grepmax 0.23.0 → 0.25.0

package/dist/lib/workers/embeddings/mlx-client.js

@@ -47,6 +47,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateMlxEmbeddingResponse = validateMlxEmbeddingResponse;
 exports.isMlxUp = isMlxUp;
 exports.mlxEmbed = mlxEmbed;
 const http = __importStar(require("node:http"));
@@ -55,11 +56,31 @@ const MLX_PORT = parseInt(process.env.MLX_EMBED_PORT || "8100", 10);
 const MLX_HOST = "127.0.0.1";
 const MLX_TIMEOUT_MS = 10000;
 const EMBED_MODE = process.env.GMAX_EMBED_MODE || "auto";
+const FLOAT32_MAX = 3.4028234663852886e38;
 let mlxAvailable = null;
 let lastCheck = 0;
 const CHECK_INTERVAL_MS = 30000;
 let lastMlxWarning = 0;
 const MLX_WARNING_INTERVAL_MS = 60000;
+let checkedModel;
+function validateMlxEmbeddingResponse(data, textCount, expectedModel, expectedDim) {
+    if (!data || typeof data !== "object")
+        return false;
+    const response = data;
+    return (typeof response.model === "string" &&
+        (!expectedModel || response.model === expectedModel) &&
+        typeof response.dim === "number" &&
+        Number.isInteger(response.dim) &&
+        (expectedDim === undefined || response.dim === expectedDim) &&
+        Array.isArray(response.vectors) &&
+        response.vectors.length === textCount &&
+        response.vectors.every((vector) => Array.isArray(vector) &&
+            vector.length === response.dim &&
+            (expectedDim === undefined || vector.length === expectedDim) &&
+            vector.every((element) => typeof element === "number" &&
+                Number.isFinite(element) &&
+                Math.abs(element) <= FLOAT32_MAX)));
+}
 function postJSON(reqPath, body) {
     const start = performance.now();
     return new Promise((resolve) => {
@@ -106,15 +127,24 @@ function postJSON(reqPath, body) {
 /**
  * Check if MLX server is reachable. Caches result for CHECK_INTERVAL_MS.
  */
-function checkHealth() {
+function checkHealth(expectedModel) {
     return __awaiter(this, void 0, void 0, function* () {
         const start = performance.now();
         return new Promise((resolve) => {
             const req = http.get({ hostname: MLX_HOST, port: MLX_PORT, path: "/health", timeout: 2000 }, (res) => {
-                res.resume();
-                const ok = res.statusCode === 200;
-                (0, logger_1.debug)("mlx", `health → ${ok ? "ok" : `status=${res.statusCode}`} ${(performance.now() - start).toFixed(0)}ms`);
-                resolve(ok);
+                const chunks = [];
+                res.on("data", (chunk) => chunks.push(chunk));
+                res.on("end", () => {
+                    let model;
+                    try {
+                        model = JSON.parse(Buffer.concat(chunks).toString("utf8")).model;
+                    }
+                    catch (_a) { }
+                    const ok = res.statusCode === 200 &&
+                        (!expectedModel || model === expectedModel);
+                    (0, logger_1.debug)("mlx", `health → ${ok ? "ok" : `status=${res.statusCode} model=${String(model)}`} ${(performance.now() - start).toFixed(0)}ms`);
+                    resolve(ok);
+                });
             });
             req.on("error", (err) => {
                 (0, logger_1.debug)("mlx", `health → error: ${err.message} ${(performance.now() - start).toFixed(0)}ms`);
@@ -128,19 +158,21 @@ function checkHealth() {
         });
     });
 }
-function isMlxUp() {
+function isMlxUp(expectedModel) {
     return __awaiter(this, void 0, void 0, function* () {
         const now = Date.now();
-        if (mlxAvailable !== null && now - lastCheck < CHECK_INTERVAL_MS) {
+        if (checkedModel === expectedModel &&
+            mlxAvailable !== null &&
+            now - lastCheck < CHECK_INTERVAL_MS) {
             (0, logger_1.debug)("mlx", `isMlxUp cached=${mlxAvailable} age=${now - lastCheck}ms`);
             return mlxAvailable;
         }
-        let result = yield checkHealth();
+        let result = yield checkHealth(expectedModel);
         // On first check (cold start), retry once after 3s — server may still be loading
         if (!result && mlxAvailable === null) {
             console.log("[mlx] Embed server not ready, retrying in 3s...");
             yield new Promise((r) => setTimeout(r, 3000));
-            result = yield checkHealth();
+            result = yield checkHealth(expectedModel);
             if (result) {
                 console.log("[mlx] Embed server ready");
             }
@@ -149,6 +181,7 @@ function isMlxUp() {
             }
         }
         mlxAvailable = result;
+        checkedModel = expectedModel;
         lastCheck = now;
         return result;
     });
@@ -157,16 +190,21 @@ function isMlxUp() {
  * Get dense embeddings from MLX server.
