grepmax 0.26.77 → 0.26.79

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "grepmax",
       "source": "./plugins/grepmax",
       "description": "Semantic code search for Claude Code. Automatically indexes your project and provides intelligent search capabilities.",
-      "version": "0.26.77",
+      "version": "0.26.79",
       "author": {
         "name": "Robert Owens",
         "email": "robowens@me.com"

package/README.md

@@ -528,11 +528,11 @@ The package includes a separate prune-only helper with pinned Lance 12 dependenc
 
 `gmax recover --table /path/to/lancedb/chunks.lance --json` reads the durable recovery receipt without starting a daemon or preparing Python. `--check` samples admission without pruning. `--prune --version <current-version> --cutoff <absolute-ISO-timestamp>` explicitly requests one offline prune. A prior uncertain attempt requires `--acknowledge-uncertain <attempt-id>` after inspection. Recovery never creates/clears quarantine, stops other owners, retries automatically or enables rewriting.
 
-Production recovery currently requires macOS, a persistent `autostart-disabled` file in the selected store home, and closed store owners. Recovery alone uses known healthy memory/kernel pressure and the shared aggregate resource budget; normal development retains its configured guard policy. Immediately free RAM is measured for diagnostics but has no fixed minimum: macOS can reclaim cached memory, so a low free-page count alone must not prevent cleanup. The helper reserves 512 MiB of admission capacity; this is not an OS-enforced footprint cap. Recovery samples have an eight-second total ceiling, including the established five-second kernel probe allowance, with fresh sampling at deletion admission and five-second heartbeat scheduling. Unknown, stale, warning or critical measurements refuse/interrupt recovery. Pruning needs at least 1 MiB of measured metadata disk headroom, not full-table rewrite space. Initial wheel setup requires 512 MiB; an existing environment is checked against the lock offline without that download-space requirement.
+Production recovery currently requires macOS, a persistent `autostart-disabled` file in the selected store home, and closed store owners. Recovery uses the shared aggregate resource budget and requires measured OS pressure and healthy kernel pressure. The configured `critical-only` policy permits a known OS memory warning while retaining aggregate accounting; the default `strict` policy pauses on warnings. Immediately free RAM is measured for diagnostics but has no fixed minimum: macOS can reclaim cached memory, so a low free-page count alone must not prevent cleanup. The helper reserves 512 MiB of admission capacity; this is not an OS-enforced footprint cap. Recovery samples have an eight-second total ceiling, including a five-second kernel probe allowance, three-second command allowance and three-second footprint allowance, with fresh sampling at deletion admission and five-second heartbeat scheduling. Unknown, stale, critical, kernel-warning or over-budget measurements refuse/interrupt recovery. A prune has a ten-minute wall-time ceiling so rate-limited deletion of thousands of manifests can finish; the 90-second CPU limit and guarded heartbeat remain. Pruning needs at least 1 MiB of measured metadata disk headroom, not full-table rewrite space. Initial wheel setup requires 512 MiB; an existing environment is checked against the lock offline without that download-space requirement.
 
 The child waits for launch and deletion admission tokens, with verified helper PID/start identity recorded as the primary exclusive owner. Existing readers retain exclusion if the parent dies while the helper is alive. Current/tagged/post-cutoff metadata is verified after pruning; recovery refuses more than 256 protected versions before deletion to bound verification. Interrupted attempts require verification and explicit acknowledgement before retry. Linux/APFS fixtures exercise native retention and interruption; supported production host admission is tested separately and still runs freshly for each operation.
 
-If a short-lived client child exits during memory sampling, confirmed dead processes can leave the sample while all surviving processes retain measured footprints. An uncertain exit, new process or changed identity requires a complete fresh measurement; a normal-pressure sample may do that once within the original deadline. It never accepts an unmeasured live process. Continued changes, unavailable measurements, and observed warning or critical pressure still refuse admission.
+If a short-lived client child exits during memory sampling, confirmed dead processes can leave the sample while all surviving processes retain measured footprints. An uncertain exit, new process or changed identity requires a complete fresh measurement; a normal-pressure sample may do that once within the original deadline. It never accepts an unmeasured live process. Continued changes, unavailable measurements and critical pressure still refuse admission; warning admission follows the recovery policy above.
 
