@gmickel/gno 2.4.0 → 2.6.0

package/src/core/setup-receipt.ts

@@ -12,6 +12,7 @@ import { dirname, join } from "node:path";
 import type { ActivationVerificationReceipt } from "../store/types";
 
 import { canonicalizeIndexName } from "../app/index-name";
+import { withWriteLock } from "./file-lock";
 
 export const SETUP_RECEIPT_SCHEMA_VERSION = "1.0" as const;
 
@@ -278,27 +279,33 @@ export async function persistSetupReceipt(
 ): Promise<void> {
   const receiptDir = dirname(receipt.paths.receipt);
   await mkdir(receiptDir, { recursive: true, mode: 0o700 });
-  await chmod(receiptDir, 0o700);
+  // Windows cannot reliably replace the same destination concurrently.
+  // Reuse the process-shared writer lock; each completed receipt stays atomic.
+  await withWriteLock(`${receipt.paths.receipt}.lock`, async () => {
+    await chmod(receiptDir, 0o700);
 
-  const tempPath = `${receipt.paths.receipt}.tmp.${crypto.randomUUID()}`;
-  let tempFile: Awaited<ReturnType<typeof open>> | null = null;
-  try {
-    tempFile = await open(tempPath, "wx", 0o600);
-    await tempFile.writeFile(serializeSetupReceipt(receipt), "utf8");
-    await tempFile.sync();
-    await tempFile.close();
-    tempFile = null;
-    await rename(tempPath, receipt.paths.receipt);
-    await chmod(receipt.paths.receipt, 0o600);
-  } catch (error) {
-    await tempFile?.close().catch(() => {
-      /* best-effort temporary receipt handle cleanup */
-    });
-    await unlink(tempPath).catch(() => {
-      /* best-effort temporary receipt cleanup */
-    });
-    throw error;
-  }
+    const tempPath = `${receipt.paths.receipt}.tmp.${crypto.randomUUID()}`;
+    let tempFile: Awaited<ReturnType<typeof open>> | null = null;
+    try {
+      tempFile = await open(tempPath, "wx", 0o600);
+      await tempFile.writeFile(serializeSetupReceipt(receipt), "utf8");
+      // Set permissions before publication. Opening the shared destination for
+      // chmod can prevent a concurrent atomic replacement on Windows.
+      await tempFile.chmod(0o600);
+      await tempFile.sync();
+      await tempFile.close();
+      tempFile = null;
+      await rename(tempPath, receipt.paths.receipt);
+    } catch (error) {
+      await tempFile?.close().catch(() => {
+        /* best-effort temporary receipt handle cleanup */
+      });
+      await unlink(tempPath).catch(() => {
+        /* best-effort temporary receipt cleanup */
+      });
+      throw error;
+    }
+  });
 }
 
 export async function loadSetupReceipt(

package/src/core/typed-metadata.ts

@@ -12,6 +12,10 @@ export type MetadataPredicate =
   | { op: "in" | "nin" | "all"; key: string; values: MetadataScalar[] }
   | { op: "exists"; key: string; value: boolean };
 
+export const METADATA_COVERAGE_GUIDANCE =
+  "Incomplete coverage is not proof of absence or of matching documents. Warnings describe the query scope, not a specific target. Keep requested filters unchanged. If an expected target is known, diagnose it with the same filter; otherwise report the coverage limit without inventing a target or broadening the search.";
+export const METADATA_FILTER_DESCRIPTION = `Typed custom metadata predicate; intersects existing scope. ${METADATA_COVERAGE_GUIDANCE}`;
+
 export const TYPED_METADATA_INGEST_VERSION = 7;
 export const METADATA_LIMITS = {
   keys: 64,

package/src/core/validation.ts

@@ -9,7 +9,14 @@ import { realpath } from "node:fs/promises";
 // node:os for homedir (no Bun os utils)
 import { homedir } from "node:os";
 // node:path for path utils (no Bun path utils)
-import { isAbsolute, join, posix as pathPosix, relative, sep } from "node:path";
+import {
+  isAbsolute,
+  join,
+  parse,
+  posix as pathPosix,
+  relative,
+  sep,
+} from "node:path";
 
 import { toAbsolutePath } from "../config/paths";
 
