@remnic/core 1.1.31 → 9.3.515

package/src/dashboard-runtime.ts

@@ -1,6 +1,6 @@
-import { createHash } from "node:crypto";
+import { createHash, timingSafeEqual } from "node:crypto";
 import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
-import { watch, type FSWatcher } from "node:fs";
+import { mkdirSync, watch, type FSWatcher } from "node:fs";
 import { readFile } from "node:fs/promises";
 import path from "node:path";
 import type { Duplex } from "node:stream";
@@ -13,6 +13,7 @@ export interface DashboardServerOptions {
   port?: number;
   publicDir?: string;
   watchDebounceMs?: number;
+  authToken?: string;
 }
 
 export interface DashboardStatus {
@@ -39,6 +40,25 @@ function normalizeOriginHostname(hostname: string): string {
   return hostname;
 }
 
+function isLoopbackBindHost(host: string): boolean {
+  return LOOPBACK_HOSTS.has(normalizeOriginHostname(host.trim().toLowerCase()));
+}
+
+function constantTimeEquals(a: string, b: string): boolean {
+  const aBuffer = Buffer.from(a);
+  const bBuffer = Buffer.from(b);
+  if (aBuffer.length !== bBuffer.length) return false;
+  return timingSafeEqual(aBuffer, bBuffer);
+}
+
+function parseDashboardPort(port: number | undefined): number {
+  if (port === undefined) return 0;
+  if (!Number.isInteger(port) || port < 0 || port > 65535) {
+    throw new Error("dashboard port must be an integer from 0 to 65535");
+  }
+  return port;
+}
+
 function websocketAcceptKey(clientKey: string): string {
   return createHash("sha1")
     .update(`${clientKey}258EAFA5-E914-47DA-95CA-C5AB0DC85B11`)
@@ -67,6 +87,7 @@ export class GraphDashboardServer {
   private readonly requestedPort: number;
   private readonly publicDir: string;
   private readonly watchDebounceMs: number;
+  private readonly authToken: string | null;
   private server: ReturnType<typeof createServer> | null = null;
   private watcher: FSWatcher | null = null;
   private clients = new Map<string, WsClient>();
@@ -83,15 +104,20 @@ export class GraphDashboardServer {
   constructor(options: DashboardServerOptions) {
     this.memoryDir = options.memoryDir;
     this.host = options.host?.trim() || "127.0.0.1";
-    this.requestedPort = Number.isFinite(options.port) ? Math.max(0, Math.floor(options.port ?? 0)) : 0;
+    this.requestedPort = parseDashboardPort(options.port);
     this.publicDir = options.publicDir ?? path.join(process.cwd(), "dashboard", "public");
     this.watchDebounceMs = Math.max(50, Math.floor(options.watchDebounceMs ?? 300));
+    const authToken = options.authToken?.trim();
+    this.authToken = authToken && authToken.length > 0 ? authToken : null;
   }
 
   async start(): Promise<DashboardStatus> {
     if (this.server) {
       return this.status();
     }
+    if (!isLoopbackBindHost(this.host) && !this.authToken) {
+      throw new Error("dashboard auth token is required when binding to a non-loopback host");
+    }
 
     await this.rebuildSnapshot();
     const candidate = createServer((req, res) => {
@@ -177,6 +203,7 @@ export class GraphDashboardServer {
   private async handleHttp(req: IncomingMessage, res: ServerResponse): Promise<void> {
     const url = req.url ?? "/";
     if (req.method === "GET" && url === "/api/health") {
+      if (!this.authorizeHttpApi(req, res)) return;
       this.respondJson(res, 200, {
         ok: true,
         running: this.server !== null,
@@ -188,6 +215,7 @@ export class GraphDashboardServer {
       return;
     }
     if (req.method === "GET" && url === "/api/graph") {
+      if (!this.authorizeHttpApi(req, res)) return;
       this.respondJson(res, 200, this.graphSnapshot);
       return;
     }
@@ -210,6 +238,22 @@ export class GraphDashboardServer {
     res.end(body);
   }
 
