@gmickel/gno 1.46.0 → 2.1.0

package/src/cli/commands/embed.ts

@@ -22,6 +22,7 @@ import {
   type WriteLeaseContention,
   withCliWriteLease,
 } from "../../core/write-lease";
+import { embedBacklog, prepareEmbeddingBacklog } from "../../embed/backlog";
 import { getEmbeddingFingerprint } from "../../embed/fingerprint";
 import {
   addUniqueSamples,
@@ -38,6 +39,7 @@ import {
   markIndexStageRunning,
   readIndexStageState,
 } from "../../embed/stage-state";
+import { countVariantBacklog } from "../../embed/variant-plan";
 import { LlmAdapter } from "../../llm/nodeLlamaCpp/adapter";
 import { resolveDownloadPolicy } from "../../llm/policy";
 import { resolveModelUri } from "../../llm/registry";
@@ -139,18 +141,6 @@ function isDisposedBatchError(message: string): boolean {
   return message.toLowerCase().includes("object is disposed");
 }
 
-async function checkVecAvailable(
-  db: import("bun:sqlite").Database
-): Promise<boolean> {
-  try {
-    const sqliteVec = await import("sqlite-vec");
-    sqliteVec.load(db);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
 interface BatchContext {
   db: import("bun:sqlite").Database;
   stats: VectorStatsPort;
@@ -506,28 +496,6 @@ export async function embed(options: EmbedOptions = {}): Promise<EmbedResult> {
         const stats: VectorStatsPort = createVectorStatsPort(db);
 
         let totalToEmbed = 0;
-        if (force) {
-          const forceCount = await getActiveChunkCount(db, options.collection);
-          if (!forceCount.ok) {
-            return { success: false, error: forceCount.error.message };
-          }
-          totalToEmbed = forceCount.value;
-
-          if (totalToEmbed === 0 || dryRun) {
-            const vecAvailable = await checkVecAvailable(db);
-            return {
-              success: true,
-              embedded: totalToEmbed,
-              errors: 0,
-              contentionErrors: 0,
-              duration: 0,
-              model: modelUri,
-              searchAvailable: vecAvailable,
-              errorSamples: [],
-            };
-          }
-        }
-
         // Create LLM adapter and embedding port with auto-download
         let offline = options.offline;
         if (offline === undefined) {
@@ -585,12 +553,16 @@ export async function embed(options: EmbedOptions = {}): Promise<EmbedResult> {
           process.stderr.write("\n");
         }
 
-        // Discover dimensions via probe embedding
-        const probeResult = await embedPort.embed("dimension probe");
-        if (!probeResult.ok) {
-          return { success: false, error: probeResult.error.message };
+        const initializedPort = await embedPort.init();
+        if (!initializedPort.ok)
+          return { success: false, error: initializedPort.error.message };
+        let dimensions = embedPort.dimensions();
+        if (!embedPort.getIdentity?.()) {
+          const probeResult = await embedPort.embed("dimension probe");
+          if (!probeResult.ok)
+            return { success: false, error: probeResult.error.message };
+          dimensions = probeResult.value.length;
         }
-        const dimensions = probeResult.value.length;
 
         // Create vector index port
         const vectorResult = await createVectorIndexPort(db, {
@@ -602,6 +574,70 @@ export async function embed(options: EmbedOptions = {}): Promise<EmbedResult> {
         }
         vectorIndex = vectorResult.value;
 
