akm-cli 0.9.5 → 0.9.7

package/dist/integrations/harnesses/gemini/agent-builder.js

@@ -23,9 +23,7 @@
  * - **systemPrompt** — Gemini CLI has no system-prompt flag in headless mode
  *   (system text comes from `GEMINI.md` context files / `GEMINI_SYSTEM_MD`),
  *   so the system prompt is folded into the `-p` payload ahead of the task
- *   prompt, separated by a blank line. `assertNotFlag` still guards it so a
- *   `--`-prefixed system prompt cannot turn the front of the `-p` value into
- *   a flag.
+ *   prompt, separated by a blank line.
  * - **schema** — the matrix places Gemini in the "via prompt+validate" tier
  *   (no native `--output-schema` equivalent, unlike Codex — so no temp-file
  *   plumbing here), so the JSON Schema is passed through the prompt: a
@@ -49,7 +47,7 @@
  * that registry, so this builder is reachable under the `"gemini"` platform
  * name without any further wiring.
  */
-import { assertNotFlag, resolveDispatchModel, } from "../../agent/builder-shared.js";
+import { resolveDispatchModel } from "../../agent/builder-shared.js";
 import { createAgentRequestLowerer } from "../../agent/request-lowering.js";
 /** Canonical harness/platform id used for model-alias resolution. */
 export const GEMINI_PLATFORM = "gemini";
@@ -102,8 +100,6 @@ export const geminiBuilder = {
         outputSchema: true,
     }),
     build(profile, req) {
-        assertNotFlag(req.systemPrompt, "systemPrompt");
-        assertNotFlag(req.model, "model");
         const args = [...profile.args];
         if (req.model) {
             const resolved = resolveDispatchModel(req, profile, GEMINI_PLATFORM);
@@ -113,7 +109,6 @@ export const geminiBuilder = {
             // Structured policy objects (entries === undefined) emit NO flags:
             // dropping a restriction must never widen to auto-approval.
             for (const tool of toolPolicyEntries(req.tools) ?? []) {
-                assertNotFlag(tool, "tools entry");
                 args.push("--allowed-tools", tool);
             }
         }

package/dist/integrations/harnesses/opencode/agent-builder.js

@@ -14,7 +14,7 @@
  * pre-migration `opencodeBuilder`. The builder's `platform` stays `'opencode'`
  * (the canonical harness id).
  */
-import { assertNotFlag, resolveDispatchModel } from "../../agent/builder-shared.js";
+import { resolveDispatchModel } from "../../agent/builder-shared.js";
 import { createAgentRequestLowerer } from "../../agent/request-lowering.js";
 /**
  * OpenCode builder.
@@ -34,9 +34,6 @@ export const opencodeBuilder = {
         outputSchema: false,
     }),
     build(profile, req) {
-        assertNotFlag(req.systemPrompt, "systemPrompt");
-        assertNotFlag(req.model, "model");
-        assertNotFlag(req.agent, "agent");
         const args = req.model ? [] : [...profile.args];
         if (req.model) {
             for (let index = 0; index < profile.args.length; index += 1) {

package/dist/integrations/harnesses/opencode-sdk/sdk-runner.js

@@ -92,6 +92,7 @@
  */
 import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
+import { COMMON_SPAWN_ENV_PASSTHROUGH, spawnEnvNamesFor } from "../../../core/spawn-env.js";
 import { DEFAULT_AGENT_TIMEOUT_MS } from "../../agent/config.js";
 // Server registry — one server per complete server-material signature. Caller
 // deadlines race the shared promise independently; they never become startup
@@ -269,24 +270,9 @@ function serverRegistryKey(profile, env) {
         .update(JSON.stringify(canonicalize(material)))
         .digest("hex");
 }
-const OPENCODE_SDK_SERVER_ENV_NAMES = [
-    "HOME",
-    "PATH",
-    "USER",
-    "LANG",
-    "LC_ALL",
-    "TERM",
-    "TMPDIR",
-    "SYSTEMROOT",
-    "COMSPEC",
-    "PATHEXT",
-    "WINDIR",
-    "TEMP",
-    "TMP",
-];
 /** @internal Exact environment allowlist used to start the OpenCode SDK server. */
 export function opencodeSdkServerEnvironmentNames(profile) {
-    return [...new Set([...OPENCODE_SDK_SERVER_ENV_NAMES, ...(profile.envPassthrough ?? [])])];
+    return [...new Set([...spawnEnvNamesFor(COMMON_SPAWN_ENV_PASSTHROUGH), ...(profile.envPassthrough ?? [])])];
 }
 function buildServerEnv(profile, config, bindings, envSource) {
     const env = {};

