akm-cli 0.9.26-alpha.2 → 0.9.27-alpha.1

package/dist/core/asset/frontmatter.js

@@ -196,17 +196,77 @@ function countLines(text) {
  * frontmatter: round-tripping the mapping through the YAML serializer drops
  * comments and normalizes formatting, which is unacceptable for a write that
  * only needs to contribute one line. Shared by `ensureAkmMarkdownType`
- * (stamping `updated:` on write) and lint's `--fix` for `missing-updated`.
+ * (adding `type:` and `updated:` on write) and lint's `--fix` for
+ * `missing-updated`. The new line takes the block's own line ending.
  */
 export function spliceFrontmatterLine(raw, line) {
-    const lines = raw.split(/\r?\n/);
-    if (lines[0]?.trim() !== "---")
+    // Alternating [line, eol, line, eol, …, line]: joining the parts back
+    // reproduces `raw` byte for byte, CRLF and all.
+    const parts = raw.split(/(\r?\n)/);
+    if (parts[0]?.trim() !== "---")
         return null;
-    const closeIdx = lines.findIndex((l, i) => i > 0 && l.trim() === "---");
-    if (closeIdx === -1)
+    const closeAt = parts.findIndex((part, i) => i > 0 && part.trim() === "---");
+    if (closeAt === -1)
+        return null;
+    parts.splice(closeAt, 0, line, parts[1]);
+    return parts.join("");
+}
+/**
+ * Replace the top-level `key:` line of an existing frontmatter block with
+ * `line`, leaving every other byte untouched — the counterpart to
+ * {@link spliceFrontmatterLine} for correcting a field's value in place.
+ *
+ * Only that one physical line is replaced, so a value that continues onto
+ * further lines (a block sequence, a folded scalar) would be left dangling:
+ * the caller must check that the result still parses to what it meant. Returns
+ * null when `raw` has no well-formed block or no such line.
+ */
+export function replaceFrontmatterLine(raw, key, line) {
+    const parts = raw.split(/(\r?\n)/);
+    if (parts[0]?.trim() !== "---")
+        return null;
+    const closeAt = parts.findIndex((part, i) => i > 0 && part.trim() === "---");
+    if (closeAt === -1)
         return null;
-    lines.splice(closeIdx, 0, line);
-    return lines.join("\n");
+    const at = parts.findIndex((part, i) => i > 0 && i < closeAt && part.match(/^(\w[\w-]*):(?:[ \t]|$)/)?.[1] === key);
+    if (at === -1)
+        return null;
+    parts[at] = line;
+    return parts.join("");
+}
+/**
+ * Replace the top-level blocks of `keys` in an existing frontmatter block with
+ * `lines`, leaving every other byte untouched — the counterpart to
+ * {@link spliceFrontmatterLine} for a write that owns whole keys, such as the
+ * provenance stamp's `generated`, `verified` and `provenance`.
+ *
+ * A key's block is its `key:` line and the lines directly under it that
+ * continue it: indented lines and `- ` items. Every such block is removed
+ * wherever it sits, and `lines` are added just before the closing `---`, in the
+ * block's own line ending. A block with a blank line or a comment inside it is
+ * not removed whole, so the caller must check that the result still parses to
+ * what it meant. Returns null when `raw` has no well-formed block.
+ */
+export function replaceFrontmatterBlocks(raw, keys, lines) {
+    const parts = raw.split(/(\r?\n)/);
+    if (parts[0]?.trim() !== "---")
+        return null;
+    const closeAt = parts.findIndex((part, i) => i > 0 && part.trim() === "---");
+    if (closeAt === -1)
+        return null;
+    const kept = [];
+    for (let i = 2; i < closeAt; i += 2) {
+        const key = parts[i].match(/^(\w[\w-]*):(?:[ \t]|$)/)?.[1];
+        if (key === undefined || !keys.includes(key)) {
+            kept.push(parts[i], parts[i + 1]);
+            continue;
+        }
+        // One of the keys: drop its line and the lines that continue it.
+        while (i + 2 < closeAt && /^(?:[ \t]|-(?:[ \t]|$))/.test(parts[i + 2]))
+            i += 2;
+    }
+    const added = lines.flatMap((line) => [line, parts[1]]);
+    return [parts[0], parts[1], ...kept, ...added, ...parts.slice(closeAt)].join("");
 }
 /**
  * Strip one layer of matching quotes — frontmatter list items are often quoted

