akm-cli 0.9.5 → 0.9.6

package/dist/commands/improve/reflect.js

@@ -44,7 +44,7 @@ import { prepareInlineExecution, prepareInlineExecutionWithRunner } from "../../
 import { buildReflectOutputRepairPrompt, buildReflectPrompt, extractDraftConfidence, parseAgentProposalPayload, } from "../../integrations/agent/prompts.js";
 import { runnerIsLlm, runnerSupportsFileWrite } from "../../integrations/agent/runner.js";
 import { collectDispatchSensitiveValues } from "../../integrations/agent/runner-dispatch.js";
-import { LlmCallError } from "../../llm/client.js";
+import { isJsonSchemaKnownUnsupported, LlmCallError } from "../../llm/client.js";
 import { callStructured } from "../../llm/structured-call.js";
 import { baseFailureFields, enoentHintMessage, isEnoentFailure } from "../agent/agent-support.js";
 import { isProposalSkipped, listProposalsReadOnly, proposalContent, } from "../proposal/repository.js";
@@ -578,8 +578,9 @@ export function sanitizeReflectPayload(payload, sourceContent, targetRef) {
 }
 /**
  * JSON Schema for structured reflect output. Passed to `chatCompletion` when
- * the connection has `supportsJsonSchema: true` so the model returns a strict
- * JSON object containing only the target-scoped fields AKM cannot derive.
+ * {@link wantsJsonSchemaOutput} selects `outputMode: "json_schema"`, so the
+ * model returns a strict JSON object containing only the target-scoped
+ * fields AKM cannot derive.
  */
 const REFLECT_FRONTMATTER_PATCH_JSON_SCHEMA = {
     type: "object",
@@ -626,6 +627,17 @@ const REFLECT_UNSCOPED_JSON_SCHEMA = {
         frontmatterPatch: REFLECT_FRONTMATTER_PATCH_JSON_SCHEMA,
     },
 };
+/**
+ * Whether to frame the reflect prompt for structured JSON output on this
+ * connection. Optimistic by default — `chatCompletion` attempts
+ * `response_format: json_schema` fresh on every call and falls back once on
+ * a 4xx, so there is no persisted verdict to consult here. `false` only when
+ * a human/workflow explicitly disabled it, or a real call already proved
+ * this connection rejects it earlier in the same process.
+ */
+function wantsJsonSchemaOutput(connection) {
+    return connection.supportsJsonSchema !== false && !isJsonSchemaKnownUnsupported(connection);
+}
 /** Critique prompt injected between prior draft and refinement request (Self-Refine loop). */
 const REFLECT_CRITIQUE_PROMPT = "Your previous proposal is shown above. Review it critically and provide an improved version that is more specific, actionable, and avoids any issues with the previous attempt. Return only the improved response using the output contract from the original prompt.";
 /**
@@ -1354,21 +1366,20 @@ async function resolveReflectSource(options, stash, emitReflectFailed) {
 }
 /**
  * Run the agent with the optional Self-Refine loop (R-1 / #372): up to
- * MAX_REFINE_ITERS invocations, each injecting the prior draft as self-critique
+ * `maxRefineIters` invocations, each injecting the prior draft as self-critique
  * context and exiting early on a no-op refinement. Synthesizes per-iteration
  * draft paths into `draftPathsToCleanup` (mutated) and returns the final agent
  * result + last draft path. Extracted verbatim from `akmReflect`.
  */
 async function runReflectRefineIterations(args) {
     const { options, parsedRef, assetContent, feedback, schemaHints, relatedLessons, rejectedProposals, standardsContext, runnerSpec, lease, agentEnv, draftPathsToCleanup, onNotices, } = args;
-    const MAX_REFINE_ITERS = 3;
-    const maxRefineIters = Math.min(Math.max(1, options.maxRefineIters ?? 1), MAX_REFINE_ITERS);
+    const maxRefineIters = Math.max(1, options.maxRefineIters ?? 1);
     // Determine whether this dispatch can honour the file-write contract.
     // Agent CLI + OpenCode SDK runners both have filesystem access; the direct
     // LLM HTTP runner does NOT.
     const canRunnerWriteFile = runnerSupportsFileWrite(runnerSpec);
     const outputMode = runnerIsLlm(runnerSpec)
-        ? runnerSpec.connection.supportsJsonSchema
+        ? wantsJsonSchemaOutput(runnerSpec.connection)
             ? "json_schema"
             : "framed_markdown"
         : undefined;
@@ -1421,10 +1432,10 @@ async function runReflectRefineIterations(args) {
                 ...(options.signal ? { signal: options.signal } : {}),
                 priorDraft,
                 iteration: iter,
-                ...(runnerSpec.connection.supportsJsonSchema
+                ...(outputMode === "json_schema"
                     ? { responseSchema: options.ref ? REFLECT_JSON_SCHEMA : REFLECT_UNSCOPED_JSON_SCHEMA }
                     : {}),
-                outputMode: runnerSpec.connection.supportsJsonSchema ? "json_schema" : "framed_markdown",
+                outputMode: outputMode ?? "framed_markdown",
                 ...(options.ref ? { targetRef: options.ref } : {}),
                 allowRepair: repairAttempts === 0,
                 ...(options.chat ? { chat: options.chat } : {}),

