@gmickel/gno 1.25.1 → 1.27.0

package/src/core/project-profile.ts

@@ -0,0 +1,490 @@
+// node:fs/promises provides realpath/stat; Bun has no equivalent for symlink-safe path identity and regular-file metadata.
+import { realpath, stat } from "node:fs/promises";
+// node:path provides cross-platform path operations; Bun has no path utilities.
+import { isAbsolute, relative, resolve, sep } from "node:path";
+
+import type { Config, ModelPreset } from "../config/types";
+
+import { normalizeContentTypes } from "../config/content-types";
+import { createDefaultConfig } from "../config/defaults";
+import {
+  PROJECT_PROFILE_FORCED_EXCLUDES,
+  PROJECT_PROFILE_SCHEMA_VERSION,
+  type ProjectProfile,
+} from "../config/project-profile";
+import { parseModelUri } from "../llm/cache";
+import { getPreset } from "../llm/registry";
+import { canonicalOperationalPath } from "./config-write-lock";
+import { normalizePersistedContextText } from "./context-identity";
+import { hasLikelySecretPath } from "./path-rules";
+import {
+  canonicalProjectProfileJson,
+  compareCodeUnits,
+  fingerprintProjectProfileState,
+  normalizeLogicalPath,
+  projectProfileIncludePattern,
+  sha256,
+  sortedUnique,
+} from "./project-profile-canonical";
+import { parseProjectProfile } from "./project-profile-parser";
+
+export {
+  canonicalProjectProfileJson,
+  fingerprintProjectProfileState,
+  projectProfileIncludePattern,
+} from "./project-profile-canonical";
+export type ProjectProfileDiagnosticCode =
+  | "COLLECTION_ROOT_NOT_DIRECTORY"
+  | "CONTEXT_FILE_INVALID"
+  | "CONTEXT_FILE_NOT_REGULAR"
+  | "CONTEXT_FILE_TOO_LARGE"
+  | "CONTEXT_FILE_UNREADABLE"
+  | "CONTEXT_TEXT_EMPTY"
+  | "INVALID_PROFILE"
+  | "MIGRATION_REQUIRED"
+  | "MODEL_CACHE_CHECK_FAILED"
+  | "MODEL_PATH_OVERLAP"
+  | "MODEL_PRESET_NOT_FOUND"
+  | "MODEL_PRESET_UNAVAILABLE_OFFLINE"
+  | "PATH_NOT_FOUND"
+  | "SYMLINK_ESCAPE"
+  | "UNSAFE_PATH"
+  | "UNSUPPORTED_SCHEMA_MAJOR"
+  | "UNSUPPORTED_SCHEMA_MINOR";
+
+export interface ProjectProfileDiagnostic {
+  code: ProjectProfileDiagnosticCode;
+  severity: "error" | "warning";
+  path: string;
+  message: string;
+}
+
+export interface ProjectProfileContextState {
+  scopeType: "collection";
+  scopeKey: string;
+  text: string;
+  source:
+    | { kind: "inline"; sha256: string }
+    | { kind: "file"; path: string; sha256: string };
+}
+
+export interface ProjectProfileDesiredState {
+  schemaVersion: typeof PROJECT_PROFILE_SCHEMA_VERSION;
+  collection: {
+    name: string;
+    root: string;
+    include: string[];
+    exclude: string[];
+    languageHint?: string;
+    modelPreset?: string;
+  };
+  contexts: ProjectProfileContextState[];
+  contentTypes: Array<{
+    id: string;
+    prefixes: string[];
+    preset: string;
+    graphHints?: string[];
+    searchBoost?: number;
+    temporal?: boolean;
+  }>;
+  affinityDefaults: {
+    enabled: boolean;
+    contribution: number;
+  };
+  recommendedCapabilities: string[];
+}
+
+export interface ResolvedProjectProfilePaths {
+  profileRoot: string;
+  collectionRoot: string;
+  contextFiles: Array<{
+    logicalPath: string;
+    absolutePath: string;
+  }>;
+}
+
+export interface CompiledProjectProfile {
+  profile: ProjectProfile;
+  desiredState: ProjectProfileDesiredState;
+  canonicalJson: string;
+  fingerprint: string;
+  resolvedPaths: ResolvedProjectProfilePaths;
+  diagnostics: ProjectProfileDiagnostic[];
+}
+
+export type CompileProjectProfileResult =
+  | { ok: true; value: CompiledProjectProfile }
+  | { ok: false; diagnostics: ProjectProfileDiagnostic[] };
+
+export interface ProjectProfileCompilerOptions {
+  profileRoot: string;
+  config?: Config;
+  isModelAvailableOffline?: (
+    modelUri: string,
+    modelType: "embed" | "rerank" | "expand" | "gen"