+        const prepared = await prepareEmbeddingBacklog({
+          statsPort: stats,
+          embedPort,
+          vectorIndex,
+          modelUri,
+          collection: options.collection,
+          batchSize,
+          force,
+        });
+        if (!prepared.ok)
+          return { success: false, error: prepared.error.message };
+        if (prepared.value.variantStore) {
+          totalToEmbed = countVariantBacklog(prepared.value);
+          const startedAt = Date.now();
+          if (dryRun)
+            return {
+              success: true,
+              embedded: totalToEmbed,
+              errors: 0,
+              contentionErrors: 0,
+              duration: 0,
+              model: modelUri,
+              searchAvailable: prepared.value.variantStore.searchAvailable,
+              errorSamples: [],
+            };
+          const processed = await embedBacklog({
+            ...prepared.value,
+            onProgress: !options.json
+              ? (embedded, errors) =>
+                  process.stderr.write(
+                    `\rEmbedded ${embedded}/${totalToEmbed} owners; ${errors} errors`
+                  )
+              : undefined,
+          });
+          if (!options.json) process.stderr.write("\n");
+          if (!processed.ok)
+            return { success: false, error: processed.error.message };
+          return {
+            success: true,
+            ...processed.value,
+            contentionErrors: processed.value.contentionErrors ?? 0,
+            duration: (Date.now() - startedAt) / 1000,
+            model: modelUri,
+            searchAvailable: prepared.value.variantStore.searchAvailable,
+            errorSamples: [],
+          };
+        }
+        if (force) {
+          const count = await getActiveChunkCount(db, options.collection);
+          if (!count.ok) return { success: false, error: count.error.message };
+          totalToEmbed = count.value;
+          if (dryRun || !totalToEmbed)
+            return {
+              success: true,
+              embedded: totalToEmbed,
+              errors: 0,
+              contentionErrors: 0,
+              duration: 0,
+              model: modelUri,
+              searchAvailable: vectorIndex.searchAvailable,
+              errorSamples: [],
+            };
+        }
+
         if (!force) {
           const embedFingerprint = getEmbeddingFingerprint({
             modelUri,
@@ -773,7 +809,7 @@ function getActiveChunks(
     const sql = after
       ? `
         SELECT c.mirror_hash as mirrorHash, c.seq, c.text,
-          (SELECT d.title FROM documents d WHERE d.mirror_hash = c.mirror_hash AND d.active = 1 LIMIT 1) as title,
+          (SELECT d.title FROM documents d WHERE d.mirror_hash = c.mirror_hash AND d.active = 1 ORDER BY d.id LIMIT 1) as title,
           'force' as reason
         FROM content_chunks c
         WHERE EXISTS (
@@ -786,7 +822,7 @@ function getActiveChunks(
       `
       : `
         SELECT c.mirror_hash as mirrorHash, c.seq, c.text,
-          (SELECT d.title FROM documents d WHERE d.mirror_hash = c.mirror_hash AND d.active = 1 LIMIT 1) as title,
+          (SELECT d.title FROM documents d WHERE d.mirror_hash = c.mirror_hash AND d.active = 1 ORDER BY d.id LIMIT 1) as title,
           'force' as reason
         FROM content_chunks c
         WHERE EXISTS (

package/src/cli/detach.ts

@@ -25,6 +25,7 @@ import type { ResidentStatus } from "../serve/status-model";
 import { VERSION, resolveDirs } from "../app/constants";
 import { toAbsolutePath } from "../config/paths";
 import { atomicWrite } from "../core/file-ops";
+import { RESIDENT_STOP_GRACE_MS } from "../core/shutdown-budget";
 import { isResidentStatus } from "../serve/resident-status";
 import { CliError } from "./errors";
 
@@ -877,7 +878,7 @@ export async function inspectForeignLive(options: {
 export interface StopOptions {
   kind: DetachKind;
   pidFile: string;
-  /** Grace period for SIGTERM before we escalate to SIGKILL. Default 10s. */
+  /** Grace period for SIGTERM before we escalate to SIGKILL. Default 12s. */
   timeoutMs?: number;
   /** Poll interval while waiting for the process to exit. Default 100ms. */
   pollIntervalMs?: number;
@@ -921,7 +922,7 @@ async function waitForExit(
  * unlinks stale pid-files it discovers on entry.
  */
 export async function stopProcess(options: StopOptions): Promise<StopOutcome> {
-  const timeoutMs = options.timeoutMs ?? 10_000;
+  const timeoutMs = options.timeoutMs ?? RESIDENT_STOP_GRACE_MS;
   const pollIntervalMs = options.pollIntervalMs ?? 100;
   const killTimeoutMs = options.killTimeoutMs ?? 2_000;
   const sleep = options.sleep ?? defaultSleep;