 For an operator-coordinated recovery window:
 

package/dist/lib/store/lance-cleanup.js

@@ -56,6 +56,9 @@ const store_lease_1 = require("./store-lease");
 const project = path.resolve(__dirname, "../../../lance-maintenance");
 const MAX_OUTPUT_BYTES = 128 * 1024;
 const MAX_HELPER_MS = 120000;
+// Pruning deletes at 32 files/second. Thousands of retained manifests and
+// transactions cannot fit a two-minute window even with an idle host.
+const MAX_PRUNE_MS = 600000;
 /** No shell, inherited service credentials, Python path hooks or source builds.
  * Thread settings apply before Arrow/Lance imports in the child. */
 function helperEnvironment() {
@@ -104,7 +107,7 @@ function runCleanupProcess(executable, args, options = {}) {
             forceKill !== null && forceKill !== void 0 ? forceKill : (forceKill = setTimeout(() => child.kill("SIGKILL"), 1000));
         };
         const abort = () => stop("Cleanup cancelled");
-        const timeout = setTimeout(() => stop("Cleanup timed out"), Math.min((_d = options.timeoutMs) !== null && _d !== void 0 ? _d : MAX_HELPER_MS, MAX_HELPER_MS));
+        const timeout = setTimeout(() => stop("Cleanup timed out"), Math.min((_d = options.timeoutMs) !== null && _d !== void 0 ? _d : MAX_HELPER_MS, MAX_PRUNE_MS));
         (_a = options.signal) === null || _a === void 0 ? void 0 : _a.addEventListener("abort", abort, { once: true });
         // stderr is deliberately not returned: child diagnostics may contain paths,
         // tokens or registry URLs. Retain a concrete bounded exit/signal/error code.
@@ -360,6 +363,7 @@ function pruneVersions(runtime, store, version, cutoff, options) {
                     "--require-admission",
                 ], {
                     signal: options.signal,
+                    timeoutMs: MAX_PRUNE_MS,
                     admission: {
                         nonce: options.lease.owner.nonce,
                         start: (pid) => {

package/dist/lib/store/recovery-admission.js

@@ -39,6 +39,7 @@ exports.assertRecoveryAdmission = assertRecoveryAdmission;
 exports.admitPrune = admitPrune;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
+const host_guard_policy_1 = require("../utils/host-guard-policy");
 const resource_budget_1 = require("../utils/resource-budget");
 const safety_latch_1 = require("../utils/safety-latch");
 const maintenance_policy_1 = require("./maintenance-policy");
@@ -48,9 +49,18 @@ exports.PRUNE_METADATA_HEADROOM_BYTES = 1024 * 1024;
 function createRecoveryBudget() {
     return new resource_budget_1.ResourceBudget({
         policy: () => "strict",
+        // Keep measured aggregate accounting in both policies. The user's
+        // critical-only selection permits known OS warning, not missing samples,
+        // unknown/kernel pressure or an overcommitted aggregate reservation.
+        allowMemoryWarning: () => (0, host_guard_policy_1.hostGuardPolicy)() === "critical-only",
         quarantine: safety_latch_1.safetyStopReason,
         requireClientRegistration: false,
-        samplerOverrides: { sampleTimeoutMs: 8000, kernelProbeTimeoutMs: 5000 },
+        samplerOverrides: {
+            sampleTimeoutMs: 8000,
+            kernelProbeTimeoutMs: 5000,
+            commandProbeTimeoutMs: 3000,
+            footprintProbeTimeoutMs: 3000,
+        },
         sampleMaxAgeMs: 10000,
     });
 }

