akm-cli 0.9.14 → 0.9.15-beta.2

package/dist/integrations/agent/prompts.js

@@ -25,6 +25,7 @@
  * `frontmatter` is optional — the proposal queue parses it from `content`
  * during validation. We carry it through if the agent supplies it.
  */
+import reflectFeedbackFraming from "../../assets/prompts/reflect-feedback-framing.md" with { type: "text" };
 import reflectLlmFramedContract from "../../assets/prompts/reflect-llm-framed-contract.md" with { type: "text" };
 import reflectLlmSchemaContract from "../../assets/prompts/reflect-llm-schema-contract.md" with { type: "text" };
 import reflectOutputRepair from "../../assets/prompts/reflect-output-repair.md" with { type: "text" };
@@ -56,6 +57,25 @@ function hintForType(type) {
 function knownTypeList() {
     return [...placementTypes()].sort().join(", ");
 }
+/**
+ * Default cap (in characters) on the asset content injected into
+ * {@link buildReflectPrompt}, and the floor a caller-supplied
+ * {@link ReflectPromptInput.contentBudgetChars} is never allowed to go below.
+ * Exists to stay well under OS ARG_MAX when the prompt is passed as a CLI
+ * argument to opencode/claude — large assets (wiki snapshots, long runbooks)
+ * would otherwise trigger E2BIG on posix_spawn. Agent/SDK runners always use
+ * this flat value; the direct-LLM path can raise it per #952 (see the reflect
+ * dispatch site in `src/commands/improve/reflect.ts`).
+ */
+export const REFLECT_CONTENT_CAP = 12_000;
+/**
+ * Marker appended to truncated asset content when it exceeds the active
+ * content budget (#952). Exported so `sanitizeReflectPayload` can detect a
+ * model that echoed this notice back into its rewrite instead of proposing
+ * real content, and so the output contracts can reference the exact string
+ * to forbid.
+ */
+export const REFLECT_TRUNCATION_MARKER = "... [truncated — focus on the visible portion]";
 /**
  * Common envelope every prompt asks the agent to honour when NO draft file
  * path is available. The wrapper code uses `JSON.parse(stdout)` to extract
@@ -87,6 +107,7 @@ function fileWriteContract(draftFilePath) {
         `Write the complete improved asset content to: ${draftFilePath}`,
         "Use your file-editing tools to create or overwrite that file.",
         "Do NOT output JSON to stdout. Do NOT print the file contents. Just write the file.",
+        `Never include the text "${REFLECT_TRUNCATION_MARKER}" or any other content from outside the provided asset content in the file you write.`,
         "When done, output a single line on stdout: DRAFT_WRITTEN confidence=<0.0-1.0>",
         "`confidence` is REQUIRED and must be your honest self-rated [0, 1] score for this proposal:",
         "  • 0.90+ — fixes a real defect or adds load-bearing missing content; reviewer would clearly accept.",
@@ -124,10 +145,14 @@ export function reflectLlmResponseContract(mode, targetScoped) {
             .replace("{{FIELD_RULE}}", targetScoped
             ? "The response has exactly the required fields `content`, `confidence`, and `frontmatterPatch`; do not echo `ref` or arbitrary `frontmatter`."
             : "The response has exactly the required fields `ref`, `content`, `confidence`, and `frontmatterPatch`; `ref` must identify the selected asset.")
+            .replaceAll("{{TRUNCATION_MARKER}}", REFLECT_TRUNCATION_MARKER)
             .trim();
     }
     const refLine = targetScoped ? "" : "AKM_REFLECT_REF: <selected asset ref>\n";
-    return reflectLlmFramedContract.replace("{{REF_LINE}}", refLine).trim();
+    return reflectLlmFramedContract
+        .replace("{{REF_LINE}}", refLine)
+        .replaceAll("{{TRUNCATION_MARKER}}", REFLECT_TRUNCATION_MARKER)
+        .trim();
 }
 export function buildReflectOutputRepairPrompt(mode, targetScoped) {
     return reflectOutputRepair.replace("{{OUTPUT_CONTRACT}}", reflectLlmResponseContract(mode, targetScoped)).trim();
@@ -194,6 +219,10 @@ export function buildReflectPrompt(input) {
     }
     // Change 3 & 4 — feedback moved before asset content; missing else branch added
     if (input.feedback && input.feedback.length > 0) {
+        // #952 — feedback lines are unverified reports, not verified facts. Without
+        // this caveat, models fabricated whole new sections asserting whatever a
+        // feedback line claimed (invented incident dates, ports, disk layouts).
+        sections.push(reflectFeedbackFraming.trim());
         sections.push("Recent feedback / signals:");
         for (const line of input.feedback)
             sections.push(`- ${line}`);
@@ -238,17 +267,20 @@ export function buildReflectPrompt(input) {
         }
     }
     if (input.assetContent?.trim()) {
-        // Cap at 12 000 chars to stay well under OS ARG_MAX when the prompt is
-        // passed as a CLI argument to opencode/claude. Large assets (wiki snapshots,
-        // long runbooks) would otherwise trigger E2BIG on posix_spawn.
-        const REFLECT_CONTENT_CAP = 12_000;
+        // Cap defaults to REFLECT_CONTENT_CAP (12 000 chars) to stay well under OS
+        // ARG_MAX when the prompt is passed as a CLI argument to opencode/claude
+        // — large assets (wiki snapshots, long runbooks) would otherwise trigger
+        // E2BIG on posix_spawn. Direct-LLM callers never touch argv, so they may
+        // pass a larger, context-aware `contentBudgetChars` (#952); it is never
+        // allowed below the flat floor, which the caller enforces before calling in.
+        const contentCap = input.contentBudgetChars ?? REFLECT_CONTENT_CAP;
         const body = input.assetContent.trimEnd();
-        const truncated = body.length > REFLECT_CONTENT_CAP;
+        const truncated = body.length > contentCap;
         sections.push(truncated
-            ? `Current asset content (first ${REFLECT_CONTENT_CAP} chars — full asset is ${body.length} chars):`
+            ? `Current asset content (first ${contentCap} chars — full asset is ${body.length} chars):`
             : "Current asset content (verbatim):");
         sections.push("```");
-        sections.push(truncated ? `${body.slice(0, REFLECT_CONTENT_CAP)}\n... [truncated — focus on the visible portion]` : body);
+        sections.push(truncated ? `${body.slice(0, contentCap)}\n${REFLECT_TRUNCATION_MARKER}` : body);
         sections.push("```");
     }
     else if (input.ref) {