package/dist/core/config/config-schema.js

@@ -59,7 +59,7 @@ import { WorkflowConfigSchema } from "./schema/workflow.js";
 export { EmbeddingConnectionConfigSchema } from "./schema/embedding.js";
 export { EngineConfigSchema, EnginesSchema, LlmConnectionConfigSchema, LlmProfileConfigSchema } from "./schema/engines.js";
 export { ExperimentalConfigSchema } from "./schema/experimental.js";
-export { FEEDBACK_FAILURE_MODES, FeedbackConfigSchema } from "./schema/feedback.js";
+export { FeedbackConfigSchema } from "./schema/feedback.js";
 export { ImproveConfigSchema } from "./schema/improve.js";
 export { ConsolidateProcessConfigSchema, DistillProcessConfigSchema, ExtractProcessConfigSchema, ImproveProcessConfigSchema, ImproveProfileConfigSchema, MemoryInferenceProcessConfigSchema, ProactiveMaintenanceProcessConfigSchema, ReflectProcessConfigSchema, TriageProcessConfigSchema, ValidationProcessConfigSchema, } from "./schema/improve-processes.js";
 export { IndexConfigSchema, IndexPassConfigSchema } from "./schema/index-config.js";

package/dist/core/config/config.js

@@ -23,10 +23,6 @@ import { getConfigPath } from "../paths.js";
 import { warn, warnOnce } from "../warn.js";
 // Canonical harness-id source of truth (#565) — runtime value re-export.
 export { VALID_HARNESS_IDS } from "./config-types.js";
-// ── Feedback failure-mode constants (F-3 / #384) ────────────────────────────
-// Canonical taxonomy lives in the schema/validator layer; re-exported here so
-// existing `../core/config/config` import sites keep working.
-export { FEEDBACK_FAILURE_MODES } from "./config-schema.js";
 // ── Defaults ────────────────────────────────────────────────────────────────
 export const DEFAULT_CONFIG = {
     configVersion: "0.9.0",

package/dist/core/config/schema/feedback.js

@@ -2,30 +2,13 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 /**
- * Feedback taxonomy + `feedback` config section. Extracted verbatim from the
- * former `config-schema.ts` monolith — no behavior change.
+ * `feedback` config section. The retired `allowedFailureModes` key (it went
+ * with `akm feedback --failure-mode`) is tolerated as an unknown key.
  */
 import { z } from "zod";
-import { nonEmptyString } from "./primitives.js";
-// ── Feedback failure modes (F-3 / #384) ─────────────────────────────────────
-/**
- * Curated taxonomy of failure modes for negative feedback.
- *
- * Structured failure modes enable aggregation across feedback events so the
- * distill pipeline can detect that "5 assets failed for the same reason" and
- * act on it — free-text strings about the same issue are not aggregatable.
- */
-export const FEEDBACK_FAILURE_MODES = [
-    "incorrect", // Factually wrong or logically flawed content
-    "outdated", // Correct at some point but now stale
-    "dangerous", // Could cause harm if followed (security, safety)
-    "incomplete", // Missing key steps, context, or caveats
-    "redundant", // Duplicates another asset without adding value
-];
 // ── Feedback ────────────────────────────────────────────────────────────────
 export const FeedbackConfigSchema = z
     .object({
     requireReason: z.boolean().optional(),
-    allowedFailureModes: z.array(nonEmptyString).optional(),
 })
     .passthrough();

