@gmickel/gno 2.7.1 → 2.8.1

package/src/llm/inference-scope.ts

@@ -169,9 +169,10 @@ export function withOwnedInferenceScope<T>(
 }
 
 /**
- * One page of a background pass: an inference deadline inside it fails only
- * that page (undefined), leaving the pass scope active for later pages.
- * Cancellation, or a deadline of the enclosing scope itself, still throws.
+ * Best-effort inference (one page of a background pass, or query expansion):
+ * an inference deadline inside it fails only this operation (undefined),
+ * leaving the enclosing scope active. Cancellation, or a deadline of the
+ * enclosing scope itself, still throws.
  */
 export async function withInferencePage<T>(
   operation: () => Promise<T>

package/src/mcp/http-egress.ts

@@ -124,6 +124,21 @@ const collectionFromRef = (value: unknown): string | null => {
   return value.slice(0, slash).trim().toLowerCase() || null;
 };
 
+/**
+ * Tools whose results follow resolved graph edges. Links resolve across a
+ * link workspace, so a ref's own collection does not bound the result: the
+ * scope is the explicit collection argument (else every collection) plus the
+ * collection of every referenced document.
+ */
+const GRAPH_RESULT_TOOLS = new Set([
+  "gno_backlinks",
+  "gno_graph",
+  "gno_graph_neighbors",
+  "gno_graph_path",
+  "gno_graph_query",
+  "gno_impact",
+]);
+
 const requestedCollections = (
   params: unknown,
   collections: readonly Collection[]
@@ -134,17 +149,41 @@ const requestedCollections = (
 
   const names = new Set<string>();
   const direct = args.collection;
-  if (typeof direct === "string") names.add(direct.trim().toLowerCase());
-  if (record?.name === "gno_audit" && Array.isArray(args.collections)) {
+  // Handlers treat a blank collection as omitted, so it must not count as a
+  // scope here either (a graph call with one is authorized as unscoped).
+  if (typeof direct === "string" && direct.trim())
+    names.add(direct.trim().toLowerCase());
+  if (
+    (record?.name === "gno_audit" || record?.name === "gno_impact") &&
+    Array.isArray(args.collections)
+  ) {
     for (const value of args.collections) {
       if (typeof value !== "string") continue;
       const normalized = value.trim().toLowerCase();
       if (normalized) names.add(normalized);
     }
   }
+  const graphTool =
+    typeof record?.name === "string" && GRAPH_RESULT_TOOLS.has(record.name);
+  // A graph result spans every collection a link resolves into: without an
+  // explicit scope, authorize them all.
+  // `gno_similar` with crossCollection returns documents from every collection.
+  const crossCollectionSimilar =
+    record?.name === "gno_similar" && args.crossCollection === true;
+  if ((graphTool && names.size === 0) || crossCollectionSimilar) {
+    for (const { name } of collections) names.add(name);
+  }
+  // The referenced documents' own collections are always authorized too:
+  // graph tools serialize the target's metadata even when the result scope
+  // is narrower. A graph-tool ref whose collection cannot be read without
+  // the index (a docid) authorizes every collection (fail closed).
   for (const key of ["ref", "target", "from", "to", "root", "uri"]) {
-    const collection = collectionFromRef(args[key]);
+    const value = args[key];
+    const collection = collectionFromRef(value);
     if (collection) names.add(collection);
+    else if (graphTool && typeof value === "string" && value.trim()) {
+      for (const { name } of collections) names.add(name);
+    }
   }
   if (Array.isArray(args.refs)) {
     for (const ref of args.refs) {

package/src/mcp/tools/audit.ts

@@ -5,7 +5,11 @@ import { z } from "zod";
 import type { AuditCategory, AuditReport } from "../../core/audit";
 import type { ToolContext } from "../server";
 
-import { AUDIT_CATEGORIES } from "../../core/audit";
+import {
+  AUDIT_CATEGORIES,
+  AUDIT_MAX_FINDINGS_ALL,
+  AUDIT_MAX_FINDINGS_LIMIT,
+} from "../../core/audit";
 import { runWorkspaceAudit } from "../../core/audit-workspace";
 import { normalizeTag, validateTag } from "../../core/tags";
 import { normalizeCollectionName } from "../../core/validation";
@@ -19,7 +23,12 @@ export const auditInputSchema = z
     collections: z.array(z.string().min(1)).max(256).default([]),
     paths: z.array(z.string().min(1)).max(256).default([]),
     tags: z.array(z.string().min(1)).max(256).default([]),
-    maxFindings: z.number().int().min(1).max(1000).default(100),
+    maxFindings: z
+      .union([
+        z.number().int().min(1).max(AUDIT_MAX_FINDINGS_LIMIT),
+        z.literal(AUDIT_MAX_FINDINGS_ALL),
+      ])
+      .default(100),
     maxAgeDays: z.number().int().min(1).optional(),
     orphanRoots: z.array(z.string().min(1)).max(256).default([]),
     orphanIgnorePrefixes: z.array(z.string().min(1)).max(256).default([]),

