grepmax 0.26.78 → 0.26.80

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "grepmax",
       "source": "./plugins/grepmax",
       "description": "Semantic code search for Claude Code. Automatically indexes your project and provides intelligent search capabilities.",
-      "version": "0.26.78",
+      "version": "0.26.80",
       "author": {
         "name": "Robert Owens",
         "email": "robowens@me.com"

package/README.md

@@ -528,11 +528,11 @@ The package includes a separate prune-only helper with pinned Lance 12 dependenc
 
 `gmax recover --table /path/to/lancedb/chunks.lance --json` reads the durable recovery receipt without starting a daemon or preparing Python. `--check` samples admission without pruning. `--prune --version <current-version> --cutoff <absolute-ISO-timestamp>` explicitly requests one offline prune. A prior uncertain attempt requires `--acknowledge-uncertain <attempt-id>` after inspection. Recovery never creates/clears quarantine, stops other owners, retries automatically or enables rewriting.
 
-Production recovery currently requires macOS, a persistent `autostart-disabled` file in the selected store home, and closed store owners. Recovery uses the shared aggregate resource budget and requires measured OS pressure and healthy kernel pressure. The configured `critical-only` policy permits a known OS memory warning while retaining aggregate accounting; the default `strict` policy pauses on warnings. Immediately free RAM is measured for diagnostics but has no fixed minimum: macOS can reclaim cached memory, so a low free-page count alone must not prevent cleanup. The helper reserves 512 MiB of admission capacity; this is not an OS-enforced footprint cap. Recovery samples have an eight-second total ceiling, including the established five-second kernel probe allowance, with fresh sampling at deletion admission and five-second heartbeat scheduling. Unknown, stale, critical, kernel-warning or over-budget measurements refuse/interrupt recovery. Pruning needs at least 1 MiB of measured metadata disk headroom, not full-table rewrite space. Initial wheel setup requires 512 MiB; an existing environment is checked against the lock offline without that download-space requirement.
+Production recovery currently requires macOS, a persistent `autostart-disabled` file in the selected store home, and closed store owners. Recovery uses the shared aggregate resource budget and requires measured OS pressure and healthy kernel pressure. The configured `critical-only` policy permits a known OS memory warning while retaining aggregate accounting; the default `strict` policy pauses on warnings. Immediately free RAM is measured for diagnostics but has no fixed minimum: macOS can reclaim cached memory, so a low free-page count alone must not prevent cleanup. The helper reserves 512 MiB of admission capacity; this is not an OS-enforced footprint cap. Recovery samples have an eight-second total ceiling, including a five-second kernel probe allowance, three-second command allowance and three-second footprint allowance, with fresh sampling at deletion admission and five-second heartbeat scheduling. Unknown, stale, critical, kernel-warning or over-budget measurements refuse/interrupt recovery. A prune has a ten-minute wall-time ceiling so rate-limited deletion of thousands of manifests can finish; the 90-second CPU limit and guarded heartbeat remain. Pruning needs at least 1 MiB of measured metadata disk headroom, not full-table rewrite space. Initial wheel setup requires 512 MiB; an existing environment is checked against the lock offline without that download-space requirement.
 
 The child waits for launch and deletion admission tokens, with verified helper PID/start identity recorded as the primary exclusive owner. Existing readers retain exclusion if the parent dies while the helper is alive. Current/tagged/post-cutoff metadata is verified after pruning; recovery refuses more than 256 protected versions before deletion to bound verification. Interrupted attempts require verification and explicit acknowledgement before retry. Linux/APFS fixtures exercise native retention and interruption; supported production host admission is tested separately and still runs freshly for each operation.
 
