akm-cli 0.9.23 → 0.9.25-alpha.1

package/CHANGELOG.md

@@ -4,6 +4,345 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [Unreleased]
+
+## [0.9.25-alpha.1] - 2026-10-02
+
+### Changed
+
+- **One schema instruction, appended by the shared agent request lowering.**
+  Seven harness builders and the workflow engine each kept a copy of
+  "Respond with ONLY a JSON value matching this JSON Schema (no prose, no code
+  fences)". The lowering now appends it to every agent engine's prompt when a
+  schema is requested, so `codex` gets it beside `--output-schema` outside
+  workflows too. A workflow unit sends the same prompt bytes as before, less
+  the duplicate fixed below; a direct-LLM unit still carries the instruction
+  in its own prompt.
+- **Model work is bounded at 600 seconds on every engine kind.** An improve
+  process, a quality or triage judge, or an index pass whose engine sets no
+  `timeoutMs` now stops after 600 seconds. Before, an agent or `opencode-sdk`
+  engine ran until it finished, and so did memory inference and consolidation
+  on an LLM engine. An engine's own `timeoutMs` still applies.
+- **An improve stage's reply that fails its JSON Schema gets one corrective
+  retry.** The stage retries once with the validation errors, then reads the
+  last reply with its own parser as before. `akm extract` now allows its
+  corrective retry on every engine, not only on one without JSON Schema
+  support. Reflect keeps its own repair turn.
+- **Agent and `opencode-sdk` dispatches leave a usage record.** Each one now
+  writes one `llm_usage` record through the same sink and stage attribution as
+  the LLM path, with the request's model and the tokens the runner reports. An
+  LLM engine still records each HTTP attempt.
+- **`akm proposal new` gets the proposal as JSON from every engine kind, with
+  no live session.** It told every engine to write the asset to a draft file
+  and print no JSON, then parsed stdout as JSON. An LLM engine that followed
+  the instruction could not succeed, and an agent engine succeeded only by
+  writing the file: an agent CLI ran in a live terminal session whose output
+  akm could not read, and otherwise failed with an "interactive mode" error.
+  Every engine now returns the proposal as one JSON object on stdout, and the
+  request carries its JSON Schema: as `response_format` for an LLM engine, as
+  the schema instruction for an agent engine. akm captures the reply, unwraps
+  a harness envelope such as claude's `--output-format json` result, and
+  validates it. A reply that is not a proposal gets one corrective retry, then
+  fails with an error that names the engine. An agent CLI now runs headless:
+  you see the queued proposal, not the agent at work, and no draft file is
+  written.
+- **Unattended model work has one tool policy, which each engine confines or
+  refuses when the request is built.** The policy allows reading, editing only
+  inside a scratch working directory that akm creates for the dispatch and
+  removes after it, and running `akm search` and `akm show`. The stash stays
+  read-only. An LLM engine has no tools. `claude` runs it with `--restricted`
+  (its user, project and local settings, whose allow rules could pre-approve
+  any command or path, are ignored, and its file tools stay in the working
+  directory), `--strict-mcp-config`, `--tools Read,Edit,Bash`, `--allowedTools`
+  for Read, Edit and the two `akm` commands, and `--permission-mode dontAsk`.
+  `opencode` and `opencode-sdk` run an injected `akm-model-work` agent that
+  can read and edit only inside the working directory and has no bash:
+  opencode checks a bash rule against the command's words only, so
+  `akm show x > ~/stash/asset.md` would pass an `akm show *` rule. The agent
+  has its own short prompt in place of opencode's coding-assistant prompt, an
+  8-step limit, and no automatic compaction. opencode only asks the model to
+  stop at that limit, so `opencode-sdk` aborts the session two steps past it,
+  and aborts a session the dispatch times out on; on `opencode` the dispatch
+  timeout is the bound. Every other harness refuses the policy. Such a
+  dispatch ignores the engine's `args` and `workspace`, refuses to start when
+  the temporary directory is inside a git repository, which opencode would
+  treat as its working directory, and fails with `parse_error` when the agent
+  ends with no answer, as opencode can at its step limit.
+- **Unattended model work runs on any engine that confines the model-work
+  tool policy, and config checks that with one rule.**
+  - **Who sends the policy.** The improve processes, the quality, triage and
+    retrieval-gate judges, index passes and `akm remember --enrich` now send
+    it, so they may run on an LLM engine or on a `claude`, `opencode` or
+    `opencode-sdk` agent engine, where they could only use an LLM engine
+    before.
+  - **The one rule.** Every key model work reads its engine from must name
+    such an engine. The keys are `defaults.llmEngine`, `index.defaults.engine`,
+    `index.<pass>.engine`, a strategy's `engine`, a process's `engine`, an
+    enabled triage `judgment.engine`, and a `qualityGate.engine`. A config
+    that breaks the rule fails to load, naming the key, the engine and its
+    platform. The rule replaces six checks that each required an LLM engine
+    for some of those keys, or let the triage judgment use any agent.
+  - **What else is gone.** The plan, reflect, the quality gate and index
+    passes no longer turn an agent engine away. A triage judgment on an agent
+    engine takes a strategy's `llm` overrides as `untranslated-field`
+    notices, where it was refused before.
+  - **Reflect on an agent engine.** The agent returns its proposal as JSON on
