osborn 0.9.224 → 0.9.226

package/dist/claude-llm.js

@@ -2231,9 +2231,16 @@ class ClaudeLLMStream extends llm.LLMStream {
                                         if (!fromSubagent && sid && this.#opts.workingDirectory) {
                                             this.#llmRef.triggerStoreUpdate(sid, this.#opts.workingDirectory);
                                         }
+                                        // Recall injection is best-effort and must NEVER approach the SDK's 30s hook
+                                        // budget. Cap it hard at 1.5s — if the store is momentarily busy (e.g. a large
+                                        // ingest sweep still draining), we skip recall for this turn rather than block
+                                        // the prompt. The keyword/vector layers catch up on the next turn.
                                         const recalled = fromSubagent
                                             ? ''
-                                            : await buildRecallInjection(sid, this.#opts.workingDirectory, String(input?.prompt || ''));
+                                            : await Promise.race([
+                                                buildRecallInjection(sid, this.#opts.workingDirectory, String(input?.prompt || '')),
+                                                new Promise((res) => setTimeout(() => res(''), 1500)),
+                                            ]);
                                         const additionalContext = recalled ? `${reminder}\n\n${recalled}` : reminder;
                                         console.log(`📌 UserPromptSubmit: injected turn-shape reminder (${reminder.length} chars)${recalled ? ` + recall (${recalled.length} chars)` : ''} for prompt="${promptPreview}..." [tool budget reset to 0/${TOOL_CALL_BUDGET}]`);
                                         return {

package/dist/embedder.d.ts

@@ -1,23 +1,28 @@
 /**
- * embedder.ts — Local text→vector embedder for the semantic (vec) layer of session-store.
+ * embedder.ts — Text→vector embedder for the semantic (vec) layer of session-store.
  *
- * Uses all-MiniLM-L6-v2 (384-dim) via @xenova/transformers, running fully local (no API,
- * no per-write network cost). Output is L2-normalized float32, quantized to int8[384]
- * (×127) to match the sqlite-vec `int8[384]` column — 4× smaller than float32 with
- * ~98–99% recall.
+ * CLOUD-FIRST (OpenRouter, OpenAI-compatible embeddings endpoint).
+ * Previously this ran all-MiniLM-L6-v2 locally via @xenova/transformers. That model
+ * inference is CPU-bound and SYNCHRONOUS on the single Node thread — during a large
+ * backfill it monopolized the event loop and starved voice, the SDK's time-boxed
+ * UserPromptSubmit hook, and fast-brain. Embedding over the network is async I/O:
+ * `await fetch(...)` frees the thread while the request is in flight, so the whole
+ * class of event-loop starvation from embedding is gone.
  *
  * DESIGN FOR RELIABILITY:
- *   • Lazy — the model is loaded on first use, never at import (startup stays fast).
- *   • Best-effort — if the package or model can't load, getEmbedder() returns null and
- *     the store runs keyword-only. Embeddings never block the keyword write path.
- *   • Gated — set OSBORN_EMBED=0 to force keyword-only (e.g. on machines without the
- *     model cached, or to avoid the first-run model download).
- *
- * Model cache honors TRANSFORMERS_CACHE / HF_HOME so it can be baked into the image.
+ *   • Best-effort — if the key is missing or a request fails/times out, the returned
+ *     embedder yields null and the store runs keyword-only. Embeddings never block
+ *     (or break) the keyword write/read path.
+ *   • Gated — OSBORN_EMBED=0 forces keyword-only.
+ *   • Consistent vectors — output is L2-normalized float→int8[EMBED_DIM] (×127) to
+ *     match the sqlite-vec `int8[EMBED_DIM]` column. Qwen3-Embedding is Matryoshka
+ *     (MRL) trained, so we ask for `dimensions: EMBED_DIM` AND defensively truncate
+ *     the returned vector to EMBED_DIM and re-normalize — correct whether or not the
+ *     API honors the `dimensions` passthrough.
  */
 import { type Embedder } from './session-store.js';
 /**
- * Returns an Embedder, or null if embeddings are unavailable/disabled.
- * The returned function itself also degrades to null on runtime failure.
+ * Returns an Embedder, or null if embeddings are disabled or no key is configured.
+ * The returned function degrades to null on any per-call failure (keyword-only recall).
  */
 export declare function getEmbedder(): Promise<Embedder | null>;

