grepmax 0.26.60 → 0.26.62

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "grepmax",
       "source": "./plugins/grepmax",
       "description": "Semantic code search for Claude Code. Automatically indexes your project and provides intelligent search capabilities.",
-      "version": "0.26.60",
+      "version": "0.26.62",
       "author": {
         "name": "Robert Owens",
         "email": "robowens@me.com"

package/README.md

@@ -557,3 +557,22 @@ Licensed under the Apache License, Version 2.0. See [LICENSE](LICENSE).
 On macOS, heavy work uses a shared resource ledger and a bounded batch footprint probe covering every gmax process and its children. Native stores, workers and model launches reserve headroom before allocating it. Warning or unknown measurements pause heavy work; known critical pressure persists a stop. The 6 GiB admission budget is a conservative scheduling threshold, not an OS-enforced memory cap. It may be lowered with `GMAX_RESOURCE_BUDGET_MB`. Existing safety markers remain in place after upgrades.
 
 MCP sessions started before this resource policy must reconnect after upgrading before heavy work can resume. Keyword search through the bounded read service stays available while those sessions are running. Cached resource snapshots in `gmax status --json` distinguish aggregate physical footprint from daemon RSS.
+
+### Host guard policy
+
+`hostGuardPolicy: "critical-only"` in `~/.gmax/config.json` (or
+`GMAX_HOST_GUARD_POLICY=critical-only`) selects an explicit availability policy.
+Warning and unavailable pressure probes remain diagnostic and do not pause
+semantic search or indexing. Confirmed critical OS or kernel pressure still
+persists a safety stop and shuts down. This mode disables aggregate memory
+admission and the requirement to reconnect older MCP clients; native cache and
+worker limits remain. The default `strict` policy keeps aggregate admission.
+Restart the daemon after changing policy. An existing safety-stop marker requires
+explicit operator review and clearing; selecting a policy never clears it.
+Full-table compaction remains disabled in either policy.
+
+Root `.gmaxignore` exclusions also filter native filesystem events. Simple
+positive rules update both daemon and standalone subscriptions when the policy
+changes. Rules with negations, escapes or advanced pattern syntax remain in the
+indexing policy only, preserving re-included files. Source JSON outside an
+excluded path stays indexable.

package/dist/lib/daemon/daemon.js

@@ -67,6 +67,7 @@ const autostart_1 = require("../utils/autostart");
 const blocked_roots_1 = require("../utils/blocked-roots");
 const daemon_client_1 = require("../utils/daemon-client");
 const daemon_launcher_1 = require("../utils/daemon-launcher");
+const host_guard_policy_1 = require("../utils/host-guard-policy");
 const host_resource_1 = require("../utils/host-resource");
 const kernel_zone_1 = require("../utils/kernel-zone");
 const keyed_mutex_1 = require("../utils/keyed-mutex");
@@ -263,6 +264,7 @@ class Daemon {
                 this.pausedReason = (_a = denied !== null && denied !== void 0 ? denied : pressure === null || pressure === void 0 ? void 0 : pressure.reason) !== null && _a !== void 0 ? _a : "read-only service requested";
             }
             process.title = "gmax-daemon";
+            console.log(`[daemon] Host guard policy: ${(0, host_guard_policy_1.hostGuardPolicy)()}`);
             if (this.pausedReason === null) {
                 try {
                     this.lastHostResources = resource_budget_1.resourceBudget.check();
@@ -2239,6 +2241,8 @@ class Daemon {
                 measured: true,
                 critical: true,
             };
+        if ((0, host_guard_policy_1.hostGuardPolicy)() === "critical-only")
+            return null;
         for (const sample of [memory, freshMemory]) {
             if (sample.status !== "known")
                 return {

