grepmax 0.26.15 → 0.26.18

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "grepmax",
       "source": "./plugins/grepmax",
       "description": "Semantic code search for Claude Code. Automatically indexes your project and provides intelligent search capabilities.",
-      "version": "0.26.15",
+      "version": "0.26.18",
       "author": {
         "name": "Robert Owens",
         "email": "robowens@me.com"

package/dist/commands/add.js

@@ -98,6 +98,12 @@ Examples:
             process.exitCode = 1;
             return;
         }
+        if ((0, blocked_roots_1.isGitWorktreeRoot)(projectRoot)) {
+            logBlockedAttempt("git_worktree", projectRoot);
+            console.error(`Refusing to add ${projectRoot}: ${blocked_roots_1.WORKTREE_REFUSAL}`);
+            process.exitCode = 1;
+            return;
+        }
         // Check if already registered
         const existing = (0, project_registry_1.getProject)(projectRoot);
         if (existing) {

package/dist/lib/daemon/daemon.js

@@ -59,8 +59,10 @@ const server_1 = require("../llm/server");
 const meta_cache_1 = require("../store/meta-cache");
 const store_lease_1 = require("../store/store-lease");
 const vector_db_1 = require("../store/vector-db");
+const blocked_roots_1 = require("../utils/blocked-roots");
 const daemon_client_1 = require("../utils/daemon-client");
 const daemon_launcher_1 = require("../utils/daemon-launcher");
+const kernel_zone_1 = require("../utils/kernel-zone");
 const keyed_mutex_1 = require("../utils/keyed-mutex");
 const log_rotate_1 = require("../utils/log-rotate");
 const logger_1 = require("../utils/logger");
@@ -127,6 +129,8 @@ class Daemon {
         this.heartbeatInterval = null;
         this.idleInterval = null;
         this.heartbeatTick = 0;
+        /** Rate-limits the kernel-zone warn log — see checkKernelZonePressure. */
+        this.lastZoneWarnMs = 0;
         this.shuttingDown = false;
         this.recycling = false;
         // False until LanceDB + MetaCache are open. The socket starts listening early
@@ -406,6 +410,7 @@ class Daemon {
                     void this.mlxServerManager.checkMlxHealth();
                     this.processManager.sweepOrphanWorkers();
                     this.maybeRecycle();
+                    this.checkKernelZonePressure();
                 }
             }, HEARTBEAT_INTERVAL_MS);
             // 10. Idle timeout (skip when disabled via env)
@@ -785,6 +790,10 @@ class Daemon {
                         return;
                     }
                     const project = (0, project_registry_1.getProject)(root);
+                    if (!project && (0, blocked_roots_1.isGitWorktreeRoot)(root)) {
+                        (0, ipc_handler_1.writeDone)(conn, { ok: false, error: blocked_roots_1.WORKTREE_REFUSAL });
+                        return;
+                    }
                     if ((project === null || project === void 0 ? void 0 : project.status) === "indexed") {
                         if (!this.activeGeneration ||
                             (0, embedding_generation_1.compareEmbeddingGeneration)(project, this.activeGeneration)
@@ -850,6 +859,10 @@ class Daemon {
                 (0, ipc_handler_1.writeDone)(conn, { ok: false, error: "daemon resources not ready" });
                 return;
             }
+            if (!(0, project_registry_1.getProject)(root) && (0, blocked_roots_1.isGitWorktreeRoot)(root)) {
+                (0, ipc_handler_1.writeDone)(conn, { ok: false, error: blocked_roots_1.WORKTREE_REFUSAL });
+                return;
+            }
             if (!(0, project_registry_1.getProject)(root)) {
                 (0, project_registry_1.registerProject)({
                     root,
@@ -1698,6 +1711,50 @@ class Daemon {
         this.recycling = true;
         void this.shutdown({ relaunch: true }).finally(() => process.exit(0));
     }
+    /**
+     * Stand down before our own write volume exhausts a leaking kernel zone.
+     *
+     * On macOS 26.5.2 sustained filesystem writes leak `data.kalloc.1024`
+     * irreversibly, and exhausting it panics the host with no warning of any kind —
+     * the daemon does not get to observe the failure, it just dies with the machine.
+     * This host lost three sessions that way before the compactor was identified as
+     * the largest write source on it.
+     *
+     * So the daemon watches the zone it is pressurizing. A warn-level reading is
+     * logged and left alone; a critical reading exits without relaunch, because
+     * relaunching would resume the writes that caused it. Nothing here can reclaim
+     * the leaked memory — only a reboot does that — so the only useful move is to
+     * stop adding to it while the user still has a working machine.
+     *
+     * Deliberately does nothing when the sample is unavailable or unparseable
+     * (non-macOS, no `zprint`, changed output format): an unknown reading must never
+     * shut the daemon down.
+     */
+    checkKernelZonePressure() {
+        if (this.shuttingDown || this.recycling)
+            return;
+        const usage = (0, kernel_zone_1.readKernelZoneUsage)();
+        if (!usage || usage.pressure === "ok")
+            return;
+        if (usage.pressure === "warn") {
+            // Rate-limited to once an hour: at the 5-minute heartbeat this would
+            // otherwise print 12 identical lines an hour for as long as the condition
+            // holds, which on a leaking host is until reboot.
+            const now = Date.now();
+            if (now - this.lastZoneWarnMs < 60 * 60 * 1000)
+                return;
+            this.lastZoneWarnMs = now;
+            console.log(`[daemon] WARNING: ${(0, kernel_zone_1.formatZoneUsage)(usage)} — macOS kernel zone is leaking ` +
+                `under write pressure. The daemon will stop itself at ` +
+                `${(kernel_zone_1.ZONE_THRESHOLDS.criticalBytes / Math.pow(1024, 3)).toFixed(0)}GiB. ` +
+                `Only a reboot reclaims this memory.`);
+            return;
+        }
+        console.log(`[daemon] CRITICAL: ${(0, kernel_zone_1.formatZoneUsage)(usage)} — stopping to avoid a kernel panic. ` +
+            `Reboot to reclaim the zone; the index will catch up on next start.`);
+        this.recycling = true;
+        void this.shutdown().finally(() => process.exit(0));
+    }
     shutdown(opts = {}) {
         if (!this.shutdownPromise) {
             this.shutdownPromise = this.performShutdown(opts);

