akm-cli 0.9.26 → 0.9.27-alpha.1

package/dist/indexer/indexer.js

@@ -5,7 +5,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { detectAdapterId } from "../core/adapter/detect-adapter.js";
 import { adapterForId } from "../core/adapter/registry.js";
-import { isHttpUrl } from "../core/common.js";
+import { compareCodePoints, isHttpUrl } from "../core/common.js";
 import { classifyPathAccess, describeInaccessiblePath } from "../core/path-access.js";
 import { getDbPath } from "../core/paths.js";
 import { SCRIPT_EXTENSIONS } from "../core/recognition-util.js";
@@ -14,6 +14,7 @@ import { isVerbose, warn, warnOnce, warnVerbose } from "../core/warn.js";
 import { resolveSourcesForOrigin } from "../registry/origin-resolve.js";
 import { closeDatabase, openExistingDatabase, openIndexDatabase, openReadonlyExistingDatabase, } from "../storage/repositories/index-connection.js";
 import { deleteEntriesByBundle, deleteEntriesByDirAndBundle, deleteEntriesByDirExceptRefs, deleteEntriesByIds, deleteUsageEventsByEntryIds, findEntryIdByRef, getAllEntries, getEmbeddableEntryCount, getEntryCount, getIndexedBundleIdsByDir, getIndexedDirPathsByBundleId, relinkUsageEvents, upsertEntry, } from "../storage/repositories/index-entries-repository.js";
+import { rebuildFtsIfTotalsStale } from "../storage/repositories/index-fts-repository.js";
 import { clearStaleCacheEntries } from "../storage/repositories/index-llm-cache-repository.js";
 import { deleteIndexDirState, deleteMeta, getIndexDirState, getMeta, setMeta, upsertIndexDirState, } from "../storage/repositories/index-meta-repository.js";
 import { VACUUM_PENDING_META } from "../storage/repositories/index-schema.js";
@@ -125,7 +126,14 @@ export async function runEmbeddingPass(params) {
  */
 function finalizeIndex(args) {
     const { db, sources, sourceDirs, stashDir, signal, onProgress } = args;
-    onProgress({ phase: "fts", message: "Full-text search index is current." });
+    // Rows replaced or removed since its BM25 totals were taken leave them off; recompute them (#1048).
+    const rebuilt = rebuildFtsIfTotalsStale(db);
+    onProgress({
+        phase: "fts",
+        message: rebuilt
+            ? "Rebuilt the full-text search index to recompute its totals."
+            : "Full-text search index is current.",
+    });
     const tFtsEnd = Date.now();
     // Re-link state.db usage events to the regenerated index and recompute the
     // derived utility cache. Stored refs already use the current item-ref grammar,
@@ -907,11 +915,6 @@ function requiresWorkflowSourcePreflight(ctxs) {
 }
 /** Phase 2 (sync): write all pre-generated scan records inside a single transaction. */
 function persistDirRecords(db, dirRecords, warnings, bundleByRoot) {
-    // Per-source dedup: the same logical asset can appear more than once within
-    // one owning source, where source order still makes the first occurrence win.
-    // The owner is part of the key so identical concepts in different bundles
-    // remain distinct indexed rows.
-    const indexedAssetIdentities = new Set();
     const deletedUsageEntryIds = new Set();
     const findPersisted = db.prepare("SELECT id, content_hash, file_path, adapter_id FROM entries WHERE item_ref = ?");
     const insertTransaction = db.transaction(() => {
@@ -961,7 +964,7 @@ function persistDirRecords(db, dirRecords, warnings, bundleByRoot) {
             let persistedRows = 0;
             let dedupedRows = 0;
             if (stash) {
-                const ownerIdentity = bundle.bundleId;
+                const sourceRoot = `${path.resolve(currentStashDir)}${path.sep}`;
                 for (const entry of stash.entries) {
                     const entryPath = entry.filename ? path.join(dirPath, entry.filename) : null;
                     if (!entryPath) {
@@ -973,23 +976,36 @@ function persistDirRecords(db, dirRecords, warnings, bundleByRoot) {
                         warn(`Skipping entry without adapter-owned concept identity: ${entryPath}`);
                         continue;
                     }
-                    // Adapter-owned concept identity is path-based and cannot be replaced
-                    // by presentation fields such as type/title.
-                    const identityKey = `${ownerIdentity}\0${adapterConceptId}`;
-                    if (indexedAssetIdentities.has(identityKey)) {
-                        dedupedRows++;
-                        continue;
-                    }
-                    indexedAssetIdentities.add(identityKey);
                     // content_hash = doc.hash from the drain, keyed by the recognized
                     // file's path. A missing hash preserves the existing value on upsert.
                     const contentHash = hashByFile?.get(entryPath);
+                    // Adapter-owned concept identity is path-based and cannot be replaced
+                    // by presentation fields such as type/title.
                     const provenance = deriveEntryProvenance(bundle, entry.type, entry.name, adapterConceptId);
+                    // Two files of one source can claim one ref (a skill's references/a.md and
+                    // knowledge/skills/x/references/a.md are both knowledge/skills/x/references/a). The file with
+                    // the smaller path holds it, whichever directories this run drains and in whatever order the
+                    // walk met them (#1050): an entry yields to a row held by a file with a smaller path and
+                    // otherwise takes the ref over. The same concept in another bundle is a different row, and a
+                    // holder whose file is gone is no claim.
+                    const holder = findPersisted.get(provenance.itemRef) ?? undefined;
+                    if (holder &&
+                        holder.file_path !== entryPath &&
+                        holder.file_path.startsWith(sourceRoot) &&
+                        fs.existsSync(holder.file_path)) {
+                        const yields = compareCodePoints(holder.file_path, entryPath) < 0;
+                        const [indexed, skipped] = yields ? [holder.file_path, entryPath] : [entryPath, holder.file_path];
+                        warnings.push(`Two files claim ${provenance.itemRef}: indexed ${indexed}, skipped ${skipped}.`);
+                        if (yields) {
+                            dedupedRows++;
+                            continue;
+                        }
+                        // The directory the ref comes from now has a row fewer than its files: drain it again.
+                        deleteIndexDirState(db, path.dirname(holder.file_path));
+                    }
                     keptItemRefs.add(provenance.itemRef);
                     persistedRows++;
-                    const previous = sameVariant
-                        ? (findPersisted.get(provenance.itemRef) ?? undefined)
-                        : undefined;
+                    const previous = sameVariant ? holder : undefined;
                     const unchanged = previous !== undefined &&
                         contentHash !== undefined &&
                         previous.content_hash === contentHash &&