package/src/config/types.ts

@@ -425,9 +425,9 @@ export const ModelConfigSchema = z.object({
   /** Model presets */
   presets: z.array(ModelPresetSchema).default(DEFAULT_MODEL_PRESETS),
   /** Model load timeout in ms */
-  loadTimeout: z.number().default(60_000),
-  /** Inference timeout in ms */
-  inferenceTimeout: z.number().default(30_000),
+  loadTimeout: z.number().int().min(1).max(2_147_483_647).default(60_000),
+  /** Inference timeout in ms, measured from native evaluation start. */
+  inferenceTimeout: z.number().int().min(1).max(2_147_483_647).default(30_000),
   /** Context size used for query expansion generation */
   expandContextSize: z.number().int().min(256).default(2_048),
   /** Keep warm model TTL in ms (5 min) */

package/src/converters/adapters/markitdownTs/adapter.ts

@@ -3,8 +3,6 @@
  * Uses convertBuffer() with bytes for determinism.
  */
 
-import { MarkItDown } from "markitdown-ts";
-
 import type {
   Converter,
   ConvertInput,
@@ -12,6 +10,7 @@ import type {
   ConvertWarning,
 } from "../../types";
 
+import { MarkItDown } from "../../../../vendor/converters/markitdown-ts";
 import {
   adapterError,
   corruptError,

package/src/converters/adapters/officeparser/adapter.ts

@@ -3,8 +3,6 @@
  * Uses parseOffice() v7 API with Buffer for in-memory extraction.
  */
 
-import { parseOffice } from "officeparser";
-
 import type {
   Converter,
   ConvertInput,
@@ -12,6 +10,7 @@ import type {
   ConvertWarning,
 } from "../../types";
 
+import { parseOffice } from "../../../../vendor/converters/officeparser";
 import { adapterError, corruptError, tooLargeError } from "../../errors";
 import { basenameWithoutExt } from "../../path";
 import { ADAPTER_VERSIONS } from "../../versions";

package/src/converters/versions.ts

@@ -2,10 +2,9 @@
  * Centralized converter version tracking.
  *
  * Native converters use our own versioning.
- * Adapter versions MUST match the wrapped npm package version.
- *
- * When updating npm dependencies, update these versions too.
- * Run `bun pm ls markitdown-ts officeparser` to check current versions.
+ * Adapter versions identify upstream code and security-sensitive parser versions.
+ * Update them when changing the vendored distributions or parser dependencies.
+ * Upstream identities live in vendor/converters/upstream-manifest.json.
  */
 
 /** Native converter versions (our own) */
@@ -15,10 +14,9 @@ export const NATIVE_VERSIONS = {
 } as const;
 
 /**
- * Adapter versions - MUST match npm package versions.
- * Update these when running `bun update`.
+ * Include repaired parser versions so existing converted content is invalidated.
  */
 export const ADAPTER_VERSIONS = {
-  "markitdown-ts": "0.0.8",
-  officeparser: "6.0.4",
+  "markitdown-ts": "0.0.10+xlsx.0.20.3",
+  officeparser: "7.8.0+pdfjs.6.3.289",
 } as const;

package/src/core/context-evidence.ts

@@ -1,6 +1,7 @@
 /** Strict indexed-evidence loading for Context Capsule compilation. */
 
 import type { EgressPolicy } from "../config/types";
+import type { RequestHydration } from "../pipeline/hydration";
 import type { SearchResults } from "../pipeline/types";
 import type {
   ActivationIndexSnapshot,
@@ -127,6 +128,7 @@ export interface ContextEvidenceProjectionContext {
 