  * Returns Float32Array[] on success, null if server unavailable.
  */
-function mlxEmbed(texts) {
+function mlxEmbed(texts, options) {
     return __awaiter(this, void 0, void 0, function* () {
-        if (EMBED_MODE === "cpu")
+        var _a;
+        const mode = (_a = options === null || options === void 0 ? void 0 : options.mode) !== null && _a !== void 0 ? _a : EMBED_MODE;
+        if (mode === "cpu")
             return null;
-        if (!(yield isMlxUp()))
+        if (!(yield isMlxUp(options === null || options === void 0 ? void 0 : options.expectedModel)))
             return null;
         (0, logger_1.debug)("mlx", `embed ${texts.length} texts`);
         let postResult;
         try {
-            postResult = yield postJSON("/embed", { texts });
+            postResult = yield postJSON("/embed", {
+                texts,
+                expected_model: options === null || options === void 0 ? void 0 : options.expectedModel,
+            });
         }
         catch (error) {
             mlxAvailable = false;
@@ -178,7 +216,8 @@ function mlxEmbed(texts) {
             return null;
         }
         const { ok, data } = postResult;
-        if (!ok || !(data === null || data === void 0 ? void 0 : data.vectors)) {
+        const responseMatches = validateMlxEmbeddingResponse(data, texts.length, options === null || options === void 0 ? void 0 : options.expectedModel, options === null || options === void 0 ? void 0 : options.expectedDim);
+        if (!ok || !responseMatches) {
             const wasPreviouslyAvailable = mlxAvailable !== false;
             mlxAvailable = false;
             const now = Date.now();
@@ -186,8 +225,12 @@ function mlxEmbed(texts) {
                 now - lastMlxWarning >= MLX_WARNING_INTERVAL_MS) {
                 console.error("[mlx] Embed server failed: bad response (ok=" +
                     ok +
-                    ", hasVectors=" +
-                    !!(data === null || data === void 0 ? void 0 : data.vectors) +
+                    ", validResponse=" +
+                    responseMatches +
+                    ", dim=" +
+                    String(data === null || data === void 0 ? void 0 : data.dim) +
+                    ", model=" +
+                    String(data === null || data === void 0 ? void 0 : data.model) +
                     ")");
                 lastMlxWarning = now;
             }

package/dist/lib/workers/orchestrator.js

@@ -51,9 +51,11 @@ const ort = __importStar(require("onnxruntime-node"));
 const uuid_1 = require("uuid");
 const config_1 = require("../../config");
 const chunker_1 = require("../index/chunker");
+const embedding_generation_1 = require("../index/embedding-generation");
 const skeleton_1 = require("../skeleton");
 const file_utils_1 = require("../utils/file-utils");
 const logger_1 = require("../utils/logger");
+const path_containment_1 = require("../utils/path-containment");
 const colbert_math_1 = require("./colbert-math");
 const colbert_1 = require("./embeddings/colbert");
 const granite_1 = require("./embeddings/granite");
@@ -115,13 +117,16 @@ if (fs.existsSync(LOCAL_MODELS)) {
     log(`Worker: Using local models from ${LOCAL_MODELS}`);
 }
 class WorkerOrchestrator {
-    constructor(vectorDim) {
-        this.colbert = new colbert_1.ColbertModel();
+    constructor(generation, embedMode) {
+        this.generation = generation;
+        this.embedMode = embedMode;
         this.chunker = new chunker_1.TreeSitterChunker();
         this.skeletonizer = new skeleton_1.Skeletonizer();
         this.initPromise = null;
-        this.vectorDimensions = vectorDim !== null && vectorDim !== void 0 ? vectorDim : config_1.CONFIG.VECTOR_DIM;