+  private authorizeHttpApi(req: IncomingMessage, res: ServerResponse): boolean {
+    if (!this.authToken) return true;
+    const header = req.headers.authorization;
+    const value = Array.isArray(header) ? header[0] : header;
+    const prefix = "Bearer ";
+    if (typeof value === "string" && value.startsWith(prefix)) {
+      const supplied = value.slice(prefix.length);
+      if (constantTimeEquals(supplied, this.authToken)) {
+        return true;
+      }
+    }
+    res.setHeader("www-authenticate", "Bearer");
+    this.respondJson(res, 401, { error: "Unauthorized" });
+    return false;
+  }
+
   private async respondStatic(res: ServerResponse, filePath: string, contentType: string): Promise<void> {
     try {
       const body = await readFile(filePath, "utf-8");
@@ -236,6 +280,11 @@ export class GraphDashboardServer {
       socket.destroy();
       return;
     }
+    if (!this.authorizeWebSocketUpgrade(req)) {
+      socket.write("HTTP/1.1 401 Unauthorized\r\nWWW-Authenticate: Bearer\r\n\r\n");
+      socket.destroy();
+      return;
+    }
     const accept = websocketAcceptKey(key);
     socket.write(
       [
@@ -268,15 +317,49 @@ export class GraphDashboardServer {
     try {
       const parsed = new URL(origin);
       const hostname = normalizeOriginHostname(parsed.hostname);
-      if (!LOOPBACK_HOSTS.has(hostname)) return false;
       if (parsed.protocol !== "http:") return false;
       const originPort = parsed.port ? Number(parsed.port) : 80;
-      return Number.isFinite(originPort) && originPort === this.boundPort;
+      if (!Number.isFinite(originPort) || originPort !== this.boundPort) return false;
+      if (LOOPBACK_HOSTS.has(hostname)) return true;
+      return this.authToken !== null;
     } catch {
       return false;
     }
   }
 
+  private authorizeWebSocketUpgrade(req: IncomingMessage): boolean {
+    if (!this.authToken) return true;
+    const supplied = this.webSocketTokenFromUrl(req.url) ?? this.webSocketTokenFromProtocol(req);
+    return typeof supplied === "string" && constantTimeEquals(supplied, this.authToken);
+  }
+
+  private webSocketTokenFromUrl(rawUrl: string | undefined): string | null {
+    if (!rawUrl) return null;
+    try {
+      const parsed = new URL(rawUrl, `http://${this.host}:${this.boundPort}`);
+      const token = parsed.searchParams.get("token");
+      return token && token.length > 0 ? token : null;
+    } catch {
+      return null;
+    }
+  }
+
+  private webSocketTokenFromProtocol(req: IncomingMessage): string | null {
+    const raw = req.headers["sec-websocket-protocol"];
+    const values = Array.isArray(raw) ? raw : typeof raw === "string" ? raw.split(",") : [];
+    for (const value of values) {
+      const trimmed = value.trim();
+      const prefix = "remnic-token.";
+      if (!trimmed.startsWith(prefix)) continue;
+      try {
+        return Buffer.from(trimmed.slice(prefix.length), "base64url").toString("utf8");
+      } catch {
+        return null;
+      }
+    }
+    return null;
+  }
+
   private broadcast(payload: unknown): void {
     const frame = encodeTextFrame(JSON.stringify(payload));
     for (const [id, client] of this.clients.entries()) {
@@ -291,6 +374,7 @@ export class GraphDashboardServer {
   private startWatcher(): void {
     const graphDir = path.join(this.memoryDir, "state", "graphs");
     try {
+      mkdirSync(graphDir, { recursive: true });
       this.watcher = watch(graphDir, { persistent: false }, () => {
         this.scheduleRebuild();
       });
@@ -315,7 +399,13 @@ export class GraphDashboardServer {
     const previous = this.graphSnapshot;
     await this.rebuildSnapshot();
     const patch = diffGraphSnapshots(previous, this.graphSnapshot);
-    if (patch.addedEdges.length === 0 && patch.removedEdges.length === 0 && patch.addedNodes.length === 0 && patch.removedNodes.length === 0) {
+    if (
+      patch.addedEdges.length === 0 &&
+      patch.removedEdges.length === 0 &&
+      patch.updatedEdges.length === 0 &&
+      patch.addedNodes.length === 0 &&
+      patch.removedNodes.length === 0
+    ) {
       return;
     }
     this.broadcast({