package/dist/commands/lint/index.js

@@ -92,7 +92,7 @@ function collectWorkflowFiles(dir) {
             continue;
         const full = path.join(dir, entry.name);
         if (entry.isDirectory()) {
-            if (entry.name === ".cache" || entry.name === "registry")
+            if (isAkmRegistryCachePath(full))
                 continue;
             results.push(...collectWorkflowFiles(full));
             continue;
@@ -185,11 +185,9 @@ function collectAdapterFiles(root, extensions) {
                 walk(full);
             }
             else if (entry.isFile() && matchesAdapterExtension(entry.name, extensions)) {
-                // Compare PATH SEGMENTS, not raw substrings: `path.join` yields `\` on
-                // Windows so a `"/.cache/"` substring test never matches there, and a
-                // substring test would also skip a legitimately-named `registry` file.
-                const segments = path.relative(root, full).split(/[\\/]/);
-                if (segments.includes(".cache") || segments.includes("registry"))
+                // Skip akm's OWN resolved registry-cache copies, not any user
+                // directory that happens to be named ".cache" or "registry".
+                if (isAkmRegistryCachePath(full))
                     continue;
                 results.push(full);
             }

package/dist/commands/proposal/validators/proposal-quality-validators.js

@@ -196,13 +196,6 @@ export function hasHotCaptureMode(frontmatter) {
  * with 80-90% overlap legitimately compress to well under 50% of the larger.
  */
 export const MERGE_SHRINK_RATIO_MIN = 0.3;
-/**
- * Absolute floor (chars) for merged body.  When sources are short (<~333 chars),
- * `MERGE_SHRINK_RATIO_MIN × largerBodyLen` falls below this and the absolute
- * floor dominates — prevents false positives on very terse memory pairs.
- * Matches the existing `promote_source_too_small` floor of 100 chars.
- */
-export const MERGE_ABSOLUTE_FLOOR_CHARS = 100;
 // ── Reflect size gate ────────────────────────────────────────────────────────
 /** Ratio lower-bound: proposed body must be at least this fraction of source. */
 export const REFLECT_SHRINK_RATIO_MIN = 0.5;

package/dist/commands/sources/bundle-config-ops.js

@@ -13,20 +13,25 @@
  * keying rules across call sites.
  */
 import path from "node:path";
-import { primaryBundlePath } from "../../core/config/config.js";
+import { bundleKeyForContentRoot, primaryBundlePath } from "../../core/config/config.js";
 import { deriveBundleId } from "../../indexer/installations.js";
 export { primaryBundlePath };
 /**
  * Upsert the primary filesystem bundle (`{ path, writable: true }`) and point
  * `defaultBundle` at it. Reuses the current default key when it already names a
- * filesystem bundle (so re-pointing the primary keeps a stable id); otherwise
- * derives a fresh slug-legal key from the path.
+ * filesystem bundle (so re-pointing the primary keeps a stable id). Otherwise,
+ * reuses whichever configured bundle ALREADY resolves to `stashDir`'s content
+ * root (issue #870 — `AKM_BUNDLE_DIR`/`--dir` pointed at a directory already
+ * configured under a different id must not mint a second bundle for it); only
+ * when no bundle owns that root yet is a fresh slug-legal key derived.
  */
 export function withPrimaryBundle(config, stashDir) {
     const bundles = { ...(config.bundles ?? {}) };
     let key = config.defaultBundle;
     if (!key || !(key in bundles) || typeof bundles[key]?.path !== "string") {
-        key = deriveBundleId(undefined, stashDir, new Set(Object.keys(bundles)));
+        key =
+            bundleKeyForContentRoot(config, path.resolve(stashDir)) ??
+                deriveBundleId(undefined, stashDir, new Set(Object.keys(bundles)));
     }
     bundles[key] = {
         ...bundles[key],