package/dist/integrations/harnesses/openhands/agent-builder.js

@@ -71,7 +71,7 @@
  * `pattern: "local-runner"`, `structuredOutput: "native-json"` alongside it
  * (`./index.ts`).
  */
-import { assertNotFlag, resolveDispatchModel, } from "../../agent/builder-shared.js";
+import { resolveDispatchModel } from "../../agent/builder-shared.js";
 import { createAgentRequestLowerer } from "../../agent/request-lowering.js";
 /** Canonical harness/platform id used for model-alias resolution. */
 export const OPENHANDS_PLATFORM = "openhands";
@@ -115,8 +115,6 @@ export const openhandsBuilder = {
         outputSchema: true,
     }),
     build(profile, req) {
-        assertNotFlag(req.systemPrompt, "systemPrompt");
-        assertNotFlag(req.model, "model");
         const args = [...profile.args];
         // Headless essentials (matrix shape): non-interactive run, JSONL stdout
         // for the extractor.

package/dist/integrations/harnesses/pi/agent-builder.js

@@ -25,7 +25,7 @@
  *   builders, so a prompt whose text begins with `-`/`--` can never be parsed
  *   as flags.
  * - **systemPrompt** — passed via `--system-prompt` (Pi follows the Claude
- *   Code flag conventions), guarded by `assertNotFlag`.
+ *   Code flag conventions).
  * - **schema** — the matrix places Pi in the "via prompt+validate" tier (no
  *   native `--output-schema` equivalent, unlike Codex), so the JSON Schema is
  *   passed through the prompt: a directive matching the engine's wording
@@ -50,7 +50,7 @@
  * wiring. The `PI_SESSION_ID` identity-env marker is declared alongside it
  * (`./index.ts`).
  */
-import { assertNotFlag, resolveDispatchModel, } from "../../agent/builder-shared.js";
+import { resolveDispatchModel } from "../../agent/builder-shared.js";
 import { createAgentRequestLowerer } from "../../agent/request-lowering.js";
 /** Canonical harness/platform id used for model-alias resolution. */
 export const PI_PLATFORM = "pi";
@@ -81,8 +81,6 @@ export const piBuilder = {
         outputSchema: true,
     }),
     build(profile, req) {
-        assertNotFlag(req.systemPrompt, "systemPrompt");
-        assertNotFlag(req.model, "model");
         const args = [...profile.args];
         if (req.systemPrompt) {
             args.push("--system-prompt", req.systemPrompt);

package/dist/integrations/session-logs/index.js

@@ -133,12 +133,3 @@ export function collectSessionEvents(harnesses, sinceMs, maxSessionsPerHarness =
     }
     return events;
 }
-/**
- * Scan recent session logs from all available harnesses and return
- * repeated failure patterns that might warrant new AKM assets.
- */
-export function getExecutionLogCandidates(sinceDays = 7) {
-    const sinceMs = Date.now() - sinceDays * 24 * 60 * 60 * 1000;
-    const events = collectSessionEvents(getAvailableHarnesses(), sinceMs);
-    return aggregateSessionEvents(events);
-}