package/dist/lib/store/vector-db.js

@@ -157,6 +157,36 @@ function isMissingTableError(err) {
 const TABLE_NAME = "chunks";
 const MAINTENANCE_INTERVAL_MS = 5 * 60 * 1000;
 const CLEAN_MAINTENANCE_INTERVAL_MS = 60 * 60 * 1000;
+/**
+ * Floor between opportunistic full-table compactions.
+ *
+ * A compaction rewrites the whole table, so its cost scales with store size, not
+ * with how much changed. Neither opportunistic caller was rate-limited: the
+ * 5-minute maintenance tick re-optimizes whenever the write epoch moved, and
+ * `compactIfNeeded` fires whenever small fragments cross a threshold. On a store
+ * under continuous reindex pressure both are true essentially always, so the
+ * table gets rewritten every few minutes forever.
+ *
+ * That is not hypothetical. On 2026-08-16..17 this store (16 GB) took 43 full
+ * compactions in two days — an accelerating 6 → 30 → 63 → 54 per day — which a
+ * microstackshot measured as 549.76 GB of file-backed writes in 12.3 hours. On
+ * macOS 26.5.2 that write volume exhausted the `data.kalloc.1024` kernel zone and
+ * panicked the host. See docs/2026-08-04-macos-kernel-zone-panic-incident.md.
+ *
+ * The floor caps compaction at twice an hour regardless of how much churn arrives.
+ * Fragments accumulating between passes cost read performance, which is recoverable;
+ * unbounded rewrite volume was not.
+ */
+const COMPACTION_MIN_INTERVAL_MS = 30 * 60 * 1000;
+/**
+ * Ceiling for the unproductive-compaction backoff.
+ *
+ * A compaction that removes no fragments and frees no bytes rewrote the table for
+ * nothing, and the next one a few minutes later will almost certainly do the same.
+ * The interval doubles on each such pass and resets the moment one does real work,
+ * so a store that cannot be improved stops paying for the attempt.
+ */
+const COMPACTION_MAX_INTERVAL_MS = 6 * 60 * 60 * 1000;
 class VectorDB {
     constructor(lancedbDir, vectorDim, suppliedLease) {
         this.lancedbDir = lancedbDir;
@@ -174,6 +204,9 @@ class VectorDB {
         /** Only an index owner may create/rebuild shared indexes — see markIndexOwner. */
         this.indexOwner = false;
         this.lastOptimizeDidWork = false;
+        /** Compaction rate limiter — see COMPACTION_MIN_INTERVAL_MS. */
+        this.lastCompactionMs = 0;
+        this.compactionIntervalMs = COMPACTION_MIN_INTERVAL_MS;
         this.maintenanceRunner = (fn) => fn();
         /** Latched when a from-scratch FTS rebuild failed to stop an optimize
          *  panic. Stops the (expensive) rebuild from re-running every maintenance
@@ -1152,13 +1185,30 @@ class VectorDB {
                 }
                 yield this.createFTSIndex();
                 yield this.createVectorIndex();
-                if (pressure === "low") {
+                // Index creation above is idempotent and self-guarding, so it stays on the
+                // 5-minute cadence. Compaction is the expensive half — it rewrites the whole
+                // table — and gets rate-limited. Without this the tick compacts every 5
+                // minutes for as long as writes keep arriving, which is how this store
+                // reached 43 full rewrites in two days and panicked the host.
+                const throttleMs = options.force
+                    ? 0
+                    : this.compactionThrottleRemainingMs();
+                if (throttleMs > 0) {
+                    (0, logger_1.debug)("vectordb", `Compaction throttled — ${Math.ceil(throttleMs / 60000)}min until next full pass ` +
+                        `(interval ${Math.round(this.compactionIntervalMs / 60000)}min)`);
+                }
+                else if (pressure === "low") {
                     (0, logger_1.log)("vectordb", `Low disk — single-pass optimize (no bloat retry)`);
                     yield this.optimize(1, 0, true);
+                    this.noteCompaction(this.lastOptimizeDidWork);
                 }
                 else {
                     // Normal maintenance: full optimize + bloat check
                     yield this.optimize(5, 0, true);
+                    // Track across both passes: `lastOptimizeDidWork` is reset per optimize()