+    stdout instead of writing a draft file, which the policy's scratch working
+    directory would not keep.
+  - **The answer is unwrapped.** A model-work reply from an agent engine goes
+    through its harness's result extractor, so a stage call on `claude` gets
+    the answer, not the `--output-format json` envelope around it.
+  - **`--require-engines` checks agent engines too.** It checks an agent
+    engine by its binary on PATH, and an `opencode-sdk` engine by its binary
+    and its LLM fallback's endpoint. It probed only LLM connections before.
+    The usage report and `akm health` count a process's calls whatever its
+    engine's kind.
+- **An `opencode-sdk` engine gets its LLM fallback connection only from its own
+  `llmEngine`. `defaults.llmEngine` no longer supplies one.** An SDK engine
+  that set no `llmEngine` used to borrow `defaults.llmEngine`: its connection,
+  its model (unless the engine set its own) and its timeout. `defaults.llmEngine`
+  names the default engine for unattended model work, and since that work may
+  now run on an agent engine it can be one too, so it is no longer also a
+  connection that every SDK engine shares. **If you relied on the inheritance,
+  set `llmEngine` on the SDK engine**, for example
+  `"sdk": { "kind": "agent", "platform": "opencode-sdk", "llmEngine": "fast" }`.
+  Without one, the SDK engine runs on opencode's own provider and auth, and on
+  its own `model` if it sets one: akm sends it no connection. An SDK engine
+  that sets `llmEngine` is unchanged, and so is a config with no `opencode-sdk`
+  engine. The rule holds everywhere the fallback is read: dispatch, a
+  workflow's frozen concurrency cap, `akm health`, and
+  `akm improve --require-engines`, which now check an SDK engine's fallback
+  endpoint only when it sets `llmEngine`.
+- **Inference reaches `opencode`, `opencode-sdk` and `claude` engines.** A
+  request's `temperature`, `maxTokens`, `contextLength`, `enableThinking` and
+  `reasoningEffort` came from the engine's own settings, an improve process's
+  `llm` overlay, a task, command or agent asset's `inference`, a workflow's
+  `llm:` and a `models.json` alias, and every agent engine dropped all of them
+  with an `untranslated-field` notice. Each platform now translates what it can
+  carry, and the nearest layer wins, field by field, as on an LLM engine. With
+  no setting anywhere akm sends nothing of its own, so the model's configured
+  default still applies, such as a `reasoningEffort: "none"` in your opencode
+  config.
+  - **`claude`** gets `reasoningEffort` as `--effort <level>`, passed as given
+    (Claude Code 2.1.283 takes `low`, `medium`, `high`, `xhigh` and `max`).
+    Its other four fields are still reported as untranslated.
+  - **`opencode` and `opencode-sdk`** get inference as opencode config, which
+    merges over your own opencode config for the same provider and model:
+    `temperature` and `reasoningEffort` become `options.temperature` and
+    `options.reasoningEffort` (opencode drops the snake_case spelling),
+    `enableThinking` becomes both wire forms an LLM engine sends, and
+    `maxTokens` with `contextLength` becomes `limit.output` and
+    `limit.context`. Set both limit fields: opencode refuses half a limit, and
+    a half would overwrite the other half of one you declared, so a lone one
+    is reported as untranslated. Without `limit.output` opencode asks for
+    `max_tokens: 32000`, which a small-context server rejects, and a wrong
+    `limit.context` lets it build requests past the server's window. The fields
+    need a `provider/model`: the request's model, or the `--model` an
+    `opencode` engine's `args` name. Model work needs none for its options, so
+    an `opencode-sdk` engine with no `model` and no `llmEngine` gets them too.
+  - **Where it goes.** Model work puts the options on the `akm-model-work`
+    agent that runs it, so opencode's own title call on the same model keeps
+    the model's defaults. Any other dispatch runs your own agent, whose name
+    akm cannot rely on, so its options go on the model and the title call sees
+    them too. `opencode-sdk` makes no title call. An `opencode-sdk` engine
+    declares its `llmEngine` fallback's model with the fallback's own
+    inference, under the engine's and the request's; each distinct set starts
+    its own `opencode serve`, as a different model does.
+- **An agent engine may set the inference fields its platform translates.**
+  `engines.<name>` of `kind: "agent"` took none, so an engine could not carry a
+  `temperature` or a `reasoningEffort` of its own. `opencode` and
+  `opencode-sdk` may set `temperature`, `maxTokens`, `contextLength`,
+  `enableThinking` and `reasoningEffort`, `claude` may set `reasoningEffort`,
+  and every other platform none. A field its platform does not translate fails
+  to load, naming the platform and the fields it does translate. `provider`,
+  `endpoint`, `apiKey`, `apiKeyFile`, `concurrency` and `extraParams` stay
+  invalid on an agent engine.
+- **Reasoning effort has one word in a request, `reasoningEffort`.** The
+  starter `reasoning` alias, an alias in your `models.json` and an asset's
+  `effort:` frontmatter said `effort`, and engines, opencode and the LLM
+  request said `reasoningEffort`. `effort` is now read as `reasoningEffort`
+  where layers are merged, so the nearest layer wins whichever word it used.
+  On an LLM engine an alias's or asset's `effort` is therefore sent as
+  `reasoning_effort`; it was reported as untranslated and dropped before. An
+  LLM engine's own request is unchanged.
+- **Reflect asks every engine kind for the same JSON reply, checks it the same
+  way and repairs it once.** An LLM engine was sent the reply's JSON Schema,