package/dist/commands/sources/info.js

@@ -8,7 +8,6 @@ import { classifyPathAccess, describeInaccessiblePath } from "../../core/path-ac
 import { getDbPath } from "../../core/paths.js";
 import { formatRegistryUrl } from "../../core/registry-url.js";
 import { error } from "../../core/warn.js";
-import { getEffectiveSemanticStatus, readSemanticStatus } from "../../indexer/search/semantic-status.js";
 import { closeDatabase, openExistingDatabase } from "../../storage/repositories/index-connection.js";
 import { getEntryCount, getEntryCountByType } from "../../storage/repositories/index-entries-repository.js";
 import { getMeta } from "../../storage/repositories/index-meta-repository.js";
@@ -29,13 +28,6 @@ export function assembleInfo(options) {
     const defaultBundle = config.defaultBundle ?? null;
     // Asset types (copy into a mutable array — `placementTypes()` returns readonly)
     const assetTypes = [...placementTypes()];
-    const semanticRuntime = readSemanticStatus();
-    const semanticStatus = getEffectiveSemanticStatus(config, semanticRuntime);
-    // Search modes
-    const searchModes = ["fts"];
-    if (semanticStatus === "ready-js" || semanticStatus === "ready-vec") {
-        searchModes.push("semantic", "hybrid");
-    }
     // Registries (strip sensitive fields like apiKey from options)
     const registries = (config.registries ?? []).map((r) => ({
         url: formatRegistryUrl(r.url),
@@ -58,6 +50,20 @@ export function assembleInfo(options) {
     // health and search use, so info reads the same database they do.
     const resolvedDbPath = options?.dbPath ?? getDbPath();
     const indexStats = readIndexStats(resolvedDbPath);
+    // Semantic status is read live from the index's own state, not a cached
+    // verdict — a failed embed attempt at search time falls back to FTS and
+    // reports that in the search response, it never disables the mode here.
+    const semanticStatus = config.semanticSearchMode === "off"
+        ? "disabled"
+        : !indexStats.hasEmbeddings
+            ? "pending"
+            : indexStats.vecAvailable
+                ? "ready-vec"
+                : "ready-js";
+    const searchModes = ["fts"];
+    if (semanticStatus === "ready-js" || semanticStatus === "ready-vec") {
+        searchModes.push("semantic", "hybrid");
+    }
     return {
         schemaVersion: 1,
         version: pkgVersion,
@@ -68,8 +74,6 @@ export function assembleInfo(options) {
         semanticSearch: {
             mode: config.semanticSearchMode,
             status: semanticStatus,
-            ...(semanticRuntime?.reason ? { reason: semanticRuntime.reason } : {}),
-            ...(semanticRuntime?.message ? { message: semanticRuntime.message } : {}),
         },
         registries,
         sourceProviders,

