@wirecat/cli-core 0.447.0 → 0.449.0

package/CHANGELOG.md

@@ -5,6 +5,27 @@ Notable changes to `@wirecat/cli-core` (`@wirecat/cli-messaging` up to 0.261.0,
 minor version may break callers, and says how under "Changed — may break callers". `pnpm docs:check` checks the
 shape of this file.
 
+## 0.449.0 — 26.10.2026
+
+### Changed — may break callers
+
+- **cli-core needs `@wirecat/cli-base` 0.62.** The peer range moves from `>=0.59.0 <0.60.0` to `>=0.62.0 <0.63.0`. A
+  CLI that pins cli-base moves its pin with this release. cli-base 0.62 checks shared commands about twice as fast,
+  which shortens every command's setup: in tg a warm `run(["--version"])` went from 49 to 29 ms. cli-base 0.61 says in
+  its handbook that a run record keeps the command line as typed, with secrets still hidden; a CLI whose tests or
+  documents say otherwise follows its changelog.
+
+## 0.448.0 — 26.10.2026
+
+### Added
+
+- **Text models and rerankers run on native ONNX Runtime on Linux (glibc, x64 and arm64) and Apple-silicon Macs**,
+  2–3× faster than WebAssembly: on one real archive `search messages --discover` went from 4.6 s to 3.2 s with the
+  same answers. `models download` of a text model or reranker now also fetches Microsoft's ONNX Runtime 1.30.0
+  library for the system (10–42 MB, checked by sha256) into `models/runtime/`; an install that already has its
+  models gets it on its next `models download`. Windows, Intel Macs, musl, picture models, and any library that
+  does not load keep running through WebAssembly. Needs `@wirecat/cli-core-onnx` 1.1.0.
+
 ## 0.447.0 — 26.10.2026
 
 ### Added

package/README.md

@@ -130,8 +130,9 @@ code and its document must agree. A search plan that reads an index once per mes
   pattern can hang the search.
 - **Presets for what people actually look for.** `preset:password`, `api-key`, `card`, `phone`, `email`, `url` and
   seven more find candidates, labelled as candidates.
-- **Search by meaning, opt in.** Conversations are split into chunks and embedded locally by a WebAssembly ONNX
-  runtime, the same on Node and Bun — e5-small by default, or any OpenAI-compatible API with your own key, after
+- **Search by meaning, opt in.** Conversations are split into chunks and embedded locally by ONNX Runtime — native
+  on Linux (glibc) and Apple-silicon Macs once `models download` has fetched it, WebAssembly elsewhere, on Node and
+  Bun alike — e5-small by default, or any OpenAI-compatible API with your own key, after
   you see the cost. Results by meaning and by words are merged by reciprocal rank fusion.
 - **The archive and the server together.** `--backend both` also asks the messenger's own search; its hits are saved
   and filtered by the same query, so nothing is counted twice. `--thread` brings the reply thread around a hit.

