@gmickel/gno 2.6.0 → 2.7.1

package/src/serve/embed-scheduler.ts

@@ -9,6 +9,7 @@ import type { Database } from "bun:sqlite";
 
 import type { EmbeddingPort } from "../llm/types";
 import type { VectorIndexPort } from "../store/vector";
+import type { BackgroundIssue } from "./status-model";
 
 import { embedBacklog } from "../embed";
 import {
@@ -24,6 +25,15 @@ import { createVectorStatsPort } from "../store/vector";
 const DEBOUNCE_MS = 30_000; // 30 seconds
 const MAX_WAIT_MS = 300_000; // 5 minutes
 const BATCH_SIZE = 32;
+/** Consecutive failed passes after which automatic retries stop (parked). */
+export const MAX_FAILED_PASSES = 5;
+/** A pass running longer than this is reported as overrunning. */
+export const PASS_OVERRUN_MS = 15 * 60_000;
+
+/** Delay before the automatic retry that follows `failures` failed passes. */
+export function failedPassRetryDelayMs(failures: number): number {
+  return DEBOUNCE_MS * 2 ** Math.max(0, failures - 1);
+}
 
 // ─────────────────────────────────────────────────────────────────────────────
 // Types
@@ -35,6 +45,12 @@ export interface EmbedSchedulerState {
   nextRunAt?: number;
   lastRunAt?: number;
   lastResult?: EmbedResult;
+  /** Start of the pass in flight. */
+  runningSince?: number;
+  /** Failed passes since the last clean pass (0 when healthy). */
+  consecutiveFailures: number;
+  /** Automatic retries stopped; chunks stay pending for new work or `gno embed`. */
+  parked: boolean;
 }
 
 export interface EmbedResult {
@@ -52,6 +68,47 @@ export interface EmbedSchedulerDeps {
   getModelUri: () => string;
   onEmbedded?: (result: EmbedResult) => void;
   embedBacklogFn?: typeof embedBacklog;
+  /**
+   * Shared writer lease for one page of background writes; null when another
+   * writer holds it, which defers the rest of the pass instead of waiting.
+   */
+  acquireWriteLease?: () => Promise<(() => Promise<void>) | null>;
+}
+
+/** Project scheduler state onto status issues; empty while healthy. */
+export function embedSchedulerIssues(
+  state: EmbedSchedulerState,
+  now = Date.now()
+): BackgroundIssue[] {
+  const issues: BackgroundIssue[] = [];
+  if (state.parked || state.consecutiveFailures > 0) {
+    issues.push({
+      job: "embed",
+      state: state.parked ? "parked" : "failing",
+      consecutiveFailures: state.consecutiveFailures,
+      runningSeconds: null,
+    });
+  }
+  if (
+    state.runningSince !== undefined &&
+    now - state.runningSince > PASS_OVERRUN_MS
+  ) {
+    issues.push({
+      job: "embed",
+      state: "overrunning",
+      consecutiveFailures: state.consecutiveFailures,
+      runningSeconds: Math.floor((now - state.runningSince) / 1000),
+    });
+  }
+  return issues;
+}
+
+interface PassOutcome {
+  result: EmbedResult;
+  /** Present when the pass failed; the message is logged once per retry step. */
+  failure?: string;
+  /** Another writer held the lease; the rest of the backlog waits for a rerun. */
+  deferred?: boolean;
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
@@ -86,6 +143,7 @@ export function createEmbedScheduler(deps: EmbedSchedulerDeps): EmbedScheduler {
     getModelUri,
     onEmbedded,
     embedBacklogFn = embedBacklog,
+    acquireWriteLease,
   } = deps;
 
   // State
@@ -99,6 +157,9 @@ export function createEmbedScheduler(deps: EmbedSchedulerDeps): EmbedScheduler {
   let currentRun: Promise<EmbedResult | null> | null = null;
   let lastRunAt: number | null = null;
   let lastResult: EmbedResult | null = null;
+  let runningSince: number | null = null;
+  let consecutiveFailures = 0;
+  let parked = false;
   const controller = new AbortController();
 
   const stats = createVectorStatsPort(db);
@@ -110,14 +171,14 @@ export function createEmbedScheduler(deps: EmbedSchedulerDeps): EmbedScheduler {
    * 2. Filtering by docId would require joining through documents table
    * 3. Simpler to just embed all backlog when triggered
    */
-  async function runEmbed(): Promise<EmbedResult> {
+  async function runEmbed(): Promise<PassOutcome> {
     // Resolve dependencies at execution time (survives context reloads)
     const embedPort = getEmbedPort();
     const vectorIndex = getVectorIndex();
     const modelUri = getModelUri();
 
