memtrails 0.4.0 → 0.4.2

package/CHANGELOG.md

@@ -5,6 +5,36 @@ versions follow [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.4.2] — 2026-11-05
+
+- Fixes: the first start no longer fails when run as root (as in most containers) with "is not this user's alone":
+  the downloaded Qdrant binary was unpacked with the archive's owner and then refused. TypeScript and Python; the Rust
+  version was not affected and is released at the same version.
+
+## [0.4.1] — 2026-11-05
+
+- Native Python (`pip install memtrails`, asyncio) and Rust (`cargo add memtrails`, tokio) versions, with the same
+  results and the same files as this library: held to shared answers (`conformance/`), and a memory folder written by
+  any of the three is searched the same by the others (`interop/`).
+- Fixes: search no longer shows a short record's own summary again as the passage that matched (`match`, and after
+  " … " in `searchText`); a match is now only ever a passage beyond the start of what is shown.
+- Fixes: the downloaded Qdrant binary and embedding model are only run or loaded from folders that are this user's
+  alone. The cache folder (and the model's folder) is made private when it is created or found open to others, and
+  refused with a clear error when it belongs to someone else or is a link. `fromFiles` no longer reads through a note
+  that was replaced by a link after the folder was listed, and `fromJsonl` and `fromMbox` skip a line longer than
+  64 MiB (with the reason) instead of holding it in memory.
+- Fixes: a rebuild that is stopped (a close, a newer rebuild) returns only once the batches it was writing are written,
+  so none of them lands in the index after it.
+- Fixes: `close()` while memory's own Qdrant is being restarted (after it died) stops that restart and waits for the
+  Qdrant it began; one could come up after the close and stay running.
+- Fixes: an add no longer runs beside a rebuild (a record could be logged but never indexed, then skipped as unchanged
+  when added again); `close()` waits for the adds and searches in flight, and every call after it is refused with
+  "memory is closed".
+- `LlmRequest.signal` (optional): aborted when no one will read the answer any more; `openAiAsk` stops its call and its
+  retries. Asks made side by side (consolidation's windows, cues and reconcile batches, gathering's parts, sleep's
+  relate batches, profiles) stop the others when one fails. Consolidation that fails or is stopped starts no further
+  extraction and returns only once the ones being read are over; before, they ran on, paid for, after it returned.
+
 ## [0.4.0] — 2026-11-04
 
 - Prompt examples are invented now. The extraction and gathering prompts had a few example sentences taken from LoCoMo

package/README.md

@@ -58,6 +58,17 @@ Node.js 22 or newer, on macOS or Linux (x64 or arm64). Windows has the pieces it
 (218 MB, from Hugging Face) and the Qdrant binary (~30 MB, from Qdrant's GitHub release) into `~/.cache/memtrails`,
 each checked against a pinned SHA-256. Set `MEMTRAILS_CACHE` to put them elsewhere.
 
+### Python and Rust
+
+The same library, written natively in each language, fully async, with the same results and the same files: a memory
+folder written by one opens in the others (checked on every change by [`interop/`](https://github.com/cmaftuleac/memtrails/tree/main/interop) and held to the shared
+answers in [`conformance/`](https://github.com/cmaftuleac/memtrails/tree/main/conformance)).
+
+```bash
+pip install memtrails          # Python 3.10–3.13, asyncio — see python/README.md
+cargo add memtrails            # Rust 1.88+, tokio — see rust/README.md
+```
+
 ## Adding data
 
 A **record** is anything with text. Only `id` and `text` are required.

package/dist/core/consolidate.d.ts

@@ -34,7 +34,7 @@ export interface ConsolidateDeps extends WriterDeps {
     /** What a window's reading may keep, checked before anything is reconciled or written (e.g. facts only
      *  from the person's own words and results the agent confirmed, each with where it came from). An answer it cannot
      *  give leaves the window for the next run, as an extraction that was not answered does. */
-    guard?: (win: StmEntry[], x: Extraction) => Promise<Extraction | {
+    guard?: (win: StmEntry[], x: Extraction, signal?: AbortSignal) => Promise<Extraction | {
         unavailable: string;
     } | {
         busy: true;
@@ -153,7 +153,7 @@ export declare class Consolidator {
     relate(batch: Array<{
         it: MemoryItem;
         known: MemoryItem;
-    }>): Promise<Map<string, Decision> | {
+    }>, signal?: AbortSignal): Promise<Map<string, Decision> | {
         paused: string;
     }>;
 }