+  ) => Promise<boolean>;
+}
+
+export const PROJECT_PROFILE_CONTEXT_FILE_MAX_BYTES = 65_536;
+
+const isContained = (parent: string, candidate: string): boolean => {
+  const pathFromParent = relative(parent, candidate);
+  return (
+    pathFromParent === "" ||
+    (pathFromParent !== ".." &&
+      !pathFromParent.startsWith(`..${sep}`) &&
+      !isAbsolute(pathFromParent))
+  );
+};
+
+const resolveContainedPath = async (
+  profileRoot: string,
+  logicalPath: string,
+  diagnosticPath: string
+): Promise<
+  | {
+      ok: true;
+      absolutePath: string;
+      metadata: Awaited<ReturnType<typeof stat>>;
+    }
+  | { ok: false; diagnostic: ProjectProfileDiagnostic }
+> => {
+  const candidate = resolve(profileRoot, normalizeLogicalPath(logicalPath));
+  let absolutePath: string;
+  let metadata: Awaited<ReturnType<typeof stat>>;
+  try {
+    absolutePath = await realpath(candidate);
+    metadata = await stat(absolutePath);
+  } catch {
+    return {
+      ok: false,
+      diagnostic: {
+        code: "PATH_NOT_FOUND",
+        severity: "error",
+        path: diagnosticPath,
+        message: "Referenced project path does not exist.",
+      },
+    };
+  }
+  if (!isContained(profileRoot, absolutePath)) {
+    return {
+      ok: false,
+      diagnostic: {
+        code: "SYMLINK_ESCAPE",
+        severity: "error",
+        path: diagnosticPath,
+        message:
+          "Referenced project path resolves outside the trusted profile root.",
+      },
+    };
+  }
+  return { ok: true, absolutePath, metadata };
+};
+
+const modelUris = (
+  preset: ModelPreset
+): Array<["embed" | "rerank" | "expand" | "gen", string]> => [
+  ["embed", preset.embed],
+  ["rerank", preset.rerank],
+  ["expand", preset.expand ?? preset.gen],
+  ["gen", preset.gen],
+];
+
+const diagnoseModelPreset = async (
+  profile: ProjectProfile,
+  options: ProjectProfileCompilerOptions,
+  profileRoot: string
+): Promise<ProjectProfileDiagnostic[]> => {
+  const presetId = profile.collection.modelPreset;
+  if (!presetId) return [];
+  const preset = getPreset(options.config ?? createDefaultConfig(), presetId);
+  if (!preset) {
+    return [
+      {
+        code: "MODEL_PRESET_NOT_FOUND",
+        severity: "error",
+        path: "collection.modelPreset",
+        message: `Model preset alias "${presetId}" is not configured.`,
+      },
+    ];
+  }
+  for (const [, uri] of modelUris(preset)) {
+    const parsed = parseModelUri(uri);
+    if (!parsed.ok || parsed.value.scheme !== "file") continue;
+    const modelPath = await canonicalOperationalPath(parsed.value.file);
+    if (isContained(profileRoot, modelPath)) {
+      return [
+        {
+          code: "MODEL_PATH_OVERLAP",
+          severity: "error",
+          path: "collection.modelPreset",
+          message:
+            "The selected model preset resolves runtime model state inside the project profile root.",
+        },
+      ];
+    }
+  }
+  if (!options.isModelAvailableOffline) return [];
+
+  const unavailable: string[] = [];
+  try {
+    for (const [modelType, uri] of modelUris(preset)) {
+      if (!(await options.isModelAvailableOffline(uri, modelType))) {
+        unavailable.push(modelType);
+      }
+    }
+  } catch {
+    return [
+      {
+        code: "MODEL_CACHE_CHECK_FAILED",
+        severity: "error",
+        path: "collection.modelPreset",
+        message: `Offline cache availability could not be verified for model preset alias "${presetId}".`,
+      },
+    ];
+  }
+  if (unavailable.length === 0) return [];
+  return [
+    {
+      code: "MODEL_PRESET_UNAVAILABLE_OFFLINE",
+      severity: "error",
+      path: "collection.modelPreset",
+      message: `Model preset alias "${presetId}" is unavailable offline for: ${unavailable.join(", ")}.`,
