grepmax 0.26.26 → 0.26.28

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "grepmax",
       "source": "./plugins/grepmax",
       "description": "Semantic code search for Claude Code. Automatically indexes your project and provides intelligent search capabilities.",
-      "version": "0.26.26",
+      "version": "0.26.28",
       "author": {
         "name": "Robert Owens",
         "email": "robowens@me.com"

package/README.md

@@ -217,6 +217,45 @@ gmax status                   # See all projects + watcher status
 
 The daemon auto-starts when you run `gmax add`, `gmax index`, `gmax remove`, `gmax summarize`, or `gmax mcp`. It shuts down after 30 minutes of inactivity. File-change batches are processed concurrently while reserving worker capacity for searches; LanceDB compaction runs after writes rather than on every maintenance tick.
 
+## Running under the Claude Code sandbox
+
+Claude Code's Bash sandbox (the default on macOS) allows writes only under the working directory,
+the added directories, and the session temp dir, and blocks every Unix socket unless it is listed.
+Child processes inherit the profile, so a gmax command run from an agent shell inherits it too —
+and gmax needs both kinds of access. A read command either asks the daemon over
+`~/.gmax/daemon.sock`, or, with no daemon running, opens the shared store itself; opening the store
+takes a lease, which means a `mkdir` under `~/.gmax`. A "read" is a writer as far as the filesystem
+is concerned.
+
+Two settings keys cover it (`~/.claude/settings.json`, or the project's `.claude/settings.json`):
+
+```json
+"sandbox": {
+  "network": { "allowUnixSockets": ["~/.gmax/daemon.sock"] },
+  "filesystem": { "allowWrite": ["~/.gmax"] }
+}
+```
+
+| Key | What it unlocks |
+| --- | --- |
+| `sandbox.network.allowUnixSockets` | Every read command — search, `test`, `impact`, `trace`, `peek`, `status` — via the daemon. This is the one that matters day to day. |
+| `sandbox.filesystem.allowWrite` | The in-process fallback, used only when no daemon is running (autostart disabled, CI). With a daemon up, nothing needs it. |
+
+Without them gmax refuses rather than failing with a bare `EPERM`, exits `2`, and prints the key to add:
+
+```
+gmax: cannot reach the daemon socket from this sandbox. Add to Claude Code settings: "sandbox": {"network": {"allowUnixSockets": ["~/.gmax/daemon.sock"]}}
+gmax: cannot open the store from this sandbox. Add to Claude Code settings: "sandbox": {"filesystem": {"allowWrite": ["~/.gmax"]}}
+```
+
+`gmax doctor` reports the same thing ahead of time as `WARN  Claude Code sandbox` whenever your
+settings enable the sandbox without allowing the socket or the store directory. It never edits
+Claude Code settings, `--fix` included — they are not gmax's files to write.
+
+On Linux the per-socket list does not exist; the only option is
+`"network": { "allowAllUnixSockets": true }`. See
+[`docs/known-limitations.md`](docs/known-limitations.md).
+
 ## Local LLM (optional)
 
 gmax can use a local LLM (via llama-server) for agentic codebase investigation. This is entirely opt-in and disabled by default — gmax works fine without it.
@@ -413,6 +452,7 @@ whether you need to act.
 | `Optimize panicked ... inverted/builder.rs` | Upstream Lance bug in incremental FTS merge ([lance#8310](https://github.com/lance-format/lance/issues/8310)). gmax rebuilds the index and retries automatically; no data loss, no action needed. |
 | `disabling auto-rebuild until an optimize succeeds` | Transient, not a wedge. The next successful optimize clears it. Search stays available. |
 | `ANN: vector index not built` | Normal — exact search is the default. |
+| `cannot reach the daemon socket from this sandbox` (exit 2) | The shell is sandboxed. Add the two keys in [Running under the Claude Code sandbox](#running-under-the-claude-code-sandbox); `gmax doctor` warns about the same gap. |
 | `npm audit` reports advisories on install | Two transitive advisories (`sharp`, `adm-zip`) have no upstream fix yet; neither is on a code path gmax executes. |
 