package/dist/llm/client.js

@@ -11,7 +11,6 @@ import { fetchWithTimeout, readBodyWithByteCap } from "../core/common.js";
 import { resolveSecret } from "../core/config/config.js";
 import { ENV_REFERENCE_PATTERN } from "../core/config/schema/primitives.js";
 import { formatExtraParamsIssue, validateExtraParams } from "../core/extra-params.js";
-import { parseJsonResponse } from "../core/parse.js";
 import { redactErrorBody, redactSensitiveText } from "../core/redaction.js";
 import { warn, warnVerbose } from "../core/warn.js";
 import { DEFAULT_LLM_TIMEOUT_MS } from "../integrations/agent/config.js";
@@ -199,12 +198,66 @@ async function chatCompletionReal(config, messages, options) {
         return await chatCompletionAttempt(config, messages, options, remaining);
     }
 }
+// ── Structured-output attempt-then-fallback ─────────────────────────────────
 /**
- * A single chat-completion attempt: one HTTP request/response cycle with no
- * retry. {@link chatCompletion} wraps this with a single bounded retry for
- * transient failures.
+ * Connections that have already demonstrated (via a real 4xx response, not a
+ * probe) that they reject `response_format: json_schema`. In-memory only,
+ * per process, never persisted — the replacement for the old
+ * `capabilities.structuredOutput` config cache that `akm setup` wrote once
+ * and nothing ever invalidated on a later `akm config set`. Populated the
+ * first time a real call proves it, forgotten on the next process start, so
+ * a config/endpoint change can never leave a stale verdict in place.
+ */
+const jsonSchemaUnsupportedConnections = new Set();
+function connectionKey(config) {
+    return `${config.endpoint}|${config.model}`;
+}
+/** TEST-ONLY. Clear the in-memory json-schema-support tracker between tests. */
+export function _resetJsonSchemaSupportTrackerForTests() {
+    jsonSchemaUnsupportedConnections.clear();
+}
+/**
+ * Whether this connection has already been proven, this process, not to
+ * support `response_format: json_schema`. Callers choosing a prompt-framing
+ * strategy up front (e.g. `improve/reflect.ts`'s `outputMode`) can consult
+ * this instead of a persisted config flag — it reflects only what a real
+ * call this run actually observed.
+ */
+export function isJsonSchemaKnownUnsupported(config) {
+    return jsonSchemaUnsupportedConnections.has(connectionKey(config));
+}
+/**
+ * A single chat-completion attempt: one HTTP request/response cycle, with an
+ * inline fallback-once when a schema was requested and the provider 4xx's
+ * (never retried by the transient-failure policy below, by design — 4xx is
+ * a same-request-will-always-fail signal EXCEPT for this one specific,
+ * request-shape-dependent case). No cached verdict gates the first attempt:
+ * `config.supportsJsonSchema === false` is the only thing that skips it,
+ * and that is a value a human (or workflow author) set explicitly, not one
+ * a probe wrote automatically.
  */
 async function chatCompletionAttempt(config, messages, options, timeoutMs) {
+    const wantsSchema = Boolean(options?.responseSchema) && config.supportsJsonSchema !== false && !isJsonSchemaKnownUnsupported(config);
+    try {
+        return await chatCompletionAttemptOnce(config, messages, options, timeoutMs, wantsSchema);
+    }
+    catch (err) {
+        if (!wantsSchema ||
+            !(err instanceof LlmCallError) ||
+            err.code !== "provider_error" ||
+            typeof err.statusCode !== "number" ||
+            err.statusCode < 400 ||
+            err.statusCode >= 500 ||
+            err.statusCode === 429) {
+            throw err;
+        }
+        warnVerbose(`[akm] LLM rejected response_format:json_schema (${err.statusCode}); retrying once without it: ${err.message}`);
+        const fallback = await chatCompletionAttemptOnce(config, messages, options, timeoutMs, false);
+        jsonSchemaUnsupportedConnections.add(connectionKey(config));