package/src/mcp/tools/changes.ts

@@ -24,6 +24,7 @@ export const diffInputSchema = z.object({
 
 export const impactInputSchema = z.object({
   ref: z.string().trim().min(1).max(4096),
+  collections: z.array(z.string().trim().min(1)).max(256).optional(),
   maxDepth: z.number().int().min(1).max(6).default(3),
   maxNodes: z.number().int().min(1).max(1000).default(100),
   maxEdges: z.number().int().min(1).max(5000).default(250),

package/src/mcp/tools/links.ts

@@ -25,6 +25,12 @@ import { parseRef } from "../../core/ref-parser";
 import { normalizeCollectionName } from "../../core/validation";
 import { getActivePreset } from "../../llm/registry";
 import { createVectorIndexPort } from "../../store/vector";
+import {
+  readStoredDocumentVectors,
+  resolveStoredVectorSource,
+  similarityHitDocuments,
+  storedVectorSearchOptions,
+} from "../../store/vector/stored-vectors";
 import { runTool, type ToolResult } from "./index";
 
 // ─────────────────────────────────────────────────────────────────────────────
@@ -219,6 +225,8 @@ interface BacklinksInput {
 interface BacklinkOutput {
   sourceDocUri: string;
   sourceDocTitle?: string;
+  /** Collection of the linking document. */
+  sourceCollection?: string;
   linkText?: string;
   position: { startLine: number; startCol: number };
 }
@@ -308,6 +316,7 @@ export function handleBacklinks(
         (b: BacklinkRow) => ({
           sourceDocUri: b.sourceDocUri,
           ...(b.sourceDocTitle && { sourceDocTitle: b.sourceDocTitle }),
+          ...(b.sourceCollection && { sourceCollection: b.sourceCollection }),
           ...(b.linkText && { linkText: b.linkText }),
           position: { startLine: b.startLine, startCol: b.startCol },
         })
@@ -406,62 +415,41 @@ export function handleSimilar(
       const preset = getActivePreset(ctx.config);
       const modelUri = preset.embed;
 
-      // Get stored embeddings from content_vectors (NO model loading required)
+      // Stored chunk vectors from the active partition (NO model loading required)
       const db = ctx.store.getRawDb();
+      const source = resolveStoredVectorSource(db, modelUri);
 
-      interface VectorRow {
-        embedding: Uint8Array;
+      let vectors: Float32Array[];
+      try {
+        vectors =
+          readStoredDocumentVectors(db, source, [
+            { id: doc.id, mirrorHash: doc.mirrorHash },
+          ]).get(doc.id) ?? [];
+      } catch (e) {
+        throw new Error(
+          `Invalid stored embedding data: ${e instanceof Error ? e.message : String(e)}`
+        );
       }
-
-      const vectorRows = db
-        .query<VectorRow, [string, string]>(
-          `SELECT embedding FROM content_vectors
-           WHERE mirror_hash = ? AND model = ?
-           ORDER BY seq`
-        )
-        .all(doc.mirrorHash, modelUri);
-
-      if (vectorRows.length === 0) {
+      const first = vectors[0];
+      if (!first) {
         throw new Error(
           `${MCP_ERRORS.NOT_FOUND.code}: Document has no embeddings. Run: gno embed`
         );
       }
 