package/src/dedup/index.test.ts

@@ -0,0 +1,133 @@
+import assert from "node:assert/strict";
+import { mkdtemp, mkdir, rm, symlink, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+import { findContradictions, findDuplicates } from "./index.js";
+
+test("findContradictions detects can versus cannot statements", async () => {
+  const memoryDir = await mkdtemp(path.join(tmpdir(), "remnic-dedup-contradiction-"));
+
+  try {
+    const factsDir = path.join(memoryDir, "facts");
+    await mkdir(factsDir);
+    await writeFile(
+      path.join(factsDir, "can.md"),
+      [
+        "---",
+        "id: mem-can",
+        "category: fact",
+        "---",
+        "The user can access production.",
+      ].join("\n"),
+      "utf8",
+    );
+    await writeFile(
+      path.join(factsDir, "cannot.md"),
+      [
+        "---",
+        "id: mem-cannot",
+        "category: fact",
+        "---",
+        "The user cannot access production.",
+      ].join("\n"),
+      "utf8",
+    );
+
+    const result = findContradictions({ memoryDir, categories: ["facts"] });
+
+    assert.equal(result.scanned, 2);
+    assert.equal(result.contradictions.length, 1);
+    assert.equal(result.contradictions[0]?.severity, "high");
+    assert.equal(result.contradictions[0]?.reason, 'Opposite quantifiers: "can" vs "cannot"');
+  } finally {
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});
+
+test("dedup public numeric options are normalized before scanning", async () => {
+  const memoryDir = await mkdtemp(path.join(tmpdir(), "remnic-dedup-options-"));
+
+  try {
+    const factsDir = path.join(memoryDir, "facts");
+    await mkdir(factsDir);
+    for (const [fileName, id, content] of [
+      ["a.md", "mem-a", "The user prefers short status updates."],
+      ["b.md", "mem-b", "The user prefers short status updates."],
+    ] as const) {
+      await writeFile(
+        path.join(factsDir, fileName),
+        [
+          "---",
+          `id: ${id}`,
+          "category: fact",
+          "---",
+          content,
+        ].join("\n"),
+        "utf8",
+      );
+    }
+
+    const invalidThreshold = findDuplicates({
+      memoryDir,
+      categories: ["facts"],
+      threshold: Number.NaN,
+    });
+    assert.equal(invalidThreshold.scanned, 2);
+    assert.equal(invalidThreshold.duplicates.length, 1);
+
+    const zeroMaxLoad = findDuplicates({
+      memoryDir,
+      categories: ["facts"],
+      maxLoad: 0,
+    });
+    assert.equal(zeroMaxLoad.scanned, 0);
+
+    const invalidMaxLoad = findContradictions({
+      memoryDir,
+      categories: ["facts"],
+      maxLoad: 0.5,
+    });
+    assert.equal(invalidMaxLoad.scanned, 2);
+  } finally {
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});
+
+test("dedup scans reject symlinked category directories outside memoryDir", async (t) => {
+  if (process.platform === "win32") {
+    t.skip("directory symlink setup is platform-specific");
+    return;
+  }
+
+  const memoryDir = await mkdtemp(path.join(tmpdir(), "remnic-dedup-root-"));
+  const outsideDir = await mkdtemp(path.join(tmpdir(), "remnic-dedup-outside-"));
+
+  try {
+    await writeFile(
+      path.join(outsideDir, "outside.md"),
+      [
+        "---",
+        "id: outside",
+        "category: fact",
+        "---",
+        "Outside memory should not be scanned.",
+      ].join("\n"),
+      "utf8",
+    );
+    await symlink(outsideDir, path.join(memoryDir, "facts"), "dir");
+
+    assert.throws(
+      () => findDuplicates({ memoryDir, categories: ["facts"] }),
+      /symlinked memory category directory/,
+    );
+    assert.throws(
+      () => findContradictions({ memoryDir, categories: ["facts"] }),
+      /symlinked memory category directory/,
+    );
+  } finally {
+    await rm(memoryDir, { recursive: true, force: true });
+    await rm(outsideDir, { recursive: true, force: true });
+  }
+});

