@alucard_24/pi-codeindex 1.0.0 → 1.1.0

package/src/extension.js

@@ -10,7 +10,7 @@ import { Type } from '@earendil-works/pi-ai';
 import fs from 'node:fs';
 import path from 'node:path';
 import { indexRepo } from './indexer.js';
-import { embeddingStatus } from './embed.js';
+import { embeddingStatus, serviceCommand, getServiceStatus, formatServiceStatus } from './embed.js';
 import { formatProfile } from './backend.js';
 import { configCommand } from './config.js';
 import { configure } from './config-ui.js';
@@ -19,7 +19,8 @@ import { loadIndex } from './store.js';
 import { invalidateSearcher, loadSearcher, search } from './search.js';
 import { buildBundle, buildGraph } from './graph.js';
 import { createDebouncedQueue, filterDirty, parsePorcelainStatus } from './sync.js';
-import { fmtBytes, git, headCommit, repoRoot } from './util.js';
+import { fmtBytes, git, headCommit } from './util.js';
+import { resolveWorkspace } from './workspace.js';
 import { formatBundle, formatHits, outlineText, promptLine, shouldAnnotateRead, statusLine, toRepoRel } from './present.js';
 
 const STATUS_KEY = 'codeindex';
@@ -30,7 +31,7 @@ const CONFIG_ENTRY = 'codeindex-config';
 const DEBOUNCE_MS = 800;
 const MAX_SWEEP_PATHS = 200;
 
-let state = null; // { repo, enabled, indexing, progress, index, error, abort, queue, watcher, rerun }
+let state = null; // { repo, mode, enabled, indexing, progress, index, error, abort, queue, watcher, rerun }
 const running = new Map(); // repo -> promise (single-flight per repo)
 
 function readEnabled(ctx) {
@@ -65,11 +66,13 @@ function showStatus(ctx) {
 
 /** Legge solo i metadati (per l'outline e la riga di stato): niente vettori. */
 async function refreshMeta() {
+  const st = state;
+  if (!st) return;
   try {
-    const { index } = await loadIndex(state.repo);
-    state.index = index;
+    const { index } = await loadIndex(st.repo);
+    if (state === st) st.index = index;
   } catch {
-    state.index = null;
+    if (state === st) st.index = null;
   }
 }
 
@@ -111,9 +114,10 @@ function runIndex(ctx, { force = false } = {}) {
       });
       st.index = r.index;
       const runtime = embeddingStatus();
-      if (state === st && st.enabled && !st.backendWarning && runtime.attempts.some((a) => !a.ok)) {
+      const warnings = [...runtime.warnings, ...runtime.attempts.filter((a) => !a.ok).map((a) => `${a.device}: ${a.error}`)];
+      if (state === st && st.enabled && !st.backendWarning && warnings.length) {
         st.backendWarning = true;
-        ctx.ui.notify(`codeindex: selezionato ${formatProfile(runtime.profile)}; tentativi falliti: ${runtime.attempts.filter((a) => !a.ok).map((a) => `${a.device}: ${a.error}`).join('; ')}`, 'warning');
+        ctx.ui.notify(`codeindex: selezionato ${formatProfile(runtime.profile)}; ${warnings.join('; ')}`, 'warning');
       }
       st.graph = null; // il grafo è derivato dall'indice: va ricostruito
       invalidateSearcher(repo);
@@ -167,16 +171,22 @@ function stopBackground() {
 }
 
 /** Path toccati da watcher/hook: passa dal debounce e poi riconcilia. */
-function markDirty(paths) {
+function markDirty(paths, options) {
   if (!state?.queue) return;
-  const rel = filterDirty(paths, state.repo);
+  const rel = filterDirty(paths, state.repo, options);
   if (rel.size === 0) return;
   state.queue.add(rel);
 }
 
-/** `git status --porcelain -z` dopo un bash: cattura le modifiche indirette. */
-function sweepGitStatus() {
+/** Dopo bash: status Git, oppure riconciliazione incrementale senza Git. */
+function sweepChanges() {
   if (!state?.enabled || !state.repo) return;
+  if (state.mode === 'folder') {
+    // Non possiamo dedurre i path dal comando. La coda coalesca le richieste
+    // e indexRepo riusa i vettori invariati, anche senza watcher disponibile.
+    state.queue?.add(['.']);
+    return;
+  }
   // Costa ~50–100 ms su un repo grande: il watcher è il segnale primario, questo
   // è la rete di sicurezza. Un giro ogni 1,5 s basta.
   const now = Date.now();
@@ -190,9 +200,20 @@ function sweepGitStatus() {
 