       // Compute average embedding from all chunks
-      const firstBlob = vectorRows[0]?.embedding;
-      if (!firstBlob) {
-        throw new Error("No embedding data available");
-      }
-
-      let dimensions: number;
-      let avgEmbedding: Float32Array;
-
-      try {
-        dimensions = firstBlob.byteLength / 4;
-        avgEmbedding = new Float32Array(dimensions);
-
-        for (const row of vectorRows) {
-          const blob = new Uint8Array(row.embedding);
-          const embeddingDims = blob.byteLength / 4;
-          if (embeddingDims !== dimensions) {
-            throw new Error(
-              `Inconsistent embedding dimensions: expected ${dimensions}, got ${embeddingDims}`
-            );
-          }
-          const embedding = new Float32Array(
-            blob.buffer,
-            blob.byteOffset,
-            embeddingDims
+      const dimensions = first.length;
+      const avgEmbedding = new Float32Array(dimensions);
+      for (const embedding of vectors) {
+        if (embedding.length !== dimensions) {
+          throw new Error(
+            `Invalid stored embedding data: Inconsistent embedding dimensions: expected ${dimensions}, got ${embedding.length}`
           );
-          for (let i = 0; i < dimensions; i++) {
-            const current = avgEmbedding[i] ?? 0;
-            avgEmbedding[i] = current + (embedding[i] ?? 0) / vectorRows.length;
-          }
         }
-      } catch (e) {
-        throw new Error(
-          `Invalid stored embedding data: ${e instanceof Error ? e.message : String(e)}`
-        );
+        for (let i = 0; i < dimensions; i++) {
+          const current = avgEmbedding[i] ?? 0;
+          avgEmbedding[i] = current + (embedding[i] ?? 0) / vectors.length;
+        }
       }
 
       // Normalize the average embedding for cosine similarity
@@ -510,73 +498,62 @@ export function handleSimilar(
       const searchResult = await vectorIndex.searchNearest(
         avgEmbedding,
         candidateLimit,
-        {}
+        storedVectorSearchOptions(source)
       );
 
       if (!searchResult.ok) {
         throw new Error(searchResult.error.message);
       }
 
-      // Get unique mirrorHashes, excluding self
-      const mirrorHashes = [
-        ...new Set(
-          searchResult.value
-            .filter((r) => r.mirrorHash !== doc.mirrorHash)
-            .map((r) => r.mirrorHash)
-        ),
-      ];
+      // Legacy hits (no owners) exclude the source's content, as before
+      const hits = searchResult.value.filter(
+        (r) => r.documentIds !== undefined || r.mirrorHash !== doc.mirrorHash
+      );
 
-      // Batch query documents by mirrorHash (avoid N+1)
+      // Batch query the hits' documents: exact owners for partition hits,
+      // documents sharing the content for legacy hits (avoid N+1)
       interface DocRow {
+        id: number;
         docid: string;
         uri: string;
         title: string | null;
         collection: string;
         rel_path: string;
-        mirror_hash: string;
+        mirrorHash: string;
       }
 
-      const placeholders = mirrorHashes.map(() => "?").join(",");
-      const docRows =
-        mirrorHashes.length > 0
-          ? (db
-              .query<DocRow, string[]>(
-                `SELECT docid, uri, title, collection, rel_path, mirror_hash
-               FROM documents WHERE mirror_hash IN (${placeholders}) AND active = 1`
-              )
-              .all(...mirrorHashes) as DocRow[])
-          : [];
-
-      // Build lookup map
-      const docsByHash = new Map<string, DocRow>();
-      for (const row of docRows) {
-        if (!docsByHash.has(row.mirror_hash)) {
-          docsByHash.set(row.mirror_hash, row);
-        }
-      }
-
-      // Build best score per mirrorHash from search results
-      const scoresByHash = new Map<string, number>();
-      for (const r of searchResult.value) {
-        if (r.mirrorHash === doc.mirrorHash) continue;
-        // Compute similarity score from cosine distance
-        // sqlite-vec with cosine metric returns distance where similarity = 1 - distance
-        const score = Math.max(0, Math.min(1, 1 - r.distance));
-        const existing = scoresByHash.get(r.mirrorHash) ?? 0;
-        if (score > existing) {
-          scoresByHash.set(r.mirrorHash, score);
-        }
-      }
+      const docRows = db
+        .query<DocRow, [string, string]>(
+          `SELECT id, docid, uri, title, collection, rel_path, mirror_hash AS mirrorHash
+           FROM documents WHERE active = 1
+             AND (id IN (SELECT value FROM json_each(?))
+               OR mirror_hash IN (SELECT value FROM json_each(?)))
+           ORDER BY id`
+        )
+        .all(
+          JSON.stringify([
+            ...new Set(hits.flatMap((r) => r.documentIds ?? [])),
+          ]),
+          JSON.stringify([
+            ...new Set(
+              hits.filter((r) => !r.documentIds).map((r) => r.mirrorHash)
+            ),
+          ])
+        );
 