package/dist/integrations/harnesses/codex/agent-builder.js

@@ -19,12 +19,13 @@
  *     `./result-extractor.ts`. Always emitted, mirroring how the Claude builder
  *     always emits `--print`: dispatch is the captured, non-interactive path.
  *   - Codex is the NATIVE-SCHEMA tier (plan §"Structured-output
- *     normalization"): `req.schema` is written to a temp file and passed via
- *     `--output-schema <file>`. The file is tiny, uniquely named under the OS
- *     temp dir, and intentionally NOT cleaned up here — `BuiltCommand` has no
- *     post-run hook, and the spawned process reads the file after `build()`
- *     returns. OS temp reaping owns the lifecycle. The engine still validates
- *     the output defensively (the constrained output is trusted but verified).
+ *     normalization"): `req.schema` is written to a file and passed via
+ *     `--output-schema <file>`. The file is named by the hash of the schema
+ *     and lives in akm's cache dir, so a schema is written once however many
+ *     units dispatch with it: `BuiltCommand` has no post-run hook, and the
+ *     spawned process reads the file after `build()` returns, so a file per
+ *     dispatch could only leak (#1051). The engine still validates the output
+ *     defensively (the constrained output is trusted but verified).
  *   - `codex exec` has no system-prompt flag; `req.systemPrompt` is folded
  *     into the prompt payload (system text first, blank line, then the task),
  *     after the `--` end-of-options separator so it can never be parsed as a
@@ -52,22 +53,29 @@
  * that registry, so this builder is reachable under the `"codex"` platform
  * name without any further wiring.
  */
-import { mkdtempSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
+import { mkdirSync } from "node:fs";
 import { join } from "node:path";
+import { writeFileAtomic } from "../../../core/common.js";
+import { getCacheDir } from "../../../core/paths.js";
+import { sha256Hex } from "../../../runtime.js";
 import { resolveDispatchModel } from "../../agent/builder-shared.js";
 import { createAgentRequestLowerer } from "../../agent/request-lowering.js";
 /**
- * Write a node's JSON Schema to a fresh temp file for `--output-schema`.
+ * Write a node's JSON Schema to a file for `--output-schema`, named by the hash
+ * of its text, in akm's cache dir. Returns the absolute file path (the value
+ * handed to the flag).
  *
- * A unique `mkdtemp` directory per build avoids collisions between concurrent
- * fan-out units dispatching in the same process. Returns the absolute file
- * path (the value handed to the flag).
+ * The same schema is the same file, so concurrent fan-out units share it, and
+ * the atomic rename makes a write of identical bytes safe under a reader: no
+ * unit can see a half-written schema, and none removes it from another. Nothing
+ * is cleaned up, because nothing accumulates but one file per distinct schema.
  */
 export function writeCodexOutputSchemaFile(schema) {
-    const dir = mkdtempSync(join(tmpdir(), "akm-codex-schema-"));
-    const file = join(dir, "output-schema.json");
-    writeFileSync(file, `${JSON.stringify(schema, null, 2)}\n`, "utf8");
+    const text = `${JSON.stringify(schema, null, 2)}\n`;
+    const dir = join(getCacheDir(), "codex-output-schemas");
+    mkdirSync(dir, { recursive: true });
+    const file = join(dir, `${sha256Hex(text)}.json`);
+    writeFileAtomic(file, text);
     return file;
 }
 /**