+                    // call, so a productive first pass followed by a barren bloat retry would
+                    // otherwise read as unproductive and trigger a spurious backoff.
+                    let didWork = this.lastOptimizeDidWork;
                     if (this.lastOptimizeDidWork) {
                         const table = yield this.openExistingTableUnsafe();
                         if (table) {
@@ -1180,9 +1230,11 @@ class VectorDB {
                                 (0, logger_1.log)("vectordb", `Bloat detected after optimize: ${(diskSize / 1024 / 1024).toFixed(0)}MB disk vs ${(logicalSize / 1024 / 1024).toFixed(0)}MB logical (${bloatRatio.toFixed(1)}x) — retrying`);
                                 yield new Promise((r) => setTimeout(r, 2000));
                                 yield this.optimize(5, 0, true);
+                                didWork = didWork || this.lastOptimizeDidWork;
                             }
                         }
                     }
+                    this.noteCompaction(didWork);
                 }
                 const maintainedTable = yield this.openExistingTableUnsafe();
                 this.maintainedTableVersion =
@@ -1195,6 +1247,47 @@ class VectorDB {
             }
         });
     }
+    /**
+     * Milliseconds until an opportunistic full-table compaction is allowed again,
+     * or 0 if one may run now. Forced callers (`gmax index`, `doctor --fix`) are
+     * expected to bypass this rather than consult it.
+     */
+    compactionThrottleRemainingMs(now = Date.now()) {
+        if (this.lastCompactionMs === 0)
+            return 0;
+        const elapsed = now - this.lastCompactionMs;
+        // A clock that jumped backwards would otherwise wedge compaction shut.
+        if (elapsed < 0)
+            return 0;
+        return Math.max(0, this.compactionIntervalMs - elapsed);
+    }
+    /**
+     * Record a completed compaction and adjust the interval. Productive passes reset
+     * to the floor; unproductive ones double up to the ceiling so a store that cannot
+     * be improved stops being rewritten every few minutes.
+     */
+    noteCompaction(didWork) {
+        this.lastCompactionMs = Date.now();
+        if (didWork) {
+            if (this.compactionIntervalMs !== COMPACTION_MIN_INTERVAL_MS) {
+                (0, logger_1.debug)("vectordb", "Productive compaction — interval reset to floor");
+            }
+            this.compactionIntervalMs = COMPACTION_MIN_INTERVAL_MS;
+            return;
+        }
+        const next = Math.min(this.compactionIntervalMs * 2, COMPACTION_MAX_INTERVAL_MS);
+        if (next !== this.compactionIntervalMs) {
+            (0, logger_1.log)("vectordb", `Compaction reclaimed nothing — backing off to ${Math.round(next / 60000)}min`);
+        }
+        this.compactionIntervalMs = next;
+    }
+    /** Test/diagnostic view of the rate limiter. */
+    getCompactionThrottleState() {
+        return {
+            intervalMs: this.compactionIntervalMs,
+            remainingMs: this.compactionThrottleRemainingMs(),
+        };
+    }
     compactIfNeeded() {
         return __awaiter(this, arguments, void 0, function* (threshold = config_1.FRAGMENT_COMPACT_THRESHOLD) {
             if (this.maintenanceRunning)
@@ -1206,8 +1299,14 @@ class VectorDB {
                 const table = yield this.ensureTable();
                 const stats = yield table.stats();
                 if (stats.fragmentStats.numSmallFragments > threshold) {
+                    const throttleMs = this.compactionThrottleRemainingMs();
+                    if (throttleMs > 0) {
+                        (0, logger_1.debug)("vectordb", `Fragment threshold exceeded (${stats.fragmentStats.numSmallFragments} > ${threshold}) — throttled, ${Math.ceil(throttleMs / 60000)}min remaining`);
+                        return false;
+                    }
                     (0, logger_1.log)("vectordb", `Fragment threshold exceeded (${stats.fragmentStats.numSmallFragments} > ${threshold}) — compacting`);
                     yield this.optimize(2, 0, true);
+                    this.noteCompaction(this.lastOptimizeDidWork);
                     return true;
                 }
             }