@@ -87,7 +94,7 @@ export async function validateCollectionRoot(
     DANGEROUS_ROOT_PATTERNS.map((p) => resolveRealPathSafe(p))
   );
 
-  if (dangerousRoots.includes(realPath)) {
+  if (realPath === parse(realPath).root || dangerousRoots.includes(realPath)) {
     throw new Error(`Cannot add ${inputPath}: resolves to dangerous root`);
   }
 

package/src/core/windows-private-path.ts

@@ -0,0 +1,96 @@
+/** Windows owner-only evidence storage. Paths are data, never interpolated script.
+ * Fresh Windows objects may use the token default Owner instead of its User.
+ * Only those exact owner SIDs are accepted; allowed DACL entries remain User-only. */
+// Use framework APIs directly: module auto-discovery depends on profile paths
+// deliberately absent from isolated native workers.
+const ACL = `
+$ErrorActionPreference='Stop'
+$p=$env:GNO_PRIVATE_PATH
+$attributes=[IO.File]::GetAttributes($p)
+$isDirectory=($attributes -band [IO.FileAttributes]::Directory) -ne 0
+if (($attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { throw 'Reparse private path' }
+$identity=[Security.Principal.WindowsIdentity]::GetCurrent()
+$sid=$identity.User
+$defaultOwner=$identity.Owner
+$acl=if ($isDirectory) { [IO.Directory]::GetAccessControl($p) } else { [IO.File]::GetAccessControl($p) }
+$owner=$acl.GetOwner([Security.Principal.SecurityIdentifier])
+if ($owner.Value -ne $sid.Value -and $owner.Value -ne $defaultOwner.Value) { throw 'Foreign private owner' }
+if ($env:GNO_PRIVATE_CREATE -eq '1') {
+  if (-not $isDirectory) { throw 'Private directory required' }
+  $acl=[Security.AccessControl.DirectorySecurity]::new()
+  $acl.SetOwner($sid)
+  $acl.SetAccessRuleProtection($true,$false)
+  $rule=[Security.AccessControl.FileSystemAccessRule]::new($sid,'FullControl','ContainerInherit,ObjectInherit','None','Allow')
+  $acl.AddAccessRule($rule)
+  [IO.Directory]::SetAccessControl($p,$acl)
+  if ([IO.Directory]::GetFileSystemEntries($p).Length -ne 0) { throw 'Private directory must be empty' }
+}
+$acl=if ($isDirectory) { [IO.Directory]::GetAccessControl($p) } else { [IO.File]::GetAccessControl($p) }
+$owner=$acl.GetOwner([Security.Principal.SecurityIdentifier])
+if ($owner.Value -ne $sid.Value -and $owner.Value -ne $defaultOwner.Value) { throw 'Foreign private owner' }
+$rules=$acl.GetAccessRules($true,$true,[Security.Principal.SecurityIdentifier])
+$allowed=$false
+foreach ($rule in $rules) {
+  if ($rule.AccessControlType -eq 'Allow') {
+    if ($rule.IdentityReference.Value -ne $sid.Value) { throw 'Private ACL permits another principal' }
+    if (($rule.FileSystemRights -band [Security.AccessControl.FileSystemRights]::FullControl) -eq [Security.AccessControl.FileSystemRights]::FullControl) { $allowed=$true }
+  }
+}
+if (-not $allowed) { throw 'Private owner access unavailable' }
+`;
+
+export async function windowsPrivatePath(
+  path: string,
+  create = false
+): Promise<void> {
+  if (process.platform !== "win32")
+    throw new Error("Windows ACL operation requires Windows");
+  const started = performance.now();
+  const child = Bun.spawn(
+    [
+      "powershell.exe",
+      "-NoLogo",
+      "-NoProfile",
+      "-NonInteractive",
+      "-EncodedCommand",
+      Buffer.from(ACL, "utf16le").toString("base64"),
+    ],
+    {
+      env: {
+        ...process.env,
+        GNO_PRIVATE_PATH: path,
+        GNO_PRIVATE_CREATE: create ? "1" : "0",
+      },
+      stdin: "ignore",
+      // ACL checks return no data; do not allocate an unused stdout pipe.
+      stdout: "ignore",
+      stderr: "pipe",
+      timeout: 10000,
+    }
+  );
+  const reader = child.stderr.getReader();
+  try {
+    const chunks: Uint8Array[] = [];
+    let size = 0;
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > 65536)
+        throw new Error("Private path ACL stderr exceeded 64 KiB");
+      chunks.push(value);
+    }
+    const exitCode = await child.exited;
+    if (exitCode !== 0) {
+      const stderr = new TextDecoder().decode(Buffer.concat(chunks)).trim();
+      throw new Error(
+        `Private path ACL unavailable (exit=${String(exitCode)}, signal=${String(child.signalCode)}, elapsedMs=${Math.round(performance.now() - started)}): ${stderr || "no stderr"}`
+      );
+    }
+  } finally {
+    reader.releaseLock();
+    if (child.exitCode === null && child.signalCode === null)
+      child.kill("SIGKILL");
+    await child.exited;
+  }
+}