 /** Watcher ricorsivo; se il sistema non lo consente si degrada senza watcher. */
 function startWatcher(ctx) {
+  const st = state;
+  if (!st?.enabled) return;
   try {
-    const watcher = fs.watch(state.repo, { recursive: true }, (_event, filename) => {
-      if (filename) markDirty([String(filename)]);
+    const watcher = fs.watch(st.repo, { recursive: true }, (event, filename) => {
+      if (state !== st || !st.enabled) return;
+      if (!filename) {
+        if (st.mode === 'folder') st.queue?.add(['.']);
+        return;
+      }
+      // Un rename può essere una directory intera: senza Git non esiste uno
+      // status successivo che recuperi i file aggiunti, spostati o cancellati.
+      markDirty([String(filename)], {
+        includeDirectories: st.mode === 'folder' && event === 'rename',
+      });
     });
     watcher.on('error', () => {
       try {
@@ -200,12 +221,12 @@ function startWatcher(ctx) {
       } catch {
         /* già chiuso */
       }
-      if (state) state.watcher = null;
+      if (st.watcher === watcher) st.watcher = null;
     });
-    state.watcher = watcher;
+    st.watcher = watcher;
   } catch (e) {
-    state.watcher = null;
-    ctx.ui.notify(`codeindex: watcher non disponibile (${e.message})`, 'warning');
+    st.watcher = null;
+    if (state === st) ctx.ui.notify(`codeindex: watcher non disponibile (${e.message})`, 'warning');
   }
 }
 
@@ -248,7 +269,7 @@ const searchCode = defineTool({
     })),
   }),
   async execute(_toolCallId, params, signal, _onUpdate, ctx) {
-    if (!state?.repo) return unavailable('la directory corrente non è un repository git');
+    if (!state?.repo) return unavailable('nessuna cartella di progetto attiva');
     if (!state.enabled) return unavailable('indice disattivato (/codeindex enable per riattivarlo)');
 
     const k = Math.min(MAX_K, Math.max(1, Math.round(params.k ?? DEFAULT_K)));
@@ -312,23 +333,24 @@ async function annotateRead(event, ctx) {
 }
 
 function statusReport() {
-  if (!state) return 'codeindex: nessun repository git nella directory corrente';
+  if (!state) return 'codeindex: nessuna cartella di progetto attiva';
   const i = state.index;
   const lines = [
     `repo        : ${state.repo}`,
+    `modalità    : ${state.mode === 'git' ? 'repository Git' : 'cartella (senza Git)'}`,
     `stato       : ${state.enabled ? 'attivo' : 'disattivato'}${state.indexing ? ' · indicizzazione in corso' : ''}`,
   ];
   if (state.progress) lines.push(`progresso   : ${state.progress.done}/${state.progress.total} chunk`);
   if (i) {
     lines.push(`file        : ${i.stats?.files ?? '?'} (${fmtBytes(i.stats?.bytes ?? 0)})`);
     lines.push(`chunk       : ${i.chunks.length} · ${i.dims}d · ${i.model} (${i.dtype})`);
-    lines.push(`head        : ${i.head ?? '?'}`);
+    if (state.mode === 'git') lines.push(`head        : ${i.head ?? '?'}`);
     lines.push(`aggiornato  : ${i.updatedAt}`);
   } else {
     lines.push('indice      : assente (usa /codeindex reindex)');
   }
   const runtime = embeddingStatus();
-  lines.push(`runtime     : ${runtime.profile ? formatProfile(runtime.profile) : 'non caricato'}`);
+  lines.push(`profilo client: ${runtime.profile ? formatProfile(runtime.profile) : 'non ancora associato al servizio'}`);
   if (i?.device) lines.push(`profilo indice: ${formatProfile(i)}`);
   if (state.error) lines.push(`ultimo errore: ${state.error}`);
   return lines.join('\n');
@@ -338,7 +360,7 @@ export default function codeindexExtension(pi) {
   pi.registerTool(searchCode);
 
