@wirecat/cli-core 0.449.0 → 0.451.0

package/dist/mcp/server.js

@@ -1,4 +1,3 @@
-import { PassThrough, Writable } from "node:stream";
 import { McpServer } from "@modelcontextprotocol/server";
 import { StdioServerTransport, serveStdio } from "@modelcontextprotocol/server/stdio";
 import { CliError, mcpErrorResult } from "@wirecat/cli-base";
@@ -19,6 +18,7 @@ import { syncsFirst } from "../cli/messenger/search-sync-options.js";
 import { stdinFieldOf } from "../cli/stdin-field.js";
 import { rootOf } from "../cli/steps.js";
 import { warmEmbedders } from "../embeddings/embed.js";
+import { mcpUrlOf } from "../http/public-url.js";
 import { readOnlyLockOf } from "../ports/app.js";
 import { guardFor } from "../sends/guard.js";
 import { levelFor, readKeysForCommand } from "../sends/permissions.js";
@@ -30,6 +30,7 @@ import { instructions } from "./instructions.js";
 import { registerPrompts } from "./prompts.js";
 import { registerResources } from "./resources.js";
 import { harmless, MessengerSession } from "./session.js";
+import { answeredWire } from "./stdio-wire.js";
 import { normal, outputOf, registerCommands, surfaceCommands } from "./surface.js";
 import { agentJson } from "./text.js";
 import { answered, commandOf, failed, outcomeOf, READ, tierOf, tool, toolKey, WRITE, } from "./tool.js";
@@ -357,77 +358,6 @@ export const createServer = (command, context, messenger, sessionOptions) => {
     };
     return { session, embedders, build, log, offered: [...commands.map((one) => one.command), ...pictured] };
 };
-const lineReader = (onMessage) => {
-    let rest = "";
-    return (chunk) => {
-        const lines = (rest + chunk.toString()).split("\n");
-        rest = lines.pop() ?? "";
-        for (const line of lines) {
-            try {
-                const message = JSON.parse(line);
-                if (message !== null && typeof message === "object")
-                    onMessage(message);
-            }
-            catch {
-                // Not a message; the transport answers it as a parse error.
-            }
-        }
-    };
-};
-/**
- * Stdin and stdout as the transport sees them, noting each request that comes in and each answer that goes out, so
- * the server can tell when everything asked has been answered. The transport's stdin never ends by itself: the server
- * closes it, after the client's stdin ended and the last answer went out.
- */
-const answeredWire = (source, sink) => {
-    const asked = new Set();
-    let settle;
-    const input = new PassThrough();
-    const onData = lineReader(({ id, method }) => {
-        if (id !== undefined && typeof method === "string")
-            asked.add(JSON.stringify(id));
-    });
-    const output = new Writable({
-        write: (chunk, _encoding, done) => {
-            noteAnswer(chunk);
-            sink.write(chunk, done);
-        },
-    });
-    const noteAnswer = lineReader(({ id, method }) => {
-        if (id === undefined || method !== undefined)
-            return;
-        asked.delete(JSON.stringify(id));
-        if (asked.size === 0)
-            settle?.();
-    });
-    const forward = (chunk) => {
-        onData(chunk);
-        input.write(chunk);
-    };
-    source.on("data", forward);
-    const ended = new Promise((resolve) => {
-        source.once("end", resolve);
-        source.once("close", resolve);
-    });
-    return {
-        input,
-        output,
-        ended,
-        answered: () => new Promise((resolve) => {
-            if (asked.size === 0)
-                resolve();
-            else
-                settle = resolve;
-        }),
-        /** Lets go of the real stdin, so it no longer holds the process open. */
-        release: () => {
-            source.off("data", forward);
-            if (source.listenerCount("data") === 0)
-                source.pause();
-            input.end();
-        },
-    };
-};
 /**
  * Serves until the client closes stdin or the process is told to stop, then closes the connection.
  * **Returning is what lets the process exit**: the transport lets go of stdin, and the session is
@@ -487,7 +417,7 @@ export const serveOverHttpUntilStopped = async (command, context, messenger, opt
             throw new CliError("configuration_error", `port ${http.port} is in use — pass another with --port`);
         throw error;
     });
-    context.renderer.note(`serving on ${listening.url.href} — point your tunnel at it; connectors use ${new URL("/mcp", http.publicUrl).href}`);
+    context.renderer.note(`serving on ${listening.url.href} — point your tunnel at it; connectors use ${mcpUrlOf(http.publicUrl).href}`);
     await new Promise((resolve) => {
         process.once("SIGINT", resolve);
         process.once("SIGTERM", resolve);