package/dist/lib/daemon/watcher-manager.js

@@ -57,6 +57,7 @@ const cache_coherence_1 = require("../index/cache-coherence");
 const file_policy_1 = require("../index/file-policy");
 const walker_1 = require("../index/walker");
 const watcher_1 = require("../index/watcher");
+const watcher_ignore_1 = require("../index/watcher-ignore");
 const file_utils_1 = require("../utils/file-utils");
 const logger_1 = require("../utils/logger");
 const project_registry_1 = require("../utils/project-registry");
@@ -114,6 +115,7 @@ class WatcherManager {
         this.degradedRoots = new Set();
         this.terminalFailures = new Map();
         this.watchLifecycles = new Map();
+        this.subscriptionUpdates = new Map();
     }
     health(root) {
         var _a;
@@ -155,7 +157,17 @@ class WatcherManager {
                 let lastReindexAt;
                 processor = new batch_processor_1.ProjectBatchProcessor(Object.assign(Object.assign({ projectRoot: root, vectorDb,
                     metaCache }, (workerPool ? { workerPool } : {})), { filePolicy, onPolicyChange: () => {
-                        void this.runCatchup(root, processor).catch((err) => {
+                        void this.subscribeWatcher(root, processor)
+                            .then(() => {
+                            if (this.deps.processors.get(root) === processor &&
+                                !this.deps.getShuttingDown())
+                                return this.runCatchup(root, processor);
+                            return;
+                        }, (error) => {
+                            this.recoverWatcher(root, processor);
+                            throw error;
+                        })
+                            .catch((err) => {
                             console.error(`[daemon:${path.basename(root)}] Policy reconciliation failed:`, err);
                         });
                     }, onReindex: (files, ms) => __awaiter(this, void 0, void 0, function* () {
@@ -277,8 +289,27 @@ class WatcherManager {
     }
     subscribeWatcher(root, processor) {
         return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const previous = (_a = this.subscriptionUpdates.get(root)) !== null && _a !== void 0 ? _a : Promise.resolve();
+            const update = previous
+                .catch(() => { })
+                .then(() => this.subscribeWatcherNow(root, processor));
+            this.subscriptionUpdates.set(root, update);
+            try {
+                yield update;
+            }
+            finally {
+                if (this.subscriptionUpdates.get(root) === update)
+                    this.subscriptionUpdates.delete(root);
+            }
+        });
+    }
+    subscribeWatcherNow(root, processor) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
             const name = path.basename(root);
-            if (this.deps.processors.get(root) !== processor)
+            if (this.deps.processors.get(root) !== processor ||
+                ((_b = (_a = this.deps).getShuttingDown) === null || _b === void 0 ? void 0 : _b.call(_a)))
                 return;
             // Unsubscribe existing watcher if any (e.g. during recovery)
             const existingSub = this.deps.subscriptions.get(root);
@@ -286,11 +317,13 @@ class WatcherManager {
                 try {
                     yield existingSub.unsubscribe();
                 }
-                catch (_a) { }
+                catch (_c) { }
                 this.deps.subscriptions.delete(root);
             }
             const sub = yield watcher.subscribe(root, (err, events) => {
                 var _a, _b;
+                if (this.deps.processors.get(root) !== processor)
+                    return;
                 if (err) {
                     this.overflowCounts.set(root, ((_a = this.overflowCounts.get(root)) !== null && _a !== void 0 ? _a : 0) + 1);
                     const now = Date.now();
@@ -311,7 +344,12 @@ class WatcherManager {
                     processor.handleFileEvent(event.type === "delete" ? "unlink" : "change", event.path);
                 }
                 this.deps.touchActivity();
-            }, { ignore: watcher_1.WATCHER_IGNORE_GLOBS });
+            }, {
+                ignore: [
+                    ...watcher_1.WATCHER_IGNORE_GLOBS,
+                    ...(yield (0, watcher_ignore_1.readProjectWatcherIgnores)(root)),
+                ],
+            });
             if (this.deps.processors.get(root) !== processor) {
                 yield sub.unsubscribe();
                 return;
@@ -725,7 +763,7 @@ class WatcherManager {
     }
     unwatchProject(root) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a;
+            var _a, _b;
             // Stop poll-mode timers + their FSEvents recovery probe first, so a removed
             // project can't keep scanning until full daemon shutdown. These live
             // independently of the processor, so clear them even on the early return.
@@ -750,6 +788,7 @@ class WatcherManager {
             this.pendingOps.delete(`recover:${root}`);
             const processor = this.deps.processors.get(root);
             this.deps.processors.delete(root);
+            yield (_b = this.subscriptionUpdates.get(root)) === null || _b === void 0 ? void 0 : _b.catch(() => { });
             yield this.stopCatchup(root);
             if (processor)
                 yield processor.close();