   pi.registerCommand('codeindex', {
-    description: 'Indice e embedding locali (status|reindex|enable|disable|config|configure|doctor)',
+    description: 'Indice e embedding locali (status|reindex|enable|disable|config|configure|doctor|service)',
     handler: async (args, ctx) => {
       const [sub = 'status', ...rest] = (args ?? '').trim().split(/\s+/).filter(Boolean);
       // Configurazione/diagnostica funzionano anche fuori da git o con indice spento.
@@ -352,9 +374,13 @@ export default function codeindexExtension(pi) {
           if (result) ctx.ui.notify(result, 'info');
           return;
         }
+        if (sub === 'service') {
+          ctx.ui.notify(await serviceCommand(rest), 'info');
+          return;
+        }
         if (sub === 'doctor') {
           const options = parseDoctorArgs(rest);
-          if (options.probe) ctx.ui.notify('codeindex: prova isolata del modello (può scaricare i pesi, timeout 120 s per backend)…', 'info');
+          if (options.probe) ctx.ui.notify('codeindex: prova isolata del modello (può caricare una copia aggiuntiva, scaricare pesi; timeout 120 s per backend)…', 'info');
           const report = await doctor(options);
           ctx.ui.notify(options.json ? JSON.stringify(report) : formatDoctor(report), report.ok ? 'info' : 'warning');
           return;
@@ -364,7 +390,7 @@ export default function codeindexExtension(pi) {
         return;
       }
       if (!state) {
-        ctx.ui.notify('codeindex: nessun repository git nella directory corrente', 'warning');
+        ctx.ui.notify('codeindex: nessuna cartella di progetto attiva', 'warning');
         return;
       }
       if (sub === 'status') {
@@ -372,7 +398,10 @@ export default function codeindexExtension(pi) {
         // abbia finito: meglio aspettare che mentire ("indice assente").
         if (!state.index) await refreshMeta();
         showStatus(ctx);
-        ctx.ui.notify(statusReport(), 'info');
+        let service;
+        try { service = formatServiceStatus(await getServiceStatus()); }
+        catch (e) { service = `servizio condiviso: ${e.message}`; }
+        ctx.ui.notify(`${statusReport()}\n${service}`, 'info');
         return;
       }
       if (sub === 'reindex') {
@@ -405,21 +434,19 @@ export default function codeindexExtension(pi) {
         ctx.ui.notify(`codeindex: ${state.enabled ? 'attivo' : 'disattivato'}`, 'info');
         return;
       }
-      ctx.ui.notify('uso: /codeindex status|reindex [--force]|enable|disable|config [show|set CHIAVE VALORE|unset CHIAVE]|configure|doctor [--probe] [--all] [--device DEVICE] [--webgpu-backend auto|vulkan]', 'warning');
+      ctx.ui.notify('uso: /codeindex status|reindex [--force]|enable|disable|config [show|set CHIAVE VALORE|unset CHIAVE]|configure|service [status [--json]|stop]|doctor [--probe] [--all] [--device DEVICE] [--webgpu-backend auto|vulkan]', 'warning');
     },
   });
 
   // Risorse di sessione: watcher e timer non vanno creati nel factory.
   pi.on('session_start', async (_event, ctx) => {
-    const repo = repoRoot(ctx.cwd);
-    if (!repo) {
-      state = null;
-      ctx.ui.setStatus(STATUS_KEY, undefined);
-      return;
-    }
+    const workspace = resolveWorkspace(ctx.cwd);
     const st = {
-      repo,
-      enabled: readEnabled(ctx),
+      repo: workspace.root,
+      mode: workspace.mode,
+      // Le cartelle protette richiedono consenso a ogni nuova sessione,
+      // anche se un enable era stato salvato nel branch in un altro progetto.
+      enabled: workspace.autoIndex && readEnabled(ctx),
       indexing: false,
       progress: null,
       index: null,
@@ -435,6 +462,9 @@ export default function codeindexExtension(pi) {
     }, { delayMs: DEBOUNCE_MS });
     state = st;
     showStatus(ctx);
+    if (!workspace.autoIndex && !st.enabled) {
+      ctx.ui.notify('codeindex: indicizzazione automatica disattivata nella home o nella radice del disco; usa una cartella di progetto o /codeindex enable', 'info');
+    }
     // Non bloccare l'avvio: metadati, watcher e indice corrono in background.
     void (async () => {
       await refreshMeta();
@@ -458,9 +488,12 @@ export default function codeindexExtension(pi) {
     showStatus(ctx);
     if (!state?.enabled) return undefined; // spento: nessuna riga nel prompt
     // Un checkout può cambiare HEAD senza eventi utili del watcher.
-    if (!state.indexing && state.index?.head && headCommit(state.repo) !== state.index.head) {
+    if (state.mode === 'git' && !state.indexing && state.index?.head && headCommit(state.repo) !== state.index.head) {
       void runIndex(ctx);
     }
+    // Senza watcher e senza Git, un nuovo prompt recupera anche le modifiche
+    // esterne a pi. Nessun polling o processo aggiuntivo.
+    if (state.mode === 'folder' && !state.watcher) state.queue?.add(['.']);
     const line = promptLine(state?.index?.chunks?.length ?? 0);
     if (!line) return undefined;
     return { systemPrompt: `${event.systemPrompt}\n\n${line}` };
@@ -468,15 +501,19 @@ export default function codeindexExtension(pi) {
 