package/src/index.ts

@@ -8,6 +8,7 @@
 
 import { runCli } from "./cli/run";
 import { resetModelManager } from "./llm/nodeLlamaCpp/lifecycle";
+import { IMPORT_CHILD_ENV } from "./sessions/import-child-env";
 
 /**
  * Cleanup models and exit.
@@ -37,8 +38,16 @@ process.on("SIGINT", () => {
   });
 });
 
-// Run CLI and exit
-runCli(process.argv)
+// A compiled executable re-run as the session import child (see
+// src/sessions/import-child.ts) serves that one request instead of the CLI.
+if (process.env[IMPORT_CHILD_ENV] === "1") {
+  const { runImportChild } = await import("./sessions/import-child");
+  await runImportChild();
+  await cleanupAndExit(0);
+}
+
+// Await module completion so pending piped stdin keeps Windows Bun alive.
+await runCli(process.argv)
   .then((code) => cleanupAndExit(interruptExitCode || code))
   .catch((err) => {
     process.stderr.write(

package/src/ingestion/compiled-context.ts

@@ -0,0 +1,15 @@
+/** Generated context is derived evidence and must not feed recursive retrieval. */
+const SIDECAR_MARKER = /"artifactKind"\s*:\s*"gno_compiled_context_sidecar"/;
+export function isCompiledContextPath(path: string): boolean {
+  return path
+    .toLowerCase()
+    .split(/[\\/]/)
+    .some((part) => part.includes(".gno-context."));
+}
+export function isCompiledContextContent(prefix: Uint8Array): boolean {
+  const text = new TextDecoder().decode(prefix).trimStart();
+  return (
+    text.startsWith("<!-- gno:compiled-context ") ||
+    (text.startsWith("{") && SIDECAR_MARKER.test(text))
+  );
+}

package/src/ingestion/sync.ts

@@ -1,12 +1,11 @@
+// node:fs/promises for realpath/stat (no Bun equivalent for canonical paths or file stats)
+import { realpath, stat } from "node:fs/promises";
 /**
  * Sync service - orchestrates file ingestion.
  * Walks collections, converts files, chunks content, updates store.
  *
  * @module src/ingestion/sync
  */
-
-// node:fs/promises for realpath/stat (no Bun equivalent for canonical paths or file stats)
-import { realpath, stat } from "node:fs/promises";
 // node:path for join (no Bun path utils)
 import { isAbsolute, join, relative, sep } from "node:path";
 
@@ -61,6 +60,10 @@ import { normalizeTag, validateTag } from "../core/tags";
 import { TYPED_METADATA_INGEST_VERSION } from "../core/typed-metadata";
 import { defaultChunker } from "./chunker";
 import { persistChunkLayout, prepareChunking } from "./chunking";
+import {
+  isCompiledContextPath,
+  isCompiledContextContent,
+} from "./compiled-context";
 import {
   extractHashtags,
   parseFrontmatter,
@@ -642,6 +645,14 @@ export class SyncService {
     store: StorePort,
     options: SyncOptions
   ): Promise<FileSyncResult> {
+    const generatedResult: FileSyncResult = {
+      relPath: entry.relPath,
+      status: "skipped",
+      errorCode: "GENERATED_CONTEXT",
+      errorMessage:
+        "Compiled context is derived material; index original sources instead",
+    };
+    if (isCompiledContextPath(entry.relPath)) return generatedResult;
     const limits = {
       maxBytes: options.limits?.maxBytes ?? DEFAULT_LIMITS.maxBytes,
       timeoutMs: options.limits?.timeoutMs ?? DEFAULT_LIMITS.timeoutMs,
@@ -733,6 +744,13 @@ export class SyncService {
         guardedBytes = sourceRead.bytes;
       }
 