package/dist/lib/index/watcher-ignore.js

@@ -0,0 +1,104 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nativeProjectIgnoreGlobs = nativeProjectIgnoreGlobs;
+exports.readProjectWatcherIgnores = readProjectWatcherIgnores;
+const fs = __importStar(require("node:fs/promises"));
+const path = __importStar(require("node:path"));
+const ignore_1 = __importDefault(require("ignore"));
+/** Only the common positive gitignore/glob subset is safe to push into Parcel.
+ * Negations, escapes and unsupported syntax stay with ProjectFilePolicy, so a
+ * native ignore can never hide a file that an explicit re-inclusion needs. */
+function nativeProjectIgnoreGlobs(content) {
+    const lines = content
+        .split("\n")
+        .map((line) => line.replace(/\r$/, "").replace(/ +$/, ""));
+    if (lines.some((line) => line.startsWith("!")))
+        return [];
+    const result = new Set();
+    for (const line of lines) {
+        if (!line || line.startsWith("#") || !/^[A-Za-z0-9_.*/-]+$/.test(line))
+            continue;
+        const pattern = line.replace(/^\//, "").replace(/\/$/, "");
+        if (!pattern ||
+            pattern.split("/").some((part) => part === "." || part === ".."))
+            continue;
+        // Keep root policy changes observable, including removal of a blanket rule.
+        const filter = (0, ignore_1.default)().add(line);
+        if (filter.ignores(".gmaxignore") || filter.ignores(".gitignore"))
+            continue;
+        if (pattern.split("/").some((part) => part.includes("**") && part !== "**"))
+            continue;
+        const glob = line.startsWith("/") || pattern.includes("/") ? pattern : `**/${pattern}`;
+        // A trailing slash ignores directories, never a same-named source file.
+        if (!line.endsWith("/"))
+            result.add(glob);
+        result.add(`${glob}/**`);
+    }
+    return [...result];
+}
+/** Root .gmaxignore rules are explicit project choices. Nested scopes and
+ * .gitignore remain authoritative in file policy, without lossy translation. */
+function readProjectWatcherIgnores(root) {
+    return __awaiter(this, void 0, void 0, function* () {
+        try {
+            const file = path.join(root, ".gmaxignore");
+            const stat = yield fs.stat(file);
+            if (!stat.isFile() || stat.size > 65536)
+                return [];
+            const contents = yield fs.readFile(file, "utf8");
+            if (Buffer.byteLength(contents) > 65536)
+                return [];
+            return nativeProjectIgnoreGlobs(contents);
+        }
+        catch (_a) {
+            // File policy handles unreadable policy conservatively. Native watching
+            // must still deliver changes rather than treating a failed read as empty.
+            return [];
+        }
+    });
+}