   // Invalidazione diretta: `write`/`edit` sanno esattamente che path hanno toccato.
   pi.on('tool_result', async (event, ctx) => {
-    if (event.isError || !state?.enabled) return undefined;
+    if (!state?.enabled) return undefined;
     try {
+      // Anche un comando terminato con errore può aver modificato dei file.
+      if (event.toolName === 'bash') {
+        sweepChanges();
+        return undefined;
+      }
+      if (event.isError) return undefined;
       if (event.toolName === 'read') return await annotateRead(event, ctx);
       if (event.toolName === 'write' || event.toolName === 'edit') {
         markDirty([String(event.input?.path ?? '')]);
         return undefined;
       }
-      // Dopo un bash il filesystem può essere cambiato in modo invisibile agli hook.
-      if (event.toolName === 'bash') sweepGitStatus();
     } catch {
       return undefined; // un hook non deve mai rompere un tool
     }

package/src/local-embed.js

@@ -0,0 +1,51 @@
+// Solo nel servizio e nei probe esplicitamente isolati. I client pi non
+// importano Transformers/ORT e non possiedono una pipeline nativa.
+import { createEmbeddingRuntime, nativeBackends, validateEmbeddings, QUERY_PREFIX } from './backend.js';
+import { ensureTextModel } from './model.js';
+
+export function createLocalEmbedder(config) {
+  const runtime = createEmbeddingRuntime({
+    settings: () => ({ config }),
+    inventory: async () => nativeBackends().backends,
+    log: (s) => process.stderr.write(`${s}\n`),
+    initialize: async (profile, settings) => {
+      const sessionOptions = {};
+      if (profile.webgpuBackend === 'vulkan') {
+        const { registerVulkanBackend } = await import('./vulkan.js');
+        sessionOptions.executionProviders = [await registerVulkanBackend()];
+      }
+      const dir = await ensureTextModel(profile, settings);
+      const { pipeline } = await import('@huggingface/transformers');
+      if (settings.cpuThreads) sessionOptions.intraOpNumThreads = settings.cpuThreads;
+      if (profile.device === 'dml') {
+        sessionOptions.executionMode = 'sequential';
+        sessionOptions.enableMemPattern = false;
+      }
+      let pipe;
+      try {
+        pipe = await pipeline('feature-extraction', dir, {
+          dtype: profile.dtype, device: profile.device, local_files_only: true, session_options: sessionOptions,
+        });
+        const out = await pipe([QUERY_PREFIX + 'code retrieval smoke test'], { pooling: 'mean', normalize: true });
+        validateEmbeddings(out.tolist(), 1);
+        return pipe;
+      } catch (e) {
+        try { await pipe?.dispose(); } catch { /* conserva l'errore originale */ }
+        throw e;
+      }
+    },
+  });
+  return {
+    getProfile: async () => (await runtime.get()).profile,
+    info: () => runtime.info(),
+    embed: async (texts, { normalize = true } = {}) => {
+      const { pipe } = await runtime.get();
+      // Non cambiare provider dopo la prima inferenza riuscita.
+      const out = await pipe(texts, { pooling: 'mean', normalize });
+      return validateEmbeddings(out.tolist(), texts.length);
+    },
+    dispose: async () => {
+      if (runtime.info().profile) await (await runtime.get()).pipe.dispose();
+    },
+  };
+}

package/src/probe.js

@@ -1,20 +1,23 @@
 // Entry point interno, eseguito solo da doctor --probe in un processo isolato.
-import { embed, cosine, getEmbeddingProfile, embeddingStatus, getEmbedder } from './embed.js';
+import { cosine } from './embed.js';
+import { loadConfig } from './config.js';
+import { createLocalEmbedder } from './local-embed.js';
 