package/dist/mcp/stdio-wire.d.ts

@@ -0,0 +1,14 @@
+import { PassThrough, type Readable, Writable } from "node:stream";
+/**
+ * Stdin and stdout as the transport sees them, noting each request that comes in and each answer that goes out, so
+ * the server can tell when everything asked has been answered. The transport's stdin never ends by itself: the server
+ * closes it, after the client's stdin ended and the last answer went out.
+ */
+export declare const answeredWire: (source: Readable, sink: Writable) => {
+    input: PassThrough;
+    output: Writable;
+    ended: Promise<void>;
+    answered: () => Promise<void>;
+    /** Lets go of the real stdin, so it no longer holds the process open. */
+    release: () => void;
+};

package/dist/mcp/stdio-wire.js

@@ -0,0 +1,72 @@
+import { PassThrough, Writable } from "node:stream";
+const lineReader = (onMessage) => {
+    let rest = "";
+    return (chunk) => {
+        const lines = (rest + chunk.toString()).split("\n");
+        rest = lines.pop() ?? "";
+        for (const line of lines) {
+            try {
+                const message = JSON.parse(line);
+                if (message !== null && typeof message === "object")
+                    onMessage(message);
+            }
+            catch {
+                // Not a message; the transport answers it as a parse error.
+            }
+        }
+    };
+};
+/**
+ * Stdin and stdout as the transport sees them, noting each request that comes in and each answer that goes out, so
+ * the server can tell when everything asked has been answered. The transport's stdin never ends by itself: the server
+ * closes it, after the client's stdin ended and the last answer went out.
+ */
+export const answeredWire = (source, sink) => {
+    const asked = new Set();
+    let settle;
+    const input = new PassThrough();
+    const onData = lineReader(({ id, method }) => {
+        if (id !== undefined && typeof method === "string")
+            asked.add(JSON.stringify(id));
+    });
+    const output = new Writable({
+        write: (chunk, _encoding, done) => {
+            noteAnswer(chunk);
+            sink.write(chunk, done);
+        },
+    });
+    const noteAnswer = lineReader(({ id, method }) => {
+        if (id === undefined || method !== undefined)
+            return;
+        asked.delete(JSON.stringify(id));
+        if (asked.size === 0)
+            settle?.();
+    });
+    const forward = (chunk) => {
+        onData(chunk);
+        input.write(chunk);
+    };
+    source.on("data", forward);
+    const ended = new Promise((resolve) => {
+        source.once("end", resolve);
+        source.once("close", resolve);
+    });
+    return {
+        input,
+        output,
+        ended,
+        answered: () => new Promise((resolve) => {
+            if (asked.size === 0)
+                resolve();
+            else
+                settle = resolve;
+        }),
+        /** Lets go of the real stdin, so it no longer holds the process open. */
+        release: () => {
+            source.off("data", forward);
+            if (source.listenerCount("data") === 0)
+                source.pause();
+            input.end();
+        },
+    };
+};

package/dist/sends/index.d.ts

@@ -3,7 +3,7 @@ export { type FloodDeadline, FloodMemory, type FloodState, FROZEN_HOLD_MS, flood
 export { type Asker, type GuardRequest, guardFor, type SendGuard, type SendGuardOptions, sendGuard, sharedJournal, } from "./guard.js";
 export { currentOperation, guardedWrite, type Operated } from "./guarded.js";
 export { type AccountAction, type ChatAction, type SendEntry, SendJournal, type SendKind, type SendOutcome, sendsPathFor, } from "./journal.js";
-export { CEILING_KEY, DEFAULT_PERMISSIONS, keyForCommand, keyForWrite, LEVELS, type Level, layerPermissions, levelFor, type PermissionKey, permissionOverrides, readKeysForCommand, skipFlagFor, WRITE_KEYS, } from "./permissions.js";
+export { assertOverridesTighten, CEILING_KEY, COMMAND_PATH_KEY, DEFAULT_PERMISSIONS, keyForCommand, keyForWrite, LEVELS, type Level, layerPermissions, levelFor, type PermissionKey, permissionOverrides, readKeysForCommand, skipFlagFor, WRITE_KEYS, } from "./permissions.js";
 export { type Recipient, RecipientList, recipientsPathFor } from "./recipients.js";
 export { newOperationId, newSendId } from "./send-id.js";
 export { MAX_BUFFERED_UPLOAD_BYTES, readUpload, refusedPlace, uploadBlob, uploadBytes, uploadSize, } from "./upload.js";