package/dist/core/consolidate.js

@@ -15,7 +15,7 @@
  * Then the window's entries are marked done and leave the short-term index: what mattered of them is long-term now.
  */
 import { redactString } from './redact.js';
-import { defaultAsk } from '../llm.js';
+import { allOrAbort, defaultAsk } from '../llm.js';
 import { episodeBody } from './episodes.js';
 import { docText } from './embedder.js';
 import { cleanConcepts, cleanCues, extractWindow, observeWindow, windowsOf } from './extract.js';
@@ -262,6 +262,8 @@ export class Consolidator {
         }
         const limit = Math.max(1, this.d.concurrency ?? EXTRACT_CONCURRENCY);
         const extracting = [];
+        /** Aborted once the lanes end — failed, paused, stopped or done: what is still being read is read for no one. */
+        const stop = new AbortController();
         // A pool: the next window starts when ANY one is read, not when the oldest is — one slow answer (measured: an
         // answer that ran on for 19,000 lines) held every other place idle while the windows after it waited their turn.
         // They are still reconciled in order.
@@ -272,17 +274,18 @@ export class Consolidator {
             while (!stopped && reading < limit && next < wins.length && !this.d.aborted()) {
                 const win = wins[next];
                 const head = win[0];
-                const p = this.read(win, { cwd: head.cwd, engine: head.engine, title: head.title });
+                const p = this.read(win, { cwd: head.cwd, engine: head.engine, title: head.title }, stop.signal);
                 reading++;
-                // One left behind by a pause or a stop is not an unhandled rejection; the awaited one still throws.
-                p.then(() => { reading--; launch(); }, () => { reading--; });
+                // One left behind by a pause or a stop is not an unhandled rejection; the awaited one still throws. One that
+                // throws starts no other: the run throws when it is reached, and no one would read their answers.
+                p.then(() => { reading--; launch(); }, () => { reading--; stopped = true; });
                 extracting[next++] = p;
             }
         };
         launch();
         const together = Math.max(1, Math.min(limit, this.d.reconcileConcurrency ?? 1));
         /** Window i, once read: reconciled, observed, marked done — or 'stop' when the run pauses. */
-        const settle = async (i) => {
+        const settle = async (i, signal) => {
             const x = await extracting[i].catch((err) => { stopped = true; throw err; });
             const win = wins[i];
             const head = win[0];
@@ -319,7 +322,7 @@ export class Consolidator {
                 ...kept.map((k) => episodeItem(byUid.get(k.uid), k, now)),
                 ...x.candidates.map((c) => itemOf(c, byUid.get(c.provenance.at(-1) ?? '') ?? head, now, c.provenance.flatMap((u) => byUid.get(u) ?? []))),
             ];
-            await this.reconcile(fresh, r);
+            await this.reconcile(fresh, r, signal);
             await this.observe(x.observations.map((o) => observationItem(o, byUid.get(o.provenance.at(-1) ?? '') ?? head, now)), r);
             r.dropped += x.dropped;
             r.episodes += kept.length;
@@ -341,19 +344,30 @@ export class Consolidator {
         };
         let at = 0;
         let halt = false;
-        const lane = async () => {
-            while (!halt && at < wins.length && extracting[at] && !this.d.aborted()) {
+        const lane = async (signal) => {
+            while (!halt && at < wins.length && extracting[at] && !this.d.aborted() && !signal.aborted) {
+                // No window is started after a failure: the run throws, and no one would read its answer.
                 try {
-                    if (await settle(at++) === 'stop')
+                    if (await settle(at++, signal) === 'stop')
                         halt = true;
                 }
                 catch (err) {
                     halt = true;
+                    stopped = true;
                     throw err;
                 }
             }
         };
-        await Promise.all(Array.from({ length: together }, lane));
+        try {
+            await allOrAbort(Array.from({ length: together }, () => lane), stop.signal);
+        }
+        finally {
+            // What is still being read once the lanes end is aborted, and over before the run goes on: no paid ask outlives
+            // it, and none starts after it (`stopped`).
+            stopped = true;
+            stop.abort();
+            await Promise.allSettled(extracting.filter((p) => p !== undefined));
+        }
         if (halt && r.paused !== undefined)
             return r;
         this.vecs.clear();
@@ -368,22 +382,27 @@ export class Consolidator {
         return r;
     }
     /** One window's reading, and what the guard (when there is one) lets it keep. */
-    async read(win, meta) {
-        const x = await this.extract(win, meta);
-        return this.d.guard && 'candidates' in x ? this.d.guard(win, x) : x;
+    async read(win, meta, signal) {
+        const x = await this.extract(win, meta, signal);
+        if (!this.d.guard || !('candidates' in x))
+            return x;
+        // Read for no one once the run stopped: the guard (it may ask a model too) is not asked.
+        if (signal?.aborted)