package/dist/embeddings/embed.js

@@ -2,6 +2,7 @@ import { readFileSync } from "node:fs";
 import { availableParallelism } from "node:os";
 import { basename, join } from "node:path";
 import { filesPresent, sharedModelsDirectory } from "../speech/install.js";
+import { onnxRuntime } from "./onnx-runtime.js";
 export const textModelsDirectory = (env = process.env) => sharedModelsDirectory("text", env);
 export const placedText = (model, directory) => model.files.map((file) => [file, join(directory, model.id, file.name)]);
 export const isTextModelInstalled = (model, directory) => filesPresent(placedText(model, directory));
@@ -122,13 +123,29 @@ export const meanOf = (data, tokens, dims) => {
 };
 /** A model's tokenizer and ONNX session, from its folder. */
 export const loadModel = async (model, directory, threads) => {
-    const [{ Tokenizer }, ort] = await Promise.all([import("@huggingface/tokenizers"), import("@wirecat/cli-core-onnx")]);
+    const [{ Tokenizer }, runtime] = await Promise.all([import("@huggingface/tokenizers"), onnxRuntime()]);
     const path = (name) => join(directory, model.id, name);
     const tokenizer = new Tokenizer(JSON.parse(readFileSync(path("tokenizer.json"), "utf8")), JSON.parse(readFileSync(path("tokenizer_config.json"), "utf8")));
-    ort.env.wasm.numThreads = threads;
-    const session = await ort.InferenceSession.create(readFileSync(path(model.onnx)), model.externalData
+    const bytes = readFileSync(path(model.onnx));
+    const external = model.externalData
         ? { externalData: [{ path: basename(model.externalData), data: readFileSync(path(model.externalData)) }] }
-        : {});
+        : {};
+    if (runtime.native) {
+        try {
+            const session = await runtime.ort.InferenceSession.create(bytes, {
+                ...external,
+                intraOpNumThreads: threads,
+                interOpNumThreads: 1,
+            });
+            return { ort: runtime.ort, tokenizer, session };
+        }
+        catch {
+            // A model the native runtime will not open still runs through WebAssembly.
+        }
+    }
+    const ort = await import("@wirecat/cli-core-onnx");
+    ort.env.wasm.numThreads = threads;
+    const session = await ort.InferenceSession.create(bytes, external);
     return { ort, tokenizer, session };
 };
 export const openEmbedder = async (model, directory, { threads = defaultThreads() } = {}) => {

package/dist/embeddings/models.js

@@ -94,7 +94,7 @@ export const RERANK_MODELS = [
         languages: "about 100 languages, Russian and English among them",
         licence: "Apache-2.0",
         maxTokens: 512,
-        // The x86 name is the quantizer's target; Core runs every model as WebAssembly, on any processor.
+        // The x86 name is the quantizer's target; WebAssembly and native ONNX Runtime both run it on any processor.
         onnx: "onnx/model_quint8_avx2.onnx",
         files: [
             {

package/dist/embeddings/onnx-runtime.d.ts

@@ -0,0 +1,42 @@
+import { type Fetch } from "../speech/install.js";
+import type { ModelFile } from "../speech/models.js";
+export declare const ONNX_RUNTIME_VERSION = "1.30.0";
+/** The library of Microsoft's release, in its archive, and the name the binding looks for beside itself. */
+export interface NativeRuntime {
+    readonly target: string;
+    readonly archive: ModelFile;
+    readonly member: string;
+    readonly library: {
+        name: string;
+        sha256: string;
+        bytes: number;
+    };
+}
+export declare const nativeRuntimeFor: ({ platform, arch, musl, }?: {
+    platform?: string;
+    arch?: string;
+    musl?: boolean;
+}) => NativeRuntime | undefined;
+export declare const runtimeFolder: (runtime: NativeRuntime, env?: NodeJS.ProcessEnv) => string;
+/**
+ * The library this system's binding links to, out of Microsoft's release archive, checked against its own sha256
+ * and placed beside a copy of the binding, which loads it from its own folder. Only from `models download`: a search
+ * never downloads. `undefined` when this system runs models through WebAssembly only.
+ */
+export declare const installNativeRuntime: ({ env, progress, fetch, runtime, binding, }?: {
+    env?: NodeJS.ProcessEnv;
+    progress?: (line: string) => void;
+    fetch?: Fetch;
+    runtime?: NativeRuntime;
+    binding?: string;
+}) => Promise<string | undefined>;
+export type Ort = typeof import("@wirecat/cli-core-onnx");
+export interface OnnxRuntime {
+    readonly ort: Ort;
+    readonly native: boolean;
+}
+/**
+ * The native runtime when `models download` placed it for this system and it loads, else WebAssembly. One per
+ * process: a binding, once loaded, stays.
+ */
+export declare const onnxRuntime: (env?: NodeJS.ProcessEnv) => Promise<OnnxRuntime>;