+        return fallback;
+    }
+}
+async function chatCompletionAttemptOnce(config, messages, options, timeoutMs, includeSchema) {
     if (config.extraParams !== undefined) {
         const issue = validateExtraParams(config.extraParams)[0];
         if (issue)
@@ -225,7 +278,7 @@ async function chatCompletionAttempt(config, messages, options, timeoutMs) {
     // limits; a hardcoded default creates silent truncation failures when the
     // guess is wrong. Users who need a cap can set llm.maxTokens in config.
     const resolvedMaxTokens = options?.maxTokens ?? config.maxTokens;
-    const responseFormat = options?.responseSchema && config.supportsJsonSchema
+    const responseFormat = includeSchema && options?.responseSchema
         ? {
             response_format: {
                 type: "json_schema",
@@ -382,47 +435,27 @@ export async function isLlmAvailable(config) {
         return false;
     }
 }
-// ── Capability probe ────────────────────────────────────────────────────────
-const CAPABILITY_PROBE_JSON_SCHEMA = {
-    type: "object",
-    properties: {
-        ok: { type: "boolean", const: true },
-        ingest: { type: "boolean", const: true },
-        lint: { type: "boolean", const: true },
-    },
-    required: ["ok", "ingest", "lint"],
-    additionalProperties: false,
-};
+// ── Reachability probe ──────────────────────────────────────────────────────
 /**
- * Ask the model to emit a strict JSON object so we know whether the knowledge
- * wiki ingest/lint flows can rely on structured output. Failure is non-fatal —
- * the caller can fall back to assist-only mode.
+ * Best-effort reachability check with an error message, for setup's optional
+ * `--probe` connectivity verification. Deliberately does NOT probe or cache
+ * `response_format: json_schema` support: that used to be persisted as
+ * `capabilities.structuredOutput` and consulted on every later call, so a
+ * config edit that changed the endpoint/model left a stale verdict in place
+ * with no invalidation, and a stale `true` sent an unsupported request that
+ * the retry policy explicitly does not retry (4xx). `chatCompletion` now
+ * attempts the schema request fresh every time and falls back once per call
+ * on a 4xx — see the in-memory tracker below.
  */
-export async function probeLlmCapabilities(config) {
+export async function probeLlmReachable(config) {
     try {
-        const raw = await chatCompletion({ ...config, supportsJsonSchema: true }, [
-            {
-                role: "system",
-                content: "You return only valid JSON. No prose, no markdown fences.",
-            },
-            {
-                role: "user",
-                content: 'Return exactly this JSON object and nothing else: {"ok": true, "ingest": true, "lint": true}',
-            },
-        ], { maxTokens: 64, temperature: 0, responseSchema: CAPABILITY_PROBE_JSON_SCHEMA });
-        if (!raw)
-            return { reachable: false, structuredOutput: false, error: "empty response" };
-        const parsed = parseJsonResponse(raw);
-        return {
-            reachable: true,
-            structuredOutput: Boolean(parsed &&
-                Object.keys(parsed).length === 3 &&
-                parsed.ok === true &&
-                parsed.ingest === true &&
-                parsed.lint === true),
-        };
+        const raw = await chatCompletion(config, [{ role: "user", content: "Respond with just the word: ok" }], {
+            maxTokens: 16,
+            temperature: 0,
+        });
+        return raw.length > 0 ? { reachable: true } : { reachable: false, error: "empty response" };
     }
     catch (err) {
-        return { reachable: false, structuredOutput: false, error: err instanceof Error ? err.message : String(err) };
+        return { reachable: false, error: err instanceof Error ? err.message : String(err) };
     }
 }