+            return { unavailable: 'the run stopped' };
+        return this.d.guard(win, x, signal);
     }
     /** One window's extraction: the one ask — and, when observations are read apart, the window's small windows too, each
      *  with the one before it as context. Any part not answered leaves the whole window for the next run. */
-    async extract(win, meta) {
+    async extract(win, meta, signal) {
         const chars = this.d.observeChars;
         const known = this.d.resolve ? await this.knownFor(win) : undefined;
         if (!chars)
-            return extractWindow(win, meta, { ask: this.d.ask, known });
+            return extractWindow(win, meta, { ask: this.d.ask, known, ...(signal ? { signal } : {}) });
         const subs = windowsOf(win, chars);
-        const [x, ...seen] = await Promise.all([
-            extractWindow(win, meta, { ask: this.d.ask, observations: false, known }),
-            ...subs.map((sub, k) => observeWindow(sub, k ? subs[k - 1] : [], meta, { ask: this.d.ask, chars, known })),
-        ]);
+        const [x, ...seen] = await allOrAbort([
+            (s) => extractWindow(win, meta, { ask: this.d.ask, observations: false, known, signal: s }),
+            ...subs.map((sub, k) => (s) => observeWindow(sub, k ? subs[k - 1] : [], meta, { ask: this.d.ask, chars, known, signal: s })),
+        ], signal);
         if (!('candidates' in x))
             return x;
         const failed = seen.find((o) => !('observations' in o));
@@ -445,7 +464,8 @@ export class Consolidator {
         for (let i = 0; i < batches.length; i += limit) {
             if (this.d.aborted())
                 break;
-            const answers = await Promise.all(batches.slice(i, i + limit).map((b) => this.cueBatch(b)));
+            // One that throws stops the others (allOrAbort).
+            const answers = await allOrAbort(batches.slice(i, i + limit).map((b) => (signal) => this.cueBatch(b, signal)));
             const paused = answers.find((a) => 'paused' in a);
             const got = answers.flatMap((a) => ('items' in a ? a.items : []));
             if (got.length) {
@@ -461,11 +481,12 @@ export class Consolidator {
         }
         return { cued };
     }
-    async cueBatch(items) {
+    async cueBatch(items, signal) {
         const prompt = items.map((it, n) => `[i${n + 1}] (${it.kind}) ${it.title}\n${it.summary}${it.appliesWhen ? `\nNeeded when: ${it.appliesWhen}` : ''}`).join('\n\n');
         const a = await (this.d.ask ?? defaultAsk)({
             purpose: 'memory', system: CUE_SYSTEM, prompt: redactString(prompt), schema: CUE_SCHEMA,
             name: 'memory_cues', maxTokens: 550 * items.length + 200, timeoutMs: 120_000, consequence: 'so these memories wait for their cues',
+            ...(signal ? { signal } : {}),
         });
         if ('unavailable' in a)
             return { paused: a.unavailable };
@@ -482,7 +503,7 @@ export class Consolidator {
         return { items: out };
     }
     /** Each item against what long-term memory holds — written as it goes, so a later item sees an earlier one. */
-    async reconcile(items, r) {
+    async reconcile(items, r, signal) {
         const ask = [];
         // Every key of the window in one embedding call (the cache serves each below and again when it is written).
         await this.embed(items.map((it) => docText(it.title, it.summary)), embedBudget(items.length));
@@ -513,7 +534,10 @@ export class Consolidator {
         }
         // The pairs are fixed before any is asked about: every batch asked at once, the answers applied in order.
         const batches = relateBatches(ask);
-        const answers = await Promise.all(batches.map((b) => this.relate(b)));
+        // One that throws stops the others (allOrAbort); a run stopped meanwhile (a lane beside this one failed) applies none.
+        const answers = await allOrAbort(batches.map((b) => (s) => this.relate(b, s)), signal);
+        if (signal?.aborted)
+            throw new Error('consolidation stopped');
         for (const [b, batch] of batches.entries()) {
             const got = answers[b];
             for (const [n, { it, known }] of batch.entries()) {
@@ -661,7 +685,7 @@ export class Consolidator {
         this.d.ltm.put([old]);
     }
     /** The model's decision for each pair, by its label (`p1`, …) — or why it did not answer. */
-    async relate(batch) {
+    async relate(batch, signal) {
         // Whole texts: a merge the model writes from a shortened body loses the rest of it.
         const prompt = batch.map(({ it, known }, n) => `[p${n + 1}]\nNEW (${it.kind}): ${it.title}\n${it.summary}\n${it.body}\n\nKNOWN (${known.kind}): ${known.title}\n${known.summary}\n${known.body}`).join('\n\n');
         // Room for every merged text in full (≈ 2.5 characters a token, the two sides together), with the decisions.
@@ -669,6 +693,7 @@ export class Consolidator {
         const a = await (this.d.ask ?? defaultAsk)({
             purpose: 'memory', system: RELATE_SYSTEM, prompt: redactString(prompt), schema: RELATE_SCHEMA,
             name: 'memory_reconcile', maxTokens: 900 * batch.length + 200 + room, timeoutMs: 300_000, consequence: 'so these memories are kept apart for now',
+            ...(signal ? { signal } : {}),
         });
         if ('unavailable' in a)
             return { paused: a.unavailable };