package/dist/llm/client.js

@@ -222,12 +222,18 @@ async function chatCompletionReal(config, messages, options) {
  * a config/endpoint change can never leave a stale verdict in place.
  */
 const jsonSchemaUnsupportedConnections = new Set();
+/**
+ * The same, for the two thinking-control fields (`chat_template_kwargs` and
+ * `enable_thinking`): a strict hosted API answers 400 `Unknown parameter`.
+ */
+const thinkingControlRejectedConnections = new Set();
 function connectionKey(config) {
     return `${config.endpoint}|${config.model}`;
 }
-/** TEST-ONLY. Clear the in-memory json-schema-support tracker between tests. */
-export function _resetJsonSchemaSupportTrackerForTests() {
+/** TEST-ONLY. Clear the in-memory endpoint-support trackers between tests. */
+export function _resetEndpointSupportTrackersForTests() {
     jsonSchemaUnsupportedConnections.clear();
+    thinkingControlRejectedConnections.clear();
 }
 /**
  * Whether this connection has already been proven, this process, not to
@@ -239,6 +245,24 @@ export function _resetJsonSchemaSupportTrackerForTests() {
 export function isJsonSchemaKnownUnsupported(config) {
     return jsonSchemaUnsupportedConnections.has(connectionKey(config));
 }
+/** Whether a real call this process showed this connection rejects the thinking-control fields (#1045). */
+export function isThinkingControlKnownRejected(config) {
+    return thinkingControlRejectedConnections.has(connectionKey(config));
+}
+/**
+ * Whether `err` is a provider's 4xx (a rate limit is not one) that may be a
+ * verdict on the shape of this request rather than on the request's own content.
+ */
+function isRejectedRequest(err) {
+    return (err instanceof LlmCallError &&
+        err.code === "provider_error" &&
+        typeof err.statusCode === "number" &&
+        err.statusCode >= 400 &&
+        err.statusCode < 500 &&
+        err.statusCode !== 429);
+}
+/** A strict API names the field it does not know: `Unknown parameter: 'chat_template_kwargs'.` */
+const THINKING_FIELD_NAMED = /chat_template_kwargs|enable_thinking/;
 /**
  * A single chat-completion attempt: one HTTP request/response cycle, with an
  * inline fallback-once when a schema was requested and the provider 4xx's
@@ -248,29 +272,35 @@ export function isJsonSchemaKnownUnsupported(config) {
  * `config.supportsJsonSchema === false` is the only thing that skips it,
  * and that is a value a human (or workflow author) set explicitly, not one
  * a probe wrote automatically.
+ *
+ * The thinking-control fields get the same treatment (#1045): a 4xx that
+ * names `chat_template_kwargs` or `enable_thinking` is answered by one retry
+ * without them, which may in turn fall back without the schema.
  */
-async function chatCompletionAttempt(config, messages, options, timeoutMs) {
+async function chatCompletionAttempt(config, messages, options, timeoutMs, includeThinking = (options?.enableThinking ?? config.enableThinking) !== undefined &&
+    !isThinkingControlKnownRejected(config)) {
     const wantsSchema = Boolean(options?.responseSchema) && config.supportsJsonSchema !== false && !isJsonSchemaKnownUnsupported(config);
     try {
-        return await chatCompletionAttemptOnce(config, messages, options, timeoutMs, wantsSchema);
+        return await chatCompletionAttemptOnce(config, messages, options, timeoutMs, wantsSchema, includeThinking);
     }
     catch (err) {
-        if (!wantsSchema ||
-            !(err instanceof LlmCallError) ||
-            err.code !== "provider_error" ||
-            typeof err.statusCode !== "number" ||
-            err.statusCode < 400 ||
-            err.statusCode >= 500 ||
-            err.statusCode === 429) {
+        if (!isRejectedRequest(err))
             throw err;
+        if (includeThinking && THINKING_FIELD_NAMED.test(err.message)) {
+            warnVerbose(`[akm] LLM rejected chat_template_kwargs/enable_thinking (${err.statusCode}); retrying once without them: ${err.message}`);
+            const fallback = await chatCompletionAttempt(config, messages, options, timeoutMs, false);
+            thinkingControlRejectedConnections.add(connectionKey(config));
+            return fallback;
         }
+        if (!wantsSchema)
+            throw err;
         warnVerbose(`[akm] LLM rejected response_format:json_schema (${err.statusCode}); retrying once without it: ${err.message}`);
-        const fallback = await chatCompletionAttemptOnce(config, messages, options, timeoutMs, false);
+        const fallback = await chatCompletionAttemptOnce(config, messages, options, timeoutMs, false, includeThinking);
         jsonSchemaUnsupportedConnections.add(connectionKey(config));
         return fallback;
     }
 }
-async function chatCompletionAttemptOnce(config, messages, options, timeoutMs, includeSchema) {
+async function chatCompletionAttemptOnce(config, messages, options, timeoutMs, includeSchema, includeThinking) {
     if (config.extraParams !== undefined) {
         const issue = validateExtraParams(config.extraParams)[0];
         if (issue)
@@ -309,7 +339,7 @@ async function chatCompletionAttemptOnce(config, messages, options, timeoutMs, i
     // (freellmapi, Bifrost) can drop either one depending on how it was built.
     // Send both whenever thinking is explicitly resolved so the same engine
     // block keeps working across a direct vhost or any gateway in front of it.
-    const resolvedEnableThinking = options?.enableThinking ?? config.enableThinking;
+    const resolvedEnableThinking = includeThinking ? (options?.enableThinking ?? config.enableThinking) : undefined;
     const thinkingParams = resolvedEnableThinking === undefined
         ? {}
         : { chat_template_kwargs: { enable_thinking: resolvedEnableThinking }, enable_thinking: resolvedEnableThinking };

