akm-cli 0.9.6 → 0.9.8-beta.1

package/dist/llm/memory-infer.js

@@ -22,8 +22,6 @@ import { toErrorMessage } from "../core/common.js";
 import { parseEmbeddedJsonResponse } from "../core/parse.js";
 import { warn } from "../core/warn.js";
 import { callStructured } from "./structured-call.js";
-/** Hard cap on body chars sent to the model — pragmatic and matches `runLlmEnrich`. */
-const MAX_BODY_CHARS = 4000;
 const SYSTEM_PROMPT = memoryInferSystemPrompt;
 const USER_PROMPT_PREFIX = memoryInferUserPrompt;
 const PROMPT_PLACEHOLDERS = new Set([
@@ -74,7 +72,7 @@ export async function compressMemoryToDerivedMemory(llmRunner, body, signal, akm
     const trimmedBody = body.trim();
     if (!trimmedBody)
         return undefined;
-    const userPrompt = `${USER_PROMPT_PREFIX}${trimmedBody.slice(0, MAX_BODY_CHARS)}`;
+    const userPrompt = `${USER_PROMPT_PREFIX}${trimmedBody}`;
     // Memory inference is always gated: no config closes the gate instead of
     // taking callStructured's ungated path for direct callers.
     if (!akmConfig) {

package/dist/llm/usage-telemetry.js

@@ -25,6 +25,7 @@
  * `undefined` outside any `withLlmStage` scope.
  */
 import { AsyncLocalStorage } from "node:async_hooks";
+import { asNonEmptyString } from "../core/common.js";
 const attributionStorage = new AsyncLocalStorage();
 let usageSink;
 /**
@@ -85,9 +86,6 @@ export function emitLlmUsage(record) {
 function asFiniteNonNegative(value) {
     return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : undefined;
 }
-function asNonEmptyString(value) {
-    return typeof value === "string" && value.length > 0 ? value : undefined;
-}
 function asLlmUsageErrorCode(value) {
     switch (value) {
         case "rate_limited":

package/dist/registry/create-provider-registry.js

@@ -17,6 +17,10 @@ export function createProviderRegistry() {
         resolve(type) {
             return map.get(type) ?? null;
         },
+        /** Removes a registration. No-op if `type` was never registered. */
+        unregister(type) {
+            map.delete(type);
+        },
         /** Snapshot of all registered keys. Iteration order matches insertion order. */
         list() {
             return [...map.keys()];

package/dist/registry/factory.js

@@ -24,3 +24,7 @@ export function registerRegistryProvider(type, factory) {
 export function resolveRegistryProviderFactory(type) {
     return registry.resolve(type);
 }
+/** Test-only seam: removes a registration made with {@link registerRegistryProvider}. */
+export function unregisterRegistryProvider(type) {
+    registry.unregister(type);
+}

package/dist/registry/resolve.js

@@ -298,14 +298,18 @@ export function trustedNpmTarballHosts() {
     const hosts = new Set([DEFAULT_NPM_REGISTRY_HOST]);
     const override = process.env.AKM_NPM_REGISTRY?.trim();
     if (override) {
+        // A malformed override must not be silently ignored (falling back to the
+        // public registry as though nothing was configured) — that would install
+        // from the wrong registry without telling the operator (R-035).
+        let overrideHost;
         try {
-            const overrideHost = new URL(override).hostname.toLowerCase();
-            if (overrideHost)
-                hosts.add(overrideHost);
+            overrideHost = new URL(override).hostname.toLowerCase();
         }
         catch {
-            // Ignore unparseable overrides; the default host still applies.
+            throw new UsageError(`AKM_NPM_REGISTRY is set to an invalid URL: ${override}`);
         }
+        if (overrideHost)
+            hosts.add(overrideHost);
     }
     return hosts;
 }
@@ -358,14 +362,18 @@ export function npmArtifactNetworkPolicy(artifact) {
 function npmMetadataRegistry() {
     const override = process.env.AKM_NPM_REGISTRY?.trim();
     if (override) {
+        // A malformed override must not be silently ignored (falling back to the
+        // public registry as though nothing was configured) — that would install
+        // from the wrong registry without telling the operator (R-035).
+        let url;
         try {
-            const url = new URL(override);
-            const base = `${url.origin}${url.pathname === "/" ? "" : url.pathname}`;
-            return { baseUrl: base.replace(/\/+$/, ""), allowPrivateRegistryOrigin: true };
+            url = new URL(override);
         }
         catch {
-            // Ignore unparseable overrides; fall back to the public registry.
+            throw new UsageError(`AKM_NPM_REGISTRY is set to an invalid URL: ${override}`);
         }
+        const base = `${url.origin}${url.pathname === "/" ? "" : url.pathname}`;
+        return { baseUrl: base.replace(/\/+$/, ""), allowPrivateRegistryOrigin: true };
     }
     return { baseUrl: `https://${DEFAULT_NPM_REGISTRY_HOST}`, allowPrivateRegistryOrigin: false };
 }
@@ -490,6 +498,13 @@ function resolveGitRevisionFromRemote(url, requestedRef) {
 }
 async function resolveGitArtifact(parsed) {
     const resolvedRevision = resolveGitRevisionFromRemote(parsed.url, parsed.requestedRef);
+    if (!resolvedRevision) {
+        // Unlike the GitHub path (which falls back to the REST API on a failed
+        // `git ls-remote`), a plain git source has no fallback resolver — an
+        // unresolved revision here would silently disable the post-clone
+        // revision-integrity check in `verifyClonedRevision` (R-011).
+        throw new Error(`Unable to resolve ${parsed.requestedRef ?? "HEAD"} for ${parsed.url} via 'git ls-remote'; refusing to install without a verifiable revision.`);
+    }
     return {
         id: parsed.id,
         source: parsed.source,

package/dist/runtime.js

@@ -250,18 +250,6 @@ export function semverOrder(a, b) {
     const semver = nodeRequire("semver");
     return semver.compare(a, b);
 }
-// ── Module resolution ───────────────────────────────────────────────────────
-/**
- * Resolve a module specifier without loading it, relative to `from`. On Bun
- * uses `Bun.resolveSync`; on Node uses `require.resolve`. Throws when the
- * specifier cannot be resolved (mirroring both underlying APIs).
- */
-export function resolveModule(spec, from) {
-    if (isBun) {
-        return bunGlobal().resolveSync(spec, from);
-    }
-    return nodeRequire.resolve(spec, { paths: [from] });
-}
 // ── Filesystem paths ────────────────────────────────────────────────────────
 /**
  * The directory of the module identified by `importMetaUrl`. Replaces