grepmax 0.26.50 → 0.26.52

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "grepmax",
       "source": "./plugins/grepmax",
       "description": "Semantic code search for Claude Code. Automatically indexes your project and provides intelligent search capabilities.",
-      "version": "0.26.50",
+      "version": "0.26.52",
       "author": {
         "name": "Robert Owens",
         "email": "robowens@me.com"

package/README.md

@@ -119,9 +119,11 @@ gmax plugin remove claude      # Remove specific plugin
 
 After upgrading with `npm install -g grepmax@latest`, run `gmax plugin update` (or `gmax plugin update <client>`) to refresh integrations. Package installation does not modify your agent configuration; its postinstall script only prints this reminder.
 
+Starting with v0.26.51, the installer refreshes an existing Claude marketplace from its configured source and updates each existing user/project/local installation in its original scope. It does not remove the marketplace, reset disabled preferences, or reinstall after a refresh failure. New installations use the local npm package. An existing source is retained; moving to another source is a separate migration. Codex instructions follow `CODEX_HOME` (default `~/.codex`), and a matching STDIO registration retains its existing options. A different existing launch configuration is reported for review instead of overwritten. Refresh the plugins after upgrading to activate the hook and installer repairs.
+
 ### How it works per client
 
-- **Claude Code:** Plugin with hooks (SessionStart, SessionEnd, CwdChanged, SubagentStart, PreToolUse). Model uses CLI via `Bash(gmax ... --agent)`.
+- **Claude Code:** Plugin with session/directory hooks, guidance hooks and activity renewal on UserPromptSubmit/PostToolUse for Bash. Model uses CLI via `Bash(gmax ... --agent)`; the plugin does not register an MCP server. Source hooks honor the autostart kill switch, start only after a definite absent socket and never fall back to a separate watcher beside a live daemon.
 - **OpenCode:** Tool shim with dynamic SKILL + session plugin for daemon startup. Model calls gmax tool directly.
 - **Codex:** MCP server registration + AGENTS.md skill instructions.
 - **Factory Droid:** Skills + SessionStart/SessionEnd hooks for daemon lifecycle.
@@ -486,7 +488,7 @@ whether you need to act.
 | `disabling auto-rebuild until an optimize succeeds` | Transient, not a wedge. The next successful optimize clears it. Search stays available. |
 | `ANN: vector index not built` | Normal — exact search is the default. |
 | `cannot reach the daemon socket from this sandbox` (exit 2) | The shell is sandboxed. Add the two keys in [Running under the Claude Code sandbox](#running-under-the-claude-code-sandbox); `gmax doctor` warns about the same gap. |
-| `npm audit` reports advisories on install | v0.26.49 passed production and fresh packed-consumer audits. Audit findings can change: record the installed version and dependency path and report new findings; do not assume historical advisories still apply. |
+| `npm audit` reports advisories on install | Record the installed version and dependency path and report new findings. JavaScript consumer audits do not cover the Python embedding environment; maintainers also audit its locked registry dependencies with `pnpm run audit:python` (Python 3.11+; no model load). |
 