+      const generatedPrefix =
+        guardedBytes?.subarray(0, 4096) ??
+        new Uint8Array(
+          await Bun.file(entry.absPath).slice(0, 4096).arrayBuffer()
+        );
+      if (isCompiledContextContent(generatedPrefix)) return generatedResult;
+
       if (recordAdapter) {
         return await processRecordContainer({
           adapter: recordAdapter,
@@ -754,11 +772,7 @@ export class SyncService {
         });
       }
 
-      const sniffBytes = guardedBytes
-        ? guardedBytes.subarray(0, Math.min(512, guardedBytes.byteLength))
-        : new Uint8Array(
-            await Bun.file(entry.absPath).slice(0, 512).arrayBuffer()
-          );
+      const sniffBytes = generatedPrefix.subarray(0, 512);
       const mime = this.mimeDetector.detect(entry.relPath, sniffBytes);
 
       const priorRecordDocuments = mustOk(
@@ -1447,6 +1461,20 @@ export class SyncService {
         store,
         syncOptions
       );
+      if (result.errorCode === "GENERATED_CONTEXT") {
+        const inactive = await this.inactivateOneAbsentSource(
+          collection,
+          store,
+          relPath,
+          projectionSourceIds,
+          { existingDoc, recordDocuments }
+        );
+        markedInactive += inactive.markedInactive;
+        results.push(
+          inactive.result.status === "error" ? inactive.result : result
+        );
+        continue;
+      }
       results.push(result);
       if (result.status === "error" || result.status === "skipped") {
         continue;
@@ -1872,6 +1900,8 @@ export class SyncService {
               store,
               syncOptions
             );
+            if (result.errorCode === "GENERATED_CONTEXT")
+              seenPaths.delete(entry.relPath);
             fileResults.push(result);
             switch (result.status) {
               case "added":
@@ -1938,6 +1968,8 @@ export class SyncService {
               store,
               syncOptions
             );
+            if (result.errorCode === "GENERATED_CONTEXT")
+              seenPaths.delete(entry.relPath);
             fileResults.push(result);
             results.push(result);
           } finally {

package/src/ingestion/walker.ts

@@ -1,3 +1,5 @@
+// node:fs - Bun has no synchronous Dirent enumeration for the guarded local walk.
+import { readdirSync } from "node:fs";
 /**
  * File walker implementation.
  * Walks collection directories using Bun.Glob (`any`) or hierarchical
@@ -5,9 +7,6 @@
  *
  * @module src/ingestion/walker
  */
-
-// node:fs - Bun has no synchronous Dirent enumeration for the guarded local walk.
-import { readdirSync } from "node:fs";
 // node:fs/promises - Bun has no realpath equivalent for symlink-safe containment.
 import { lstat, realpath } from "node:fs/promises";
 // node:path - Bun has no path manipulation module
@@ -28,6 +27,7 @@ import {
   matchesCollectionExclusion,
   matchesCollectionSubtreeExclusion,
 } from "../core/path-rules";
+import { isCompiledContextPath } from "./compiled-context";
 import { isRecordVirtualPath } from "./record-path";
 import {
   createDirectoryAvailability,
@@ -204,7 +204,8 @@ export function matchesWalkPath(
   if (
     isAbsolute(normalizedPath) ||
     DANGEROUS_PATTERN_REGEX.test(normalizedPath) ||
-    isRecordVirtualPath(normalizedPath)
+    isRecordVirtualPath(normalizedPath) ||
+    isCompiledContextPath(normalizedPath)
   ) {
     return false;
   }

