akm-cli 0.9.17-alpha.3 → 0.9.17-alpha.4

package/dist/commands/read/search-cli.js

@@ -76,36 +76,24 @@ export const searchCommand = defineJsonCommand({
             description: "Memory belief filter: all|current|historical. current keeps active memory beliefs; historical keeps contradicted/superseded/archived memory beliefs.",
             default: "all",
         },
-        // Declared as the POSITIVE name with `default: true` so citty's native
-        // `--no-<name>` negation (it strips a leading `--no-` from ANY token and
-        // negates the remainder BEFORE consulting the declared-args table — see
-        // node_modules/citty/dist/index.mjs) does the work, the same pattern
-        // `sync --push/--no-push` uses. A flag DECLARED as `no-project-context`
-        // can never be negated: `--no-project-context` parses as "negate
-        // `project-context`", a name nothing declared, leaving the real key at
-        // its default `false` forever (F1/A1).
-        "project-context": {
-            type: "boolean",
-            default: true,
-            description: "Automatic project-context ranking boost: assets whose name/tags/aliases match the current working " +
-                "directory's project get a small score boost, and this search's usage also feeds the scoped-utility " +
-                "ranking signal. Default: on. Use --no-project-context to disable BOTH the project-context boost and " +
-                "the scoped-utility signal for this search only.",
-        },
         "include-sessions": {
             type: "boolean",
             description: "Include session assets (excluded from default search results via config.search.defaultExcludeTypes).",
             default: false,
         },
-        // Declared as the POSITIVE name with `default: true` for the same reason
-        // as `project-context` above — never declare a flag whose NAME starts
-        // with `no-`.
+        // Declared as the POSITIVE name with `default: true` so citty's native
+        // `--no-<name>` negation (it strips a leading `--no-` from ANY token and
+        // negates the remainder BEFORE consulting the declared-args table — see
+        // node_modules/citty/dist/index.mjs) does the work, the same pattern
+        // `sync --push/--no-push` uses. A flag DECLARED as `no-track-usage` could
+        // never be negated: `--no-track-usage` parses as "negate `track-usage`",
+        // a name nothing declared, leaving the real key at its default forever
+        // (F1/A1).
         "track-usage": {
             type: "boolean",
             default: true,
-            description: "A successful search updates ranking signals (usage-events telemetry and the MemRL utility-score bump " +
-                "used to prioritize future results). Default: on. Use --no-track-usage to run a read-only search that " +
-                "does not influence future ranking.",
+            description: "A successful search records usage-events telemetry. Default: on. Use --no-track-usage to run a " +
+                "search that records nothing.",
         },
     },
     async run({ args }) {
@@ -120,7 +108,6 @@ export const searchCommand = defineJsonCommand({
         const filters = parseScopeFilterFlags(filterTokens, "--filter");
         const includeProposed = args["include-proposed"] === true;
         const belief = parseBeliefFilterMode(typeof args.belief === "string" ? args.belief : undefined);
-        const disableProjectContext = args["project-context"] === false;
         const skipLogging = args["track-usage"] === false;
         const includeSessions = args["include-sessions"];
         const assets = args.assets === true;
@@ -134,8 +121,6 @@ export const searchCommand = defineJsonCommand({
             includeProposed,
             belief,
             includeSessions,
-            disableProjectContext,
-            disableScopedUtility: disableProjectContext,
             skipLogging,
             assets,
             eventSource: resolveUsageEventSource(),
@@ -170,14 +155,13 @@ export const curateCommand = defineJsonCommand({
                 "one curate call.",
         },
         // Declared as the POSITIVE name with `default: true` — see the
-        // `project-context` comment on `searchCommand` above for why a flag NAME
+        // `track-usage` comment on `searchCommand` above for why a flag NAME
         // must never start with `no-`.
         "track-usage": {
             type: "boolean",
             default: true,
-            description: "A successful curate updates ranking signals (usage-events telemetry for the curated items and the " +
-                "underlying search). Default: on. Use --no-track-usage to run a read-only curate that does not " +
-                "influence future ranking.",
+            description: "A successful curate records usage-events telemetry for the curated items. Default: on. Use " +
+                "--no-track-usage to run a curate that records nothing.",
         },
     },
     async run({ args }) {
@@ -302,14 +286,13 @@ export const showCommand = defineJsonCommand({
             description: "Exact context budget in characters. Requires --context lead; mutually exclusive with --max-tokens.",
         },
         // Declared as the POSITIVE name with `default: true` — see the
-        // `project-context` comment on `searchCommand` above for why a flag NAME
+        // `track-usage` comment on `searchCommand` above for why a flag NAME
         // must never start with `no-`.
         "track-usage": {
             type: "boolean",
             default: true,
-            description: "A successful show updates ranking signals (usage-events telemetry, including the search-selection " +
-                "linkage when this show follows a recent search). Default: on. Use --no-track-usage to run a " +
-                "read-only show that does not influence future ranking.",
+            description: "A successful show records usage-events telemetry, including the search-selection linkage when this " +
+                "show follows a recent search. Default: on. Use --no-track-usage to run a show that records nothing.",
         },
     },
     async run({ args }) {