-        this.granite = new granite_1.GraniteModel(this.vectorDimensions);
+        this.vectorDimensions = generation.vectorDim;
+        this.allowOnnxFallback = (0, embedding_generation_1.isOnnxFallbackCompatible)(generation);
+        this.granite = new granite_1.GraniteModel(generation.vectorDim, generation.onnxModel);
+        this.colbert = new colbert_1.ColbertModel(generation.colbertModel);
     }
     ensureReady() {
         return __awaiter(this, void 0, void 0, function* () {
@@ -159,17 +164,31 @@ class WorkerOrchestrator {
             const BATCH_SIZE = Number.isFinite(envBatch) && envBatch > 0
                 ? Math.max(4, Math.min(16, envBatch))
                 : 16;
+            let denseBackend = null;
             for (let i = 0; i < texts.length; i += BATCH_SIZE) {
                 if (i > 0)
                     onProgress === null || onProgress === void 0 ? void 0 : onProgress();
                 const batchTexts = texts.slice(i, i + BATCH_SIZE);
                 const batchStart = performance.now();
                 // Try MLX GPU server first, fall back to ONNX CPU
-                const mlxResult = yield (0, mlx_client_1.mlxEmbed)(batchTexts);
+                const mlxResult = denseBackend === "onnx"
+                    ? null
+                    : yield (0, mlx_client_1.mlxEmbed)(batchTexts, {
+                        mode: this.embedMode,
+                        expectedModel: this.generation.mlxModel,
+                        expectedDim: this.generation.vectorDim,
+                    });
+                if (!mlxResult && !this.allowOnnxFallback) {
+                    throw new Error(`MLX embedding model ${this.generation.mlxModel} is unavailable; ONNX fallback is disabled for this custom embedding generation`);
+                }
+                if (!mlxResult && denseBackend === "mlx") {
+                    throw new Error(`MLX embedding model ${this.generation.mlxModel} became unavailable during this embedding operation`);
+                }
                 if (!mlxResult && !mlxFallbackWarned) {
                     console.warn("[embed] MLX unavailable, falling back to CPU (ONNX)");
                     mlxFallbackWarned = true;
                 }
+                denseBackend = mlxResult ? "mlx" : "onnx";
                 const denseBatch = mlxResult !== null && mlxResult !== void 0 ? mlxResult : (yield this.granite.runBatch(batchTexts));
                 const colbertBatch = yield this.colbert.runBatch(batchTexts, denseBatch, this.vectorDimensions);
                 (0, logger_1.debug)("orch", `embed batch ${i / BATCH_SIZE + 1}/${Math.ceil(texts.length / BATCH_SIZE)} (${batchTexts.length} texts) mlx=${!!mlxResult} ${(performance.now() - batchStart).toFixed(0)}ms`);
@@ -243,8 +262,13 @@ class WorkerOrchestrator {
                 : input.absolutePath
                     ? input.absolutePath
                     : path.join(PROJECT_ROOT, input.path);
+            (0, path_containment_1.resolveContainedPath)(input.projectRoot, absolutePath, {
+                verifyExistingTarget: true,
+            });
             (0, logger_1.debug)("orch", `processFile start: ${input.path}`);
-            const { buffer, mtimeMs, size } = yield (0, file_utils_1.readFileSnapshot)(absolutePath);
+            const { buffer, mtimeMs, size } = yield (0, file_utils_1.readFileSnapshot)(absolutePath, {
+                projectRoot: input.projectRoot,
+            });
             const hash = (0, file_utils_1.computeContentHash)(buffer, absolutePath);
             if (!(0, file_utils_1.isIndexableFile)(absolutePath, size)) {