 export interface ContextEvidenceCompilerDeps<P> {
   store: ContextEvidenceStore;
+  hydration?: Pick<RequestHydration, "getContentBatch" | "getChunksBatch">;
   retrieve: (request: ContextRetrievalRequest) => Promise<SearchResults>;
   projectCanonical: (
     draft: ContextCanonicalPlanDraft<ContextEvidenceValue>,
@@ -329,7 +331,8 @@ const referenceDocument = (
 export const materializeContextEvidenceCandidates = async (
   store: ContextEvidenceStore,
   candidates: ContextRetrievalCandidate[],
-  indexNameInput: string
+  indexNameInput: string,
+  hydration?: ContextEvidenceCompilerDeps<unknown>["hydration"]
 ): Promise<ContextMaterialization<ContextEvidenceValue>[]> => {
   if (candidates.length === 0) return [];
   const indexName = canonicalizeIndexName(indexNameInput);
@@ -363,8 +366,8 @@ export const materializeContextEvidenceCandidates = async (
     ),
   ];
   const [contentResult, chunksResult] = await Promise.all([
-    store.getContentBatch(mirrorHashes),
-    store.getChunksBatch(mirrorHashes),
+    (hydration ?? store).getContentBatch(mirrorHashes),
+    (hydration ?? store).getChunksBatch(mirrorHashes),
   ]);
   const contentByHash = unwrapStore(
     contentResult,
@@ -517,7 +520,8 @@ export const compileContextEvidence = async <P>(
         materializeContextEvidenceCandidates(
           deps.store,
           candidates,
-          input.indexName
+          input.indexName,
+          deps.hydration
         ),
       projectCanonical: (draft) => deps.projectCanonical(draft, fingerprints),
     }

package/src/core/job-manager.ts

@@ -1,11 +1,15 @@
+import type { SyncResult } from "../ingestion";
 /**
  * Background job manager for MCP write operations.
  *
  * @module src/core/job-manager
  */
 
-import type { SyncResult } from "../ingestion";
-
+import {
+  assertInferenceActive,
+  withOwnedInferenceScope,
+  withBackgroundInference,
+} from "../llm/inference-scope";
 import { MCP_ERRORS } from "./errors";
 import { acquireWriteLock, type WriteLockHandle } from "./file-lock";
 
@@ -78,7 +82,10 @@ export class JobManager {
   #jobs = new Map<string, JobRecord>();
   #jobAuthorizationEpochs = new Map<string, string>();
   #activeJobs = new Set<Promise<void>>();
+  #jobControllers = new Map<string, AbortController>();
   #authorizationEpoch = "egress-epoch-uninitialized";
+  #accepting = true;
+  #releaseJobLocks = new Map<string, () => Promise<void>>();
 
   constructor(options: JobManagerOptions) {
     this.#lockPath = options.lockPath;
@@ -89,8 +96,10 @@ export class JobManager {
 
   async startJob(
     type: JobType,
-    fn: () => Promise<SyncResult>
+    fn: (signal: AbortSignal) => Promise<SyncResult>
   ): Promise<string> {
+    assertInferenceActive();
+    this.#assertAccepting();
     this.#cleanupExpiredJobs();
 
     if (this.#activeJobId) {
@@ -105,14 +114,21 @@ export class JobManager {
       throw new JobError("LOCKED", MCP_ERRORS.LOCKED.message);
     }
 
+    if (!this.#accepting) {
+      await lock.release();
+      this.#assertAccepting();
+    }
+
     return this.#startJobWithLock(type, fn, lock);
   }
 
   async startJobWithLock(
     type: JobType,
     lock: WriteLockHandle,
-    fn: () => Promise<SyncResult>
+    fn: (signal: AbortSignal) => Promise<SyncResult>
   ): Promise<string> {
+    assertInferenceActive();
+    this.#assertAccepting();
     this.#cleanupExpiredJobs();
 
     if (this.#activeJobId) {
@@ -132,8 +148,10 @@ export class JobManager {
   async startTypedJobWithLock(
     type: JobType,
     lock: WriteLockHandle,
-    fn: () => Promise<JobResult>
+    fn: (signal: AbortSignal) => Promise<JobResult>
   ): Promise<string> {
+    assertInferenceActive();
+    this.#assertAccepting();
     this.#cleanupExpiredJobs();
 
     if (this.#activeJobId) {
@@ -205,10 +223,56 @@ export class JobManager {
     return { active, recent };
   }
 
+  /** Internal owner control; cancellation retains the existing failed job schema. */
+  cancelJob(jobId: string): boolean {
+    const controller = this.#jobControllers.get(jobId);
+    if (!controller) return false;
+    controller.abort();
+    return true;
+  }
+
   async shutdown(): Promise<void> {
+    this.stop();
     await Promise.allSettled(this.#activeJobs);
   }
 