package/dist/lib/utils/host-resource.js

@@ -163,7 +163,7 @@ function sampleHostResourcesOnce(extraPids, overrides, extraGroups) {
                     return false;
                 throw new Error("process liveness unavailable");
             }
-        }, sampleTimeoutMs: exports.HOST_SAMPLE_TIMEOUT_MS, kernelProbeTimeoutMs: 500, run: (command, args, timeoutMs) => (0, node_child_process_1.execFileSync)(command, args, {
+        }, sampleTimeoutMs: exports.HOST_SAMPLE_TIMEOUT_MS, kernelProbeTimeoutMs: 500, commandProbeTimeoutMs: 500, footprintProbeTimeoutMs: 1500, run: (command, args, timeoutMs) => (0, node_child_process_1.execFileSync)(command, args, {
             encoding: "utf8",
             timeout: timeoutMs,
             maxBuffer: 512 * 1024,
@@ -185,7 +185,7 @@ function sampleHostResourcesOnce(extraPids, overrides, extraGroups) {
     if (deps.platform !== "darwin")
         return snapshot;
     const deadline = deps.monotonic() + deps.sampleTimeoutMs;
-    const run = (command, args, maximumMs = 500) => {
+    const run = (command, args, maximumMs = deps.commandProbeTimeoutMs) => {
         const remaining = Math.floor(deadline - deps.monotonic());
         if (remaining <= 0)
             throw new Error("resource sample deadline exceeded");
@@ -222,7 +222,7 @@ function sampleHostResourcesOnce(extraPids, overrides, extraGroups) {
         const footprints = parseBatchFootprints(run("footprint", [
             "--noCategories",
             ...snapshot.processes.flatMap((p) => ["-p", String(p.pid)]),
-        ], 1500));
+        ], deps.footprintProbeTimeoutMs));
         for (const p of snapshot.processes)
             p.footprintMb = (_c = footprints.get(p.pid)) !== null && _c !== void 0 ? _c : null;
         const after = parseResourceProcesses(run("ps", PS_ARGS), deps.uid, deps.pid, extraPids, extraGroups);