-      // Build similar docs list
+      // Build similar docs list; hits are nearest first, so a document's
+      // first hit carries its best score
       const similar: SimilarDocOutput[] = [];
+      const seenIds = new Set<number>();
       const docCollection = doc.collection.toLowerCase();
 
-      for (const mirrorHash of mirrorHashes) {
+      for (const { document: docRow, distance } of similarityHitDocuments(
+        hits,
+        docRows
+      )) {
         if (similar.length >= limit) break;
-
-        const docRow = docsByHash.get(mirrorHash);
-        if (!docRow) continue;
+        if (docRow.id === doc.id || seenIds.has(docRow.id)) continue;
+        seenIds.add(docRow.id);
 
         // Filter by collection if not crossCollection (case-insensitive)
         if (
@@ -586,7 +563,9 @@ export function handleSimilar(
           continue;
         }
 
-        const score = scoresByHash.get(mirrorHash) ?? 0;
+        // Compute similarity score from cosine distance
+        // sqlite-vec with cosine metric returns distance where similarity = 1 - distance
+        const score = Math.max(0, Math.min(1, 1 - distance));
         if (score < threshold) continue;
 
         // Get absPath (case-insensitive collection lookup)
@@ -796,6 +775,7 @@ export function handleGraph(
         threshold: args.threshold ?? 0.7,
         linkedOnly: args.linkedOnly ?? true,
         similarTopK: args.similarTopK ?? 5,
+        embedModel: getActivePreset(ctx.config).embed,
       });
 
       if (!result.ok) {
@@ -833,6 +813,7 @@ async function getValidatedGraph(
     threshold: args.threshold ?? 0.7,
     linkedOnly: args.linkedOnly ?? true,
     similarTopK: args.similarTopK ?? 5,
+    embedModel: getActivePreset(ctx.config).embed,
   });
 
   if (!result.ok) {

package/src/mcp/tools/sessions.ts

@@ -13,9 +13,11 @@
 
 import { z } from "zod";
 
+import type { Config } from "../../config/types";
 import type { ToolContext } from "../server";
 
 import { runAutomationProfile } from "../../sessions/automation";
+import { refreshServedConfig } from "../../sessions/config-refresh";
 import {
   formatAutomationRunText,
   formatImportReceiptText,
@@ -99,9 +101,36 @@ export const SESSIONS_IMPORT_MCP_ANNOTATIONS = {
   openWorldHint: false,
 } as const;
 
-function service(ctx: ToolContext): SessionsService {
-  return new SessionsService({
+/**
+ * The config file as it is now, adopted when the CLI changed it while this
+ * server runs (same binding checks and errors as the REST routes). Inside a
+ * request `ctx.config` stays the snapshot taken at its start, so callers use
+ * the returned config. An adoption moves the egress policy epoch; this
+ * request advances with it rather than voiding itself.
+ */
+function currentConfig(ctx: ToolContext): Promise<Config> {
+  return refreshServedConfig({
+    configPath: ctx.actualConfigPath,
+    indexName: ctx.indexName,
+    store: ctx.store,
     config: ctx.config,
+    setConfig: (config) => {
+      ctx.config = config;
+    },
+    invalidateEgressPolicy: async () => {
+      const invalidation = await ctx.invalidateEgressPolicy?.();
+      if (invalidation) {
+        ctx.advanceRequestAuthorizationEpoch?.(invalidation.policyEpoch);
+      }
+    },
+    markContentMutation: () => ctx.markContentMutation?.(),
+    markIndexMutation: () => ctx.markIndexMutation?.(),
+  });
+}
+
+async function service(ctx: ToolContext): Promise<SessionsService> {
+  return new SessionsService({
+    config: await currentConfig(ctx),
     configPath: ctx.actualConfigPath,
     indexName: ctx.indexName,
     store: ctx.store,
@@ -120,7 +149,7 @@ export function handleSessionsStatus(ctx: ToolContext): Promise<ToolResult> {
     "gno_sessions_status",
     async () => {
       try {
-        return await service(ctx).status();
+        return await (await service(ctx)).status();
       } catch (error) {
         return rethrowSessionsError(error);
       }
@@ -146,7 +175,7 @@ export function handleSessionsImport(
       try {
         // A child process keeps this server answering during a long import.
         receipt = await importInChildProcess({
-          config: ctx.config,
+          config: await currentConfig(ctx),
           configPath: ctx.actualConfigPath,
           indexName: ctx.indexName,
           sourceId: args.sourceId,

