akm-cli 0.9.1 → 0.9.2-alpha.2

package/dist/commands/read/show.js

@@ -17,34 +17,34 @@
  */
 import fs from "node:fs";
 import path from "node:path";
+import { detectAdapterId } from "../../core/adapter/detect-adapter.js";
 import { recognizeMatch } from "../../core/adapter/recognize-match.js";
+import { assetPathForName, stashDirFor } from "../../core/asset/asset-placement.js";
 import { makeBundleRef, parseBundleRef } from "../../core/asset/asset-ref.js";
 import { parseFrontmatter } from "../../core/asset/frontmatter.js";
 import { extractSection, markdownFragmentSlugs } from "../../core/asset/markdown.js";
 import { displayRef, typeNameFromConceptId } from "../../core/asset/resolve-ref.js";
-import { META_DIR, parseMetaRef, resolveMetaFilePath } from "../../core/asset/stash-meta.js";
-import { asNonEmptyString } from "../../core/common.js";
+import { META_DIR, parseMetaRef, readMetaFile } from "../../core/asset/stash-meta.js";
+import { asNonEmptyString, isWithin } from "../../core/common.js";
 import { getIndexPassConfig, loadConfig } from "../../core/config/config.js";
 import { NotFoundError, rethrowIfTestIsolationError, UsageError } from "../../core/errors.js";
-import { appendEvent, readEvents } from "../../core/events.js";
-import { withStateDbTelemetry } from "../../core/state-db.js";
+import { appendEvent } from "../../core/events.js";
+import { SCRIPT_EXTENSIONS } from "../../core/recognition-util.js";
 import { presentationFor } from "../../core/type-presentation.js";
+import { warn } from "../../core/warn.js";
 import { hasGraphData } from "../../indexer/db/graph-db.js";
 import { listRelatedPathsForFile } from "../../indexer/graph/graph-boost.js";
 import { extractGraphForSingleFile } from "../../indexer/graph/graph-extraction.js";
-import { lookupBundleRef } from "../../indexer/indexer.js";
+import { lookupBundleRef, lookupBundleRefWithResolution } from "../../indexer/indexer.js";
 import { ensurePrimaryIndexForRead, resolveReadSources } from "../../indexer/read-preflight.js";
-import { usageEventAttributionMetadata } from "../../indexer/search/search-attribution.js";
-import { buildEditHint, findSourceForPath, isEditable, resolveSourceEntries } from "../../indexer/search/search-source.js";
-import { insertUsageEvent } from "../../indexer/usage/usage-events.js";
+import { buildEditHint, findSourceForPath, isEditable, resolveSourceEntries, } from "../../indexer/search/search-source.js";
+import { recentShowCount, recordShowUsage } from "../../indexer/usage/show-usage.js";
 import { buildFileContext, buildRenderContext, getRenderer, } from "../../indexer/walk/file-context.js";
-import { resolveAssetPath } from "../../indexer/walk/path-resolver.js";
-import { resolveIndexPassLLM } from "../../llm/index-passes.js";
+import { resolveIndexPassExecution } from "../../llm/index-passes.js";
 import { resolveSourcesForOrigin } from "../../registry/origin-resolve.js";
 import { resolveStorageLocations } from "../../storage/locations.js";
 import { closeDatabase, openExistingDatabase } from "../../storage/repositories/index-connection.js";
 import { TELEMETRY_BUSY_TIMEOUT_MS, withIndexDb } from "../../storage/repositories/index-db.js";
-import { findEntryIdByRef, getEntryById, getEntryIdByFilePath, getItemRefById, } from "../../storage/repositories/index-entries-repository.js";
 import { computeBodyHash } from "../../storage/repositories/index-llm-cache-repository.js";
 // Eagerly import source providers to trigger self-registration.
 import "../../sources/providers/index.js";
@@ -52,8 +52,9 @@ import { getCurrentWorkflowScopeKey } from "../../workflows/authoring/scope-key.
 import { buildWorkflowAction } from "../../workflows/renderer.js";
 import { getActiveWorkflowRun } from "../../workflows/runtime/runs.js";
 /**
- * Unified show: queries the local FTS5 index, then falls back to on-disk
- * type-dir resolution if the index has no row. Spec §6.2; no remote provider
+ * Unified show: queries the local FTS5 index, then reads that row's file path.
