akm-cli 0.9.23 → 0.9.25-alpha.1

package/dist/core/config/config-schema.js

@@ -39,7 +39,8 @@
  *   enforced at save time via `superRefine` on the top-level schema.
  */
 import { z } from "zod";
-import { BUILTIN_IMPROVE_STRATEGY_NAMES, IMPROVE_PROCESS_ENGINE_CAPABILITIES } from "./engine-semantics.js";
+import { HARNESS_MODEL_WORK_IDS } from "../../integrations/harnesses/ids.js";
+import { BUILTIN_IMPROVE_STRATEGY_NAMES, IMPROVE_ENGINE_PROCESSES } from "./engine-semantics.js";
 import { EmbeddingConnectionConfigSchema } from "./schema/embedding.js";
 import { EnginesSchema } from "./schema/engines.js";
 import { ExecutionPolicyConfigSchema } from "./schema/execution.js";
@@ -222,13 +223,32 @@ export const AkmConfigSchema = AkmConfigBaseSchema.superRefine((config, ctx) =>
             message: "engine does not name a configured engine",
         });
     }
-    const defaultLlm = config.defaults?.llmEngine;
-    if (defaultLlm && config.engines?.[defaultLlm]?.kind !== "llm") {
-        ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            path: ["defaults", "llmEngine"],
-            message: "llmEngine must name an LLM engine",
-        });
+    // One rule for every key unattended model work reads its engine from: the
+    // engine must confine the model-work tool policy (an LLM, or an agent whose
+    // harness does), because that work runs over generated content with no one
+    // watching.
+    const confining = [...HARNESS_MODEL_WORK_IDS];
+    const confiningPlatforms = `${confining.slice(0, -1).join(", ")} or ${confining.at(-1)}`;
+    const modelWorkEngine = (name, path) => {
+        if (!name)
+            return;
+        const engine = config.engines?.[name];
+        if (!engine) {
+            ctx.addIssue({ code: z.ZodIssueCode.custom, path, message: "engine does not name a configured engine" });
+        }
+        else if (engine.kind !== "llm" && !HARNESS_MODEL_WORK_IDS.has(engine.platform)) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path,
+                message: `engine "${name}" (platform ${engine.platform}) cannot confine the model-work tool policy, which unattended model work requires. Use an LLM engine, or an agent engine on ${confiningPlatforms}.`,
+            });
+        }
+    };
+    modelWorkEngine(config.defaults?.llmEngine, ["defaults", "llmEngine"]);
+    for (const [passName, pass] of Object.entries(config.index ?? {})) {
+        const engine = pass?.engine;
+        if (typeof engine === "string")
+            modelWorkEngine(engine, ["index", passName, "engine"]);
     }
     const workflowJudge = config.workflow?.judgeEngine;
     if (workflowJudge && !config.engines?.[workflowJudge]) {
@@ -256,68 +276,25 @@ export const AkmConfigSchema = AkmConfigBaseSchema.superRefine((config, ctx) =>
         });
     }
     for (const [strategyName, strategy] of Object.entries(config.improve?.strategies ?? {})) {
-        const strategyEngine = strategy.engine;
-        if (strategyEngine) {
-            const engine = config.engines?.[strategyEngine];
-            if (!engine || engine.kind !== "llm") {
-                ctx.addIssue({
-                    code: z.ZodIssueCode.custom,
-                    path: ["improve", "strategies", strategyName, "engine"],
-                    message: engine ? "strategy engine must be an LLM engine" : "engine does not name a configured engine",
-                });
-            }
-        }
+        const strategyPath = ["improve", "strategies", strategyName];
+        modelWorkEngine(strategy.engine, [...strategyPath, "engine"]);