package/dist/commands/read/search.js

@@ -14,22 +14,20 @@
 import { getSources, loadConfig } from "../../core/config/config.js";
 import { rethrowIfTestIsolationError, UsageError } from "../../core/errors.js";
 import { appendEvent } from "../../core/events.js";
+import { redactCredentialPatterns } from "../../core/redaction.js";
+import { withStateDbTelemetry } from "../../core/state-db.js";
 import { resolveReadSources } from "../../indexer/read-preflight.js";
 import { searchLocal } from "../../indexer/search/db-search.js";
 import { getSearchHitAttribution, usageEventAttributionMetadata, } from "../../indexer/search/search-attribution.js";
-import { getEntryIdByFilePath, getItemRefById } from "../../storage/repositories/index-entries-repository.js";
-// Eagerly import source providers to trigger self-registration before the
-// indexer or path-resolution code runs.
-import "../../sources/providers/index.js";
-import { withStateDbTelemetry } from "../../core/state-db.js";
 import { insertUsageEvent } from "../../indexer/usage/usage-events.js";
 import { TELEMETRY_BUSY_TIMEOUT_MS, withIndexDb } from "../../storage/repositories/index-db.js";
+import { getEntryIdByFilePath, getItemRefById } from "../../storage/repositories/index-entries-repository.js";
 import { searchRegistry } from "./registry-search.js";
 const DEFAULT_LIMIT = 20;
 function duplicateConceptWarnings(hits, defaultBundle) {
     const ownersByConcept = new Map();
     for (const hit of hits) {
-        const displayRef = (hit.parentRef ?? hit.ref).split("#", 1)[0] ?? hit.ref;
+        const displayRef = hit.ref.split("#", 1)[0] ?? hit.ref;
         const boundary = displayRef.indexOf("//");
         const conceptId = boundary >= 0 ? displayRef.slice(boundary + 2) : displayRef;
         const owner = hit.origin ?? defaultBundle ?? "working-bundle";
@@ -47,7 +45,6 @@ function duplicateConceptWarnings(hits, defaultBundle) {
 export async function akmSearch(input) {
     const t0 = Date.now();
     const query = input.query.trim();
-    const normalizedQuery = query.toLowerCase();
     const searchType = input.type ?? "any";
     const limit = normalizeLimit(input.limit);
     const parsedSource = parseSearchSource(input.source ?? "local");
@@ -110,7 +107,7 @@ export async function akmSearch(input) {
     const localResult = source === "registry"
         ? undefined
         : await searchLocal({
-            query: normalizedQuery,
+            query,
             searchType,
             limit,
             stashDir,
@@ -126,8 +123,6 @@ export async function akmSearch(input) {
             // would leak hits from sources the caller did not request.
             restrictToSources: namedSourceName !== undefined,
             includeExcludedTypes: input.includeSessions === true,
-            disableProjectContext: input.disableProjectContext === true,