                 (0, logger_1.debug)("orch", `skip ${input.path} (non-indexable, size=${size})`);
@@ -309,7 +333,14 @@ class WorkerOrchestrator {
             var _a;
             yield this.ensureReady();
             // Try MLX GPU server first, fall back to ONNX CPU
-            const mlxResult = yield (0, mlx_client_1.mlxEmbed)([text]);
+            const mlxResult = yield (0, mlx_client_1.mlxEmbed)([text], {
+                mode: this.embedMode,
+                expectedModel: this.generation.mlxModel,
+                expectedDim: this.generation.vectorDim,
+            });
+            if (!mlxResult && !this.allowOnnxFallback) {
+                throw new Error(`MLX embedding model ${this.generation.mlxModel} is unavailable; ONNX fallback is disabled for this custom embedding generation`);
+            }
             const denseVector = (_a = mlxResult === null || mlxResult === void 0 ? void 0 : mlxResult[0]) !== null && _a !== void 0 ? _a : (yield this.granite.runBatch([text]))[0];
             const encoded = yield this.colbert.encodeQuery(text);
             const feeds = {
@@ -398,7 +429,7 @@ class WorkerOrchestrator {
                 const tokenIds = Array.isArray(doc.token_ids) && doc.token_ids.length === seqLen
                     ? doc.token_ids
                     : undefined;
-                return (0, colbert_math_1.maxSim)(queryMatrix, docMatrix, tokenIds);
+                return (0, colbert_math_1.maxSim)(queryMatrix, docMatrix, tokenIds, this.generation.colbertModel);
             });
         });
     }

package/dist/lib/workers/pool.js

@@ -55,6 +55,7 @@ const childProcess = __importStar(require("node:child_process"));
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const config_1 = require("../../config");
+const embedding_generation_1 = require("../index/embedding-generation");
 const index_config_1 = require("../index/index-config");
 const logger_1 = require("../utils/logger");
 function reviveBufferLike(input) {
@@ -120,16 +121,19 @@ const REAP_FORCE_KILL_GRACE_MS = 5000;
  * every worker user (index, add, search, daemon, mcp). Merged so process.env can
  * override — see the spread order at fork().
  */
-function embeddingEnv() {
-    const { modelTier } = (0, index_config_1.readGlobalConfig)();
-    const ids = (0, index_config_1.getModelIdsForTier)(modelTier);
+function embeddingEnv(generation, embedMode) {
+    const config = generation && embedMode ? null : (0, index_config_1.readGlobalConfig)();
+    const resolved = generation !== null && generation !== void 0 ? generation : (0, embedding_generation_1.resolveEmbeddingGeneration)(config);
+    const mode = embedMode !== null && embedMode !== void 0 ? embedMode : config.embedMode;
     return {
-        GMAX_VECTOR_DIM: String(ids.vectorDim),
-        GMAX_EMBED_ONNX_MODEL: ids.embed,
+        GMAX_VECTOR_DIM: String(resolved.vectorDim),
+        GMAX_EMBED_ONNX_MODEL: resolved.onnxModel,
+        GMAX_EMBED_MODE: mode,
+        GMAX_EMBEDDING_GENERATION: JSON.stringify(resolved),
     };
 }
 class ProcessWorker {
-    constructor(modulePath, execArgv, maxMemoryMb) {
+    constructor(modulePath, execArgv, embeddingEnvironment, maxMemoryMb) {
         this.modulePath = modulePath;
         this.execArgv = execArgv;
         this.busy = false;
@@ -140,16 +144,17 @@ class ProcessWorker {
         this.busySince = null;
         // Most recent RSS (bytes) the worker reported, for memory-based recycling.
         this.lastRssBytes = 0;
+        // Consecutive post-task readings over WORKER_RSS_RECYCLE_MB. Recycling
+        // waits for BLOAT_STREAK_TO_RECYCLE of these; reset by any lean reading.