         for (const [processName, process] of Object.entries(strategy.processes ?? {})) {
             const processConfig = process;
-            const capability = IMPROVE_PROCESS_ENGINE_CAPABILITIES[processName];
-            if (processConfig.engine && capability === null) {
+            const processPath = [...strategyPath, "processes", processName];
+            if (processConfig.engine && !IMPROVE_ENGINE_PROCESSES.includes(processName)) {
                 ctx.addIssue({
                     code: z.ZodIssueCode.custom,
-                    path: ["improve", "strategies", strategyName, "processes", processName, "engine"],
+                    path: [...processPath, "engine"],
                     message: `${processName} does not dispatch an engine`,
                 });
             }
             else {
-                const processEngine = processConfig.engine ?? strategyEngine;
-                if (processEngine && capability === "llm") {
-                    const engine = config.engines?.[processEngine];
-                    if (!engine || engine.kind !== "llm") {
-                        ctx.addIssue({
-                            code: z.ZodIssueCode.custom,
-                            path: ["improve", "strategies", strategyName, "processes", processName, "engine"],
-                            message: engine ? `${processName} requires an LLM engine` : "engine does not name a configured engine",
-                        });
-                    }
-                }
-                else if (processConfig.engine && capability === "runner" && !config.engines?.[processConfig.engine]) {
-                    ctx.addIssue({
-                        code: z.ZodIssueCode.custom,
-                        path: ["improve", "strategies", strategyName, "processes", processName, "engine"],
-                        message: "engine does not name a configured engine",
-                    });
-                }
+                modelWorkEngine(processConfig.engine, [...processPath, "engine"]);
             }
-            const judgmentEngine = processConfig.judgment?.engine;
-            if (processConfig.judgment?.enabled === true && judgmentEngine) {
-                const engine = config.engines?.[judgmentEngine];
-                if (!engine) {
-                    ctx.addIssue({
-                        code: z.ZodIssueCode.custom,
-                        path: ["improve", "strategies", strategyName, "processes", processName, "judgment", "engine"],
-                        message: "engine does not name a configured engine",
-                    });
-                }
-            }
-            const gateEngine = processConfig.qualityGate?.engine;
-            if (gateEngine && config.engines?.[gateEngine]?.kind !== "llm") {
-                ctx.addIssue({
-                    code: z.ZodIssueCode.custom,
-                    path: ["improve", "strategies", strategyName, "processes", processName, "qualityGate", "engine"],
-                    message: config.engines?.[gateEngine]
-                        ? "a quality-gate judge must be an LLM engine"
-                        : "engine does not name a configured engine",
-                });
+            if (processConfig.judgment?.enabled === true) {
+                modelWorkEngine(processConfig.judgment.engine, [...processPath, "judgment", "engine"]);
             }
+            modelWorkEngine(processConfig.qualityGate?.engine, [...processPath, "qualityGate", "engine"]);
         }
     }
     // #464.a: defaultWriteTarget must name a configured source. 0.9.0 (spec