package/dist/llm/embedder.js

@@ -93,11 +93,15 @@ async function embedOnce(text, embeddingConfig, signal) {
 }
 /**
  * Generate embeddings for multiple texts in batch.
- * Uses the OpenAI-compatible batch API for remote endpoints (batches of 100).
+ * Uses the OpenAI-compatible batch API for remote endpoints, batched by an
+ * estimated token budget (not a fixed document count, #874). A remote
+ * sub-batch or oversized document that fails is skipped rather than
+ * aborting the whole call — pass `onSkip` to learn which indices were
+ * skipped and why; the result array holds `undefined` at those indices.
  * Uses the LocalEmbedder.embedBatch path for the local transformer pipeline,
  * which processes texts in chunks of 32 for genuine batched inference.
  */
-export async function embedBatch(texts, embeddingConfig, signal) {
+export async function embedBatch(texts, embeddingConfig, signal, onSkip) {
     if (embedderOverrides?.embedBatch)
         return embedderOverrides.embedBatch(texts, embeddingConfig, signal);
     if (texts.length === 0)
@@ -107,7 +111,7 @@ export async function embedBatch(texts, embeddingConfig, signal) {
         return texts.map((t) => deterministicEmbed(t));
     }
     if (embeddingConfig && hasRemoteEndpoint(embeddingConfig)) {
-        return new RemoteEmbedder(embeddingConfig).embedBatch(texts, signal);
+        return new RemoteEmbedder(embeddingConfig).embedBatch(texts, signal, onSkip);
     }
     // Local transformer: use the batched path (chunks of 32 via LocalEmbedder).
     // When a localModel override is set we cannot share the singleton (which uses