package/dist/embedder.js

@@ -1,30 +1,48 @@
 /**
- * embedder.ts — Local text→vector embedder for the semantic (vec) layer of session-store.
+ * embedder.ts — Text→vector embedder for the semantic (vec) layer of session-store.
  *
- * Uses all-MiniLM-L6-v2 (384-dim) via @xenova/transformers, running fully local (no API,
- * no per-write network cost). Output is L2-normalized float32, quantized to int8[384]
- * (×127) to match the sqlite-vec `int8[384]` column — 4× smaller than float32 with
- * ~98–99% recall.
+ * CLOUD-FIRST (OpenRouter, OpenAI-compatible embeddings endpoint).
+ * Previously this ran all-MiniLM-L6-v2 locally via @xenova/transformers. That model
+ * inference is CPU-bound and SYNCHRONOUS on the single Node thread — during a large
+ * backfill it monopolized the event loop and starved voice, the SDK's time-boxed
+ * UserPromptSubmit hook, and fast-brain. Embedding over the network is async I/O:
+ * `await fetch(...)` frees the thread while the request is in flight, so the whole
+ * class of event-loop starvation from embedding is gone.
  *
  * DESIGN FOR RELIABILITY:
- *   • Lazy — the model is loaded on first use, never at import (startup stays fast).
- *   • Best-effort — if the package or model can't load, getEmbedder() returns null and
- *     the store runs keyword-only. Embeddings never block the keyword write path.
- *   • Gated — set OSBORN_EMBED=0 to force keyword-only (e.g. on machines without the
- *     model cached, or to avoid the first-run model download).
- *
- * Model cache honors TRANSFORMERS_CACHE / HF_HOME so it can be baked into the image.
+ *   • Best-effort — if the key is missing or a request fails/times out, the returned
+ *     embedder yields null and the store runs keyword-only. Embeddings never block
+ *     (or break) the keyword write/read path.
+ *   • Gated — OSBORN_EMBED=0 forces keyword-only.
+ *   • Consistent vectors — output is L2-normalized float→int8[EMBED_DIM] (×127) to
+ *     match the sqlite-vec `int8[EMBED_DIM]` column. Qwen3-Embedding is Matryoshka
+ *     (MRL) trained, so we ask for `dimensions: EMBED_DIM` AND defensively truncate
+ *     the returned vector to EMBED_DIM and re-normalize — correct whether or not the
+ *     API honors the `dimensions` passthrough.
  */
 import { EMBED_DIM, EMBED_MODEL } from './session-store.js';
+const OPENROUTER_URL = process.env.OPENROUTER_EMBED_URL || 'https://openrouter.ai/api/v1/embeddings';
 const MODEL_ID = EMBED_MODEL;
-let pipelinePromise = null;
+const MAX_BATCH = 64; // inputs per request (OpenAI-compatible arrays)
+const REQUEST_TIMEOUT_MS = Number(process.env.OSBORN_EMBED_TIMEOUT_MS || 20_000);
 let disabled = false;
-/** Quantize a normalized float32 embedding to int8[dim] (×127, clamped). */
-function quantizeInt8(floats) {
-    const out = new Int8Array(EMBED_DIM);
+function apiKey() {
+    return process.env.OPENROUTER_API_KEY || process.env.OPENROUTER_WORKSPACE_API_KEY;
+}
+/**
+ * L2-normalize the first EMBED_DIM components of a float embedding, then quantize to
+ * int8[EMBED_DIM] (×127, clamped). Truncating a Matryoshka vector to a prefix and
+ * re-normalizing is a valid lower-dim embedding in the same space.
+ */
+function normalizeAndQuantize(floats) {
     const n = Math.min(EMBED_DIM, floats.length);
+    let sum = 0;
+    for (let i = 0; i < n; i++)
+        sum += floats[i] * floats[i];
+    const inv = sum > 0 ? 1 / Math.sqrt(sum) : 0;
+    const out = new Int8Array(EMBED_DIM);
     for (let i = 0; i < n; i++) {
-        let v = Math.round(floats[i] * 127);
+        let v = Math.round(floats[i] * inv * 127);
         if (v > 127)
             v = 127;
         else if (v < -128)
@@ -33,66 +51,77 @@ function quantizeInt8(floats) {
     }
     return out;
 }
-async function loadPipeline() {
-    if (disabled)
-        return null;
-    if (process.env.OSBORN_EMBED === '0') {
-        disabled = true;
-        return null;
-    }
-    if (!pipelinePromise) {
-        pipelinePromise = (async () => {
-            // Lazy import — @xenova/transformers is heavy and optional.
-            const mod = await import('@xenova/transformers').catch(() => null);