package/dist/llm/memory-infer.js

@@ -46,7 +46,7 @@ const PROMPT_PLACEHOLDERS = new Set([
  * — no more "incomplete derived memory payload from LLM; skipping memory"
  * for shape-only failures.
  */
-const DERIVED_MEMORY_JSON_SCHEMA = {
+export const DERIVED_MEMORY_JSON_SCHEMA = {
     type: "object",
     properties: {
         title: { type: "string", minLength: 1 },

package/dist/scripts/akm-migrate-node.js

@@ -25639,6 +25639,7 @@ var $visitAsync = visit.visitAsync;
 import path7 from "node:path";
 // src/runtime.ts
 import { spawn as nodeSpawn, spawnSync as nodeSpawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
 import { createWriteStream, statfsSync } from "node:fs";
 import { createRequire as createRequire2 } from "node:module";
 import path6 from "node:path";
@@ -26803,6 +26804,9 @@ async function writeResponseToFileCapped(filePath, res, options) {
     reader.releaseLock?.();
   }
 }
+function sha256Hex(data) {
+  return createHash("sha256").update(data).digest("hex");
+}
 function getDirname(importMetaUrl) {
   return path6.dirname(fileURLToPath(importMetaUrl));
 }
@@ -36849,7 +36853,7 @@ function withConfigLock(fn) {
 }
 