package/dist/core/config/engine-semantics.js

@@ -11,14 +11,18 @@ export const BUILTIN_IMPROVE_STRATEGY_NAMES = [
     "reflect-distill",
     "proactive-maintenance",
 ];
-/** Engine capability required by each configured improve process. `null` means engine-free. */
-export const IMPROVE_PROCESS_ENGINE_CAPABILITIES = {
-    reflect: "llm",
-    distill: "llm",
-    consolidate: "llm",
-    memoryInference: "llm",
-    extract: "llm",
-    validation: "llm",
-    triage: "runner",
-    proactiveMaintenance: null,
-};
+/**
+ * The improve processes that use an engine. Triage's engine is its judgment's;
+ * each of the others makes the process's own model calls.
+ */
+export const IMPROVE_ENGINE_PROCESSES = [
+    "reflect",
+    "distill",
+    "consolidate",
+    "memoryInference",
+    "extract",
+    "validation",
+    "triage",
+];
+/** Every improve process, in plan order: the engine processes and `proactiveMaintenance`, which uses none. */
+export const IMPROVE_PROCESS_NAMES = [...IMPROVE_ENGINE_PROCESSES, "proactiveMaintenance"];

package/dist/core/config/schema/engines.js

@@ -13,7 +13,7 @@ import { z } from "zod";
 // `config-types`, which type-derives from this barrel via
 // `typeof import("./config-schema")` — routing through config-types would mint
 // a config-schema ↔ config-types type cycle that collapses inference.
-import { HARNESS_AGENT_DISPATCH_IDS, VALID_HARNESS_IDS } from "../../../integrations/harnesses/ids.js";
+import { HARNESS_AGENT_DISPATCH_IDS, harnessInferenceKeys, VALID_HARNESS_IDS, } from "../../../integrations/harnesses/ids.js";
 import { WORKFLOW_MAX_TIMEOUT_MS } from "../../../workflows/resource-limits.js";
 import { chatCompletionsEndpoint, ExtraParamsSchema, engineName, nonEmptyString, positiveInt, symbolicOrWarnApiKey, } from "./primitives.js";
 /**
@@ -105,6 +105,20 @@ const LlmEngineSchema = z
         });
     }
 });
+/**
+ * The inference fields an agent engine may set: the ones its platform
+ * translates (`harnesses/ids.ts`). An asset's or a caller's inference reaches
+ * every engine and reports what the engine does not translate as a lowering
+ * notice; an engine the operator configures for a platform names only what
+ * that platform carries, so the rest is an error here.
+ */
+const AGENT_INFERENCE_KEYS = [
+    "temperature",
+    "maxTokens",
+    "contextLength",
+    "enableThinking",
+    "reasoningEffort",
+];
 const AgentEngineSchema = z
     .object({
     kind: z.literal("agent"),
@@ -117,26 +131,30 @@ const AgentEngineSchema = z
     model: nonEmptyString.optional(),
     timeoutMs: timeoutMsField,
     llmEngine: engineName.optional(),
+    temperature: z.number().finite().optional(),
+    maxTokens: positiveInt.optional(),
+    contextLength: positiveInt.optional(),
+    enableThinking: z.boolean().optional(),
+    reasoningEffort: nonEmptyString.optional(),
 })
     .passthrough()
     .superRefine((value, ctx) => {
-    for (const key of [
-        "provider",
-        "endpoint",
-        "apiKey",
-        "apiKeyFile",
-        "temperature",
-        "maxTokens",
-        "concurrency",
-        "extraParams",
-        "contextLength",
-        "enableThinking",
-        "reasoningEffort",
-        "modelAliases",
-    ]) {
+    for (const key of ["provider", "endpoint", "apiKey", "apiKeyFile", "concurrency", "extraParams", "modelAliases"]) {
         if (key in value)
             ctx.addIssue({ code: z.ZodIssueCode.custom, path: [key], message: `${key} is not valid on an agent engine` });
     }
+    const translated = harnessInferenceKeys(value.platform);
+    for (const key of AGENT_INFERENCE_KEYS) {
+        if (key in value && !translated.includes(key)) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: [key],
+                message: `${key} is not valid on a ${value.platform} engine: ${translated.length > 0
+                    ? `the platform translates only ${translated.join(", ")}`
+                    : "the platform translates no inference fields"}`,
+            });
+        }
+    }
     if (value.platform !== "opencode-sdk" && value.llmEngine !== undefined) {
         ctx.addIssue({
             code: z.ZodIssueCode.custom,

package/dist/core/config/schema/improve-processes.js

@@ -6,7 +6,7 @@
  * verbatim from the former `config-schema.ts` monolith — no behavior change.
  */
 import { z } from "zod";
-import { IMPROVE_PROCESS_ENGINE_CAPABILITIES } from "../engine-semantics.js";
+import { IMPROVE_PROCESS_NAMES } from "../engine-semantics.js";
 import { engineName, LlmInvocationOverridesSchema, nonEmptyString, positiveInt } from "./primitives.js";
 // ── Improve profile / process ──────────────────────────────────────────────
 //
@@ -319,7 +319,7 @@ const ImproveProfileProcessesSchema = z
         });
     }
     for (const [name, process] of Object.entries(val)) {
-        if (!(name in IMPROVE_PROCESS_ENGINE_CAPABILITIES) &&
+        if (!IMPROVE_PROCESS_NAMES.includes(name) &&
             !RETIRED_PROCESS_NAMES.has(name) &&
             process !== null &&
             typeof process === "object" &&

