@gmickel/gno 1.27.1 → 1.29.0

package/src/publish/artifact.ts

@@ -4,6 +4,7 @@
  * @module src/publish/artifact
  */
 
+import type { EgressLineage } from "../core/egress-provenance";
 import type { DocumentRow } from "../store/types";
 
 import { deriveDocid } from "../app/constants";
@@ -11,6 +12,10 @@ import {
   contextCapsuleEvidenceIdentity,
   sha256Text,
 } from "../core/context-capsule-validation";
+import {
+  egressLineageSchema,
+  legacyLocalOnlyEgressLineage,
+} from "../core/egress-provenance";
 import { stripFrontmatter } from "../ingestion/frontmatter";
 import {
   MAX_PUBLISH_SLUG_LENGTH,
@@ -71,6 +76,7 @@ export interface PublicPublishDocument {
 export interface PublicPublishManifest {
   capabilities: typeof PUBLIC_PUBLISH_CAPABILITIES;
   documents: PublicPublishDocument[];
+  egressLineage: EgressLineage;
   generatedAt: string;
   projectionRevision: string;
   schemaVersion: typeof PUBLIC_PUBLISH_MANIFEST_SCHEMA_VERSION;
@@ -116,6 +122,7 @@ export interface EncryptedPublishArtifactSpace {
 }
 
 export interface PublishArtifactV1 {
+  egressLineage: EgressLineage;
   exportedAt: string;
   source: string;
   spaces: PublishArtifactSpace[];
@@ -123,6 +130,7 @@ export interface PublishArtifactV1 {
 }
 
 export interface PublishArtifactV2 {
+  egressLineage: EgressLineage;
   exportedAt: string;
   source: string;
   spaces: EncryptedPublishArtifactSpace[];
@@ -279,6 +287,7 @@ const buildPublicPublishDocument = (
 };
 
 export const buildPublicPublishManifest = (input: {
+  egressLineage?: EgressLineage;
   exportedAt: string;
   homeNoteSlug?: string;
   notes: PublishArtifactNote[];
@@ -288,7 +297,11 @@ export const buildPublicPublishManifest = (input: {
   title: string;
   visibility: "public";
 }): PublicPublishManifest => {
-  const validated = validateAndProjectPublishSpaceInput(input);
+  const { egressLineage: providedLineage, ...spaceInput } = input;
+  const validated = validateAndProjectPublishSpaceInput(spaceInput);
+  const egressLineage = egressLineageSchema.parse(
+    providedLineage ?? legacyLocalOnlyEgressLineage("legacy")
+  );
   if (validated.visibility !== "public") {
     throw new Error("Public publish manifests require public visibility");
   }
@@ -304,6 +317,7 @@ export const buildPublicPublishManifest = (input: {
   const revisionProjection = {
     capabilities: PUBLIC_PUBLISH_CAPABILITIES,
     documents,
+    egressLineage,
     homeNoteSlug: validated.homeNoteSlug ?? null,
     notes: validated.notes
       .map((note) => ({
@@ -324,6 +338,7 @@ export const buildPublicPublishManifest = (input: {
   return {
     capabilities: { ...PUBLIC_PUBLISH_CAPABILITIES },
     documents,
+    egressLineage,
     generatedAt: exportedAt,
     projectionRevision: sha256Text(canonicalJson(revisionProjection)),
     schemaVersion: PUBLIC_PUBLISH_MANIFEST_SCHEMA_VERSION,
@@ -332,6 +347,7 @@ export const buildPublicPublishManifest = (input: {
 };
 
 export const buildPublishArtifact = (input: {
+  egressLineage?: EgressLineage;
   homeNoteSlug?: string;
   notes: PublishArtifactNote[];
   routeSlug: string;
@@ -340,7 +356,11 @@ export const buildPublishArtifact = (input: {
   title: string;
   visibility: Exclude<PublishVisibility, "encrypted">;
 }): PublishArtifactV1 => {
-  const validated = validateAndProjectPublishSpaceInput(input);
+  const { egressLineage: providedLineage, ...spaceInput } = input;
+  const validated = validateAndProjectPublishSpaceInput(spaceInput);
+  const egressLineage = egressLineageSchema.parse(
+    providedLineage ?? legacyLocalOnlyEgressLineage("legacy")
+  );
   const exportedAt = new Date().toISOString();
   const base = {
     ...(validated.homeNoteSlug === undefined
@@ -357,6 +377,7 @@ export const buildPublishArtifact = (input: {
       ? {
           ...base,
           manifest: buildPublicPublishManifest({
+            egressLineage,
             exportedAt,
             homeNoteSlug: validated.homeNoteSlug,
             notes: validated.notes,
@@ -374,6 +395,7 @@ export const buildPublishArtifact = (input: {
         };
 