+  and its reply was held to exact fields and repaired once. An agent or
+  `opencode-sdk` engine got a looser contract in its prompt (`ref`, `content`
+  and an optional `frontmatter`) with no schema and no repair, so one invalid
+  reply failed the run. Every engine kind now runs the same iteration:
+  - **The request.** The prompt carries the same output contract, and the
+    reply's JSON Schema is the request's output schema: `response_format` for
+    an LLM engine, as before, and the schema instruction at the end of the
+    prompt for an agent engine. `claude` also gets `--output-format json`,
+    which akm unwraps. An LLM endpoint that rejects JSON Schema still gets the
+    framed-markdown contract.
+  - **The reply.** An agent now returns `content`, `confidence` and a
+    `frontmatterPatch` of `description` and `when_to_use`, and `ref` too when
+    no asset was named, as an LLM does. akm derives a named asset's ref and
+    merges the patch with the source's frontmatter, so an agent can no longer
+    set other frontmatter keys or retarget the proposal.
+  - **The repair.** A reply that fails the contract gets one repair turn that
+    carries the first reply, shared across self-refine passes. A reply that is
+    still invalid fails with `parse_error` and queues nothing. On an agent or
+    `opencode-sdk` engine the error names the engine, as in
+    `Engine "oc" reply was not a valid reflect proposal after 2 attempts: …`.
+    An LLM engine's message is unchanged, because improve feeds it into later
+    prompts as a pattern to avoid. A failed agent dispatch is still reported
+    with its exit code and stderr.
+  - **What reflect sends and reports on an agent engine.** Reflect asks every
+    engine kind for no visible chain of thought (`enableThinking: false`).
+    `opencode` and `opencode-sdk` carry it, as the inference entry above
+    says; `claude` reports it as an `untranslated-field` notice, as it does
+    for every other stage. `reflect_completed` carries `outputMode` and
+    `repairAttempts` for every engine kind.
+  - **Unchanged.** An LLM engine's requests are byte-identical to before:
+    reflect's generation and repair, and its quality judge. So are the
+    refine passes, the content budget (an LLM engine's context length), the
+    protected frontmatter fields, the review routing and the judge selection.
+
+### Removed
+
+- **Two harness metadata fields that nothing read.** Each of the ten harness
+  descriptors carried an execution `pattern` and a `structuredOutput` tier.
+  No code branched on either: the shared request lowering appends the schema
+  instruction to every agent prompt, and a harness's own argv builder adds its
+  native channel, as codex does with `--output-schema`. The fields, their two
+  types and the tests that pinned their values are gone. Nothing you run
+  changes.
+- **`resolveLlmEngineUse`'s swap of an agent engine for an LLM engine.** Given
+  an agent engine, it used the engine's `llmEngine`, then `defaults.llmEngine`,
+  and warned. Only the implicit SDK fallback above could reach it, so nothing
+  you run changes. An agent engine passed to it is now an error.
+- **An `effort` hint on the agent dispatch request that nothing read.** The
+  lowering set it from `inference.effort`, reserved for a workflow field, and
+  no builder consumed it. `reasoningEffort` in the request's inference is read
+  where it is translated, and the field is gone.
+- **The agent file-write contract.** An agent was once told to write its
+  proposal to a draft file and print `DRAFT_WRITTEN confidence=<n>`. Reflect and
+  `akm proposal new` had already stopped sending that instruction, because the
+  model-work scratch directory does not outlive a dispatch. The instruction, the
+  function that read the `DRAFT_WRITTEN` line and the `draftFilePath` prompt
+  inputs that nothing passed any more are gone, with their tests. So is
+  reflect's `ref_mismatch` check: a reflect that names an asset derives the
+  proposal's ref, so an engine can no longer name another one. Nothing you run
+  changes.
+
+### Fixed
+
+- **An `opencode-sdk` engine with an LLM fallback now reaches its endpoint,
+  and a failed dispatch is reported as a failure (#1015).** The `akm-custom`
+  provider that akm generates for the fallback listed no models, so opencode
+  could not find the model and failed every dispatch. akm now declares the
+  routed model under the provider's `models`. The runner also ignored the
+  error that the SDK client returns for an HTTP error, and the error opencode
+  puts on a reply when the provider rejects a request, and reported
+  `ok: true` with empty output. Both now give `ok: false`, with opencode's
+  error name and message in `error` and `stderr`. An aborted message is
+  `aborted`, a reply cut off at the output limit is `parse_error`, and any
+  other error is `non_zero_exit`. A reply with several text parts now returns
+  the last one, which is the answer, instead of the first.
+- **An LLM engine reports a provider error sent with HTTP 200 as a failure.**
+  OpenRouter, for one, answers a request whose provider fails after the
+  response has started with HTTP 200 and a body that holds only an `error`
+  object and no `choices`. akm returned that as an empty reply with
+  `ok: true`. It is now a provider error with the body in its message, as an
+  error status is.
+- **An `opencode` engine runs a persona instead of failing.** akm passed the
+  persona to `opencode run` as `--system-prompt`, which opencode 1.18 does
+  not accept, so opencode printed its usage and exited 1 on every dispatch
+  that carried a persona, including `akm agent <agent-ref> --engine opencode`.
+  akm now composes the persona into the prompt in an `<AKM_PERSONA>` block,