+ * A physical owner can arbitrate collisions during lookup, but show never
+ * renders an asset without an indexed row. Spec §6.2; no provider or disk
  * fallback.
  *
  * When `detail` is `"brief"` or `"summary"`, the response omits
@@ -70,6 +71,12 @@ export async function akmShowUnified(input) {
         if (metaRef)
             return showStashMeta(metaRef);
     }
+    // Env/secret bodies have no safe fragment surface. Reject from the canonical
+    // ref namespace before auto-index or lookup can touch authored bytes. This is
+    // deliberately independent of on-disk suffix probing: secret filenames keep
+    // their natural extension, and a misspelled extensionless ref must not move
+    // the sensitive-fragment policy behind a not-found result.
+    assertSensitiveFragmentUnsupported(parseBundleRef(ref));
     // Auto-index when stale so the index is current before lookup.
     const { primarySource } = resolveReadSources();
     await ensurePrimaryIndexForRead(primarySource);
@@ -86,7 +93,7 @@ export async function akmShowUnified(input) {
     if (!input.skipLogging) {
         const consumedRef = result.ref ?? makeBundleRef(undefined, parseBundleRef(ref).conceptId);
         const priorShowCount = recentShowCount(consumedRef);
-        logShowEvent(consumedRef, result.type, result.name, input.eventSource, result.path);
+        recordShowUsage(consumedRef, result.type, result.name, input.eventSource, result.path);
         if (priorShowCount >= 2) {
             // Agent has shown this same asset 3+ times — inject a loop-break hint.
             result.showLoopWarning = priorShowCount + 1;
@@ -111,18 +118,17 @@ async function showStashMeta(metaRef) {
     }
     const config = loadConfig();
     for (const source of sources) {
-        const filePath = resolveMetaFilePath(source.path, metaRef.name);
-        if (!filePath)
+        const metaFile = readMetaFile(source.path, metaRef.name);
+        if (!metaFile)
             continue;
-        const content = fs.readFileSync(filePath, "utf8");
-        const editable = isEditable(filePath, config, allSources);
+        const editable = isEditable(metaFile.path, config, allSources);
         appendEvent({ eventType: "show", ref: `meta:${metaRef.name}`, metadata: { type: "meta", name: metaRef.name } });
         return {
             type: "meta",
             name: metaRef.name,
-            path: filePath,
+            path: metaFile.path,
             ref: `meta:${metaRef.name}`,
-            content,
+            content: metaFile.content,
             origin: source.registryId ?? null,
             editable,
         };
@@ -168,127 +174,43 @@ function enforceScopeOrThrow(filePath, ref, scope) {
         }
     }
 }
-/**
- * Count how many times `ref` has been shown in the current session by reading
- * recent events. Returns the count BEFORE the current invocation.
- */
-function recentShowCount(ref) {
-    try {
-        const { events } = readEvents({
-            type: "show",
-            ref,
-            since: new Date(Date.now() - 60 * 60 * 1000).toISOString(),
-        });
-        return events.length;
-    }
-    catch {
-        return 0;
-    }
-}
-function logShowEvent(ref, type, name, eventSource = "user", filePath) {
-    // Emit a structured event to events.jsonl so workflow-trace consumers
-    // detect akm show invocations without relying on stdout scraping.
-    const eventRef = makeBundleRef(parseBundleRef(ref).bundle, parseBundleRef(ref).conceptId);
-    appendEvent({ eventType: "show", ref: eventRef, metadata: { type, name } });
-    // Detect if this show is a selection from a recent search result.