-            disableScopedUtility: input.disableScopedUtility === true,
         });
     const registryResult = source === "local"
         ? undefined
@@ -249,7 +244,13 @@ function resolveEntryIds(db, hits) {
  * Per-entry events are recorded only for stash hits because registry hits
  * have no local entry_id to reference.
  */
-function logSearchEvent(query, response, mode = "keyword", eventSource = "user", attributionProjection = "full") {
+function logSearchEvent(rawQuery, response, mode = "keyword", eventSource = "user", attributionProjection = "full") {
+    // Credentials pasted into a query (e.g. by the Claude Code hook that
+    // curates every user prompt) must never reach state.db verbatim — see
+    // `redactCredentialPatterns`. Redacted once here so every persistence call
+    // below (events.metadata_json via appendEvent, usage_events.query via
+    // insertUsageEvent) gets the same scrubbed text.
+    const query = redactCredentialPatterns(rawQuery);
     // Emit a structured event to events.jsonl so workflow-trace consumers
     // detect akm search invocations without relying on stdout scraping.
     const stashHits = response.hits.filter((h) => h.type !== "registry");
@@ -296,18 +297,11 @@ function logSearchEvent(query, response, mode = "keyword", eventSource = "user",
                     source: eventSource,
                 });
             }, TELEMETRY_BUSY_TIMEOUT_MS);
-            // No live utility_scores/utility_scores_scoped write here (#862): a
-            // search result is an impression, not a signal that the asset was
-            // useful. Rewarding every returned hit created a feedback loop where
-            // merely appearing in results inflated future ranking — assets
-            // surfaced because they'd surfaced before, not because a user acted
-            // on them. Retrieval counts are still recorded above via
-            // insertUsageEvent (search_count) and rolled into utility_scores by
-            // the offline `recomputeUtilityScores` pass (`akm index`), which uses
-            // the show/search *select rate* — a ratio that requires an actual
-            // `show`/select event, not raw impressions. Explicit signal comes
-            // from `akm feedback` (applyFeedbackToUtilityScore) and from
-            // selection (recordShowUsage / the `select` event derived from it).
+            // No live utility_scores write here (#862): a search result is an
+            // impression, not a signal that the asset was useful. Retrieval
+            // counts are recorded above via insertUsageEvent (search_count) and
+            // rolled into utility_scores by the offline `recomputeUtilityScores`
+            // pass (`akm index`).
         }, { busyTimeoutMs: TELEMETRY_BUSY_TIMEOUT_MS });
     }
     catch (err) {