   return {
+    egressLineage,
     exportedAt,
     source: validated.routeSlug,
     spaces: [space],
@@ -382,14 +404,20 @@ export const buildPublishArtifact = (input: {
 };
 
 export const buildEncryptedPublishArtifact = (input: {
+  egressLineage?: EgressLineage;
   encryptedPayload: EncryptedArtifactPayload;
   routeSlug: string;
   secretToken: string;
   sourceType: "note" | "collection";
 }): PublishArtifactV2 => {
-  const validated = validateAndProjectEncryptedPublishInput(input);
+  const { egressLineage: providedLineage, ...encryptedInput } = input;
+  const validated = validateAndProjectEncryptedPublishInput(encryptedInput);
+  const egressLineage = egressLineageSchema.parse(
+    providedLineage ?? legacyLocalOnlyEgressLineage("legacy")
+  );
   const exportedAt = requirePublishDateTime(new Date().toISOString());
   return {
+    egressLineage,
     exportedAt,
     source: validated.routeSlug,
     spaces: [

package/src/publish/export-service.ts

@@ -7,6 +7,7 @@
 import type { Collection } from "../config/types";
 import type { DocumentRow, StorePort, TagRow } from "../store/types";
 
+import { enforceCollectionEgressWithAudit } from "../core/egress-enforcement";
 import { parseRef } from "../core/ref-parser";
 import { parseFrontmatter, stripFrontmatter } from "../ingestion/frontmatter";
 import { getContentBatch } from "../store/content-batch";
@@ -217,6 +218,15 @@ async function exportCollectionArtifact(
     target,
   ]);
   const visibility = resolveVisibility(options.visibility);
+  const { lineage } = await enforceCollectionEgressWithAudit({
+    collections,
+    collectionNames: [collection.name],
+    action: "export",
+    destinationZone: "local_process",
+    caller: { authenticated: true, operationAuthorized: true },
+    contentClass: "source",
+    store,
+  });
 
   if (visibility === "encrypted") {
     if (!options.encryptionPassphrase) {
@@ -237,6 +247,7 @@ async function exportCollectionArtifact(
     });
 
     return buildEncryptedPublishArtifact({
+      egressLineage: lineage,
       encryptedPayload: encrypted.encryptedPayload,
       routeSlug,
       secretToken: encrypted.secretToken,
@@ -245,6 +256,7 @@ async function exportCollectionArtifact(
   }
 
   return buildPublishArtifact({
+    egressLineage: lineage,
     homeNoteSlug: chooseHomeNoteSlug(notes),
     notes,
     routeSlug,
@@ -257,6 +269,7 @@ async function exportCollectionArtifact(
 
 async function exportDocumentArtifact(
   store: StorePort,
+  collections: Collection[],
   target: string,
   options: PublishExportCoreOptions,
   warnings: SanitizeWarning[]
@@ -283,6 +296,15 @@ async function exportDocumentArtifact(
   const slug = deriveExportedSlug(doc);
   const visibility = resolveVisibility(options.visibility);
   const routeSlug = derivePublishSlug([options.routeSlug ?? "", slug, target]);
+  const { lineage } = await enforceCollectionEgressWithAudit({
+    collections,
+    collectionNames: [doc.collection],
+    action: "export",
+    destinationZone: "local_process",
+    caller: { authenticated: true, operationAuthorized: true },
+    contentClass: "source",
+    store,
+  });
 
   if (visibility === "encrypted") {
     if (!options.encryptionPassphrase) {
@@ -310,6 +332,7 @@ async function exportDocumentArtifact(
     });
 
     return buildEncryptedPublishArtifact({
+      egressLineage: lineage,
       encryptedPayload: encrypted.encryptedPayload,
       routeSlug,
       secretToken: encrypted.secretToken,
@@ -318,6 +341,7 @@ async function exportDocumentArtifact(
   }
 