 ## Contributing
 

package/dist/commands/claude-code.js

@@ -46,32 +46,36 @@ exports.installClaudeCode = void 0;
 const node_child_process_1 = require("node:child_process");
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
+const node_util_1 = require("node:util");
 const commander_1 = require("commander");
-function runClaudeCommand(args) {
-    return new Promise((resolve, reject) => {
-        const child = (0, node_child_process_1.spawn)("claude", ["plugin", ...args], {
+const execFileAsync = (0, node_util_1.promisify)(node_child_process_1.execFile);
+function runClaudeCommand(args_1) {
+    return __awaiter(this, arguments, void 0, function* (args, options = {}) {
+        const { stdout, stderr } = yield execFileAsync("claude", ["plugin", ...args], {
             env: process.env,
-            stdio: "inherit",
-        });
-        const timeout = setTimeout(() => {
-            child.kill("SIGTERM");
-            reject(new Error("claude command timed out after 60s"));
-        }, 60000);
-        child.on("error", (error) => {
-            clearTimeout(timeout);
-            reject(error);
-        });
-        child.on("exit", (code) => {
-            clearTimeout(timeout);
-            if (code === 0) {
-                resolve();
-            }
-            else {
-                reject(new Error(`claude exited with code ${code !== null && code !== void 0 ? code : "unknown"}`));
-            }
+            encoding: "utf8",
+            timeout: 60000,
+            maxBuffer: 2 * 1024 * 1024,
+            cwd: options.cwd,
         });
+        if (!options.quiet) {
+            process.stdout.write(stdout);
+            process.stderr.write(stderr);
+        }
+        return stdout;
     });
 }
+function parseList(raw, label) {
+    const parsed = JSON.parse(raw);
+    const key = label === "marketplace list" ? "name" : "id";
+    if (!Array.isArray(parsed) ||
+        parsed.some((entry) => !entry ||
+            typeof entry !== "object" ||
+            typeof entry[key] !== "string" ||
+            !entry[key]))
+        throw new Error(`Unexpected Claude ${label} response; configuration preserved`);
+    return parsed;
+}
 /**
  * Resolve the gmax package root directory.
  * Works for both npm global installs (symlinked binary) and dev mode.
@@ -94,19 +98,47 @@ function installPlugin() {
                 return;
             }
             console.log(`Installing plugin from ${marketplacePath}`);
-            // Remove old GitHub-based marketplace if present (ignore errors)
-            try {
-                yield runClaudeCommand(["marketplace", "remove", "grepmax"]);
+            // Query the CLI so account selection and CLAUDE_CONFIG_DIR match the client.
+            // A failed/invalid inventory must never trigger a destructive reinstall.
+            const marketplaces = parseList(yield runClaudeCommand(["marketplace", "list", "--json"], {
+                quiet: true,
+            }), "marketplace list");
+            const installed = parseList(yield runClaudeCommand(["list", "--json"], { quiet: true }), "plugin list").filter((entry) => entry.id === "grepmax@grepmax");
+            const updates = installed.filter((entry) => entry.scope !== "managed");
+            // Validate every target before even refreshing the source.
+            for (const entry of updates) {
+                if (!["user", "project", "local"].includes(String(entry.scope)))
+                    throw new Error("Unknown gmax installation scope; configuration preserved");
+                if (entry.scope !== "user" &&
+                    (typeof entry.projectPath !== "string" ||
+                        !fs.existsSync(entry.projectPath)))
+                    throw new Error("Missing gmax installation project; configuration preserved");
             }
-            catch (_a) {
-                // May not exist — fine
+            if (installed.length > 0 && updates.length === 0) {
+                console.log("gmax is managed by your administrator; installation preserved.");
+                return;
+            }
+            if (marketplaces.some((entry) => entry.name === "grepmax")) {
+                // Retain the user's chosen source, including GitHub or another npm prefix.
+                // Retargeting by removing a marketplace also deletes plugin-owned state.
+                yield runClaudeCommand(["marketplace", "update", "grepmax"]);
+                console.log("✔ Marketplace refreshed (existing source preserved)");
+            }
+            else {
+                yield runClaudeCommand(["marketplace", "add", marketplacePath]);
+                console.log("✔ Marketplace registered (local)");
+            }
+            if (updates.length === 0) {
+                yield runClaudeCommand(["install", "grepmax@grepmax", "--scope", "user"]);
+            }
+            else {
+                for (const entry of updates) {
+                    yield runClaudeCommand(["update", "grepmax@grepmax", "--scope", String(entry.scope)], {
+                        cwd: entry.scope === "user" ? undefined : String(entry.projectPath),
+                    });
+                }
             }
-            // Add local package directory as marketplace source
-            yield runClaudeCommand(["marketplace", "add", marketplacePath]);
-            console.log("✔ Marketplace registered (local)");
-            // Install the plugin from the local marketplace
-            yield runClaudeCommand(["install", "grepmax"]);
-            console.log("✅ Successfully installed the gmax plugin for Claude Code");
+            console.log("✅ Successfully refreshed the gmax plugin for Claude Code");
             console.log("\nNext steps:");
             console.log("1. Restart Claude Code if it's running");
             console.log("2. Run `gmax add` in your project to index it");

