@gmickel/gno 2.7.0 → 2.8.0

package/src/core/windows-private-path.ts

@@ -1,6 +1,9 @@
 /** Windows owner-only evidence storage. Paths are data, never interpolated script.
  * Fresh Windows objects may use the token default Owner instead of its User.
  * Only those exact owner SIDs are accepted; allowed DACL entries remain User-only. */
+// bun:ffi — reading a security descriptor in-process needs advapi32; Bun has no ACL API
+import { dlopen, FFIType } from "bun:ffi";
+
 // Use framework APIs directly: module auto-discovery depends on profile paths
 // deliberately absent from isolated native workers.
 const ACL = `
@@ -65,7 +68,8 @@ export async function windowsPrivatePath(
       // ACL checks return no data; do not allocate an unused stdout pipe.
       stdout: "ignore",
       stderr: "pipe",
-      timeout: 10000,
+      // A cold PowerShell start on a loaded host can take over 10s.
+      timeout: 30000,
     }
   );
   const reader = child.stderr.getReader();
@@ -94,3 +98,134 @@ export async function windowsPrivatePath(
     await child.exited;
   }
 }
+
+const OWNER_AND_DACL = 0x1 | 0x4; // OWNER_ | DACL_SECURITY_INFORMATION
+const FILE_ATTRIBUTE_DIRECTORY = 0x10;
+const FILE_ATTRIBUTE_REPARSE_POINT = 0x4_00;
+const INVALID_FILE_ATTRIBUTES = 0xff_ff_ff_ff;
+const SECURITY_DESCRIPTOR_MAX_BYTES = 65_536;
+
+interface Win32Security {
+  getFileAttributes: (path: Uint8Array) => number;
+  getFileSecurity: (
+    path: Uint8Array,
+    info: number,
+    descriptor: Uint8Array,
+    length: number,
+    needed: Uint32Array
+  ) => number;
+}
+
+let win32Security: Win32Security | null | undefined;
+
+function loadWin32Security(): Win32Security | null {
+  if (win32Security !== undefined) return win32Security;
+  try {
+    const kernel32 = dlopen("kernel32.dll", {
+      GetFileAttributesW: { args: [FFIType.ptr], returns: FFIType.u32 },
+    });
+    const advapi32 = dlopen("advapi32.dll", {
+      GetFileSecurityW: {
+        args: [FFIType.ptr, FFIType.u32, FFIType.ptr, FFIType.u32, FFIType.ptr],
+        returns: FFIType.i32,
+      },
+    });
+    win32Security = {
+      getFileAttributes: kernel32.symbols.GetFileAttributesW,
+      getFileSecurity: advapi32.symbols.GetFileSecurityW,
+    };
+  } catch {
+    win32Security = null;
+  }
+  return win32Security;
+}
+
+/**
+ * Owner and DACL of a directory that is not a reparse point, read in-process
+ * (no PowerShell). Null when unavailable: callers treat that as unverified.
+ */
+export function windowsDirectoryDescriptor(path: string): Uint8Array | null {
+  if (process.platform !== "win32") return null;
+  const win32 = loadWin32Security();
+  if (!win32) return null;
+  const widePath = Buffer.from(`${path}\0`, "utf16le");
+  const attributes = win32.getFileAttributes(widePath);
+  if (
+    attributes === INVALID_FILE_ATTRIBUTES ||
+    (attributes & FILE_ATTRIBUTE_DIRECTORY) === 0 ||
+    (attributes & FILE_ATTRIBUTE_REPARSE_POINT) !== 0
+  ) {
+    return null;
+  }
+  const descriptor = new Uint8Array(SECURITY_DESCRIPTOR_MAX_BYTES);
+  const needed = new Uint32Array(1);
+  const ok = win32.getFileSecurity(
+    widePath,
+    OWNER_AND_DACL,
+    descriptor,
+    descriptor.length,
+    needed
+  );
+  const length = needed[0] ?? 0;
+  if (ok === 0 || length === 0 || length > descriptor.length) return null;
+  return descriptor.slice(0, length);
+}
+
+const SE_DACL_PRESENT = 0x4;
+const SE_SELF_RELATIVE = 0x80_00;
+const ACCESS_ALLOWED_ACE_TYPE = 0;
+const ACCESS_DENIED_ACE_TYPE = 1;
+const FILE_ALL_ACCESS = 0x1f_01_ff;
+
+function sidAt(view: DataView, offset: number): Uint8Array | null {
+  if (offset === 0 || offset + 8 > view.byteLength) return null;
+  const end = offset + 8 + 4 * view.getUint8(offset + 1);
+  if (end > view.byteLength) return null;
+  return new Uint8Array(view.buffer, view.byteOffset + offset, end - offset);
+}
+
+function sameBytes(left: Uint8Array, right: Uint8Array): boolean {
+  return left.length === right.length && left.every((b, i) => b === right[i]);
+}
+
+/**
+ * Self-relative descriptor whose owner is the only principal any allow entry
+ * names, with full control among them. Stricter than the PowerShell policy
+ * (which also accepts a token default owner): a false here only means the
+ * authoritative check runs.
+ */
+export function isOwnerOnlyDescriptor(descriptor: Uint8Array): boolean {
+  const view = new DataView(
+    descriptor.buffer,
+    descriptor.byteOffset,
+    descriptor.byteLength
+  );
+  if (view.byteLength < 20 || view.getUint8(0) !== 1) return false;
+  const control = view.getUint16(2, true);
+  if ((control & SE_SELF_RELATIVE) === 0 || (control & SE_DACL_PRESENT) === 0)
+    return false;
+  const owner = sidAt(view, view.getUint32(4, true));
+  const dacl = view.getUint32(16, true);
+  if (!owner || dacl === 0 || dacl + 8 > view.byteLength) return false;
+  const aclEnd = dacl + view.getUint16(dacl + 2, true);
+  if (aclEnd > view.byteLength) return false;
+  let offset = dacl + 8;
+  let fullControl = false;
+  for (let ace = view.getUint16(dacl + 4, true); ace > 0; ace--) {
+    if (offset + 8 > aclEnd) return false;
+    const type = view.getUint8(offset);
+    const size = view.getUint16(offset + 2, true);
+    if (size < 8 || offset + size > aclEnd) return false;
+    if (type === ACCESS_ALLOWED_ACE_TYPE) {
+      const sid = sidAt(view, offset + 8);
+      if (!sid || offset + 8 + sid.length > offset + size) return false;
+      if (!sameBytes(sid, owner)) return false;
+      const mask = view.getUint32(offset + 4, true);
+      if ((mask & FILE_ALL_ACCESS) === FILE_ALL_ACCESS) fullControl = true;
+    } else if (type !== ACCESS_DENIED_ACE_TYPE) {
+      return false;
+    }
+    offset += size;
+  }
+  return fullControl;
+}