+    },
+  ];
+};
+
+export async function compileProjectProfileYaml(
+  yaml: string,
+  options: ProjectProfileCompilerOptions
+): Promise<CompileProjectProfileResult> {
+  const parsed = parseProjectProfile(yaml);
+  if ("ok" in parsed) return parsed;
+  const profile = parsed;
+  const diagnostics: ProjectProfileDiagnostic[] = [];
+
+  let profileRoot: string;
+  try {
+    profileRoot = await realpath(options.profileRoot);
+  } catch {
+    return {
+      ok: false,
+      diagnostics: [
+        {
+          code: "PATH_NOT_FOUND",
+          severity: "error",
+          path: "profileRoot",
+          message: "Trusted project profile root does not exist.",
+        },
+      ],
+    };
+  }
+
+  const collectionRoot = await resolveContainedPath(
+    profileRoot,
+    profile.collection.root,
+    "collection.root"
+  );
+  if (!collectionRoot.ok) diagnostics.push(collectionRoot.diagnostic);
+  else if (!collectionRoot.metadata.isDirectory()) {
+    diagnostics.push({
+      code: "COLLECTION_ROOT_NOT_DIRECTORY",
+      severity: "error",
+      path: "collection.root",
+      message: "The collection root must resolve to a directory.",
+    });
+  }
+
+  const contexts: ProjectProfileContextState[] = [];
+  const contextFiles: ResolvedProjectProfilePaths["contextFiles"] = [];
+  for (const [index, context] of profile.contexts.entries()) {
+    if ("text" in context) {
+      const normalizedText = normalizePersistedContextText(context.text);
+      if (!normalizedText) {
+        diagnostics.push({
+          code: "CONTEXT_TEXT_EMPTY",
+          severity: "error",
+          path: `contexts[${index}].text`,
+          message: "Context text must not be empty after normalization.",
+        });
+        continue;
+      }
+      contexts.push({
+        scopeType: "collection",
+        scopeKey: `${profile.collection.name}:`,
+        text: normalizedText,
+        source: { kind: "inline", sha256: sha256(context.text) },
+      });
+      continue;
+    }
+
+    const resolved = await resolveContainedPath(
+      profileRoot,
+      context.file,
+      `contexts[${index}].file`
+    );
+    if (!resolved.ok) {
+      diagnostics.push(resolved.diagnostic);
+      continue;
+    }
+    const resolvedLogicalPath = normalizeLogicalPath(
+      relative(profileRoot, resolved.absolutePath)
+    );
+    if (hasLikelySecretPath(resolvedLogicalPath)) {
+      diagnostics.push({
+        code: "UNSAFE_PATH",
+        severity: "error",
+        path: `contexts[${index}].file`,
+        message:
+          "Context input resolves to a likely credential or secret file.",
+      });
+      continue;
+    }
+    if (!resolved.metadata.isFile()) {
+      diagnostics.push({
+        code: "CONTEXT_FILE_NOT_REGULAR",
+        severity: "error",
+        path: `contexts[${index}].file`,
+        message: "Context input must resolve to a regular file.",
+      });
+      continue;
+    }
+    if (resolved.metadata.size > PROJECT_PROFILE_CONTEXT_FILE_MAX_BYTES) {
+      diagnostics.push({
+        code: "CONTEXT_FILE_TOO_LARGE",
+        severity: "error",
+        path: `contexts[${index}].file`,
+        message: `Context file exceeds ${PROJECT_PROFILE_CONTEXT_FILE_MAX_BYTES} bytes.`,
+      });
+      continue;
+    }
+    let bytes: Uint8Array;
+    try {
+      bytes = new Uint8Array(
+        await Bun.file(resolved.absolutePath)
+          .slice(0, PROJECT_PROFILE_CONTEXT_FILE_MAX_BYTES + 1)
+          .arrayBuffer()
+      );
+    } catch {
+      diagnostics.push({
+        code: "CONTEXT_FILE_UNREADABLE",
+        severity: "error",
+        path: `contexts[${index}].file`,
+        message: "Context file could not be read.",
+      });
+      continue;
+    }