 ## Contributing

package/dist/commands/audit.js

@@ -43,14 +43,13 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.audit = void 0;
-exports.computeAudit = computeAudit;
 const commander_1 = require("commander");
-const callsites_1 = require("../lib/graph/callsites");
+const graph_handler_1 = require("../lib/daemon/graph-handler");
 const vector_db_1 = require("../lib/store/vector-db");
-const arrow_1 = require("../lib/utils/arrow");
 const exit_1 = require("../lib/utils/exit");
 const project_registry_1 = require("../lib/utils/project-registry");
 const project_root_1 = require("../lib/utils/project-root");
+const store_access_1 = require("../lib/utils/store-access");
 const useColors = process.stdout.isTTY && !process.env.NO_COLOR;
 const style = {
     bold: (s) => (useColors ? `\x1b[1m${s}\x1b[22m` : s),
@@ -59,222 +58,6 @@ const style = {
     yellow: (s) => (useColors ? `\x1b[33m${s}\x1b[39m` : s),
     cyan: (s) => (useColors ? `\x1b[36m${s}\x1b[39m` : s),
 };
-// Names too generic to be useful as god-node signal (`id`, `el`, `fn`, …).
-const MIN_GOD_NAME_LEN = 3;
-function rel(p, prefix) {
-    return p.startsWith(prefix) ? p.slice(prefix.length) : p;
-}
-function findFileCycles(deps, prefix, top) {
-    const indexByFile = new Map();
-    const lowlink = new Map();
-    const stack = [];
-    const onStack = new Set();
-    const components = [];
-    let index = 0;
-    const strongConnect = (file) => {
-        var _a, _b, _c, _d, _e;
-        indexByFile.set(file, index);
-        lowlink.set(file, index);
-        index++;
-        stack.push(file);
-        onStack.add(file);
-        for (const dep of (_a = deps.get(file)) !== null && _a !== void 0 ? _a : []) {
-            if (!indexByFile.has(dep)) {
-                strongConnect(dep);
-                lowlink.set(file, Math.min((_b = lowlink.get(file)) !== null && _b !== void 0 ? _b : 0, (_c = lowlink.get(dep)) !== null && _c !== void 0 ? _c : 0));
-            }
-            else if (onStack.has(dep)) {
-                lowlink.set(file, Math.min((_d = lowlink.get(file)) !== null && _d !== void 0 ? _d : 0, (_e = indexByFile.get(dep)) !== null && _e !== void 0 ? _e : 0));
-            }
-        }
-        if (lowlink.get(file) !== indexByFile.get(file))
-            return;
-        const component = [];
-        while (stack.length > 0) {
-            const dep = stack.pop();
-            onStack.delete(dep);
-            component.push(dep);
-            if (dep === file)
-                break;
-        }
-        if (component.length > 1)
-            components.push(component);
-    };
-    const files = new Set();
-    for (const [file, targets] of deps) {
-        files.add(file);
-        for (const target of targets)
-            files.add(target);
-    }
-    for (const file of [...files].sort()) {
-        if (!indexByFile.has(file))
-            strongConnect(file);
-    }
-    return components
-        .map((component) => {
-        var _a;
-        const set = new Set(component);
-        let edgeCount = 0;
-        for (const file of component) {
-            for (const dep of (_a = deps.get(file)) !== null && _a !== void 0 ? _a : []) {
-                if (set.has(dep))
-                    edgeCount++;
-            }
-        }
-        return {
-            files: component.map((f) => rel(f, prefix)).sort(),
-            edgeCount,
-        };
-    })
-        .sort((a, b) => b.files.length - a.files.length ||
-        b.edgeCount - a.edgeCount ||
-        a.files.join("\0").localeCompare(b.files.join("\0")))
-        .slice(0, top);
-}
-/**
- * Pure aggregation over chunk rows — no DB, no I/O. Builds the symbol→def map,
- * cross-file inbound edges, and per-file fan-in/out, then derives god nodes
- * (most depended-upon symbols), hub files (most depended-upon files), and
- * dead-code candidates (non-exported symbols with zero inbound references).
- * `top` caps each list; `deadTotal` reports the full pre-cap dead count.
- */
-function computeAudit(rows, prefix, top) {
-    var _a, _b;
-    // First definition of a symbol wins (matches GraphBuilder semantics).
-    const defs = new Map();
-    // Distinct files defining each name — name-based edges can't tell same-name
-    // symbols apart, so multi-file definitions get flagged in the output.
-    const defFileCounts = new Map();
-    // Distinct files that reference a symbol (cross-file inbound edges).
-    const inboundFiles = new Map();
-    const inboundTotal = new Map();
-    // Per-file aggregates.
-    const fileDefs = new Map();
-    const fileOutRefs = new Map();
-    const files = new Set();
-    for (const row of rows) {