package/dist/sends/index.js

@@ -2,7 +2,7 @@ export { FloodMemory, FROZEN_HOLD_MS, floodPathFor, LIMITED_HOLD_MS, } from "./f
 export { guardFor, sendGuard, sharedJournal, } from "./guard.js";
 export { currentOperation, guardedWrite } from "./guarded.js";
 export { SendJournal, sendsPathFor, } from "./journal.js";
-export { CEILING_KEY, DEFAULT_PERMISSIONS, keyForCommand, keyForWrite, LEVELS, layerPermissions, levelFor, permissionOverrides, readKeysForCommand, skipFlagFor, WRITE_KEYS, } from "./permissions.js";
+export { assertOverridesTighten, CEILING_KEY, COMMAND_PATH_KEY, DEFAULT_PERMISSIONS, keyForCommand, keyForWrite, LEVELS, layerPermissions, levelFor, permissionOverrides, readKeysForCommand, skipFlagFor, WRITE_KEYS, } from "./permissions.js";
 export { RecipientList, recipientsPathFor } from "./recipients.js";
 export { newOperationId, newSendId } from "./send-id.js";
 export { MAX_BUFFERED_UPLOAD_BYTES, readUpload, refusedPlace, uploadBlob, uploadBytes, uploadSize, } from "./upload.js";

package/dist/sends/permissions.d.ts

@@ -62,8 +62,16 @@ export declare const readKeysForCommand: (path: readonly string[]) => Permission
  * `undefined` for a path this package does not know — a CLI's own command, which its CLI maps.
  */
 export declare const keyForCommand: (path: readonly string[]) => PermissionKey | null | undefined;
+/** A messenger's key starts with one of its resources, so a misspelled resource is refused by its shape alone. */
+export declare const RESOURCE_KEY: RegExp;
+/**
+ * A key of a CLI that declares its own commands (`commandPermissions`): any command path. Which paths exist is
+ * checked against the program, not here. Past the first word a key may hold capitals, as Google's method ids do
+ * (`api.calendar.calendarList.list`).
+ */
+export declare const COMMAND_PATH_KEY: RegExp;
 /** Startup overrides are a nearer layer than the saved profile, and never write that profile. */
-export declare const permissionOverrides: (entries?: readonly string[]) => Record<PermissionKey, Level>;
+export declare const permissionOverrides: (entries?: readonly string[], shape?: RegExp) => Record<PermissionKey, Level>;
 /** No startup flag grants access: an override may narrow the profile's level, never lift it or a key under it. */
-export declare const assertOverridesTighten: (overrides: Readonly<Record<PermissionKey, Level>>, profile: Readonly<Record<PermissionKey, Level>>) => void;
+export declare const assertOverridesTighten: (overrides: Readonly<Record<PermissionKey, Level>>, profile: Readonly<Record<PermissionKey, Level>>, defaults?: Readonly<Record<PermissionKey, Level>>) => void;
 export declare const assertRetentionEvidenceRead: (permissions: Readonly<Record<string, Level>>) => void;