 // src/core/config/config-sources.ts
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 import fs9 from "node:fs";
 import path13 from "node:path";
 function bundleComponentConfig(bundle) {
@@ -36912,7 +36916,7 @@ function filesystemBundleSourceId(contentRoot) {
   });
 }
 function hashBundleSourceIdentity(identity3) {
-  return `sha256:${createHash("sha256").update("akm.bundle-source\x00v1\x00").update(JSON.stringify(identity3)).digest("hex")}`;
+  return `sha256:${createHash2("sha256").update("akm.bundle-source\x00v1\x00").update(JSON.stringify(identity3)).digest("hex")}`;
 }
 function bundleContentRoots(config) {
   const bundles = config.bundles ?? {};
@@ -38374,7 +38378,7 @@ async function tryFetchJson(url, headers) {
 }
 
 // src/sources/providers/provider-utils.ts
-import { createHash as createHash4, randomUUID as randomUUID2 } from "node:crypto";
+import { createHash as createHash5, randomUUID as randomUUID2 } from "node:crypto";
 import fs27 from "node:fs";
 import path34 from "node:path";
 
@@ -38469,7 +38473,7 @@ function countLines(text) {
 }
 
 // src/core/adapter/adapters/shared.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 
 // src/core/asset/frontmatter-lint.ts
 function checkUnquotedDescriptionColon(frontmatterText) {
@@ -38491,7 +38495,7 @@ function checkUnquotedDescriptionColon(frontmatterText) {
 
 // src/core/adapter/adapters/shared.ts
 function hashContent(content) {
-  return createHash2("sha256").update(content, "utf8").digest("hex");
+  return createHash3("sha256").update(content, "utf8").digest("hex");
 }
 function nonEmptyString2(value) {
   if (typeof value !== "string")
@@ -39674,7 +39678,7 @@ function extractDirTagsFromName(name) {
 }
 
 // src/core/adapter/execution-source.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 
 // src/execution/source.ts
 var EXECUTION_SOURCE_SCHEMA_VERSION = 1;
@@ -40012,7 +40016,7 @@ function renderMarkdownExecutionSource(input) {
       bundle: identity3.bundle,
       adapter: identity3.adapter,
       file: identity3.file,
-      hash: createHash3("sha256").update(raw, "utf8").digest("hex")
+      hash: createHash4("sha256").update(raw, "utf8").digest("hex")
     },
     ...hasDefaults ? { defaults } : {},
     ...extensions === undefined ? {} : { extensions }
@@ -46567,7 +46571,7 @@ function uniqueSlug() {
 }
 function buildInstallCacheDir(cacheRootDir, source, id, version) {
   const safeId = id.replace(/[^a-zA-Z0-9_.-]+/g, "-").replace(/^-+|-+$/g, "");
-  const identitySuffix = version === "writable" ? `-${createHash4("sha256").update(`${source}:${id}`).digest("hex").slice(0, 12)}` : "";
+  const identitySuffix = version === "writable" ? `-${createHash5("sha256").update(`${source}:${id}`).digest("hex").slice(0, 12)}` : "";
   const slug = `${source}-${safeId}${identitySuffix}`;
   const versionSlug = source === "local" ? uniqueSlug() : version?.replace(/[^a-zA-Z0-9_.-]+/g, "-") ?? uniqueSlug();
   return path34.join(cacheRootDir, slug || source, versionSlug);
@@ -46588,7 +46592,7 @@ async function downloadArchive(url, destination) {
 }
 async function computeFileHash(filePath) {
   const data = fs27.readFileSync(filePath);
-  const hash = createHash4("sha256").update(data).digest("hex");
+  const hash = createHash5("sha256").update(data).digest("hex");
   return `sha256:${hash}`;
 }
 function isDirectory(target) {
@@ -46763,7 +46767,7 @@ function redactUrlUserinfo(text) {
   return text.replace(/\b([A-Za-z][A-Za-z0-9+.-]*:\/\/)([^\s/@]+)@/g, "$1[REDACTED]@");
 }
 // src/sources/providers/git-provider.ts
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 import fs30 from "node:fs";
 import path36 from "node:path";
 