package/src/embed/backlog.ts

@@ -19,6 +19,7 @@ import type { AcquireWriteTurn } from "./retry";
 import {
   assertInferenceActive,
   isBackgroundInference,
+  withInferencePage,
 } from "../llm/inference-scope";
 import { formatDocForEmbedding } from "../pipeline/contextual";
 import { err, ok } from "../store/types";
@@ -221,16 +222,27 @@ export async function embedBacklog(
       }
 
       const beforeEmbedded = embedded;
-      const batchStoreResult = await embedAndStoreBatch({
-        embedPort,
-        vectorIndex,
-        items: batch,
-        modelUri,
-        embedFingerprint,
-        identityStillCurrent: deps.identityStillCurrent,
-        statsPort,
-        acquireWriteTurn: deps.acquireWriteTurn,
-      });
+      const storePage = () =>
+        embedAndStoreBatch({
+          embedPort,
+          vectorIndex,
+          items: batch,
+          modelUri,
+          embedFingerprint,
+          identityStillCurrent: deps.identityStillCurrent,
+          statsPort,
+          acquireWriteTurn: deps.acquireWriteTurn,
+        });
+      const batchStoreResult = background
+        ? await withInferencePage(storePage)
+        : await storePage();
+      if (!batchStoreResult) {
+        // Past its deadline: this page stays pending for the next pass.
+        errors += batch.length;
+        deps.onProgress?.(embedded, errors);
+        await Bun.sleep(0);
+        continue;
+      }
       if (batchStoreResult.deferred)
         return ok({ embedded, errors, contentionErrors, deferred: true });
       embedded += batchStoreResult.embedded;