-        const file = String(row.path || "");
-        const line = Number(row.start_line || 0);
-        const exported = Boolean(row.is_exported);
-        const defSyms = (0, arrow_1.toArr)(row.defined_symbols);
-        const refSyms = (0, arrow_1.toArr)(row.referenced_symbols);
-        files.add(file);
-        for (const s of defSyms) {
-            if (!defs.has(s)) {
-                defs.set(s, { file, line, exported, complexity: 0 });
-            }
-            if (!defFileCounts.has(s))
-                defFileCounts.set(s, new Set());
-            defFileCounts.get(s).add(file);
-            if (!fileDefs.has(file))
-                fileDefs.set(file, new Set());
-            fileDefs.get(file).add(s);
-        }
-        for (const s of refSyms) {
-            if (!inboundFiles.has(s))
-                inboundFiles.set(s, new Set());
-            inboundFiles.get(s).add(file);
-            inboundTotal.set(s, (inboundTotal.get(s) || 0) + 1);
-            if (!fileOutRefs.has(file))
-                fileOutRefs.set(file, new Set());
-            fileOutRefs.get(file).add(s);
-        }
-    }
-    // God nodes — in-project symbols by distinct external inbound files.
-    const godNodes = [];
-    for (const [symbol, info] of defs) {
-        if (symbol.length < MIN_GOD_NAME_LEN)
-            continue;
-        // Builtin method names (get, set, push, …) leak in via prototype/member
-        // definitions and their inbound counts are meaningless name collisions.
-        if ((0, callsites_1.isBuiltinCallee)(symbol))
-            continue;
-        const refFiles = inboundFiles.get(symbol);
-        if (!refFiles)
-            continue;
-        let external = 0;
-        for (const f of refFiles)
-            if (f !== info.file)
-                external++;
-        if (external === 0)
-            continue;
-        godNodes.push({
-            symbol,
-            file: rel(info.file, prefix),
-            line: info.line,
-            inboundFiles: external,
-            totalRefs: inboundTotal.get(symbol) || 0,
-            defFiles: (_b = (_a = defFileCounts.get(symbol)) === null || _a === void 0 ? void 0 : _a.size) !== null && _b !== void 0 ? _b : 1,
-        });
-    }
-    godNodes.sort((a, b) => b.inboundFiles - a.inboundFiles || b.totalRefs - a.totalRefs);
-    // Hub files — distinct external files depending on each file (a file G
-    // depends on F if G references any symbol F defines).
-    const hubFiles = [];
-    for (const [file, syms] of fileDefs) {
-        const dependents = new Set();
-        for (const s of syms) {
-            const refFiles = inboundFiles.get(s);
-            if (!refFiles)
-                continue;
-            for (const f of refFiles)
-                if (f !== file)
-                    dependents.add(f);
-        }
-        // Fan-out: distinct referenced symbols that are defined somewhere
-        // in-project (external-library calls don't count as coupling).
-        let fanOut = 0;
-        const out = fileOutRefs.get(file);
-        if (out)
-            for (const s of out)
-                if (defs.has(s))
-                    fanOut++;
-        hubFiles.push({
-            file: rel(file, prefix),
-            dependents: dependents.size,
-            defines: syms.size,
-            fanOut,
-        });
-    }
-    hubFiles.sort((a, b) => b.dependents - a.dependents || b.defines - a.defines);
-    const fileDeps = new Map();
-    for (const [file, refs] of fileOutRefs) {
-        for (const s of refs) {
-            if ((0, callsites_1.isBuiltinCallee)(s))
-                continue;
-            const defFiles = defFileCounts.get(s);
-            if (!defFiles || defFiles.size !== 1)
-                continue;
-            const [depFile] = defFiles;
-            if (!depFile || depFile === file)
-                continue;
-            if (!fileDeps.has(file))
-                fileDeps.set(file, new Set());
-            fileDeps.get(file).add(depFile);
-        }
-    }
-    const fileCycles = findFileCycles(fileDeps, prefix, top);
-    // Dead candidates — non-exported in-project symbols with zero inbound
-    // references anywhere (including their own file).
-    const deadAll = [];
-    for (const [symbol, info] of defs) {
-        if (info.exported)
-            continue;
-        if ((inboundTotal.get(symbol) || 0) > 0)
-            continue;
-        deadAll.push({ symbol, file: rel(info.file, prefix), line: info.line });
-    }
-    deadAll.sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line);
-    return {
-        scannedChunks: rows.length,
-        scannedFiles: files.size,