-    try {
-        // D7: bound the query to the last 60 s so we never scan unbounded history
-        const { events: recentSearches } = readEvents({
-            type: "search",
-            since: new Date(Date.now() - 60_000).toISOString(),
-        });
-        const cutoffMs = Date.now() - 60_000;
-        const matchingSearch = [...recentSearches].reverse().find((e) => {
-            if (!e.ts || new Date(e.ts).getTime() < cutoffMs)
-                return false;
-            const refs = e.metadata?.resultRefs ?? [];
-            return refs.includes(ref);
-        });
-        if (matchingSearch) {
-            appendEvent({
-                eventType: "select",
-                ref,
-                metadata: {
-                    query: matchingSearch.metadata?.query,
-                    searchTs: matchingSearch.ts,
-                    rankPosition: (matchingSearch.metadata?.resultRefs ?? []).indexOf(ref),
-                },
-            });
-        }
-    }
-    catch {
-        /* fire-and-forget — select is best-effort */
-    }
-    try {
-        withIndexDb((db) => {
-            const entryId = filePath ? getEntryIdByFilePath(db, filePath) : findEntryIdByRef(db, eventRef);
-            if (entryId === undefined)
-                return;
-            // Usage events carry only the resolved row's fully-qualified item_ref.
-            // A disk-only show has no durable indexed identity yet, so it does not
-            // create a per-entry usage row.
-            const entryRef = getItemRefById(db, entryId);
-            if (!entryRef)
-                return;
-            const entry = getEntryById(db, entryId);
-            withStateDbTelemetry((stateDb) => {
-                insertUsageEvent(stateDb, {
-                    event_type: "show",
-                    entry_ref: entryRef,
-                    entry_id: entryId,
-                    metadata: usageEventAttributionMetadata(entry?.entry.derivedFrom ? { memoryInference: { exposure: "direct" } } : undefined, entryRef),
-                    source: eventSource,
-                });
-            }, TELEMETRY_BUSY_TIMEOUT_MS);
-        }, { busyTimeoutMs: TELEMETRY_BUSY_TIMEOUT_MS });
-    }
-    catch (err) {
-        rethrowIfTestIsolationError(err);
-        /* fire-and-forget */
-    }
-}
 /** @internal Use akmShowUnified() for all external callers. */
 export async function showLocal(input) {
     const parsed = parseBundleRef(input.ref);
+    assertSensitiveFragmentUnsupported(parsed);
     const assetParts = typeNameFromConceptId(parsed.conceptId);
     const config = loadConfig();
     const allSources = resolveSourceEntries(input.stashDir);
     const searchSources = resolveSourcesForOrigin(parsed.bundle, allSources);
     const allSourceDirs = searchSources.map((s) => s.path);
-    let indexedEntry = null;
-    try {
-        indexedEntry = await lookupBundleRef(parsed);
-    }
-    catch (err) {
-        rethrowIfTestIsolationError(err);
-        indexedEntry = null;
-    }
-    const resolvedAssetPath = indexedEntry?.filePath ??
-        (assetParts
-            ? await resolveAssetPath({ type: assetParts.type, name: assetParts.name, origin: parsed.bundle }, {
-                stashDir: input.stashDir,
-                mode: "disk-only",
-            })
-            : null);
-    const assetPath = resolvedAssetPath ?? undefined;
-    const displayType = indexedEntry?.type ?? assetParts?.type ?? "asset";
-    const displayName = indexedEntry?.name ?? assetParts?.name ?? parsed.conceptId;
-    if (!assetPath && parsed.bundle && searchSources.length === 0) {
+    const resolution = await lookupBundleRefWithResolution(parsed);
+    if (resolution.indexError !== undefined)
+        throw resolution.indexError;
+    const indexedEntry = resolution.entry;
+    const assetPath = indexedEntry?.filePath;
+    if (!indexedEntry && parsed.bundle && searchSources.length === 0) {
         const installCmd = `akm bundle add ${parsed.bundle}`;
         throw new NotFoundError(`Stash asset not found for ref: ${makeBundleRef(parsed.bundle, parsed.conceptId)}. ` +