@@ -46824,7 +46828,7 @@ function resolveGitContentDir(config) {
   throw new ConfigError("git source entry must have either `path` or `url`");
 }
 function getCachePaths(repoUrl, cacheRootOverride) {
-  const key = createHash5("sha256").update(repoUrl).digest("hex").slice(0, 16);
+  const key = createHash6("sha256").update(repoUrl).digest("hex").slice(0, 16);
   const cacheRoot = cacheRootOverride ?? getRegistryIndexCacheDir();
   const rootDir = path36.join(cacheRoot, `git-${key}`);
   return {
@@ -47045,7 +47049,7 @@ import fs33 from "node:fs";
 import path39 from "node:path";
 
 // src/sources/providers/tar-utils.ts
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 import fs32 from "node:fs";
 import path38 from "node:path";
 function verifyArchiveIntegrity(archivePath, expected, source) {
@@ -47058,7 +47062,7 @@ function verifyArchiveIntegrity(archivePath, expected, source) {
     const dashIndex = expected.indexOf("-");
     const algorithm = expected.slice(0, dashIndex);
     const expectedBase64 = expected.slice(dashIndex + 1);
-    const actualBase64 = createHash6(algorithm).update(fileBuffer).digest("base64");
+    const actualBase64 = createHash7(algorithm).update(fileBuffer).digest("base64");
     if (actualBase64 !== expectedBase64) {
       fs32.unlinkSync(archivePath);
       throw new Error(`Integrity check failed for ${archivePath}: expected ${algorithm} digest ${expectedBase64}, got ${actualBase64}`);
@@ -47066,7 +47070,7 @@ function verifyArchiveIntegrity(archivePath, expected, source) {
     return;
   }
   if (/^[0-9a-f]{40}$/i.test(expected)) {
-    const actualHex = createHash6("sha1").update(fileBuffer).digest("hex");
+    const actualHex = createHash7("sha1").update(fileBuffer).digest("hex");
     if (actualHex.toLowerCase() !== expected.toLowerCase()) {
       fs32.unlinkSync(archivePath);
       throw new Error(`Integrity check failed for ${archivePath}: expected sha1 ${expected}, got ${actualHex}`);
@@ -51669,14 +51673,15 @@ class ClaudeHarness extends BaseHarness {
 }
 
 // src/integrations/harnesses/codex/agent-builder.ts
-import { mkdtempSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
+import { mkdirSync } from "node:fs";
 import { join } from "node:path";
 function writeCodexOutputSchemaFile(schema) {
-  const dir = mkdtempSync(join(tmpdir(), "akm-codex-schema-"));
-  const file = join(dir, "output-schema.json");
-  writeFileSync(file, `${JSON.stringify(schema, null, 2)}
-`, "utf8");
+  const text = `${JSON.stringify(schema, null, 2)}
+`;
+  const dir = join(getCacheDir(), "codex-output-schemas");
+  mkdirSync(dir, { recursive: true });
+  const file = join(dir, `${sha256Hex(text)}.json`);
+  writeFileAtomic(file, text);
   return file;
 }
 function ensureSandboxFlags(base) {

package/dist/scripts/akm-migrate.js

@@ -24967,6 +24967,7 @@ var $visitAsync = visit.visitAsync;
 import path7 from "path";
 // src/runtime.ts
 import { spawn as nodeSpawn, spawnSync as nodeSpawnSync } from "child_process";
+import { createHash } from "crypto";
 import { createWriteStream, statfsSync } from "fs";
 import { createRequire } from "module";
 import path6 from "path";
@@ -26131,6 +26132,9 @@ async function writeResponseToFileCapped(filePath, res, options) {
     reader.releaseLock?.();
   }
 }
+function sha256Hex(data) {
+  return createHash("sha256").update(data).digest("hex");
+}
 function getDirname(importMetaUrl) {
   return path6.dirname(fileURLToPath(importMetaUrl));
 }
@@ -36177,7 +36181,7 @@ function withConfigLock(fn) {
 }
 
 // src/core/config/config-sources.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import fs9 from "fs";
 import path13 from "path";
 function bundleComponentConfig(bundle) {
@@ -36240,7 +36244,7 @@ function filesystemBundleSourceId(contentRoot) {
   });
 }
 function hashBundleSourceIdentity(identity3) {
-  return `sha256:${createHash("sha256").update("akm.bundle-source\x00v1\x00").update(JSON.stringify(identity3)).digest("hex")}`;
+  return `sha256:${createHash2("sha256").update("akm.bundle-source\x00v1\x00").update(JSON.stringify(identity3)).digest("hex")}`;
 }
 function bundleContentRoots(config) {
   const bundles = config.bundles ?? {};
@@ -37702,7 +37706,7 @@ async function tryFetchJson(url, headers) {
 }
 