   return buildPublishArtifact({
+    egressLineage: lineage,
     notes: [
       {
         markdown,
@@ -357,6 +381,7 @@ export async function exportPublishArtifact(input: {
     )) ??
     (await exportDocumentArtifact(
       input.store,
+      input.collections,
       input.target,
       input.options,
       warnings

package/src/sdk/client.ts

@@ -79,6 +79,11 @@ import {
   planCapture,
 } from "../core/capture";
 import { writeCapturePlanFile } from "../core/capture-write";
+import { projectCollectionEgressPolicy } from "../core/collection-egress-policy-projection";
+import { CollectionEgressPolicyService } from "../core/collection-egress-policy-service";
+import { applyConfigChange } from "../core/config-mutation";
+import { EgressAuditService } from "../core/egress-audit";
+import { authorizeCurrentEgress } from "../core/egress-authorization";
 import {
   atomicWrite,
   copyFilePath,
@@ -270,7 +275,7 @@ async function resolveClientState(
 }
 
 class GnoClientImpl implements GnoClient {
-  readonly config: Config;
+  config: Config;
   readonly dbPath: string;
   readonly configPath: string | null;
   readonly configSource: "file" | "inline";
@@ -331,6 +336,9 @@ class GnoClientImpl implements GnoClient {
     rerankModel?: string;
   }): Promise<RuntimePorts> {
     this.assertOpen();
+    const egressCollections = options.collection
+      ? [options.collection]
+      : ("all" as const);
 
     let embedPort: EmbeddingPort | null = null;
     let expandPort: GenerationPort | null = null;
@@ -347,6 +355,7 @@ class GnoClientImpl implements GnoClient {
           options.collection
         ),
         {
+          egressCollections,
           policy: this.downloadPolicy,
         }
       );
@@ -391,6 +400,7 @@ class GnoClientImpl implements GnoClient {
           options.collection
         ),
         {
+          egressCollections,
           policy: this.downloadPolicy,
         }
       );
@@ -415,6 +425,7 @@ class GnoClientImpl implements GnoClient {
           options.collection
         ),
         {
+          egressCollections,
           policy: this.downloadPolicy,
         }
       );
@@ -442,6 +453,7 @@ class GnoClientImpl implements GnoClient {
           options.collection
         ),
         {
+          egressCollections,
           policy: this.downloadPolicy,
         }
       );
@@ -1230,7 +1242,19 @@ class GnoClientImpl implements GnoClient {
   ) {
     this.assertOpen();
     return unwrapTraceStore(
-      await new RetrievalTraceManagementService(this.store).export(input)
+      await new RetrievalTraceManagementService(this.store, {
+        authorizeExport: async (lineage) => {
+          return authorizeCurrentEgress({
+            store: this.store,
+            config: this.config,
+            lineage,
+            action: "export",
+            destinationZone: "local_process",
+            caller: { authenticated: true, operationAuthorized: true },
+            contentClass: "retrieval_trace",
+          });
+        },
+      }).export(input)
     );
   }
 
