@bendyline/gezel-inference 1.0.1 → 1.0.3

package/dist/engines/native-manifest.d.ts

@@ -40,12 +40,12 @@
  * but logs that it could not anchor to a baked-in digest.
  */
 /** Native release version this build pins. Placeholder until first public release. */
-export declare const NATIVE_ENGINE_RELEASE = "0.1.49";
+export declare const NATIVE_ENGINE_RELEASE = "0.1.52";
 /** sha256 of the pinned release's `SHA256SUMS` asset. All-zeros = unpinned. */
-export declare const SHA256SUMS_DIGEST = "51e9d1fcd18174967fed451d11a7401035076330dfedadd6a0ce396ab636cff7";
-/** Exact SHA256 values for every engine archive published by native-v0.1.49. */
+export declare const SHA256SUMS_DIGEST = "1a2183ad785671be0f78a0f25816f7c802ce668ebe4fa58d640d336ebcbd7023";
+/** Exact SHA256 values for every engine archive published by native-v0.1.52. */
 export declare const NATIVE_ENGINE_ARCHIVE_SHA256: Readonly<Record<string, string>>;
-/** Download size in bytes of every engine archive published by native-v0.1.49. */
+/** Download size in bytes of every engine archive published by native-v0.1.52. */
 export declare const NATIVE_ENGINE_ARCHIVE_BYTES: Readonly<Record<string, number>>;
 /**
  * True only when the pinned release's standalone macOS archives were