+    if (bytes.byteLength > PROJECT_PROFILE_CONTEXT_FILE_MAX_BYTES) {
+      diagnostics.push({
+        code: "CONTEXT_FILE_TOO_LARGE",
+        severity: "error",
+        path: `contexts[${index}].file`,
+        message: `Context file exceeds ${PROJECT_PROFILE_CONTEXT_FILE_MAX_BYTES} bytes.`,
+      });
+      continue;
+    }
+    let text: string;
+    try {
+      text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    } catch {
+      diagnostics.push({
+        code: "CONTEXT_FILE_INVALID",
+        severity: "error",
+        path: `contexts[${index}].file`,
+        message: "Context file is not valid UTF-8.",
+      });
+      continue;
+    }
+    const logicalPath = normalizeLogicalPath(context.file);
+    const normalizedText = normalizePersistedContextText(text);
+    if (!normalizedText) {
+      diagnostics.push({
+        code: "CONTEXT_TEXT_EMPTY",
+        severity: "error",
+        path: `contexts[${index}].file`,
+        message: "Context file must not be empty after normalization.",
+      });
+      continue;
+    }
+    contexts.push({
+      scopeType: "collection",
+      scopeKey: `${profile.collection.name}:`,
+      text: normalizedText,
+      source: { kind: "file", path: logicalPath, sha256: sha256(bytes) },
+    });
+    contextFiles.push({
+      logicalPath,
+      absolutePath: resolved.absolutePath,
+    });
+  }
+
+  diagnostics.push(
+    ...(await diagnoseModelPreset(profile, options, profileRoot))
+  );
+  if (diagnostics.some((diagnostic) => diagnostic.severity === "error")) {
+    return { ok: false, diagnostics };
+  }
+
+  const normalizedContentTypes = normalizeContentTypes(
+    Object.entries(profile.contentTypes).map(([id, rule]) => ({ id, ...rule }))
+  ).rules.map((rule) => ({
+    id: rule.id,
+    prefixes: sortedUnique(rule.prefixes.map(normalizeLogicalPath)),
+    preset: rule.preset,
+    ...(rule.graphHints ? { graphHints: sortedUnique(rule.graphHints) } : {}),
+    ...(rule.searchBoost === undefined
+      ? {}
+      : { searchBoost: rule.searchBoost }),
+    ...(rule.temporal === undefined ? {} : { temporal: rule.temporal }),
+  }));
+
+  const desiredState: ProjectProfileDesiredState = {
+    schemaVersion: PROJECT_PROFILE_SCHEMA_VERSION,
+    collection: {
+      name: profile.collection.name,
+      root: normalizeLogicalPath(profile.collection.root),
+      include: sortedUnique(
+        profile.collection.include.map(normalizeLogicalPath)
+      ),
+      exclude: sortedUnique([
+        ...profile.collection.exclude.map(normalizeLogicalPath),
+        ...PROJECT_PROFILE_FORCED_EXCLUDES,
+      ]),
+      ...(profile.collection.languageHint
+        ? { languageHint: profile.collection.languageHint }
+        : {}),
+      ...(profile.collection.modelPreset
+        ? { modelPreset: profile.collection.modelPreset }
+        : {}),
+    },
+    contexts: contexts.sort((left, right) =>
+      compareCodeUnits(
+        canonicalProjectProfileJson(left),
+        canonicalProjectProfileJson(right)
+      )
+    ),
+    contentTypes: normalizedContentTypes,
+    affinityDefaults: profile.affinityDefaults,
+    recommendedCapabilities: sortedUnique(profile.recommendedCapabilities),
+  };
+  const canonicalJson = canonicalProjectProfileJson(desiredState);
+  return {
+    ok: true,
+    value: {
+      profile,
+      desiredState,
+      canonicalJson,
+      fingerprint: fingerprintProjectProfileState(desiredState),
+      resolvedPaths: {
+        profileRoot,
+        collectionRoot: collectionRoot.ok
+          ? collectionRoot.absolutePath
+          : profileRoot,
+        contextFiles: contextFiles.sort((left, right) =>
+          compareCodeUnits(left.logicalPath, right.logicalPath)
+        ),
+      },
+      diagnostics,
+    },
+  };
+}