@@ -1248,6 +1272,99 @@ class GnoClientImpl implements GnoClient {
     );
   }
 
+  async getCollectionEgressPolicy(collection: string) {
+    this.assertOpen();
+    const state = new CollectionEgressPolicyService({
+      getConfig: () => this.config,
+    }).get(collection);
+    if (!state.ok) {
+      throw sdkError(
+        state.code === "NOT_FOUND" ? "NOT_FOUND" : "VALIDATION",
+        state.error
+      );
+    }
+    return state.value;
+  }
+
+  async setCollectionEgressPolicy(
+    collection: string,
+    policy: import("../config/types").EgressPolicy,
+    confirmation?: import("../core/collection-egress-policy-service").EgressRelaxationConfirmation
+  ) {
+    this.assertOpen();
+    if (!this.configPath) {
+      throw sdkError(
+        "VALIDATION",
+        "Inline-config clients cannot persist collection policy changes"
+      );
+    }
+    const service = new CollectionEgressPolicyService({
+      getConfig: () => this.config,
+      mutateConfig: (mutate) =>
+        applyConfigChange(
+          {
+            store: this.store,
+            configPath: this.configPath ?? undefined,
+            onConfigUpdated: (config) => {
+              this.config = config;
+            },
+            projectStore: (store, config) =>
+              projectCollectionEgressPolicy(store, config, collection),
+          },
+          mutate
+        ),
+    });
+    const result = await service.set({
+      collection,
+      policy,
+      confirmation,
+    });
+    if (!result.ok) throw sdkError("VALIDATION", result.error);
+    return result.value;
+  }
+
+  async checkEgress(
+    input: import("../core/collection-egress-policy-service").CollectionEgressCheckInput
+  ) {
+    this.assertOpen();
+    const result = new CollectionEgressPolicyService({
+      getConfig: () => this.config,
+    }).check(input);
+    if (!result.ok) throw sdkError("VALIDATION", result.error);
+    return result.value;
+  }
+
+  async listEgressAudits(options: { limit?: number; cursor?: string } = {}) {
+    this.assertOpen();
+    return unwrapTraceStore(
+      await new EgressAuditService(this.store).list(options)
+    );
+  }
+
+  async getEgressAudit(auditId: string) {
+    this.assertOpen();
+    return unwrapTraceStore(
+      await new EgressAuditService(this.store).show(auditId)
+    );
+  }
+
+  async getEgressAuditStatus() {
+    this.assertOpen();
+    return unwrapTraceStore(await new EgressAuditService(this.store).status());
+  }
+
+  async deleteEgressAudit(auditId: string) {
+    this.assertOpen();
+    return unwrapTraceStore(
+      await new EgressAuditService(this.store).delete(auditId)
+    );
+  }
+
+  async purgeEgressAudits() {
+    this.assertOpen();
+    return unwrapTraceStore(await new EgressAuditService(this.store).purge());
+  }
+
   async update(options: GnoUpdateOptions = {}): Promise<SyncResult> {
     this.assertOpen();
     const collections = this.getCollections(options.collection);

package/src/sdk/documents.ts

@@ -23,6 +23,7 @@ import type {
 } from "./types";
 
 import { getDocumentCapabilities } from "../core/document-capabilities";
+import { projectRecordEvidenceMetadata } from "../core/record-metadata";
 import { isGlobPattern, parseRef, splitRefs } from "../core/ref-parser";
 import {
   attachRetrievalTraceMetadata,
@@ -53,9 +54,10 @@ function buildSourceMeta(
   config: Config
 ): GetResponse["source"] {
   const coll = config.collections.find((c) => c.name === doc.collection);
+  const relPath = doc.recordSourcePath ?? doc.relPath;
   return {
-    absPath: coll ? `${coll.path}/${doc.relPath}` : undefined,
-    relPath: doc.relPath,
+    absPath: coll ? `${coll.path}/${relPath}` : undefined,
+    relPath,
     mime: doc.sourceMime,
     ext: doc.sourceExt,
     sizeBytes: doc.sourceSize,
@@ -129,10 +131,12 @@ async function getDocumentByRefUntraced(
       language: doc.languageHint ?? undefined,
       source: buildSourceMeta(doc, config),
       conversion: buildConversionMeta(doc),
+      record: projectRecordEvidenceMetadata(doc),
       capabilities: getDocumentCapabilities({
         sourceExt: doc.sourceExt,
         sourceMime: doc.sourceMime,
         contentAvailable: doc.mirrorHash !== null,
+        recordKey: doc.recordKey,
       }),
     };
   }
@@ -156,10 +160,12 @@ async function getDocumentByRefUntraced(
     language: doc.languageHint ?? undefined,
     source: buildSourceMeta(doc, config),
     conversion: buildConversionMeta(doc),
+    record: projectRecordEvidenceMetadata(doc),
     capabilities: getDocumentCapabilities({
       sourceExt: doc.sourceExt,
       sourceMime: doc.sourceMime,
       contentAvailable: doc.mirrorHash !== null,
+      recordKey: doc.recordKey,
     }),
   };
 }
@@ -318,6 +324,7 @@ export async function multiGetDocuments(
       maxBytes
     );
     const coll = config.collections.find((c) => c.name === doc.collection);
+    const sourceRelPath = doc.recordSourcePath ?? doc.relPath;
     documents.push({
       docid: doc.docid,
       uri: doc.uri,
@@ -326,11 +333,12 @@ export async function multiGetDocuments(
       truncated: truncated || undefined,
       totalLines: content.split("\n").length,
       source: {
-        absPath: coll ? `${coll.path}/${doc.relPath}` : undefined,
-        relPath: doc.relPath,
+        absPath: coll ? `${coll.path}/${sourceRelPath}` : undefined,
+        relPath: sourceRelPath,
         mime: doc.sourceMime,
         ext: doc.sourceExt,
       },
+      record: projectRecordEvidenceMetadata(doc),
     });
   }
 