             `Stash "${parsed.bundle}" is not installed. Run: ${installCmd}`);
     }
-    if (!assetPath) {
+    if (!indexedEntry && !resolution.owner) {
+        const unsupportedExtension = existingUnsupportedScriptExtension(assetParts, searchSources);
+        if (unsupportedExtension !== undefined) {
+            const displayExtension = unsupportedExtension || "no extension";
+            throw new NotFoundError(`Script ref "${makeBundleRef(parsed.bundle, parsed.conceptId)}" resolves to an existing file with ` +
+                `unsupported extension "${displayExtension}". Script refs must use a supported script extension: ` +
+                `${[...SCRIPT_EXTENSIONS].join(", ")}.`, "ASSET_NOT_FOUND");
+        }
+    }
+    if (!indexedEntry || !assetPath) {
         throw new NotFoundError(`Stash asset not found for ref: ${makeBundleRef(parsed.bundle, parsed.conceptId)}. ` +
             "Check the name with `akm search` or verify the asset exists in your stash.");
     }
-    if (indexedEntry) {
-        try {
-            fs.accessSync(assetPath, fs.constants.R_OK);
-        }
-        catch (error) {
-            throwIndexedPathNotFound(error, input.ref);
-        }
+    try {
+        fs.accessSync(assetPath, fs.constants.R_OK);
+    }
+    catch (error) {
+        throwIndexedPathNotFound(error, input.ref);
     }
     const source = findSourceForPath(assetPath, allSources);
     const sourceStashDir = source?.path ?? allSourceDirs[0];
@@ -297,25 +219,24 @@ export async function showLocal(input) {
             "Run `akm bundle create` to create the stash directory, or check `akm bundle list` for configured paths.");
     }
     const fileCtx = buildFileContext(sourceStashDir, assetPath);
-    const indexedRenderer = indexedEntry ? rendererForIndexedEntry(indexedEntry, fileCtx) : undefined;
+    const presentedName = indexedEntry.name;
+    const indexedRenderer = rendererForIndexedEntry(indexedEntry, fileCtx);
     let response;
     try {
-        if (indexedEntry && indexedRenderer === null) {
+        if (indexedRenderer === null) {
             response = buildIndexedProjectionResponse(indexedEntry, assetPath, parsed.fragment);
         }
         else {
-            const match = indexedEntry && typeof indexedRenderer === "string"
-                ? indexedMatch(indexedEntry, indexedRenderer)
-                : recognizeMatch(fileCtx);
+            const match = typeof indexedRenderer === "string" ? indexedMatch(indexedEntry, indexedRenderer) : recognizeMatch(fileCtx);
             if (!match) {
                 throw new UsageError(`Could not display asset "${makeBundleRef(parsed.bundle, parsed.conceptId)}" — unsupported file type or unrecognized layout`);
             }
-            match.meta = { ...match.meta, name: displayName };
+            match.meta = { ...match.meta, name: presentedName };
             const renderer = await getRenderer(match.renderer);
             if (!renderer) {
                 throw new UsageError(`Renderer "${match.renderer}" not found for asset: ${makeBundleRef(parsed.bundle, parsed.conceptId)}`);
             }
-            const renderBundle = indexedEntry ? indexedEntry.bundleId : source?.registryId;
+            const renderBundle = indexedEntry.bundleId;
             const renderDefaultBundle = config.defaultBundle ?? (source?.path === allSources[0]?.path ? renderBundle : undefined);
             const renderCtx = buildRenderContext(fileCtx, match, allSourceDirs, renderBundle, renderDefaultBundle);
             response = renderer.buildShowResponse(renderCtx);
@@ -323,26 +244,22 @@ export async function showLocal(input) {
                 if (!match.renderer.endsWith("-md")) {
                     throw new UsageError(`Fragments are not supported for ${makeBundleRef(parsed.bundle, parsed.conceptId)}. Only Markdown documents support heading fragments.`, "INVALID_FLAG_VALUE");
                 }
-                applyMarkdownFragment(response, fileCtx.content(), parsed.fragment, displayName);
+                applyMarkdownFragment(response, fileCtx.content(), parsed.fragment, presentedName);
             }