package/dist/core/improve-result.js

@@ -3,7 +3,7 @@
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import { cloneExecutionJsonObject } from "../execution/json.js";
 import { isRecord } from "./common.js";
-import { IMPROVE_PROCESS_ENGINE_CAPABILITIES } from "./config/engine-semantics.js";
+import { IMPROVE_PROCESS_NAMES } from "./config/engine-semantics.js";
 const COMMON_FIELDS = [
     "schemaVersion",
     "ok",
@@ -192,11 +192,11 @@ function validateProactivePlan(value) {
         fail("plan.proactive.selected must equal plan.proactive.selectedRefs.length");
     }
 }
-/** #947 — plan.processes: one row per IMPROVE_PROCESS_ENGINE_CAPABILITIES name, plus an optional "triage.judgment" row. */
+/** #947 — plan.processes: one row per IMPROVE_PROCESS_NAMES name, plus an optional "triage.judgment" row. */
 function validateProcessRoutingRows(value) {
     if (!Array.isArray(value))
         fail("plan.processes must be an array");
-    const canonicalNames = Object.keys(IMPROVE_PROCESS_ENGINE_CAPABILITIES);
+    const canonicalNames = IMPROVE_PROCESS_NAMES;
     const engineKinds = new Set(["llm", "agent", "sdk"]);
     const seen = new Set();
     for (const row of value) {

package/dist/core/structured.js

@@ -24,6 +24,16 @@
  * jittered retry; `runAgent` has timeout/abort semantics).
  */
 import { parseEmbeddedJsonResponse } from "./parse.js";
+/**
+ * Append the one structured-output instruction to a prompt. Agent lowering
+ * appends it to every schema-bearing request, alongside a harness's native
+ * channel where one exists (codex `--output-schema`); the workflow engine
+ * appends it for a direct-LLM unit. Resumed workflow runs depend on these
+ * exact bytes, so do not reword it.
+ */
+export function withSchemaInstruction(prompt, schema) {
+    return `${prompt}\n\nRespond with ONLY a JSON value matching this JSON Schema (no prose, no code fences):\n${JSON.stringify(schema)}`;
+}
 function defaultFeedback(failure) {
     if (failure.reason === "parse_error") {
         return "Your previous response contained no parseable JSON. Respond with ONLY a JSON value that matches the requested schema — no prose, no code fences.";

package/dist/execution/source.js

@@ -5,6 +5,20 @@ import { cloneExecutionJson, cloneExecutionJsonObject } from "./json.js";
 export const EXECUTION_SOURCE_SCHEMA_VERSION = 1;
 /** Current internal adapter identifiers are lowercase kebab-case registry keys. */
 export const EXECUTION_ADAPTER_ID_PATTERN = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+/**
+ * The model-work tool policy: unattended model work (improve, the judges,
+ * index passes, remember) may read, edit only inside the dispatch's own
+ * scratch working directory, and run `akm search` and `akm show`. The stash
+ * stays read-only to it. A transport grants what it can confine and refuses
+ * the policy at build when it can confine nothing; an LLM has no tools.
+ */
+export const MODEL_WORK_TOOLS = Object.freeze(["read", "edit", "akm search", "akm show"]);
+/** Whether a selection names the model-work tool policy. */
+export function isModelWorkTools(tools) {
+    return (Array.isArray(tools) &&
+        tools.length === MODEL_WORK_TOOLS.length &&
+        tools.every((tool, index) => tool === MODEL_WORK_TOOLS[index]));
+}
 function requireRecord(value, path) {
     if (value === null || typeof value !== "object" || Array.isArray(value)) {
         throw new TypeError(`${path} must be an object`);