+  stop(): void {
+    this.#accepting = false;
+  }
+
+  cancel(): void {
+    this.stop();
+    for (const controller of this.#jobControllers.values()) controller.abort();
+  }
+
+  /** Call only after the shared shutdown budget; late callbacks stay canceled. */
+  async failUnfinished(): Promise<void> {
+    this.cancel();
+    for (const job of this.#jobs.values()) {
+      if (job.status !== "running") continue;
+      job.status = "failed";
+      job.error = "Resident shutdown deadline exceeded";
+      job.completedAt = Date.now();
+    }
+    await Promise.allSettled(
+      Array.from(this.#releaseJobLocks.values(), (release) => release())
+    );
+  }
+
+  #assertAccepting(): void {
+    if (!this.#accepting) throw new Error("Resident runtime is shutting down");
+  }
+
+  #ownLock(jobId: string, lock: WriteLockHandle): WriteLockHandle {
+    let releasing: Promise<void> | undefined;
+    const owned = {
+      release: () =>
+        (releasing ??= Promise.resolve().then(() => lock.release())),
+    };
+    this.#releaseJobLocks.set(jobId, owned.release);
+    return owned;
+  }
+
   #track(jobPromise: Promise<void>): void {
     const tracked = jobPromise.catch(() => undefined);
     this.#activeJobs.add(tracked);
@@ -219,14 +283,16 @@ export class JobManager {
 
   async #runJob(
     job: JobRecord,
-    fn: () => Promise<SyncResult>,
+    fn: (signal: AbortSignal) => Promise<SyncResult>,
     lock: { release: () => Promise<void> }
   ): Promise<void> {
     try {
       const release = await this.#toolMutex.acquire();
       try {
         this.#assertAuthorizationEpoch(job);
-        const result = await fn();
+        assertInferenceActive();
+        const result = await fn(this.#jobControllers.get(job.id)!.signal);
+        assertInferenceActive();
         job.status = "completed";
         job.result = result;
       } catch (e) {
@@ -239,6 +305,8 @@ export class JobManager {
       job.status = "failed";
       job.error = e instanceof Error ? e.message : String(e);
     } finally {
+      this.#releaseJobLocks.delete(job.id);
+      this.#jobControllers.delete(job.id);
       job.completedAt = Date.now();
       this.#activeJobId = null;
       await lock.release().catch(() => undefined);
@@ -248,10 +316,11 @@ export class JobManager {
 
   #startJobWithLock(
     type: JobType,
-    fn: () => Promise<SyncResult>,
+    fn: (signal: AbortSignal) => Promise<SyncResult>,
     lock: WriteLockHandle
   ): string {
     const jobId = crypto.randomUUID();
+    const ownedLock = this.#ownLock(jobId, lock);
     const job: JobRecord = {
       id: jobId,
       type,
@@ -260,11 +329,15 @@ export class JobManager {
       serverInstanceId: this.#serverInstanceId,
     };
 
+    this.#jobControllers.set(jobId, new AbortController());
     this.#jobs.set(jobId, job);
     this.#jobAuthorizationEpochs.set(jobId, this.#authorizationEpoch);
     this.#activeJobId = jobId;
 
-    const jobPromise = this.#runJob(job, fn, lock);
+    const jobPromise = withOwnedInferenceScope(
+      { signal: this.#jobControllers.get(jobId)!.signal },
+      () => withBackgroundInference(() => this.#runJob(job, fn, ownedLock))
+    );
     this.#track(jobPromise);
 
     return jobId;
@@ -272,10 +345,11 @@ export class JobManager {
 
   #startTypedJobWithLock(
     type: JobType,
-    fn: () => Promise<JobResult>,
+    fn: (signal: AbortSignal) => Promise<JobResult>,
     lock: WriteLockHandle
   ): string {
     const jobId = crypto.randomUUID();
+    const ownedLock = this.#ownLock(jobId, lock);
     const job: JobRecord = {
       id: jobId,
       type,
@@ -284,11 +358,15 @@ export class JobManager {
       serverInstanceId: this.#serverInstanceId,
     };
 