+        this.bloatStreak = 0;
         // Set when the pool has cleaned up after this worker (via exit or error
         // event). Guards against handleWorkerExit running twice when both events
         // fire for the same crash.
         this.cleanedUp = false;
         const memArgs = maxMemoryMb ? [`--max-old-space-size=${maxMemoryMb}`] : [];
-        // embeddingEnv() first so a manually-exported GMAX_VECTOR_DIM /
-        // GMAX_EMBED_ONNX_MODEL in process.env still wins (spread last).
         this.child = childProcess.fork(modulePath, {
             execArgv: [...memArgs, ...execArgv],
-            env: Object.assign(Object.assign({}, embeddingEnv()), process.env),
+            env: Object.assign(Object.assign({}, process.env), embeddingEnvironment),
         });
     }
 }
@@ -160,7 +165,10 @@ function resolveProcessWorker() {
         return { filename: jsWorker, execArgv: [] };
     }
     if (fs.existsSync(tsWorker)) {
-        return { filename: tsWorker, execArgv: ["-r", "ts-node/register"] };
+        return {
+            filename: tsWorker,
+            execArgv: ["--import", require.resolve("tsx")],
+        };
     }
     throw new Error("Process worker file not found");
 }
@@ -171,17 +179,28 @@ const IDLE_WORKER_TIMEOUT_MS = 60000; // reap idle workers after 60s
 // load models) on the rare search is preferable to keeping a second worker
 // warm. The pool still scales up to maxWorkers on demand for indexing bursts.
 const MIN_KEEP_WORKERS = 1;
-// Recycle an idle worker whose RSS has grown past this. ONNX native memory
-// (model arenas) lives outside V8, so --max-old-space-size can't bound it — a
-// worker that processed one big file can stay pinned at ~2 GB. Replacing it
-// with a fresh worker reclaims that. 0 (or negative) disables the check.
+// Recycle a worker whose RSS has grown past this. ONNX native memory lives
+// outside V8, so --max-old-space-size can't bound it; replacing the worker is
+// the only reclaim. The threshold must sit ABOVE the healthy working set or
+// the pool executes warm workers for normal behavior: measured steady state
+// is ~700-800 MB with MLX serving dense embeds and ~900-1050 MB in ONNX CPU
+// fallback (granite session loaded in-process), flat across task count and
+// file size. The old 800 default was calibrated for the pre-
+// enableCpuMemArena:false era (arenas pinned ~2 GB) and sat inside the
+// healthy range — every busy worker was recycled after nearly every task,
+// paying a full model reload each time. 0 (or negative) disables the check.
 const WORKER_RSS_RECYCLE_MB = (() => {
     var _a;
     const fromEnv = Number.parseInt((_a = process.env.GMAX_WORKER_RSS_RECYCLE_MB) !== null && _a !== void 0 ? _a : "", 10);
     if (Number.isFinite(fromEnv))
         return fromEnv;
-    return 800;
+    return 1536;
 })();
+// Post-task recycling waits for this many consecutive over-threshold readings.
+// V8 holds freed heap after a big file, so a single post-task reading can show
+// a transient high-water mark that the next task's GC releases; the second
+// reading confirms the memory is actually sticky.
+const BLOAT_STREAK_TO_RECYCLE = 2;
 // Methods that must skip the indexing backlog. encodeQuery is the search hot
 // path: a single query is ~17ms but waits behind every queued processFile.
 // rerank is similarly small and latency-sensitive.