package/dist/indexer/passes/memory-inference.js

@@ -48,6 +48,7 @@ import { ConfigError } from "../../core/errors.js";
 import { warn } from "../../core/warn.js";
 import { beginWriteProvenance, recordWrittenPath } from "../../core/write-provenance.js";
 import { writeAssetToSource } from "../../core/write-source.js";
+import { runnerLlmConnection } from "../../integrations/agent/runner.js";
 import { assertRunnerCredentials } from "../../integrations/agent/runner-dispatch.js";
 import { isProcessEnabled } from "../../llm/feature-gate.js";
 import { resolveIndexPassExecution } from "../../llm/index-passes.js";
@@ -283,7 +284,7 @@ async function runMemoryInferencePassBody(ctx, provenance) {
     }), 
     // Caller-set connection concurrency or 1: `resolveLlmEngineUse` does
     // not forward `engines.<name>.concurrency`, so config cannot raise this.
-    llmRunner.connection.concurrency ?? 1);
+    runnerLlmConnection(llmRunner)?.concurrency ?? 1);
     if (configFailure)
         throw configFailure;
     for (let i = 0; i < perRecordResults.length; i++) {

package/dist/integrations/agent/builder-shared.js

@@ -5,6 +5,21 @@
 export function resolveDispatchModel(request, _profile, _platform) {
     return request.model;
 }
+/**
+ * The model an engine's own `args` select, as `--model X` or `--model=X` (the
+ * last one wins), for a builder that writes its own argv in place of those args.
+ */
+export function modelFromArgs(args) {
+    let model;
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === "--model")
+            model = args[index + 1];
+        else if (arg?.startsWith("--model="))
+            model = arg.slice("--model=".length);
+    }
+    return model;
+}
 /**
  * Normalize a toolPolicy value to a comma-separated string suitable for a
  * CLI flag. Structured policy objects are JSON-serialized.

package/dist/integrations/agent/config.js

@@ -5,3 +5,5 @@
 export const DEFAULT_AGENT_TIMEOUT_MS = null;
 /** Default hard timeout for direct LLM calls when no engine/use override exists. */
 export const DEFAULT_LLM_TIMEOUT_MS = 600_000;
+/** Default bound on model work (structured calls, judgments) on every runner kind. */
+export const DEFAULT_MODEL_WORK_TIMEOUT_MS = 600_000;