package/dist/sends/permissions.js

@@ -409,25 +409,33 @@ export const keyForCommand = (path) => {
         return path.join(".");
     return undefined;
 };
+/** A messenger's key starts with one of its resources, so a misspelled resource is refused by its shape alone. */
+export const RESOURCE_KEY = new RegExp(`^(${RESOURCES.join("|")})(\\.[a-z][a-z-]*)*$`);
+/**
+ * A key of a CLI that declares its own commands (`commandPermissions`): any command path. Which paths exist is
+ * checked against the program, not here. Past the first word a key may hold capitals, as Google's method ids do
+ * (`api.calendar.calendarList.list`).
+ */
+export const COMMAND_PATH_KEY = /^[a-z][a-z-]*(\.[a-zA-Z][a-zA-Z-]*)*$/;
 /** Startup overrides are a nearer layer than the saved profile, and never write that profile. */
-export const permissionOverrides = (entries = []) => {
+export const permissionOverrides = (entries = [], shape = RESOURCE_KEY) => {
     const levels = {};
-    const path = new RegExp(`^(${RESOURCES.join("|")})(\\.[a-z][a-z-]*)*$`);
+    const example = shape === RESOURCE_KEY ? "messages.send=allow" : "api=readonly";
     for (const entry of entries) {
         const [key = "", level = "", extra] = entry.split("=");
-        if (!path.test(key) || !LEVELS.includes(level) || extra !== undefined)
-            throw new CliError("validation_error", "--permission takes a command path and level, e.g. messages.send=allow (deny, readonly, ask, allow)");
+        if (!shape.test(key) || !LEVELS.includes(level) || extra !== undefined)
+            throw new CliError("validation_error", `--permission takes a command path and level, e.g. ${example} (deny, readonly, ask, allow)`);
         levels[key] = level;
     }
     return levels;
 };
 /** No startup flag grants access: an override may narrow the profile's level, never lift it or a key under it. */
-export const assertOverridesTighten = (overrides, profile) => {
+export const assertOverridesTighten = (overrides, profile, defaults = DEFAULT_PERMISSIONS) => {
     for (const [key, level] of Object.entries(overrides)) {
         const under = Object.keys(profile).filter((named) => named.startsWith(`${key}.`));
-        const lifted = [key, ...under].find((named) => ORDER[level] > ORDER[levelFor(profile, named).level]);
+        const lifted = [key, ...under].find((named) => ORDER[level] > ORDER[levelFor(profile, named, defaults).level]);
         if (lifted !== undefined)
-            throw new CliError("validation_error", `--permission ${key}=${level} would loosen ${lifted} from ${levelFor(profile, lifted).level}; ` +
+            throw new CliError("validation_error", `--permission ${key}=${level} would loosen ${lifted} from ${levelFor(profile, lifted, defaults).level}; ` +
                 "it only tightens — change the profile's permissions to loosen it", { key, lifted });
     }
 };