         }
     }
     catch (error) {
-        if (indexedEntry)
-            throwIndexedPathNotFound(error, input.ref);
-        throw error;
-    }
-    if (indexedEntry) {
-        response.type = indexedEntry.type;
-        response.name = indexedEntry.name;
+        throwIndexedPathNotFound(error, input.ref);
     }
+    response.type = indexedEntry.type;
+    response.name = indexedEntry.name;
     const isPrimaryStash = source !== undefined && source.path === allSources[0]?.path;
     const canonicalRef = displayRef({
-        type: displayType,
-        name: displayName,
-        conceptId: indexedEntry?.conceptId,
-        bundleId: indexedEntry ? indexedEntry.bundleId : source?.registryId,
-    }, config.defaultBundle ?? (isPrimaryStash ? indexedEntry?.bundleId : undefined));
+        type: indexedEntry.type,
+        name: presentedName,
+        conceptId: indexedEntry.conceptId,
+        bundleId: indexedEntry.bundleId,
+    }, config.defaultBundle ?? (isPrimaryStash ? indexedEntry.bundleId : undefined));
     if (response.type === "workflow")
         response.action = buildWorkflowAction(canonicalRef);
     // 07 P1-D: provenance-aware toolPolicy CEILING. An agent's self-declared
@@ -400,21 +317,83 @@ export async function showLocal(input) {
     }
     return fullResponse;
 }
+/** Reject body fragments for namespaces whose authored bytes are sensitive. */
+function assertSensitiveFragmentUnsupported(ref) {
+    if (ref.fragment === undefined)
+        return;
+    const type = typeNameFromConceptId(ref.conceptId)?.type;
+    if (type !== "env" && type !== "secret")
+        return;
+    throw new UsageError(`Fragments are not supported for ${makeBundleRef(ref.bundle, ref.conceptId)}. Sensitive ${type} assets do not expose body fragments.`, "INVALID_FLAG_VALUE");
+}
+/**
+ * Return the unsupported extension only when the exact canonical AKM script
+ * path exists as a contained regular file. Physical owner arbitration runs
+ * first; this is a diagnostic for its miss, never an alternate owner or
+ * runnable-file classifier. No authored bytes are read.
+ */
+function existingUnsupportedScriptExtension(assetParts, sources) {
+    if (assetParts?.type !== "script")
+        return undefined;
+    const extension = path.extname(assetParts.name);
+    if (SCRIPT_EXTENSIONS.has(extension.toLowerCase()))
+        return undefined;
+    const scriptDir = stashDirFor("script");
+    if (!scriptDir)
+        return undefined;
+    for (const source of sources) {
+        try {
+            if ((source.adapterId ?? detectAdapterId(source.path)) !== "akm")
+                continue;
+            const sourceRoot = path.resolve(source.path);
+            const candidate = path.resolve(assetPathForName("script", path.join(sourceRoot, scriptDir), assetParts.name));
+            if (!isWithin(candidate, sourceRoot))
+                continue;
+            const authoredStat = fs.lstatSync(candidate);
+            if (!authoredStat.isFile() && !authoredStat.isSymbolicLink())
+                continue;
+            const realRoot = fs.realpathSync(sourceRoot);
+            const realCandidate = fs.realpathSync(candidate);
+            if (!isWithin(realCandidate, realRoot) || !fs.statSync(realCandidate).isFile())
+                continue;
+            return extension;
+        }
+        catch {
+            // Missing, unreadable, dangling, or otherwise unsafe paths remain normal
+            // not-found misses; this diagnostic never widens physical ownership.
+        }
+    }
+    return undefined;
+}
 /**
  * #624-P3 — opt-in inline graph extraction for `akm show`. Best-effort and
  * timeout-bounded: never throws, never hangs, never mutates the response.
  *
  * Preconditions (caller already checked the flag): a model must be configured
- * (model-available guard via {@link resolveIndexPassLLM}) and the asset must be
- * ungraphed ({@link hasGraphData}). Extraction races a 30s timeout so `show`
- * cannot block on a slow provider; any timeout/error/missing-model path is
- * swallowed and `show` returns its already-assembled response unchanged.