package/src/core/retrieval-replay-candidate.ts

@@ -12,6 +12,7 @@ import type { RetrievalQrelsCase } from "./retrieval-qrels";
 import type { RetrievalReplayCandidate } from "./retrieval-replay-types";
 
 import { parseUri } from "../app/constants";
+import { normalizeContentTypes } from "../config";
 import { searchHybrid } from "../pipeline/hybrid";
 import { searchBm25 } from "../pipeline/search";
 import { SEARCH_RESULTS_TRACE_METADATA } from "../pipeline/types";
@@ -145,7 +146,11 @@ const runCandidateOnce = async (
   options: HybridSearchOptions
 ): Promise<StoreResult<SearchResults>> => {
   if (candidate.type === "bm25") {
-    return searchBm25(deps.store, source.query.text, options);
+    return searchBm25(deps.store, source.query.text, {
+      ...options,
+      contentTypeRules: normalizeContentTypes(deps.config.contentTypes ?? [])
+        .rules,
+    });
   }
   if (candidate.type === "vector") {
     if (!(deps.vectorIndex && deps.embedPort)) {

package/src/ingestion/sync-options.ts

@@ -7,7 +7,10 @@
 import type { Config, NormalizedContentTypeRule } from "../config";
 import type { SyncOptions } from "./types";
 
-import { fingerprintContentTypeRules, normalizeContentTypes } from "../config";
+import {
+  fingerprintContentTypeMetadataRules,
+  normalizeContentTypes,
+} from "../config";
 
 export function resolveContentTypeRules(
   config?: Pick<Config, "contentTypes">
@@ -24,6 +27,7 @@ export function withContentTypeRules(
     ...options,
     contentTypeRules: rules,
     contentTypeRulesFingerprint:
-      options.contentTypeRulesFingerprint ?? fingerprintContentTypeRules(rules),
+      options.contentTypeRulesFingerprint ??
+      fingerprintContentTypeMetadataRules(rules),
   };
 }

package/src/ingestion/sync.ts

@@ -33,7 +33,10 @@ import type {
   WalkerPort,
 } from "./types";
 
-import { fingerprintContentTypeRules } from "../config";
+import {
+  fingerprintContentTypeMetadataRules,
+  resolveContentTypeRule,
+} from "../config";
 import { getDefaultMimeDetector, type MimeDetector } from "../converters/mime";
 import {
   type ConversionPipeline,
@@ -80,7 +83,8 @@ const MAX_CONCURRENCY = 16;
  * Documents with ingestVersion < INGEST_VERSION will be re-processed.
  */
 export const INGEST_VERSION = 6;
-const EMPTY_CONTENT_TYPE_RULES_FINGERPRINT = fingerprintContentTypeRules([]);
+const EMPTY_CONTENT_TYPE_RULES_FINGERPRINT =
+  fingerprintContentTypeMetadataRules([]);
 const RELATION_EDGE_TYPE_PATTERN = /^[a-z][a-z0-9_]*$/;
 const PROJECTION_YIELD_INTERVAL = 25;
 const NON_RETRYABLE_CONVERSION_ERROR_CODES = new Set([
@@ -401,18 +405,6 @@ function parseCategories(input: unknown): string[] {
   return [];
 }
 