package/dist/embeddings/onnx-runtime.js

@@ -0,0 +1,161 @@
+import { createHash } from "node:crypto";
+import { copyFileSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { join } from "node:path";
+import { CliError } from "@wirecat/cli-base";
+import { gunzipSync } from "fflate";
+import { installFiles, megabytes, sharedModelsDirectory } from "../speech/install.js";
+export const ONNX_RUNTIME_VERSION = "1.30.0";
+const release = (name, sha256, bytes) => ({
+    name,
+    url: `https://github.com/microsoft/onnxruntime/releases/download/v${ONNX_RUNTIME_VERSION}/${name}`,
+    sha256,
+    bytes,
+});
+/**
+ * The systems the ONNX workflow runs natively; everywhere else, and on musl, the models run through WebAssembly.
+ * Windows too: its binding needs the DirectML build of onnxruntime.dll, which Microsoft's release does not carry.
+ */
+const NATIVE = {
+    "linux-x64": {
+        archive: release("onnxruntime-linux-x64-1.30.0.tgz", "a5ed5a3cac51fbb2e90da632ae43d19212faaa20e76484e62bcb7c23ddb3b3fd", 11_306_877),
+        member: "onnxruntime-linux-x64-1.30.0/lib/libonnxruntime.so.1.30.0",
+        library: {
+            name: "libonnxruntime.so.1",
+            sha256: "245a6f8c38127551057a1cd1ffd59f0a186a227ade4f3492dea2494eb565542e",
+            bytes: 28_985_152,
+        },
+    },
+    "linux-arm64": {
+        archive: release("onnxruntime-linux-aarch64-1.30.0.tgz", "e16a27a8ed330bbc698df7330b0cf56e722f354e3bcc92118682c74ef3c3e3da", 10_269_495),
+        member: "onnxruntime-linux-aarch64-1.30.0/lib/libonnxruntime.so.1.30.0",
+        library: {
+            name: "libonnxruntime.so.1",
+            sha256: "64e903a43a041240fd6bcffe0ac6d4fea47ef87bf24b9d097801bd00a9612a4b",
+            bytes: 25_135_496,
+        },
+    },
+    "darwin-arm64": {
+        archive: release("onnxruntime-osx-arm64-1.30.0.tgz", "6ebb5062a934537c352937821f9fe9718e7de1a2db1122a93dd363ffd53a7012", 42_373_116),
+        member: "onnxruntime-osx-arm64-1.30.0/lib/libonnxruntime.1.30.0.dylib",
+        library: {
+            name: "libonnxruntime.1.dylib",
+            sha256: "bcc9110f9d638a119de2db7afb3ba9a1da8085f0cb3401e1c48ae1caf450b6fa",
+            bytes: 43_879_424,
+        },
+    },
+};
+const onMusl = () => {
+    try {
+        return readFileSync("/proc/self/maps", "utf8").includes("ld-musl");
+    }
+    catch {
+        return false;
+    }
+};
+export const nativeRuntimeFor = ({ platform = process.platform, arch = process.arch, musl = platform === "linux" && onMusl(), } = {}) => {
+    const target = `${platform}-${arch}`;
+    const runtime = NATIVE[target];
+    return runtime && !musl ? { target, ...runtime } : undefined;
+};
+export const runtimeFolder = (runtime, env = process.env) => join(sharedModelsDirectory("runtime", env), `onnxruntime-${ONNX_RUNTIME_VERSION}-${runtime.target}`);
+const BINDING = "onnxruntime_binding.node";
+const sizeOf = (path) => {
+    try {
+        return statSync(path).size;
+    }
+    catch {
+        return undefined;
+    }
+};
+const isInstalled = (runtime, folder) => sizeOf(join(folder, runtime.library.name)) === runtime.library.bytes && sizeOf(join(folder, BINDING)) !== undefined;
+/**
+ * The library this system's binding links to, out of Microsoft's release archive, checked against its own sha256
+ * and placed beside a copy of the binding, which loads it from its own folder. Only from `models download`: a search
+ * never downloads. `undefined` when this system runs models through WebAssembly only.
+ */
+export const installNativeRuntime = async ({ env = process.env, progress = () => { }, fetch, runtime = nativeRuntimeFor(), binding, } = {}) => {
+    if (!runtime)
+        return undefined;
+    const source = binding ?? (await import("@wirecat/cli-core-onnx")).nativeBindingFor();
+    if (!source)