package/dist/lib/utils/blocked-roots.js

@@ -33,9 +33,11 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.BLOCKED_ROOTS_DESCRIPTION = void 0;
+exports.WORKTREE_REFUSAL = exports.BLOCKED_ROOTS_DESCRIPTION = void 0;
 exports.getBlockedProjectRoots = getBlockedProjectRoots;
 exports.isBlockedProjectRoot = isBlockedProjectRoot;
+exports.isGitWorktreeRoot = isGitWorktreeRoot;
+const fs = __importStar(require("node:fs"));
 const os = __importStar(require("node:os"));
 const path = __importStar(require("node:path"));
 exports.BLOCKED_ROOTS_DESCRIPTION = "home, /, /Users, /tmp, /private, /var, /usr, /opt, /etc, /System, /Library, /Applications";
@@ -61,3 +63,27 @@ function getBlockedProjectRoots() {
 function isBlockedProjectRoot(root) {
     return getBlockedProjectRoots().has(path.resolve(root));
 }
+/**
+ * A linked git worktree has a `.git` FILE (not a directory) pointing back into
+ * the main repo's `.git/worktrees/<name>`. Indexing one duplicates the whole
+ * corpus of the repo it was cut from — three platform worktrees once put 680k
+ * duplicate chunks in the index and pinned seven embed workers at ~1GB each.
+ */
+function isGitWorktreeRoot(root) {
+    const gitPath = path.join(path.resolve(root), ".git");
+    let contents;
+    try {
+        if (!fs.statSync(gitPath).isFile())
+            return false;
+        contents = fs.readFileSync(gitPath, "utf8");
+    }
+    catch (_a) {
+        return false;
+    }
+    const match = /^gitdir:\s*(.+)$/m.exec(contents);
+    if (!(match === null || match === void 0 ? void 0 : match[1]))
+        return false;
+    const gitdir = match[1].trim().replace(/\\/g, "/");
+    return /(^|\/)\.git\/worktrees\//.test(gitdir);
+}
+exports.WORKTREE_REFUSAL = "gmax does not index git worktrees — they duplicate the repository they were cut from. Add the main repository root instead.";