package/dist/integrations/agent/engine-resolution.js

@@ -10,10 +10,10 @@ import { SECRET_STORE_REFERENCE_PATTERN } from "../../core/config/schema/primiti
 import { ConfigError } from "../../core/errors.js";
 import { formatExtraParamsIssue, validateExtraParams } from "../../core/extra-params.js";
 import { collectSensitiveValues } from "../../core/redaction.js";
-import { warn } from "../../core/warn.js";
 import { resolveSecretFromStore } from "../../sources/snapshot-fetchers/secret-seam.js";
 import { getHarness } from "../harnesses/index.js";
-import { DEFAULT_AGENT_TIMEOUT_MS, DEFAULT_LLM_TIMEOUT_MS } from "./config.js";
+import { DEFAULT_LLM_TIMEOUT_MS } from "./config.js";
+import { engineModelAndInference } from "./model-map.js";
 import { getBuiltinAgentProfile, OPENCODE_SDK_SERVER_BIN } from "./profiles.js";
 const LLM_CONNECTION_FIELDS = [
     "provider",
@@ -217,29 +217,15 @@ function rawLlmConnection(engine) {
     }
     return connection;
 }
-export function resolveLlmEngineUse(config, layers, options = {}) {
+/** Resolve one selected LLM engine and overlays without materializing credentials. */
+export function resolveLlmEngineUse(config, layers) {
     const name = selectedEngineName(config, layers, true);
     if (!name) {
-        if (options.optional)
-            return undefined;
         throw new ConfigError("No LLM engine is selected. Set defaults.llmEngine or specify engine.", "LLM_NOT_CONFIGURED");
     }
     const engine = configuredEngine(name, config);
-    if (engine.kind !== "llm") {
-        const fallbackName = engine.llmEngine ?? config.defaults?.llmEngine;
-        const fallbackEngine = fallbackName ? configuredEngine(fallbackName, config) : undefined;
-        if (!fallbackEngine || fallbackEngine.kind !== "llm") {
-            if (options.optional)
-                return undefined;
-            throw new ConfigError(fallbackName
-                ? `Engine "${name}" is not an LLM engine, and its llmEngine fallback "${fallbackName}" is not one either.`
-                : `Engine "${name}" is not an LLM engine, and has no llmEngine fallback configured.`, "INVALID_CONFIG_FILE");
-        }
-        warn(`[akm] Engine "${name}" is an agent engine, not an LLM engine; using its llmEngine "${fallbackName}" instead.`);
-        return options.optional
-            ? resolveLlmEngineUse(config, [{ engine: fallbackName }], { optional: true })
-            : resolveLlmEngineUse(config, [{ engine: fallbackName }]);
-    }
+    if (engine.kind !== "llm")
+        throw new ConfigError(`Engine "${name}" is not an LLM engine.`, "INVALID_CONFIG_FILE");
     let connection = rawLlmConnection(engine);
     for (const layer of layers) {
         if (layer.llm)
@@ -288,6 +274,7 @@ function lowerAgentEngine(name, engine, config) {
     const platform = harness.id;
     const sdk = platform === "opencode-sdk";
     const builtin = getBuiltinAgentProfile(platform);
+    const { inference } = engineModelAndInference(engine);
     const profile = {
         name,
         platform,
@@ -300,20 +287,18 @@ function lowerAgentEngine(name, engine, config) {
         parseOutput: "text",
         ...(engine.workspace ? { workspace: path.resolve(engine.workspace) } : {}),
         ...(engine.model ? { model: engine.model } : {}),
+        ...(inference ? { inference } : {}),
     };
+    // An engine that sets no timeoutMs leaves it unset, so a caller's own default
+    // (model work's 600 s) can apply; a dispatch with none runs unbounded.
     const ownTimeout = Object.hasOwn(engine, "timeoutMs") ? (engine.timeoutMs ?? null) : undefined;
     if (!sdk) {
-        return {
-            kind: "agent",
-            engine: name,
-            profile,
-            timeoutMs: ownTimeout !== undefined ? ownTimeout : DEFAULT_AGENT_TIMEOUT_MS,
-        };
+        return { kind: "agent", engine: name, profile, ...(ownTimeout !== undefined ? { timeoutMs: ownTimeout } : {}) };
     }
-    const fallbackName = engine.llmEngine ?? config.defaults?.llmEngine;
-    const fallback = fallbackName
-        ? resolveLlmEngineUse(config, [{ engine: fallbackName }], { optional: true })
-        : undefined;
+    // The fallback connection is the engine's own `llmEngine` and nothing else. `defaults.llmEngine`
+    // is the default engine for model work, not a connection every SDK engine borrows: with no
+    // `llmEngine`, opencode resolves provider, model and auth from its own configuration.
+    const fallback = engine.llmEngine ? resolveLlmEngineUse(config, [{ engine: engine.llmEngine }]) : undefined;
     return {
         kind: "sdk",
         engine: name,
@@ -327,7 +312,7 @@ function lowerAgentEngine(name, engine, config) {
                 fallbackTimeoutMs: fallback.timeoutMs,
             }
             : {}),
-        timeoutMs: ownTimeout !== undefined ? ownTimeout : (fallback?.timeoutMs ?? DEFAULT_AGENT_TIMEOUT_MS),
+        ...(ownTimeout !== undefined ? { timeoutMs: ownTimeout } : fallback ? { timeoutMs: fallback.timeoutMs } : {}),
     };
 }
 /** Resolve a configured engine name to its runner: an LLM connection, a spawned agent, or the SDK. */