package/dist/commands/read/show.js

@@ -34,8 +34,8 @@ import { SCRIPT_EXTENSIONS } from "../../core/recognition-util.js";
 import { presentationFor } from "../../core/type-presentation.js";
 import { warn, warnOnce } from "../../core/warn.js";
 import { hasGraphData } from "../../indexer/db/graph-db.js";
-import { listRelatedPathsForFile } from "../../indexer/graph/graph-boost.js";
 import { extractGraphForSingleFile } from "../../indexer/graph/graph-extraction.js";
+import { listRelatedPathsForFile } from "../../indexer/graph/graph-related.js";
 import { lookupBundleRef, lookupBundleRefWithResolution } from "../../indexer/indexer.js";
 import { projectMarkdownFragmentContent } from "../../indexer/passes/metadata.js";
 import { ensurePrimaryIndexForRead, resolveReadSources } from "../../indexer/read-preflight.js";
@@ -48,9 +48,6 @@ import { resolveStorageLocations } from "../../storage/locations.js";
 import { closeDatabase, openExistingDatabase } from "../../storage/repositories/index-connection.js";
 import { TELEMETRY_BUSY_TIMEOUT_MS, withIndexDb } from "../../storage/repositories/index-db.js";
 import { getIndexedMarkdownFragment } from "../../storage/repositories/index-fts-repository.js";
-import { computeBodyHash } from "../../storage/repositories/index-llm-cache-repository.js";
-// Eagerly import source providers to trigger self-registration.
-import "../../sources/providers/index.js";
 import { getCurrentWorkflowScopeKey } from "../../workflows/authoring/scope-key.js";
 import { buildWorkflowAction } from "../../workflows/renderer.js";
 import { getActiveWorkflowRun } from "../../workflows/runtime/runs.js";
@@ -503,14 +500,6 @@ async function maybeExtractGraphInline(config, sourceStashDir, assetPath) {
         };
         reportNotices(graphExecution.notices);
         let alreadyGraphed = false;
-        let bodyHash;
-        try {
-            const raw = fs.readFileSync(assetPath, "utf8");
-            bodyHash = computeBodyHash(parseFrontmatter(raw).content.trim());
-        }
-        catch {
-            return; // file gone/unreadable ⇒ nothing to extract
-        }
         withIndexDb((db) => {
             alreadyGraphed = hasGraphData(db, sourceStashDir, assetPath);
         }, { busyTimeoutMs: TELEMETRY_BUSY_TIMEOUT_MS });
@@ -527,7 +516,7 @@ async function maybeExtractGraphInline(config, sourceStashDir, assetPath) {
         });
         try {
             await Promise.race([
-                extractGraphForSingleFile(db, sourceStashDir, assetPath, bodyHash, {
+                extractGraphForSingleFile(db, sourceStashDir, assetPath, {
                     config,
                     llmRunner: graphExecution.runner,
                     onNotices: reportNotices,

package/dist/commands/sources/bundle-cli.js

@@ -24,9 +24,11 @@
  * `proposal-new` shape). `show` is a new shape, `bundle-show`.
  */
 import { defineGroupCommand, defineJsonCommand, output } from "../../cli/shared.js";
+import { renameBundle } from "../../core/bundle-rename.js";
 import { NotFoundError, TransientError, UsageError } from "../../core/errors.js";
 import { appendEvent } from "../../core/events.js";
 import { warn } from "../../core/warn.js";
+import { akmTasksSync } from "../tasks/tasks.js";
 import { addCommand } from "./add-cli.js";
 import { akmInit } from "./init.js";
 import { akmListSources, akmRemove, akmUpdate } from "./installed-stashes.js";
@@ -182,9 +184,29 @@ const updateCommand = defineJsonCommand({
         output("update", result);
     },
 });
+const renameCommand = defineJsonCommand({
+    meta: {
+        name: "rename",
+        description: "Rename a configured bundle's key everywhere akm persists it (config, lock, index, and its own proposals/task history). Content inside the bundle that still spells the old ref is reported, not rewritten.",
+    },
+    args: {
+        old: { type: "positional", description: "Current bundle name", required: true },
+        new: { type: "positional", description: "New bundle name (must be a legal, unused slug)", required: true },
+        "dry-run": {
+            type: "boolean",
+            description: "Show the rename plan without writing anything",
+            default: false,
+        },
+    },
+    async run({ args }) {
+        const result = await renameBundle(args.old, args.new, { dryRun: args["dry-run"] }, {
+            syncTasks: (newId, backend) => akmTasksSync({ backend }, newId),
+        });
+        output("bundle-rename", result);
+    },
+});
 export function isSkippableBundleUpdateLock(error) {
-    return (error instanceof TransientError &&
-        ["INDEX_DB_CONTENDED", "STATE_DB_CONTENDED", "MAINTENANCE_BARRIER_BUSY"].includes(error.code));
+    return error instanceof TransientError && ["INDEX_DB_CONTENDED", "STATE_DB_CONTENDED"].includes(error.code);
 }
 export const bundleCommand = defineGroupCommand({
     meta: {
@@ -198,5 +220,6 @@ export const bundleCommand = defineGroupCommand({
         show: showCommand,
         remove: removeCommand,
         update: updateCommand,
+        rename: renameCommand,
     },
 });