package/dist/llm/embedders/remote.js

@@ -10,11 +10,65 @@
 import { fetchWithTimeout, isHttpUrl, readBodyWithByteCap } from "../../core/common.js";
 import { resolveSecret } from "../../core/config/config.js";
 import { redactErrorBody, redactSensitiveText } from "../../core/redaction.js";
-const DEFAULT_REMOTE_BATCH_SIZE = 100;
+import { warnVerbose } from "../../core/warn.js";
+/**
+ * Upper bound on the number of documents in one HTTP request, independent of
+ * the token budget below. Overridable via `config.batchSize`. Purely a
+ * safety cap (very many tiny documents could otherwise pack one request) —
+ * the token budget is what actually keeps a request inside the endpoint's
+ * context window and inside the timeout (#874).
+ */
+export const DEFAULT_REMOTE_BATCH_SIZE = 100;
+/**
+ * Conservative default token budget per HTTP request when the config gives
+ * no better number (`maxTokens` or `contextLength`). #874's measurements:
+ * a batch of 100 small docs (~400 KB, ~100K tokens) took 14.8s against a
+ * healthy local endpoint — half the 30s request timeout — and a single
+ * 128 KB (~24K token) document alone was rejected by the endpoint as
+ * exceeding its context size. 8000 tokens keeps a batch's estimated size
+ * comfortably under both the timeout and common local-model context windows.
+ */
+export const DEFAULT_TOKEN_BUDGET = 8000;
 /** Cheap token estimator: 4 chars ≈ 1 token. Used in verbose logging and error messages. */
 export function estimateTokenCount(text) {
     return Math.round(text.length / 4);
 }
+/**
+ * Group `texts` into request-sized batches bounded by BOTH an estimated
+ * token budget and a document-count cap, so one large document does not
+ * silently blow the batch past the endpoint's context window (#874).
+ *
+ * A single document whose own estimate exceeds `tokenBudget` can never fit
+ * any batch — it is reported as its own oversized "batch" so the caller can
+ * skip it without ever making an HTTP request for it.
+ */
+export function buildTokenBoundedBatches(texts, tokenBudget, maxCount) {
+    const batches = [];
+    let current = [];
+    let currentTokens = 0;
+    const flush = () => {
+        if (current.length > 0) {
+            batches.push({ indices: current, oversized: false });
+            current = [];
+            currentTokens = 0;
+        }
+    };
+    for (let i = 0; i < texts.length; i++) {
+        const tokens = estimateTokenCount(texts[i]);
+        if (tokens > tokenBudget) {
+            flush();
+            batches.push({ indices: [i], oversized: true });
+            continue;
+        }
+        if (current.length > 0 && (currentTokens + tokens > tokenBudget || current.length >= maxCount)) {
+            flush();
+        }
+        current.push(i);
+        currentTokens += tokens;
+    }
+    flush();
+    return batches;
+}
 export class RemoteEmbedder {
     config;
     endpoint;
@@ -63,55 +117,102 @@ export class RemoteEmbedder {
         }
         return l2Normalize(json.data[0].embedding);
     }
-    async embedBatch(texts, signal) {
+    /**
+     * Embed every text, batched by an estimated token budget (not a fixed
+     * document count) and bounded by `config.batchSize` as a document-count
+     * safety cap. Batching by count alone let a batch of ordinary-sized
+     * documents balloon past the endpoint's context window and the 30s
+     * request timeout (#874).
+     *
+     * A failing sub-batch or an oversized single document is SKIPPED, not
+     * thrown — the rest of `texts` still gets embedded. Skips are reported via
+     * `onSkip` (index into `texts` + a named reason) rather than silently
+     * dropped; the returned array holds `undefined` at every skipped index.
+     * A caller abort (`signal.aborted`) still propagates as a rejection.
+     */
+    async embedBatch(texts, signal, onSkip) {
         if (texts.length === 0)
             return [];
-        const results = [];
+        const results = new Array(texts.length).fill(undefined);
         const headers = this.buildHeaders();
         const ollamaOpts = resolveOllamaOptions(this.config);
-        const batchSize = this.config.batchSize ?? DEFAULT_REMOTE_BATCH_SIZE;
-        for (let i = 0; i < texts.length; i += batchSize) {
-            const batch = texts.slice(i, i + batchSize);
-            const body = {
-                input: batch,
-                model: this.model,
-            };
-            if (this.config.dimension) {
-                body.dimensions = this.config.dimension;
-            }
-            if (ollamaOpts) {
-                body.options = ollamaOpts;
-            }
-            // See embed(): `signal` goes through the 4th parameter, not the
-            // RequestInit, or fetchWithTimeout drops it.
-            const response = await fetchWithTimeout(normalizeEmbeddingEndpoint(this.endpoint), {
-                method: "POST",
-                headers,
-                body: JSON.stringify(body),
-            }, 30_000, signal);
-            if (!response.ok) {
-                const respBody = await readBodyWithByteCap(response, undefined, { bodyTimeoutMs: 30_000, signal }).catch((err) => {
-                    if (signal?.aborted)
-                        throw err;
-                    return "";
+        const tokenBudget = this.config.maxTokens ?? this.config.contextLength ?? DEFAULT_TOKEN_BUDGET;
+        const maxCount = this.config.batchSize ?? DEFAULT_REMOTE_BATCH_SIZE;
+        const batches = buildTokenBoundedBatches(texts, tokenBudget, maxCount);