package/dist/engines/native-manifest.js

@@ -40,45 +40,47 @@
  * but logs that it could not anchor to a baked-in digest.
  */
 /** Native release version this build pins. Placeholder until first public release. */
-export const NATIVE_ENGINE_RELEASE = '0.1.49';
+export const NATIVE_ENGINE_RELEASE = '0.1.52';
 /** sha256 of the pinned release's `SHA256SUMS` asset. All-zeros = unpinned. */
-export const SHA256SUMS_DIGEST = '51e9d1fcd18174967fed451d11a7401035076330dfedadd6a0ce396ab636cff7';
+export const SHA256SUMS_DIGEST = '1a2183ad785671be0f78a0f25816f7c802ce668ebe4fa58d640d336ebcbd7023';
 // BEGIN PINNED NATIVE ARCHIVE HASHES
-/** Exact SHA256 values for every engine archive published by native-v0.1.49. */
+/** Exact SHA256 values for every engine archive published by native-v0.1.52. */
 export const NATIVE_ENGINE_ARCHIVE_SHA256 = Object.freeze({
-    'gezel-native-0.1.49-darwin-arm64-metal.tar.gz': 'a484487893151fdbe1ba5b3ea9d4dff3692efe8735e0a681d8f4ab84d5ffb09d',
-    'gezel-native-0.1.49-darwin-arm64.tar.gz': '7dc049ffd09dfb51befbf5c955e569556de6024991478eeb6900646e4672c723',
-    'gezel-native-0.1.49-linux-arm64-cpu.tar.gz': '19490ce26e843c2cab7321b91f9fac781ab3bab9ade6e3945543b312bf1a29e8',
-    'gezel-native-0.1.49-linux-arm64-cuda.tar.gz': '6802852803b0748d7ced99805a8aac281637f8816d02937460e64fbcd8da0637',
-    'gezel-native-0.1.49-linux-arm64.tar.gz': '8d3cd77b5c029fc0c4b4ae83000a72450008973eaf69168c4a21c58bfb75bf33',
-    'gezel-native-0.1.49-linux-x64-cpu.tar.gz': '030eaf798727ab13dcd7e7f4b3124c0f02e6f638e58f81c5d9a399c57d1c0a0a',
-    'gezel-native-0.1.49-linux-x64-cuda.tar.gz': 'd31d21d0c4c5504c9f29eaed32b500b26676bec0fd5ed23fdfd598baecafd748',
-    'gezel-native-0.1.49-linux-x64-vulkan.tar.gz': '114956cb94d174f00105f86b97ba932e1583cac80d9d0ab6b0edf396ea410506',
-    'gezel-native-0.1.49-linux-x64.tar.gz': 'd6a711c2be9329b00ad6bb20e4c16062677ef4d5804a2033d579b2347f5e2802',
-    'gezel-native-0.1.49-win32-arm64-cpu.zip': 'c2e8f10a45bae6cee4801845b605588c5b8b7b3c2e81a512e89296a2f9b7afce',
-    'gezel-native-0.1.49-win32-arm64.zip': '23173db21533dfe3f3189f5582cde9a0550859515b2c94688fb34d342d97e3e5',
-    'gezel-native-0.1.49-win32-x64-cpu.zip': 'cf6a8806e2c2b0a964804169cfb3d9283032536a6c262dc70b65a37b45451f3e',
-    'gezel-native-0.1.49-win32-x64-cuda.zip': '9a1e090829cf2f16389e1a01506853d8ac3ed151a32994831000c1c3658cef08',
-    'gezel-native-0.1.49-win32-x64-vulkan.zip': '0b7fe1cab3b881ac4a5cc24f08b0206c38edab30940ea79888a70776925a8bfb',
-    'gezel-native-0.1.49-win32-x64.zip': 'e8996f82ea358903010e050d6b8b93beec683286af512b11cd8eeefdea50aa6d',
+    'gezel-native-0.1.52-darwin-arm64-metal.tar.gz': '8c8619530592692ad9fd905823a5bc7772a652d4257905919dac088c5fa86347',
+    'gezel-native-0.1.52-darwin-arm64.tar.gz': '3088b7d97968ea206bf58a516da2a9c635d7622672da220d48d790fd5555a797',
+    'gezel-native-0.1.52-linux-arm64-cpu.tar.gz': 'ec4b992eb372e735156691950eadb2aa8f7e5ef29437b53a9da6fe8cc2a7912b',
+    'gezel-native-0.1.52-linux-arm64-cuda.tar.gz': '4f97fd70f0d132f0bfcaadfd113f63add7d8b63982edf8b1b7a46301702047f5',
+    'gezel-native-0.1.52-linux-arm64.tar.gz': '3fa2c58ff75bea7ec0f739821250307bfba78cb026779ec3ad1ef935286af534',
+    'gezel-native-0.1.52-linux-x64-cpu.tar.gz': '1fbfd06acfea1ef9e2629c121da2d7da13ee2e76a0cebb8cf07b779938817966',
+    'gezel-native-0.1.52-linux-x64-cuda.tar.gz': '5c3c05f285c3922845b72e470ecfcd5e510b874a35ae841cd655a7098b541ffd',
+    'gezel-native-0.1.52-linux-x64-vulkan.tar.gz': '33a6dd016bd2cf0aada7f34c364a457acc524373b52a1d3f1f6e83c1240e93a7',
+    'gezel-native-0.1.52-linux-x64.tar.gz': 'f17afac30f984da17b6098bf5f9c5e88e9f9e128b8fbea0b5ff67a360a494313',
+    'gezel-native-0.1.52-win32-arm64-cpu.zip': '49f011b05eec55cc3f60730fdd46e3d28de331f60b195eb29abaa04fe62835a3',
+    'gezel-native-0.1.52-win32-arm64-cuda.zip': '7dbc99fd9516ea5a5cc49ad2c157bb66a240ecc2b5a5e22fae33142a6615caec',
+    'gezel-native-0.1.52-win32-arm64.zip': 'dfe61d86eae932e03d92665aa42b81121e21cfa76a85424d993b5726ee5fa504',
+    'gezel-native-0.1.52-win32-x64-cpu.zip': 'b1147052367daf694d6001ef0d45a8897a39a1d74cb776a42f22529d5c21f919',
+    'gezel-native-0.1.52-win32-x64-cuda.zip': '3c9568591d19ba04ceb12ae2e9f9f2a4ac7ade4597458a8674d444c06407324f',
+    'gezel-native-0.1.52-win32-x64-vulkan.zip': '9cb1e7721d1dbebfa830ec8cba1bbbbcb41f0145d60461e4bf50c4e347feecb2',
+    'gezel-native-0.1.52-win32-x64.zip': '7c94605b0783695174773ac2327274d91bb9d7ae31e7d932a2b9df78d44424df',
 });
-/** Download size in bytes of every engine archive published by native-v0.1.49. */
+/** Download size in bytes of every engine archive published by native-v0.1.52. */
 export const NATIVE_ENGINE_ARCHIVE_BYTES = Object.freeze({
-    'gezel-native-0.1.49-darwin-arm64-metal.tar.gz': 6895181,
-    'gezel-native-0.1.49-darwin-arm64.tar.gz': 41543602,
-    'gezel-native-0.1.49-linux-arm64-cpu.tar.gz': 8681742,
-    'gezel-native-0.1.49-linux-arm64-cuda.tar.gz': 618839431,
-    'gezel-native-0.1.49-linux-arm64.tar.gz': 41977168,
-    'gezel-native-0.1.49-linux-x64-cpu.tar.gz': 13085558,
-    'gezel-native-0.1.49-linux-x64-cuda.tar.gz': 987396266,
-    'gezel-native-0.1.49-linux-x64-vulkan.tar.gz': 27140717,
-    'gezel-native-0.1.49-linux-x64.tar.gz': 58057802,
-    'gezel-native-0.1.49-win32-arm64-cpu.zip': 5459336,
-    'gezel-native-0.1.49-win32-arm64.zip': 42048477,
-    'gezel-native-0.1.49-win32-x64-cpu.zip': 8603082,
-    'gezel-native-0.1.49-win32-x64-cuda.zip': 641853362,
-    'gezel-native-0.1.49-win32-x64-vulkan.zip': 22326156,
-    'gezel-native-0.1.49-win32-x64.zip': 56551783,
+    'gezel-native-0.1.52-darwin-arm64-metal.tar.gz': 7056567,
+    'gezel-native-0.1.52-darwin-arm64.tar.gz': 42206061,
+    'gezel-native-0.1.52-linux-arm64-cpu.tar.gz': 8836310,
+    'gezel-native-0.1.52-linux-arm64-cuda.tar.gz': 620408821,
+    'gezel-native-0.1.52-linux-arm64.tar.gz': 42037958,
+    'gezel-native-0.1.52-linux-x64-cpu.tar.gz': 12914985,
+    'gezel-native-0.1.52-linux-x64-cuda.tar.gz': 993543364,
+    'gezel-native-0.1.52-linux-x64-vulkan.tar.gz': 25672744,
+    'gezel-native-0.1.52-linux-x64.tar.gz': 57183428,
+    'gezel-native-0.1.52-win32-arm64-cpu.zip': 5618616,
+    'gezel-native-0.1.52-win32-arm64-cuda.zip': 219555740,
+    'gezel-native-0.1.52-win32-arm64.zip': 42114295,
+    'gezel-native-0.1.52-win32-x64-cpu.zip': 8714442,
+    'gezel-native-0.1.52-win32-x64-cuda.zip': 749856660,
+    'gezel-native-0.1.52-win32-x64-vulkan.zip': 21123132,
+    'gezel-native-0.1.52-win32-x64.zip': 55662940,
 });
 // END PINNED NATIVE ARCHIVE HASHES
 /**