+  as it does for harnesses with no system-prompt option.
+- **`opencode` and `opencode-sdk` engines receive a requested output schema.**
+  They dropped it with only an `untranslated-field` warning, so a schema from
+  `akm agent`, `akm command run`, a command's frontmatter or a task's
+  `output:` never reached the model. They now get it as the same instruction
+  every other agent engine gets.
+- **An LLM engine sends a requested schema unless it opts out.** It sent
+  `response_format` only when the engine set `supportsJsonSchema: true`, so an
+  engine that left the flag unset never had its output constrained. It now
+  sends it unless the engine sets `supportsJsonSchema: false`. An endpoint
+  that rejects it with a 4xx is still retried once without it.
+- **A workflow unit on `claude`, `copilot`, `gemini`, `pi`, `aider`,
+  `amazonq` or `openhands` gets the schema instruction once.** The unit prompt
+  carried it and the harness builder appended a second copy.
+- **A feature gate's timeout now stops the call it bounds.** When an improve
+  stage's gate timed out (600 seconds unless the call sets its own), the model
+  call kept running in the background, on an engine with `timeoutMs: 900000`
+  for up to five more minutes. The gate now aborts it.
+- **A stage call reports a timeout or abort by the dispatch's own reason.** A
+  timed-out or aborted agent or `opencode-sdk` dispatch, and an LLM timeout
+  inside a feature gate, came back as `error`. They now come back as `timeout`
+  or `aborted`.
+
+- **`akm proposal new` keeps the reply's confidence.** The engine's
+  self-rated `confidence` was parsed and then dropped, so a proposal from
+  `proposal new` never carried the field the reference says it has.
+- **Model work on an agent or `opencode-sdk` engine that sets no `timeoutMs` now
+  stops after 600 seconds, as documented.** Such an engine resolved to an
+  explicit "no timeout", so the 600-second bound for model work never applied
+  to it. An engine's own `timeoutMs`, `null` included, still applies, and
+  other work on an agent engine still runs until it finishes.
+- **The announcement of the implicit `opencode-sdk` fallback is now true.** It
+  says provider, model and auth come from opencode's own configuration, but the
+  fallback engine borrowed `defaults.llmEngine`'s connection whenever one was
+  set, so opencode got an akm-generated provider and model instead. It now runs
+  on opencode's own configuration, as announced.
+- **`model: reasoning` set no effort on `claude`, `opencode` or `opencode-sdk`.**
+  The starter alias supplies `effort: high` for all three, and each dropped it
+  with an `untranslated-field` notice, so the alias chose a stronger model and
+  nothing more. It now sets `--effort high` on `claude` and
+  `options.reasoningEffort` on opencode (see "Inference reaches `opencode`,
+  `opencode-sdk` and `claude` engines" above). An improve process's
+  `llm.reasoningEffort` and `llm.temperature` overlay now reaches those
+  engines the same way.
+
+## [0.9.24] - 2026-10-02
+
+### Changed
+
+- **Reflect never auto-accepts a revision that changes the body; it waits for
+  review.** On 396 labelled reflect edits, the judge-passed edits that changed
+  the body were good 12 times in 37, and those that changed only the
+  frontmatter 13 times in 13. A revision whose body differs from the asset's,
+  ignoring whitespace, or whose source could not be read, is now created
+  pending and deferred for review with the reason `body-edit` (gate
+  `reflect`). When the quality judge passed it, the judge's scores and reason
+  stay on its gate decision. With `processes.reflect.qualityGate` off, no
+  judge ran, so the decision carries none. Before, the triage drain accepted a
+  judge-passed body edit, and its judgment tier could accept one made with the
+  gate off. These body edits now appear in the review queue
+  (`akm proposal list`), and `akm proposal show <id>` gives the reason and any
+  judge scores. A judge-passed revision that leaves the body unchanged is
+  still staged and accepted by the drain. A frontmatter-only revision made
+  with the gate off is still left to the drain, and a revision the judge fails
+  is still refused.
+
+### Fixed
+
+- **Reflect sends a revision to review when its judge fails, instead of
+  rejecting it.** A quality judge that timed out, errored or returned a reply
+  that could not be parsed gave no verdict, but reflect treated that as a
+  rejection. It created no proposal, recorded a `quality_rejected` attempt that
+  kept the asset from being reflected again for 14 days, and reported
+  `quality gate rejected: score=-1` with a reason saying the revision had been
+  routed to review. Reflect now creates the proposal and leaves it pending for
+  a person, deferred by the quality gate with the reason `judge-error`, as
+  distill does when its judge fails. The triage drain leaves it alone. It has
+  not been through the retrieval regression check, which runs only on a
+  revision the judge passes. A revision the judge scores too low is still
+  refused.
+- **The triage drain leaves every proposal a stage deferred for review to a
+  person.** It skipped a deferred proposal only when the quality gate had
+  deferred it. Reflect defers with its own gate, `reflect`: a revision whose
+  size the size guard flagged, one that echoed the truncation notice, one made
+  with no judge configured, and now a body edit. With
+  `processes.triage.judgment` enabled, the drain's judgment tier decided those
+  proposals, and under `applyMode: promote` it could accept them before anyone
+  saw them. The drain now skips every deferral it did not make itself, and
+  judges again, as before, the ones it did.
+
 ## [0.9.23] - 2026-10-01
 