package/dist/commands/tasks/tasks.js

@@ -39,7 +39,6 @@ import { assertSchedulerNativeArtifactOwnership, assertSchedulerSourceSnapshot,
 import { renderSchedulerPlanPreview, renderSchedulerSyncPlanPreview, } from "../../tasks/scheduler-sync-preview.js";
 import { parseTaskSource } from "../../tasks/source/parse-task-source.js";
 import { projectTaskSourceV4 } from "../../tasks/source/project-v4.js";
-import { TASK_V3_MAX_SOURCE_BYTES } from "../../tasks/source-v3.js";
 import { normaliseTaskConceptId, normaliseTaskId } from "../../tasks/task-id.js";
 import { applyAutonomyGate, configuredDirectAutonomyLanes, describeGatedLanes } from "../improve/autonomy-gate.js";
 import { resolveImproveStrategy } from "../improve/improve-strategies.js";
@@ -971,13 +970,7 @@ function captureTaskSourceExpectation(filePathInput, rootInput) {
     if (!rootStat.isDirectory()) {
         throw new UsageError(`${root} is not a task source directory.`, "INVALID_FLAG_VALUE");
     }
-    const common = {
-        filePath,
-        rootRealPath,
-        rootPhysicalIdentity: rootStat.ino === 0n ? `path:${rootRealPath}` : `inode:${rootStat.dev}:${rootStat.ino}`,
-        rootMtimeNs: String(rootStat.mtimeNs),
-        rootCtimeNs: String(rootStat.ctimeNs),
-    };
+    const common = { filePath, rootRealPath };
     let descriptor;
     try {
         const noFollow = "O_NOFOLLOW" in fs.constants ? fs.constants.O_NOFOLLOW : 0;
@@ -986,9 +979,6 @@ function captureTaskSourceExpectation(filePathInput, rootInput) {
         if (!before.isFile()) {
             throw new UsageError(`${filePath} is not a regular task source.`, "INVALID_FLAG_VALUE");
         }
-        if (before.size > BigInt(TASK_V3_MAX_SOURCE_BYTES)) {
-            throw new UsageError(`${filePath} exceeds the 1 MiB (${TASK_V3_MAX_SOURCE_BYTES}-byte) task source limit.`, "INVALID_FLAG_VALUE");
-        }
         const bytes = fs.readFileSync(descriptor);
         const after = fs.fstatSync(descriptor, { bigint: true });
         if (!sameTaskSourceStat(before, after) || BigInt(bytes.byteLength) !== before.size) {
@@ -1010,10 +1000,7 @@ function captureTaskSourceExpectation(filePathInput, rootInput) {
             state: "present",
             ...common,
             realPath,
-            physicalIdentity: before.ino === 0n ? `path:${realPath}` : `inode:${before.dev}:${before.ino}`,
             size: bytes.byteLength,
-            mtimeNs: String(before.mtimeNs),
-            ctimeNs: String(before.ctimeNs),
             sha256: createHash("sha256").update(bytes).digest("hex"),
             bytesBase64: bytes.toString("base64"),
             content,
@@ -1035,6 +1022,11 @@ function captureTaskSourceExpectation(filePathInput, rootInput) {
             fs.closeSync(descriptor);
     }
 }
+// TOCTOU note: this compares CONTENT (state + sha256), not filesystem
+// identity (inode/mtime/ctime/directory timestamps) — the same split already
+// applied to the task migrator in 0.9.5. An unrelated touch to the file or
+// its containing directory must not trip a "changed after planning" refusal;
+// only a real content change should.
 function assertTaskSourceExpectation(expected) {
     const actual = captureTaskSourceExpectation(expected.filePath, expected.rootRealPath);
     if (!sameTaskSourceExpectation(actual, expected)) {
@@ -1042,12 +1034,16 @@ function assertTaskSourceExpectation(expected) {
     }
 }
 function sameTaskSourceExpectation(left, right) {
-    return JSON.stringify(left) === JSON.stringify(right);
+    if (left.state !== right.state || left.filePath !== right.filePath || left.rootRealPath !== right.rootRealPath) {
+        return false;
+    }
+    if (left.state === "absent")
+        return true;
+    return left.sha256 === right.sha256;
 }
 function assertTaskSourceRestored(expected) {
     const actual = captureTaskSourceExpectation(expected.filePath, expected.rootRealPath);
     const restored = actual.state === expected.state &&
-        actual.rootPhysicalIdentity === expected.rootPhysicalIdentity &&
         (actual.state === "absent" ||
             (expected.state === "present" && actual.sha256 === expected.sha256 && actual.content === expected.content));
     if (!restored) {

package/dist/commands/workflow-cli.js

@@ -20,7 +20,7 @@ import { deliverRendered } from "../output/html-render.js";
 import { shapeForCommand } from "../output/shapes.js";
 import { formatPlain } from "../output/text.js";
 import { assertWorkflowMarkdownName, createWorkflowAsset, getWorkflowTemplate } from "../workflows/authoring/authoring.js";
-import { WORKFLOW_MAX_RETRIES, WORKFLOW_MAX_TIMEOUT_MS } from "../workflows/ir/schema.js";
+import { WORKFLOW_MAX_TIMEOUT_MS } from "../workflows/ir/schema.js";
 import { abandonWorkflowRun, getWorkflowStatus, hasWorkflowRun, listWorkflowRuns, resumeWorkflowRun, } from "../workflows/runtime/runs.js";
 import { akmWorkflowPlan } from "./workflow/plan.js";
 const workflowStatusCommand = defineJsonCommand({
@@ -168,7 +168,7 @@ const workflowRunCommand = defineJsonCommand({
         const { runWorkflowSteps } = await import("../workflows/exec/run-workflow.js");
         const parameterFlags = parseWorkflowParameterFlags(rawArgs, args.target);
         const maxSteps = parseIntegerFlag(getStringArg(args, "max-steps"), "--max-steps", 1);
-        const maxRetries = parseIntegerFlag(getStringArg(args, "max-retries"), "--max-retries", 0, WORKFLOW_MAX_RETRIES);
+        const maxRetries = parseIntegerFlag(getStringArg(args, "max-retries"), "--max-retries", 0);
         const timeoutMs = parseWorkflowTimeout(getStringArg(args, "timeout"));
         const controller = new AbortController();
         let signalExitCode;

