config.endpoint}: ${redactSensitiveText(htmlExcerpt(rawOkBody), resolvedKey ? [resolvedKey] : [])}`, "provider_html_error", response.status);
-    }
-    let json;
-    try {
-        json = JSON.parse(rawOkBody);
+        if (isHtmlResponse(rawOkBody)) {
+            throw new LlmCallError(`LLM provider returned HTML instead of JSON (${response.status}) ${config.endpoint}: ${redactSensitiveText(htmlExcerpt(rawOkBody), resolvedKey ? [resolvedKey] : [])}`, "provider_html_error", response.status);
+        }
+        let json;
+        try {
+            json = JSON.parse(rawOkBody);
+        }
+        catch {
+            throw new LlmCallError(`LLM response was not valid JSON ${config.endpoint}: ${redactSensitiveText(redactErrorBody(rawOkBody), resolvedKey ? [resolvedKey] : [])}`, "parse_error", response.status);
+        }
+        const responseModel = typeof json.model === "string" && json.model.trim().length > 0 ? json.model : undefined;
+        terminalFields = {
+            model: responseModel ?? config.model,
+            modelSource: responseModel === undefined ? "configured" : "response",
+            finishReason: typeof json.choices?.[0]?.finish_reason === "string" ? json.choices[0].finish_reason : undefined,
+            ...extractUsageTokens(json.usage),
+        };
+        const content = (json.choices?.[0]?.message?.content ?? "").trim();
+        const reasoning = (json.choices?.[0]?.message?.reasoning_content ?? "").trim();
+        const result = redactSensitiveText(content || reasoning, resolvedKey ? [resolvedKey] : []);
+        emitLlmUsage({
+            ...terminalFields,
+            outcome: "success",
+            durationMs: Date.now() - requestStartedAt,
+        });
+        return result;
     }
-    catch {
-        throw new LlmCallError(`LLM response was not valid JSON ${config.endpoint}: ${redactSensitiveText(redactErrorBody(rawOkBody), resolvedKey ? [resolvedKey] : [])}`, "parse_error", response.status);
+    catch (err) {
+        emitLlmUsage({
+            ...terminalFields,
+            outcome: "error",
+            durationMs: Date.now() - requestStartedAt,
+            errorCode: err instanceof LlmCallError ? err.code : "unknown_error",
+        });
+        throw err;
     }
-    // Per-call usage telemetry (#576). Best-effort and fully isolated: a missing
-    // or garbled usage block still records duration + model, and a throwing sink
-    // can never fail the call (emitLlmUsage swallows its own errors). The stage
-    // is supplied ambiently by emitLlmUsage; no `stage` param is threaded here.
-    emitLlmUsage({
-        model: typeof json.model === "string" && json.model ? json.model : config.model,
-        durationMs: Date.now() - requestStartedAt,
-        finishReason: typeof json.choices?.[0]?.finish_reason === "string" ? json.choices[0].finish_reason : undefined,
-        ...extractUsageTokens(json.usage),
-    });
-    const content = (json.choices?.[0]?.message?.content ?? "").trim();
-    const reasoning = (json.choices?.[0]?.message?.reasoning_content ?? "").trim();
-    return redactSensitiveText(content || reasoning, resolvedKey ? [resolvedKey] : []);
-}
-/**
- * Strip `<think>` blocks, code fences, and escape control characters in JSON
- * strings. Thin wrapper kept for backward compatibility with call sites that
- * import `stripJsonFences` from this module. New code should prefer the
- * granular helpers from `../core/parse`.
- */
-export function stripJsonFences(raw) {
-    return escapeJsonStringControls(stripCodeFences(stripThinkBlocks(raw)));
 }
 // ── Availability check ──────────────────────────────────────────────────────
 /**