-            if (!mod)
-                throw new Error('@xenova/transformers not installed');
-            if (mod.env) {
-                mod.env.allowLocalModels = true;
-                // Avoid noisy multi-thread wasm issues in the agent process.
-                if (mod.env.backends?.onnx?.wasm)
-                    mod.env.backends.onnx.wasm.numThreads = 1;
-            }
-            return mod.pipeline('feature-extraction', MODEL_ID);
-        })().catch((err) => {
-            disabled = true;
-            pipelinePromise = null;
-            throw err;
+/** Embed one batch (≤ MAX_BATCH inputs). Returns aligned int8 vectors, or null on any failure. */
+async function embedBatch(inputs, key) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+    try {
+        const res = await fetch(OPENROUTER_URL, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${key}`,
+                'Content-Type': 'application/json',
+                'HTTP-Referer': 'https://voice-native.com',
+                'X-Title': 'osborn',
+            },
+            body: JSON.stringify({
+                model: MODEL_ID,
+                input: inputs,
+                dimensions: EMBED_DIM, // MRL reduce; defensively truncated below if ignored
+                encoding_format: 'float',
+            }),
+            signal: controller.signal,
         });
+        if (!res.ok)
+            return null;
+        const json = await res.json();
+        const data = json?.data;
+        if (!Array.isArray(data) || !data.length)
+            return null;
+        // OpenAI-compatible: each entry carries its input `index`; align by it.
+        const byIndex = new Array(inputs.length).fill(null);
+        for (const d of data) {
+            const idx = typeof d?.index === 'number' ? d.index : -1;
+            const emb = d?.embedding;
+            if (idx >= 0 && idx < inputs.length && Array.isArray(emb)) {
+                byIndex[idx] = normalizeAndQuantize(emb);
+            }
+        }
+        if (byIndex.some((v) => v == null))
+            return null; // malformed / partial response
+        return byIndex;
+    }
+    catch {
+        return null; // network error, timeout/abort, bad JSON — degrade to keyword-only
+    }
+    finally {
+        clearTimeout(timer);
     }
-    return pipelinePromise;
 }
 /**
- * Returns an Embedder, or null if embeddings are unavailable/disabled.
- * The returned function itself also degrades to null on runtime failure.
+ * Returns an Embedder, or null if embeddings are disabled or no key is configured.
+ * The returned function degrades to null on any per-call failure (keyword-only recall).
  */
 export async function getEmbedder() {
-    if (process.env.OSBORN_EMBED === '0')
+    if (process.env.OSBORN_EMBED === '0' || disabled)
         return null;
-    let pipe;
-    try {
-        pipe = await loadPipeline();
-    }
-    catch {
+    const key = apiKey();
+    if (!key) {
+        disabled = true; // no key on this machine — don't retry every turn
         return null;
     }
-    if (!pipe)
-        return null;
     const embed = async (texts) => {
-        try {
-            if (!texts.length)
-                return [];
-            const out = [];
-            // Transformers.js handles batching internally; do them one-by-one to keep
-            // memory bounded on long tool outputs.
-            for (const t of texts) {
-                const res = await pipe(t || ' ', { pooling: 'mean', normalize: true });
-                out.push(quantizeInt8(res.data));
-            }
-            return out;
-        }
-        catch {
-            return null;
+        if (!texts.length)
+            return [];
+        const out = [];
+        for (let i = 0; i < texts.length; i += MAX_BATCH) {
+            const chunk = texts.slice(i, i + MAX_BATCH).map((t) => t || ' ');
+            const vecs = await embedBatch(chunk, key);
+            if (!vecs)
+                return null; // any failure → keyword-only for this call
+            out.push(...vecs);
         }
+        return out;
     };
     return embed;
 }