@@ -190,7 +209,7 @@ const PRIORITY_METHODS = new Set([
     "rerank",
 ]);
 class WorkerPool {
-    constructor() {
+    constructor(generation, embedMode) {
         this.workers = [];
         // Two queues so searches don't wait behind a long indexing backlog. Priority
         // tasks (encodeQuery/rerank) are dispatched first; processFile tasks queue
@@ -198,7 +217,6 @@ class WorkerPool {
         this.priorityQueue = [];
         this.taskQueue = [];
         this.tasks = new Map();
-        this.abortedTasks = new Set();
         this.nextId = 1;
         this.destroyed = false;
         this.destroyPromise = null;
@@ -209,6 +227,14 @@ class WorkerPool {
         this.modulePath = resolved.filename;
         this.execArgv = resolved.execArgv;
         this.maxWorkers = Math.max(1, config_1.CONFIG.WORKER_THREADS);
+        const config = generation && embedMode ? null : (0, index_config_1.readGlobalConfig)();
+        this.generation = generation !== null && generation !== void 0 ? generation : (0, embedding_generation_1.resolveEmbeddingGeneration)(config);
+        this.embedMode = embedMode !== null && embedMode !== void 0 ? embedMode : config.embedMode;
+        const generatedEmbeddingEnv = embeddingEnv(this.generation, this.embedMode);
+        // Replacement workers must use the same embedding generation as the pool
+        // that created them, even if config changes while tasks are running. Other
+        // process environment remains live and is copied at each fork.
+        this.embeddingEnvironment = Object.freeze(generatedEmbeddingEnv);
         // Lazy spawn: start with 1 worker, scale up on demand
         this.spawnWorker();
         // Periodically reap idle workers back to MIN_KEEP, and force-kill any
@@ -280,6 +306,10 @@ class WorkerPool {
     }
     completeTask(task, worker) {
         this.clearTaskTimeout(task);
+        if (task.signal && task.abortListener) {
+            task.signal.removeEventListener("abort", task.abortListener);
+            task.abortListener = undefined;
+        }
         this.tasks.delete(task.id);
         this.removeFromQueue(task.id);
         if (worker) {
@@ -320,23 +350,12 @@ class WorkerPool {
         }
     }
     spawnWorker() {
-        const worker = new ProcessWorker(this.modulePath, this.execArgv, config_1.MAX_WORKER_MEMORY_MB);
+        const worker = new ProcessWorker(this.modulePath, this.execArgv, this.embeddingEnvironment, config_1.MAX_WORKER_MEMORY_MB);
         (0, logger_1.log)("pool", `spawn PID:${worker.child.pid} (${this.workers.length + 1}/${Math.max(1, config_1.CONFIG.WORKER_THREADS)})`);
         const onMessage = (msg) => {
             var _a, _b, _c, _d, _e, _f, _g, _h;
             if (typeof msg.rss === "number")
                 worker.lastRssBytes = msg.rss;
-            // Fast cleanup for tasks that were aborted while running
-            if (this.abortedTasks.has(msg.id)) {
-                this.abortedTasks.delete(msg.id);
-                const task = this.tasks.get(msg.id);
-                if (task) {
-                    this.completeTask(task, worker);
-                    this.recycleIfBloated(worker);
-                    this.dispatch();
-                }
-                return;
-            }
             const task = this.tasks.get(msg.id);
             if (!task)
                 return;
@@ -416,34 +435,26 @@ class WorkerPool {
                 payload,
                 resolve: safeResolve,
                 reject: safeReject,
+                signal,
             };
             if (signal) {
-                signal.addEventListener("abort", () => {
-                    // If task is still queued (in either queue), remove it
-                    const pi = this.priorityQueue.indexOf(id);
-                    if (pi !== -1)
-                        this.priorityQueue.splice(pi, 1);
-                    const idx = this.taskQueue.indexOf(id);
-                    if (pi !== -1 || idx !== -1) {
-                        if (idx !== -1)
-                            this.taskQueue.splice(idx, 1);
-                        this.tasks.delete(id);
-                        const err = new Error("Aborted");
-                        err.name = "AbortError";
-                        safeReject(err);
-                    }
-                    // If task is already running (assigned to worker), we can't easily kill it without
-                    // killing the worker. For now, we just let it finish but reject the promise early so
-                    // the caller doesn't wait. The worker will eventually finish and we'll ignore the result.
-                    else if (this.tasks.has(id)) {
-                        // Task is running. Reject caller immediately.