-If a short-lived client child exits during memory sampling, confirmed dead processes can leave the sample while all surviving processes retain measured footprints. An uncertain exit, new process or changed identity requires a complete fresh measurement; a normal-pressure sample may do that once within the original deadline. It never accepts an unmeasured live process. Continued changes, unavailable measurements and critical pressure still refuse admission; warning admission follows the recovery policy above.
+If a short-lived client child exits during memory sampling, confirmed dead processes can leave the sample while all surviving processes retain measured footprints. An uncertain exit, new process or changed identity requires a complete fresh measurement; a recovery sample may do that once within the original deadline while retaining any observed OS warning for the final policy check. Normal service requires normal pressure for this retry. It never accepts an unmeasured live process. Continued changes, unavailable measurements and critical pressure still refuse admission; warning admission follows the recovery policy above.
 
 For an operator-coordinated recovery window:
 

package/dist/lib/store/lance-cleanup.js

@@ -56,6 +56,9 @@ const store_lease_1 = require("./store-lease");
 const project = path.resolve(__dirname, "../../../lance-maintenance");
 const MAX_OUTPUT_BYTES = 128 * 1024;
 const MAX_HELPER_MS = 120000;
+// Pruning deletes at 32 files/second. Thousands of retained manifests and
+// transactions cannot fit a two-minute window even with an idle host.
+const MAX_PRUNE_MS = 600000;
 /** No shell, inherited service credentials, Python path hooks or source builds.
  * Thread settings apply before Arrow/Lance imports in the child. */
 function helperEnvironment() {
@@ -104,7 +107,7 @@ function runCleanupProcess(executable, args, options = {}) {
             forceKill !== null && forceKill !== void 0 ? forceKill : (forceKill = setTimeout(() => child.kill("SIGKILL"), 1000));
         };
         const abort = () => stop("Cleanup cancelled");
-        const timeout = setTimeout(() => stop("Cleanup timed out"), Math.min((_d = options.timeoutMs) !== null && _d !== void 0 ? _d : MAX_HELPER_MS, MAX_HELPER_MS));
+        const timeout = setTimeout(() => stop("Cleanup timed out"), Math.min((_d = options.timeoutMs) !== null && _d !== void 0 ? _d : MAX_HELPER_MS, MAX_PRUNE_MS));
         (_a = options.signal) === null || _a === void 0 ? void 0 : _a.addEventListener("abort", abort, { once: true });
         // stderr is deliberately not returned: child diagnostics may contain paths,
         // tokens or registry URLs. Retain a concrete bounded exit/signal/error code.
@@ -360,6 +363,7 @@ function pruneVersions(runtime, store, version, cutoff, options) {
                     "--require-admission",
                 ], {
                     signal: options.signal,
+                    timeoutMs: MAX_PRUNE_MS,
                     admission: {
                         nonce: options.lease.owner.nonce,
                         start: (pid) => {

package/dist/lib/store/recovery-admission.js

@@ -55,7 +55,15 @@ function createRecoveryBudget() {
         allowMemoryWarning: () => (0, host_guard_policy_1.hostGuardPolicy)() === "critical-only",
         quarantine: safety_latch_1.safetyStopReason,
         requireClientRegistration: false,
-        samplerOverrides: { sampleTimeoutMs: 8000, kernelProbeTimeoutMs: 5000 },
+        samplerOverrides: {
+            sampleTimeoutMs: 8000,
+            kernelProbeTimeoutMs: 5000,
+            commandProbeTimeoutMs: 3000,
+            footprintProbeTimeoutMs: 3000,
+            // Re-measure a changing cohort while retaining warning severity. The
+            // fresh policy check above still decides whether that warning is allowed.
+            retryWarningPressure: true,
+        },
         sampleMaxAgeMs: 10000,
     });
 }