     if (!embedPort || !vectorIndex) {
-      return { embedded: 0, errors: 0 };
+      return { result: { embedded: 0, errors: 0 } };
     }
 
     let result: Awaited<ReturnType<typeof embedBacklogFn>>;
@@ -130,6 +191,7 @@ export function createEmbedScheduler(deps: EmbedSchedulerDeps): EmbedScheduler {
             vectorIndex,
             modelUri,
             batchSize: BATCH_SIZE,
+            acquireWriteTurn: acquireWriteLease,
             identityStillCurrent: () =>
               getEmbedPort() === embedPort &&
               getVectorIndex() === vectorIndex &&
@@ -138,14 +200,21 @@ export function createEmbedScheduler(deps: EmbedSchedulerDeps): EmbedScheduler {
         )
       );
     } catch (cause) {
-      if (controller.signal.aborted) return { embedded: 0, errors: 0 };
-      throw cause;
+      if (controller.signal.aborted)
+        return { result: { embedded: 0, errors: 0 } };
+      // A worker exit aborts the whole pass (a deadline fails only its page).
+      // It is a failed pass like any other, never a silently dropped rejection.
+      return {
+        result: { embedded: 0, errors: 0 },
+        failure: cause instanceof Error ? cause.message : String(cause),
+      };
     }
 
     if (!result.ok) {
-      needsRerun = true;
-      console.error("[embed-scheduler] Embed failed:", result.error.message);
-      return { embedded: 0, errors: 0 };
+      return {
+        result: { embedded: 0, errors: 0 },
+        failure: result.error.message,
+      };
     }
     if (
       getEmbedPort() !== embedPort ||
@@ -153,21 +222,42 @@ export function createEmbedScheduler(deps: EmbedSchedulerDeps): EmbedScheduler {
       getModelUri() !== modelUri
     )
       needsRerun = true;
-    if ((result.value.contentionErrors ?? 0) > 0 || result.value.errors > 0) {
-      // Provider failures and contended checkpoints remain durably pending.
+    if (result.value.deferred) needsRerun = true;
+    if (result.value.embedded > 0) onEmbedded?.(result.value);
+    const contended = result.value.contentionErrors ?? 0;
+    const deferred = result.value.deferred === true;
+    // Provider failures and contended checkpoints remain durably pending.
+    return result.value.errors > 0 || contended > 0
+      ? {
+          result: result.value,
+          deferred,
+          failure: `${result.value.errors} embedding errors, ${contended} contended writes`,
+        }
+      : { result: result.value, deferred };
+  }
+
+  /** Count a failed pass and schedule its bounded retry, logging each step once. */
+  function recordFailure(message: string): void {
+    consecutiveFailures += 1;
+    if (parked) return;
+    if (consecutiveFailures >= MAX_FAILED_PASSES) {
+      parked = true;
       console.error(
-        `[embed-scheduler] ${result.value.errors} embedding errors, ${result.value.contentionErrors ?? 0} contended writes; rescheduling`
+        `[embed-scheduler] Embed pass failed ${consecutiveFailures} times (${message}); automatic retries parked. Pending chunks stay queued for new changes or \`gno embed\`.`
       );
-      needsRerun = true;
+      return;
     }
-    if (result.value.embedded > 0) onEmbedded?.(result.value);
-    return result.value;
+    const delay = failedPassRetryDelayMs(consecutiveFailures);
+    console.error(
+      `[embed-scheduler] Embed pass failed (${consecutiveFailures}/${MAX_FAILED_PASSES}): ${message}; retrying in ${Math.round(delay / 1000)}s`
+    );
+    scheduleRun(delay);
   }
 
   /**
    * Schedule or reschedule the debounced embed run.
    */
-  function scheduleRun(): void {
+  function scheduleRun(retryDelay?: number): void {
     if (disposed) {
       return;
     }
@@ -180,7 +270,7 @@ export function createEmbedScheduler(deps: EmbedSchedulerDeps): EmbedScheduler {
 
     // Calculate delay
     const now = Date.now();
-    let delay = DEBOUNCE_MS;
+    let delay = retryDelay ?? DEBOUNCE_MS;
 
     // Check max-wait
     if (firstPendingAt !== null) {
@@ -226,17 +316,38 @@ export function createEmbedScheduler(deps: EmbedSchedulerDeps): EmbedScheduler {
       pendingCount = 0;
       firstPendingAt = null;
 