package/dist/engines/resolver.js

@@ -763,7 +763,9 @@ async function resolveGitHubToken() {
         return process.env.GITHUB_TOKEN;
     try {
         const { execFileSync } = await import('node:child_process');
-        const out = execFileSync('gh', ['auth', 'token'], {
+        // Named host: a bare `gh auth token` answers for gh's default host, which
+        // can be a GitHub Enterprise server whose token must not go to github.com.
+        const out = execFileSync('gh', ['auth', 'token', '--hostname', 'github.com'], {
             encoding: 'utf8',
             stdio: ['ignore', 'pipe', 'ignore'],
             ...windowsHeadlessSpawnOptions(),

package/dist/fs/atomic.d.ts

@@ -50,4 +50,7 @@ export declare function writeFileAtomic(absPath: string, content: string | Uint8
  * private staging file by their adapter, then copied to a sibling temporary
  * path and renamed into place.
  */
-export declare function copyFileAtomic(sourcePath: string, absPath: string): Promise<void>;
+export declare function copyFileAtomic(sourcePath: string, absPath: string, opts?: {
+    noReplace?: boolean;
+    signal?: AbortSignal;
+}): Promise<void>;

package/dist/fs/atomic.js

@@ -108,10 +108,16 @@ export async function writeFileAtomic(absPath, content, opts) {
  * private staging file by their adapter, then copied to a sibling temporary
  * path and renamed into place.
  */
-export async function copyFileAtomic(sourcePath, absPath) {
+export async function copyFileAtomic(sourcePath, absPath, opts) {
     const tmp = `${absPath}.tmp-${process.pid}-${randomUUID()}`;
     try {
         await copyFile(sourcePath, tmp);
+        opts?.signal?.throwIfAborted();
+        if (opts?.noReplace) {
+            await link(tmp, absPath);
+            await rm(tmp, { force: true }).catch(() => undefined);
+            return;
+        }
         await renameWithWindowsRetry(tmp, absPath);
     }
     catch (err) {

package/dist/http/openai-compat/chat-target.d.ts

@@ -59,7 +59,7 @@ export declare function resolvePinnedModelTarget(ctx: ServiceContext, model: str
  * Pick the gezel that guarantees a persona-backed fallback for public
  * inference requests.
  *
- * The explicit Connected Apps choice wins. When it is unset or stale,
+ * The explicit Integrations choice wins. When it is unset or stale,
  * the install's Meester is the natural front door; the first available
  * gezel is the final recovery path for older or partially migrated
  * homes. A healthy store always has at least a Meester, but returning

package/dist/http/openai-compat/chat-target.js

@@ -29,7 +29,7 @@ export async function resolvePinnedModelTarget(ctx, model) {
  * Pick the gezel that guarantees a persona-backed fallback for public
  * inference requests.
  *
- * The explicit Connected Apps choice wins. When it is unset or stale,
+ * The explicit Integrations choice wins. When it is unset or stale,
  * the install's Meester is the natural front door; the first available
  * gezel is the final recovery path for older or partially migrated
  * homes. A healthy store always has at least a Meester, but returning