+        for (const textBatch of batches) {
+            if (textBatch.oversized) {
+                const idx = textBatch.indices[0];
+                const estTokens = estimateTokenCount(texts[idx]);
+                onSkip?.({
+                    index: idx,
+                    reason: "context-window-exceeded",
+                    message: `Document estimated at ${estTokens} tokens exceeds the ${tokenBudget}-token embedding budget; skipped.`,
                 });
-                throw new Error(`Embedding batch request failed (${response.status}): ${this.safeErrorBody(respBody)}`);
+                continue;
             }
-            const json = JSON.parse(await readBodyWithByteCap(response, undefined, { bodyTimeoutMs: 30_000, signal }));
-            if (!json.data || json.data.length !== batch.length) {
-                throw new Error(`Unexpected embedding batch response: expected ${batch.length} embeddings, got ${json.data?.length ?? 0}.${embeddingEndpointPathHint(this.endpoint)}`);
+            const batch = textBatch.indices.map((i) => texts[i]);
+            try {
+                const embeddings = await this.requestBatch(batch, headers, ollamaOpts, signal);
+                for (let k = 0; k < textBatch.indices.length; k++) {
+                    results[textBatch.indices[k]] = embeddings[k];
+                }
             }
-            // Sort by index to guarantee correct order (OpenAI API doesn't guarantee order)
-            const sorted = [...json.data].sort((a, b) => a.index - b.index);
-            for (const [idx, d] of sorted.entries()) {
-                if (!Array.isArray(d.embedding)) {
-                    throw new Error(`Unexpected embedding at batch index ${idx}: missing or invalid`);
+            catch (err) {
+                // A caller abort must still propagate — it is not a "this batch
+                // failed" condition, it means stop entirely.
+                if (signal?.aborted)
+                    throw err;
+                const message = err instanceof Error ? err.message : String(err);
+                warnVerbose(`[embed] batch of ${batch.length} document(s) failed and was skipped: ${message}`);
+                for (const idx of textBatch.indices) {
+                    onSkip?.({ index: idx, reason: "batch-request-failed", message });
                 }
-                results.push(l2Normalize(d.embedding));
             }
         }
         return results;
     }
+    /** Send one batch request and return its embeddings in input order. Throws on any failure. */
+    async requestBatch(batch, headers, ollamaOpts, signal) {
+        const body = {
+            input: batch,
+            model: this.model,
+        };
+        if (this.config.dimension) {
+            body.dimensions = this.config.dimension;
+        }
+        if (ollamaOpts) {
+            body.options = ollamaOpts;
+        }
+        // See embed(): `signal` goes through the 4th parameter, not the
+        // RequestInit, or fetchWithTimeout drops it.
+        const response = await fetchWithTimeout(normalizeEmbeddingEndpoint(this.endpoint), {
+            method: "POST",
+            headers,
+            body: JSON.stringify(body),
+        }, 30_000, signal);
+        if (!response.ok) {
+            const respBody = await readBodyWithByteCap(response, undefined, { bodyTimeoutMs: 30_000, signal }).catch((err) => {
+                if (signal?.aborted)
+                    throw err;
+                return "";
+            });
+            throw new Error(`Embedding batch request failed (${response.status}): ${this.safeErrorBody(respBody)}`);
+        }
+        const json = JSON.parse(await readBodyWithByteCap(response, undefined, { bodyTimeoutMs: 30_000, signal }));
+        if (!json.data || json.data.length !== batch.length) {
+            throw new Error(`Unexpected embedding batch response: expected ${batch.length} embeddings, got ${json.data?.length ?? 0}.${embeddingEndpointPathHint(this.endpoint)}`);
+        }
+        // Sort by index to guarantee correct order (OpenAI API doesn't guarantee order)
+        const sorted = [...json.data].sort((a, b) => a.index - b.index);
+        const results = [];
+        for (const [idx, d] of sorted.entries()) {
+            if (!Array.isArray(d.embedding)) {
+                throw new Error(`Unexpected embedding at batch index ${idx}: missing or invalid`);
+            }
+            results.push(l2Normalize(d.embedding));
+        }
+        return results;
+    }
     buildHeaders() {
         const headers = { "Content-Type": "application/json" };
         const resolvedKey = resolveSecret(this.config.apiKey);
@@ -125,10 +226,8 @@ export class RemoteEmbedder {
      * hardening llm/client.ts applies on the identical path: pattern-redact
      * credential shapes, exact-scrub this connection's own key, and clip.
      *
-     * These messages are durable — generateEmbeddingsForDb surfaces them as
-     * `embeddingResult.message`, which is written to semantic-status.json and
-     * replayed by `akm info` (including `--json`) until the next successful
-     * index, and printed on every vector-search attempt. Raw bodies reached that
+     * These messages surface via generateEmbeddingsForDb's `EmbeddingGenerationResult.message`
+     * and are printed on every vector-search attempt. Raw bodies reached that
      * far unredacted and uncapped, at readBodyWithByteCap's 10 MB default.
      */
     safeErrorBody(body) {