package/dist/indexer/indexer.js

@@ -5,7 +5,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { detectAdapterId } from "../core/adapter/detect-adapter.js";
 import { adapterForId } from "../core/adapter/registry.js";
-import { isHttpUrl } from "../core/common.js";
+import { compareCodePoints, isHttpUrl } from "../core/common.js";
 import { classifyPathAccess, describeInaccessiblePath } from "../core/path-access.js";
 import { getDbPath } from "../core/paths.js";
 import { SCRIPT_EXTENSIONS } from "../core/recognition-util.js";
@@ -14,6 +14,7 @@ import { isVerbose, warn, warnOnce, warnVerbose } from "../core/warn.js";
 import { resolveSourcesForOrigin } from "../registry/origin-resolve.js";
 import { closeDatabase, openExistingDatabase, openIndexDatabase, openReadonlyExistingDatabase, } from "../storage/repositories/index-connection.js";
 import { deleteEntriesByBundle, deleteEntriesByDirAndBundle, deleteEntriesByDirExceptRefs, deleteEntriesByIds, deleteUsageEventsByEntryIds, findEntryIdByRef, getAllEntries, getEmbeddableEntryCount, getEntryCount, getIndexedBundleIdsByDir, getIndexedDirPathsByBundleId, relinkUsageEvents, upsertEntry, } from "../storage/repositories/index-entries-repository.js";
+import { rebuildFtsIfTotalsStale } from "../storage/repositories/index-fts-repository.js";
 import { clearStaleCacheEntries } from "../storage/repositories/index-llm-cache-repository.js";
 import { deleteIndexDirState, deleteMeta, getIndexDirState, getMeta, setMeta, upsertIndexDirState, } from "../storage/repositories/index-meta-repository.js";
 import { VACUUM_PENDING_META } from "../storage/repositories/index-schema.js";
@@ -125,7 +126,14 @@ export async function runEmbeddingPass(params) {
  */
 function finalizeIndex(args) {
     const { db, sources, sourceDirs, stashDir, signal, onProgress } = args;
-    onProgress({ phase: "fts", message: "Full-text search index is current." });
+    // Rows replaced or removed since its BM25 totals were taken leave them off; recompute them (#1048).
+    const rebuilt = rebuildFtsIfTotalsStale(db);
+    onProgress({
+        phase: "fts",
+        message: rebuilt
+            ? "Rebuilt the full-text search index to recompute its totals."
+            : "Full-text search index is current.",
+    });
     const tFtsEnd = Date.now();
     // Re-link state.db usage events to the regenerated index and recompute the
     // derived utility cache. Stored refs already use the current item-ref grammar,
@@ -907,11 +915,6 @@ function requiresWorkflowSourcePreflight(ctxs) {
 }
 /** Phase 2 (sync): write all pre-generated scan records inside a single transaction. */
 function persistDirRecords(db, dirRecords, warnings, bundleByRoot) {
-    // Per-source dedup: the same logical asset can appear more than once within
-    // one owning source, where source order still makes the first occurrence win.
-    // The owner is part of the key so identical concepts in different bundles
-    // remain distinct indexed rows.
-    const indexedAssetIdentities = new Set();
     const deletedUsageEntryIds = new Set();
     const findPersisted = db.prepare("SELECT id, content_hash, file_path, adapter_id FROM entries WHERE item_ref = ?");
     const insertTransaction = db.transaction(() => {
@@ -961,7 +964,7 @@ function persistDirRecords(db, dirRecords, warnings, bundleByRoot) {
             let persistedRows = 0;
             let dedupedRows = 0;
             if (stash) {
-                const ownerIdentity = bundle.bundleId;
+                const sourceRoot = `${path.resolve(currentStashDir)}${path.sep}`;
                 for (const entry of stash.entries) {
                     const entryPath = entry.filename ? path.join(dirPath, entry.filename) : null;
                     if (!entryPath) {
@@ -973,23 +976,36 @@ function persistDirRecords(db, dirRecords, warnings, bundleByRoot) {
                         warn(`Skipping entry without adapter-owned concept identity: ${entryPath}`);
                         continue;
                     }
-                    // Adapter-owned concept identity is path-based and cannot be replaced
-                    // by presentation fields such as type/title.
-                    const identityKey = `${ownerIdentity}\0${adapterConceptId}`;
-                    if (indexedAssetIdentities.has(identityKey)) {
-                        dedupedRows++;
-                        continue;
-                    }
-                    indexedAssetIdentities.add(identityKey);
                     // content_hash = doc.hash from the drain, keyed by the recognized
                     // file's path. A missing hash preserves the existing value on upsert.
                     const contentHash = hashByFile?.get(entryPath);
+                    // Adapter-owned concept identity is path-based and cannot be replaced
+                    // by presentation fields such as type/title.
                     const provenance = deriveEntryProvenance(bundle, entry.type, entry.name, adapterConceptId);
+                    // Two files of one source can claim one ref (a skill's references/a.md and
+                    // knowledge/skills/x/references/a.md are both knowledge/skills/x/references/a). The file with
+                    // the smaller path holds it, whichever directories this run drains and in whatever order the
+                    // walk met them (#1050): an entry yields to a row held by a file with a smaller path and
+                    // otherwise takes the ref over. The same concept in another bundle is a different row, and a
+                    // holder whose file is gone is no claim.
+                    const holder = findPersisted.get(provenance.itemRef) ?? undefined;
+                    if (holder &&
+                        holder.file_path !== entryPath &&
+                        holder.file_path.startsWith(sourceRoot) &&
+                        fs.existsSync(holder.file_path)) {
+                        const yields = compareCodePoints(holder.file_path, entryPath) < 0;
+                        const [indexed, skipped] = yields ? [holder.file_path, entryPath] : [entryPath, holder.file_path];
+                        warnings.push(`Two files claim ${provenance.itemRef}: indexed ${indexed}, skipped ${skipped}.`);
+                        if (yields) {
+                            dedupedRows++;
+                            continue;
+                        }
+                        // The directory the ref comes from now has a row fewer than its files: drain it again.
+                        deleteIndexDirState(db, path.dirname(holder.file_path));
+                    }
                     keptItemRefs.add(provenance.itemRef);
                     persistedRows++;
-                    const previous = sameVariant
-                        ? (findPersisted.get(provenance.itemRef) ?? undefined)
-                        : undefined;
+                    const previous = sameVariant ? holder : undefined;
                     const unchanged = previous !== undefined &&
                         contentHash !== undefined &&
                         previous.content_hash === contentHash &&