package/dist/core/common.js

@@ -10,8 +10,6 @@ import { getConfigPath, getDefaultStashDir, getRegistryCacheDir, getRegistryInde
 // Moved to the platform leaf so paths.ts can use it without a common↔paths
 // cycle (chunk-8 WI-8.6, DoD 11); re-exported here for the existing surface.
 export { IS_WINDOWS } from "./platform.js";
-export const MAX_CONFIG_FILE_BYTES = 1024 * 1024;
-export const MAX_LOCAL_METADATA_BYTES = 1024 * 1024;
 export const MAX_LOCK_METADATA_BYTES = 64 * 1024;
 export function isHttpUrl(value) {
     return !!value && /^https?:\/\//.test(value);
@@ -51,10 +49,13 @@ export function readTextFileDescriptorWithLimit(fd, maxBytes, label = "File", di
     }
     return buffer.subarray(0, total).toString("utf8");
 }
-export function readTextFileWithLimit(filePath, maxBytes, label = "File") {
+export function readTextFile(filePath, label = "File") {
     const fd = fs.openSync(filePath, "r");
     try {
-        return readTextFileDescriptorWithLimit(fd, maxBytes, label, filePath);
+        const stat = fs.fstatSync(fd);
+        if (!stat.isFile())
+            throw new ConfigError(`${label} is not a regular file: ${filePath}.`, "INVALID_CONFIG_FILE");
+        return fs.readFileSync(fd, "utf8");
     }
     finally {
         fs.closeSync(fd);
@@ -290,7 +291,7 @@ function isValidDirectory(dir) {
 function readStashDirFromConfig() {
     try {
         const configPath = getConfigPath();
-        const text = readTextFileWithLimit(configPath, MAX_CONFIG_FILE_BYTES, "Config file");
+        const text = readTextFile(configPath, "Config file");
         // The config loader accepts JSONC, so a commented config.json is valid and
         // in use. Parsing it raw here threw, the catch swallowed it, and every
         // caller silently fell back — operating on the wrong bundle or failing with
@@ -544,21 +545,59 @@ export async function fetchWithTimeout(url, opts, timeoutMs = 30_000, signal) {
             clearTimeout(timer);
     }
 }
+/**
+ * Cap on how long a retry loop will wait between attempts, even when a
+ * server-supplied `Retry-After` claims a longer delay. Prevents an
+ * attacker-controlled or misconfigured server from parking a caller
+ * indefinitely.
+ */
+export const DEFAULT_RETRY_MAX_DELAY_MS = 30_000;
+export function shouldRetry(status) {
+    return status === 429 || status >= 500;
+}
+/** Jittered exponential backoff, capped at `maxDelayMs`. */
+export function backoffDelay(attempt, baseDelay = 500, maxDelayMs = DEFAULT_RETRY_MAX_DELAY_MS) {
+    return Math.min(maxDelayMs, baseDelay * 2 ** attempt * (0.5 + Math.random() * 0.5));
+}
+/**
+ * Determine the delay before the next retry attempt.
+ *
+ * Honors a server-supplied `Retry-After` header in both its numeric-seconds
+ * and HTTP-date forms, but always clamps the result to `maxDelayMs` — an
+ * unclamped `Retry-After` lets an attacker/misconfigured server park a
+ * caller for an arbitrarily long time. Falls back to jittered exponential
+ * backoff when the header is absent or unparseable.
+ */
+export function computeRetryDelay(response, attempt, options) {
+    const maxDelayMs = options?.maxDelayMs ?? DEFAULT_RETRY_MAX_DELAY_MS;
+    const baseDelay = options?.baseDelay ?? 500;
+    const retryAfter = response.headers.get("retry-after");
+    if (retryAfter) {
+        const seconds = Number(retryAfter);
+        if (Number.isFinite(seconds)) {
+            return seconds >= 0 ? Math.min(maxDelayMs, seconds * 1_000) : backoffDelay(attempt, baseDelay, maxDelayMs);
+        }
+        const date = Date.parse(retryAfter);
+        if (Number.isFinite(date))
+            return Math.min(maxDelayMs, Math.max(0, date - Date.now()));
+    }
+    return backoffDelay(attempt, baseDelay, maxDelayMs);
+}
 /**
  * Fetch with retry and exponential backoff.
  * Retries on network errors, 429, and 5xx responses.
- * Honors Retry-After header for 429 responses.
+ * Honors Retry-After header, capped at `maxDelayMs`.
  */
 export async function fetchWithRetry(url, init, options) {
     const maxRetries = options?.retries ?? 3;
     const baseDelay = options?.baseDelay ?? 500;
+    const maxDelayMs = options?.maxDelayMs ?? DEFAULT_RETRY_MAX_DELAY_MS;