package/dist/lib/utils/host-resource.js

@@ -134,13 +134,20 @@ function sampleHostResources(extraPids = [], overrides = {}, extraGroups = []) {
     const monotonic = (_a = overrides.monotonic) !== null && _a !== void 0 ? _a : (() => performance.now());
     const deadline = monotonic() + ((_b = overrides.sampleTimeoutMs) !== null && _b !== void 0 ? _b : exports.HOST_SAMPLE_TIMEOUT_MS);
     let snapshot;
+    let observedWarning = false;
     for (let attempt = 0; attempt < 2; attempt++) {
         snapshot = sampleHostResourcesOnce(extraPids, Object.assign(Object.assign({}, overrides), { monotonic, sampleTimeoutMs: Math.max(0, deadline - monotonic()) }), extraGroups);
+        observedWarning || (observedWarning = snapshot.memoryPressure === "warn");
+        // A fresh complete cohort may retain an observed warning; retrying must
+        // never downgrade it to normal or weaken the caller's final policy check.
+        if (observedWarning && snapshot.memoryPressure === "normal")
+            snapshot.memoryPressure = "warn";
         // Short-lived client children routinely exit during footprint sampling.
         // Re-measure the entire cohort once, within the original deadline. Never
-        // accept a partial total or retry away observed warning/critical pressure.
+        // accept a partial total or downgrade observed warning/critical pressure.
         if (attempt === 1 ||
-            snapshot.memoryPressure !== "normal" ||
+            (snapshot.memoryPressure !== "normal" &&
+                !(overrides.retryWarningPressure && snapshot.memoryPressure === "warn")) ||
             snapshot.kernelPressure !== "ok" ||
             snapshot.incompleteReasons.length !== 1 ||
             snapshot.incompleteReasons[0] !==
@@ -163,7 +170,7 @@ function sampleHostResourcesOnce(extraPids, overrides, extraGroups) {
                     return false;
                 throw new Error("process liveness unavailable");
             }
-        }, sampleTimeoutMs: exports.HOST_SAMPLE_TIMEOUT_MS, kernelProbeTimeoutMs: 500, run: (command, args, timeoutMs) => (0, node_child_process_1.execFileSync)(command, args, {
+        }, sampleTimeoutMs: exports.HOST_SAMPLE_TIMEOUT_MS, kernelProbeTimeoutMs: 500, commandProbeTimeoutMs: 500, footprintProbeTimeoutMs: 1500, retryWarningPressure: false, run: (command, args, timeoutMs) => (0, node_child_process_1.execFileSync)(command, args, {
             encoding: "utf8",
             timeout: timeoutMs,
             maxBuffer: 512 * 1024,
@@ -185,7 +192,7 @@ function sampleHostResourcesOnce(extraPids, overrides, extraGroups) {
     if (deps.platform !== "darwin")
         return snapshot;
     const deadline = deps.monotonic() + deps.sampleTimeoutMs;
-    const run = (command, args, maximumMs = 500) => {
+    const run = (command, args, maximumMs = deps.commandProbeTimeoutMs) => {
         const remaining = Math.floor(deadline - deps.monotonic());
         if (remaining <= 0)
             throw new Error("resource sample deadline exceeded");
@@ -222,7 +229,7 @@ function sampleHostResourcesOnce(extraPids, overrides, extraGroups) {
         const footprints = parseBatchFootprints(run("footprint", [
             "--noCategories",
             ...snapshot.processes.flatMap((p) => ["-p", String(p.pid)]),
-        ], 1500));
+        ], deps.footprintProbeTimeoutMs));
         for (const p of snapshot.processes)
             p.footprintMb = (_c = footprints.get(p.pid)) !== null && _c !== void 0 ? _c : null;
         const after = parseResourceProcesses(run("ps", PS_ARGS), deps.uid, deps.pid, extraPids, extraGroups);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "grepmax",
-  "version": "0.26.78",
+  "version": "0.26.80",
   "author": "Robert Owens <78518764+reowens@users.noreply.github.com>",
   "homepage": "https://github.com/reowens/grepmax",
   "bugs": {

package/plugins/grepmax/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "grepmax",
-  "version": "0.26.78",
+  "version": "0.26.80",
   "description": "Semantic code search for Claude Code. Automatically indexes your project and provides intelligent search capabilities.",
   "author": {
     "name": "Robert Owens",