package/dist/llm/embedders/remote.js

@@ -7,7 +7,7 @@
  * Calls the configured `/embeddings` endpoint and L2-normalizes the returned
  * vectors so the scoring pipeline's L2-to-cosine conversion is correct.
  */
-import { fetchWithTimeout, isHttpUrl } from "../../core/common.js";
+import { fetchWithTimeout, isHttpUrl, readBodyWithByteCap } from "../../core/common.js";
 import { resolveSecret } from "../../core/config/config.js";
 const DEFAULT_REMOTE_BATCH_SIZE = 100;
 /** Cheap token estimator: 4 chars ≈ 1 token. Used in verbose logging and error messages. */
@@ -49,10 +49,14 @@ export class RemoteEmbedder {
             body: JSON.stringify(body),
         }, 30_000, signal);
         if (!response.ok) {
-            const errBody = await response.text().catch(() => "");
+            const errBody = await readBodyWithByteCap(response, undefined, { bodyTimeoutMs: 30_000, signal }).catch((err) => {
+                if (signal?.aborted)
+                    throw err;
+                return "";
+            });
             throw new Error(`Embedding request failed (${response.status}): ${errBody}`);
         }
-        const json = (await response.json());
+        const json = JSON.parse(await readBodyWithByteCap(response, undefined, { bodyTimeoutMs: 30_000, signal }));
         if (!json.data?.[0]?.embedding) {
             throw new Error(`Unexpected embedding response format: missing data[0].embedding.${embeddingEndpointPathHint(this.endpoint)}`);
         }
@@ -85,10 +89,14 @@ export class RemoteEmbedder {
                 body: JSON.stringify(body),
             }, 30_000, signal);
             if (!response.ok) {
-                const respBody = await response.text().catch(() => "");
+                const respBody = await readBodyWithByteCap(response, undefined, { bodyTimeoutMs: 30_000, signal }).catch((err) => {
+                    if (signal?.aborted)
+                        throw err;
+                    return "";
+                });
                 throw new Error(`Embedding batch request failed (${response.status}): ${respBody}`);
             }
-            const json = (await response.json());
+            const json = JSON.parse(await readBodyWithByteCap(response, undefined, { bodyTimeoutMs: 30_000, signal }));
             if (!json.data || json.data.length !== batch.length) {
                 throw new Error(`Unexpected embedding batch response: expected ${batch.length} embeddings, got ${json.data?.length ?? 0}.${embeddingEndpointPathHint(this.endpoint)}`);
             }

package/dist/llm/feature-gate.js

@@ -3,16 +3,11 @@
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 /**
  * For each feature key, return the effective enabled state by reading the
- * 0.9.0 config shape. Defaults match the legacy `LlmFeatureFlags` docstrings.
+ * 0.9.0 config shape.
  */
-// Defaults below mirror the legacy LlmFeatureFlags docstrings so existing
-// behaviour is preserved when a config is silent on a flag.
 const FEATURE_LOCATION = {
-    // Legacy default: true
     memory_inference: (cfg) => cfg.index?.memory?.enabled ?? true,
-    // Legacy default: true
     graph_extraction: (cfg) => cfg.index?.graph?.enabled ?? true,
-    // Legacy default: false
     metadata_enhance: (cfg) => cfg.index?.metadataEnhance?.enabled ?? false,
     // Always on at the LLM-wrapper level. Enablement is decided ONCE at the
     // extract entry point (`akmExtract`): the `extract.enabled` process toggle
@@ -26,8 +21,7 @@ const FEATURE_LOCATION = {
 /**
  * Pure predicate: is the named feature gate enabled in `config`?
  *
- * Reads from the unified 0.9.0 config shape. Defaults follow the legacy
- * `LlmFeatureFlags` docstring defaults.
+ * Reads from the unified 0.9.0 config shape.
  */
 export function isLlmFeatureEnabled(config, feature, improveEnabled) {
     if (!config)
@@ -71,10 +65,8 @@ export async function tryLlmFeature(feature, config, fn, fallback, opts) {
     }
 }
 /**
- * Section-agnostic process gate. After the 0.8.0 migration, the canonical
- * accessor is the `FEATURE_LOCATION` map above; this helper exists so older
- * call sites that knew the (section, processName) pair don't all need to
- * relearn the new mapping.
+ * Section-agnostic process gate that maps process identifiers to their current
+ * config locations.
  *
  * For unknown (section, processName) pairs the result is `false`.
  */