package/dist/core/extract.d.ts

@@ -111,6 +111,8 @@ export interface ExtractOptions {
     observations?: boolean;
     /** Passages of other conversations related to this part (consolidate.ts): what a description refers to is named. */
     known?: string[];
+    /** Aborted when the answer is no longer wanted: passed to each ask, and no further part is asked. */
+    signal?: AbortSignal;
 }
 /** Read one window. `unavailable`/`busy` come back as they are, so the worker can pause. */
 export declare function extractWindow(win: ReadableRequest[], meta: {
@@ -133,6 +135,7 @@ export declare function observeWindow(win: ReadableRequest[], before: ReadableRe
     ask?: Ask;
     chars: number;
     known?: string[];
+    signal?: AbortSignal;
 }): Promise<{
     observations: Observation[];
 } | {

package/dist/core/extract.js

@@ -336,6 +336,7 @@ export function partsOf(text, max = WINDOW_CHARS) {
     return out;
 }
 const outcomeIn = (x) => (OUTCOMES.includes(String(x?.outcome)) ? x.outcome : undefined);
+const STOPPED = { unavailable: 'the ask was stopped, so this part of the conversation waits to be consolidated' };
 /** What the model reads before the part: where it comes from, the calendar of its days, and what other conversations
  *  say that it may refer to. */
 function headerOf(win, meta, known) {
@@ -349,10 +350,13 @@ function headerOf(win, meta, known) {
 }
 async function askExtraction(prompt, opts) {
     const withObservations = opts.observations !== false;
+    if (opts.signal?.aborted)
+        return STOPPED;
     const r = await (opts.ask ?? defaultAsk)({
         purpose: 'memory', system: withObservations ? SYSTEM : SYSTEM_WITHOUT_OBSERVATIONS, prompt: redactString(prompt),
         schema: (withObservations ? SCHEMA : SCHEMA_WITHOUT_OBSERVATIONS), name: 'memory_consolidation',
         maxTokens: EXTRACT_MAX_TOKENS, timeoutMs: 300_000, consequence: 'so this part of the conversation waits to be consolidated',
+        ...(opts.signal ? { signal: opts.signal } : {}),
     });
     if ('unavailable' in r || 'busy' in r)
         return r;
@@ -440,9 +444,12 @@ export async function observeWindow(win, before, meta, opts) {
     for (const [k, text] of parts.entries()) {
         const earlier = k === 0 ? context : parts[k - 1].slice(-Math.floor(opts.chars / 2));
         const prompt = `${header}\n\n${earlier ? `JUST BEFORE (context only):\n${earlier}\n\n` : ''}TO READ${parts.length > 1 ? ` (part ${k + 1} of ${parts.length})` : ''}:\n${text}`;
+        if (opts.signal?.aborted)
+            return STOPPED;
         const r = await (opts.ask ?? defaultAsk)({
             purpose: 'memory', system: OBSERVE_SYSTEM, prompt: redactString(prompt), schema: OBSERVE_SCHEMA,
             name: 'memory_observations', maxTokens: 16_000, timeoutMs: 300_000, consequence: 'so this part of the conversation waits to be consolidated',
+            ...(opts.signal ? { signal: opts.signal } : {}),
         });
         if ('unavailable' in r || 'busy' in r)
             return r;