package/dist/integrations/agent/runner-dispatch.js

@@ -20,7 +20,7 @@ import { assertNever } from "../../core/assert.js";
 import { collectSensitiveValues, isEnvPassthroughValueSafeToExpose, redactSensitiveText, redactSensitiveValue, } from "../../core/redaction.js";
 import { spawnEnvNamesFor } from "../../core/spawn-env.js";
 import { closeServer as disposeOpencodeSdkServers, opencodeSdkServerEnvironmentNames, runOpencodeSdk, } from "../harnesses/opencode-sdk/sdk-runner.js";
-import { lookupApiKeyFileValue, lookupCredentialFromEnv, materializeLlmConnection, materializeLlmConnectionWithCredential, resolveLlmCredentialValue, } from "./engine-resolution.js";
+import { lookupApiKeyFileValue, lookupApiKeySecretRefValue, lookupCredentialFromEnv, materializeLlmConnection, materializeLlmConnectionWithCredential, resolveLlmCredentialValue, } from "./engine-resolution.js";
 import { materializeLlmRunnerConnection, materializeLlmRunnerConnectionWithCredential, } from "./runner.js";
 import { runAgent } from "./spawn.js";
 const liveRunnerDispatchLeases = new WeakMap();
@@ -134,10 +134,10 @@ export function acquireRunnerDispatchLease(spec, envSource = process.env) {
         },
     });
     const primaryCredential = spec.kind === "llm"
-        ? resolveLlmCredentialValue(spec.engine, spec.credential, spec.apiKeyFile, credentialSource)
+        ? resolveLlmCredentialValue(spec.engine, spec.credential, spec.apiKeyFile, spec.apiKeySecretRef, credentialSource)
         : undefined;
     const fallbackCredential = spec.kind === "sdk"
-        ? resolveLlmCredentialValue(spec.engine, spec.fallbackCredential, spec.fallbackApiKeyFile, credentialSource)
+        ? resolveLlmCredentialValue(spec.engine, spec.fallbackCredential, spec.fallbackApiKeyFile, spec.fallbackApiKeySecretRef, credentialSource)
         : undefined;
     const handle = Object.create(null);
     Object.defineProperty(handle, "toJSON", {
@@ -229,6 +229,12 @@ export function collectDispatchSensitiveValues(spec, opts, envSource = opts.envS
         add(lookupApiKeyFileValue(spec.apiKeyFile));
     if (spec.kind === "sdk" && spec.fallbackApiKeyFile)
         add(lookupApiKeyFileValue(spec.fallbackApiKeyFile));
+    // #953: a secret-store-backed credential is read at dispatch too — same
+    // best-effort scrub-set inclusion rationale.
+    if (spec.kind === "llm" && spec.apiKeySecretRef)
+        add(lookupApiKeySecretRefValue(spec.apiKeySecretRef));
+    if (spec.kind === "sdk" && spec.fallbackApiKeySecretRef)
+        add(lookupApiKeySecretRefValue(spec.fallbackApiKeySecretRef));
     if (spec.kind !== "llm") {
         for (const value of Object.values(spec.profile.env ?? {}))
             add(value);