@@ -385,7 +393,7 @@ export async function listDocuments(
       uri: d.uri,
       title: d.title ?? undefined,
       source: {
-        relPath: d.relPath,
+        relPath: d.recordSourcePath ?? d.relPath,
         mime: d.sourceMime,
         ext: d.sourceExt,
       },

package/src/sdk/embed.ts

@@ -283,6 +283,7 @@ export async function runEmbed(
   }
 
   const embedResult = await runtime.llm.createEmbeddingPort(modelUri, {
+    egressCollections: options.collection ? [options.collection] : "all",
     policy: runtime.downloadPolicy,
   });
   if (!embedResult.ok) {

package/src/sdk/types.ts

@@ -11,6 +11,13 @@ import type {
 import type { ContentTypeBoostStatus } from "../config/content-types";
 import type { Config } from "../config/types";
 import type { CaptureInput, CaptureReceipt } from "../core/capture";
+import type {
+  CollectionEgressCheckInput,
+  CollectionEgressCheckResult,
+  CollectionEgressPolicySetResult,
+  CollectionEgressPolicyState,
+  EgressRelaxationConfirmation,
+} from "../core/collection-egress-policy-service";
 import type {
   ContextCapsuleErrorCode,
   ContextCapsuleV1,
@@ -18,6 +25,13 @@ import type {
 } from "../core/context-capsule";
 import type { ContextEvidenceErrorCode } from "../core/context-evidence";
 import type { ContextVerifierErrorCode } from "../core/context-verifier";
+import type {
+  EgressAuditDeleteResult,
+  EgressAuditListResult,
+  EgressAuditPurgeManagementResult,
+  EgressAuditShowResult,
+  EgressAuditStatusResult,
+} from "../core/egress-audit";
 import type {
   KnowledgeChangesResult,
   KnowledgeDiffResult,
@@ -300,6 +314,25 @@ export interface GnoClient {
   ): Promise<RetrievalTraceExportResult>;
   deleteRetrievalTrace(traceId: string): Promise<RetrievalTraceDeleteResult>;
   purgeRetrievalTraces(): Promise<RetrievalTraceManagementPurgeResult>;
+  getCollectionEgressPolicy(
+    collection: string
+  ): Promise<CollectionEgressPolicyState>;
+  setCollectionEgressPolicy(
+    collection: string,
+    policy: import("../config/types").EgressPolicy,
+    confirmation?: EgressRelaxationConfirmation
+  ): Promise<CollectionEgressPolicySetResult>;
+  checkEgress(
+    input: CollectionEgressCheckInput
+  ): Promise<CollectionEgressCheckResult>;
+  listEgressAudits(options?: {
+    limit?: number;
+    cursor?: string;
+  }): Promise<EgressAuditListResult>;
+  getEgressAudit(auditId: string): Promise<EgressAuditShowResult>;
+  getEgressAuditStatus(): Promise<EgressAuditStatusResult>;
+  deleteEgressAudit(auditId: string): Promise<EgressAuditDeleteResult>;
+  purgeEgressAudits(): Promise<EgressAuditPurgeManagementResult>;
   update(options?: GnoUpdateOptions): Promise<SyncResult>;
   embed(options?: GnoEmbedOptions): Promise<GnoEmbedResult>;
   index(options?: GnoIndexOptions): Promise<GnoIndexResult>;

package/src/serve/browse-tree.ts

@@ -15,7 +15,7 @@ export interface BrowseTreeNode {
 type BrowseCollectionLike = Pick<CollectionRow, "name">;
 type BrowseDocumentLike = Pick<
   DocumentRow,
-  "collection" | "relPath" | "active"
+  "collection" | "relPath" | "recordSourcePath" | "active"
 >;
 type BrowseFolderLike = {
   collection: string;
@@ -128,7 +128,9 @@ export function buildBrowseTree(
 
     root.documentCount += 1;
 