package/dist/lib/utils/kernel-zone.js

@@ -0,0 +1,117 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ZONE_THRESHOLDS = void 0;
+exports.classifyZonePressure = classifyZonePressure;
+exports.parseZprintOutput = parseZprintOutput;
+exports.readKernelZoneUsage = readKernelZoneUsage;
+exports.formatZoneUsage = formatZoneUsage;
+const node_child_process_1 = require("node:child_process");
+/**
+ * macOS kernel-zone pressure guard.
+ *
+ * On macOS 26.5.2 (build 25F84) the `data.kalloc.1024` kernel zone leaks under
+ * sustained filesystem write pressure and is never reclaimed. Exhausting it panics
+ * the host outright — no jetsam, no swap warning, no chance to intervene, because
+ * the failing resource is wired kernel memory rather than anything the VM system
+ * manages.
+ *
+ * This host panicked three times that way. The third time the zone sat near 1.4 GB
+ * for twelve days, then climbed to 17.9 GB in eight hours while gmax's compactor
+ * dirtied 549.76 GB of file-backed memory. See
+ * docs/2026-08-04-macos-kernel-zone-panic-incident.md.
+ *
+ * gmax cannot fix the kernel defect, but it can decline to be the thing that
+ * detonates it. Sampling the zone is cheap (~0.2 s), so the daemon watches its own
+ * blast radius and stands down while there are still hours of headroom.
+ */
+/** The zone that leaks. Named explicitly so `zprint` returns a single line. */
+const ZONE_NAME = "data.kalloc.1024";
+/**
+ * Warn threshold.
+ *
+ * Twelve days of ordinary use held this zone between 0.67 and 1.37 GiB, so 4 GiB is
+ * roughly 3x anything a healthy host has been observed to reach. During the
+ * August 17 burst the zone crossed this about 90 minutes in — early enough that
+ * stopping then would have avoided the panic with hours to spare.
+ */
+const WARN_BYTES = 4 * Math.pow(1024, 3);
+/**
+ * Critical threshold — the daemon stands down here.
+ *
+ * The observed zone map cap on this hardware is ~17.6 GiB. Eight GiB is under half
+ * of it, and at the burst rate actually measured (~2.0 GiB/hour) it still leaves
+ * roughly five hours before exhaustion. The margin is deliberately generous: the
+ * cost of standing down early is a stale index, and the cost of standing down late
+ * is an unplanned reboot.
+ */
+const CRITICAL_BYTES = 8 * Math.pow(1024, 3);
+function classifyZonePressure(bytes) {
+    if (bytes >= CRITICAL_BYTES)
+        return "critical";
+    if (bytes >= WARN_BYTES)
+        return "warn";
+    return "ok";
+}
+/**
+ * Parse one `zprint <zone>` report.
+ *
+ * Exported for tests; the column layout is a stable but undocumented text format,
+ * so this validates rather than trusting it:
+ *
+ * ```
+ *                             elem         cur         max        cur         max         cur  alloc  alloc
+ * zone name                   size        size        size      #elts       #elts       inuse   size  count
+ * data.kalloc.1024            1024          0K          0K          0           0        3416     0K      0
+ * ```
+ *
+ * The `cur size` column reads `0K` on this build, which is why the byte figure is
+ * derived from `cur inuse` x `elem size` rather than read directly.
+ */
+function parseZprintOutput(output, zoneName = ZONE_NAME) {
+    for (const line of output.split("\n")) {
+        const fields = line.trim().split(/\s+/);
+        if (fields[0] !== zoneName)
+            continue;
+        const elementSize = Number(fields[1]);
+        const elements = Number(fields[6]);
+        if (!Number.isInteger(elementSize) || elementSize <= 0)
+            return null;
+        if (!Number.isInteger(elements) || elements < 0)
+            return null;
+        return { elements, elementSize };
+    }
+    return null;
+}
+/**
+ * Sample the zone. Returns null off macOS, or whenever the sample cannot be
+ * trusted — an unparseable report must read as "unknown", never as "healthy" and
+ * never as a reason to stop working.
+ */
+function readKernelZoneUsage(zoneName = ZONE_NAME) {
+    if (process.platform !== "darwin")
+        return null;
+    try {
+        const output = (0, node_child_process_1.execFileSync)("zprint", [zoneName], {
+            encoding: "utf-8",
+            timeout: 5000,
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+        const parsed = parseZprintOutput(output, zoneName);
+        if (!parsed)
+            return null;
+        const bytes = parsed.elements * parsed.elementSize;
+        return Object.assign(Object.assign({}, parsed), { bytes, pressure: classifyZonePressure(bytes) });
+    }
+    catch (_a) {
+        return null;
+    }
+}
+function formatZoneUsage(usage) {
+    const gib = (usage.bytes / Math.pow(1024, 3)).toFixed(2);
+    return `${ZONE_NAME} at ${gib}GiB (${usage.elements.toLocaleString()} elements)`;
+}
+exports.ZONE_THRESHOLDS = {
+    warnBytes: WARN_BYTES,
+    criticalBytes: CRITICAL_BYTES,
+    zoneName: ZONE_NAME,
+};