     const timeout = options?.timeout ?? 30_000;
     for (let attempt = 0; attempt <= maxRetries; attempt++) {
         try {
             const response = await fetchWithTimeout(url, init, timeout, init?.signal ?? undefined);
             if (attempt < maxRetries && shouldRetry(response.status)) {
-                const retryAfter = parseRetryAfter(response);
-                const delay = retryAfter ?? baseDelay * 2 ** attempt * (0.5 + Math.random() * 0.5);
+                const delay = computeRetryDelay(response, attempt, { baseDelay, maxDelayMs });
                 await response.body?.cancel().catch(() => undefined);
                 await abortableDelay(delay, init?.signal);
                 continue;
@@ -571,8 +610,7 @@ export async function fetchWithRetry(url, init, options) {
             // A caller-supplied abort is terminal: never keep retrying past it.
             if (init?.signal?.aborted)
                 throw err;
-            const delay = baseDelay * 2 ** attempt * (0.5 + Math.random() * 0.5);
-            await abortableDelay(delay, init?.signal);
+            await abortableDelay(backoffDelay(attempt, baseDelay, maxDelayMs), init?.signal);
         }
     }
     throw new Error("fetchWithRetry: unreachable");
@@ -584,17 +622,19 @@ export async function fetchWithRetry(url, init, options) {
  * large. Sleeping it out with a bare `setTimeout` ignored the caller's abort
  * signal entirely, so a single `429` could park an operation far past any
  * deadline its caller believed it had imposed — the request timeout bounds
- * only the request, never the wait between attempts.
+ * only the request, never the wait between attempts. Callers using this for
+ * a retry delay should pass a `maxDelayMs`-capped `ms` (see
+ * {@link computeRetryDelay}) to bound the wait itself.
  */
-function abortableDelay(ms, signal) {
+export function abortableDelay(ms, signal, abortMessage = "Aborted") {
     if (!signal)
         return new Promise((resolve) => setTimeout(resolve, ms));
     if (signal.aborted)
-        return Promise.reject(signal.reason ?? new Error("Aborted"));
+        return Promise.reject(signal.reason ?? new Error(abortMessage));
     return new Promise((resolve, reject) => {
         const onAbort = () => {
             clearTimeout(timer);
-            reject(signal.reason ?? new Error("Aborted"));
+            reject(signal.reason ?? new Error(abortMessage));
         };
         const timer = setTimeout(() => {
             signal.removeEventListener("abort", onAbort);
@@ -603,9 +643,6 @@ function abortableDelay(ms, signal) {
         signal.addEventListener("abort", onAbort, { once: true });
     });
 }
-function shouldRetry(status) {
-    return status === 429 || status >= 500;
-}
 /**
  * Read stdin as UTF-8 text if something is piped in. Returns `undefined`
  * when stdin is a TTY (no pipe) or when the piped content is empty.
@@ -789,13 +826,6 @@ export async function jsonWithByteCap(response, maxBytes = DEFAULT_RESPONSE_BYTE
     const text = await readBodyWithByteCap(response, maxBytes, limits);
     return JSON.parse(text);
 }
-function parseRetryAfter(response) {
-    const header = response.headers.get("retry-after");
-    if (!header)
-        return undefined;
-    const seconds = parseInt(header, 10);
-    return Number.isNaN(seconds) ? undefined : seconds * 1000;
-}
 export function toErrorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
@@ -871,8 +901,15 @@ export function stringArray(value) {
  * reported alive. Treating it as dead let a lock held by a live process in a
  * shared data dir (agent sandboxes, containers, service accounts — a
  * configuration managed-db.ts explicitly supports) be reclaimed as stale.
+ *
+ * `pid` is `unknown` because callers reading it out of untrusted on-disk
+ * JSON (e.g. a lease file) cannot guarantee it parsed as a valid PID; a
+ * non-positive-integer value is reported dead without ever reaching
+ * `process.kill`.
  */
 export function isProcessAlive(pid) {
+    if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0)
+        return false;
     try {
         process.kill(pid, 0);
         return true;