-        godNodes: godNodes.slice(0, top),
-        hubFiles: hubFiles.filter((h) => h.dependents > 0).slice(0, top),
-        fileCycles,
-        deadCandidates: deadAll.slice(0, top),
-        deadTotal: deadAll.length,
-    };
-}
 function formatCycle(files) {
     const shown = files.length > 6
         ? [...files.slice(0, 6), `... ${files.length - 6} more`]
@@ -374,67 +157,52 @@ exports.audit = new commander_1.Command("audit")
     const root = (0, project_registry_1.resolveRootOrExit)(opts.root);
     if (root === null)
         return;
-    let vectorDb = null;
+    // Opened only if the daemon is unreachable; withStoreRead decides.
+    const local = { db: null };
     try {
         const projectRoot = (_a = (0, project_root_1.findProjectRoot)(root)) !== null && _a !== void 0 ? _a : root;
-        const prefix = projectRoot.endsWith("/")
-            ? projectRoot
-            : `${projectRoot}/`;
-        const paths = (0, project_root_1.ensureProjectPaths)(projectRoot);
-        vectorDb = new vector_db_1.VectorDB(paths.lancedbDir);
-        const { resolveScope, buildScopeWhere } = yield Promise.resolve().then(() => __importStar(require("../lib/utils/scope-filter")));
+        const { resolveScope } = yield Promise.resolve().then(() => __importStar(require("../lib/utils/scope-filter")));
         const scope = resolveScope({
             projectRoot,
             in: opts.in,
             exclude: opts.exclude,
         });
         const top = Math.max(1, Number.parseInt(opts.top, 10) || 10);
-        const table = yield vectorDb.ensureTable();
-        const rows = yield table
-            .query()
-            .select([
-            "path",
-            "start_line",
-            "defined_symbols",
-            "referenced_symbols",
-            "type_referenced_symbols",
-            "is_exported",
-        ])
-            .where(buildScopeWhere(scope))
-            .limit(500000)
-            .toArray();
-        if (rows.length === 0) {
+        // Up to 500k rows are read and aggregated wherever the store is open;
+        // what crosses the socket is the finished report.
+        const result = yield (0, graph_handler_1.callGraphVerb)("graph.audit", {
+            projectRoot,
+            scope,
+            payload: { top },
+            render: (resp) => { var _a; return (_a = resp.audit) !== null && _a !== void 0 ? _a : null; },
+            inProcess: () => {
+                var _a;
+                (_a = local.db) !== null && _a !== void 0 ? _a : (local.db = new vector_db_1.VectorDB((0, project_root_1.ensureProjectPaths)(projectRoot).lancedbDir));
+                return (0, graph_handler_1.runGraphAudit)(local.db, { projectRoot, scope, top });
+            },
+        });
+        if (result === null) {
             console.log(opts.agent
                 ? "(no indexed data)"
                 : `No indexed data for ${projectRoot}. Run: gmax index --path ${projectRoot}`);
             process.exitCode = 1;
             return;
         }
-        const result = computeAudit(rows.map((r) => ({
-            path: String(r.path || ""),
-            start_line: Number(r.start_line || 0),
-            is_exported: Boolean(r.is_exported),
-            defined_symbols: (0, arrow_1.toArr)(r.defined_symbols),
-            // Union call-position + type-position edges so god-node ranking and
-            // dead-candidate detection see references made purely in type position.
-            referenced_symbols: [
-                ...new Set([
-                    ...(0, arrow_1.toArr)(r.referenced_symbols),
-                    ...(0, arrow_1.toArr)(r.type_referenced_symbols),
-                ]),
-            ],
-        })), prefix, top);
         console.log(opts.agent ? formatAgent(result) : formatHuman(result));
     }
     catch (error) {
-        const message = error instanceof Error ? error.message : "Unknown error";
-        console.error("Audit failed:", message);
-        process.exitCode = 1;
+        // A sandbox refusal is already one actionable line; an "Audit failed:"
+        // prefix would bury the settings key that fixes it.
+        if (!(0, store_access_1.reportStoreAccessRefusal)(error)) {
+            const message = error instanceof Error ? error.message : "Unknown error";
+            console.error("Audit failed:", message);
+            process.exitCode = 1;
+        }
     }
     finally {
-        if (vectorDb) {
+        if (local.db) {
             try {
-                yield vectorDb.close();
+                yield local.db.close();
             }
             catch (err) {
                 console.error("Failed to close VectorDB:", err);