package/src/embed/variant-backlog.ts

@@ -5,6 +5,7 @@ import type { EmbedBacklogDeps, EmbedBacklogResult } from "./backlog";
 import {
   assertInferenceActive,
   isBackgroundInference,
+  withInferencePage,
 } from "../llm/inference-scope";
 import { err, ok } from "../store/types";
 import { getVectorStatsDatabase } from "../store/vector/stats";
@@ -38,7 +39,20 @@ export async function embedVariantBacklog(
   const total = { embedded: 0, errors: 0, contentionErrors: 0 };
   let after: { documentId: number; seq: number } | undefined;
   try {
-    while (identityStillCurrent()) {
+    while (true) {
+      // A failed request drops the port's cached identity (a timed-out native
+      // worker is retired); reload it so one failed page cannot end the pass.
+      if (background) {
+        const reloaded = await withInferencePage(() => deps.embedPort.init());
+        // Without an identity the pass cannot continue. Failing it schedules
+        // the scheduler's bounded retry instead of ending with pages pending.
+        if (!reloaded?.ok)
+          throw new Error(
+            reloaded?.error.message ??
+              "Embedding model reload exceeded its inference deadline"
+          );
+      }
+      if (!identityStillCurrent()) break;
       assertInferenceActive();
       const pending = variantBacklogPage(deps, store, batchSize, after);
       if (!pending.length) break;
@@ -54,14 +68,25 @@ export async function embedVariantBacklog(
                 .get(owner.documentId, deps.collection!)
           )
         : pending;
-      let result = await embedVariantBatch({
-        store,
-        embedPort: deps.embedPort,
-        owners,
-        identityStillCurrent,
-        force: deps.force,
-        acquireWriteTurn: deps.acquireWriteTurn,
-      });
+      const embedPage = () =>
+        embedVariantBatch({
+          store,
+          embedPort: deps.embedPort,
+          owners,
+          identityStillCurrent,
+          force: deps.force,
+          acquireWriteTurn: deps.acquireWriteTurn,
+        });
+      let result = background
+        ? await withInferencePage(embedPage)
+        : await embedPage();
+      if (!result) {
+        // Past its deadline: this page stays pending for the next pass.
+        total.errors += owners.length;
+        deps.onProgress?.(total.embedded, total.errors);
+        await Bun.sleep(0);
+        continue;
+      }
       if (result.deferred) return ok({ ...total, deferred: true });
       total.embedded += result.embedded;
       total.errors += result.errors;

package/src/index.ts

@@ -18,14 +18,27 @@ import { IMPORT_CHILD_ENV } from "./sessions/import-child-env";
  * is the flush that actually waits. A closed consumer (EPIPE) settles
  * through the callback or the 'error' event.
  */
+const pendingFlushes = new WeakMap<NodeJS.WriteStream, Promise<void>>();
+
+/**
+ * Concurrent exit paths (normal completion racing a SIGINT) share one flush:
+ * a second caller must wait for the drain the first end() started, not treat
+ * the already-ended stream as flushed and exit mid-write.
+ */
 function flushStream(stream: NodeJS.WriteStream): Promise<void> {
+  const pending = pendingFlushes.get(stream);
+  if (pending) {
+    return pending;
+  }
   if (stream.destroyed || stream.writableEnded) {
     return Promise.resolve();
   }
-  return new Promise((resolve) => {
+  const flush = new Promise<void>((resolve) => {
     stream.once("error", () => resolve());
     stream.end(() => resolve());
   });
+  pendingFlushes.set(stream, flush);
+  return flush;
 }
 
