grepmax 0.26.66 → 0.26.67

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "grepmax",
       "source": "./plugins/grepmax",
       "description": "Semantic code search for Claude Code. Automatically indexes your project and provides intelligent search capabilities.",
-      "version": "0.26.66",
+      "version": "0.26.67",
       "author": {
         "name": "Robert Owens",
         "email": "robowens@me.com"

package/README.md

@@ -57,7 +57,7 @@ gmax doctor                   # Health check
 gmax doctor --fix             # Repair checks; full-table maintenance is disabled
 ```
 
-**Storage containment:** full-table compaction is disabled, including forced maintenance and doctor repair. Existing retained index copies are not reclaimed by this release. The verified prune-only recovery path is separate work; normal incremental indexing remains available when the host is healthy and not quarantined. A persistent host safety stop blocks mutation and normal daemon restart; an explicit read-only start can serve the retained index. Installing an update preserves existing quarantine. Speculative embedding warmup and maintenance timers are disabled. On macOS, startup, heavy queries, worker forks and MLX launches require known normal OS memory pressure and a healthy kernel-zone sample; warning or unavailable probes pause heavy work while the daemon serves bounded reads. Known critical pressure still stops the daemon.
+**Storage containment:** full-table compaction is disabled, including forced maintenance and doctor repair. Existing retained index copies are not reclaimed by this release. The verified prune-only recovery path is separate work; normal incremental indexing remains available when the host is healthy and not quarantined. A persistent host safety stop blocks mutation and normal daemon restart; an explicit read-only start can serve the retained index. Installing an update preserves existing quarantine. Speculative embedding warmup and maintenance timers are disabled. Under the default `strict` host policy on macOS, startup, heavy queries, worker forks and MLX launches require known normal OS memory pressure and a healthy kernel-zone sample; warning or unavailable probes pause heavy work while the daemon serves bounded reads. The explicit `critical-only` policy keeps semantic search and indexing available under warning or unavailable probes. Known critical pressure still stops the daemon.
 
 ### Core Commands
 
@@ -495,6 +495,14 @@ Production recovery currently requires macOS, a persistent `autostart-disabled`
 
 The child waits for launch and deletion admission tokens, with verified helper PID/start identity recorded as the primary exclusive owner. Existing readers retain exclusion if the parent dies while the helper is alive. Current/tagged/post-cutoff metadata is verified after pruning; recovery refuses more than 256 protected versions before deletion to bound verification. Interrupted attempts require verification and explicit acknowledgement before retry. Linux/APFS fixtures exercise native retention and interruption; supported production host admission is tested separately and still runs freshly for each operation.
 
+For an operator-coordinated recovery window:
+
+1. Check live host pressure and service availability first. Keep development online when recovery admission is already known to refuse. Preserve the configured normal-service policy and any pre-existing safety markers.
+2. Once admission is plausible, create a private, durable task-owned autostart marker and gracefully close the identified daemon and its managed children. Verify shared store owners have drained. `--check` samples resource admission; it does not drain owners or acquire the exclusive prune lease.
+3. Take a fresh bounded version/tag inventory after draining, with a shared lease and small native Session caches. Close that reader before pruning. Choose an explicit real-clock cutoff and verify the union of current, tagged and post-cutoff versions fits the 256-version verification bound. A snapshot from before resumed indexing is unsuitable; never silently move the cutoff to fit the bound.
+4. Run one `recover --prune` with that current version and cutoff. Both `--store <value> recover` and `--store=<value> recover` preserve recovery's table-version option; the explicit `--table` selects the recovery store. Require a verified result and completed receipt before claiming recovery. Record signed table allocated-byte recovery separately from global filesystem free-space change.
+5. Wait for the recovery child and helper to close before lifting exclusion. Clear only the unchanged marker created by this operation, then restore normal service and verify search/watcher health and unchanged configuration. If ownership or the marker changed, preserve containment and inspect it. An uncertain receipt requires retained-state inspection and explicit acknowledgement before another attempt; never automatically retry.
+
 Explicit helper calls persist a private `.gmax-prune-state.json` receipt outside the table before deletion. Cancellation, invalid results, lost ownership and abandoned running receipts remain uncertain; a verified explicit retry records the prior uncertain attempt. Successful receipts include before/after file lengths, allocated bytes and filesystem free space. These measurements do not imply zero retained copies or a macOS physical-footprint cap. Current, tagged and post-cutoff versions are protected; unverified files are retained. Full-table rewriting remains disabled regardless of receipt state.
 