package/dist/lib/index/watcher.js

@@ -58,6 +58,7 @@ const cache_coherence_1 = require("./cache-coherence");
 const file_policy_1 = require("./file-policy");
 const ignore_patterns_1 = require("./ignore-patterns");
 const walker_1 = require("./walker");
+const watcher_ignore_1 = require("./watcher-ignore");
 // Directory names ignored at ANY depth. @parcel/watcher treats a non-glob
 // ignore entry as a literal path resolved against the watch root, so a bare
 // "dist" only covered <root>/dist — nested build dirs (packages/*/dist,
@@ -121,6 +122,42 @@ function startWatcher(opts) {
         let degradedRepairQueued = false;
         const terminalFailures = new Set();
         let processor;
+        let subscription = null;
+        let subscriptionUpdate = Promise.resolve();
+        let subscriptionPolicy = "";
+        const updateSubscription = () => {
+            const update = subscriptionUpdate
+                .catch(() => { })
+                .then(() => __awaiter(this, void 0, void 0, function* () {
+                const ignores = [
+                    ...exports.WATCHER_IGNORE_GLOBS,
+                    ...(yield (0, watcher_ignore_1.readProjectWatcherIgnores)(projectRoot)),
+                ];
+                const policy = JSON.stringify(ignores);
+                if (closing || (subscription && subscriptionPolicy === policy))
+                    return;
+                yield subscription === null || subscription === void 0 ? void 0 : subscription.unsubscribe();
+                subscription = null;
+                if (closing)
+                    return;
+                const next = yield watcher.subscribe(projectRoot, (err, events) => {
+                    if (err) {
+                        console.error(`[${wtag}] Watcher error:`, err);
+                        return;
+                    }
+                    for (const event of events)
+                        processor.handleFileEvent(event.type === "delete" ? "unlink" : "change", event.path);
+                }, { ignore: ignores });
+                if (closing) {
+                    yield next.unsubscribe();
+                    return;
+                }
+                subscription = next;
+                subscriptionPolicy = policy;
+            }));
+            subscriptionUpdate = update;
+            return update;
+        };
         const reportHealthyIfSettled = () => {
             var _a;
             if (scanHealthy &&
@@ -144,6 +181,9 @@ function startWatcher(opts) {
                 do {
                     reconcileRequested = false;
                     filePolicy.invalidateIgnoreCache();
+                    yield updateSubscription();
+                    if (closing)
+                        return;
                     const rootPrefix = projectRoot.endsWith("/")
                         ? projectRoot
                         : `${projectRoot}/`;
@@ -234,15 +274,7 @@ function startWatcher(opts) {
                 }
                 reportHealthyIfSettled();
             } }));
-        const subscription = yield watcher.subscribe(projectRoot, (err, events) => {
-            if (err) {
-                console.error(`[${wtag}] Watcher error:`, err);
-                return;
-            }
-            for (const event of events) {
-                processor.handleFileEvent(event.type === "delete" ? "unlink" : "change", event.path);
-            }
-        }, { ignore: exports.WATCHER_IGNORE_GLOBS });
+        yield updateSubscription();
         reconcile();
         return {
             get progress() {
@@ -250,7 +282,8 @@ function startWatcher(opts) {
             },
             close: () => __awaiter(this, void 0, void 0, function* () {
                 closing = true;
-                yield subscription.unsubscribe();
+                yield subscriptionUpdate.catch(() => { });
+                yield subscription === null || subscription === void 0 ? void 0 : subscription.unsubscribe();
                 yield reconciliation;
                 yield processor.close();
             }),

package/dist/lib/utils/host-guard-policy.js

@@ -0,0 +1,84 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hostGuardPolicy = hostGuardPolicy;
+exports.sampleCriticalPressure = sampleCriticalPressure;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const config_1 = require("../../config");
+const kernel_zone_1 = require("./kernel-zone");
+/** Explicit operator preference. Unknown values preserve strict admission. */
+function hostGuardPolicy() {
+    const environment = process.env.GMAX_HOST_GUARD_POLICY;
+    if (environment !== undefined)
+        return environment === "critical-only" ? "critical-only" : "strict";
+    try {
+        const config = JSON.parse(fs.readFileSync(path.join(config_1.PATHS.sharedRoot, "config.json"), "utf8"));
+        return config.hostGuardPolicy === "critical-only"
+            ? "critical-only"
+            : "strict";
+    }
+    catch (_a) {
+        return "strict";
+    }
+}
+/** No footprint scan or reservation ledger in explicitly selected critical-only
+ * mode. Unknown probes stay visible as unknown; they are never called healthy. */
+function sampleCriticalPressure() {
+    const at = Date.now();
+    const memory = (0, kernel_zone_1.probeMemoryPressure)();
+    const kernel = (0, kernel_zone_1.probeKernelZoneUsage)();
+    const freshMemory = (0, kernel_zone_1.probeMemoryPressure)();
+    const memoryPressure = [memory, freshMemory].some((p) => p.status === "known" && p.pressure === "critical")
+        ? "critical"
+        : freshMemory.status === "known"
+            ? freshMemory.pressure
+            : "unknown";
+    return {
+        at,
+        completedAt: Date.now(),
+        platform: process.platform,
+        processes: [],
+        aggregateFootprintMb: null,
+        physicalFreeMb: null,
+        swapUsedMb: null,
+        memoryPressure,
+        kernelPressure: kernel.status === "known" ? kernel.usage.pressure : "unknown",
+        kernelBytes: kernel.status === "known" ? kernel.usage.bytes : null,
+        incompleteReasons: [
+            "aggregate admission disabled by explicit critical-only policy",
+        ],
+    };
+}