package/dist/integrations/harnesses/codex/agent-builder.js

@@ -19,12 +19,13 @@
  *     `./result-extractor.ts`. Always emitted, mirroring how the Claude builder
  *     always emits `--print`: dispatch is the captured, non-interactive path.
  *   - Codex is the NATIVE-SCHEMA tier (plan §"Structured-output
- *     normalization"): `req.schema` is written to a temp file and passed via
- *     `--output-schema <file>`. The file is tiny, uniquely named under the OS
- *     temp dir, and intentionally NOT cleaned up here — `BuiltCommand` has no
- *     post-run hook, and the spawned process reads the file after `build()`
- *     returns. OS temp reaping owns the lifecycle. The engine still validates
- *     the output defensively (the constrained output is trusted but verified).
+ *     normalization"): `req.schema` is written to a file and passed via
+ *     `--output-schema <file>`. The file is named by the hash of the schema
+ *     and lives in akm's cache dir, so a schema is written once however many
+ *     units dispatch with it: `BuiltCommand` has no post-run hook, and the
+ *     spawned process reads the file after `build()` returns, so a file per
+ *     dispatch could only leak (#1051). The engine still validates the output
+ *     defensively (the constrained output is trusted but verified).
  *   - `codex exec` has no system-prompt flag; `req.systemPrompt` is folded
  *     into the prompt payload (system text first, blank line, then the task),
  *     after the `--` end-of-options separator so it can never be parsed as a
@@ -52,22 +53,29 @@
  * that registry, so this builder is reachable under the `"codex"` platform
  * name without any further wiring.
  */
-import { mkdtempSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
+import { mkdirSync } from "node:fs";
 import { join } from "node:path";
+import { writeFileAtomic } from "../../../core/common.js";
+import { getCacheDir } from "../../../core/paths.js";
+import { sha256Hex } from "../../../runtime.js";
 import { resolveDispatchModel } from "../../agent/builder-shared.js";
 import { createAgentRequestLowerer } from "../../agent/request-lowering.js";
 /**
- * Write a node's JSON Schema to a fresh temp file for `--output-schema`.
+ * Write a node's JSON Schema to a file for `--output-schema`, named by the hash
+ * of its text, in akm's cache dir. Returns the absolute file path (the value
+ * handed to the flag).
  *
- * A unique `mkdtemp` directory per build avoids collisions between concurrent
- * fan-out units dispatching in the same process. Returns the absolute file
- * path (the value handed to the flag).
+ * The same schema is the same file, so concurrent fan-out units share it, and
+ * the atomic rename makes a write of identical bytes safe under a reader: no
+ * unit can see a half-written schema, and none removes it from another. Nothing
+ * is cleaned up, because nothing accumulates but one file per distinct schema.
  */
 export function writeCodexOutputSchemaFile(schema) {
-    const dir = mkdtempSync(join(tmpdir(), "akm-codex-schema-"));
-    const file = join(dir, "output-schema.json");
-    writeFileSync(file, `${JSON.stringify(schema, null, 2)}\n`, "utf8");
+    const text = `${JSON.stringify(schema, null, 2)}\n`;
+    const dir = join(getCacheDir(), "codex-output-schemas");
+    mkdirSync(dir, { recursive: true });
+    const file = join(dir, `${sha256Hex(text)}.json`);
+    writeFileAtomic(file, text);
     return file;
 }
 /**