package/src/mcp/tools/status.ts

@@ -10,6 +10,7 @@ import type { ToolContext } from "../server";
 import { buildContentTypeBoostStatus } from "../../config/content-types";
 import { formatChunkingStatus } from "../../core/chunking-status";
 import { OWNER_CONFIG_PATH_FIELDS, withoutFields } from "../../core/host-paths";
+import { formatLinkWorkspace } from "../../core/link-workspace";
 import { formatVectorPartitionLines } from "../../core/vector-partition-status";
 import { resolveModelUri } from "../../llm/registry";
 import { createStandaloneResidentStatus } from "../../serve/resident-status";
@@ -55,6 +56,8 @@ function formatStatus(status: StatusView): string {
         `  ${c.name}: ${c.activeDocuments} docs, ${c.totalChunks} chunks` +
           (c.embeddedChunks > 0 ? `, ${c.embeddedChunks} embedded` : "")
       );
+      const workspace = formatLinkWorkspace(c);
+      if (workspace) lines.push(`    Link workspace: ${workspace}`);
     }
   }
 
@@ -102,6 +105,7 @@ export function handleStatus(
       const result = await ctx.store.getStatus({
         embedModel: resolveModelUri(ctx.config, "embed"),
         chunking: ctx.config.chunking ?? {},
+        configuredCollections: ctx.config.collections.map(({ name }) => name),
       });
       if (!result.ok) {
         throw new Error(result.error.message);

package/src/pipeline/expansion.ts

@@ -15,6 +15,7 @@ import {
   assertInferenceActive,
   assertInferenceResult,
   inferenceOptions,
+  withInferencePage,
 } from "../llm/inference-scope";
 import { ok } from "../store/types";
 
@@ -23,7 +24,6 @@ import { ok } from "../store/types";
 // ─────────────────────────────────────────────────────────────────────────────
 
 const EXPANSION_PROMPT_VERSION = "v3";
-const DEFAULT_TIMEOUT_MS = 5000;
 // Non-greedy to avoid matching from first { to last } across multiple objects
 const JSON_EXTRACT_PATTERN = /\{[\s\S]*?\}/;
 const QUOTED_PHRASE_PATTERN = /"([^"]+)"/g;
@@ -457,8 +457,6 @@ export function parseExpansionOutput(
 export interface ExpansionOptions extends InferenceOptions {
   /** Language hint for prompt selection */
   lang?: string;
-  /** Timeout in milliseconds */
-  timeout?: number;
   /** Optional context that steers expansion for ambiguous queries */
   intent?: string;
   /** Optional bounded context size override for expansion generation */
@@ -467,59 +465,49 @@ export interface ExpansionOptions extends InferenceOptions {
 
 /**
  * Expand query using generation model.
- * Returns null on timeout or parse failure (graceful degradation).
+ * Returns null when generation fails or times out, or its output does not
+ * parse (graceful degradation).
  */
 export async function expandQuery(
   genPort: GenerationPort,
   query: string,
   options: ExpansionOptions = {}
 ): Promise<StoreResult<ExpansionResult | null>> {
-  const timeout = options.timeout ?? DEFAULT_TIMEOUT_MS;
-
   // Build prompt
   const prompt = buildExpansionPrompt(query, options);
 
   assertInferenceActive(options);
   const operational = inferenceOptions(options);
-  const budget = new AbortController();
-  const expiresAt = performance.now() + timeout;
-  const timer = setTimeout(() => budget.abort(), timeout);
   try {
-    const result = await genPort.generate(
-      prompt,
-      {
-        temperature: 0,
-        seed: 42,
-        maxTokens: 512,
-        contextSize: options.contextSize,
-      },
-      {
-        ...operational,
-        signal: operational.signal
-          ? AbortSignal.any([operational.signal, budget.signal])
-          : budget.signal,
-      }
+    // Expansion is best effort but has no budget of its own: slow hardware
+    // (CPU generation takes 15-20s) and a cold model load still expand. A
+    // generation that hits models.inferenceTimeout fails only expansion.
+    const result = await withInferencePage(() =>
+      genPort.generate(
+        prompt,
+        {
+          temperature: 0,
+          seed: 42,
+          maxTokens: 512,
+          contextSize: options.contextSize,
+        },
+        operational
+      )
     );
-    // The independent expansion budget preserves its existing fallback. Caller
-    // cancellation/deadline always wins and cannot become a lexical success.
+    // Caller cancellation/deadline always wins and cannot become a lexical success.
     assertInferenceActive(options);
-    if (budget.signal.aborted || performance.now() >= expiresAt)
-      return ok(null);
+    if (!result) return ok(null);
     assertInferenceResult(result);
     if (!result.ok) return ok(null);
     return ok(parseExpansionOutput(result.value, query));
   } catch (cause) {
     assertInferenceActive(options);
-    if (budget.signal.aborted || performance.now() >= expiresAt)
-      return ok(null);
     if (
       cause instanceof Error &&
       ["AbortError", "TimeoutError"].includes(cause.name)
     )
       throw cause;
     return ok(null);
-  } finally {
-    clearTimeout(timer);
   }
 }
 