package/dist/lib/utils/resource-budget.js

@@ -46,6 +46,7 @@ const path = __importStar(require("node:path"));
 const proper_lockfile_1 = __importDefault(require("proper-lockfile"));
 const config_1 = require("../../config");
 const autostart_1 = require("./autostart");
+const host_guard_policy_1 = require("./host-guard-policy");
 const host_resource_1 = require("./host-resource");
 const safety_latch_1 = require("./safety-latch");
 /** Admission thresholds, not an OS-enforced memory cap. Keep enough room for
@@ -107,7 +108,7 @@ class ResourceBudget {
         this.deps = Object.assign({ root: path.join(config_1.PATHS.sharedRoot, "resource-budget"), platform: process.platform, pid: process.pid, now: Date.now, sample: (extraPids = []) => {
                 const records = this.readRecords();
                 return (0, host_resource_1.sampleHostResources)([...records.map((r) => r.pid), ...extraPids], {}, records.flatMap((r) => (r.groupPid ? [r.groupPid] : [])));
-            }, signal: (pid) => process.kill(pid, 0), quarantine: autostart_1.daemonStartDeniedReason, latch: safety_latch_1.latchSafetyStop, processStart: () => (0, node_child_process_1.execFileSync)("ps", ["-p", String(process.pid), "-o", "lstart="], {
+            }, signal: (pid) => process.kill(pid, 0), policy: host_guard_policy_1.hostGuardPolicy, criticalSample: host_guard_policy_1.sampleCriticalPressure, quarantine: autostart_1.daemonStartDeniedReason, latch: safety_latch_1.latchSafetyStop, processStart: () => (0, node_child_process_1.execFileSync)("ps", ["-p", String(process.pid), "-o", "lstart="], {
                 encoding: "utf8",
                 timeout: 500,
                 maxBuffer: 1024,
@@ -315,6 +316,29 @@ class ResourceBudget {
                 requiredPid === null ||
                 requiredPid < 1))
             throw new ResourceAdmissionError("adopted model process identity unavailable; heavy work paused");
+        if (this.deps.policy() === "critical-only") {
+            const denied = this.deps.quarantine();
+            if (denied)
+                throw new ResourceAdmissionError(`heavy work refused: ${denied}`);
+            if (requiredPid)
+                this.deps.signal(requiredPid);
+            const snapshot = this.deps.criticalSample();
+            if (snapshot.memoryPressure === "critical" ||
+                snapshot.kernelPressure === "critical") {
+                const error = new ResourceAdmissionError("critical host pressure; heavy work refused", true);
+                try {
+                    this.deps.latch(error.message);
+                }
+                catch (_a) {
+                    error.message += "; safety stop persistence failed";
+                }
+                throw error;
+            }
+            const after = this.deps.quarantine();
+            if (after)
+                throw new ResourceAdmissionError(`heavy work refused: ${after}`);
+            return snapshot;
+        }
         return this.withLock(() => {
             const snapshot = this.deps.sample(requiredPid ? [requiredPid] : []);
             if (requiredPid && !snapshot.processes.some((p) => p.pid === requiredPid))
@@ -328,6 +352,10 @@ class ResourceBudget {
             throw new ResourceAdmissionError("invalid resource reservation");
         if (this.deps.platform !== "darwin")
             return { attach: () => { }, release: () => { } };
+        if (this.deps.policy() === "critical-only") {
+            this.check();
+            return { attach: () => { }, release: () => { } };
+        }
         let record = this.withLock(() => {
             var _a;
             const denied = this.deps.quarantine();