 ### Added

package/dist/commands/health/checks.js

@@ -3,7 +3,6 @@
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import { spawnSync } from "node:child_process";
 import { loadConfig } from "../../core/config/config.js";
-import { IMPROVE_PROCESS_ENGINE_CAPABILITIES } from "../../core/config/engine-semantics.js";
 import { listEnvsRecursive } from "../../core/env-secret-ref.js";
 import { ConfigError } from "../../core/errors.js";
 import { EXTRACT_INFRASTRUCTURE_SKIP_REASONS } from "../../core/improve-types.js";
@@ -15,7 +14,7 @@ import { loadModelMap, mergeModelMapLayers, parseModelMapLayer, readInstalledMod
 import { probeEndpointOnce } from "../../llm/client.js";
 import { STATE_DB_FREELIST_WARN_RATIO, } from "../../storage/state-db-integrity.js";
 import { listKeys } from "../env/env.js";
-import { resolveImprovePlan } from "../improve/improve-strategies.js";
+import { MODEL_CALLING_PROCESSES, resolveImprovePlan } from "../improve/improve-strategies.js";
 import { ENGINE_LAST_USED_LOOKBACK_DAYS } from "./engine-usage.js";
 import { ACTIVE_RUN_WARN_MS, TASK_FAIL_RATE_WARN, } from "./types.js";
 /** Probe one connection's reachability, once per endpoint; `undefined` when no probe seam is supplied. */
@@ -142,7 +141,7 @@ async function runConfiguredEngineProbe(checkName, engineName, config, deps, rea
                 evidence: { engine: engineName, runtimeKind: "sdk", binaryAvailable: false },
             };
         }
-        const fallbackEngine = configuredEngine.llmEngine ?? config.defaults?.llmEngine;
+        const fallbackEngine = configuredEngine.llmEngine;
         let fallback;
         let fallbackCredential;
         let fallbackApiKeyFile;
@@ -523,17 +522,17 @@ export function probeActiveImproveStrategy(deps = {}) {
             .sort(([a], [b]) => a.localeCompare(b))
             .map(([process, engine]) => `${process}: "${engine}"`)
             .join(", ");
-        // #957: fail only when the strategy's LLM-backed work would be a total
-        // no-op — every process the strategy actually enabled among the
-        // `capability: "llm"` set (see IMPROVE_PROCESS_ENGINE_CAPABILITIES) ended
-        // up unavailable. A partial failure (some processes still have a working
+        // #957: fail only when the strategy's model work would be a total no-op —
+        // every process the strategy actually enabled among the ones that call a
+        // model themselves (MODEL_CALLING_PROCESSES, any engine kind) ended up
+        // unavailable. A partial failure (some processes still have a working
         // engine) stays a `warn`, matching #914's "a credential warn stays a warn"
         // policy for the general per-engine probes; this is the strategy-scoped
         // "is the whole run a no-op" question instead.
-        const llmProcessNames = Object.keys(IMPROVE_PROCESS_ENGINE_CAPABILITIES).filter((name) => IMPROVE_PROCESS_ENGINE_CAPABILITIES[name] === "llm");
-        const requiredLlmProcessNames = llmProcessNames.filter((name) => plan.processes[name].enabled || plan.engineUnavailable.some((item) => item.process === name));
-        const availableLlmProcessNames = llmProcessNames.filter((name) => plan.processes[name].enabled);
-        const allRequiredUnavailable = requiredLlmProcessNames.length > 0 && availableLlmProcessNames.length === 0;
+        const modelProcessNames = [...MODEL_CALLING_PROCESSES];
+        const requiredModelProcessNames = modelProcessNames.filter((name) => plan.processes[name].enabled || plan.engineUnavailable.some((item) => item.process === name));
+        const availableModelProcessNames = modelProcessNames.filter((name) => plan.processes[name].enabled);
+        const allRequiredUnavailable = requiredModelProcessNames.length > 0 && availableModelProcessNames.length === 0;
         const status = unavailableProcesses.length === 0 ? "pass" : allRequiredUnavailable ? "fail" : "warn";
         return {
             check: {