package/dist/commands/context.js

@@ -46,17 +46,18 @@ exports.context = void 0;
 exports.findEnclosingSignature = findEnclosingSignature;
 const fs = __importStar(require("node:fs"));
 const commander_1 = require("commander");
+const rows_handler_1 = require("../lib/daemon/rows-handler");
 const searcher_1 = require("../lib/search/searcher");
 const skeleton_1 = require("../lib/skeleton");
-const vector_db_1 = require("../lib/store/vector-db");
 const arrow_1 = require("../lib/utils/arrow");
 const budget_pack_1 = require("../lib/utils/budget-pack");
+const daemon_client_1 = require("../lib/utils/daemon-client");
 const exit_1 = require("../lib/utils/exit");
 const file_utils_1 = require("../lib/utils/file-utils");
-const filter_builder_1 = require("../lib/utils/filter-builder");
 const path_containment_1 = require("../lib/utils/path-containment");
 const project_registry_1 = require("../lib/utils/project-registry");
 const project_root_1 = require("../lib/utils/project-root");
+const store_access_1 = require("../lib/utils/store-access");
 function estimateTokens(text) {
     return Math.ceil(text.length / 4);
 }
@@ -169,14 +170,12 @@ exports.context = new commander_1.Command("context")
     var _a, _b, _c;
     const budget = Number.parseInt(opts.budget || "4000", 10) || 4000;
     const maxResults = Number.parseInt(opts.maxResults || "10", 10) || 10;
-    let vectorDb = null;
     try {
         const root = (0, project_registry_1.resolveRootOrExit)(opts.root);
         if (root === null)
             return;
         const projectRoot = (_a = (0, project_root_1.findProjectRoot)(root)) !== null && _a !== void 0 ? _a : root;
         const paths = (0, project_root_1.ensureProjectPaths)(projectRoot);
-        vectorDb = new vector_db_1.VectorDB(paths.lancedbDir);
         const pathTarget = (0, path_containment_1.resolveContainedExistingPath)(projectRoot, topic, {
             cwd: root,
             onOutside: "throw",
@@ -187,10 +186,26 @@ exports.context = new commander_1.Command("context")
             console.log(rendered.sections.join("\n"));
             return;
         }
-        const searcher = new searcher_1.Searcher(vectorDb);
-        // Phase 1: Semantic search
-        const response = yield searcher.search(topic, maxResults, { rerank: true }, {}, `${projectRoot}/`);
-        const scopedData = response.data.filter((result) => (0, path_containment_1.isPathWithin)(projectRoot, chunkPath(result)));
+        // Phase 1: Semantic search. Routed through the daemon so the Searcher —
+        // and the PageRank cache under ~/.gmax/pagerank/ that it may write — lives
+        // in exactly one process.
+        const responseData = yield (0, store_access_1.withStoreRead)("context", {
+            daemon: () => (0, daemon_client_1.sendDaemonCommand)({
+                cmd: "search",
+                projectRoot,
+                query: topic,
+                limit: maxResults,
+                pathPrefix: projectRoot,
+                rerank: true,
+            }, { timeoutMs: 60000 }),
+            render: (resp) => { var _a; return ((_a = resp.data) !== null && _a !== void 0 ? _a : []); },
+            inProcess: () => (0, rows_handler_1.withLocalStore)(paths.lancedbDir, (deps) => __awaiter(void 0, void 0, void 0, function* () {