 /**

package/src/ingestion/graph-reconciliation.ts

@@ -13,15 +13,25 @@ import {
   normalizeRelationEdgeType,
   normalizeRelationTarget,
 } from "../core/change-diff";
+import { LINK_RESOLVER_VERSION } from "../core/link-workspace";
 import {
   normalizeMarkdownPath,
   normalizeWikiName,
   parseTargetParts,
 } from "../core/links";
+import {
+  createInMemoryWorkspaceResolver,
+  membershipsFromCollectionRows,
+} from "../store/sqlite/workspace-link-resolver";
 import { parseFrontmatter } from "./frontmatter";
 
-const VERSION = 1;
+/**
+ * Projection version. 2: workspace-wide wiki resolution; a stored version
+ * mismatch forces one full projection on the first sync after upgrade.
+ */
+const VERSION = 2;
 const EDGE_TYPE = /^[a-z][a-z0-9_]*$/;
+const RELATIVE_REF = /^\.\.?\//;
 type ProjectionError = { relPath: string; code: string; message: string };
 
 function identity(doc: DocumentRow): GraphReferenceDocument {
@@ -38,8 +48,27 @@ function identity(doc: DocumentRow): GraphReferenceDocument {
   };
 }
 
-/** Insert once in catalog order: preserves legacy Array.find ambiguity precedence. */
-function relationResolver(docs: GraphReferenceDocument[]) {
+/**
+ * Insert once in catalog order: preserves legacy Array.find ambiguity precedence.
+ * Plain wiki-style targets from a document inside a link workspace use the
+ * shared workspace ranking (a tie resolves to nothing); URIs, docids,
+ * collection-qualified paths and relative markdown keep their contracts.
+ */
+function relationResolver(
+  docs: GraphReferenceDocument[],
+  memberships: ReturnType<typeof membershipsFromCollectionRows>
+) {
+  const workspace = createInMemoryWorkspaceResolver(
+    memberships,
+    docs.map((doc) => ({
+      id: doc.documentId,
+      docid: doc.docid,
+      collection: doc.collection,
+      relPath: doc.relPath,
+      title: doc.title,
+    }))
+  );
+  const byId = new Map(docs.map((doc) => [doc.documentId, doc]));
   const docids = new Map<string, GraphReferenceDocument>();
   const uris = new Map<string, GraphReferenceDocument>();
   const paths = new Map<string, GraphReferenceDocument>();
@@ -84,14 +113,27 @@ function relationResolver(docs: GraphReferenceDocument[]) {
         localWiki.get(`${parts.collection}\0${key}`)
       );
     const relativePath = normalizeMarkdownPath(parts.ref, source.relPath);
-    return (
-      (relativePath
-        ? paths.get(`${source.collection}/${relativePath}`)
-        : undefined) ??
-      paths.get(parts.ref) ??
-      localWiki.get(`${source.collection}\0${key}`) ??
-      wiki.get(key)
-    );
+    const relativeHit = relativePath
+      ? paths.get(`${source.collection}/${relativePath}`)
+      : undefined;
+    const ranked = workspace(source, key);
+    if (ranked === undefined) {
+      // Source outside any link workspace: the collection-scoped contract.
+      return (
+        relativeHit ??
+        paths.get(parts.ref) ??
+        localWiki.get(`${source.collection}\0${key}`) ??
+        wiki.get(key)
+      );
+    }
+    // Inside a workspace only the preserved contracts bypass the shared
+    // ranking: a collection-qualified path (`collection/relPath`) and an
+    // explicitly relative Markdown path (`./x.md`, `../x.md`). Every other
+    // name or path resolves exactly as the shared link resolver does.
+    const qualified = paths.get(parts.ref);
+    if (qualified) return qualified;
+    if (RELATIVE_REF.test(parts.ref) && relativeHit) return relativeHit;
+    return ranked?.traversable ? byId.get(ranked.target.id) : undefined;
   };
 }
 