package/dist/commands/improve/consolidate/pair-pass.js

@@ -36,6 +36,7 @@ import { concurrentMap } from "../../../core/concurrent.js";
 import { parseEmbeddedJsonResponse } from "../../../core/parse.js";
 import { DERIVED_SUFFIX } from "../../../core/recognition-util.js";
 import { warnOnce } from "../../../core/warn.js";
+import { runnerLlmConnection } from "../../../integrations/agent/runner.js";
 import { assertRunnerCredentials } from "../../../integrations/agent/runner-dispatch.js";
 import { runGit } from "../../../sources/providers/git-install.js";
 import { closeDatabase, openExistingDatabase, openReadonlyExistingDatabase, } from "../../../storage/repositories/index-connection.js";
@@ -501,7 +502,7 @@ async function judgeOne(ctx, candidate) {
         request: {
             responseSchema: PAIR_JUDGE_JSON_SCHEMA,
             enableThinking: false,
-            timeoutMs: ctx.llmRunner.timeoutMs,
+            ...(Object.hasOwn(ctx.llmRunner, "timeoutMs") ? { timeoutMs: ctx.llmRunner.timeoutMs } : {}),
             signal: ctx.opts.signal,
             ...(ctx.chat ? { chat: ctx.chat } : {}),
         },
@@ -747,7 +748,7 @@ seams = {}) {
         // entirely and needs no credential.
         if (!seams.chat)
             assertRunnerCredentials(llmRunner);
-        const results = await concurrentMap(judgeable, (candidate) => judgeOne(ctx, candidate), llmRunner.connection.concurrency ?? 1, { signal: opts.signal });
+        const results = await concurrentMap(judgeable, (candidate) => judgeOne(ctx, candidate), runnerLlmConnection(llmRunner)?.concurrency ?? 1, { signal: opts.signal });
         results.forEach((r, idx) => {
             // Must-fix 3: `concurrentMap` leaves an entry `undefined` for a call an
             // aborted run never sent at all — `r?.failed === true` reads that as

package/dist/commands/improve/consolidate.js

@@ -36,6 +36,7 @@ import { resolveWriteTarget } from "../../core/write-source.js";
 import { deriveInstallations } from "../../indexer/installations.js";
 import { resolveSourceEntries } from "../../indexer/search/search-source.js";
 import { USAGE_EVENT_RETENTION_DAYS } from "../../indexer/usage/usage-events.js";
+import { runnerLlmConnection } from "../../integrations/agent/runner.js";
 import { assertRunnerCredentials } from "../../integrations/agent/runner-dispatch.js";
 import { cosineSimilarity, embedBatch, resolveEmbeddingModelId } from "../../llm/embedder.js";
 import { getBodyEmbeddings, upsertBodyEmbeddings } from "../../storage/repositories/embeddings-repository.js";
@@ -566,7 +567,7 @@ async function judgeConsolidationChunks(args) {
             request: {
                 responseSchema: CONSOLIDATE_PLAN_JSON_SCHEMA,
                 enableThinking: false,
-                timeoutMs: llmRunner.timeoutMs,
+                ...(Object.hasOwn(llmRunner, "timeoutMs") ? { timeoutMs: llmRunner.timeoutMs } : {}),
                 signal: opts.signal,
             },
             ...(opts.onNotices ? { onNotices: opts.onNotices } : {}),
@@ -619,7 +620,7 @@ async function planConsolidation(opts, config, stashDir, memories, warnings, sta
     const llmRunner = opts.llmRunner ?? undefined;
     // 500 body chars per memory keep the judgement useful; chunk size varies instead.
     const bodyTruncation = 500;
-    const chunkSize = computeSafeChunkSize(llmRunner?.connection.contextLength ?? DEFAULT_CONTEXT_LENGTH_TOKENS, bodyTruncation, opts.maxChunkSize);
+    const chunkSize = computeSafeChunkSize((llmRunner && runnerLlmConnection(llmRunner)?.contextLength) ?? DEFAULT_CONTEXT_LENGTH_TOKENS, bodyTruncation, opts.maxChunkSize);
     const sourceName = opts.target ?? stashDir;
     let budgeted = memories;
     const budgetMs = opts.signal?.remainingBudgetMs;