package/dist/http/openai-compat/engine-failure.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The OpenAI-compatible routes' vocabulary for an on-device engine failure.
+ *
+ * Providers already throw typed errors that say exactly what went wrong: the
+ * capacity broker refused the model's memory, the engine crashed, the prompt
+ * overflowed its context. These routes kept only the message and stamped every
+ * one `provider_error`, so a connected app could not tell "this machine cannot
+ * fit the model" from "try again in a second" without parsing prose — and the
+ * prose is exactly what a sanitizing proxy strips. Each internal code maps to
+ * one stable wire code here; anything unrecognized stays `provider_error`.
+ */
+export type EngineFailureCode = 'capacity_denied' | 'engine_busy' | 'engine_launch_failed' | 'engine_crashed' | 'engine_out_of_memory' | 'context_length_exceeded' | 'engine_not_ready' | 'model_not_ready';
+export interface EngineFailure {
+    code: EngineFailureCode | 'provider_error';
+    type: 'server_error' | 'invalid_request_error';
+    status: 400 | 500;
+}
+/**
+ * Stand-ins for an engine failure's own message wherever a response body must
+ * not carry internal detail (the service's opaque-error middleware). The
+ * provider's message can name binaries and model paths.
+ */
+export declare const ENGINE_FAILURE_SUMMARIES: Readonly<Record<EngineFailureCode, string>>;
+export declare function isEngineFailureCode(value: unknown): value is EngineFailureCode;
+export declare function engineFailure(err: unknown): EngineFailure;

package/dist/http/openai-compat/engine-failure.js

@@ -0,0 +1,76 @@
+/**
+ * The OpenAI-compatible routes' vocabulary for an on-device engine failure.
+ *
+ * Providers already throw typed errors that say exactly what went wrong: the
+ * capacity broker refused the model's memory, the engine crashed, the prompt
+ * overflowed its context. These routes kept only the message and stamped every
+ * one `provider_error`, so a connected app could not tell "this machine cannot
+ * fit the model" from "try again in a second" without parsing prose — and the
+ * prose is exactly what a sanitizing proxy strips. Each internal code maps to
+ * one stable wire code here; anything unrecognized stays `provider_error`.
+ */
+/** Internal error `code` (as thrown) → wire code (as sent). */
+const WIRE_CODES = new Map([
+    ['capacity-denied', 'capacity_denied'],
+    ['engine-busy', 'engine_busy'],
+    ['engine-launch', 'engine_launch_failed'],
+    ['native-engine-crash', 'engine_crashed'],
+    ['context-overflow', 'context_length_exceeded'],
+    ['engine-not-ready', 'engine_not_ready'],
+    ['model-not-ready', 'model_not_ready'],
+]);
+/**
+ * Stand-ins for an engine failure's own message wherever a response body must
+ * not carry internal detail (the service's opaque-error middleware). The
+ * provider's message can name binaries and model paths.
+ */
+export const ENGINE_FAILURE_SUMMARIES = {
+    capacity_denied: 'This machine does not have enough free memory to run this model right now.',
+    engine_busy: 'The on-device engine is busy with another request. Try again shortly.',
+    engine_launch_failed: 'The on-device engine could not be started on this machine.',
+    engine_crashed: 'The on-device engine stopped unexpectedly. Try again.',
+    engine_out_of_memory: 'This computer ran out of memory and the on-device engine was stopped. Close other programs or use a smaller model, then try again.',
+    context_length_exceeded: 'The prompt is longer than this model can read at once.',
+    engine_not_ready: 'The on-device engine is still getting ready. Try again shortly.',
+    model_not_ready: 'This model is not ready yet.',
+};
+export function isEngineFailureCode(value) {
+    return typeof value === 'string' && Object.hasOwn(ENGINE_FAILURE_SUMMARIES, value);
+}
+const MAX_CAUSE_DEPTH = 5;
+/**
+ * The outermost recognized code wins: a wrapper such as
+ * `NativeEngineCrashedError` is the provider's own classification of the
+ * cause it carries.
+ */
+function internalCode(err) {
+    const seen = new Set();
+    let current = err;
+    for (let depth = 0; depth < MAX_CAUSE_DEPTH; depth++) {
+        if (!current || typeof current !== 'object' || seen.has(current))
+            return undefined;
+        seen.add(current);
+        const code = current.code;
+        const wire = typeof code === 'string' ? WIRE_CODES.get(code) : undefined;
+        // A crash the out-of-memory killer caused is a capacity fact, not a fault.
+        if (wire === 'engine_crashed' &&
+            current.panicKind === 'host-out-of-memory') {
+            return 'engine_out_of_memory';
+        }
+        if (wire)
+            return wire;
+        current = current.cause;
+    }
+    return undefined;
+}
+export function engineFailure(err) {
+    const code = internalCode(err);
+    if (!code)
+        return { code: 'provider_error', type: 'server_error', status: 500 };
+    // OpenAI's own spelling and status for an over-long prompt. A 500 makes
+    // every SDK retry a request that cannot fit no matter how often it is sent.
+    if (code === 'context_length_exceeded') {
+        return { code, type: 'invalid_request_error', status: 400 };
+    }
+    return { code, type: 'server_error', status: 500 };
+}

package/dist/http/openai-compat/responses-streaming.js

@@ -1,4 +1,5 @@
 import { randomUUID } from 'node:crypto';
+import { engineFailure } from './engine-failure.js';
 import { unwrapCustomToolInput } from './responses-translate.js';
 const DEFAULT_LIMITS = {
     maxOutputTextChars: 4_000_000,
@@ -673,7 +674,7 @@ export async function runResponsesStreaming(session, prompt, echoModel, sink, no
     }
     catch (error) {
         options.onProviderError?.(error);
-        enqueue(serializer.fail('The model provider failed while generating this response.', 'provider_error'));
+        enqueue(serializer.fail('The model provider failed while generating this response.', engineFailure(error).code));
     }
     finally {
         unsubscribeDelta();