-function matchPrefixContentType(
-  relPath: string,
-  rules: NormalizedContentTypeRule[]
-): string | undefined {
-  for (const rule of rules) {
-    if (rule.prefixes.some((prefix) => relPath.startsWith(prefix))) {
-      return rule.id;
-    }
-  }
-  return undefined;
-}
-
 export function extractDocumentMetadata(
   markdown: string,
   relPath: string,
@@ -421,23 +413,23 @@ export function extractDocumentMetadata(
 ): DocumentMetadata {
   const parsed = parseFrontmatter(markdown);
   const metadata = parsed.metadata;
-  const typedRules = new Map(contentTypeRules.map((rule) => [rule.id, rule]));
   const rawFrontmatterType =
     typeof metadata.type === "string"
       ? normalizeFrontmatterScalar(metadata.type)
       : "";
-  const frontmatterType = typedRules.get(rawFrontmatterType)?.id;
-  const prefixType =
-    frontmatterType === undefined
-      ? matchPrefixContentType(relPath, contentTypeRules)
-      : undefined;
+  const configuredRule = resolveContentTypeRule(
+    rawFrontmatterType,
+    relPath,
+    contentTypeRules
+  );
   const inferred = inferPathContentType(relPath, ext);
-  const contentType = frontmatterType ?? prefixType ?? inferred.contentType;
-  const contentTypeSource: ContentTypeSource = frontmatterType
-    ? "frontmatter-type"
-    : prefixType
-      ? "prefix"
-      : inferred.source;
+  const contentType = configuredRule?.rule.id ?? inferred.contentType;
+  const contentTypeSource: ContentTypeSource =
+    configuredRule?.source === "configured-id"
+      ? "frontmatter-type"
+      : configuredRule?.source === "prefix"
+        ? "prefix"
+        : inferred.source;
   const categories = new Set<string>([contentType]);
 
   const fmCategories = parseCategories(
@@ -679,7 +671,7 @@ export class SyncService {
       const contentTypeRules = options.contentTypeRules ?? [];
       const contentTypeRulesFingerprint =
         options.contentTypeRulesFingerprint ??
-        fingerprintContentTypeRules(contentTypeRules);
+        fingerprintContentTypeMetadataRules(contentTypeRules);
 
       // 4. Check existing doc for skip/repair decision
       const existingResult = await store.getDocument(
@@ -1066,7 +1058,7 @@ export class SyncService {
       contentTypeRules: options.contentTypeRules ?? [],
       contentTypeRulesFingerprint:
         options.contentTypeRulesFingerprint ??
-        fingerprintContentTypeRules(options.contentTypeRules ?? []),
+        fingerprintContentTypeMetadataRules(options.contentTypeRules ?? []),
     };
     const results: FileSyncResult[] = [];
     const projectionSourceIds = new Set<number>();
@@ -1411,7 +1403,7 @@ export class SyncService {
       contentTypeRules: options.contentTypeRules ?? [],
       contentTypeRulesFingerprint:
         options.contentTypeRulesFingerprint ??
-        fingerprintContentTypeRules(options.contentTypeRules ?? []),
+        fingerprintContentTypeMetadataRules(options.contentTypeRules ?? []),
     };
     const errors: Array<{ relPath: string; code: string; message: string }> =
       [];

package/src/ingestion/types.ts

@@ -135,7 +135,7 @@ export interface SyncOptions {
   concurrency?: number;
   /** Normalized content type rules from config.contentTypes. */
   contentTypeRules?: NormalizedContentTypeRule[];
-  /** Stable hash of the normalized content type rules, used for re-derivation. */
+  /** Stable hash of metadata-affecting rules, used for re-derivation. */
   contentTypeRulesFingerprint?: string;
   /** Internal orchestration flag: defer graph projection to an outer sync. */
   projectTypedEdges?: boolean;