package/dist/integrations/agent/runner.js

@@ -9,6 +9,7 @@ export function materializeLlmRunnerConnection(runner) {
         connection: runner.connection,
         ...(runner.credential ? { credential: runner.credential } : {}),
         ...(runner.apiKeyFile ? { apiKeyFile: runner.apiKeyFile } : {}),
+        ...(runner.apiKeySecretRef ? { apiKeySecretRef: runner.apiKeySecretRef } : {}),
         timeoutMs: runner.timeoutMs ?? null,
     });
 }
@@ -19,6 +20,7 @@ export function materializeLlmRunnerConnectionWithCredential(runner, credentialV
         connection: runner.connection,
         ...(runner.credential ? { credential: runner.credential } : {}),
         ...(runner.apiKeyFile ? { apiKeyFile: runner.apiKeyFile } : {}),
+        ...(runner.apiKeySecretRef ? { apiKeySecretRef: runner.apiKeySecretRef } : {}),
         timeoutMs: runner.timeoutMs ?? null,
     }, credentialValue);
 }

package/dist/llm/client.js

@@ -290,12 +290,17 @@ async function chatCompletionAttemptOnce(config, messages, options, timeoutMs, i
             },
         }
         : {};
+    // #949: which of these two wire forms a backend honors is a fact about the
+    // backend (and any gateway in front of it), not about akm's own `provider`
+    // label — a llama.cpp build honors chat_template_kwargs, a bare
+    // `enable_thinking` is honored by nothing observed, and a gateway
+    // (freellmapi, Bifrost) can drop either one depending on how it was built.
+    // Send both whenever thinking is explicitly resolved so the same engine
+    // block keeps working across a direct vhost or any gateway in front of it.
     const resolvedEnableThinking = options?.enableThinking ?? config.enableThinking;
     const thinkingParams = resolvedEnableThinking === undefined
         ? {}
-        : config.provider === "vllm"
-            ? { chat_template_kwargs: { enable_thinking: resolvedEnableThinking } }
-            : { enable_thinking: resolvedEnableThinking };
+        : { chat_template_kwargs: { enable_thinking: resolvedEnableThinking }, enable_thinking: resolvedEnableThinking };
     const reasoningEffortParams = config.reasoningEffort === undefined ? {} : { reasoning_effort: config.reasoningEffort };
     const requestBody = JSON.stringify({
         model: config.model,