package/dist/commands/codex.js

@@ -15,13 +15,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.uninstallCodex = exports.installCodex = void 0;
 const node_child_process_1 = require("node:child_process");
 const node_fs_1 = __importDefault(require("node:fs"));
-const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
 const node_util_1 = require("node:util");
 const commander_1 = require("commander");
+const codex_home_1 = require("../lib/utils/codex-home");
 const shell = process.env.SHELL || (process.platform === "win32" ? "cmd.exe" : "/bin/sh");
 const execAsync = (0, node_util_1.promisify)(node_child_process_1.exec);
-const AGENTS_PATH = node_path_1.default.join(node_os_1.default.homedir(), ".codex", "AGENTS.md");
 const SKILL_START = "<!-- gmax:start -->";
 const SKILL_END = "<!-- gmax:end -->";
 function ownedSkillBlocks() {
@@ -48,6 +47,7 @@ function loadSkill() {
     }
 }
 function writeSkillToAgents(skill) {
+    const AGENTS_PATH = (0, codex_home_1.codexAgentsPath)();
     node_fs_1.default.mkdirSync(node_path_1.default.dirname(AGENTS_PATH), { recursive: true });
     const block = `${SKILL_START}\n${skill.trim()}\n${SKILL_END}`;
     if (!node_fs_1.default.existsSync(AGENTS_PATH)) {
@@ -74,20 +74,37 @@ function writeSkillToAgents(skill) {
 }
 function installPlugin() {
     return __awaiter(this, void 0, void 0, function* () {
+        var _a;
         try {
+            const inventory = yield execAsync("codex mcp list --json", {
+                shell,
+                env: process.env,
+            });
+            const servers = JSON.parse(inventory.stdout);
+            if (!Array.isArray(servers) ||
+                servers.some((server) => !server || typeof server.name !== "string"))
+                throw new Error("Unexpected Codex MCP inventory; configuration preserved");
+            const existing = servers.find((server) => (server === null || server === void 0 ? void 0 : server.name) === "gmax");
+            if (existing &&
+                (((_a = existing.transport) === null || _a === void 0 ? void 0 : _a.type) !== "stdio" ||
+                    node_path_1.default.basename(String(existing.transport.command)) !== "gmax" ||
+                    JSON.stringify(existing.transport.args) !== JSON.stringify(["mcp"])))
+                throw new Error("Existing gmax MCP launch differs; review it before replacing");
             // 1. Register MCP tool. Codex requires the stdio command after `--`:
             //   codex mcp add [OPTIONS] <NAME> -- <COMMAND>...
             // Without the separator the launch command is misparsed. AGENTS.md is only
             // written after this resolves, so a failed registration leaves it untouched.
-            yield execAsync("codex mcp add gmax -- gmax mcp", {
-                shell,
-                env: process.env,
-            });
-            console.log("✅ gmax MCP tool registered with Codex");
+            if (!existing) {
+                yield execAsync("codex mcp add gmax -- gmax mcp", {
+                    shell,
+                    env: process.env,
+                });
+            }
+            console.log("✅ gmax MCP registration ready (existing options preserved)");
             // 2. Write SKILL to AGENTS.md (idempotent)
             const skill = loadSkill();
             writeSkillToAgents(skill);
-            console.log("✅ gmax skill instructions written to", AGENTS_PATH);
+            console.log("✅ gmax skill instructions written to", (0, codex_home_1.codexAgentsPath)());
         }
         catch (error) {
             console.error(`❌ Error installing Codex plugin: ${error}`);
@@ -97,6 +114,7 @@ function installPlugin() {
 }
 function uninstallPlugin() {
     return __awaiter(this, void 0, void 0, function* () {
+        const AGENTS_PATH = (0, codex_home_1.codexAgentsPath)();
         try {
             yield execAsync("codex mcp remove gmax", { shell, env: process.env });
             console.log("✅ gmax MCP tool removed");

package/dist/commands/plugin.js

@@ -49,6 +49,7 @@ const fs = __importStar(require("node:fs"));
 const os = __importStar(require("node:os"));
 const path = __importStar(require("node:path"));
 const commander_1 = require("commander");
+const codex_home_1 = require("../lib/utils/codex-home");
 const exit_1 = require("../lib/utils/exit");
 function commandExists(cmd) {
     try {
@@ -106,7 +107,7 @@ function getClients() {
             id: "codex",
             detect: () => commandExists("codex"),
             isInstalled: () => {
-                const p = path.join(os.homedir(), ".codex", "AGENTS.md");
+                const p = (0, codex_home_1.codexAgentsPath)();
                 try {
                     return (fs.existsSync(p) && fs.readFileSync(p, "utf-8").includes("gmax"));
                 }