package/dist/lib/workers/pool.js

@@ -58,6 +58,7 @@ const config_1 = require("../../config");
 const embedding_generation_1 = require("../index/embedding-generation");
 const index_config_1 = require("../index/index-config");
 const autostart_1 = require("../utils/autostart");
+const host_guard_policy_1 = require("../utils/host-guard-policy");
 const kernel_zone_1 = require("../utils/kernel-zone");
 const logger_1 = require("../utils/logger");
 const resource_budget_1 = require("../utils/resource-budget");
@@ -423,21 +424,29 @@ class WorkerPool {
             const quarantine = (0, autostart_1.daemonStartDeniedReason)();
             if (quarantine)
                 return this.denySpawn(quarantine, false);
+            const strictHostGuard = (0, host_guard_policy_1.hostGuardPolicy)() === "strict";
             if (process.platform === "darwin") {
                 const memory = (0, kernel_zone_1.probeMemoryPressure)();
-                if (memory.status !== "known" || memory.pressure !== "normal") {
+                if ((memory.status === "known" && memory.pressure === "critical") ||
+                    (strictHostGuard &&
+                        (memory.status !== "known" || memory.pressure !== "normal"))) {
                     return this.denySpawn(`OS memory pressure ${memory.status === "known" ? memory.pressure : memory.status}; ${(0, kernel_zone_1.formatPressureProbe)(memory)}`, memory.status === "known" && memory.pressure === "critical");
                 }
                 const kernel = (0, kernel_zone_1.probeKernelZoneUsage)();
-                if (kernel.status !== "known" || kernel.usage.pressure !== "ok") {
+                if ((kernel.status === "known" && kernel.usage.pressure === "critical") ||
+                    (strictHostGuard &&
+                        (kernel.status !== "known" || kernel.usage.pressure !== "ok"))) {
                     return this.denySpawn(`kernel pressure ${kernel.status === "known" ? kernel.usage.pressure : kernel.status}; ${(0, kernel_zone_1.formatPressureProbe)(kernel)}`, kernel.status === "known" && kernel.usage.pressure === "critical");
                 }
             }
             if (process.platform === "darwin") {
                 // Refresh the cheap OS sample after the potentially slow kernel probe.
                 const freshMemory = (0, kernel_zone_1.probeMemoryPressure)();
-                if (freshMemory.status !== "known" ||
-                    freshMemory.pressure !== "normal") {
+                if ((freshMemory.status === "known" &&
+                    freshMemory.pressure === "critical") ||
+                    (strictHostGuard &&
+                        (freshMemory.status !== "known" ||
+                            freshMemory.pressure !== "normal"))) {
                     return this.denySpawn(`OS memory pressure ${freshMemory.status === "known" ? freshMemory.pressure : freshMemory.status}; ${(0, kernel_zone_1.formatPressureProbe)(freshMemory)}`, freshMemory.status === "known" &&
                         freshMemory.pressure === "critical");
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "grepmax",
-  "version": "0.26.60",
+  "version": "0.26.62",
   "author": "Robert Owens <78518764+reowens@users.noreply.github.com>",
   "homepage": "https://github.com/reowens/grepmax",
   "bugs": {

package/plugins/grepmax/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "grepmax",
-  "version": "0.26.60",
+  "version": "0.26.62",
   "description": "Semantic code search for Claude Code. Automatically indexes your project and provides intelligent search capabilities.",
   "author": {
     "name": "Robert Owens",