package/dist/commands/sources/bundle-config-ops.js

@@ -92,6 +92,13 @@ export function bundleKeyForUrl(config, url) {
  * caller's `preferredName` when it is a legal slug, else slug the seed locator
  * (path/url) — the shared {@link deriveBundleId} rule (D-R5), made unique against
  * the currently-configured bundle keys.
+ *
+ * This helper stays forgiving (no `--name` contract enforcement): it is also
+ * used by `akm source add` (`source-manage.ts`'s `addStash`), which predates
+ * and is not in scope for the D6 `--name` contract. A caller that DOES need
+ * the D6 contract (an illegal or already-taken explicit name failing loudly)
+ * validates with {@link validateExplicitBundleName} itself before calling in,
+ * as `source-add.ts`'s local/website/registry add paths do.
  */
 export function nextBundleKey(bundles, preferredName, seedLocator) {
     return deriveBundleId(preferredName, seedLocator, new Set(Object.keys(bundles)));

package/dist/commands/sources/dangerous-env-audit.js

@@ -66,8 +66,7 @@ function collectDangerousKeyFindings(installedStashRoot, checkEnvForDangerousKey
     }
     return allFindings;
 }
-/** Scan only; callers that already obtained approval use this for a final materialization fence. */
-export function scanStashForDangerousKeys(installedStashRoot) {
+function scanStashForDangerousKeys(installedStashRoot) {
     const scanner = scannerOverride ??
         ((envPath, relPath) => scanEnvKeyNames(fs.readFileSync(envPath, "utf8"))
             .filter(isDangerousEnvKey)

package/dist/commands/sources/info.js

@@ -11,7 +11,6 @@ import { error } from "../../core/warn.js";
 import { closeDatabase, openExistingDatabase } from "../../storage/repositories/index-connection.js";
 import { getEntryCount, getEntryCountByType } from "../../storage/repositories/index-entries-repository.js";
 import { getMeta } from "../../storage/repositories/index-meta-repository.js";
-import { isVecAvailable } from "../../storage/repositories/index-vec-repository.js";
 import { pkgVersion } from "../../version.js";
 /**
  * Assemble system info describing the current capabilities, configuration,
@@ -53,15 +52,9 @@ export function assembleInfo(options) {
     // Semantic status is read live from the index's own state, not a cached
     // verdict — a failed embed attempt at search time falls back to FTS and
     // reports that in the search response, it never disables the mode here.
-    const semanticStatus = config.semanticSearchMode === "off"
-        ? "disabled"
-        : !indexStats.hasEmbeddings
-            ? "pending"
-            : indexStats.vecAvailable
-                ? "ready-vec"
-                : "ready-js";
+    const semanticStatus = config.semanticSearchMode === "off" ? "disabled" : indexStats.hasEmbeddings ? "ready-js" : "pending";
     const searchModes = ["fts"];
-    if (semanticStatus === "ready-js" || semanticStatus === "ready-vec") {
+    if (semanticStatus === "ready-js") {
         searchModes.push("semantic", "hybrid");
     }
     return {
@@ -90,7 +83,6 @@ function readIndexStats(resolvedPath) {
         byType: {},
         lastBuiltAt: null,
         hasEmbeddings: false,
-        vecAvailable: false,
     };
     // "Absent" is the ordinary first-run state; "inaccessible" is a fault that
     // must not present as an empty index (#791). `akm info` is the command an
@@ -112,7 +104,6 @@ function readIndexStats(resolvedPath) {
             byType: getEntryCountByType(db),
             lastBuiltAt: getMeta(db, "builtAt") ?? null,
             hasEmbeddings: getMeta(db, "hasEmbeddings") === "1",
-            vecAvailable: isVecAvailable(db),
         };
     }
     catch (err) {