package/dist/core/config/config-io.js

@@ -15,7 +15,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { sleepSync } from "../../runtime.js";
-import { MAX_CONFIG_FILE_BYTES, readTextFileWithLimit, stripJsonComments, writeFileAtomic } from "../common.js";
+import { readTextFile, stripJsonComments, writeFileAtomic } from "../common.js";
 import { ConfigError } from "../errors.js";
 import { createLockPayload, probeLock, reclaimStaleLock, releaseLock, tryAcquireLockSync } from "../file-lock.js";
 import { getCacheDir, getConfigDir } from "../paths.js";
@@ -25,7 +25,7 @@ import { getCacheDir, getConfigDir } from "../paths.js";
  */
 export function readConfigText(configPath) {
     try {
-        return readTextFileWithLimit(configPath, MAX_CONFIG_FILE_BYTES, "Config file");
+        return readTextFile(configPath, "Config file");
     }
     catch (err) {
         if (err.code === "ENOENT")

package/dist/core/config/config-sources.js

@@ -23,6 +23,16 @@ export function bundleComponentConfig(bundle) {
  * `defaultBundle` first, then map insertion order. Each entry's `name` is its
  * bundle key. Returns `undefined` when no bundles map is configured.
  */
+/**
+ * A bundle's true identity: its configured `path` plus its component's
+ * `root` (default `"."`), fully resolved. Two bundle entries whose bare
+ * `path` differs (relative vs. absolute, trailing slash, `~` vs. expanded)
+ * can still resolve to this same directory — this is the identity akm
+ * compares before registering or reconciling a bundle (issue #870).
+ */
+export function bundleContentRoot(entryPath, componentRoot) {
+    return path.resolve(entryPath, componentRoot ?? ".");
+}
 /**
  * The resolved primary stash path — the `defaultBundle`'s filesystem `path`
  * (spec §10.1) — or `undefined` when no filesystem primary is configured.
@@ -36,9 +46,9 @@ export function primaryBundlePath(config) {
     if (!entry || typeof entry.path !== "string" || entry.path.length === 0)
         return undefined;
     const componentRoot = bundleComponentConfig(entry)?.root;
-    if (!componentRoot || componentRoot === ".")
-        return entry.path;
     const bundleRoot = path.resolve(entry.path);
+    if (!componentRoot || componentRoot === ".")
+        return bundleRoot;
     const resolved = path.resolve(bundleRoot, componentRoot);
     const relative = path.relative(bundleRoot, resolved);
     if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
@@ -46,6 +56,26 @@ export function primaryBundlePath(config) {
     }
     return resolved;
 }
+/**
+ * Every configured filesystem bundle's id paired with its resolved content
+ * root. Used to detect two bundle ids that resolve to the same directory
+ * (issue #870) and to find the id that already owns a given root before a
+ * new one is registered.
+ */
+export function bundleContentRoots(config) {
+    const bundles = config.bundles ?? {};
+    const out = [];
+    for (const [id, entry] of Object.entries(bundles)) {
+        if (typeof entry.path !== "string" || entry.path.length === 0)
+            continue;
+        out.push({ id, contentRoot: bundleContentRoot(entry.path, bundleComponentConfig(entry)?.root) });
+    }
+    return out;
+}
+/** The bundle id whose resolved content root already matches `resolvedContentRoot`, if any. */
+export function bundleKeyForContentRoot(config, resolvedContentRoot) {
+    return bundleContentRoots(config).find((entry) => entry.contentRoot === resolvedContentRoot)?.id;
+}
 export function bundlesToSourceEntries(config) {
     const bundles = config.bundles;
     if (!bundles)

package/dist/core/config/config.js

@@ -376,7 +376,7 @@ export function getIndexPassConfig(config, passName) {
     return entry;
 }
 // Re-export source runtime helpers — implementation lives in config-sources.ts.
-export { bundleComponentConfig, bundleEntryToSourceEntry, bundlesToSourceEntries, installedSourceDescriptor, parseSourceSpec, primaryBundlePath, resolveConfiguredSources, } from "./config-sources.js";
+export { bundleComponentConfig, bundleContentRoot, bundleContentRoots, bundleEntryToSourceEntry, bundleKeyForContentRoot, bundlesToSourceEntries, installedSourceDescriptor, parseSourceSpec, primaryBundlePath, resolveConfiguredSources, } from "./config-sources.js";
 /**
  * Merge a partial user-config override onto a base config. Used by
  * {@link loadUserConfig} (DEFAULT_CONFIG + on-disk) and {@link updateConfig}