 // src/sources/providers/provider-utils.ts
-import { createHash as createHash4, randomUUID as randomUUID2 } from "crypto";
+import { createHash as createHash5, randomUUID as randomUUID2 } from "crypto";
 import fs27 from "fs";
 import path34 from "path";
 
@@ -37797,7 +37801,7 @@ function countLines(text) {
 }
 
 // src/core/adapter/adapters/shared.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 
 // src/core/asset/frontmatter-lint.ts
 function checkUnquotedDescriptionColon(frontmatterText) {
@@ -37819,7 +37823,7 @@ function checkUnquotedDescriptionColon(frontmatterText) {
 
 // src/core/adapter/adapters/shared.ts
 function hashContent(content) {
-  return createHash2("sha256").update(content, "utf8").digest("hex");
+  return createHash3("sha256").update(content, "utf8").digest("hex");
 }
 function nonEmptyString2(value) {
   if (typeof value !== "string")
@@ -39002,7 +39006,7 @@ function extractDirTagsFromName(name) {
 }
 
 // src/core/adapter/execution-source.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 
 // src/execution/source.ts
 var EXECUTION_SOURCE_SCHEMA_VERSION = 1;
@@ -39340,7 +39344,7 @@ function renderMarkdownExecutionSource(input) {
       bundle: identity3.bundle,
       adapter: identity3.adapter,
       file: identity3.file,
-      hash: createHash3("sha256").update(raw, "utf8").digest("hex")
+      hash: createHash4("sha256").update(raw, "utf8").digest("hex")
     },
     ...hasDefaults ? { defaults } : {},
     ...extensions === undefined ? {} : { extensions }
@@ -45895,7 +45899,7 @@ function uniqueSlug() {
 }
 function buildInstallCacheDir(cacheRootDir, source, id, version) {
   const safeId = id.replace(/[^a-zA-Z0-9_.-]+/g, "-").replace(/^-+|-+$/g, "");
-  const identitySuffix = version === "writable" ? `-${createHash4("sha256").update(`${source}:${id}`).digest("hex").slice(0, 12)}` : "";
+  const identitySuffix = version === "writable" ? `-${createHash5("sha256").update(`${source}:${id}`).digest("hex").slice(0, 12)}` : "";
   const slug = `${source}-${safeId}${identitySuffix}`;
   const versionSlug = source === "local" ? uniqueSlug() : version?.replace(/[^a-zA-Z0-9_.-]+/g, "-") ?? uniqueSlug();
   return path34.join(cacheRootDir, slug || source, versionSlug);
@@ -45916,7 +45920,7 @@ async function downloadArchive(url, destination) {
 }
 async function computeFileHash(filePath) {
   const data = fs27.readFileSync(filePath);
-  const hash = createHash4("sha256").update(data).digest("hex");
+  const hash = createHash5("sha256").update(data).digest("hex");
   return `sha256:${hash}`;
 }
 function isDirectory(target) {
@@ -46091,7 +46095,7 @@ function redactUrlUserinfo(text) {
   return text.replace(/\b([A-Za-z][A-Za-z0-9+.-]*:\/\/)([^\s/@]+)@/g, "$1[REDACTED]@");
 }
 // src/sources/providers/git-provider.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 import fs30 from "fs";
 import path36 from "path";
 
@@ -46152,7 +46156,7 @@ function resolveGitContentDir(config) {
   throw new ConfigError("git source entry must have either `path` or `url`");
 }
 function getCachePaths(repoUrl, cacheRootOverride) {
-  const key = createHash5("sha256").update(repoUrl).digest("hex").slice(0, 16);
+  const key = createHash6("sha256").update(repoUrl).digest("hex").slice(0, 16);
   const cacheRoot = cacheRootOverride ?? getRegistryIndexCacheDir();
   const rootDir = path36.join(cacheRoot, `git-${key}`);
   return {
@@ -46373,7 +46377,7 @@ import fs33 from "fs";
 import path39 from "path";
 