-      let result: EmbedResult;
+      runningSince = Date.now();
+      let outcome: PassOutcome;
       try {
-        result = await runEmbed();
+        outcome = await runEmbed();
         lastRunAt = Date.now();
-        lastResult = result;
+        lastResult = outcome.result;
       } finally {
         running = false;
+        runningSince = null;
       }
+      const result = outcome.result;
 
-      // Check if we need to rerun (notifications arrived while running)
       // Must be AFTER running=false so scheduleRun() actually schedules
+      if (outcome.failure !== undefined && !disposed) {
+        // A failed pass never reruns immediately: the bounded retry covers work
+        // that arrived meanwhile, and once parked only fresh work earns a pass.
+        needsRerun = false;
+        recordFailure(outcome.failure);
+        // Parked stops retries of failed work, never a lease-deferred remainder.
+        if (parked && (pendingCount > 0 || outcome.deferred)) {
+          firstPendingAt ??= Date.now();
+          scheduleRun();
+        }
+        return result;
+      }
+      // Only a pass that reached the end of the backlog cleanly clears failures.
+      if (outcome.failure === undefined && !outcome.deferred) {
+        consecutiveFailures = 0;
+        parked = false;
+      }
+
+      // Check if we need to rerun (notifications arrived while running)
       if ((needsRerun || pendingCount > 0) && !disposed) {
         needsRerun = false;
         // Set firstPendingAt if we have pending work
@@ -313,7 +424,10 @@ export function createEmbedScheduler(deps: EmbedSchedulerDeps): EmbedScheduler {
       const state: EmbedSchedulerState = {
         pendingDocCount: pendingCount,
         running,
+        consecutiveFailures,
+        parked,
       };
+      if (runningSince !== null) state.runningSince = runningSince;
 
       // Use accurate nextRunAt from timer scheduling
       if (nextRunAt !== null) {

package/src/serve/host-path-redaction.ts

@@ -0,0 +1,116 @@
+/**
+ * REST boundary for host paths: a caller the request-locality rule judges
+ * remote never receives an `absPath` field from any `/api/*` JSON response,
+ * nor the host `path` fields of the status, collection, connector, and
+ * document-mutation routes (plus `configPath`/`dbPath` on status and the
+ * `file://` `uri` of a document save). Same-host callers (the loopback Web
+ * UI) keep them for Reveal, "Open original", and the Collections page.
+ * Routes that stream original source bytes are exempt: their body is the
+ * owner's file, not an API envelope.
+ */
+
+import {
+  HOST_PATH_FIELDS,
+  OWNER_CONFIG_PATH_FIELDS,
+  withoutFields,
+} from "../core/host-paths";
+import {
+  isLocalClientRequest,
+  type RequestPeerServer,
+} from "./request-locality";
+
+const SOURCE_BYTE_ROUTES = new Set(["/api/doc-asset"]);
+const OWNER_CONFIG_FIELDS: ReadonlySet<string> = new Set([
+  ...HOST_PATH_FIELDS,
+  ...OWNER_CONFIG_PATH_FIELDS,
+]);
+/** Document mutations answer with the file's host `path`. */
+const DOC_PATH_FIELDS: ReadonlySet<string> = new Set([
+  ...HOST_PATH_FIELDS,
+  "path",
+]);
+/** A document save also names the file by a `file://` `uri`. */
+const DOC_SAVE_FIELDS: ReadonlySet<string> = new Set([
+  ...DOC_PATH_FIELDS,
+  "uri",
+]);
+const ROUTE_FIELDS = new Map<string, ReadonlySet<string>>([
+  ["/api/status", OWNER_CONFIG_FIELDS],
+  ["/api/collections", OWNER_CONFIG_FIELDS],
+  ["/api/collections/:name", OWNER_CONFIG_FIELDS],
+  ["/api/connectors", OWNER_CONFIG_FIELDS],
+  ["/api/connectors/install", OWNER_CONFIG_FIELDS],
+  ["/api/docs", DOC_PATH_FIELDS],
+  ["/api/docs/:id", DOC_SAVE_FIELDS],
+  ["/api/docs/:id/rename", DOC_PATH_FIELDS],
+  ["/api/docs/:id/move", DOC_PATH_FIELDS],
+  ["/api/docs/:id/duplicate", DOC_PATH_FIELDS],
+  ["/api/docs/:id/trash", DOC_PATH_FIELDS],
+  ["/api/docs/:id/editable-copy", DOC_PATH_FIELDS],
+  ["/api/folders", DOC_PATH_FIELDS],
+]);
+
+type RouteHandler = (
+  req: Request,
+  server: RequestPeerServer
+) => Response | Promise<Response>;
+
+/** The JSON response with every key in `fields` removed. */
+export async function redactResponseHostPaths(
+  response: Response,
+  fields: ReadonlySet<string>
+): Promise<Response> {
+  const contentType = response.headers.get("content-type") ?? "";
+  if (!contentType.includes("application/json") || response.body === null) {
+    return response;
+  }
+  const text = await response.text();
+  const body = [...fields].some((field) => text.includes(`"${field}"`))
+    ? JSON.stringify(withoutFields(JSON.parse(text) as unknown, fields))
+    : text;
+  const headers = new Headers(response.headers);
+  headers.delete("content-length");
+  return new Response(body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers,
+  });
+}
+
+const redacting =
+  (handler: RouteHandler, fields: ReadonlySet<string>): RouteHandler =>
+  async (req, server) => {
+    const response = await handler(req, server);
+    return isLocalClientRequest(req, server)
+      ? response
+      : redactResponseHostPaths(response, fields);
+  };
+
+const isMethodTable = (route: unknown): route is Record<string, unknown> =>
+  route !== null &&
+  typeof route === "object" &&
+  Object.getPrototypeOf(route) === Object.prototype;
+
+/** Wrap every `/api/*` handler in the remote host-path redaction. */
+export function withRemoteHostPathRedaction<T extends Record<string, unknown>>(
+  routes: T
+): T {
+  const wrapped: Record<string, unknown> = { ...routes };
+  for (const [path, route] of Object.entries(routes)) {
+    if (!path.startsWith("/api/") || SOURCE_BYTE_ROUTES.has(path)) continue;
+    const fields = ROUTE_FIELDS.get(path) ?? HOST_PATH_FIELDS;
+    if (typeof route === "function") {
+      wrapped[path] = redacting(route as RouteHandler, fields);
+    } else if (isMethodTable(route)) {
+      wrapped[path] = Object.fromEntries(
+        Object.entries(route).map(([method, handler]) => [
+          method,
+          typeof handler === "function"
+            ? redacting(handler as RouteHandler, fields)
+            : handler,
+        ])
+      );
+    }
+  }
+  return wrapped as T;
+}