@@ -105,12 +147,23 @@ export async function projectGraph(
   try {
     const graph = store.graphReferenceStore?.();
     let fingerprint = "";
+    // Partial ports (tests, adapters without collections) resolve links
+    // collection-scoped; the SQLite store always reports memberships.
+    const collections =
+      typeof store.getCollections === "function"
+        ? await store.getCollections()
+        : undefined;
+    if (collections && !collections.ok)
+      throw new Error(collections.error.message);
+    const memberships = membershipsFromCollectionRows(collections?.value ?? []);
     if (graph) {
-      const collections = await store.getCollections();
-      if (!collections.ok) throw new Error(collections.error.message);
+      if (!collections) throw new Error("Graph projection needs collections");
+      // Effective workspace membership (roots, nested vaults, real paths) is
+      // part of each collection row, so a membership change re-projects.
       fingerprint = new Bun.CryptoHasher("sha256")
         .update(
           JSON.stringify({
+            resolver: LINK_RESOLVER_VERSION,
             rules: options.contentTypeRules ?? [],
             collections: collections.value
               .map(({ syncedAt: _syncedAt, ...config }) => config)
@@ -138,7 +191,15 @@ export async function projectGraph(
       state.inProgress ||
       state.version !== VERSION ||
       state.configFingerprint !== fingerprint;
-    const resolve = relationResolver(current);
+    // An existing graph whose resolver or collection membership changed is
+    // rebuilt in full; report it so the fallback is never silent.
+    if (!forceFull && state && state.version !== null) {
+      if (state.version !== VERSION)
+        options.onGraphRebuild?.("resolver-upgrade");
+      else if (state.configFingerprint !== fingerprint)
+        options.onGraphRebuild?.("collections-changed");
+    }
+    const resolve = relationResolver(current, memberships);
     let selected: Set<number> | undefined;
     if (!full && graph) {
       selected = new Set(requestedSources);
@@ -165,7 +226,8 @@ export async function projectGraph(
         ))
           selected.add(id);
         const resolveOld = relationResolver(
-          previous.map((row) => row.document)
+          previous.map((row) => row.document),
+          memberships
         );
         for (const row of previous) {
           const source = currentById.get(row.document.documentId);

package/src/ingestion/source-availability/darwin-path.ts

@@ -1,6 +1,7 @@
 /**
  * Metadata-free recognition of the macOS File Provider layouts covered by the
- * physical fn-118 evidence. This is intentionally narrower than all paths on
+ * physical evidence in research/file-provider/ (fn-118; Google Shared drives in
+ * fn-179). This is intentionally narrower than all paths on
  * Darwin: unknown storage must not inherit a no-materialization guarantee.
  */
 
@@ -43,8 +44,13 @@ export function classifyDarwinFileProviderPath(
     return "unsupported";
   }
   const domain = parts[2];
-  if (domain?.startsWith("GoogleDrive-") && parts[3] === "My Drive") {
-    return "google-drive";
+  if (domain?.startsWith("GoogleDrive-")) {
+    const isMyDrive = parts[3] === "My Drive";
+    const isSharedDrive =
+      parts[3] === "Shared drives" &&
+      typeof parts[4] === "string" &&
+      parts[4].length > 0;
+    return isMyDrive || isSharedDrive ? "google-drive" : "unsupported";
   }
   if (
     domain?.startsWith("OneDrive-") &&

package/src/ingestion/sync.ts

@@ -2069,6 +2069,19 @@ export class SyncService {
       }
     }
 
+    // Nested vaults (their own `.obsidian/`) are discovered from the synced
+    // document directories; a change re-fingerprints the graph projection.
+    const nestedRefresh = await store.refreshCollectionNestedWorkspaces?.(
+      collection.name
+    );
+    if (nestedRefresh && !nestedRefresh.ok) {
+      errors.push({
+        relPath: "(link workspace)",
+        code: nestedRefresh.error.code,
+        message: nestedRefresh.error.message,
+      });
+    }
+
     if (syncOptions.projectTypedEdges !== false) {
       errors.push(...(await this.projectTypedEdges(store, syncOptions)));
     }
@@ -2123,8 +2136,15 @@ export class SyncService {
       results.push(result);
     }
 