package/dist/index.js

@@ -507,8 +507,10 @@ function startApiServer(workingDir, port) {
     const server = createServer(async (req, res) => {
         // CORS headers for cloud frontend
         res.setHeader('Access-Control-Allow-Origin', '*');
-        res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
-        res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+        res.setHeader('Access-Control-Allow-Methods', 'GET, POST, DELETE, OPTIONS');
+        // Authorization is required for /secrets (Bearer OSBORN_SYNC_TOKEN); without it in the
+        // allow-list the browser preflight fails and the dashboard can't read/manage keys.
+        res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
         if (req.method === 'OPTIONS') {
             res.writeHead(204);
             res.end();

package/dist/pipeline-fastbrain.js

@@ -333,7 +333,16 @@ export async function askPipelineFastBrain(workingDir, sessionId, question, opts
     ];
     try {
         let rounds = 0;
+        // Overall wall-clock cap. The per-request fetch timeout doesn't bound the whole
+        // tool loop; if the event loop is briefly busy (large ingest sweep) a search could
+        // otherwise stretch to 40–130s. Bail with whatever we have past this deadline.
+        const FASTBRAIN_DEADLINE_MS = 8000;
+        const startTime = Date.now();
         while (rounds < MAX_TOOL_ROUNDS) {
+            if (Date.now() - startTime > FASTBRAIN_DEADLINE_MS) {
+                console.warn(`🧠⚡ [pipeline-fb] deadline hit after ${rounds} rounds`);
+                break;
+            }
             rounds++;
             const data = await callOpenRouter(messages, tools, apiKey);
             const choice = data.choices?.[0];

package/dist/session-store.d.ts

@@ -29,9 +29,13 @@
  */
 import Database from 'better-sqlite3';
 export declare const STORE_VERSION = 1;
-export declare const EMBED_DIM = 384;
-/** Canonical embed model id — the single source of truth (embedder.ts imports this).
- * Recorded in meta.embed_model so a model swap is detected as a stale store. */
+/** Vector width of the semantic layer. Qwen3-Embedding is Matryoshka-trained, so 1024
+ * is a valid MRL reduction of its native width — big enough for strong recall, small
+ * enough to keep int8 vectors ~1KB/row. Changing this rebuilds every store's vec table. */
+export declare const EMBED_DIM = 1024;
+/** Canonical embed model id — the single source of truth (embedder.ts imports this and
+ * sends it to OpenRouter). Recorded in meta.embed_model so a model swap is detected as a
+ * stale store and triggers a re-embed. */
 export declare const EMBED_MODEL: string;
 /** An embedder turns text into int8[EMBED_DIM] vectors (quantized, normalized). */
 export type Embedder = (texts: string[]) => Promise<Int8Array[] | null>;