+        return undefined;
+    const folder = runtimeFolder(runtime, env);
+    if (isInstalled(runtime, folder))
+        return folder;
+    progress(`ONNX Runtime ${ONNX_RUNTIME_VERSION} for ${runtime.target}: ${megabytes(runtime.archive.bytes)} from Microsoft`);
+    const parent = sharedModelsDirectory("runtime", env);
+    mkdirSync(parent, { recursive: true, mode: 0o700 });
+    const staging = mkdtempSync(join(parent, ".onnxruntime-"));
+    try {
+        const archive = join(staging, runtime.archive.name);
+        await installFiles([[runtime.archive, archive]], { ...(fetch ? { fetch } : {}), progress });
+        const library = tarMember(gunzipSync(readFileSync(archive)), runtime.member);
+        rmSync(archive);
+        const sha256 = library && createHash("sha256").update(library).digest("hex");
+        if (!library || library.length !== runtime.library.bytes || sha256 !== runtime.library.sha256)
+            throw new CliError("invalid_response", `${runtime.archive.name} does not hold the ${runtime.library.name} this version expects — nothing was installed`);
+        writeFileSync(join(staging, runtime.library.name), library, { mode: 0o755 });
+        copyFileSync(source, join(staging, BINDING));
+        rmSync(folder, { recursive: true, force: true });
+        renameSync(staging, folder);
+        return folder;
+    }
+    finally {
+        rmSync(staging, { recursive: true, force: true });
+    }
+};
+/** One regular file of a ustar archive, by its path: PAX and GNU long names, and a leading `./`, are understood. */
+const tarMember = (tar, member) => {
+    const text = (from, length) => new TextDecoder().decode(tar.subarray(from, from + length)).replace(/\0.*$/s, "");
+    const plain = (path) => path.replace(/^\.\//, "");
+    let longName;
+    for (let offset = 0; offset + 512 <= tar.length;) {
+        const name = text(offset, 100);
+        if (!name)
+            return undefined;
+        const size = Number.parseInt(text(offset + 124, 12).trim() || "0", 8);
+        const type = text(offset + 156, 1);
+        const prefix = text(offset + 345, 155);
+        const data = tar.subarray(offset + 512, offset + 512 + size);
+        offset += 512 + Math.ceil(size / 512) * 512;
+        if (type === "x") {
+            longName = /(?:^|\n)\d+ path=([^\n]*)\n/.exec(new TextDecoder().decode(data))?.[1] ?? longName;
+            continue;
+        }
+        if (type === "L") {
+            longName = new TextDecoder().decode(data).replace(/\0.*$/s, "");
+            continue;
+        }
+        const path = plain(longName ?? (prefix ? `${prefix}/${name}` : name));
+        longName = undefined;
+        if (path === plain(member) && (type === "0" || type === ""))
+            return data;
+    }
+    return undefined;
+};
+const opened = new Map();
+/**
+ * The native runtime when `models download` placed it for this system and it loads, else WebAssembly. One per
+ * process: a binding, once loaded, stays.
+ */
+export const onnxRuntime = (env = process.env) => {
+    const runtime = nativeRuntimeFor();
+    const folder = runtime ? runtimeFolder(runtime, env) : "";
+    let found = opened.get(folder);
+    if (!found) {
+        found = (async () => {
+            const wasm = await import("@wirecat/cli-core-onnx");
+            if (runtime && isInstalled(runtime, folder)) {
+                try {
+                    return { ort: wasm.openNative(join(folder, BINDING)), native: true };
+                }
+                catch {
+                    // A library that does not load on this system: WebAssembly runs the same models, slower.
+                }
+            }
+            return { ort: wasm, native: false };
+        })();
+        opened.set(folder, found);
+    }
+    return found;
+};