package/dist/core/gather.js

@@ -14,7 +14,7 @@
  * the model did not answer keeps all of its candidates.
  */
 import { redactString } from './redact.js';
-import { defaultAsk } from '../llm.js';
+import { allOrAbort, defaultAsk } from '../llm.js';
 import { PROFILE_SHOWN } from './profiles.js';
 import { memorySearch, MAX_SEARCH } from './recall.js';
 import { cut } from './text.js';
@@ -70,12 +70,14 @@ async function pick(ask, question, list, notes = false) {
     const size = notes ? NOTES_PART : PART;
     for (let i = 0; i < list.length; i += size)
         parts.push(list.slice(i, i + size));
-    const answers = await Promise.all(parts.map(async (part) => {
+    // The parts asked at once; one that throws stops the others (allOrAbort).
+    const answers = await allOrAbort(parts.map((part) => async (signal) => {
         const prompt = `Question: ${question}\n\nMemories:\n${part.map((h, n) => line(h, n + 1)).join('\n')}`;
         const a = await ask({
             purpose: 'memory', system: notes ? SYSTEM + NOTES_RULE : SYSTEM, prompt: redactString(prompt),
             schema: (notes ? NOTES_SCHEMA : SCHEMA),
             name: 'memory_gather', maxTokens: 40 * part.length + (notes ? 1400 : 600), timeoutMs: 120_000, consequence: 'so these memories are kept unread',
+            signal,
         });
         if (!('answer' in a))
             return { keep: part.map((h) => h.id), searches: [], notes: [], paused: 'unavailable' in a ? a.unavailable : 'the fast model is busy' };

package/dist/core/model.d.ts

@@ -7,7 +7,8 @@ export declare const MODEL_FILES: ReadonlyArray<{
     sha256: string;
 }>;
 export declare function defaultModelDir(): string;
-/** Every file in place at its pinned size, and the marker written after the last of them was verified. */
+/** Every file in place at its pinned size, the marker written after the last of them was verified, and no one else could
+ *  have changed any of them since (the folders, the files and the marker this user's alone, as the Qdrant binary's). */
 export declare function modelReady(dir?: string): boolean;
 /**
  * The model in `dir` (fetched and checked unless it is already there); the directory, ready for `modelDir`. Each file