package/dist/http/openai-compat/responses-translate.d.ts

@@ -134,8 +134,8 @@ export declare const ResponsesRequestSchema: z.ZodObject<{
     }, z.core.$loose>]>>>;
     tool_choice: z.ZodDefault<z.ZodUnion<readonly [z.ZodEnum<{
         none: "none";
-        auto: "auto";
         required: "required";
+        auto: "auto";
     }>, z.ZodObject<{
         type: z.ZodEnum<{
             function: "function";

package/dist/http/openai-compat/translate.d.ts

@@ -121,8 +121,8 @@ export declare const ChatCompletionRequestSchema: z.ZodObject<{
     }, z.core.$strip>>>;
     tool_choice: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
         none: "none";
-        auto: "auto";
         required: "required";
+        auto: "auto";
     }>, z.ZodObject<{
         type: z.ZodLiteral<"function">;
         function: z.ZodObject<{

package/dist/http/routes/engines.js

@@ -6,6 +6,8 @@ import { streamSSE } from 'hono/streaming';
 import { z } from 'zod';
 import { effectiveEngineRelease, isEnginePinned, pinnedEngineArchiveBytes, } from '../../engines/native-manifest.js';
 import { KNOWN_ENGINES, isKnownEngine } from '../../engines/registry.js';
+import { llamaBackendHealthView } from '../../providers/llama-cpp/backend-health.js';
+import { isLlamaBackend, liftLlamaQuarantine, llamaQuarantineView, } from '../../providers/llama-cpp/backend-quarantine.js';
 import { EngineBusyError } from '../../providers/native/capacity-broker.js';
 import { invalidateModelsCache } from '../model-inventory-cache.js';
 import { isMachineEngineProvider, machineEngineProxy } from './machine-engine-proxy.js';
@@ -212,6 +214,39 @@ export function enginesRoutes(ctx) {
         }
         return c.json({ policy: effective });
     });
+    /**
+     * llama-server builds switched off on this machine after crashing while
+     * starting, and the undo behind the engine's Settings tab. Engine-owner
+     * state like the policies above: the quarantine file lives in the home of
+     * the process that launches the engines, so packaged user daemons proxy
+     * this to the machine engine.
+     */
+    app.get('/llama-cpp/quarantine', (c) => c.json(llamaQuarantineView(ctx.home)));
+    /**
+     * Whether llama-server is getting this machine's hardware: a CUDA build the
+     * driver cannot run, a GPU build that started without its GPU, the
+     * out-of-memory killer. Engine-owner state, proxied like the quarantine.
+     */
+    app.get('/llama-cpp/backend-health', (c) => c.json(llamaBackendHealthView()));
+    app.delete('/llama-cpp/quarantine/:backend', async (c) => {
+        const backend = c.req.param('backend');
+        if (!isLlamaBackend(backend)) {
+            return c.json({ error: 'backend must be "cuda", "vulkan", "metal", or "cpu"' }, 400);
+        }
+        const override = (await ctx.store.readConfig()).llamaCppBackendOverride;
+        const { restored } = liftLlamaQuarantine(ctx.home, backend, {
+            pinned: override !== undefined && override !== 'auto',
+        });
+        if (restored) {
+            log.info(`llama-server ${backend} quarantine lifted; next launch uses ${restored.path}`);
+            // Engines resolve their binary when the provider is built, so a resident
+            // engine keeps running the fallback until it restarts. Same soft reset
+            // as the policies above: idle engines go now, busy ones after their turn.
+            invalidateModelsCache();
+            await ctx.chat.resetClient({ deferBusy: true });
+        }
+        return c.json(llamaQuarantineView(ctx.home));
+    });
     /**
      * Per-model context overrides (Settings → Local models → Context size…).
      * Engine-owner state like the sizing policy above — packaged user daemons