package/dist/llm/client.js

@@ -222,12 +222,18 @@ async function chatCompletionReal(config, messages, options) {
  * a config/endpoint change can never leave a stale verdict in place.
  */
 const jsonSchemaUnsupportedConnections = new Set();
+/**
+ * The same, for the two thinking-control fields (`chat_template_kwargs` and
+ * `enable_thinking`): a strict hosted API answers 400 `Unknown parameter`.
+ */
+const thinkingControlRejectedConnections = new Set();
 function connectionKey(config) {
     return `${config.endpoint}|${config.model}`;
 }
-/** TEST-ONLY. Clear the in-memory json-schema-support tracker between tests. */
-export function _resetJsonSchemaSupportTrackerForTests() {
+/** TEST-ONLY. Clear the in-memory endpoint-support trackers between tests. */
+export function _resetEndpointSupportTrackersForTests() {
     jsonSchemaUnsupportedConnections.clear();
+    thinkingControlRejectedConnections.clear();
 }
 /**
  * Whether this connection has already been proven, this process, not to
@@ -239,6 +245,24 @@ export function _resetJsonSchemaSupportTrackerForTests() {
 export function isJsonSchemaKnownUnsupported(config) {
     return jsonSchemaUnsupportedConnections.has(connectionKey(config));
 }
+/** Whether a real call this process showed this connection rejects the thinking-control fields (#1045). */
+export function isThinkingControlKnownRejected(config) {
+    return thinkingControlRejectedConnections.has(connectionKey(config));
+}
+/**
+ * Whether `err` is a provider's 4xx (a rate limit is not one) that may be a
+ * verdict on the shape of this request rather than on the request's own content.
+ */
+function isRejectedRequest(err) {
+    return (err instanceof LlmCallError &&
+        err.code === "provider_error" &&
+        typeof err.statusCode === "number" &&
+        err.statusCode >= 400 &&
+        err.statusCode < 500 &&
+        err.statusCode !== 429);
+}
+/** A strict API names the field it does not know: `Unknown parameter: 'chat_template_kwargs'.` */
+const THINKING_FIELD_NAMED = /chat_template_kwargs|enable_thinking/;
 /**
  * A single chat-completion attempt: one HTTP request/response cycle, with an
  * inline fallback-once when a schema was requested and the provider 4xx's
@@ -248,29 +272,35 @@ export function isJsonSchemaKnownUnsupported(config) {
  * `config.supportsJsonSchema === false` is the only thing that skips it,
  * and that is a value a human (or workflow author) set explicitly, not one
  * a probe wrote automatically.
+ *
+ * The thinking-control fields get the same treatment (#1045): a 4xx that
+ * names `chat_template_kwargs` or `enable_thinking` is answered by one retry
+ * without them, which may in turn fall back without the schema.
  */
-async function chatCompletionAttempt(config, messages, options, timeoutMs) {
+async function chatCompletionAttempt(config, messages, options, timeoutMs, includeThinking = (options?.enableThinking ?? config.enableThinking) !== undefined &&
+    !isThinkingControlKnownRejected(config)) {
     const wantsSchema = Boolean(options?.responseSchema) && config.supportsJsonSchema !== false && !isJsonSchemaKnownUnsupported(config);
     try {
-        return await chatCompletionAttemptOnce(config, messages, options, timeoutMs, wantsSchema);
+        return await chatCompletionAttemptOnce(config, messages, options, timeoutMs, wantsSchema, includeThinking);
     }
     catch (err) {
-        if (!wantsSchema ||
-            !(err instanceof LlmCallError) ||