package/dist/session-store.js

@@ -38,10 +38,14 @@ import { getSessionPaths, getSessionSubAgents, projectPathToSlug } from './sessi
 // CONFIG / TYPES
 // ============================================================
 export const STORE_VERSION = 1;
-export const EMBED_DIM = 384;
-/** Canonical embed model id — the single source of truth (embedder.ts imports this).
- * Recorded in meta.embed_model so a model swap is detected as a stale store. */
-export const EMBED_MODEL = process.env.OSBORN_EMBED_MODEL || 'Xenova/all-MiniLM-L6-v2';
+/** Vector width of the semantic layer. Qwen3-Embedding is Matryoshka-trained, so 1024
+ * is a valid MRL reduction of its native width — big enough for strong recall, small
+ * enough to keep int8 vectors ~1KB/row. Changing this rebuilds every store's vec table. */
+export const EMBED_DIM = 1024;
+/** Canonical embed model id — the single source of truth (embedder.ts imports this and
+ * sends it to OpenRouter). Recorded in meta.embed_model so a model swap is detected as a
+ * stale store and triggers a re-embed. */
+export const EMBED_MODEL = process.env.OSBORN_EMBED_MODEL || 'qwen/qwen3-embedding-8b';
 // ============================================================
 // PATHS
 // ============================================================
@@ -251,22 +255,44 @@ function countLines(filePath, upToBytes) {
             c++;
     return c;
 }
+/**
+ * Max bytes ingested from a single JSONL per sweep. A very large session file
+ * (100MB+) is drained gap-free across many turns instead of being read whole in
+ * one synchronous pass — that whole-file read + insert transaction is what pegged
+ * the single Node event loop and starved the SDK's time-boxed UserPromptSubmit hook.
+ */
+const MAX_INGEST_BYTES = 4 * 1024 * 1024;
 /**
  * Ingest new bytes from a single JSONL file into the store.
- * Reads only from `fromOffset` forward. Returns rows inserted + new offset.
+ * Reads only from `fromOffset` forward, at most `maxBytes` per call. Returns rows
+ * inserted + new offset (which advances by the bytes actually consumed, so the next
+ * sweep resumes exactly where this one stopped).
  */
-function ingestFile(db, filePath, source, fromOffset) {
+function ingestFile(db, filePath, source, fromOffset, maxBytes = MAX_INGEST_BYTES) {
     const inserted = [];
     if (!existsSync(filePath))
         return { inserted, newOffset: fromOffset, linesProcessed: 0 };
     const fileSize = statSync(filePath).size;
     if (fromOffset >= fileSize)
         return { inserted, newOffset: fromOffset, linesProcessed: 0 };
-    const buf = Buffer.alloc(fileSize - fromOffset);
+    const remaining = fileSize - fromOffset;
+    const reachedEof = remaining <= maxBytes;
+    const readLen = Math.min(remaining, maxBytes);
+    const buf = Buffer.alloc(readLen);
     const fd = openSync(filePath, 'r');
     readSync(fd, buf, 0, buf.length, fromOffset);
     closeSync(fd);
-    const rawLines = buf.toString('utf-8').split('\n');
+    // If we stopped short of EOF, trim back to the last complete line so a JSON record
+    // is never split across sweeps. If the window holds no newline at all (a single
+    // line longer than maxBytes), take it whole rather than stall forever.
+    let usable = buf;
+    if (!reachedEof) {
+        const lastNl = buf.lastIndexOf(10);
+        if (lastNl >= 0)
+            usable = buf.subarray(0, lastNl + 1);
+    }
+    const consumed = usable.length;
+    const rawLines = usable.toString('utf-8').split('\n');
     let lineNum = fromOffset === 0 ? 1 : countLines(filePath, fromOffset) + 1;
     let cursor = fromOffset;
     let linesProcessed = 0;
@@ -309,7 +335,7 @@ function ingestFile(db, filePath, source, fromOffset) {
         }
         lineNum++;
     }
-    return { inserted, newOffset: fileSize, linesProcessed };
+    return { inserted, newOffset: fromOffset + consumed, linesProcessed };
 }
 /**
  * Build or update the session store incrementally.
@@ -391,6 +417,8 @@ async function embedRows(db, rows, embed, onProgress) {
     const BATCH = 64;
     let done = 0;
     for (let i = 0; i < rows.length; i += BATCH) {
+        // embed() is now a network call (OpenRouter) — `await` already yields the event
+        // loop while the request is in flight, so no manual setImmediate pump is needed.
         const batch = rows.slice(i, i + BATCH);
         // Cap embedding input length — long tool outputs blow up the model with no recall gain.
         const vectors = await embed(batch.map(r => r.text.slice(0, 8000)));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "osborn",
-  "version": "0.9.224",
+  "version": "0.9.226",
   "description": "Voice AI coding assistant - local agent that connects to Osborn frontend",
   "type": "module",
   "bin": {
@@ -46,7 +46,6 @@
     "@smithery/api": "^0.48.0",
     "@types/diff": "^8.0.0",
     "@vscode/ripgrep": "^1.17.1",
-    "@xenova/transformers": "^2.17.2",
     "better-sqlite3": "^13.0.3",
     "diff": "^8.0.4",
     "dotenv": "^16.4.0",