package/dist/lib/utils/resource-budget.js

@@ -77,11 +77,12 @@ function resolveResourceBudgetMb(raw = process.env.GMAX_RESOURCE_BUDGET_MB) {
         throw new ResourceAdmissionError("resource budget must be 256..6144 MiB");
     return n;
 }
-function assertResourceSnapshot(snapshot, chargedMb, budgetMb, now = Date.now(), sampleMaxAgeMs = 5000) {
+function assertResourceSnapshot(snapshot, chargedMb, budgetMb, now = Date.now(), sampleMaxAgeMs = 5000, allowMemoryWarning = false) {
     if (snapshot.memoryPressure === "critical" ||
         snapshot.kernelPressure === "critical")
         throw new ResourceAdmissionError("critical host pressure; heavy work refused", true);
-    if (snapshot.memoryPressure === "warn" || snapshot.kernelPressure === "warn")
+    if ((snapshot.memoryPressure === "warn" && !allowMemoryWarning) ||
+        snapshot.kernelPressure === "warn")
         throw new ResourceAdmissionError("warning host pressure; heavy work paused");
     if (snapshot.platform !== "darwin")
         return;
@@ -92,7 +93,8 @@ function assertResourceSnapshot(snapshot, chargedMb, budgetMb, now = Date.now(),
         throw new ResourceAdmissionError("resource sample stale or clock changed; heavy work paused");
     if (snapshot.incompleteReasons.length ||
         snapshot.aggregateFootprintMb === null ||
-        snapshot.memoryPressure !== "normal" ||
+        (snapshot.memoryPressure !== "normal" &&
+            !(allowMemoryWarning && snapshot.memoryPressure === "warn")) ||
         snapshot.kernelPressure !== "ok")
         throw new ResourceAdmissionError(`unknown aggregate resources; heavy work paused: ${snapshot.incompleteReasons.join(", ") || "incomplete sample"}`);
     if (!Number.isFinite(chargedMb) ||
@@ -110,7 +112,7 @@ class ResourceBudget {
         this.deps = Object.assign({ root: path.join(config_1.PATHS.sharedRoot, "resource-budget"), platform: process.platform, pid: process.pid, now: Date.now, sample: (extraPids = []) => {
                 const records = this.readExistingRecords();
                 return (0, host_resource_1.sampleHostResources)([...records.map((r) => r.pid), ...extraPids], this.deps.samplerOverrides, records.flatMap((r) => (r.groupPid ? [r.groupPid] : [])));
-            }, signal: (pid) => process.kill(pid, 0), policy: host_guard_policy_1.hostGuardPolicy, requireClientRegistration: true, samplerOverrides: {}, sampleMaxAgeMs: 5000, criticalSample: host_guard_policy_1.sampleCriticalPressure, quarantine: autostart_1.daemonStartDeniedReason, latch: (reason, diagnostics) => (0, safety_latch_1.latchSafetyStop)(reason, undefined, diagnostics), processStart: () => (0, node_child_process_1.execFileSync)("ps", ["-p", String(process.pid), "-o", "lstart="], {
+            }, signal: (pid) => process.kill(pid, 0), policy: host_guard_policy_1.hostGuardPolicy, requireClientRegistration: true, allowMemoryWarning: () => false, samplerOverrides: {}, sampleMaxAgeMs: 5000, criticalSample: host_guard_policy_1.sampleCriticalPressure, quarantine: autostart_1.daemonStartDeniedReason, latch: (reason, diagnostics) => (0, safety_latch_1.latchSafetyStop)(reason, undefined, diagnostics), processStart: () => (0, node_child_process_1.execFileSync)("ps", ["-p", String(process.pid), "-o", "lstart="], {
                 encoding: "utf8",
                 timeout: 500,
                 maxBuffer: 1024,
@@ -267,7 +269,7 @@ class ResourceBudget {
     }
     checked(snapshot, records, kind, mb) {
         try {
-            assertResourceSnapshot(snapshot, this.charge(snapshot, records), resolveResourceBudgetMb(), this.deps.now(), this.deps.sampleMaxAgeMs);
+            assertResourceSnapshot(snapshot, this.charge(snapshot, records), resolveResourceBudgetMb(), this.deps.now(), this.deps.sampleMaxAgeMs, this.deps.allowMemoryWarning());
             const legacy = snapshot.processes.filter((p) => p.role === "mcp" &&
                 !records.some((r) => r.pid === p.pid && r.kind === "client"));
             if (legacy.length && this.deps.requireClientRegistration)
@@ -344,7 +346,7 @@ class ResourceBudget {
         }
         const records = this.readExistingRecords();
         const snapshot = this.deps.sample();
-        assertResourceSnapshot(snapshot, this.charge(snapshot, records), resolveResourceBudgetMb(), this.deps.now(), this.deps.sampleMaxAgeMs);
+        assertResourceSnapshot(snapshot, this.charge(snapshot, records), resolveResourceBudgetMb(), this.deps.now(), this.deps.sampleMaxAgeMs, this.deps.allowMemoryWarning());
         if (this.deps.quarantine())
             throw new ResourceAdmissionError("host containment");
         return snapshot;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "grepmax",
-  "version": "0.26.77",
+  "version": "0.26.79",
   "author": "Robert Owens <78518764+reowens@users.noreply.github.com>",
   "homepage": "https://github.com/reowens/grepmax",
   "bugs": {

package/plugins/grepmax/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "grepmax",
-  "version": "0.26.77",
+  "version": "0.26.79",
   "description": "Semantic code search for Claude Code. Automatically indexes your project and provides intelligent search capabilities.",
   "author": {
     "name": "Robert Owens",