package/dist/commands/improve/execution.js

@@ -2,6 +2,7 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import { deepMergeConfig } from "../../core/config/deep-merge.js";
+import { MODEL_WORK_TOOLS } from "../../execution/source.js";
 import { buildExecution, resolveExecution } from "../../integrations/agent/execution.js";
 function own(value, key) {
     return value !== undefined && Object.hasOwn(value, key);
@@ -22,6 +23,8 @@ function mergeDefaults(farther, nearer) {
 /**
  * Resolve improve-owned model work through the canonical execution cascade:
  * defaults.llmEngine -> strategy -> index.<pass> -> process -> current invocation.
+ * The engine may be of any kind that confines the model-work tool policy: one
+ * that cannot, chosen with `--engine` say, is refused here, before any work.
  */
 export function resolveImproveExecution(options) {
     const defaultEngine = options.config.defaults?.llmEngine;
@@ -33,7 +36,7 @@ export function resolveImproveExecution(options) {
     if (selectedEngine === undefined || selectedEngine === null)
         return null;
     const invocationDefaults = mergeDefaults(mergeDefaults(defaultEngine ? { engine: defaultEngine } : {}, profileDefaults), indexDefaults);
-    const current = mergeDefaults(processDefaults, currentDefaults);
+    const current = { ...mergeDefaults(processDefaults, currentDefaults), tools: MODEL_WORK_TOOLS };
     const prepared = resolveExecution({
         content: `improve ${options.processName} execution selection`,
         config: options.config,
@@ -43,12 +46,3 @@ export function resolveImproveExecution(options) {
     const lowered = buildExecution(prepared.request, prepared.runner);
     return Object.freeze({ runner: lowered.runner, notices: lowered.notices });
 }
-export function resolveImproveLlmExecution(options) {
-    const resolved = resolveImproveExecution(options);
-    if (!resolved)
-        return null;
-    if (resolved.runner.kind !== "llm") {
-        return null;
-    }
-    return { runner: resolved.runner, notices: resolved.notices };
-}

package/dist/commands/improve/extract-prompt.js

@@ -9,9 +9,9 @@
  * session data into the markdown template loaded from
  * `src/assets/prompts/extract-session.md`.
  *
- * The schema is intentionally strict — providers with `supportsJsonSchema:
- * true` enforce shape upstream, so the parser only has to handle the
- * happy path. `additionalProperties: false` means any hallucinated keys
+ * The schema is intentionally strict — a provider that honours
+ * `response_format` enforces shape upstream, so the parser only has to handle
+ * the happy path. `additionalProperties: false` means any hallucinated keys
  * the model emits get dropped before we parse.
  */
 import promptTemplate from "../../assets/prompts/extract-session.md" with { type: "text" };
@@ -20,7 +20,7 @@ const EXTRACT_CANDIDATE_NAME_PATTERN = "^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:/[a-z
 const EXTRACT_CANDIDATE_NAME_RE = new RegExp(EXTRACT_CANDIDATE_NAME_PATTERN);
 /**
  * JSON Schema for the structured extract output. Passed to `chatCompletion`
- * when the configured LLM connection has `supportsJsonSchema: true`.
+ * unless the configured LLM connection sets `supportsJsonSchema: false`.
  *
  * Shape:
  *   {