package/src/dedup/index.ts

@@ -85,9 +85,31 @@ export interface ContradictionPair {
 
 // ── Main functions ───────────────────────────────────────────────────────────
 
+const DEFAULT_DEDUP_THRESHOLD = 0.85;
+const DEFAULT_MAX_LOAD = 10000;
+
+function normalizeThreshold(value: number | undefined, defaultValue: number): number {
+  return typeof value === "number" &&
+    Number.isFinite(value) &&
+    value >= 0 &&
+    value <= 1
+    ? value
+    : defaultValue;
+}
+
+function normalizeMaxLoad(value: number | undefined, defaultValue: number): number {
+  return typeof value === "number" &&
+    Number.isInteger(value) &&
+    value >= 0
+    ? value
+    : defaultValue;
+}
+
 export function findDuplicates(options: DedupOptions): DedupResult {
   const startTime = Date.now();
-  const { memoryDir, threshold = 0.85, maxLoad = 10000 } = options;
+  const { memoryDir } = options;
+  const threshold = normalizeThreshold(options.threshold, DEFAULT_DEDUP_THRESHOLD);
+  const maxLoad = normalizeMaxLoad(options.maxLoad, DEFAULT_MAX_LOAD);
 
   const memories = loadMemories(memoryDir, options.categories, maxLoad);
   const duplicates: DuplicatePair[] = [];
@@ -116,7 +138,8 @@ export function findDuplicates(options: DedupOptions): DedupResult {
 
 export function findContradictions(options: ContradictionOptions): ContradictionResult {
   const startTime = Date.now();
-  const { memoryDir, maxLoad = 10000 } = options;
+  const { memoryDir } = options;
+  const maxLoad = normalizeMaxLoad(options.maxLoad, DEFAULT_MAX_LOAD);
 
   const memories = loadMemories(memoryDir, options.categories, maxLoad);
   const contradictions: ContradictionPair[] = [];
@@ -178,7 +201,7 @@ function normalize(text: string): string {
 // ── Contradiction detection ──────────────────────────────────────────────────
 
 const NEGATION_WORDS = new Set([
-  "not", "don't", "doesn't", "isn't", "aren't", "won't", "can't",
+  "not", "don't", "doesn't", "isn't", "aren't", "won't", "can't", "cannot",
   "never", "no", "none", "neither", "nor", "nothing", "nowhere",
 ]);
 
@@ -241,7 +264,7 @@ function containsNegation(text: string): boolean {
 
 function stripNegation(text: string): string {
   return text
-    .replace(/\b(not|don't|doesn't|isn't|aren't|won't|can't|never|no|none|neither|nor|nothing|nowhere)\b/gi, "")
+    .replace(/\b(not|don't|doesn't|isn't|aren't|won't|can't|cannot|never|no|none|neither|nor|nothing|nowhere)\b/gi, "")
     .replace(/\s+/g, " ")
     .trim();
 }
@@ -255,17 +278,26 @@ function loadMemories(
 ): MemoryEntry[] {
   const result: MemoryEntry[] = [];
   const allCategories = categories ?? ALL_CATEGORY_DIRS;
+  if (!fs.existsSync(memoryDir)) return result;
+  const memoryRootReal = fs.realpathSync(memoryDir);
 
   for (const category of allCategories) {
     if (result.length >= maxLoad) break;
 
     const dir = path.join(memoryDir, category);
     if (!fs.existsSync(dir)) continue;
+    const categoryStat = fs.lstatSync(dir);
+    if (categoryStat.isSymbolicLink()) {
+      throw new Error(`Refusing to scan symlinked memory category directory: ${dir}`);
+    }
+    if (!categoryStat.isDirectory()) continue;
+    const categoryRootReal = fs.realpathSync(dir);
+    assertPathInsideRoot(memoryRootReal, categoryRootReal, dir);
 
-    walkMdFiles(dir, (filePath) => {
+    walkMdFiles(dir, memoryRootReal, categoryRootReal, (filePath) => {
       if (result.length >= maxLoad) return;
 
-      const content = readFileSafe(filePath);
+      const content = readFileSafe(filePath, memoryRootReal, categoryRootReal);
       if (!content) return;
 
       const fm = parseFrontmatter(content);
@@ -290,8 +322,19 @@ function hashContent(content: string): string {
   return crypto.createHash("sha256").update(content).digest("hex").slice(0, 16);
 }
 
-function readFileSafe(filePath: string): string | null {
+function readFileSafe(
+  filePath: string,
+  memoryRootReal: string,
+  categoryRootReal: string,
+): string | null {
   try {
+    const fileStat = fs.lstatSync(filePath);
+    if (fileStat.isSymbolicLink()) {
+      throw new Error(`Refusing to read symlinked memory file: ${filePath}`);
+    }
+    const fileReal = fs.realpathSync(filePath);
+    assertPathInsideRoot(memoryRootReal, fileReal, filePath);
+    assertPathInsideRoot(categoryRootReal, fileReal, filePath);
     return fs.readFileSync(filePath, "utf8");
   } catch {
     return null;
@@ -318,11 +361,31 @@ function extractBody(content: string): string {
   return match ? match[1].trim() : content.trim();
 }
 