package/dist/integrations/agent/execution.js

@@ -6,9 +6,9 @@ import { ConfigError } from "../../core/errors.js";
 import { DURATION_UNITS, parseDuration } from "../../core/time.js";
 import { EXECUTION_MAX_TIMEOUT_MS } from "../../execution/limits.js";
 import { createInlineResolvedCommand, createResolvedExecutionRequest, decodeResolvedExecutionRequest, } from "../../execution/resolved-request.js";
-import { cloneToolSelection, isPortableExecutionAgentSelector, } from "../../execution/source.js";
+import { cloneToolSelection, isModelWorkTools, isPortableExecutionAgentSelector, } from "../../execution/source.js";
 import { getHarness } from "../harnesses/index.js";
-import { DEFAULT_AGENT_TIMEOUT_MS, DEFAULT_LLM_TIMEOUT_MS } from "./config.js";
+import { DEFAULT_LLM_TIMEOUT_MS } from "./config.js";
 import { FALLBACK_ENGINE_NAME, fallbackEngineConfig, NO_ENGINE_MESSAGE_SUFFIX, NO_ENGINE_REMEDY, } from "./engine-fallback.js";
 import { configuredEngine, resolveEngine } from "./engine-resolution.js";
 import { engineModelAndInference, loadModelMap, resolveModelMapAlias } from "./model-map.js";
@@ -62,21 +62,14 @@ function engineDefaults(name, engine, config) {
     if (engine.platform !== "opencode-sdk") {
         return { kind: "agent", platform: engine.platform, modelMapKey: engine.platform, values };
     }
-    // An SDK engine runs its LLM fallback's model/inference/timeout unless it sets its own.
-    const fallbackName = engine.llmEngine ?? config.defaults?.llmEngine;
+    // An SDK engine runs its own `llmEngine`'s model/inference/timeout unless it sets its own. With no
+    // `llmEngine` it has no fallback, and opencode picks the model: `defaults.llmEngine` is not borrowed.
+    const fallbackName = engine.llmEngine;
     const fallback = fallbackName && config.engines && Object.hasOwn(config.engines, fallbackName)
         ? config.engines[fallbackName]
         : undefined;
     if (fallback?.kind !== "llm" || !fallbackName) {
-        return {
-            kind: "sdk",
-            platform: "opencode-sdk",
-            modelMapKey: "opencode-sdk",
-            values: {
-                ...values,
-                timeout: has(values, "timeout") ? values.timeout : DEFAULT_AGENT_TIMEOUT_MS,
-            },
-        };
+        return { kind: "sdk", platform: "opencode-sdk", modelMapKey: "opencode-sdk", values };
     }
     const inherited = engineModelAndInference(fallback);
     return {
@@ -85,8 +78,11 @@ function engineDefaults(name, engine, config) {
         modelMapKey: own.model === undefined ? fallbackName : "opencode-sdk",
         values: {
             ...(inherited.model !== undefined ? { model: inherited.model } : {}),
-            ...(inherited.inference !== undefined ? { inference: inherited.inference } : {}),
             ...values,
+            // The engine's own inference is added over the fallback's, field by field.
+            ...(inherited.inference !== undefined || own.inference !== undefined
+                ? { inference: { ...inherited.inference, ...own.inference } }
+                : {}),
             timeout: Object.hasOwn(engine, "timeoutMs")
                 ? (engine.timeoutMs ?? null)
                 : Object.hasOwn(fallback, "timeoutMs")
@@ -114,7 +110,10 @@ function runnerDefaults(runner) {
     const platform = runner.profile.platform ?? runner.profile.name;
     const fallback = runner.kind === "sdk" ? runner.fallbackConnection : undefined;
     const model = runner.profile.model ?? fallback?.model;
-    const inference = fallback ? inferenceOf(fallback) : undefined;
+    const fallbackInference = fallback ? inferenceOf(fallback) : undefined;
+    const inference = fallbackInference !== undefined || runner.profile.inference !== undefined
+        ? { ...fallbackInference, ...runner.profile.inference }
+        : undefined;
     return {
         kind: runner.kind,
         platform,
@@ -187,10 +186,17 @@ function requestedToolNames(tools) {
         return undefined;
     return Object.keys(policy).filter((tool) => policy[tool] === true);
 }
-/** Assets may only narrow the host's `execution.allowedTools`; without a config nothing is allowed. */
+/**
+ * Assets may only narrow the host's `execution.allowedTools`; without a config
+ * nothing is allowed. The model-work policy is akm's own and always allowed:
+ * it confines an engine more tightly than leaving tools unset does.
+ */
 function authorizeTools(tools, config) {
     if (!hasToolSelection(tools))
         return { status: "not-required" };
+    if (isModelWorkTools(tools)) {
+        return { status: "allowed", reason: "The model-work tool policy is akm's own.", policy: { id: "model-work" } };
+    }
     if (!config) {
         return {
             status: "denied",
@@ -239,14 +245,16 @@ function applyRequest(base, request) {
             ...timeout,
         };
     }
-    const { model: _model, workspace: _workspace, ...profile } = base.profile;
+    const { model: _model, workspace: _workspace, inference: ownInference, ...profile } = base.profile;
     const workspace = request.runtime.workspace;
+    const inference = Object.hasOwn(request, "inference") ? request.inference : ownInference;
     const next = {
         ...base,
         profile: {
             ...profile,
             ...(model !== undefined ? { model } : {}),
             ...(typeof workspace === "string" ? { workspace } : {}),
+            ...(inference ? { inference } : {}),
         },
         ...timeout,
     };
@@ -260,14 +268,29 @@ function applyRequest(base, request) {
     }
     return next;
 }
-function mergeInference(current, next, source, provenance) {
+/**
+ * Reasoning effort has one word in a request: `reasoningEffort`, which is what
+ * engines, opencode and the LLM request body call it. `effort` is the same
+ * setting as a `models.json` alias or an asset's `effort:` frontmatter spells
+ * it, and becomes `reasoningEffort` here, in the one place every layer's
+ * inference is merged, so the nearest layer wins whichever word it used. When
+ * one inference object has both, `reasoningEffort` wins.
+ */
+function withReasoningEffort(inference) {
+    if (!Object.hasOwn(inference, "effort"))
+        return inference;
+    const { effort, ...rest } = inference;
+    return Object.hasOwn(rest, "reasoningEffort") ? rest : { ...rest, reasoningEffort: effort };
+}
+function mergeInference(current, layerInference, source, provenance) {
     provenance["/inference"] = source;
-    if (next === null) {
+    if (layerInference === null) {
         for (const key of Object.keys(provenance))
             if (key.startsWith("/inference/"))
                 delete provenance[key];
         return null;
     }
+    const next = withReasoningEffort(layerInference);
     for (const key of Object.keys(next)) {
         provenance[`/inference/${key.replaceAll("~", "~0").replaceAll("/", "~1")}`] = source;
     }
@@ -415,7 +438,8 @@ function buildLlm(request, runner, options) {
     if (typeof request.agent === "string" && request.persona === null) {
         throw new ConfigError(`The direct LLM transport cannot consume native agent selector ${JSON.stringify(request.agent)}.`, "INVALID_CONFIG_FILE");
     }
-    if (hasToolSelection(request.tools)) {
+    // An LLM has no tools, which already meets the model-work policy.
+    if (hasToolSelection(request.tools) && !isModelWorkTools(request.tools)) {
         throw new ConfigError("The direct LLM transport cannot enforce the resolved tool policy.", "INVALID_CONFIG_FILE");
     }
     const notices = [...request.notices];
@@ -427,8 +451,9 @@ function buildLlm(request, runner, options) {
             skip(`inference.${key}`);
     }
     const chatOptions = {};
+    // Sent unless the engine opts out; chatCompletion drops it once if the provider rejects it.
     if (request.outputSchema) {
-        if (runner.connection.supportsJsonSchema === true)
+        if (runner.connection.supportsJsonSchema !== false)
             chatOptions.responseSchema = request.outputSchema;
         else
             skip("outputSchema");

package/dist/integrations/agent/index.js

@@ -4,4 +4,4 @@
 export { DEFAULT_AGENT_TIMEOUT_MS } from "./config.js";
 export { _setAgentDetectForTests, defaultWhich, detectAgentCliProfiles, pickDefaultAgentProfile } from "./detect.js";
 export { BUILTIN_AGENT_PROFILE_NAMES, getBuiltinAgentProfile, listBuiltinAgentProfiles, } from "./profiles.js";
-export { buildProposePrompt, buildReflectPrompt, buildSchemaRepairPrompt, extractDraftConfidence, parseAgentProposalPayload, } from "./prompts.js";
+export { buildProposePrompt, buildReflectPrompt, buildSchemaRepairPrompt, parseAgentProposalPayload, } from "./prompts.js";