package/dist/llm/embedder.js

@@ -100,32 +100,44 @@ async function embedOnce(text, embeddingConfig, signal) {
  * skipped and why; the result array holds `undefined` at those indices.
  * Uses the LocalEmbedder.embedBatch path for the local transformer pipeline,
  * which processes texts in chunks of 32 for genuine batched inference.
+ *
+ * `onBatch`, when given, fires once per provider/local batch as it completes
+ * (#954) so a caller can commit each batch's rows durably as they land
+ * rather than buffering the whole call — see `EmbeddingBatchCommit`.
  */
-export async function embedBatch(texts, embeddingConfig, signal, onSkip) {
-    if (embedderOverrides?.embedBatch)
-        return embedderOverrides.embedBatch(texts, embeddingConfig, signal);
+export async function embedBatch(texts, embeddingConfig, signal, onSkip, onBatch) {
+    if (embedderOverrides?.embedBatch) {
+        return embedderOverrides.embedBatch(texts, embeddingConfig, signal, onSkip, onBatch);
+    }
     if (texts.length === 0)
         return [];
     // Deterministic mode (env-gated, test/bench only): model-free, stable.
     if (isDeterministicEmbedEnabled()) {
-        return texts.map((t) => deterministicEmbed(t));
+        const embeddings = texts.map((t) => deterministicEmbed(t));
+        // One onBatch commit for the whole call, like the local/remote batched
+        // paths — firing once per text opened one materializer transaction per
+        // entry in deterministic (test/bench) mode.
+        onBatch?.(embeddings.map((_embedding, i) => i), embeddings);
+        return embeddings;
     }
     if (embeddingConfig && hasRemoteEndpoint(embeddingConfig)) {
-        return new RemoteEmbedder(embeddingConfig).embedBatch(texts, signal, onSkip);
+        return new RemoteEmbedder(embeddingConfig).embedBatch(texts, signal, onSkip, onBatch);
     }
     // Local transformer: use the batched path (chunks of 32 via LocalEmbedder).
     // When a localModel override is set we cannot share the singleton (which uses
     // the default model), so fall back to per-text embedWithModel in that case.
     const localModel = embeddingConfig?.localModel;
     if (!localModel) {
-        return getLocalEmbedder().embedBatch(texts, signal);
+        return getLocalEmbedder().embedBatch(texts, signal, onBatch);
     }
     const results = [];
-    for (const text of texts) {
+    for (const [i, text] of texts.entries()) {
         if (signal?.aborted) {
             throw signal.reason instanceof Error ? signal.reason : new Error("embedding interrupted");
         }
-        results.push(await getLocalEmbedder().embedWithModel(text, localModel));
+        const embedding = await getLocalEmbedder().embedWithModel(text, localModel);
+        results.push(embedding);
+        onBatch?.([i], [embedding]);
     }
     return results;
 }

package/dist/llm/embedders/local.js

@@ -81,8 +81,13 @@ export class LocalEmbedder {
      * Embed a batch of texts. Processes in chunks of `LOCAL_BATCH_SIZE` (32) so
      * the transformers pipeline can run genuine batched inference rather than one
      * call per text. Each chunk is checked against the AbortSignal between calls.
+     *
+     * `onBatch`, when given, fires once per chunk (indices into `texts` + the
+     * chunk's embeddings) as it completes (#954) — parity with
+     * `RemoteEmbedder.embedBatch`'s per-provider-batch commit callback, so a
+     * caller committing per batch does not need to special-case the local path.
      */
-    async embedBatch(texts, signal) {
+    async embedBatch(texts, signal, onBatch) {
         if (texts.length === 0)
             return [];
         if (signal?.aborted) {
@@ -109,9 +114,12 @@ export class LocalEmbedder {
             if (batch !== chunk.length || batchResult.data.length !== batch * dim) {
                 throw new Error("unexpected pipeline return shape for batch input");
             }
+            const chunkEmbeddings = [];
             for (let row = 0; row < chunk.length; row++) {
-                results.push(Array.from(batchResult.data.subarray(row * dim, (row + 1) * dim)));
+                chunkEmbeddings.push(Array.from(batchResult.data.subarray(row * dim, (row + 1) * dim)));
             }
+            results.push(...chunkEmbeddings);
+            onBatch?.(Array.from({ length: chunk.length }, (_, row) => i + row), chunkEmbeddings);
         }
         return results;
     }