package/src/llm/nodeLlamaCpp/simulator-install.ts

@@ -1,4 +1,7 @@
 /** Install the pinned simulator guard in memory, including npm/nested installs. */
+// node:url — filesystem conversion of file URLs has no Bun equivalent.
+import { fileURLToPath } from "node:url";
+
 import type {
   SimulatorBackend,
   SimulatorDependencies,
@@ -52,14 +55,15 @@ export async function verifySimulatorPackage(
 export async function loadSimulatorDependencies(
   entry: string
 ): Promise<SimulatorDependencies> {
+  const parent = fileURLToPath(entry);
   const [guards, cache, locks, binding, tensors, byteModule] =
     await Promise.all([
       import(new URL("./utils/DisposeGuard.js", entry).href),
       import(new URL("./utils/LruCache.js", entry).href),
-      import(import.meta.resolve("lifecycle-utils", entry)),
+      import(import.meta.resolve("lifecycle-utils", parent)),
       import(new URL("./bindings/types.js", entry).href),
       import(new URL("./gguf/types/GgufTensorInfoTypes.js", entry).href),
-      import(import.meta.resolve("bytes", entry)),
+      import(import.meta.resolve("bytes", parent)),
     ]);
   return {
     DisposeGuard: guards.DisposeGuard,

package/src/mcp/context.ts

@@ -66,11 +66,14 @@ export interface ToolContextSnapshot {
    * session id, so this is what keeps two modern callers apart.
    */
   requestIdentity?: string;
+  /** Stable request-receipt namespace of the authorized HTTP identity. */
+  requestNamespace?: string;
 }
 
 export interface RequestScope {
   egress: NonNullable<ToolContextSnapshot["egress"]>;
   requestIdentity?: string;
+  requestNamespace?: string;
 }
 
 export interface ToolContext {
@@ -107,6 +110,8 @@ export interface ToolContext {
   getEgressContext?: () => ToolContextSnapshot["egress"];
   /** Per-caller identity of the current request; absent on stdio. */
   getRequestIdentity?: () => string | undefined;
+  /** Request-receipt namespace of the current HTTP caller; absent on stdio. */
+  getRequestNamespace?: () => string | undefined;
   runWithEgressContext?<T>(
     egress: NonNullable<ToolContextSnapshot["egress"]>,
     operation: () => Promise<T>,
@@ -216,6 +221,7 @@ export function createToolContext(
       requestSnapshot.getStore()?.egress?.authorizationEpoch?.value,
     getEgressContext: () => requestSnapshot.getStore()?.egress,
     getRequestIdentity: () => requestSnapshot.getStore()?.requestIdentity,
+    getRequestNamespace: () => requestSnapshot.getStore()?.requestNamespace,
     runWithEgressContext<T>(
       egress: NonNullable<ToolContextSnapshot["egress"]>,
       operation: () => Promise<T>,
@@ -228,6 +234,7 @@ export function createToolContext(
           collections: config.collections,
           egress,
           requestIdentity: scope?.requestIdentity,
+          requestNamespace: scope?.requestNamespace,
         },
         operation
       );
@@ -241,6 +248,7 @@ export function createToolContext(
           collections: config.collections,
           egress: current?.egress,
           requestIdentity: current?.requestIdentity,
+          requestNamespace: current?.requestNamespace,
         },
         operation
       );

package/src/mcp/http-egress.ts

@@ -23,6 +23,8 @@ export const MCP_HTTP_EGRESS_TOOLS = {
   gno_changes: "metadata",
   gno_clear_collection_embeddings: "metadata",
   gno_context: "capsule",
+  gno_context_compiled_preview: "capsule",
+  gno_context_compiled_check: "capsule",
   gno_context_verify: "capsule",
   gno_create_folder: "metadata",
   gno_diff: "metadata",
@@ -55,8 +57,12 @@ export const MCP_HTTP_EGRESS_TOOLS = {
   gno_remember: "source",
   gno_remove_collection: "metadata",
   gno_rename_note: "metadata",
+  gno_request_status: "metadata",
   gno_search: "snippet",
   gno_section: "metadata",
+  gno_sessions_automation_run: "metadata",
+  gno_sessions_import: "metadata",
+  gno_sessions_status: "metadata",
   gno_similar: "snippet",
   gno_peek: "metadata",
   gno_status: "metadata",
@@ -159,9 +165,15 @@ const enforceMessage = (
     const params = asRecord(message.params);
     const name = params?.name;
     if (typeof name !== "string" || !(name in MCP_HTTP_EGRESS_TOOLS)) return;
-    // Trace export is authorized inside RetrievalTraceManagementService after
-    // exact trace IDs resolve to their immutable collection lineage.
-    if (name === "gno_trace_export") return;
+    // Derived exports authorize exact current lineage inside their shared
+    // runtime. Broad transport scoping would deny eligible subsets merely
+    // because another configured collection is private.
+    if (
+      name === "gno_trace_export" ||
+      name === "gno_context_compiled_preview" ||
+      name === "gno_context_compiled_check"
+    )
+      return;
     contentClass =
       MCP_HTTP_EGRESS_TOOLS[name as keyof typeof MCP_HTTP_EGRESS_TOOLS];
   } else if (