-let result;
+let result, runtime;
 try {
   const t0 = performance.now();
+  runtime = createLocalEmbedder((await loadConfig()).config);
   const same = 'title: args.ts | text: export function parseArgs(argv) { return argv.slice(2); }';
   const other = 'title: math.py | text: def factorial(n): return 1 if n < 2 else n * factorial(n - 1)';
-  const [a, b, c] = await embed([same, same, other]);
+  const [a, b, c] = await runtime.embed([same, same, other]);
   const cosSame = cosine(a, b);
   const cosOther = cosine(a, c);
   if (cosSame < 0.999 || cosOther > 0.9999) throw new Error(`smoke test discriminazione fallito: stesso=${cosSame}, diverso=${cosOther}`);
-  result = { ok: true, profile: await getEmbeddingProfile(), elapsedMs: Math.round(performance.now() - t0),
-    cosSame, cosOther, attempts: embeddingStatus().attempts };
-  await (await getEmbedder()).dispose();
+  result = { ok: true, profile: await runtime.getProfile(), elapsedMs: Math.round(performance.now() - t0),
+    cosSame, cosOther, attempts: runtime.info().attempts };
+  await runtime.dispose();
 } catch (e) {
-  result = { ok: false, error: String(e.message ?? e), attempts: embeddingStatus().attempts };
+  result = { ok: false, error: String(e.message ?? e), attempts: runtime?.info().attempts ?? [] };
 }
 if (process.send) process.send(result, () => process.exit(result.ok ? 0 : 1));
 else { console.log(JSON.stringify(result)); process.exitCode = result.ok ? 0 : 1; }