+ * (model-available guard via {@link resolveIndexPassExecution}) and the asset
+ * must be ungraphed ({@link hasGraphData}). Extraction races a 30s timeout so
+ * `show` cannot block on a slow provider; any timeout/error/missing-model path
+ * is swallowed and `show` returns its already-assembled response unchanged.
  */
 async function maybeExtractGraphInline(config, sourceStashDir, assetPath) {
     try {
-        // Model-available guard — no provider configured ⇒ silent skip, no LLM call.
-        if (!resolveIndexPassLLM("graph", config))
+        // Resolve readiness and the symbolic runner once. The inline dispatch must
+        // consume this same snapshot even if models.json changes while show runs.
+        const graphExecution = resolveIndexPassExecution("graph", config);
+        if (!graphExecution.runner)
             return;
+        const emittedNoticeKeys = new Set();
+        const reportNotices = (notices) => {
+            for (const notice of notices) {
+                const key = JSON.stringify(notice);
+                if (emittedNoticeKeys.has(key))
+                    continue;
+                emittedNoticeKeys.add(key);
+                const field = typeof notice.field === "string" ? ` field=${notice.field}` : "";
+                warn(`[akm] lazy graph extraction notice ${notice.code} adapter=${notice.adapter}${field}: ${notice.message}`);
+            }
+        };
+        reportNotices(graphExecution.notices);
         let alreadyGraphed = false;
         let bodyHash;
         try {
@@ -439,7 +418,14 @@ async function maybeExtractGraphInline(config, sourceStashDir, assetPath) {
             timer = setTimeout(resolve, 30_000);
         });
         try {
-            await Promise.race([extractGraphForSingleFile(db, sourceStashDir, assetPath, bodyHash, { config }), timeout]);
+            await Promise.race([
+                extractGraphForSingleFile(db, sourceStashDir, assetPath, bodyHash, {
+                    config,
+                    llmRunner: graphExecution.runner,
+                    onNotices: reportNotices,
+                }),
+                timeout,
+            ]);
         }
         finally {
             if (timer)

package/dist/commands/registry-cli.js

@@ -4,6 +4,7 @@
 import { defineGroupCommand, defineJsonCommand, output } from "../cli/shared.js";
 import { getEffectiveRegistries, loadUserConfig, mutateConfig } from "../core/config/config.js";
 import { NotFoundError, UsageError } from "../core/errors.js";
+import { formatRegistryUrl, hasRegistryUrlCredentials, REGISTRY_CREDENTIALS_UNSUPPORTED, registryEntryForOutput, } from "../core/registry-url.js";
 import { warn } from "../core/warn.js";
 export const registryCommand = defineGroupCommand({
     meta: { name: "registry", description: "Manage bundle registries" },
@@ -14,7 +15,7 @@ export const registryCommand = defineGroupCommand({
                 const config = loadUserConfig();
                 // R-066 #5: mirror the shared config↔default-fallback helper instead
                 // of re-deriving it inline.