package/dist/http/routes/v1-chat.js

@@ -10,6 +10,7 @@ import { EXTERNAL_CONVERSATION_ID_HEADER, EXTERNAL_PROJECT_HEADER, EXTERNAL_WORK
 import { appendCallerOwnedActionLedger } from '../openai-compat/action-ledger.js';
 import { profileForCallerOwnedInference } from '../openai-compat/caller-owned-profile.js';
 import { resolveChatTarget, resolveFallbackGezelId, resolvePinnedModelTarget, } from '../openai-compat/chat-target.js';
+import { engineFailure } from '../openai-compat/engine-failure.js';
 import { overlayOpenAiRequestTuning } from '../openai-compat/request-tuning.js';
 import { createStreamingDiagnostics, snapshotStreamingDiagnostics, } from '../openai-compat/streaming-telemetry.js';
 import { runNonStreaming, runStreaming } from '../openai-compat/streaming.js';
@@ -288,7 +289,7 @@ export function v1ChatRoutes(ctx, opts = {}) {
             // instruct folds, per-gezel overrides for gezel: targets) applies
             // unconditionally — it's "what the model is" — with the caller's
             // per-request knobs overlaid on top. The behavior `profile` is the
-            // supporting layer the Connected Apps switch gates. Caller-owned
+            // supporting layer the Integrations switch gates. Caller-owned
             // inference keeps parsing, grammar, and transcript compatibility but
             // omits interventions which assume Gezel owns the action loop.
             // Best-effort: a resolver failure serves engine defaults rather than
@@ -536,12 +537,13 @@ export function v1ChatRoutes(ctx, opts = {}) {
                             clientAborted,
                             error: describeErrorChain(err),
                         })}`);
+                        const failure = engineFailure(err);
                         await stream
                             .writeSSE({
                             data: JSON.stringify({
                                 error: err instanceof UnsupportedResponseFormatError
                                     ? { message, type: 'invalid_request_error', code: err.code }
-                                    : { message, type: 'server_error', code: 'provider_error' },
+                                    : { message, type: failure.type, code: failure.code },
                             }),
                         })
                             .catch((sseErr) => {
@@ -644,6 +646,13 @@ export function v1ChatRoutes(ctx, opts = {}) {
                 }, 400);
             }
             const message = err instanceof Error ? err.message : String(err);
+            // Before the prose checks below: an engine's own message can contain
+            // "empty", and a typed failure says more than any substring does.
+            const failure = engineFailure(err);
+            if (failure.code !== 'provider_error') {
+                log.warn(`chat completion failed (${failure.code}): ${message}`);
+                return c.json({ error: { message, type: failure.type, code: failure.code } }, failure.status);
+            }
             if (message.includes('messages must') ||
                 message.includes('empty') ||
                 message.includes('cannot be an assistant turn')) {

package/dist/http/routes/v1-knowledge.js

@@ -222,6 +222,10 @@ export function v1KnowledgeRoutes(ctx) {
             maxResults: 24,
             queryEmbedBudgetMs: 5000,
             catalogs: enabled.map((entry) => entry.ref.catalogId),
+            // Let the reranker choose among an article's sections: one passage per
+            // article, picked by embedding similarity, sent an infobox in place of
+            // the history the person asked about.
+            chunksPerDocument: 3,
         });
         c.req.raw.signal.throwIfAborted();
         const candidates = [];

package/dist/http/routes/v1-models.js

@@ -1,6 +1,7 @@
-import { estimateManifestKvBytes, externalGezelModelId, isRecommendedModel, localContextFloorTokens, rateModelsForDevice, resolveDistributionProfile, } from '@bendyline/gezel';
+import { estimateManifestKvBytes, externalGezelModelId, isRecommendedModel, llamaCppBackendExclusion, localContextFloorTokens, rateModelsForDevice, resolveDistributionProfile, } from '@bendyline/gezel';
 import { resolveOnDeviceProvider } from '@bendyline/gezel/native';
 import { Hono } from 'hono';
+import { currentLlamaCppBackend } from '../../providers/llama-cpp/backend-health.js';
 import { CapacityBroker } from '../../providers/native/capacity-broker.js';
 import { detectMemoryProfileCached } from '../../system/memory.js';
 import { appleSystemModel } from '../openai-compat/apple-model.js';
@@ -59,14 +60,15 @@ function catalogBackend(manifest) {
     // Store hosts have no provisioned Python runtime. Only advertise models
     // backed by bundled native engines until a frozen MLX runtime ships.
     const store = resolveDistributionProfile().pythonProvisioning === 'frozen-only';
+    const llamaCpp = manifest.llamaCpp && !llamaCppBackendExclusion(manifest.llamaCpp, currentLlamaCppBackend());
     if (store)
-        return manifest.llamaCpp ? 'llama-cpp' : ds4;
+        return llamaCpp ? 'llama-cpp' : ds4;
     const preferred = resolveOnDeviceProvider(process.platform, process.arch);
     if (preferred === 'mlx' && manifest.mlx && !manifest.mlx.disabledReason)
         return 'mlx';
-    if (preferred === 'llama-cpp' && manifest.llamaCpp)
+    if (preferred === 'llama-cpp' && llamaCpp)
         return 'llama-cpp';
-    if (manifest.llamaCpp)
+    if (llamaCpp)
         return 'llama-cpp';
     if (manifest.mlx && !manifest.mlx.disabledReason && process.platform === 'darwin')
         return 'mlx';

package/dist/http/routes/v1-responses.d.ts

@@ -9,7 +9,7 @@ import type { InferenceContext } from '../inference-context.js';
  * and returns assistant text/tool calls in Responses wire shapes. The route
  * intentionally does not create a Gezel chat session or attach Gezel MCP.
  *
- * In the full service, auth is mounted in `server.ts`: the Connected Apps
+ * In the full service, auth is mounted in `server.ts`: the Integrations
  * master switch, bearer authentication, and the `openai` scope all apply. Codex can therefore use
  * an app-scoped token without ever learning the daemon's root credential.
  */