package/src/service-client.js

@@ -0,0 +1,126 @@
+// Client leggero: solo JSON e socket loopback. Nessuna pipeline locale.
+import { fork } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { setTimeout as delay } from 'node:timers/promises';
+import { loadConfig } from './config.js';
+import { assertCompatibleIndex, validateEmbeddings } from './backend.js';
+import { serviceAddress, readServiceRecord, rpc, disconnected, serviceError } from './service-protocol.js';
+import { validateServiceConfig, validateTexts } from './service-policy.js';
+
+export function createEmbeddingClient({ env = process.env, settings = () => loadConfig({ env }),
+  workerFile = new URL('./service-worker.js', import.meta.url), startupTimeoutMs = 10_000, requestTimeoutMs = 15 * 60_000 } = {}) {
+  let config = null, configLoading = null, starting = null, pinned = null;
+  let pending = 0, error = null, remote = null;
+  async function getConfig() {
+    if (config) return config;
+    if (!configLoading) configLoading = Promise.resolve().then(settings).then((loaded) => {
+      config = validateServiceConfig(loaded.config);
+      return config;
+    });
+    try { return await configLoading; } finally { configLoading = null; }
+  }
+  async function probe(address) {
+    const record = await readServiceRecord(address);
+    if (!record) return { record: null };
+    try {
+      const response = await rpc(address, record, { op: 'status' }, { timeoutMs: 2000 });
+      return { record, status: response.result };
+    } catch (e) {
+      if (disconnected(e)) return { record: null };
+      if (e.code === 'SERVICE_STOPPING') return { record, status: { running: false } };
+      throw e;
+    }
+  }
+  async function start(address) {
+    if (starting) return starting;
+    starting = (async () => {
+      let launchError, childRunning = false, launches = 0, lastLaunchAt = 0;
+      const launch = () => {
+        launches++; childRunning = true; lastLaunchAt = Date.now();
+        const child = fork(workerFile instanceof URL ? fileURLToPath(workerFile) : workerFile,
+          [address.directory, String(address.port)], { detached: true, execArgv: [], env,
+            stdio: ['ignore', 'ignore', 'ignore', 'ipc'] });
+        child.on('error', (e) => { launchError = e; childRunning = false; });
+        child.on('exit', () => { childRunning = false; });
+        child.on('message', (message) => {
+          if (message?.ready === false && message.code !== 'EADDRINUSE') launchError = serviceError(message.code ?? 'START_FAILED', message.error);
+        });
+        child.unref(); child.channel?.unref();
+      };
+      const deadline = Date.now() + startupTimeoutMs;
+      while (Date.now() < deadline) {
+        if (launchError) throw launchError;
+        const { record, status } = await probe(address);
+        if (record && status.running) return record;
+        // Il vecchio processo tiene la porta durante dispose. Non tentare
+        // un secondo modello mentre quel processo sta ancora liberando VRAM.
+        if (!record && !childRunning && launches < 3 && Date.now() - lastLaunchAt >= 100) launch();
+        await delay(40);
+      }
+      throw serviceError('START_FAILED', `servizio locale non avviabile su 127.0.0.1:${address.port}: porta occupata o avvio fallito. Controlla service status e servicePort. Nessun fallback in-process.`);
+    })();
+    try { return await starting; } finally { starting = null; }
+  }
+  function remember(info) { if (info) remote = { ...info, lastSeenAt: Date.now() }; }
+  async function call(op, payload = {}) {
+    const active = await getConfig();
+    const address = serviceAddress(active);
+    pending++;
+    error = null;
+    try {
+      let record = await readServiceRecord(address);
+      if (!record) record = await start(address);
+      let response;
+      const request = { op, config: active, expectedProfile: pinned, ...payload };
+      try { response = await rpc(address, record, request, { timeoutMs: requestTimeoutMs }); }
+      catch (e) {
+        // Questi errori provano che l'inferenza non è iniziata. Un crash
+        // dopo l'invio non viene ritentato automaticamente.
+        if (!['ECONNREFUSED', 'SERVICE_STOPPING'].includes(e.code)) throw e;
+        record = await start(address);
+        response = await rpc(address, record, request, { timeoutMs: requestTimeoutMs });
+      }
+      remember(response.info);
+      const profile = response.info?.profile;
+      if (!profile) throw serviceError('BAD_FRAME', 'il servizio non ha restituito il profilo del modello');
+      if (pinned) {
+        try { assertCompatibleIndex(pinned, profile); }
+        catch { throw serviceError('PROFILE_CHANGED', 'profilo del servizio cambiato: riavvia pi e verifica/reindicizza; nessun vettore accettato'); }
+      }
+      pinned ??= Object.freeze({ ...profile });
+      return response.result;
+    } catch (e) {
+      remember(e.info);
+      error = e.message;
+      throw e;
+    } finally { pending--; }
+  }
+  return {
+    getProfile: async () => { await call('profile'); return pinned; },
+    embed: async (texts, { normalize = true } = {}) => {
+      if (Array.isArray(texts) && !texts.length) return [];
+      validateTexts(texts, normalize);
+      const rows = await call('embed', { texts, normalize });
+      return validateEmbeddings(rows, texts.length).map((row) => Float32Array.from(row));
+    },
+    info: () => ({ profile: pinned, config, loading: pending > 0, attempts: (remote?.attempts ?? []).map((a) => ({ ...a })),
+      error, shared: true,
+      warnings: pinned?.device === 'cpu' && config && !['auto', 'cpu'].includes(config.device)
+        ? [`fallback CPU esplicitamente consentito: richiesto ${config.device}, riutilizzato il servizio ${pinned.device}/${pinned.dtype}`] : [],
+      service: remote ? { pid: remote.pid, lastSeenAt: remote.lastSeenAt } : null }),
+    status: async () => {
+      const address = serviceAddress(await getConfig());
+      const record = await readServiceRecord(address);
+      if (!record) return { running: false, shared: true, port: address.port };
+      try { return (await rpc(address, record, { op: 'status' }, { timeoutMs: 2000 })).result; }
+      catch (e) { if (disconnected(e)) return { running: false, shared: true, port: address.port }; throw e; }
+    },
+    stop: async () => {
+      const address = serviceAddress(await getConfig());
+      const record = await readServiceRecord(address);
+      if (!record) return { stopping: false };
+      try { return (await rpc(address, record, { op: 'stop' }, { timeoutMs: 5000 })).result; }
+      catch (e) { if (disconnected(e)) return { stopping: false }; throw e; }
+    },
+  };
+}