+    let graphRebuild: SyncResult["graphRebuild"];
     if (results.length > 0) {
-      const projectionErrors = await this.projectTypedEdges(store, options);
+      const projectionErrors = await this.projectTypedEdges(store, {
+        ...options,
+        onGraphRebuild: (reason) => {
+          graphRebuild = reason;
+          options.onGraphRebuild?.(reason);
+        },
+      });
       results.at(-1)?.errors.push(...projectionErrors);
     }
 
@@ -2145,6 +2165,7 @@ export class SyncService {
       ...(prepared.rechunkedMirrors
         ? { rechunkedMirrors: prepared.rechunkedMirrors }
         : {}),
+      ...(graphRebuild ? { graphRebuild } : {}),
       totalDurationMs: Date.now() - startTime,
       totalFilesProcessed: totals.processed,
       totalFilesAdded: totals.added,

package/src/ingestion/types.ts

@@ -161,7 +161,19 @@ export interface ChunkerPort {
 // ─────────────────────────────────────────────────────────────────────────────
 
 /** Sync options */
+/** Why a sync rebuilt the whole link graph instead of reconciling it. */
+export type GraphRebuildReason =
+  /** Link resolution semantics changed (first sync after an upgrade). */
+  | "resolver-upgrade"
+  /** Collection settings changed, including link workspace membership. */
+  | "collections-changed";
+
 export interface SyncOptions {
+  /**
+   * Internal: called when graph reconciliation cannot proceed incrementally
+   * and falls back to a full projection of an existing graph.
+   */
+  onGraphRebuild?: (reason: GraphRebuildReason) => void;
   /** Index-wide configured policy; omitted means the existing defaults. */
   chunking?: Partial<ChunkingParams>;
   /** Internal token passed from an outer sync; never a public CLI override. */
@@ -298,6 +310,8 @@ export interface CollectionSyncResult {
 export interface SyncResult {
   /** Cached layouts updated independently of source-refresh file counters. */
   rechunkedMirrors?: number;
+  /** Present when the link graph was rebuilt in full rather than reconciled. */
+  graphRebuild?: GraphRebuildReason;
   collections: CollectionSyncResult[];
   totalDurationMs: number;
   totalFilesProcessed: number;

package/src/llm/inference-scope.ts

@@ -168,6 +168,25 @@ export function withOwnedInferenceScope<T>(
   return scope.run({}, () => withInferenceScope(options, operation));
 }
 
+/**
+ * Best-effort inference (one page of a background pass, or query expansion):
+ * an inference deadline inside it fails only this operation (undefined),
+ * leaving the enclosing scope active. Cancellation, or a deadline of the
+ * enclosing scope itself, still throws.
+ */
+export async function withInferencePage<T>(
+  operation: () => Promise<T>
+): Promise<T | undefined> {
+  try {
+    return await withOwnedInferenceScope(inferenceOptions(), operation);
+  } catch (cause) {
+    if (!(cause instanceof DOMException && cause.name === "TimeoutError"))
+      throw cause;
+    assertInferenceActive();
+    return undefined;
+  }
+}
+
 /** A cancelled queued reader releases only its eventual grant, never another caller's. */
 export async function acquireInferencePermit(
   acquire: () => Promise<() => void>

package/src/mcp/http-egress.ts

@@ -124,6 +124,21 @@ const collectionFromRef = (value: unknown): string | null => {
   return value.slice(0, slash).trim().toLowerCase() || null;
 };
 