-            err.code !== "provider_error" ||
-            typeof err.statusCode !== "number" ||
-            err.statusCode < 400 ||
-            err.statusCode >= 500 ||
-            err.statusCode === 429) {
+        if (!isRejectedRequest(err))
             throw err;
+        if (includeThinking && THINKING_FIELD_NAMED.test(err.message)) {
+            warnVerbose(`[akm] LLM rejected chat_template_kwargs/enable_thinking (${err.statusCode}); retrying once without them: ${err.message}`);
+            const fallback = await chatCompletionAttempt(config, messages, options, timeoutMs, false);
+            thinkingControlRejectedConnections.add(connectionKey(config));
+            return fallback;
         }
+        if (!wantsSchema)
+            throw err;
         warnVerbose(`[akm] LLM rejected response_format:json_schema (${err.statusCode}); retrying once without it: ${err.message}`);
-        const fallback = await chatCompletionAttemptOnce(config, messages, options, timeoutMs, false);
+        const fallback = await chatCompletionAttemptOnce(config, messages, options, timeoutMs, false, includeThinking);
         jsonSchemaUnsupportedConnections.add(connectionKey(config));
         return fallback;
     }
 }
-async function chatCompletionAttemptOnce(config, messages, options, timeoutMs, includeSchema) {
+async function chatCompletionAttemptOnce(config, messages, options, timeoutMs, includeSchema, includeThinking) {
     if (config.extraParams !== undefined) {
         const issue = validateExtraParams(config.extraParams)[0];
         if (issue)
@@ -309,7 +339,7 @@ async function chatCompletionAttemptOnce(config, messages, options, timeoutMs, i
     // (freellmapi, Bifrost) can drop either one depending on how it was built.
     // Send both whenever thinking is explicitly resolved so the same engine
     // block keeps working across a direct vhost or any gateway in front of it.
-    const resolvedEnableThinking = options?.enableThinking ?? config.enableThinking;
+    const resolvedEnableThinking = includeThinking ? (options?.enableThinking ?? config.enableThinking) : undefined;
     const thinkingParams = resolvedEnableThinking === undefined
         ? {}
         : { chat_template_kwargs: { enable_thinking: resolvedEnableThinking }, enable_thinking: resolvedEnableThinking };

package/dist/llm/memory-infer.js

@@ -46,7 +46,7 @@ const PROMPT_PLACEHOLDERS = new Set([
  * — no more "incomplete derived memory payload from LLM; skipping memory"
  * for shape-only failures.
  */
-const DERIVED_MEMORY_JSON_SCHEMA = {
+export const DERIVED_MEMORY_JSON_SCHEMA = {
     type: "object",
     properties: {
         title: { type: "string", minLength: 1 },

package/dist/scripts/akm-migrate-node.js

@@ -25639,6 +25639,7 @@ var $visitAsync = visit.visitAsync;
 import path7 from "node:path";
 // src/runtime.ts
 import { spawn as nodeSpawn, spawnSync as nodeSpawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
 import { createWriteStream, statfsSync } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
 import path6 from "node:path";
@@ -26803,6 +26804,9 @@ async function writeResponseToFileCapped(filePath, res, options) {
     reader.releaseLock?.();
   }
 }
+function sha256Hex(data) {
+  return createHash("sha256").update(data).digest("hex");
+}
 function getDirname(importMetaUrl) {
   return path6.dirname(fileURLToPath(importMetaUrl));
 }
@@ -35845,8 +35849,7 @@ var ExperimentalConfigSchema = exports_external.object({
 