package/dist/core/config/schema/engines.js

@@ -15,7 +15,7 @@ import { z } from "zod";
 // a config-schema ↔ config-types type cycle that collapses inference.
 import { HARNESS_AGENT_DISPATCH_IDS, VALID_HARNESS_IDS } from "../../../integrations/harnesses/ids.js";
 import { WORKFLOW_MAX_TIMEOUT_MS } from "../../../workflows/resource-limits.js";
-import { chatCompletionsEndpoint, ENV_REFERENCE_PATTERN, ExtraParamsSchema, engineName, LlmCapabilitiesSchema, nonEmptyString, positiveInt, } from "./primitives.js";
+import { chatCompletionsEndpoint, ENV_REFERENCE_PATTERN, ExtraParamsSchema, engineName, nonEmptyString, positiveInt, } from "./primitives.js";
 /**
  * Engine-config timeouts share the workflow ceiling.
  *
@@ -43,16 +43,20 @@ export const LlmConnectionConfigSchema = z
     maxTokens: positiveInt.optional(),
     timeoutMs: timeoutMsField,
     concurrency: positiveInt.optional(),
-    capabilities: LlmCapabilitiesSchema.optional(),
+    // User-settable override, not a cached probe verdict: attempt-then-
+    // fallback in llm/client.ts tries `response_format: json_schema` whenever
+    // a schema is supplied, degrading to plain text on an unsupported-4xx and
+    // remembering that in-memory for the rest of the process. `false` here
+    // opts a known-incompatible endpoint out of even the first attempt;
+    // `true` is advisory only.
+    supportsJsonSchema: z.boolean().optional(),
     extraParams: ExtraParamsSchema.optional(),
     contextLength: positiveInt.optional(),
     enableThinking: z.boolean().optional(),
     reasoningEffort: nonEmptyString.optional(),
 })
     .passthrough();
-export const LlmProfileConfigSchema = LlmConnectionConfigSchema.extend({
-    supportsJsonSchema: z.boolean().optional(),
-}).passthrough();
+export const LlmProfileConfigSchema = LlmConnectionConfigSchema.passthrough();
 // ── Agent engines ───────────────────────────────────────────────────────────
 // Derives from the canonical VALID_HARNESS_IDS (#565) so the Zod gate cannot
 // drift from the TS union / parse check / setup detection.
@@ -68,7 +72,6 @@ const LlmEngineSchema = z
     maxTokens: positiveInt.optional(),
     timeoutMs: timeoutMsField,
     concurrency: positiveInt.optional(),
-    supportsJsonSchema: z.boolean().optional(),
     extraParams: ExtraParamsSchema.optional(),
     contextLength: positiveInt.optional(),
     enableThinking: z.boolean().optional(),
@@ -103,7 +106,6 @@ const AgentEngineSchema = z
         "temperature",
         "maxTokens",
         "concurrency",
-        "supportsJsonSchema",
         "extraParams",
         "contextLength",
         "enableThinking",

package/dist/core/config/schema/primitives.js

@@ -54,11 +54,6 @@ export const ExtraParamsSchema = z.record(z.unknown()).superRefine((value, ctx)
     }
 });
 // ── Shared connection/invocation building blocks ────────────────────────────
-export const LlmCapabilitiesSchema = z
-    .object({
-    structuredOutput: z.boolean().optional(),
-})
-    .passthrough();
 export const LlmInvocationOverridesSchema = z
     .object({
     temperature: z.number().finite().optional(),

package/dist/core/config/schema/search.js

@@ -16,7 +16,8 @@ const SearchGraphBoostSchema = z
     hopBoostCap: nonNegativeNumber.optional(),
     /** Hard-capped at 3; values > 3 hard-error so users see the typo. */
     maxHops: positiveInt.max(3).optional(),
-    confidenceMode: z.enum(["off", "blend", "multiply"]).default("blend").optional(),
+    /** Only "blend" is exercised; "off"/"multiply" were never set in practice and were removed. */
+    confidenceMode: z.enum(["blend"]).default("blend").optional(),
     /** Range [0, 1]; values > 1 hard-error (no silent clamp). */
     confidenceWeight: z.number().finite().min(0).max(1).default(0.2).optional(),
 })

package/dist/core/file-lock.js

@@ -4,6 +4,7 @@
 import { randomUUID } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
+import { sleepSync } from "../runtime.js";
 import { openDatabase } from "../storage/database.js";
 import { isProcessAlive, MAX_LOCK_METADATA_BYTES, readTextFileDescriptorWithLimit } from "./common.js";
 function readLockSnapshot(lockPath) {
@@ -51,7 +52,7 @@ function withLockOperationMutex(lockPath, run) {
             db.exec("BEGIN IMMEDIATE");
             began = db.inTransaction;
             if (!began)
-                Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 2 ** attempt);
+                sleepSync(2 ** attempt);
         }
         if (!began)
             throw new Error(`Could not acquire lock operation mutex for ${lockPath}.`);