package/dist/llm/graph-extract.js

@@ -7,7 +7,7 @@
  * Given a single asset body (typically a `memory:` or `knowledge:` file),
  * asks the configured LLM to surface the entities mentioned in it and the
  * relations between them. The pass itself
- * (`src/indexer/graph-extraction.ts`) is responsible for deciding which
+ * (`src/indexer/graph/graph-extraction.ts`) is responsible for deciding which
  * files to extract, persisting the resulting nodes/edges to the index DB,
  * and feeding the graph data into the FTS5+boosts
  * search pipeline as a single boost component.
@@ -15,16 +15,15 @@
  * This module is intentionally tiny and stateless so tests can stub it via
  * `mock.module("../src/llm/graph-extract", ...)` without hitting a network.
  *
- * Locked v1 contract (#208): the LLM connection always comes from the
- * selected named LLM engine. Callers obtain
- * the connection via `resolveIndexPassLLM("graph", config)` and pass it
- * straight through.
+ * The LLM connection comes from the selected named engine. Callers obtain it
+ * via `resolveIndexPassLLM("graph", config)` and pass it straight through.
  */
 import systemPromptTemplate from "../assets/prompts/graph-extract-system.md" with { type: "text" };
 import userPromptTemplate from "../assets/prompts/graph-extract-user-prompt.md" with { type: "text" };
 import { toErrorMessage } from "../core/common.js";
+import { parseEmbeddedJsonResponse } from "../core/parse.js";
 import { warn, warnVerbose } from "../core/warn.js";
-import { chatCompletion, isContextSizeError, parseEmbeddedJsonResponse } from "./client.js";
+import { chatCompletion, isContextSizeError } from "./client.js";
 import { tryLlmFeature } from "./feature-gate.js";
 import { callStructured } from "./structured-call.js";
 /**
@@ -47,11 +46,6 @@ const SYSTEM_PROMPT = systemPromptTemplate;
 const USER_PROMPT_PREFIX = userPromptTemplate
     .replace("{{MAX_ENTITIES}}", String(MAX_ENTITIES_PER_ASSET))
     .replace("{{MAX_RELATIONS}}", String(MAX_RELATIONS_PER_ASSET));
-// `isContextSizeError` is defined in `./client` and re-exported here so the
-// graph extractor and the retry classifier (`isRetryable`) share one
-// definition (#496). Re-exported (not just imported) to preserve existing
-// importers of this module — including its unit test.
-export { isContextSizeError } from "./client.js";
 const GENERIC_ENTITIES = new Set([
     "agent",
     "application",