package/dist/services/model-downloads.js

@@ -1,9 +1,22 @@
 import { CliError } from "@wirecat/cli-base";
 import { isTextModelInstalled, placedText, textModelsDirectory } from "../embeddings/embed.js";
 import { rerankModel, textModel } from "../embeddings/models.js";
+import { installNativeRuntime } from "../embeddings/onnx-runtime.js";
 import { imageModel, imageModelsDirectory, isImageModelInstalled, placedImage, } from "../images/picture/models.js";
 import { installFiles, megabytes } from "../speech/install.js";
 const bytesOf = (model) => model.files.reduce((sum, file) => sum + file.bytes, 0);
+/**
+ * The native ONNX Runtime beside the text models, where this system has one. It only makes them faster, so a
+ * failed download says why and the model is still installed, to run through WebAssembly.
+ */
+const nativeRuntime = async ({ env, progress = () => { } }) => {
+    try {
+        await installNativeRuntime({ env, progress });
+    }
+    catch (error) {
+        progress(`ONNX Runtime not installed (${error instanceof Error ? error.message : String(error)}); models run through WebAssembly`);
+    }
+};
 /**
  * The text embedding model into the shared models folder, checked against the sha256 this version expects and
  * loaded once on a word. Nothing is downloaded when it is already there; it is still loaded.
@@ -18,6 +31,7 @@ export const downloadTextModel = async (id, { env, progress = () => { }, acceptT
         progress(`${model.id}: ${megabytes(bytesOf(model))} from Hugging Face`);
         await installFiles(placedText(model, directory), { progress });
     }
+    await nativeRuntime({ env, progress });
     progress(`${model.id}: loading it once to check it works`);
     const { openEmbedder } = await import("../embeddings/embed.js");
     const embedder = await openEmbedder(model, directory);
@@ -39,6 +53,7 @@ export const downloadRerankModel = async (id, { env, progress = () => { } }) =>
         progress(`${model.id}: ${megabytes(bytesOf(model))} from Hugging Face`);
         await installFiles(placedText(model, directory), { progress });
     }
+    await nativeRuntime({ env, progress });
     progress(`${model.id}: loading it once to check it works`);
     const { openReranker } = await import("../embeddings/rerank.js");
     const reranker = await openReranker(model, directory);

package/dist/speech/install.d.ts

@@ -1,6 +1,6 @@
 import { type ModelFile, type SpeechModel } from "./models.js";
 /** Shared by every CLI of the family, whatever it talks to: a model is hundreds of MB and is downloaded once. */
-export declare const sharedModelsDirectory: (kind: "audio" | "text" | "image", env?: NodeJS.ProcessEnv) => string;
+export declare const sharedModelsDirectory: (kind: "audio" | "text" | "image" | "runtime", env?: NodeJS.ProcessEnv) => string;
 export declare const modelsDirectory: (env?: NodeJS.ProcessEnv) => string;
 export declare const modelPath: (directory: string, model: SpeechModel) => (name: string) => string;
 export declare const vadPath: (directory: string) => string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-core",
-  "version": "0.447.0",
+  "version": "0.449.0",
   "description": "The messenger-neutral half of a messaging CLI: domain model, message locators, rendering, name resolution, the SQLite seam, the command skeleton and shared read commands, the send guard, run records and the message store",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",
@@ -176,7 +176,7 @@
     "@modelcontextprotocol/server": "^2.4.0",
     "@resvg/resvg-js": "2.6.2",
     "@valibot/to-json-schema": "1.8.0",
-    "@wirecat/cli-core-onnx": "1.0.1",
+    "@wirecat/cli-core-onnx": "1.1.0",
     "@wirecat/cli-core-sqlite": "1.1.0",
     "@xmldom/xmldom": "0.9.12",
     "chardet": "2.2.0",
@@ -217,7 +217,7 @@
     "@types/node": "^22.20.5",
     "@types/pngjs": "6.0.5",
     "@vitest/coverage-v8": "^5.0.5",
-    "@wirecat/cli-base": "0.59.0",
+    "@wirecat/cli-base": "0.62.0",
     "@wirecat/cli-core-legacy-tags": "npm:@wirecat/cli-core@0.414.0",
     "commander": "15.0.0",
     "cspell": "10.4.0",
@@ -237,7 +237,7 @@
   },
   "peerDependencies": {
     "@napi-rs/canvas": ">=0.1.69 <2",
-    "@wirecat/cli-base": ">=0.59.0 <0.60.0",
+    "@wirecat/cli-base": ">=0.62.0 <0.63.0",
     "commander": ">=15"
   },
   "bin": {