+/**
+ * Tools whose results follow resolved graph edges. Links resolve across a
+ * link workspace, so a ref's own collection does not bound the result: the
+ * scope is the explicit collection argument (else every collection) plus the
+ * collection of every referenced document.
+ */
+const GRAPH_RESULT_TOOLS = new Set([
+  "gno_backlinks",
+  "gno_graph",
+  "gno_graph_neighbors",
+  "gno_graph_path",
+  "gno_graph_query",
+  "gno_impact",
+]);
+
 const requestedCollections = (
   params: unknown,
   collections: readonly Collection[]
@@ -134,17 +149,41 @@ const requestedCollections = (
 
   const names = new Set<string>();
   const direct = args.collection;
-  if (typeof direct === "string") names.add(direct.trim().toLowerCase());
-  if (record?.name === "gno_audit" && Array.isArray(args.collections)) {
+  // Handlers treat a blank collection as omitted, so it must not count as a
+  // scope here either (a graph call with one is authorized as unscoped).
+  if (typeof direct === "string" && direct.trim())
+    names.add(direct.trim().toLowerCase());
+  if (
+    (record?.name === "gno_audit" || record?.name === "gno_impact") &&
+    Array.isArray(args.collections)
+  ) {
     for (const value of args.collections) {
       if (typeof value !== "string") continue;
       const normalized = value.trim().toLowerCase();
       if (normalized) names.add(normalized);
     }
   }
+  const graphTool =
+    typeof record?.name === "string" && GRAPH_RESULT_TOOLS.has(record.name);
+  // A graph result spans every collection a link resolves into: without an
+  // explicit scope, authorize them all.
+  // `gno_similar` with crossCollection returns documents from every collection.
+  const crossCollectionSimilar =
+    record?.name === "gno_similar" && args.crossCollection === true;
+  if ((graphTool && names.size === 0) || crossCollectionSimilar) {
+    for (const { name } of collections) names.add(name);
+  }
+  // The referenced documents' own collections are always authorized too:
+  // graph tools serialize the target's metadata even when the result scope
+  // is narrower. A graph-tool ref whose collection cannot be read without
+  // the index (a docid) authorizes every collection (fail closed).
   for (const key of ["ref", "target", "from", "to", "root", "uri"]) {
-    const collection = collectionFromRef(args[key]);
+    const value = args[key];
+    const collection = collectionFromRef(value);
     if (collection) names.add(collection);
+    else if (graphTool && typeof value === "string" && value.trim()) {
+      for (const { name } of collections) names.add(name);
+    }
   }
   if (Array.isArray(args.refs)) {
     for (const ref of args.refs) {

package/src/mcp/tools/audit.ts

@@ -5,7 +5,11 @@ import { z } from "zod";
 import type { AuditCategory, AuditReport } from "../../core/audit";
 import type { ToolContext } from "../server";
 
-import { AUDIT_CATEGORIES } from "../../core/audit";
+import {
+  AUDIT_CATEGORIES,
+  AUDIT_MAX_FINDINGS_ALL,
+  AUDIT_MAX_FINDINGS_LIMIT,
+} from "../../core/audit";
 import { runWorkspaceAudit } from "../../core/audit-workspace";
 import { normalizeTag, validateTag } from "../../core/tags";
 import { normalizeCollectionName } from "../../core/validation";
@@ -19,7 +23,12 @@ export const auditInputSchema = z
     collections: z.array(z.string().min(1)).max(256).default([]),
     paths: z.array(z.string().min(1)).max(256).default([]),
     tags: z.array(z.string().min(1)).max(256).default([]),
-    maxFindings: z.number().int().min(1).max(1000).default(100),
+    maxFindings: z
+      .union([
+        z.number().int().min(1).max(AUDIT_MAX_FINDINGS_LIMIT),
+        z.literal(AUDIT_MAX_FINDINGS_ALL),
+      ])
+      .default(100),
     maxAgeDays: z.number().int().min(1).optional(),
     orphanRoots: z.array(z.string().min(1)).max(256).default([]),
     orphanIgnorePrefixes: z.array(z.string().min(1)).max(256).default([]),

package/src/mcp/tools/changes.ts

@@ -24,6 +24,7 @@ export const diffInputSchema = z.object({
 
 export const impactInputSchema = z.object({
   ref: z.string().trim().min(1).max(4096),
+  collections: z.array(z.string().trim().min(1)).max(256).optional(),
   maxDepth: z.number().int().min(1).max(6).default(3),
   maxNodes: z.number().int().min(1).max(1000).default(100),
   maxEdges: z.number().int().min(1).max(5000).default(250),