+                const searcher = new searcher_1.Searcher(deps.vectorDb);
+                const response = yield searcher.search(topic, maxResults, { rerank: true }, {}, `${projectRoot}/`);
+                return response.data;
+            })),
+        });
+        const scopedData = responseData.filter((result) => (0, path_containment_1.isPathWithin)(projectRoot, chunkPath(result)));
         if (scopedData.length === 0) {
             console.log(`No results found for "${topic}".`);
             return;
@@ -322,23 +337,28 @@ exports.context = new commander_1.Command("context")
             sections.push(skelSection.join(""));
         }
         // Phase 5: Related files summary
-        const table = yield vectorDb.ensureTable();
         const allSymbols = new Set();
         for (const r of scopedData) {
             for (const s of (0, arrow_1.toArr)(r.defined_symbols))
                 allSymbols.add(s);
         }
         if (allSymbols.size > 0) {
-            const pathScope = (0, filter_builder_1.pathStartsWith)(`${projectRoot}/`);
             const relatedCounts = new Map();
             const searchedFiles = new Set(uniqueFiles);
-            for (const sym of [...allSymbols].slice(0, 20)) {
-                const rows = yield table
-                    .query()
-                    .select(["path"])
-                    .where(`array_contains(referenced_symbols, '${(0, filter_builder_1.escapeSqlString)(sym)}') AND ${pathScope}`)
-                    .limit(5)
-                    .toArray();
+            // One batched round trip for the ≤20 symbol lookups.
+            const { resolveScope } = yield Promise.resolve().then(() => __importStar(require("../lib/utils/scope-filter")));
+            const relatedRows = yield (0, rows_handler_1.readRows)({
+                name: "context",
+                projectRoot,
+                lancedbDir: paths.lancedbDir,
+                scope: resolveScope({ projectRoot }),
+                select: ["path"],
+                matches: [...allSymbols]
+                    .slice(0, 20)
+                    .map((symbol) => ({ kind: "referencedSymbol", symbol })),
+                limit: 5,
+            });
+            for (const rows of relatedRows) {
                 for (const row of rows) {
                     const p = String(row.path || "");
                     if (searchedFiles.has(p))
@@ -366,17 +386,13 @@ exports.context = new commander_1.Command("context")
         console.log(sections.join("\n"));
     }
     catch (error) {
-        const msg = error instanceof Error ? error.message : "Unknown error";
-        console.error("Context generation failed:", msg);
-        process.exitCode = 1;
+        if (!(0, store_access_1.reportStoreAccessRefusal)(error)) {
+            const msg = error instanceof Error ? error.message : "Unknown error";
+            console.error("Context generation failed:", msg);
+            process.exitCode = 1;
+        }
     }
     finally {
-        if (vectorDb) {
-            try {
-                yield vectorDb.close();
-            }
-            catch (_e) { }
-        }
         yield (0, exit_1.gracefulExit)();
     }
 }));