package/src/pipeline/graph-retrieval.ts

@@ -196,6 +196,7 @@ const loadGraphLinks = async (
   seedDocumentIds: number[],
   options: {
     collection?: string;
+    collections?: string[];
     includeSimilar?: boolean;
   }
 ): Promise<
@@ -205,6 +206,7 @@ const loadGraphLinks = async (
     const neighborsResult = await store.getGraphNeighborsForSeeds({
       seedDocumentIds,
       collection: options.collection,
+      collections: options.collections,
       limitEdges: GRAPH_EDGE_LIMIT,
     });
     if (!neighborsResult.ok) {
@@ -239,6 +241,11 @@ export async function expandGraphCandidates(
   fusedCandidates: FusionCandidate[],
   options: {
     collection?: string;
+    /**
+     * Graph allowlist (plural request scope). Neighbours must belong to one of
+     * these collections; defaults to `[collection]` when unset.
+     */
+    collections?: string[];
     includeSimilar?: boolean;
     eligibility?: DocumentEligibilityOptions;
     limit?: number;
@@ -353,8 +360,14 @@ export async function expandGraphCandidates(
   }
 
   const seedDocumentIds = [...seedByDocid.values()].map(({ doc }) => doc.id);
+  const graphAllowlist = options.collections
+    ? new Set(options.collections)
+    : options.collection
+      ? new Set([options.collection])
+      : undefined;
   const linksResult = await loadGraphLinks(store, seedDocumentIds, {
     collection: options.collection,
+    collections: options.collections,
     includeSimilar: options.includeSimilar,
   });
   if (!linksResult.ok) {
@@ -400,9 +413,15 @@ export async function expandGraphCandidates(
     return { candidates: [], meta };
   }
 
+  // A plural allowlist hydrates across its collections; scope is enforced on
+  // each neighbour's own collection below, never widened past the allowlist.
+  const plural = options.collections !== undefined;
   const docsResult = await store.getDocumentsByDocids(rankedNeighborDocids, {
-    eligibility: options.eligibility,
-    collection: options.collection,
+    eligibility:
+      plural && options.eligibility
+        ? { ...options.eligibility, collection: undefined }
+        : options.eligibility,
+    collection: plural ? undefined : options.collection,
     activeOnly: true,
   });
   if (!docsResult.ok) {
@@ -413,6 +432,7 @@ export async function expandGraphCandidates(
   const metadataFilteredDocs = docsResult.value.filter(
     (doc) =>
       doc.mirrorHash &&
+      (!graphAllowlist || graphAllowlist.has(doc.collection)) &&
       (options.relPathPrefix === undefined ||
         sourceRelPath(doc) === options.relPathPrefix ||
         sourceRelPath(doc).startsWith(`${options.relPathPrefix}/`)) &&

package/src/pipeline/hybrid.ts

@@ -520,7 +520,6 @@ async function searchHybridWithHydration(
       const expandResult = await expandQuery(expandPort, query, {
         // Use queryLanguage for prompt selection, NOT options.lang (retrieval filter)
         lang: queryLanguage,
-        timeout: pipelineConfig.expansionTimeout,
         intent: options.intent,
         contextSize: deps.config.models?.expandContextSize,
       });
@@ -804,6 +803,7 @@ async function searchHybridWithHydration(
     fusedCandidates,
     {
       collection: options.collection,
+      collections: options.graphCollections,
       includeSimilar: vectorAvailable,
       eligibility: vectorEligibility,
       limit,

package/src/pipeline/search.ts

@@ -223,6 +223,8 @@ export async function searchBm25(
     filter: options.filter,
     memoryScopesAny: options.memoryFilter?.scopes,
     excludeSuperseded: options.memoryFilter?.excludeSuperseded,
+    anyTerm: options.anyTerm,
+    minRelativeScore: options.minRelativeScore,
   });
 
   if (!ftsResult.ok) {