-    const normalizedRelPath = normalizeBrowsePath(doc.relPath);
+    const normalizedRelPath = normalizeBrowsePath(
+      doc.recordSourcePath ?? doc.relPath
+    );
     const parts = normalizedRelPath.split("/").filter(Boolean);
     const folderParts = parts.slice(0, -1);
 

package/src/serve/clipper-capture.ts

@@ -3,6 +3,7 @@
 import type { Database } from "bun:sqlite";
 
 import type { PreparedBrowserClip } from "../core/browser-clip";
+import type { EgressLineage } from "../core/egress-provenance";
 import type { SqliteAdapter } from "../store/sqlite/adapter";
 import type { ClipperIdempotencyReplay } from "../store/sqlite/clipper-store-types";
 import type { ResidentCaptureContext } from "./capture-service";
@@ -35,6 +36,7 @@ interface ExecuteClipperCaptureInput {
   context: ResidentCaptureContext;
   store: SqliteAdapter;
   pairing: ClipperPairingService;
+  egressLineage?: EgressLineage;
 }
 
 const inFlightRequests = new Set<string>();
@@ -153,7 +155,9 @@ export const executeClipperCapture = async (
     );
   }
 
-  const prepared = prepareBrowserClip(parsed.data.payload);
+  const prepared = prepareBrowserClip(parsed.data.payload, {
+    egressLineage: input.egressLineage,
+  });
   if (prepared.preview.digest !== parsed.data.previewDigest) {
     return clipperErrorResponse(
       "CLIPPER_PREVIEW_MISMATCH",

package/src/serve/closed-json.ts

@@ -0,0 +1,61 @@
+/** Bounded, content-free JSON request parsing for closed REST contracts. */
+
+const DEFAULT_MAX_BYTES = 16 * 1024;
+
+export type ClosedJsonResult =
+  | { ok: true; value: unknown }
+  | { ok: false; code: "VALIDATION"; error: string };
+
+export const parseClosedJson = async (
+  request: Request,
+  maxBytes = DEFAULT_MAX_BYTES
+): Promise<ClosedJsonResult> => {
+  try {
+    const contentLength = Number(request.headers.get("content-length"));
+    if (Number.isFinite(contentLength) && contentLength > maxBytes) {
+      return {
+        ok: false,
+        code: "VALIDATION",
+        error: "JSON body exceeds the allowed size",
+      };
+    }
+    const reader = request.body?.getReader();
+    if (!reader) {
+      return {
+        ok: false,
+        code: "VALIDATION",
+        error: "Invalid JSON body",
+      };
+    }
+    const chunks: Uint8Array[] = [];
+    let totalBytes = 0;
+    while (true) {
+      const chunk = await reader.read();
+      if (chunk.done) break;
+      totalBytes += chunk.value.byteLength;
+      if (totalBytes > maxBytes) {
+        await reader.cancel("JSON body exceeds the allowed size");
+        return {
+          ok: false,
+          code: "VALIDATION",
+          error: "JSON body exceeds the allowed size",
+        };
+      }
+      chunks.push(chunk.value);
+    }
+    const bytes = new Uint8Array(totalBytes);
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    const text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    return { ok: true, value: JSON.parse(text) as unknown };
+  } catch {
+    return {
+      ok: false,
+      code: "VALIDATION",
+      error: "Invalid JSON body",
+    };
+  }
+};

package/src/serve/config-sync.ts

@@ -11,6 +11,7 @@ import type { ContextHolder } from "./routes/api";
 
 import {
   applyConfigChange as applyConfigChangeCore,
+  type ConfigMutationContext,
   type ApplyConfigResult,
   type MutationResult,
 } from "../core/config-mutation";
@@ -67,11 +68,13 @@ export async function applyConfigChangeTyped<T>(
   ctxHolder: ContextHolder,
   store: SqliteAdapter,
   mutate: (config: Config) => Promise<MutationResult<T>> | MutationResult<T>,
-  configPath?: string
+  configPath?: string,
+  options: Pick<ConfigMutationContext, "projectStore"> = {}
 ): Promise<ApplyConfigResult<T>> {
   const result = await applyConfigChangeCore(
     {
       store,
+      projectStore: options.projectStore,
       configPath: configPath ?? ctxHolder.actualConfigPath,
       onConfigUpdated: (config) => {
         ctxHolder.config = config;

package/src/serve/context.ts

@@ -115,6 +115,7 @@ export async function createServerContext(
 
     // Progress callback updates downloadState for WebUI polling
     const createPortOptions = (type: ModelType): CreatePortOptions => ({
+      egressCollections: "all",
       policy,
       onProgress: (progress) => {
         downloadState.active = true;