package/dist/commands/dead.js

@@ -44,15 +44,14 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.dead = void 0;
 const commander_1 = require("commander");
-const languages_1 = require("../lib/core/languages");
-const graph_builder_1 = require("../lib/graph/graph-builder");
+const graph_handler_1 = require("../lib/daemon/graph-handler");
 const vector_db_1 = require("../lib/store/vector-db");
 const agent_errors_1 = require("../lib/utils/agent-errors");
 const exit_1 = require("../lib/utils/exit");
-const filter_builder_1 = require("../lib/utils/filter-builder");
 const project_registry_1 = require("../lib/utils/project-registry");
 const project_root_1 = require("../lib/utils/project-root");
 const stale_hint_1 = require("../lib/utils/stale-hint");
+const store_access_1 = require("../lib/utils/store-access");
 const useColors = process.stdout.isTTY && !process.env.NO_COLOR;
 const style = {
     bold: (s) => (useColors ? `\x1b[1m${s}\x1b[22m` : s),
@@ -117,63 +116,66 @@ exports.dead = new commander_1.Command("dead")
     const root = (0, project_registry_1.resolveRootOrExit)(opts.root);
     if (root === null)
         return;
-    let vectorDb = null;
+    // Opened only if the daemon is unreachable; withStoreRead decides.
+    const local = { db: null };
     try {
         const projectRoot = (_a = (0, project_root_1.findProjectRoot)(root)) !== null && _a !== void 0 ? _a : root;
         (0, stale_hint_1.maybeWarnStaleChunker)(projectRoot, { agent: opts.agent });
         (0, stale_hint_1.maybeWarnStaleEmbedding)(projectRoot, { agent: opts.agent });
-        const paths = (0, project_root_1.ensureProjectPaths)(projectRoot);
-        vectorDb = new vector_db_1.VectorDB(paths.lancedbDir);
-        const { resolveScope, buildScopeWhere } = yield Promise.resolve().then(() => __importStar(require("../lib/utils/scope-filter")));
+        const { resolveScope } = yield Promise.resolve().then(() => __importStar(require("../lib/utils/scope-filter")));
         const scope = resolveScope({
             projectRoot,
             in: opts.in,
             exclude: opts.exclude,
         });
-        // Resolve the defining chunk to get path, line, and is_exported.
-        const table = yield vectorDb.ensureTable();
-        const defRows = yield table
-            .query()
-            .select(["path", "start_line", "is_exported"])
-            .where(buildScopeWhere(scope, `array_contains(defined_symbols, '${(0, filter_builder_1.escapeSqlString)(symbol)}')`))
-            .limit(1)
-            .toArray();
-        if (defRows.length === 0) {
+        // The defining chunk plus its inbound callers, counted store-side: the
+        // caller set can be large and only its size and top 3 are rendered.
+        const facts = yield (0, graph_handler_1.callGraphVerb)("graph.dead", {
+            projectRoot,
+            scope,
+            payload: { target: symbol },
+            render: (resp) => resp.dead,
+            inProcess: () => {
+                var _a;
+                (_a = local.db) !== null && _a !== void 0 ? _a : (local.db = new vector_db_1.VectorDB((0, project_root_1.ensureProjectPaths)(projectRoot).lancedbDir));
+                return (0, graph_handler_1.runGraphDead)(local.db, { symbol, scope });
+            },
+        });
+        if (!facts.found) {
             console.log((0, agent_errors_1.symbolNotFoundLines)(symbol, { agent: opts.agent }).join("\n"));
             process.exitCode = 1;
             return;
         }
-        const defRow = defRows[0];
-        const defPath = String(defRow.path || "");
-        const defLine = Number(defRow.start_line || 0);
-        const isExported = Boolean(defRow.is_exported);
-        const builder = new graph_builder_1.GraphBuilder(vectorDb, scope.pathPrefix, scope.excludePrefixes);
-        const callers = yield builder.getCallers(symbol, (0, languages_1.languageFamilyForPath)(defPath));
-        const status = callers.length === 0 ? (isExported ? "PUBLIC_EXPORT" : "DEAD") : "LIVE";
-        const topCallers = callers
-            .slice(0, TOP_CALLERS)
-            .map((c) => ({ file: c.file, line: c.line }));
+        const status = facts.callerCount === 0
+            ? facts.isExported
+                ? "PUBLIC_EXPORT"
+                : "DEAD"
+            : "LIVE";
         const result = {
             status,
             symbol,
-            defPath,
-            defLine,
-            callerCount: callers.length,
-            topCallers,
+            defPath: facts.defPath,
+            defLine: facts.defLine,
+            callerCount: facts.callerCount,
+            topCallers: facts.topCallers,
         };
         console.log(opts.agent
             ? formatAgent(result, projectRoot)
             : formatHuman(result, projectRoot));
     }
     catch (error) {
-        const message = error instanceof Error ? error.message : "Unknown error";
-        console.error("Dead check failed:", message);
-        process.exitCode = 1;
+        // A sandbox refusal is already one actionable line; a "Dead check
+        // failed:" prefix would bury the settings key that fixes it.
+        if (!(0, store_access_1.reportStoreAccessRefusal)(error)) {
+            const message = error instanceof Error ? error.message : "Unknown error";
+            console.error("Dead check failed:", message);
+            process.exitCode = 1;
+        }
     }
     finally {
-        if (vectorDb) {
+        if (local.db) {
             try {
-                yield vectorDb.close();
+                yield local.db.close();
             }
             catch (err) {
                 console.error("Failed to close VectorDB:", err);