package/dist/registry/network.js

@@ -2,6 +2,7 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import { isIP } from "node:net";
+import { backoffDelay, computeRetryDelay, abortableDelay as sharedAbortableDelay, shouldRetry } from "../core/common.js";
 import { bareHostname, classifyNetworkAddress, classifyNetworkHostname, resolveHostnameAddresses, } from "../core/network-policy.js";
 import { assertRegistryPinnedTransportAvailable, requestRegistryAddressPinned, } from "./pinned-transport.js";
 export { requestRegistryAddressPinned } from "./pinned-transport.js";
@@ -77,7 +78,7 @@ async function requestRegistryHop(url, init, options) {
             }
             const response = await transport(url, address, init, remainingMs);
             if (attempt < maxRetries && shouldRetry(response.status)) {
-                const delay = retryDelay(response, attempt);
+                const delay = computeRetryDelay(response, attempt, { maxDelayMs: MAX_REGISTRY_RETRY_DELAY_MS });
                 await cancelRegistryResponse(response);
                 await abortableDelay(delay, init?.signal);
                 continue;
@@ -87,7 +88,7 @@ async function requestRegistryHop(url, init, options) {
         catch (error) {
             if (attempt >= maxRetries || init?.signal?.aborted)
                 throw error;
-            await abortableDelay(backoffDelay(attempt), init?.signal);
+            await abortableDelay(backoffDelay(attempt, undefined, MAX_REGISTRY_RETRY_DELAY_MS), init?.signal);
         }
     }
     throw new Error("Registry retry loop is unreachable");
@@ -217,45 +218,12 @@ function isRedirect(status) {
 export async function cancelRegistryResponse(response) {
     await response.body?.cancel().catch(() => undefined);
 }
-function shouldRetry(status) {
-    return status === 429 || status >= 500;
-}
-function retryDelay(response, attempt) {
-    const retryAfter = response.headers.get("retry-after");
-    if (retryAfter) {
-        const seconds = Number(retryAfter);
-        if (Number.isFinite(seconds)) {
-            return seconds >= 0 ? Math.min(MAX_REGISTRY_RETRY_DELAY_MS, seconds * 1_000) : backoffDelay(attempt);
-        }
-        const date = Date.parse(retryAfter);
-        if (Number.isFinite(date))
-            return Math.min(MAX_REGISTRY_RETRY_DELAY_MS, Math.max(0, date - Date.now()));
-    }
-    return backoffDelay(attempt);
-}
-function backoffDelay(attempt) {
-    return Math.min(MAX_REGISTRY_RETRY_DELAY_MS, 500 * 2 ** attempt * (0.5 + Math.random() * 0.5));
-}
 /** Test-only visibility for the server-controlled Retry-After clamp. */
 export function _registryRetryDelayForTests(response, attempt) {
-    return retryDelay(response, attempt);
+    return computeRetryDelay(response, attempt, { maxDelayMs: MAX_REGISTRY_RETRY_DELAY_MS });
 }
 function abortableDelay(ms, signal) {
-    if (!signal)
-        return new Promise((resolve) => setTimeout(resolve, ms));
-    if (signal.aborted)
-        return Promise.reject(signal.reason ?? new Error("Registry request aborted"));
-    return new Promise((resolve, reject) => {
-        const timer = setTimeout(() => {
-            signal.removeEventListener("abort", onAbort);
-            resolve();
-        }, ms);
-        const onAbort = () => {
-            clearTimeout(timer);
-            reject(signal.reason ?? new Error("Registry request aborted"));
-        };
-        signal.addEventListener("abort", onAbort, { once: true });
-    });
+    return sharedAbortableDelay(ms, signal, "Registry request aborted");
 }
 /** Existing local HTTP fixtures remain available only inside the test process. */
 export function allowPrivateRegistryFixtureForTests(rawUrl) {

package/dist/runtime.js

@@ -135,18 +135,10 @@ function stdioFor(mode) {
     return mode ?? "pipe";
 }
 // ── Stdin ───────────────────────────────────────────────────────────────────
-/**
- * Read all of stdin as a single `Buffer`, enforcing a byte limit. When more
- * than `limitBytes` is read, `onLimitExceeded()` is invoked and its return (an
- * Error) is thrown — callers supply their own message so behaviour is exact.
- */
-export async function readStdin(limitBytes, onLimitExceeded) {
+/** Read all of stdin as a single `Buffer`. */
+export async function readStdin() {
     const chunks = [];
-    let total = 0;
     for await (const chunk of stdinIterator()) {
-        total += chunk.byteLength;
-        if (total > limitBytes)
-            throw onLimitExceeded();
         chunks.push(chunk);
     }
     return Buffer.concat(chunks);