package/src/serve/public/components/BootstrapStatus.tsx

@@ -105,9 +105,11 @@ export function BootstrapStatus({
           </CardHeader>
           <CardContent className="space-y-2 text-sm">
             <p>Total cache: {bootstrap.cache.totalSizeLabel}</p>
-            <p className="font-mono text-muted-foreground text-xs">
-              {bootstrap.cache.path}
-            </p>
+            {bootstrap.cache.path && (
+              <p className="font-mono text-muted-foreground text-xs">
+                {bootstrap.cache.path}
+              </p>
+            )}
           </CardContent>
         </Card>
 

package/src/serve/public/components/CaptureModal.tsx

@@ -75,7 +75,7 @@ export interface CaptureModalProps {
 
 interface Collection {
   name: string;
-  path: string;
+  path?: string;
 }
 
 interface CreateDocResponse {

package/src/serve/public/components/CollectionModelDialog.tsx

@@ -54,7 +54,8 @@ export interface CollectionModelDetails {
   modelSources?: Record<ModelRole, ModelSource>;
   models?: Partial<Record<ModelRole, string>>;
   name: string;
-  path: string;
+  /** Host path; omitted for remote callers. */
+  path?: string;
   pattern?: string;
   egressPolicy?: {
     schemaVersion: "1.0";
@@ -110,7 +111,7 @@ const CODE_EXT_HINTS = [
 ] as const;
 