-                output("registry-list", { registries: getEffectiveRegistries(config) });
+                output("registry-list", { registries: getEffectiveRegistries(config).map(registryEntryForOutput) });
             },
         }),
         add: defineJsonCommand({
@@ -23,7 +24,7 @@ export const registryCommand = defineGroupCommand({
                 url: { type: "positional", description: "Registry index URL", required: true },
                 name: { type: "string", description: "Human-friendly name for the registry" },
                 provider: { type: "string", description: "Provider type (e.g. static-index, skills-sh)" },
-                options: { type: "string", description: 'Provider options as JSON (e.g. \'{"apiKey":"key"}\').' },
+                options: { type: "string", description: "Provider-specific options as JSON." },
                 "allow-insecure": {
                     type: "boolean",
                     description: "Allow a plain HTTP registry URL (otherwise rejected)",
@@ -31,6 +32,9 @@ export const registryCommand = defineGroupCommand({
                 },
             },
             async run({ args }) {
+                if (hasRegistryUrlCredentials(args.url)) {
+                    throw new UsageError(REGISTRY_CREDENTIALS_UNSUPPORTED);
+                }
                 if (!args.url.startsWith("http")) {
                     throw new UsageError("Registry URL must start with http:// or https://");
                 }
@@ -65,7 +69,7 @@ export const registryCommand = defineGroupCommand({
                     return { ...config, registries };
                 }).config;
                 output("registry-add", {
-                    registries: updated.registries ?? [],
+                    registries: (updated.registries ?? []).map(registryEntryForOutput),
                     added,
                     ...(!added ? { message: "Registry URL already configured" } : {}),
                 });
@@ -80,15 +84,20 @@ export const registryCommand = defineGroupCommand({
             async run({ args }) {
                 const config = loadUserConfig();
                 const registries = [...(config.registries ?? [])];
+                const displayTarget = hasRegistryUrlCredentials(args.target) ||
+                    args.target.startsWith("http://") ||
+                    args.target.startsWith("https://")
+                    ? formatRegistryUrl(args.target)
+                    : args.target;
                 const idx = registries.findIndex((r) => r.url === args.target || r.name === args.target);
                 if (idx === -1) {
                     // Was a success envelope with `removed: false` and exit 0, so
                     // `akm registry remove typo && ...` proceeded as if it had removed
                     // something. A missing target is exit 1, like every other not-found.
-                    throw new NotFoundError(`No registry matching "${args.target}" is configured.`, "SOURCE_NOT_FOUND", "Run `akm registry list` to see configured registries.");
+                    throw new NotFoundError(`No registry matching "${displayTarget}" is configured.`, "SOURCE_NOT_FOUND", "Run `akm registry list` to see configured registries.");
                 }
                 const { confirmDestructive } = await import("../cli/confirm.js");
-                const confirmed = await confirmDestructive(`Remove registry "${args.target}"? This cannot be undone.`, {
+                const confirmed = await confirmDestructive(`Remove registry "${displayTarget}"? This cannot be undone.`, {
                     yes: args.yes === true,
                 });
                 if (!confirmed) {
@@ -105,9 +114,9 @@ export const registryCommand = defineGroupCommand({
                     return { ...latest, registries: current };
                 }).config;
                 output("registry-remove", {
-                    registries: updated.registries ?? [],
+                    registries: (updated.registries ?? []).map(registryEntryForOutput),
                     removed: removed !== undefined,
-                    ...(removed ? { entry: removed } : { message: "No matching registry found" }),
+                    ...(removed ? { entry: registryEntryForOutput(removed) } : { message: "No matching registry found" }),
                 });
             },
         }),

package/dist/commands/remember.js

@@ -11,12 +11,14 @@
 import { serializeFrontmatter } from "../core/asset/asset-serialize.js";
 import { toErrorMessage, tryReadStdinText } from "../core/common.js";
 import { loadConfig } from "../core/config/config.js";
-import { UsageError } from "../core/errors.js";
+import { ConfigError, UsageError } from "../core/errors.js";
 import { parseEmbeddedJsonResponse } from "../core/parse.js";
 import { DURATION_UNITS, parseDuration as parseDurationSpec } from "../core/time.js";
 import { warn } from "../core/warn.js";
 import { SCOPE_KEYS } from "../indexer/passes/metadata.js";
-import { getDefaultLlmConfig } from "../integrations/agent/engine-resolution.js";
+import { callStructured } from "../llm/structured-call.js";
+import { withLlmStage } from "../llm/usage-telemetry.js";
+import { resolveImproveLlmExecution } from "./improve/execution.js";
 /**
  * Parse a shorthand duration string to a number of milliseconds.
  * Supports the CLI-wide canonical grammar: `30d` (days), `12h` (hours),
@@ -140,21 +142,20 @@ function detectObservedAt(body) {
 const LLM_ENRICH_TIMEOUT_MS = 10_000;
 /**
  * Attempt LLM enrichment of memory metadata. Returns merged metadata
- * fields on success. On timeout, unreachable, or invalid JSON — returns
- * empty result and emits a warning. Never throws; always resolves.