package/src/service-policy.js

@@ -0,0 +1,33 @@
+import path from 'node:path';
+import { ENV_KEYS, validateConfig } from './config.js';
+import { assertCompatibleIndex, backendPlan, formatProfile, webgpuBackendOf } from './backend.js';
+import { MAX_TEXTS, MAX_TEXT_BYTES, serviceError } from './service-protocol.js';
+
+export function validateServiceConfig(config) {
+  validateConfig(config, 'client del servizio');
+  if (Object.keys(ENV_KEYS).some((key) => !Object.hasOwn(config, key))) throw serviceError('BAD_CONFIG', 'configurazione client incompleta');
+  if (!path.isAbsolute(config.cacheDir) || !path.isAbsolute(config.serviceDir)) throw serviceError('BAD_CONFIG', 'cacheDir e serviceDir devono essere assoluti');
+  return Object.freeze({ ...config });
+}
+
+export function assertServiceCompatible(config, activeConfig, profile, expectedProfile) {
+  const permitted = backendPlan(config, [{ device: profile.device, available: true }]).some((p) =>
+    p.device === profile.device && p.dtype === profile.dtype &&
+    (p.device !== 'webgpu' || config.webgpuBackend === webgpuBackendOf(profile)));
+  const differs = ['cacheDir', 'cpuThreads', 'serviceIdleMs'].filter((key) => config[key] !== activeConfig[key]);
+  if (!permitted || differs.length) {
+    throw serviceError('PROFILE_CONFLICT', `servizio condiviso già configurato per ${formatProfile(profile)}${differs.length ? `; impostazioni diverse: ${differs.join(', ')}` : ''}. Nessun secondo modello avviato. Usa /codeindex service status; per cambiare profilo, service stop quando inattivo e riavvia pi.`);
+  }
+  if (expectedProfile) {
+    try { assertCompatibleIndex(expectedProfile, profile); }
+    catch { throw serviceError('PROFILE_CHANGED', `profilo del servizio cambiato dopo una riconnessione: ${formatProfile(profile)}. Riavvia pi e verifica/reindicizza; nessun vettore è stato accettato.`); }
+  }
+}
+
+export function validateTexts(texts, normalize) {
+  if (!Array.isArray(texts) || !texts.length || texts.length > MAX_TEXTS || texts.some((t) => typeof t !== 'string')) {
+    throw serviceError('BAD_TEXTS', `embedding: attesi da 1 a ${MAX_TEXTS} testi`);
+  }
+  if (typeof normalize !== 'boolean') throw serviceError('BAD_TEXTS', 'normalize deve essere booleano');
+  if (texts.reduce((n, t) => n + Buffer.byteLength(t), 0) > MAX_TEXT_BYTES) throw serviceError('BAD_TEXTS', `batch di embedding troppo grande (massimo ${MAX_TEXT_BYTES} byte)`);
+}