 // src/sources/providers/tar-utils.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 import fs32 from "fs";
 import path38 from "path";
 function verifyArchiveIntegrity(archivePath, expected, source) {
@@ -46386,7 +46390,7 @@ function verifyArchiveIntegrity(archivePath, expected, source) {
     const dashIndex = expected.indexOf("-");
     const algorithm = expected.slice(0, dashIndex);
     const expectedBase64 = expected.slice(dashIndex + 1);
-    const actualBase64 = createHash6(algorithm).update(fileBuffer).digest("base64");
+    const actualBase64 = createHash7(algorithm).update(fileBuffer).digest("base64");
     if (actualBase64 !== expectedBase64) {
       fs32.unlinkSync(archivePath);
       throw new Error(`Integrity check failed for ${archivePath}: expected ${algorithm} digest ${expectedBase64}, got ${actualBase64}`);
@@ -46394,7 +46398,7 @@ function verifyArchiveIntegrity(archivePath, expected, source) {
     return;
   }
   if (/^[0-9a-f]{40}$/i.test(expected)) {
-    const actualHex = createHash6("sha1").update(fileBuffer).digest("hex");
+    const actualHex = createHash7("sha1").update(fileBuffer).digest("hex");
     if (actualHex.toLowerCase() !== expected.toLowerCase()) {
       fs32.unlinkSync(archivePath);
       throw new Error(`Integrity check failed for ${archivePath}: expected sha1 ${expected}, got ${actualHex}`);
@@ -51664,14 +51668,15 @@ class ClaudeHarness extends BaseHarness {
 }
 
 // src/integrations/harnesses/codex/agent-builder.ts
-import { mkdtempSync, writeFileSync } from "fs";
-import { tmpdir } from "os";
+import { mkdirSync } from "fs";
 import { join as join2 } from "path";
 function writeCodexOutputSchemaFile(schema) {
-  const dir = mkdtempSync(join2(tmpdir(), "akm-codex-schema-"));
-  const file = join2(dir, "output-schema.json");
-  writeFileSync(file, `${JSON.stringify(schema, null, 2)}
-`, "utf8");
+  const text = `${JSON.stringify(schema, null, 2)}
+`;
+  const dir = join2(getCacheDir(), "codex-output-schemas");
+  mkdirSync(dir, { recursive: true });
+  const file = join2(dir, `${sha256Hex(text)}.json`);
+  writeFileAtomic(file, text);
   return file;
 }
 function ensureSandboxFlags(base) {

package/dist/storage/repositories/index-entry-schema.js

@@ -120,20 +120,36 @@ const REQUIRED_ENTRY_COLUMNS = [
     "document_json",
     "derived_from",
 ];
+/**
+ * The transitional columns layout 20 and earlier kept beside the current ones
+ * and layout 21 removed (`entry_key` was the key). They are NOT NULL, so a
+ * table that still has one takes none of this release's inserts, and its
+ * `document_json` is empty (the entry sat in `entry_json`), so none of its rows
+ * can be read either. A 0.9.1 index is such a table.
+ */
+const RETIRED_ENTRY_COLUMNS = ["entry_key", "dir_path", "stash_dir", "entry_json", "entry_type"];
+function entryColumnNames(db) {
+    return new Set(db.prepare("PRAGMA table_info(entries)").all().map((c) => c.name));
+}
 /** Required `entries` columns the table lacks; every column when there is no `entries` table. */
 export function missingEntryColumns(db) {
-    const present = new Set(db.prepare("PRAGMA table_info(entries)").all().map((c) => c.name));
+    const present = entryColumnNames(db);
     return REQUIRED_ENTRY_COLUMNS.filter((column) => !present.has(column));
 }
+/** Retired `entries` columns the table still has: it was written by layout 20 or earlier. */
+export function retiredEntryColumns(db) {
+    const present = entryColumnNames(db);
+    return RETIRED_ENTRY_COLUMNS.filter((column) => present.has(column));
+}
 /**
  * Whether an index database has an `entries` table this release can read. A
  * fresh or empty file has none; an index older than layout 21 has one keyed
- * by columns this release no longer reads, and serves nothing until the next
- * `akm index` recreates it.
+ * by columns this release no longer reads (or lacks the ones it does), and
+ * serves nothing until the next `akm index` recreates it.
  */
 export function hasCurrentEntriesTable(db) {
     try {
-        return missingEntryColumns(db).length === 0;
+        return missingEntryColumns(db).length === 0 && retiredEntryColumns(db).length === 0;
     }
     catch {
         return false;