 function collectionLooksCodeHeavy(collection: CollectionModelDetails): boolean {
-  const path = collection.path.toLowerCase();
+  const path = (collection.path ?? "").toLowerCase();
   if (
     CODE_PATH_HINTS.some(
       (hint) => path.endsWith(hint) || path.includes(`${hint}/`)
@@ -284,17 +285,19 @@ export function CollectionModelDialog({
                 active preset for the rest of the workspace.
               </DialogDescription>
             </div>
-            <div className="hidden shrink-0 max-w-[200px] space-y-1 border-border/15 border-l pl-4 lg:block">
-              <p className="font-mono text-[10px] text-muted-foreground/50 uppercase tracking-[0.15em]">
-                Path
-              </p>
-              <p
-                className="break-all font-mono text-[10px] leading-relaxed text-muted-foreground/50"
-                title={collection?.path}
-              >
-                {collection?.path}
-              </p>
-            </div>
+            {collection?.path && (
+              <div className="hidden shrink-0 max-w-[200px] space-y-1 border-border/15 border-l pl-4 lg:block">
+                <p className="font-mono text-[10px] text-muted-foreground/50 uppercase tracking-[0.15em]">
+                  Path
+                </p>
+                <p
+                  className="break-all font-mono text-[10px] leading-relaxed text-muted-foreground/50"
+                  title={collection.path}
+                >
+                  {collection.path}
+                </p>
+              </div>
+            )}
           </div>
         </DialogHeader>
 

package/src/serve/public/components/CollectionsEmptyState.tsx

@@ -13,6 +13,8 @@ export function CollectionsEmptyState({
   suggestedCollections,
   onAddCollection,
 }: CollectionsEmptyStateProps) {
+  // A remote caller's suggestions carry no host path to prefill.
+  const quickPicks = suggestedCollections.filter(({ path }) => path);
   return (
     <div className="mx-auto max-w-3xl py-16 text-center">
       <div className="mx-auto mb-4 flex size-16 items-center justify-center rounded-full bg-muted">
@@ -29,7 +31,7 @@ export function CollectionsEmptyState({
           <FolderPlusIcon className="mr-2 size-4" />
           Add Folder
         </Button>
-        {suggestedCollections.map((suggestion) => (
+        {quickPicks.map((suggestion) => (
           <Button
             key={suggestion.path}
             onClick={() => onAddCollection(suggestion.path)}
@@ -40,9 +42,9 @@ export function CollectionsEmptyState({
         ))}
       </div>
 
-      {suggestedCollections.length > 0 && (
+      {quickPicks.length > 0 && (
         <div className="grid gap-3 text-left md:grid-cols-2">
-          {suggestedCollections.map((suggestion) => (
+          {quickPicks.map((suggestion) => (
             <div
               className="rounded-xl border border-border/60 bg-background/70 p-4"
               key={`${suggestion.path}-detail`}

package/src/serve/public/components/FirstRunWizard.tsx

@@ -235,6 +235,8 @@ export function FirstRunWizard({
       ? steps[activeIndex + 1]
       : null;
   const progressValue = getStepProgress(onboarding);
+  // A remote caller's suggestions carry no host path to prefill.
+  const quickPicks = onboarding.suggestedCollections.filter(({ path }) => path);
   const isShowingRecommended = activeStep?.id === recommendedStepId;
   const runRecommendedAction = () => {
     if (!activeStep) {
@@ -277,7 +279,7 @@ export function FirstRunWizard({
             </Button>
           </div>
 
-          {onboarding.suggestedCollections.length > 0 && (
+          {quickPicks.length > 0 && (
             <div className="space-y-3">
               <div className="flex items-center justify-between gap-3">
                 <div>
@@ -295,7 +297,7 @@ export function FirstRunWizard({
                 <Badge variant="outline">Quick picks</Badge>
               </div>
               <div className="grid gap-3 md:grid-cols-2">
-                {onboarding.suggestedCollections.map((suggestion) => (
+                {quickPicks.map((suggestion) => (
                   <button
                     className="rounded-xl border border-border/70 bg-background/80 p-4 text-left shadow-sm transition-all hover:border-primary/35 hover:bg-background hover:shadow-md"
                     key={suggestion.path}

package/src/serve/public/components/sessions/SessionSearch.tsx

@@ -8,10 +8,10 @@ import {
 } from "../../../../sessions/types";
 import { apiFetch } from "../../hooks/use-api";
 import { buildDocDeepLink } from "../../lib/deep-links";
+import { renderSnippet } from "../../lib/snippet";
 import { Badge } from "../ui/badge";
 import { Button } from "../ui/button";
 import { Input } from "../ui/input";
-import { renderSessionSnippet } from "./snippet";
 
 interface SessionSearchResult {
   docid: string;
@@ -274,7 +274,7 @@ export function SessionSearch({ collections, navigate }: SessionSearchProps) {
                   {result.title || result.uri}
                 </a>
                 <p className="line-clamp-3 break-words text-muted-foreground text-sm">
-                  {renderSessionSnippet(result.snippet)}
+                  {renderSnippet(result.snippet)}
                 </p>
               </li>
             );