package/dist/commands/improve/extract.js

@@ -32,16 +32,15 @@ import { indexWrittenAssets } from "../../indexer/index-written-assets.js";
 import { assertRunnerCredentials } from "../../integrations/agent/runner-dispatch.js";
 import { getAvailableHarnesses } from "../../integrations/session-logs/index.js";
 import { preFilterSession } from "../../integrations/session-logs/pre-filter.js";
-import { isJsonSchemaKnownUnsupported } from "../../llm/client.js";
 import { getExtractedSessionsMap, getLastExtractRunAt, shouldSkipAlreadyExtractedSession, upsertExtractedSession, } from "../../storage/repositories/extract-sessions-repository.js";
 import { openSqliteReadSnapshot } from "../../storage/sqlite-read-snapshot.js";
 import { contentHash } from "./content-hash.js";
-import { resolveImproveLlmExecution } from "./execution.js";
+import { resolveImproveExecution } from "./execution.js";
 import { buildExtractPrompt, EXTRACT_JSON_SCHEMA, parseExtractPayload, } from "./extract-prompt.js";
 import { cloneAndFreeze, resolveImproveStrategy, resolveProcessEnabled } from "./improve-strategies.js";
 import { isLedgerBlocked, ledgerKey, loadLedgerSnapshot } from "./ledger.js";
 import { buildSessionSummaryPrompt, parseSessionSummary, SESSION_SUMMARY_JSON_SCHEMA, sessionMeetsDurationGate, writeSessionAsset, } from "./session-asset.js";
-import { callStage, mintProposal, noticeSet } from "./stage.js";
+import { callStage, callStageOnce, mintProposal, noticeSet } from "./stage.js";
 /** Minimum session duration (minutes) for writing a session asset. */
 const DEFAULT_MIN_SESSION_DURATION_MINUTES = 5;
 /** Raw session size (chars) below which the LLM call is skipped; only truly empty sessions are safe to skip. */
@@ -119,7 +118,7 @@ export function resolveStandaloneExtractPlan(config, selection) {
     }
     const selected = resolveImproveStrategy(selection.strategy, config);
     const process = cloneAndFreeze(getImproveProcessConfig("extract", selected.config) ?? {});
-    const resolved = resolveImproveLlmExecution({
+    const resolved = resolveImproveExecution({
         config,
         profile: selected.config,
         process,
@@ -130,7 +129,7 @@ export function resolveStandaloneExtractPlan(config, selection) {
         processName: "extract",
     });
     if (!resolved) {
-        throw new ConfigError("No LLM engine configured for extract. Set defaults.llmEngine, pass --engine, or select an improve strategy with processes.extract.engine.", "LLM_NOT_CONFIGURED");
+        throw new ConfigError("No engine configured for extract. Set defaults.llmEngine, pass --engine, or select an improve strategy with processes.extract.engine.", "LLM_NOT_CONFIGURED");
     }
     const runner = resolved.runner;
     return Object.freeze({
@@ -358,15 +357,16 @@ function planExtractSessions(args) {
 }
 const EXTRACT_LLM_UNAVAILABLE = Symbol("extract-llm-unavailable");
 /**
- * One session's extraction call. A connection without structured output gets
- * one corrective retry; configuration errors escape before any state is written.
+ * One session's extraction call, with one corrective retry; configuration
+ * errors escape before any state is written.
  */
 async function extractFromSession(run, prompt) {
     const { llmRunner } = run;
     try {
         const result = await runStructured({
             dispatch: async (feedback) => {
-                const outcome = await callStage({
+                // This loop parses and repairs the reply itself, so each attempt is one unvalidated dispatch.
+                const outcome = await callStageOnce({
                     feature: "session_extraction",
                     runner: llmRunner,
                     prompt: feedback ? `${prompt}\n\n## Corrective output instruction\n\n${feedback}` : prompt,
@@ -388,9 +388,6 @@ async function extractFromSession(run, prompt) {
                 return payload.parseFailure ? undefined : payload;
             },
             validate: (payload) => ({ ok: true, value: payload }),
-            maxAttempts: llmRunner.connection.supportsJsonSchema !== false && !isJsonSchemaKnownUnsupported(llmRunner.connection)
-                ? 1
-                : 2,
             buildFeedback: () => "Your previous response did not contain a valid extraction payload. Respond with ONLY a JSON object matching the requested schema, with a candidates array and no prose or code fences.",
         });
         if (result.ok)
@@ -714,13 +711,13 @@ function resolveExtractRun(options, config, process, activeProfile) {
         llmRunner = options.llmRunner;
     }
     else {
-        const resolved = resolveImproveLlmExecution({ config, profile: activeProfile, process, processName: "extract" });
+        const resolved = resolveImproveExecution({ config, profile: activeProfile, process, processName: "extract" });
         llmRunner = resolved?.runner;
         if (resolved)
             notices.add(resolved.notices);
     }
     if (!llmRunner) {
-        throw new ConfigError("No LLM engine configured for extract. Set defaults.llmEngine or improve.strategies.<name>.processes.extract.engine.", "LLM_NOT_CONFIGURED");
+        throw new ConfigError("No engine configured for extract. Set defaults.llmEngine or improve.strategies.<name>.processes.extract.engine.", "LLM_NOT_CONFIGURED");
     }
     const runner = llmRunner;
     const timeoutMs = options.resolvedPlan