package/dist/core/model.js

@@ -4,10 +4,10 @@
  * pinned size and SHA-256. 218 MB. The model is Google's, under the Gemma Terms of Use (ai.google.dev/gemma/terms);
  * memtrails does not ship it.
  */
-import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { chmodSync, existsSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { cacheDir } from './paths.js';
-import { downloadVerified, withLock } from './qdrant-binary.js';
+import { downloadVerified, ownedSafely, privateDir, withLock } from './qdrant-binary.js';
 export const MODEL_REPO = 'onnx-community/embeddinggemma-300m-ONNX';
 export const MODEL_REVISION = '5090578d9565bb06545b4552f76e6bc2c93e4a66';
 export const MODEL_FILES = [
@@ -20,12 +20,16 @@ export function defaultModelDir() {
     return join(cacheDir(), `embeddinggemma-300m-${MODEL_REVISION.slice(0, 8)}`);
 }
 const marker = (dir) => join(dir, '.verified');
+/** The model's folder and the folders its files are in. */
+const folders = (dir) => [...new Set([dir, ...MODEL_FILES.map((f) => dirname(join(dir, f.rel)))])];
 const stamp = MODEL_FILES.map((f) => `${f.rel}:${f.size}:${f.sha256}`).join('\n');
-/** Every file in place at its pinned size, and the marker written after the last of them was verified. */
+/** Every file in place at its pinned size, the marker written after the last of them was verified, and no one else could
+ *  have changed any of them since (the folders, the files and the marker this user's alone, as the Qdrant binary's). */
 export function modelReady(dir = defaultModelDir()) {
     try {
         return readFileSync(marker(dir), 'utf8') === stamp &&
-            MODEL_FILES.every((f) => existsSync(join(dir, f.rel)) && statSync(join(dir, f.rel)).size === f.size);
+            MODEL_FILES.every((f) => existsSync(join(dir, f.rel)) && statSync(join(dir, f.rel)).size === f.size) &&
+            [...folders(dir), marker(dir), ...MODEL_FILES.map((f) => join(dir, f.rel))].every(ownedSafely);
     }
     catch {
         return false;
@@ -40,7 +44,12 @@ export async function ensureModel(opts = {}) {
     const dir = opts.dir ?? defaultModelDir();
     if (modelReady(dir))
         return dir;
-    mkdirSync(dir, { recursive: true });
+    // Made private, or refused when others could change them: what is verified in them is loaded later. A set already
+    // there in folders made before this is ready once they are private (checked again under the lock).
+    if (!opts.dir)
+        privateDir(cacheDir());
+    for (const d of folders(dir))
+        privateDir(d);
     return withLock(dir, async () => {
         if (modelReady(dir))
             return dir; // another run finished it while this one waited
@@ -56,7 +65,8 @@ export async function ensureModel(opts = {}) {
                 rmSync(tmp, { recursive: true, force: true });
             }
         }
-        writeFileSync(marker(dir), stamp);
+        writeFileSync(marker(dir), stamp, { mode: 0o644 });
+        chmodSync(marker(dir), 0o644); // whatever the umask: a marker others could write is not trusted
         opts.log?.('[memtrails] embedding model ready');
         return dir;
     }, { signal: opts.signal });

package/dist/core/profiles.js

@@ -17,7 +17,7 @@
  */
 import { createHash } from 'node:crypto';
 import { redactString } from './redact.js';
-import { defaultAsk } from '../llm.js';
+import { allOrAbort, defaultAsk } from '../llm.js';
 import { stamped } from './consolidate.js';
 import { conceptKey, cut } from './text.js';
 import { writeLtm } from './writer.js';
@@ -123,12 +123,14 @@ export async function writeProfiles(d, max = PROFILES_PER_SLEEP) {
     }
     const todo = subjects.filter((s) => { const m = d.ltm.meta(s.uid); return m?.status !== 'active' || m.fp !== s.fingerprint; }).slice(0, max);
     let next = 0;
-    await Promise.all(Array.from({ length: Math.min(PROFILE_IN_FLIGHT, todo.length) }, async () => {
-        while (!r.paused && next < todo.length && !d.aborted()) {
+    // A lane that throws stops the others, their asks too (allOrAbort).
+    await allOrAbort(Array.from({ length: Math.min(PROFILE_IN_FLIGHT, todo.length) }, () => async (signal) => {
+        while (!r.paused && next < todo.length && !d.aborted() && !signal.aborted) {
             const s = todo[next++];
             const a = await (d.ask ?? defaultAsk)({
                 purpose: 'memory', system: PROFILE_SYSTEM, prompt: redactString(promptOf(s)), schema: PROFILE_SCHEMA,
                 name: 'memory_profile', maxTokens: 3000, timeoutMs: 180_000, consequence: "so this subject's profile waits for the next night",
+                signal,
             });
             if (!('answer' in a)) {
                 r.paused = 'unavailable' in a ? a.unavailable : 'busy';