 // src/core/config/schema/feedback.ts
 var FeedbackConfigSchema = exports_external.object({
-  requireReason: exports_external.boolean().optional(),
-  allowedFailureModes: exports_external.array(nonEmptyString).optional()
+  requireReason: exports_external.boolean().optional()
 }).passthrough();
 
 // src/core/config/schema/improve-processes.ts
@@ -36850,7 +36853,7 @@ function withConfigLock(fn) {
 }
 
 // src/core/config/config-sources.ts
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 import fs9 from "node:fs";
 import path13 from "node:path";
 function bundleComponentConfig(bundle) {
@@ -36913,7 +36916,7 @@ function filesystemBundleSourceId(contentRoot) {
   });
 }
 function hashBundleSourceIdentity(identity3) {
-  return `sha256:${createHash("sha256").update("akm.bundle-source\x00v1\x00").update(JSON.stringify(identity3)).digest("hex")}`;
+  return `sha256:${createHash2("sha256").update("akm.bundle-source\x00v1\x00").update(JSON.stringify(identity3)).digest("hex")}`;
 }
 function bundleContentRoots(config) {
   const bundles = config.bundles ?? {};
@@ -38375,7 +38378,7 @@ async function tryFetchJson(url, headers) {
 }
 
 // src/sources/providers/provider-utils.ts
-import { createHash as createHash4, randomUUID as randomUUID2 } from "node:crypto";
+import { createHash as createHash5, randomUUID as randomUUID2 } from "node:crypto";
 import fs27 from "node:fs";
 import path34 from "node:path";
 
@@ -38470,7 +38473,7 @@ function countLines(text) {
 }
 
 // src/core/adapter/adapters/shared.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 
 // src/core/asset/frontmatter-lint.ts
 function checkUnquotedDescriptionColon(frontmatterText) {
@@ -38492,7 +38495,7 @@ function checkUnquotedDescriptionColon(frontmatterText) {
 
 // src/core/adapter/adapters/shared.ts
 function hashContent(content) {
-  return createHash2("sha256").update(content, "utf8").digest("hex");
+  return createHash3("sha256").update(content, "utf8").digest("hex");
 }
 function nonEmptyString2(value) {
   if (typeof value !== "string")
@@ -39675,7 +39678,7 @@ function extractDirTagsFromName(name) {
 }
 
 // src/core/adapter/execution-source.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 
 // src/execution/source.ts
 var EXECUTION_SOURCE_SCHEMA_VERSION = 1;
@@ -40013,7 +40016,7 @@ function renderMarkdownExecutionSource(input) {
       bundle: identity3.bundle,
       adapter: identity3.adapter,
       file: identity3.file,
-      hash: createHash3("sha256").update(raw, "utf8").digest("hex")
+      hash: createHash4("sha256").update(raw, "utf8").digest("hex")
     },
     ...hasDefaults ? { defaults } : {},
     ...extensions === undefined ? {} : { extensions }
@@ -46568,7 +46571,7 @@ function uniqueSlug() {
 }
 function buildInstallCacheDir(cacheRootDir, source, id, version) {
   const safeId = id.replace(/[^a-zA-Z0-9_.-]+/g, "-").replace(/^-+|-+$/g, "");
-  const identitySuffix = version === "writable" ? `-${createHash4("sha256").update(`${source}:${id}`).digest("hex").slice(0, 12)}` : "";
+  const identitySuffix = version === "writable" ? `-${createHash5("sha256").update(`${source}:${id}`).digest("hex").slice(0, 12)}` : "";
   const slug = `${source}-${safeId}${identitySuffix}`;
   const versionSlug = source === "local" ? uniqueSlug() : version?.replace(/[^a-zA-Z0-9_.-]+/g, "-") ?? uniqueSlug();
   return path34.join(cacheRootDir, slug || source, versionSlug);
@@ -46589,7 +46592,7 @@ async function downloadArchive(url, destination) {
 }
 async function computeFileHash(filePath) {
   const data = fs27.readFileSync(filePath);
-  const hash = createHash4("sha256").update(data).digest("hex");
+  const hash = createHash5("sha256").update(data).digest("hex");
   return `sha256:${hash}`;
 }
 function isDirectory(target) {
@@ -46764,7 +46767,7 @@ function redactUrlUserinfo(text) {
   return text.replace(/\b([A-Za-z][A-Za-z0-9+.-]*:\/\/)([^\s/@]+)@/g, "$1[REDACTED]@");
 }
 // src/sources/providers/git-provider.ts
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 import fs30 from "node:fs";
 import path36 from "node:path";
 