 `~/.gmax/logs/daemon.log` records containment skips and retained historical compaction outcomes, including duration, logical size, disk size before/after, free space, and bytes reclaimed. `gmax status --json` exposes the last outcome under `daemon.compaction`; its `at` timestamp identifies when it was recorded. Five-minute resource snapshots track footprint, RSS, heap, external/ArrayBuffer memory, Lance cache, workers and pending work for memory investigations. Reading status uses retained snapshots and does not scan the index directory. Logs rotate to `daemon.log.prev`.
@@ -570,7 +578,7 @@ grepmax is built upon the foundation of [mgrep](https://github.com/mixedbread-ai
 
 Licensed under the Apache License, Version 2.0. See [LICENSE](LICENSE).
 
-On macOS, heavy work uses a shared resource ledger and a bounded batch footprint probe covering every gmax process and its children. Native stores, workers and model launches reserve headroom before allocating it. Warning or unknown measurements pause heavy work; known critical pressure persists a stop. The 6 GiB admission budget is a conservative scheduling threshold, not an OS-enforced memory cap. It may be lowered with `GMAX_RESOURCE_BUDGET_MB`. Existing safety markers remain in place after upgrades.
+On macOS, heavy work uses a shared resource ledger and a bounded batch footprint probe covering every gmax process and its children. Native stores, workers and model launches reserve headroom before allocating it. Under the default `strict` policy, warning or unknown measurements pause heavy work; known critical pressure persists a stop under either policy. The 6 GiB admission budget is a conservative scheduling threshold, not an OS-enforced memory cap. It may be lowered with `GMAX_RESOURCE_BUDGET_MB`. Existing safety markers remain in place after upgrades.
 
 MCP sessions started before this resource policy must reconnect after upgrading before heavy work can resume. Keyword search through the bounded read service stays available while those sessions are running. Cached resource snapshots in `gmax status --json` distinguish aggregate physical footprint from daemon RSS.
 

package/dist/bin.js

@@ -39,9 +39,10 @@ exports.registeredForm = registeredForm;
 // Entry point. Picks the gmax home before anything reads config.ts: a command
 // aimed at a project under a secondary store's prefix (src/lib/utils/stores.ts)
 // runs against that store, in-process, so the drive it lives on can always
-// eject. Only Node built-ins and stores.ts may be imported here.
+// eject. Only Node built-ins and dependency-free routing helpers may load here.
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
+const cli_command_1 = require("./lib/utils/cli-command");
 const stores_1 = require("./lib/utils/stores");
 const DIR_ARG_COMMANDS = new Set(["add", "remove"]);
 function optionValue(argv, names) {
@@ -77,7 +78,9 @@ function selectHome() {
     const argv = process.argv.slice(2);
     // These enumerate/route stores per request rather than pinning the process
     // to its launch cwd's store. In particular an MCP session can serve both.
-    if (argv[0] === "mcp" || argv[0] === "status" || argv[0] === "recover")
+    if (argv[0] === "mcp" ||
+        argv[0] === "status" ||
+        (0, cli_command_1.explicitCommand)(argv) === "recover")
         return;
     const match = (0, stores_1.matchStore)(commandTarget(argv, process.cwd()));
     if (match.kind === "primary")

package/dist/index.js

@@ -79,6 +79,7 @@ const symbols_1 = require("./commands/symbols");
 const test_find_1 = require("./commands/test-find");
 const trace_1 = require("./commands/trace");
 const watch_1 = require("./commands/watch");
+const cli_command_1 = require("./lib/utils/cli-command");
 commander_1.program
     .name("gmax")
     .description("Semantic code search — finds code by meaning, not just strings")
@@ -165,6 +166,6 @@ opencode_1.uninstallOpencode._hidden = true;
 commander_1.program.addCommand(opencode_1.uninstallOpencode);
 // Recovery owns --version as a required table-version value. Keep the root
 // package-version flag from consuming it; other commands retain global options.
-if (process.argv[2] === "recover")
+if ((0, cli_command_1.explicitCommand)(process.argv.slice(2)) === "recover")
     commander_1.program.enablePositionalOptions();
 commander_1.program.parse();

package/dist/lib/utils/cli-command.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.explicitCommand = explicitCommand;
+/** Find an explicit command after the root's --store option, without treating
+ * its value (which can itself be a command name) as the command. Root help and
+ * version flags retain their normal early-exit behavior. */
+function explicitCommand(argv) {
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg === "--store") {
+            if (argv[i + 1] === undefined)
+                return undefined;
+            i++;
+        }
+        else if (arg.startsWith("--store=")) {
+        }
+        else if (arg === "--") {
+            return argv[i + 1];
+        }
+        else {
+            return arg.startsWith("-") ? undefined : arg;
+        }
+    }
+    return undefined;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "grepmax",
-  "version": "0.26.66",
+  "version": "0.26.67",
   "author": "Robert Owens <78518764+reowens@users.noreply.github.com>",
   "homepage": "https://github.com/reowens/grepmax",
   "bugs": {

package/plugins/grepmax/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "grepmax",
-  "version": "0.26.66",
+  "version": "0.26.67",
   "description": "Semantic code search for Claude Code. Automatically indexes your project and provides intelligent search capabilities.",
   "author": {
     "name": "Robert Owens",