package/dist/llm/memory-infer.js

@@ -1,4 +1,147 @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
-export { compressMemoryToDerivedMemory, } from "./memory-infer-impl.js";
+/**
+ * LLM helper for the `akm index` memory-inference pass (#201).
+ *
+ * Compresses a single memory body into one higher-signal derived memory. The
+ * pass itself (in `src/indexer/passes/memory-inference.ts`) is responsible for
+ * deciding which memories are pending, persisting the derived memory with the
+ * correct frontmatter (`inferred: true`, `source: <parent-ref>`), and marking
+ * the parent as processed for idempotency.
+ *
+ * This module is intentionally tiny and stateless so tests can stub it via
+ * `mock.module("../src/llm/memory-infer", ...)` without hitting a network.
+ *
+ * The LLM connection comes from the selected named engine. Callers obtain it
+ * via `resolveIndexPassLLM("memory", config)` and pass it straight through.
+ */
+import memoryInferSystemPrompt from "../assets/prompts/memory-infer-system.md" with { type: "text" };
+import memoryInferUserPrompt from "../assets/prompts/memory-infer-user.md" with { type: "text" };
+import { toErrorMessage } from "../core/common.js";
+import { parseEmbeddedJsonResponse } from "../core/parse.js";
+import { warn } from "../core/warn.js";
+import { callStructured } from "./structured-call.js";
+/** Hard cap on body chars sent to the model — pragmatic and matches `runLlmEnrich`. */
+const MAX_BODY_CHARS = 4000;
+const SYSTEM_PROMPT = memoryInferSystemPrompt;
+const USER_PROMPT_PREFIX = memoryInferUserPrompt;
+const PROMPT_PLACEHOLDERS = new Set([
+    "short title string",
+    "one sentence summary string",
+    "tag1",
+    "tag2",
+    "search phrase 1",
+    "search phrase 2",
+    "2-3 sentence compressed body preserving key facts verbatim",
+]);
+/**
+ * Strict JSON Schema for the derived-memory payload. Sent to providers that
+ * opt in via `ChatCompletionConfig.supportsJsonSchema = true`; the client
+ * silently drops the schema for providers that don't.
+ *
+ * Extends the responseSchema lift (PR 1, asset-writers-investigation §5) to
+ * the memory-inference path. Mirrors the validation gate below
+ * (title/description/content + non-empty tags/searchHints) so a
+ * schema-compliant response is guaranteed to pass the downstream check
+ * — no more "incomplete derived memory payload from LLM; skipping memory"
+ * for shape-only failures.
+ */
+const DERIVED_MEMORY_JSON_SCHEMA = {
+    type: "object",
+    properties: {
+        title: { type: "string", minLength: 1 },
+        description: { type: "string", minLength: 1 },
+        content: { type: "string", minLength: 1 },
+        tags: { type: "array", items: { type: "string" }, minItems: 1, maxItems: 8 },
+        searchHints: { type: "array", items: { type: "string" }, minItems: 1, maxItems: 6 },
+    },
+    required: ["title", "description", "content", "tags", "searchHints"],
+    additionalProperties: false,
+};
+/**
+ * Compress a single memory body into one derived memory via the configured LLM.
+ *
+ * Returns `undefined` on any failure (timeout, invalid JSON, empty response).
+ * Errors are logged via `warn()` but never thrown — a failed split for one memory
+ * must not abort the rest of the index pass.
+ *
+ * Routes through `callStructured({ feature: "memory_inference", ... })` so the
+ * feature gate, error classification, and onFallback hook are honoured uniformly
+ * (Fix C5).
+ */
+export async function compressMemoryToDerivedMemory(llmConfig, body, signal, akmConfig, onFallback, telemetry, onRetryAttempt) {
+    const trimmedBody = body.trim();
+    if (!trimmedBody)
+        return undefined;
+    const userPrompt = `${USER_PROMPT_PREFIX}${trimmedBody.slice(0, MAX_BODY_CHARS)}`;
+    // Memory inference is always gated: no config closes the gate instead of
+    // taking callStructured's ungated path for direct callers.
+    if (!akmConfig) {
+        onFallback?.({ feature: "memory_inference", reason: "disabled" });
+        return undefined;
+    }
+    return callStructured({
+        feature: "memory_inference",
+        akmConfig,
+        config: llmConfig,
+        messages: [
+            { role: "system", content: SYSTEM_PROMPT },
+            { role: "user", content: userPrompt },
+        ],
+        request: {
+            temperature: 0.1,
+            timeoutMs: llmConfig.timeoutMs,
+            signal,
+            responseSchema: DERIVED_MEMORY_JSON_SCHEMA,
+            onRetryAttempt,
+        },
+        parse: (raw) => {
+            if (!raw)
+                return undefined;
+            const parsed = parseEmbeddedJsonResponse(raw);
+            if (!parsed) {
+                warn("memory inference: invalid JSON response from LLM; skipping memory.");
+                return undefined;
+            }
+            const title = typeof parsed.title === "string" ? parsed.title.trim() : "";
+            const description = typeof parsed.description === "string" ? parsed.description.trim() : "";
+            const content = typeof parsed.content === "string" ? parsed.content.trim() : "";
+            const tags = Array.isArray(parsed.tags)
+                ? parsed.tags
+                    .filter((t) => typeof t === "string")
+                    .map((t) => t.trim())
+                    .filter(Boolean)
+                    .slice(0, 8)
+                : [];
+            const searchHints = Array.isArray(parsed.searchHints)
+                ? parsed.searchHints
+                    .filter((h) => typeof h === "string")
+                    .map((h) => h.trim())
+                    .filter(Boolean)
+                    .slice(0, 6)
+                : [];
+            if (!title || !description || !content || tags.length === 0 || searchHints.length === 0) {
+                warn("memory inference: incomplete derived memory payload from LLM; skipping memory.");
+                return undefined;
+            }
+            if ([title, description, content, ...tags, ...searchHints].some((value) => PROMPT_PLACEHOLDERS.has(value.toLowerCase()))) {
+                warn("memory inference: prompt placeholder response from LLM; skipping memory.");
+                return undefined;
+            }
+            return { title, description, tags, searchHints, content };
+        },
+        onError: (cls, err) => {
+            if (cls === "html") {
+                if (telemetry)
+                    telemetry.htmlErrorCount = (telemetry.htmlErrorCount ?? 0) + 1;
+                warn(`memory inference: provider returned HTML instead of JSON; skipping memory: ${toErrorMessage(err)}`);
+                return undefined;
+            }
+            warn(`memory inference failed: ${toErrorMessage(err)}`);
+            return undefined;
+        },
+        fallback: undefined,
+        onFallback,
+    });
+}