package/dist/store/sqlite/note-search.js

@@ -12,6 +12,7 @@ import { documentOf, noteOf } from "./notes.js";
 import { stemmerCache } from "./stems.js";
 import { canonicalTagNamed } from "./tags.js";
 import { read } from "./transaction.js";
+import { searchIndex } from "./vector-index.js";
 import { dot } from "./vectors.js";
 /** The fields a note has. A message-only field (`from:`, `chat:`, …) is refused rather than matching nothing. */
 export const NOTE_FIELDS = [
@@ -375,29 +376,72 @@ export const noteSearchOver = (context) => {
         nearest: async (model, query, { limit, folderIds, withInternal, source }) => {
             drain();
             const scope = live(folderIds, source, withInternal);
-            const page = database.prepare(`SELECT k.id, k.chunkable_type AS type, k.chunkable_id AS owner, k.start_offset AS start, k.end_offset AS end, v.vector
-           FROM chunks k JOIN embeddings v ON v.model = ? AND v.content_hash = k.content_hash
-          WHERE k.id > ?${scope.sql}
-          ORDER BY k.id LIMIT ?`);
-            const best = new Map();
-            let after = 0;
-            for (;;) {
-                const rows = page.all(model, after, ...scope.params, SCAN_PAGE);
-                for (const row of rows) {
-                    const score = dot(query, row.vector);
-                    const key = `${row.type}:${row.owner}`;
-                    if (score > (best.get(key)?.score ?? Number.NEGATIVE_INFINITY))
-                        best.set(key, { score, start: Number(row.start), end: Number(row.end) });
+            const columns = `k.id, k.chunkable_type AS type, k.chunkable_id AS owner, k.start_offset AS start,
+        k.end_offset AS end, k.content_hash AS hash, v.vector
+           FROM chunks k JOIN embeddings v ON v.model = ? AND v.content_hash = k.content_hash`;
+            const keep = (best, row) => {
+                const score = dot(query, row.vector);
+                const key = `${row.type}:${row.owner}`;
+                const held = best.get(key);
+                if (!held || score > held.score)
+                    best.set(key, {
+                        score,
+                        first: held?.first ?? Number(row.id),
+                        chunk: Number(row.id),
+                        start: Number(row.start),
+                        end: Number(row.end),
+                    });
+            };
+            // The scan meets each note first at its lowest chunk, and keeps that order among equal scores.
+            const ranked = (best) => [...best.entries()].sort(([, a], [, b]) => b.score - a.score || a.first - b.first).slice(0, limit);
+            const indexed = () => {
+                const types = source === undefined ? ["document", "note"] : source === "file" ? ["document"] : ["note"];
+                const accounts = database.prepare("SELECT DISTINCT coalesce(account_id, 0) AS account FROM chunks WHERE chunkable_type = ?");
+                const wanted = folderIds?.length ? new Set(folderIds.map(Number)) : undefined;
+                const candidates = database.prepare(`SELECT ${columns} WHERE k.id IN (SELECT value FROM json_each(?))${scope.sql} ORDER BY k.id`);
+                const first = database.prepare(`SELECT min(k.id) AS first FROM chunks k JOIN embeddings v ON v.model = ? AND v.content_hash = k.content_hash
+            WHERE k.chunkable_type = ? AND k.chunkable_id = ?${scope.sql}`);
+                const merged = new Map();
+                for (const type of types)
+                    for (const { account } of accounts.all(type)) {
+                        if (type === "document" && wanted && !wanted.has(Number(account)))
+                            continue;
+                        const found = searchIndex(database, model, { kind: type, account: Number(account) }, query, limit, (near) => {
+                            const hashes = new Map(near.map(({ id, hash }) => [id, hash]));
+                            const best = new Map();
+                            for (const row of candidates.all(model, JSON.stringify([...hashes.keys()]), ...scope.params))
+                                if (hashes.get(Number(row.id)) === row.hash)
+                                    keep(best, row);
+                            for (const [key, held] of best) {
+                                const [kind, owner] = key.split(":");
+                                held.first = Number(first.get(model, String(kind), Number(owner), ...scope.params)?.first);
+                            }
+                            const results = ranked(best);
+                            return { results, best: results.map(([, { chunk }]) => chunk) };
+                        });
+                        if (!found)
+                            return undefined;
+                        for (const [key, held] of found)
+                            merged.set(key, held);
+                    }
+                return ranked(merged);
+            };
+            const scanned = () => {
+                const page = database.prepare(`SELECT ${columns} WHERE k.id > ?${scope.sql} ORDER BY k.id LIMIT ?`);
+                const best = new Map();
+                let after = 0;
+                for (;;) {
+                    const rows = page.all(model, after, ...scope.params, SCAN_PAGE);
+                    for (const row of rows)
+                        keep(best, row);
+                    const last = rows.at(-1);
+                    if (!last || rows.length < SCAN_PAGE)
+                        break;
+                    after = Number(last.id);
                 }
-                const last = rows.at(-1);
-                if (!last || rows.length < SCAN_PAGE)
-                    break;
-                after = Number(last.id);
-            }
-            return [...best.entries()]
-                .sort(([, a], [, b]) => b.score - a.score)
-                .slice(0, limit)
-                .flatMap(([key, { score, start, end }]) => {
+                return ranked(best);
+            };
+            return (indexed() ?? scanned()).flatMap(([key, { score, start, end }]) => {
                 const [type, id] = key.split(":");
                 const note = read(String(type), Number(id));
                 return note ? [{ ref: note.ref, note, score, range: { start, end } }] : [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-core",
-  "version": "0.449.0",
+  "version": "0.451.0",
   "description": "The messenger-neutral half of a messaging CLI: domain model, message locators, rendering, name resolution, the SQLite seam, the command skeleton and shared read commands, the send guard, run records and the message store",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",
@@ -176,7 +176,7 @@
     "@modelcontextprotocol/server": "^2.4.0",
     "@resvg/resvg-js": "2.6.2",
     "@valibot/to-json-schema": "1.8.0",
-    "@wirecat/cli-core-onnx": "1.1.0",
+    "@wirecat/cli-core-onnx": "1.2.0",
     "@wirecat/cli-core-sqlite": "1.1.0",
     "@xmldom/xmldom": "0.9.12",
     "chardet": "2.2.0",
@@ -217,7 +217,7 @@
     "@types/node": "^22.20.5",
     "@types/pngjs": "6.0.5",
     "@vitest/coverage-v8": "^5.0.5",
-    "@wirecat/cli-base": "0.62.0",
+    "@wirecat/cli-base": "0.63.0",
     "@wirecat/cli-core-legacy-tags": "npm:@wirecat/cli-core@0.414.0",
     "commander": "15.0.0",
     "cspell": "10.4.0",
@@ -237,7 +237,7 @@
   },
   "peerDependencies": {
     "@napi-rs/canvas": ">=0.1.69 <2",
-    "@wirecat/cli-base": ">=0.62.0 <0.63.0",
+    "@wirecat/cli-base": ">=0.63.0 <0.64.0",
     "commander": ">=15"
   },
   "bin": {