-function walkMdFiles(dir: string, callback: (filePath: string) => void): void {
+function assertPathInsideRoot(rootReal: string, targetReal: string, sourcePath: string): void {
+  const rel = path.relative(rootReal, targetReal);
+  if (rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel))) {
+    return;
+  }
+  throw new Error(`Refusing to scan memory path outside root: ${sourcePath}`);
+}
+
+function walkMdFiles(
+  dir: string,
+  memoryRootReal: string,
+  categoryRootReal: string,
+  callback: (filePath: string) => void,
+): void {
   for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
     const fullPath = path.join(dir, entry.name);
-    if (entry.isDirectory()) {
-      walkMdFiles(fullPath, callback);
+    const entryStat = fs.lstatSync(fullPath);
+    if (entryStat.isSymbolicLink()) {
+      throw new Error(`Refusing to scan symlinked memory path: ${fullPath}`);
+    }
+    const entryReal = fs.realpathSync(fullPath);
+    assertPathInsideRoot(memoryRootReal, entryReal, fullPath);
+    assertPathInsideRoot(categoryRootReal, entryReal, fullPath);
+    if (entryStat.isDirectory()) {
+      walkMdFiles(fullPath, memoryRootReal, categoryRootReal, callback);
     } else if (entry.name.endsWith(".md")) {
       callback(fullPath);
     }

package/src/dedup/semantic.test.ts

@@ -173,6 +173,46 @@ test("semantic dedup: candidates option is forwarded to lookup", async () => {
   assert.equal(limitSeen, 11);
 });
 
+test("semantic dedup: normalizes malformed numeric options before lookup", async () => {
+  let invalidCandidateLimitSeen = -1;
+  const invalidCandidates = await decideSemanticDedup(
+    "anything",
+    async (_content, limit) => {
+      invalidCandidateLimitSeen = limit;
+      return [{ id: "m1", score: 0.93 }];
+    },
+    { ...DEFAULT_OPTS, threshold: Number.NaN, candidates: Number.NaN },
+  );
+  assert.equal(invalidCandidateLimitSeen, 5);
+  assert.equal(invalidCandidates.action, "skip");
+
+  let fractionalCandidateLimitSeen = -1;
+  await decideSemanticDedup(
+    "anything",
+    async (_content, limit) => {
+      fractionalCandidateLimitSeen = limit;
+      return [];
+    },
+    { ...DEFAULT_OPTS, candidates: 0.5 },
+  );
+  assert.equal(fractionalCandidateLimitSeen, 1);
+
+  const clampedHighThreshold = await decideSemanticDedup(
+    "anything",
+    makeLookup([{ id: "m1", score: 0.99 }]),
+    { ...DEFAULT_OPTS, threshold: 2 },
+  );
+  assert.equal(clampedHighThreshold.action, "keep");
+  assert.equal(clampedHighThreshold.reason, "no_near_duplicate");
+
+  const clampedLowThreshold = await decideSemanticDedup(
+    "anything",
+    makeLookup([{ id: "m1", score: 0.01 }]),
+    { ...DEFAULT_OPTS, threshold: -1 },
+  );
+  assert.equal(clampedLowThreshold.action, "skip");
+});
+
 test("semantic dedup: candidates=0 short-circuits without calling lookup", async () => {
   let called = 0;
   const decision = await decideSemanticDedup(
@@ -369,13 +409,14 @@ test("regression #399: after neighbor archive, re-write of skipped content is al
 async function seedEmbeddingIndex(
   memoryDir: string,
   entries: Record<string, { vector: number[]; path: string }>,
+  options: { provider?: "openai" | "local"; model?: string } = {},
 ): Promise<void> {
   const stateDir = join(memoryDir, "state");
   await mkdir(stateDir, { recursive: true });
   const indexFile = {
     version: 1 as const,
-    provider: "openai" as const,
-    model: "text-embedding-3-small",
+    provider: options.provider ?? "openai" as const,
+    model: options.model ?? "text-embedding-3-small",
     entries,
   };
   await writeFile(
@@ -489,6 +530,40 @@ test("regression #399 P1: semantic dedup lookup is scoped to target namespace",
   }
 });
 