package/src/mcp/http-transport.ts

@@ -15,6 +15,7 @@ import type {
 
 import { MCP_SERVER_NAME, VERSION } from "../app/constants";
 import { EgressDeniedError } from "../core/egress-enforcement";
+import { httpMcpRequestNamespace } from "../core/request-receipts";
 import { withInferenceScope } from "../llm/inference-scope";
 import { createMcpServerSurface, type ToolContext } from "./context";
 import {
@@ -445,6 +446,7 @@ export class HttpMcpTransport {
                 this.#runtime.mcpContext.serverInstanceId,
                 context.identity
               ),
+              requestNamespace: httpMcpRequestNamespace(context.identity),
             }
           )
         : await handle();

package/src/mcp/retrieval-warnings.ts

@@ -0,0 +1,24 @@
+import type { SearchMeta } from "../pipeline/types";
+
+import { METADATA_COVERAGE_GUIDANCE } from "../core/typed-metadata";
+
+/** Text-only MCP clients need the same warnings as structured clients. */
+export function appendRetrievalWarnings(
+  text: string,
+  warnings: SearchMeta["warnings"]
+): string {
+  if (!warnings?.length) return text;
+  const lines = warnings.map(
+    ({ code, message }) => `Warning [${code}]: ${message}`
+  );
+  if (
+    warnings.some(
+      ({ code }) =>
+        code === "METADATA_COVERAGE_INCOMPLETE" ||
+        code === "METADATA_COVERAGE_UNKNOWN"
+    )
+  ) {
+    lines.push(METADATA_COVERAGE_GUIDANCE);
+  }
+  return `${text}\n\n${lines.join("\n")}`;
+}

package/src/mcp/tools/ask.ts

@@ -17,6 +17,8 @@ import { attachRetrievalTraceMetadata } from "../../core/retrieval-trace-session
 import { normalizeStructuredQueryInput } from "../../core/structured-query";
 import {
   metadataPredicateSchema,
+  METADATA_FILTER_DESCRIPTION,
+  METADATA_COVERAGE_GUIDANCE,
   normalizeMetadataPredicate,
 } from "../../core/typed-metadata";
 import { resolveModelUri } from "../../llm/registry";
@@ -44,7 +46,9 @@ export const askInputSchema = z
     candidateLimit: z.number().int().min(1).max(100).optional(),
     exclude: z.array(z.string()).optional(),
     queryModes: z.array(queryModeSchema).optional(),
-    filter: metadataPredicateSchema.optional(),
+    filter: metadataPredicateSchema
+      .optional()
+      .describe(METADATA_FILTER_DESCRIPTION),
     tagsAll: z.array(z.string()).optional(),
     tagsAny: z.array(z.string()).optional(),
     since: z.string().optional(),
@@ -111,6 +115,15 @@ export const formatVerifiedAskReadable = (
       );
     }
   }
+  if (
+    result.verification?.capsule.warnings.some(
+      (warning) => warning.code === "metadata_coverage_incomplete"
+    )
+  ) {
+    lines.push(
+      "Warning [metadata_coverage_incomplete]: " + METADATA_COVERAGE_GUIDANCE
+    );
+  }
   for (const gap of result.verification?.capsule.coverage.gaps ?? []) {
     lines.push(`Gap: ${gap.facet} (${gap.code})`);
   }