package/dist/core/qdrant-binary.d.ts

@@ -12,6 +12,19 @@ export declare function qdrantAsset(platform?: string, arch?: string): QdrantAss
 export declare function qdrantDir(): string;
 export declare function qdrantBinaryPath(a?: QdrantAsset | null): string | null;
 export declare const QDRANT_RELEASE_BASE = "https://github.com/qdrant/qdrant/releases/download/v1.20.0";
+/**
+ * Run only what this user alone could have put there: the cache, the folder, the binary and its marker owned by this
+ * user, no symlink, writable by no one else. The archive's hash is pinned but not the unpacked binary's (that needs every
+ * platform's archive to compute), so on a shared machine this is what stops a binary swapped in after unpacking.
+ * Windows has no owner bits; there the user's profile ACLs keep others out.
+ */
+export declare function ownedSafely(path: string): boolean;
+/**
+ * The folder made (0700) or made private, and this user's alone — or refused. What is verified in it is run or loaded
+ * later: a folder others could write to lets them swap a binary between its check and its run, or a download between
+ * its hash and its unpacking. (`mkdirSync`'s mode applies only to a folder it makes.)
+ */
+export declare function privateDir(dir: string): void;
 /** The binary is in place, its archive was verified when it was unpacked, and no one else could have changed it since. */
 export declare function qdrantReady(a?: QdrantAsset | null): boolean;
 /** A download given up after this long without a byte (the answer's headers included). */

package/dist/core/qdrant-binary.js

@@ -36,17 +36,29 @@ export function qdrantBinaryPath(a = qdrantAsset()) {
 export const QDRANT_RELEASE_BASE = `https://github.com/qdrant/qdrant/releases/download/v${QDRANT_VERSION}`;
 const assetUrl = (a) => `${QDRANT_RELEASE_BASE}/${a.asset}`;
 /**
- * Run only what this user alone could have put there: the folder, the binary and its marker owned by this user, no
- * symlink, writable by no one else. The archive's hash is pinned but not the unpacked binary's (that needs every
+ * Run only what this user alone could have put there: the cache, the folder, the binary and its marker owned by this
+ * user, no symlink, writable by no one else. The archive's hash is pinned but not the unpacked binary's (that needs every
  * platform's archive to compute), so on a shared machine this is what stops a binary swapped in after unpacking.
  * Windows has no owner bits; there the user's profile ACLs keep others out.
  */
-function ownedSafely(path) {
+export function ownedSafely(path) {
     if (typeof process.getuid !== 'function')
-        return true;
+        return !lstatSync(path).isSymbolicLink();
     const st = lstatSync(path);
     return !st.isSymbolicLink() && st.uid === process.getuid() && (st.mode & 0o022) === 0;
 }
+/**
+ * The folder made (0700) or made private, and this user's alone — or refused. What is verified in it is run or loaded
+ * later: a folder others could write to lets them swap a binary between its check and its run, or a download between
+ * its hash and its unpacking. (`mkdirSync`'s mode applies only to a folder it makes.)
+ */
+export function privateDir(dir) {
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    chmodSync(dir, 0o700);
+    if (!ownedSafely(dir)) {
+        throw new Error(`${dir} is not this user's alone (its owner, its permissions, or it is a link): set MEMTRAILS_CACHE to a folder of your own`);
+    }
+}
 /** The binary is in place, its archive was verified when it was unpacked, and no one else could have changed it since. */
 export function qdrantReady(a = qdrantAsset()) {
     const bin = qdrantBinaryPath(a);
@@ -55,7 +67,7 @@ export function qdrantReady(a = qdrantAsset()) {
     const marker = join(qdrantDir(), '.verified');
     try {
         return readFileSync(marker, 'utf8').trim() === `${a.size}:${a.sha256}` && statSync(bin).size > 0 &&
-            [qdrantDir(), bin, marker].every(ownedSafely);
+            [dirname(qdrantDir()), qdrantDir(), bin, marker].every(ownedSafely);
     }
     catch {
         return false;
@@ -65,10 +77,13 @@ export function qdrantReady(a = qdrantAsset()) {
 function tarProgram() {
     return process.platform === 'win32' ? join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'tar.exe') : 'tar';
 }
-/** Unpack one archive with the system's tar (bsdtar on macOS and Windows reads zip too). */
+/**
+ * Unpack one archive with the system's tar (bsdtar on macOS and Windows reads zip too). Run as root, tar would give
+ * the files the archive's owner, and the binary would then not be this user's alone.
+ */
 function untar(archive, into) {
     return new Promise((resolve, reject) => {
-        const child = spawn(tarProgram(), ['-xf', archive, '-C', into], { stdio: 'ignore' });
+        const child = spawn(tarProgram(), ['--no-same-owner', '-xf', archive, '-C', into], { stdio: 'ignore' });
         child.once('error', reject);
         child.once('exit', (code) => (code === 0 ? resolve() : reject(new Error(`tar exited ${code}`))));
     });
@@ -210,7 +225,7 @@ export async function ensureQdrant(opts = {}) {
         return bin;
     const dir = qdrantDir();
     const cache = dirname(dir);
-    mkdirSync(cache, { recursive: true, mode: 0o700 });
+    privateDir(cache);
     return withLock(dir, async () => {
         if (qdrantReady(a))
             return bin; // another run finished it while this one waited