+ * fields on success. Provider, timeout, and parse failures return an empty
+ * result and emit a warning. Invalid configuration remains a hard pre-write
+ * error and preserves its original {@link ConfigError}.
  */
 export async function runLlmEnrich(body) {
     const config = loadConfig();
-    const llmConfig = getDefaultLlmConfig(config);
-    if (!llmConfig) {
+    const resolved = resolveImproveLlmExecution({ config, processName: "remember-enrich" });
+    if (!resolved) {
         warn("Warning: --enrich requires an LLM to be configured. Run `akm setup` to configure one.");
         return { tags: [] };
     }
-    const { chatCompletion } = await import("../llm/client.js");
-    // #576: attribute this entry point's LLM call to the `remember` stage. The
-    // wrapper is ambient — if a usage sink is active it tags the record; if not,
-    // it is a no-op.
-    const { withLlmStage } = await import("../llm/usage-telemetry.js");
+    const runner = resolved.runner;
+    const noticesByKey = new Map(resolved.notices.map((notice) => [JSON.stringify(notice), notice]));
+    const noticeFields = () => noticesByKey.size > 0 ? { notices: Object.freeze([...noticesByKey.values()]) } : {};
     const prompt = `You are a memory tagger for a developer knowledge base.
 Given the memory text below, return ONLY a JSON object with these fields:
 - "tags": array of 1-5 short lowercase keyword tags
@@ -170,10 +171,22 @@ Return ONLY the JSON object, no prose, no markdown fences.`;
         const result = await (async () => {
             try {
                 return await Promise.race([
-                    withLlmStage("remember", () => chatCompletion(llmConfig, [
-                        { role: "system", content: "Return only valid JSON. No prose." },
-                        { role: "user", content: prompt },
-                    ], { maxTokens: 256, temperature: 0.1 })),
+                    withLlmStage("remember", () => callStructured({
+                        feature: "remember_enrich",
+                        runner,
+                        messages: [
+                            { role: "system", content: "Return only valid JSON. No prose." },
+                            { role: "user", content: prompt },
+                        ],
+                        request: { maxTokens: 256, temperature: 0.1 },
+                        onNotices: (value) => {
+                            for (const notice of value)
+                                noticesByKey.set(JSON.stringify(notice), notice);
+                        },
+                        parse: (raw) => raw ?? "",
+                        onError: () => "",
+                        fallback: "",
+                    })),
                     new Promise((_, reject) => {
                         timeoutHandle = setTimeout(() => reject(new Error("LLM enrichment timed out")), LLM_ENRICH_TIMEOUT_MS);
                     }),
@@ -188,7 +201,7 @@ Return ONLY the JSON object, no prose, no markdown fences.`;
         const parsed = parseEmbeddedJsonResponse(result);
         if (!parsed) {
             warn("Warning: --enrich received invalid JSON from the LLM. Writing memory without enrichment.");
-            return { tags: [] };
+            return { tags: [], ...noticeFields() };
         }
         const tags = Array.isArray(parsed.tags)
             ? parsed.tags.filter((t) => typeof t === "string" && t.trim().length > 0)
@@ -197,11 +210,13 @@ Return ONLY the JSON object, no prose, no markdown fences.`;
         const observed_at = typeof parsed.observed_at === "string" && /^\d{4}-\d{2}-\d{2}$/.test(parsed.observed_at.trim())
             ? parsed.observed_at.trim()
             : undefined;
-        return { tags, description, observed_at };
+        return { tags, description, observed_at, ...noticeFields() };
     }
     catch (err) {
+        if (err instanceof ConfigError)
+            throw err;
         warn(`Warning: --enrich failed (${toErrorMessage(err)}). Writing memory without enrichment.`);
-        return { tags: [] };
+        return { tags: [], ...noticeFields() };
     }
 }
 // R-061(c): `resolveRememberContentArg` / `wasRememberFlagValueConsumedAsContent`