package/src/service-protocol.js

@@ -0,0 +1,122 @@
+// IPC locale autenticato. Nessun provider o modello viene importato qui.
+import fs from 'node:fs/promises';
+import net from 'node:net';
+import path from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+
+export const PROTOCOL = 1;
+export const HOST = '127.0.0.1';
+export const MAX_FRAME = 8 * 1024 * 1024;
+export const MAX_TEXT_BYTES = 2 * 1024 * 1024;
+export const MAX_TEXTS = 128;
+
+export function serviceError(code, message) {
+  return Object.assign(new Error(message), { code });
+}
+
+export function serviceAddress(config) {
+  const directory = path.resolve(config.serviceDir);
+  const identity = process.platform === 'win32' ? directory.toLowerCase() : directory;
+  const port = config.servicePort || 49152 + createHash('sha256').update(identity).digest().readUInt16BE(0) % 16384;
+  return { directory, host: HOST, port, file: path.join(directory, 'service.json') };
+}
+
+function checkPrivate(stat, target, directory = false) {
+  if (stat.isSymbolicLink() || (directory ? !stat.isDirectory() : !stat.isFile())) {
+    throw serviceError('UNSAFE_SERVICE_PATH', `percorso del servizio non sicuro: ${target}`);
+  }
+  if (process.platform !== 'win32' && (stat.uid !== process.getuid() || (stat.mode & 0o077))) {
+    throw serviceError('UNSAFE_SERVICE_PATH', `il servizio richiede proprietà utente e permessi privati (0700 directory, 0600 file): ${target}`);
+  }
+}
+
+export async function prepareServiceDirectory(address) {
+  await fs.mkdir(address.directory, { recursive: true, mode: 0o700 });
+  checkPrivate(await fs.lstat(address.directory), address.directory, true);
+}
+
+// Status è read-only: non crea directory/file e non avvia il servizio.
+export async function readServiceRecord(address) {
+  try {
+    checkPrivate(await fs.lstat(address.directory), address.directory, true);
+    const stat = await fs.lstat(address.file);
+    checkPrivate(stat, address.file);
+    if (stat.size > 4096) throw serviceError('BAD_SERVICE_RECORD', 'record del servizio troppo grande');
+    const record = JSON.parse(await fs.readFile(address.file, 'utf8'));
+    if (record.port !== address.port || !Number.isInteger(record.pid) || record.pid < 1 ||
+        typeof record.token !== 'string' || !/^[a-f0-9]{64}$/.test(record.token)) {
+      throw serviceError('BAD_SERVICE_RECORD', 'record del servizio locale non valido');
+    }
+    if (record.protocol !== PROTOCOL) throw serviceError('PROTOCOL_MISMATCH', 'servizio locale di versione incompatibile: arrestalo prima di riavviare pi');
+    return record;
+  } catch (e) {
+    if (e.code === 'ENOENT') return null;
+    throw e;
+  }
+}
+
+export async function writeServiceRecord(address, record) {
+  const tmp = `${address.file}.${randomUUID()}.tmp`;
+  try {
+    await fs.writeFile(tmp, JSON.stringify(record) + '\n', { flag: 'wx', mode: 0o600 });
+    await fs.rename(tmp, address.file);
+  } finally { await fs.rm(tmp, { force: true }); }
+}
+
+export function readFrame(socket, { timeoutMs = 30_000 } = {}) {
+  return new Promise((resolve, reject) => {
+    let size = 0;
+    const chunks = [];
+    const finish = (error, value) => {
+      clearTimeout(timer);
+      socket.off('data', data); socket.off('end', end); socket.off('close', end); socket.off('error', fail);
+      if (error) reject(error); else resolve(value);
+    };
+    const fail = (e) => finish(e);
+    const end = () => fail(serviceError('SERVICE_DISCONNECTED', 'servizio locale disconnesso; nessun fallback in-process'));
+    const data = (chunk) => {
+      size += chunk.length;
+      if (size > MAX_FRAME) return fail(serviceError('FRAME_TOO_LARGE', 'messaggio del servizio troppo grande'));
+      chunks.push(chunk);
+      const newline = chunk.indexOf(10);
+      if (newline < 0) return;
+      try {
+        const buffer = Buffer.concat(chunks);
+        const at = buffer.indexOf(10);
+        if (buffer.subarray(at + 1).toString().trim()) throw new Error('attesa una sola richiesta per connessione');
+        finish(null, JSON.parse(buffer.subarray(0, at).toString('utf8')));
+      } catch (e) { fail(serviceError('BAD_FRAME', `messaggio del servizio non valido: ${e.message}`)); }
+    };
+    const timer = setTimeout(() => fail(serviceError('SERVICE_TIMEOUT', 'timeout del servizio locale')), timeoutMs);
+    socket.on('data', data); socket.once('end', end); socket.once('close', end); socket.once('error', fail);
+  });
+}
+
+export function writeFrame(socket, value) {
+  const frame = JSON.stringify(value) + '\n';
+  if (Buffer.byteLength(frame) > MAX_FRAME) throw serviceError('FRAME_TOO_LARGE', 'messaggio del servizio troppo grande');
+  socket.write(frame);
+}
+
+export async function rpc(address, record, request, { timeoutMs = 15 * 60_000, connectTimeoutMs = 1000 } = {}) {
+  const socket = net.createConnection({ host: HOST, port: address.port });
+  socket.on('error', () => {});
+  try {
+    await new Promise((resolve, reject) => {
+      const timer = setTimeout(() => { socket.destroy(); reject(serviceError('CONNECT_TIMEOUT', 'timeout connessione al servizio locale')); }, connectTimeoutMs);
+      socket.once('connect', () => { clearTimeout(timer); resolve(); });
+      socket.once('error', (e) => { clearTimeout(timer); reject(e); });
+    });
+    const response = readFrame(socket, { timeoutMs });
+    try { writeFrame(socket, { protocol: PROTOCOL, token: record.token, ...request }); }
+    catch (e) { socket.destroy(); await response.catch(() => {}); throw e; }
+    const message = await response;
+    if (!message || message.protocol !== PROTOCOL || typeof message.ok !== 'boolean') throw serviceError('BAD_FRAME', 'risposta del servizio non valida');
+    if (!message.ok) throw Object.assign(serviceError(message.code ?? 'SERVICE_ERROR', message.error ?? 'errore del servizio locale'), { info: message.info });
+    return message;
+  } finally { socket.destroy(); }
+}
+
+export function disconnected(error) {
+  return ['ECONNREFUSED', 'ECONNRESET', 'EPIPE', 'CONNECT_TIMEOUT', 'SERVICE_DISCONNECTED'].includes(error.code);
+}

package/src/service-worker.js

@@ -0,0 +1,3 @@
+// Worker autonomo: non deve mai importare il client embed.js.
+import { runServiceWorker } from './service.js';
+await runServiceWorker();