package/dist/core/qdrant-client.d.ts

@@ -62,9 +62,6 @@ export declare class QdrantClient {
         score: number;
         payload: Record<string, unknown>;
     }>>;
-    /** Each of these items' best cosine to one vector among its points of one part (key, child, cue) — the ranker's
-     *  per-family similarities. An item with no such point is not in the map. */
-    bestPerItem(vector: number[], items: string[], part: string, timeoutMs?: number): Promise<Map<string, number>>;
     /** `nearest` for several vectors in one call. */
     /** `fields`: only these payload fields (and the item), for a caller that needs no more — a walk over
      *  many neighbours reads ids, not the bodies of long requests. */

package/dist/core/qdrant-client.js

@@ -177,18 +177,6 @@ export class QdrantClient {
         });
         return (r?.points ?? []).map((p) => ({ item: String(p.payload?.item ?? ''), score: p.score, payload: p.payload ?? {} }));
     }
-    /** Each of these items' best cosine to one vector among its points of one part (key, child, cue) — the ranker's
-     *  per-family similarities. An item with no such point is not in the map. */
-    async bestPerItem(vector, items, part, timeoutMs = 2000) {
-        if (!items.length)
-            return new Map();
-        const r = await this.call('POST', `${this.at}/points/query/groups`, {
-            query: vector, using: 'dense', params: RESCORE,
-            filter: { must: [{ key: 'item', match: { any: items } }, { key: 'part', match: { value: part } }] },
-            group_by: 'item', group_size: 1, limit: items.length, with_payload: false,
-        }, timeoutMs);
-        return new Map((r?.groups ?? []).map((g) => [String(g.id), g.hits[0]?.score ?? 0]));
-    }
     /** `nearest` for several vectors in one call. */
     /** `fields`: only these payload fields (and the item), for a caller that needs no more — a walk over
      *  many neighbours reads ids, not the bodies of long requests. */

package/dist/core/qdrant-process.d.ts

@@ -16,6 +16,12 @@ export declare class QdrantProcess {
     private stopping;
     private deaths;
     private restartTimer;
+    /** A restart's start while it runs: stopAndWait waits for it, and for what it began to be gone. */
+    private restarting;
+    /** Counts stop()s: a start that sees it move while it starts gives up — before it spawns too, where `child` is null. */
+    private stops;
+    /** This instance's children that have not exited: stopAndWait waits for each, a restart's own included. */
+    private readonly children;
     private readonly opts;
     /** `dir` may be relative: Qdrant runs inside it, so every path it is given is made absolute first. */
     constructor(opts: {
@@ -46,6 +52,7 @@ export declare class QdrantProcess {
     /** Started again after a growing pause; a restart that fails counts as another death. */
     private restartLater;
     stop(): void;
-    /** Stop and wait for the process to be gone — before its storage is deleted. */
+    /** Stop and wait for the process to be gone — before its storage is deleted. A restart that was starting one ends
+     *  first, and the Qdrant it began is waited for too: none is left running after a close. */
     stopAndWait(ms?: number): Promise<void>;
 }