@@ -46825,7 +46828,7 @@ function resolveGitContentDir(config) {
   throw new ConfigError("git source entry must have either `path` or `url`");
 }
 function getCachePaths(repoUrl, cacheRootOverride) {
-  const key = createHash5("sha256").update(repoUrl).digest("hex").slice(0, 16);
+  const key = createHash6("sha256").update(repoUrl).digest("hex").slice(0, 16);
   const cacheRoot = cacheRootOverride ?? getRegistryIndexCacheDir();
   const rootDir = path36.join(cacheRoot, `git-${key}`);
   return {
@@ -47046,7 +47049,7 @@ import fs33 from "node:fs";
 import path39 from "node:path";
 
 // src/sources/providers/tar-utils.ts
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 import fs32 from "node:fs";
 import path38 from "node:path";
 function verifyArchiveIntegrity(archivePath, expected, source) {
@@ -47059,7 +47062,7 @@ function verifyArchiveIntegrity(archivePath, expected, source) {
     const dashIndex = expected.indexOf("-");
     const algorithm = expected.slice(0, dashIndex);
     const expectedBase64 = expected.slice(dashIndex + 1);
-    const actualBase64 = createHash6(algorithm).update(fileBuffer).digest("base64");
+    const actualBase64 = createHash7(algorithm).update(fileBuffer).digest("base64");
     if (actualBase64 !== expectedBase64) {
       fs32.unlinkSync(archivePath);
       throw new Error(`Integrity check failed for ${archivePath}: expected ${algorithm} digest ${expectedBase64}, got ${actualBase64}`);
@@ -47067,7 +47070,7 @@ function verifyArchiveIntegrity(archivePath, expected, source) {
     return;
   }
   if (/^[0-9a-f]{40}$/i.test(expected)) {
-    const actualHex = createHash6("sha1").update(fileBuffer).digest("hex");
+    const actualHex = createHash7("sha1").update(fileBuffer).digest("hex");
     if (actualHex.toLowerCase() !== expected.toLowerCase()) {
       fs32.unlinkSync(archivePath);
       throw new Error(`Integrity check failed for ${archivePath}: expected sha1 ${expected}, got ${actualHex}`);
@@ -51670,14 +51673,15 @@ class ClaudeHarness extends BaseHarness {
 }
 
 // src/integrations/harnesses/codex/agent-builder.ts
-import { mkdtempSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
+import { mkdirSync } from "node:fs";
 import { join } from "node:path";
 function writeCodexOutputSchemaFile(schema) {
-  const dir = mkdtempSync(join(tmpdir(), "akm-codex-schema-"));
-  const file = join(dir, "output-schema.json");
-  writeFileSync(file, `${JSON.stringify(schema, null, 2)}
-`, "utf8");
+  const text = `${JSON.stringify(schema, null, 2)}
+`;
+  const dir = join(getCacheDir(), "codex-output-schemas");
+  mkdirSync(dir, { recursive: true });
+  const file = join(dir, `${sha256Hex(text)}.json`);
+  writeFileAtomic(file, text);
   return file;
 }
 function ensureSandboxFlags(base) {