package/dist/llm/metadata-enhance.js

@@ -4,12 +4,11 @@
 /**
  * LLM-driven metadata enhancement for stash entries.
  *
- * Split out of `llm.ts` so the higher-level workflow (prompting the LLM to
- * improve descriptions/tags/searchHints) lives separately from the low-level
- * transport client in `client.ts`.
+ * Keeps the higher-level workflow for improving descriptions, tags, and search
+ * hints separate from the low-level transport client.
  */
 import metadataEnhanceSystemPrompt from "../assets/prompts/metadata-enhance-system.md" with { type: "text" };
-import { parseJsonResponse } from "./client.js";
+import { parseJsonResponse } from "../core/parse.js";
 import { callStructured } from "./structured-call.js";
 const SYSTEM_PROMPT = metadataEnhanceSystemPrompt;
 /**
@@ -20,9 +19,8 @@ const SYSTEM_PROMPT = metadataEnhanceSystemPrompt;
  * `tryLlmFeature("metadata_enhance", ...)` so the feature gate is honoured: a
  * closed gate yields `{ status: "skipped" }` and a thrown/timed-out call yields
  * `{ status: "failed" }` — neither is reported as an enrichment. When
- * `akmConfig` is `undefined` the gate is bypassed entirely — the LLM call runs
- * unconditionally and errors propagate to the caller (pre-gate behaviour, used
- * by direct callers such as tests).
+ * `akmConfig` is `undefined` the gate is bypassed entirely: the LLM call runs
+ * unconditionally and errors propagate to direct callers such as tests.
  */
 export async function enhanceMetadata(config, entry, fileContent, signal, akmConfig) {
     const contextParts = [`Name: ${entry.name}`, `Type: ${entry.type}`];

package/dist/llm/structured-call.js

@@ -1,7 +1,7 @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
-import { chatCompletion, isContextSizeError, LlmCallError } from "./client.js";
+import { chatCompletion, isContextSizeError, LlmCallError, } from "./client.js";
 import { tryLlmFeature } from "./feature-gate.js";
 /**
  * Classify a thrown LLM error into one of the three buckets. This is the single