-                        const err = new Error("Aborted");
-                        err.name = "AbortError";
-                        safeReject(err);
-                        // Track for fast cleanup when the worker eventually finishes.
-                        this.abortedTasks.add(id);
+                task.abortListener = () => {
+                    if (!this.tasks.has(id))
+                        return;
+                    const err = new Error("Aborted");
+                    err.name = "AbortError";
+                    safeReject(err);
+                    if (!task.worker) {
+                        this.completeTask(task, null);
+                        this.dispatch();
+                        return;
                     }
-                }, { once: true });
+                    // Caller settlement and worker lifecycle settlement are separate.
+                    // Keep the assignment and timers until the child sends a terminal
+                    // result/error or exits.
+                    task.callerAborted = true;
+                };
+                signal.addEventListener("abort", task.abortListener, { once: true });
             }
             this.tasks.set(id, task);
             if (PRIORITY_METHODS.has(method)) {
@@ -590,14 +601,17 @@ class WorkerPool {
             this.recycleWorker(w, "idle");
     }
     /**
-     * Recycle a worker whose RSS exceeds the threshold the instant it goes free
-     * between tasks. The idle reaper alone can't catch this: under continuous
-     * churn (a busy monorepo trickling one small file at a time) a worker is
-     * dispatched again within the 60s idle window, so a worker that peaked at
-     * ~1.4 GB on one large file never looks "idle" and stays pinned. Checking at
-     * task completion — when busy was just cleared and before the next dispatch —
-     * bounds RSS regardless of how steady the churn is. No-op while busy, so an
-     * in-flight task is never interrupted.
+     * Recycle a worker whose RSS stays over the threshold across consecutive
+     * task completions. The idle reaper alone can't catch this: under
+     * continuous churn (a busy monorepo trickling one small file at a time) a
+     * worker is dispatched again within the 60s idle window, so a genuinely
+     * pinned worker never looks "idle". Checking at task completion — when busy
+     * was just cleared and before the next dispatch — bounds RSS regardless of
+     * how steady the churn is. Requires BLOAT_STREAK_TO_RECYCLE consecutive
+     * over-threshold readings so a one-off high-water mark (V8 holding heap it
+     * frees on the next task's GC) doesn't execute a warm worker and force a
+     * model reload. No-op while busy, so an in-flight task is never
+     * interrupted.
      */
     recycleIfBloated(worker) {
         if (this.destroyed ||
@@ -607,7 +621,13 @@ class WorkerPool {
             return;
         }
         if (worker.lastRssBytes > WORKER_RSS_RECYCLE_MB * 1024 * 1024) {
-            this.recycleWorker(worker, "post-task");
+            worker.bloatStreak++;
+            if (worker.bloatStreak >= BLOAT_STREAK_TO_RECYCLE) {
+                this.recycleWorker(worker, "post-task");
+            }
+        }
+        else {
+            worker.bloatStreak = 0;
         }
     }
     /**
@@ -702,7 +722,7 @@ class WorkerPool {
         });
     }
     destroy() {
-        return __awaiter(this, void 0, void 0, function* () {
+        return __awaiter(this, arguments, void 0, function* (options = {}) {
             if (this.destroyPromise)
                 return this.destroyPromise;
             if (this.destroyed)
@@ -713,46 +733,86 @@ class WorkerPool {
                 this.idleReapInterval = null;
             }
             for (const task of this.tasks.values()) {
-                this.clearTaskTimeout(task);
                 task.reject(new Error("Worker pool destroyed"));
+                this.completeTask(task, null);
             }
-            this.tasks.clear();
             this.taskQueue = [];
             this.priorityQueue = [];
-            const killPromises = this.workers.map((w) => new Promise((resolve) => {
+            const exitedWorkers = new Set();
+            const killPromises = this.workers.map((w) => new Promise((resolve, reject) => {
                 var _a, _b;
                 let settled = false;
                 let force;
-                let fallback;
-                const cleanup = () => {
+                let deadline;
+                const settle = (error) => {
                     if (settled)
                         return;
                     settled = true;
                     if (force)