package/dist/commands/watch.js

@@ -53,6 +53,7 @@ const watcher_1 = require("../lib/index/watcher");
 const index_state_footer_1 = require("../lib/output/index-state-footer");
 const meta_cache_1 = require("../lib/store/meta-cache");
 const vector_db_1 = require("../lib/store/vector-db");
+const autostart_1 = require("../lib/utils/autostart");
 const daemon_restart_1 = require("../lib/utils/daemon-restart");
 const exit_1 = require("../lib/utils/exit");
 const filter_builder_1 = require("../lib/utils/filter-builder");
@@ -92,11 +93,18 @@ exports.watch = new commander_1.Command("watch")
             return;
         }
         if (options.background) {
+            const startOnly = process.env.GMAX_DAEMON_START_ONLY === "1";
+            // Plugin hooks are implicit starts. Recheck quarantine in this child
+            // and never use their launch as a version-upgrade restart.
+            if (startOnly && (0, autostart_1.isAutostartDisabled)())
+                return;
             // Skip spawn if daemon already running at the same version.
             // If version mismatches (e.g. after npm install -g), shut down the old
             // daemon so we can start a fresh one with the new code.
             const { isDaemonRunning, isDaemonHeartbeatFresh, sendDaemonCommand, readDaemonPid, waitForProcessExit, } = yield Promise.resolve().then(() => __importStar(require("../lib/utils/daemon-client")));
             if (yield isDaemonRunning()) {
+                if (startOnly)
+                    return;
                 const cliVersion = JSON.parse(fs.readFileSync(path.join(__dirname, "../../package.json"), "utf-8")).version;
                 const resp = yield sendDaemonCommand({ cmd: "ping" });
                 if (resp.version && resp.version === cliVersion) {

package/dist/lib/utils/autostart.js

@@ -49,7 +49,7 @@ const config_1 = require("../../config");
  * Explicit `gmax watch --daemon` is never gated: typing it is the user asking
  * for a daemon in that moment.
  *
- * plugins/grepmax/hooks/start.js carries a plain-JS copy of these semantics
+ * plugins/grepmax/hooks/watch-lease.js carries a plain-JS copy of these semantics
  * (env var checked first, then the file) because a SessionStart hook cannot
  * import from dist. Keep the two in sync.
  */

package/dist/lib/utils/codex-home.js

@@ -0,0 +1,44 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.codexAgentsPath = codexAgentsPath;
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+function codexAgentsPath() {
+    const home = process.env.CODEX_HOME
+        ? path.resolve(process.env.CODEX_HOME)
+        : path.join(os.homedir(), ".codex");
+    return path.join(home, "AGENTS.md");
+}

package/mlx-embed-server/pyproject.toml

@@ -6,7 +6,7 @@ requires-python = ">=3.13"
 dependencies = [
     "fastapi>=0.115.0",
     "uvicorn>=0.34.0",
-    "mlx-embeddings @ git+https://github.com/Blaizzy/mlx-embeddings.git",
+    "mlx-embeddings @ git+https://github.com/Blaizzy/mlx-embeddings.git@88522e288c0142170a5a44fd93c184d8ed777371",
     "mlx-lm>=0.22.0",
     "setproctitle>=1.3.0",
 ]
@@ -14,3 +14,23 @@ dependencies = [
 [project.scripts]
 mlx-embed-server = "server:main"
 mlx-summarizer = "summarizer:main"
+
+[tool.uv]
+# Advisory patch floors for the HTTP/TLS, model and utility dependency trees.
+# Constraints do not install otherwise-unused packages or change model weights.
+# Keep these floors when refreshing the lock; npm audits do not cover Python.
+constraint-dependencies = [
+    "aiohttp>=3.14.3",
+    "anyio>=4.14.2",
+    "click>=8.3.3",
+    "datasets>=5.0.1",
+    "fsspec>=2026.6.0",
+    "idna>=3.15",
+    "multidict>=6.9.1",
+    "pillow>=12.3.0",
+    "pygments>=2.20.0",
+    "requests>=2.33.0",
+    "starlette>=1.3.1",
+    "transformers>=5.10.1", # 5.10.0 was yanked by its maintainers.
+    "urllib3>=2.8.0",
+]