package/dist/http/routes/v1-responses.js

@@ -8,6 +8,7 @@ import { ExternalToolsUnsupportedError, ModelNotInstalledError, } from '../../pr
 import { appendCallerOwnedActionLedger } from '../openai-compat/action-ledger.js';
 import { profileForCallerOwnedInference } from '../openai-compat/caller-owned-profile.js';
 import { resolveChatTarget, resolvePinnedModelTarget, } from '../openai-compat/chat-target.js';
+import { engineFailure } from '../openai-compat/engine-failure.js';
 import { runResponsesNonStreaming, runResponsesStreaming, } from '../openai-compat/responses-streaming.js';
 import { ResponsesRequestSchema, translateResponsesRequest, } from '../openai-compat/responses-translate.js';
 import { flattenTranscriptIntoPrompt, parseGezelModelRef, resolveModelTarget, } from '../openai-compat/translate.js';
@@ -221,7 +222,7 @@ export function v1ResponsesRoutes(ctx, opts = {}) {
                             event: 'error',
                             data: JSON.stringify({
                                 type: 'error',
-                                code: 'provider_error',
+                                code: engineFailure(err).code,
                                 message: 'The response stream ended unexpectedly.',
                                 param: null,
                             }),
@@ -264,6 +265,11 @@ export function v1ResponsesRoutes(ctx, opts = {}) {
                 return invalidRequest(c, err.message, err.code);
             }
             const message = err instanceof Error ? err.message : String(err);
+            const failure = engineFailure(err);
+            if (failure.code !== 'provider_error') {
+                log.warn(`Responses request failed (${failure.code}): ${message}`);
+                return c.json({ error: { message, type: failure.type, code: failure.code } }, failure.status);
+            }
             if (message.includes('messages must') ||
                 message.includes('empty') ||
                 message.includes('cannot be an assistant turn')) {

package/dist/inference-service.d.ts

@@ -1,4 +1,4 @@
-import { type ProviderName } from '@bendyline/gezel';
+import { type LogOutput, type ProviderName } from '@bendyline/gezel';
 import type { LLMProvider } from './providers/types.js';
 import './http/auth-context.js';
 /** Same shape the full service reports, so one handler serves either host. */
@@ -15,6 +15,11 @@ export interface InferenceServiceOptions {
     /** Host-provided local providers, useful for testing without downloading weights. */
     providers?: ReadonlyMap<ProviderName, LLMProvider>;
     onUnexpectedHttpError?: (event: InferenceHttpErrorEvent) => void;
+    /**
+     * Where log records go while this host runs; restored on `stop()`. An app
+     * embedding the host passes `'stderr'` so its own stdout stays its own.
+     */
+    logOutput?: LogOutput;
 }
 export interface RunningInferenceService {
     readonly profile: 'embedded-inference';

package/dist/inference-service.js

@@ -1,6 +1,6 @@
 import { randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
 import { join } from 'node:path';
-import { GEZEL_API_GENERATION, GEZEL_API_GENERATION_FLOOR, GEZEL_VERSION, GezelConfigSchema, createLogger, nowIso, startSuspendMonitor, stopSuspendMonitor, } from '@bendyline/gezel';
+import { GEZEL_API_GENERATION, GEZEL_API_GENERATION_FLOOR, GEZEL_VERSION, GezelConfigSchema, createLogger, getLogOutput, nowIso, setLogOutput, startSuspendMonitor, stopSuspendMonitor, } from '@bendyline/gezel';
 import { BundledSource, CatalogService } from '@bendyline/gezel-catalog';
 import { discoverNativeBinaries } from '@bendyline/gezel/native';
 import { gezelHome } from '@bendyline/gezel/paths';
@@ -35,16 +35,27 @@ import './http/auth-context.js';
 const log = createLogger('inference');
 /** Direct Fetch host: no listener, product store, background downloads or daemon discovery. */
 export async function startService(options = {}) {
+    const previousLogOutput = getLogOutput();
+    const restoreLogOutput = () => setLogOutput(previousLogOutput);
+    if (options.logOutput)
+        setLogOutput(options.logOutput);
     const home = options.home ?? gezelHome();
-    await ensurePrivateUserHome(home);
-    // Model files must land in this home's managed cache: unset, transformers.js
-    // falls back to a module-relative cache that is read-only inside a packaged
-    // app, and the embed worker (which reads this env) has no other view of home.
-    process.env[HF_CACHE_DIR_ENV] ??= transformersCacheDir(home);
-    const startedAt = nowIso();
     const runtimeDir = join(home, 'runtime');
-    const lock = await acquireSingleInstanceLock({ runtimeDir, lockPath: join(runtimeDir, 'lock') });
-    const cleanup = [() => lock.release()];
+    let lock;
+    try {
+        await ensurePrivateUserHome(home);
+        // Model files must land in this home's managed cache: unset, transformers.js
+        // falls back to a module-relative cache that is read-only inside a packaged
+        // app, and the embed worker (which reads this env) has no other view of home.
+        process.env[HF_CACHE_DIR_ENV] ??= transformersCacheDir(home);
+        lock = await acquireSingleInstanceLock({ runtimeDir, lockPath: join(runtimeDir, 'lock') });
+    }
+    catch (error) {
+        restoreLogOutput();
+        throw error;
+    }
+    const startedAt = nowIso();
+    const cleanup = [restoreLogOutput, () => lock.release()];
     const requests = new InFlightRequests();
     let stopping;
     let closed = false;