                         clearTimeout(force);
-                    if (fallback)
-                        clearTimeout(fallback);
-                    resolve();
+                    if (deadline)
+                        clearTimeout(deadline);
+                    if (error)
+                        reject(error);
+                    else
+                        resolve();
+                };
+                const exited = () => {
+                    exitedWorkers.add(w);
+                    settle();
                 };
                 w.cleanedUp = true;
                 w.child.removeAllListeners("message");
                 w.child.removeAllListeners("exit");
                 w.child.removeAllListeners("error");
-                w.child.once("exit", cleanup);
+                w.child.once("exit", exited);
                 force = setTimeout(() => {
                     try {
-                        w.child.kill("SIGKILL");
+                        if (!w.child.kill("SIGKILL") && options.requireExit) {
+                            settle(new Error(`Failed to SIGKILL worker PID:${w.child.pid}`));
+                        }
+                    }
+                    catch (error) {
+                        if (options.requireExit) {
+                            settle(new Error(`Failed to SIGKILL worker PID:${w.child.pid}: ${error instanceof Error ? error.message : String(error)}`));
+                        }
                     }
-                    catch (_a) { }
                 }, FORCE_KILL_GRACE_MS);
                 (_a = force.unref) === null || _a === void 0 ? void 0 : _a.call(force);
-                fallback = setTimeout(cleanup, config_1.WORKER_TIMEOUT_MS);
-                (_b = fallback.unref) === null || _b === void 0 ? void 0 : _b.call(fallback);
-                w.child.kill("SIGTERM");
+                deadline = setTimeout(() => {
+                    if (options.requireExit) {
+                        settle(new Error(`Worker PID:${w.child.pid} did not exit within ${config_1.WORKER_TIMEOUT_MS}ms`));
+                    }
+                    else {
+                        settle();
+                    }
+                }, config_1.WORKER_TIMEOUT_MS);
+                (_b = deadline.unref) === null || _b === void 0 ? void 0 : _b.call(deadline);
+                try {
+                    if (!w.child.kill("SIGTERM") && options.requireExit) {
+                        settle(new Error(`Failed to SIGTERM worker PID:${w.child.pid}`));
+                    }
+                }
+                catch (error) {
+                    if (options.requireExit) {
+                        settle(new Error(`Failed to SIGTERM worker PID:${w.child.pid}: ${error instanceof Error ? error.message : String(error)}`));
+                    }
+                    else {
+                        settle();
+                    }
+                }
             }));
-            this.destroyPromise = Promise.allSettled(killPromises).then(() => {
-                this.workers = [];
-                this.destroyPromise = null;
+            this.destroyPromise = Promise.allSettled(killPromises).then((results) => {
+                this.workers = options.requireExit
+                    ? this.workers.filter((worker) => !exitedWorkers.has(worker))
+                    : [];
+                const failures = results.flatMap((result) => result.status === "rejected" ? [result.reason] : []);
+                if (failures.length > 0) {
+                    const details = failures
+                        .map((failure) => failure instanceof Error ? failure.message : String(failure))
+                        .join("; ");
+                    throw new Error(`Strict worker pool shutdown failed: ${details}`);
+                }
             });
             yield this.destroyPromise;
         });
@@ -761,9 +821,16 @@ class WorkerPool {
 exports.WorkerPool = WorkerPool;
 WorkerPool.MAX_RESPAWNS = 10;
 let singleton = null;
-function getWorkerPool() {
+function getWorkerPool(generation, embedMode) {
     if (!singleton) {
-        singleton = new WorkerPool();
+        singleton = new WorkerPool(generation, embedMode);
+    }
+    else if (generation &&
+        singleton.generation.fingerprint !== generation.fingerprint) {
+        throw new Error(`Worker pool embedding generation mismatch: active ${singleton.generation.fingerprint}, requested ${generation.fingerprint}`);
+    }
+    else if (embedMode && singleton.embedMode !== embedMode) {
+        throw new Error(`Worker pool embed mode mismatch: active ${singleton.embedMode}, requested ${embedMode}`);
     }
     return singleton;
 }