+    this.#jobControllers.set(jobId, new AbortController());
     this.#jobs.set(jobId, job);
     this.#jobAuthorizationEpochs.set(jobId, this.#authorizationEpoch);
     this.#activeJobId = jobId;
 
-    const jobPromise = this.#runTypedJob(job, fn, lock);
+    const jobPromise = withOwnedInferenceScope(
+      { signal: this.#jobControllers.get(jobId)!.signal },
+      () => withBackgroundInference(() => this.#runTypedJob(job, fn, ownedLock))
+    );
     this.#track(jobPromise);
 
     return jobId;
@@ -296,14 +374,16 @@ export class JobManager {
 
   async #runTypedJob(
     job: JobRecord,
-    fn: () => Promise<JobResult>,
+    fn: (signal: AbortSignal) => Promise<JobResult>,
     lock: { release: () => Promise<void> }
   ): Promise<void> {
     try {
       const release = await this.#toolMutex.acquire();
       try {
         this.#assertAuthorizationEpoch(job);
-        const result = await fn();
+        assertInferenceActive();
+        const result = await fn(this.#jobControllers.get(job.id)!.signal);
+        assertInferenceActive();
         job.status = "completed";
         job.typedResult = result;
       } catch (e) {
@@ -316,6 +396,8 @@ export class JobManager {
       job.status = "failed";
       job.error = e instanceof Error ? e.message : String(e);
     } finally {
+      this.#releaseJobLocks.delete(job.id);
+      this.#jobControllers.delete(job.id);
       job.completedAt = Date.now();
       this.#activeJobId = null;
       await lock.release().catch(() => undefined);

package/src/core/network-boundary-inventory.ts

@@ -149,6 +149,16 @@ export const NETWORK_BOUNDARY_INVENTORY = [
     action: "remote_inference",
     enforcement: "collection_policy",
   },
+  {
+    // Collection text crosses owned local IPC only. The child receives approved
+    // model paths and a restricted environment with downloads/builds disabled.
+    id: "native-inference-worker",
+    key: "src/llm/native-worker/client.ts::child_process#1",
+    path: "src/llm/native-worker/client.ts",
+    primitive: "child_process",
+    action: null,
+    enforcement: "local_process_only",
+  },
   {
     id: "pinned-http-fetch",
     key: "src/llm/pinned-http-connection.ts::fetch#1",

package/src/core/shutdown-budget.ts

@@ -0,0 +1,45 @@
+/** Internal resident shutdown clock. Every participant shares these deadlines. */
+export const SHUTDOWN_DRAIN_MS = 5_000;
+export const SHUTDOWN_ABORT_MS = 5_000;
+export const SHUTDOWN_EXIT_MS = 1_000;
+// The detached parent must not be killed before it can reap its native child.
+export const RESIDENT_STOP_GRACE_MS = 12_000;
+
+/** Observe settlement without abandoning rejection handling or retaining a timer. */
+export async function settlesBy(
+  work: Promise<unknown>,
+  deadline: number,
+  interrupt?: AbortSignal
+): Promise<boolean> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  let interrupted: (() => void) | undefined;
+  try {
+    return await Promise.race([
+      work.then(() => true),
+      new Promise<false>((resolve) => {
+        interrupted = () => resolve(false);
+        interrupt?.addEventListener("abort", interrupted, { once: true });
+        if (interrupt?.aborted) resolve(false);
+        timer = setTimeout(
+          () => resolve(false),
+          Math.max(0, deadline - performance.now())
+        );
+      }),
+    ]);
+  } finally {
+    clearTimeout(timer);
+    if (interrupted) interrupt?.removeEventListener("abort", interrupted);
+  }
+}
+
+export function shutdownDuration(
+  value: number | undefined,
+  fallback: number
+): number {
+  const duration = value ?? fallback;
+  if (!Number.isSafeInteger(duration) || duration < 0)
+    throw new RangeError(
+      "Shutdown duration must be a nonnegative finite integer"
+    );
+  return duration;
+}