package/dist/knowledge/catalog-host.d.ts

@@ -7,7 +7,7 @@
  * (docs/gezk-format.md). The in-process implementation is test/CLI-only;
  * production fails closed if its worker becomes unavailable.
  */
-import type { CatalogAssetFile, CatalogAssetInfo, CatalogAssetRead, CatalogChunkHit, CatalogDocumentMeta, CatalogTopic, CatalogValidationReport } from '@bendyline/gezel-knowledge';
+import type { CatalogAssetFile, CatalogAssetInfo, CatalogAssetRead, CatalogChunkHit, CatalogDocumentInitial, CatalogDocumentMeta, CatalogTopic, CatalogValidationReport } from '@bendyline/gezel-knowledge';
 import type { KnowledgeRadius } from '@bendyline/gezel';
 import type { SpatialMatch } from '@bendyline/gezel-knowledge';
 export interface MountSpec {
@@ -78,6 +78,14 @@ export interface KnowledgeCatalogHost {
         documents: CatalogDocumentMeta[];
         total: number;
     }>;
+    documentInitials(key: string, opts: {
+        topicId?: string;
+        descendants?: boolean;
+    }): Promise<CatalogDocumentInitial[]>;
+    documentPosition(key: string, documentId: string, opts: {
+        topicId?: string;
+        descendants?: boolean;
+    }): Promise<number | null>;
     nearbyDocuments(key: string, radius: KnowledgeRadius, opts: {
         offset?: number;
         limit?: number;

package/dist/knowledge/catalog-host.js

@@ -158,6 +158,8 @@ export async function createInProcessCatalogHost() {
         validate: async (rootDir, deep) => validateExtractedCatalog(rootDir, { deep }),
         topics: async (key) => mustGet(handles, key).topics(),
         documentsPage: async (key, opts) => mustGet(handles, key).documentsPage(opts),
+        documentInitials: async (key, opts) => mustGet(handles, key).documentInitials(opts),
+        documentPosition: async (key, documentId, opts) => mustGet(handles, key).documentPosition(documentId, opts),
         nearbyDocuments: async (key, radius, opts) => mustGet(handles, key).nearbyDocuments(radius, opts),
         getDocument: async (key, documentId) => mustGet(handles, key).getDocument(documentId),
         getChunk: async (key, documentId, chunkUid) => mustGet(handles, key).getChunk(documentId, chunkUid),

package/dist/knowledge/manager.d.ts

@@ -121,6 +121,12 @@ export declare class KnowledgeManager {
      * what the Knowledge screen's browser renders. Offline-safe: gilde is local.
      */
     available(): Promise<KnowledgeAvailableCatalog[]>;
+    /**
+     * The search model an install of a catalog with this profile would also
+     * download. None when the catalog searches with the daemon's own embedder
+     * (an install never fetches that) or the profile's pinned files are cached.
+     */
+    private searchModelDownloadBytes;
     /** Resolve a catalogId (URI authority) to its mounted info, or null. */
     mountedCatalog(catalogId: string): MountedInfo | null;
     /**
@@ -206,6 +212,14 @@ export declare class KnowledgeManager {
         limit?: number;
         descendants?: boolean;
     }): ReturnType<KnowledgeCatalogHost['documentsPage']>;
+    documentInitials(catalogId: string, opts: {
+        topicId?: string;
+        descendants?: boolean;
+    }): ReturnType<KnowledgeCatalogHost['documentInitials']>;
+    documentPosition(catalogId: string, documentId: string, opts: {
+        topicId?: string;
+        descendants?: boolean;
+    }): ReturnType<KnowledgeCatalogHost['documentPosition']>;
     getDocument(catalogId: string, documentId: string): ReturnType<KnowledgeCatalogHost['getDocument']>;
     /** One passage by its citation id, with the document's title and origin. */
     getPassage(catalogId: string, documentId: string, chunkUid: string): Promise<KnowledgePassageRead | null>;
@@ -246,6 +260,13 @@ export declare class KnowledgeManager {
          * their own. Explicit search asks; proactive injection does not.
          */
         media?: boolean;
+        /**
+         * Also return up to this many of a document's other passages that the
+         * search found, after its best one. Fusion otherwise keeps one passage
+         * per document, chosen by vector similarity alone, so an article's name-
+         * dense infobox can stand in for the section a reranker would choose.
+         */
+        chunksPerDocument?: number;
     }): Promise<UnifiedSearchResult[]>;
     /** A document the lexical arms named but no chunk carries: cite it with its lead paragraph. */
     private toDocumentResult;