+test("embedding fallback ignores persisted indexes from a different provider or model", async () => {
+  const memoryDir = await mkdtemp(join(tmpdir(), "remnic-embedding-provider-mismatch-"));
+  const vec = [1, 0, 0, 0];
+  const restoreFetch = stubEmbedFetch(vec);
+  try {
+    await seedEmbeddingIndex(memoryDir, {
+      "mem-openai-001": {
+        vector: vec,
+        path: "facts/openai.md",
+      },
+    }, {
+      provider: "openai",
+      model: "text-embedding-3-small",
+    });
+
+    const config = parseConfig({
+      memoryDir,
+      embeddingFallbackEnabled: true,
+      embeddingFallbackProvider: "local",
+      localLlmEnabled: true,
+      localLlmUrl: "http://127.0.0.1:1234",
+      localLlmModel: "local-embed",
+      embeddingFallbackModel: "local-embed",
+    });
+    const fallback = new EmbeddingFallback(config);
+
+    const hits = await fallback.search("the user prefers tabs", 5);
+    assert.deepEqual(hits, []);
+  } finally {
+    restoreFetch();
+    await rm(memoryDir, { recursive: true, force: true });
+  }
+});
+
 // ── Finding 3: empty index vs backend unavailable ─────────────────────────────
 
 test("finding 3: empty lookup result returns no_candidates, not backend_unavailable", async () => {

package/src/dedup/semantic.ts

@@ -27,9 +27,11 @@ export interface SemanticDedupHit {
 
 /**
  * Lookup function passed by the caller. Must return an array of hits sorted
- * descending by score. Implementations should return an empty array (never
- * throw) when the embedding backend is unavailable — the decision function
- * treats that as "no near duplicate" (fail-open).
+ * descending by score. Implementations must throw when the embedding backend
+ * is unavailable or the provider call fails, and return an empty array only
+ * when a reachable backend successfully reports no hits. The decision function
+ * fail-opens on thrown lookup errors while preserving a distinct
+ * "backend_unavailable" reason for telemetry.
  */
 export type SemanticDedupLookup = (
   content: string,
@@ -66,6 +68,23 @@ export type SemanticDedupDecision =
 
 // ── Pure decision function ────────────────────────────────────────────────────
 
+const DEFAULT_SEMANTIC_THRESHOLD = 0.92;
+const DEFAULT_SEMANTIC_CANDIDATES = 5;
+
+function normalizeSemanticThreshold(value: number): number {
+  return Number.isFinite(value)
+    ? Math.min(1, Math.max(0, value))
+    : DEFAULT_SEMANTIC_THRESHOLD;
+}
+
+function normalizeSemanticCandidates(value: number): number {
+  if (!Number.isFinite(value) || value < 0) {
+    return DEFAULT_SEMANTIC_CANDIDATES;
+  }
+  const normalized = Math.floor(value);
+  return value > 0 && normalized === 0 ? 1 : normalized;
+}
+
 /**
  * Pure decision function: given a lookup callback and options, decide whether
  * the candidate content should be written or skipped as a near-duplicate.
@@ -90,16 +109,17 @@ export async function decideSemanticDedup(
   if (!options.enabled) {
     return { action: "keep", reason: "disabled" };
   }
+  const threshold = normalizeSemanticThreshold(options.threshold);
+  const candidates = normalizeSemanticCandidates(options.candidates);
   // Zero candidates means the operator has disabled the embedding lookup.
   // Treat it identically to enabled=false so no backend call is made.
-  if (options.candidates === 0) {
+  if (candidates === 0) {
     return { action: "keep", reason: "disabled" };
   }
   const trimmed = typeof content === "string" ? content.trim() : "";
   if (!trimmed) {
     return { action: "keep", reason: "no_near_duplicate" };
   }
-  const candidates = Math.max(1, Math.floor(options.candidates));
   let hits: SemanticDedupHit[] = [];
   try {
     hits = await lookup(trimmed, candidates);
@@ -129,7 +149,7 @@ export async function decideSemanticDedup(
     return { action: "keep", reason: "no_near_duplicate" };
   }
 
-  if (top.score >= options.threshold) {
+  if (top.score >= threshold) {
     return {
       action: "skip",
       reason: "near_duplicate",