package/dist/lib/utils/project-registry.js

@@ -63,6 +63,7 @@ const path = __importStar(require("node:path"));
 const proper_lockfile_1 = __importDefault(require("proper-lockfile"));
 const config_1 = require("../../config");
 const embedding_generation_1 = require("../index/embedding-generation");
+const blocked_roots_1 = require("./blocked-roots");
 const REGISTRY_PATH = path.join(config_1.PATHS.globalRoot, "projects.json");
 const REBUILD_JOURNAL_PATH = path.join(config_1.PATHS.globalRoot, "rebuild-journal.json");
 class ProjectRegistryConflictError extends Error {
@@ -207,6 +208,10 @@ function registerProject(entry) {
     }
     withRegistryLock(() => {
         const entries = loadRegistry();
+        if (!entries.some((e) => e.root === entry.root) &&
+            (0, blocked_roots_1.isGitWorktreeRoot)(entry.root)) {
+            throw new Error(`${blocked_roots_1.WORKTREE_REFUSAL} (${entry.root})`);
+        }
         let canonicalRoot;
         try {
             canonicalRoot = fs.realpathSync(entry.root);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "grepmax",
-  "version": "0.26.15",
+  "version": "0.26.18",
   "author": "Robert Owens <78518764+reowens@users.noreply.github.com>",
   "homepage": "https://github.com/reowens/grepmax",
   "bugs": {

package/plugins/grepmax/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "grepmax",
-  "version": "0.26.15",
+  "version": "0.26.18",
   "description": "Semantic code search for Claude Code. Automatically indexes your project and provides intelligent search capabilities.",
   "author": {
     "name": "Robert Owens",

package/plugins/grepmax/hooks/start.js

@@ -78,7 +78,23 @@ function isProjectRegistered() {
   }
 }
 
+// A kill switch for the auto-start. Create ~/.gmax/autostart-disabled (or export
+// GMAX_NO_AUTOSTART=1) to keep sessions from reviving the daemon — needed when the
+// host is quarantined after a kernel-zone incident and the daemon's write volume is
+// the thing under investigation. Delete the file to restore normal behavior.
+function isAutostartDisabled() {
+  if (process.env.GMAX_NO_AUTOSTART === "1") return true;
+  try {
+    return require("node:fs").existsSync(
+      _path.join(require("node:os").homedir(), ".gmax", "autostart-disabled"),
+    );
+  } catch {
+    return false;
+  }
+}
+
 function startWatcher() {
+  if (isAutostartDisabled()) return;
   if (!isProjectRegistered()) return;
   try {
     execFileSync("gmax", ["watch", "--daemon", "-b"], {