pi-vault-mind 0.8.0 → 0.8.3

package/dist/src/lance.js

@@ -1,5 +1,4 @@
 import * as fs from "node:fs";
-import { homedir } from "node:os";
 import * as path from "node:path";
 import * as lancedb from "@lancedb/lancedb";
 import { LanceSchema, TextEmbeddingFunction } from "@lancedb/lancedb/embedding";
@@ -27,17 +26,19 @@ export const resetConnection = () => {
 };
 // ── Embedding Functions ─────────────────────────────────────────────────────
 /**
- * Ollama embedding function that talks to a local Ollama instance.
- * Uses the /api/embed endpoint with configurable model.
+ * OpenAI-compatible embedding function that POSTs to /v1/embeddings.
+ * Works with any OpenAI-compatible endpoint (Ollama, Modal, cloud providers).
  */
-class OllamaEmbeddingFunction extends TextEmbeddingFunction {
+class OpenAICompatibleEmbeddingFunction extends TextEmbeddingFunction {
+    url;
     model;
-    host;
+    apiKey;
     ndimsValue;
-    constructor(options = {}) {
+    constructor(options) {
         super();
-        this.model = options.model || "embeddinggemma";
-        this.host = options.host || "http://127.0.0.1:11434";
+        this.url = options.url;
+        this.model = options.model;
+        this.apiKey = options.apiKey;
         this.ndimsValue = options.dims;
     }
     ndims() {
@@ -47,40 +48,39 @@ class OllamaEmbeddingFunction extends TextEmbeddingFunction {
         return new arrow.Float32();
     }
     async init() {
-        // Verify Ollama is reachable and the model is available
+        // Best-effort connectivity check
         try {
-            const resp = await fetch(`${this.host}/api/tags`);
-            if (!resp.ok)
-                throw new Error(`Ollama returned ${resp.status}`);
-            const data = (await resp.json());
-            const modelNames = data.models?.map((m) => m.name) || [];
-            if (!modelNames.some((n) => n.startsWith(this.model))) {
-                console.warn(`[pi-vault-mind] Ollama model "${this.model}" not found. Available: ${modelNames.join(", ")}. Pull it with: ollama pull ${this.model}`);
-            }
+            const baseUrl = this.url.replace(/\/v1\/embeddings\/?$/, "").replace(/\/+$/, "");
+            const headers = {};
+            if (this.apiKey)
+                headers.Authorization = `Bearer ${this.apiKey}`;
+            await fetch(`${baseUrl}/v1/models`, { headers });
         }
         catch (err) {
-            console.warn(`[pi-vault-mind] Cannot reach Ollama at ${this.host}: ${err}`);
+            console.warn(`[pi-vault-mind] Cannot reach embedding endpoint at ${this.url}: ${err}`);
         }
     }
     async generateEmbeddings(texts) {
-        const embeddings = [];
-        for (const text of texts) {
-            const resp = await fetch(`${this.host}/api/embed`, {
-                method: "POST",
-                headers: { "Content-Type": "application/json" },
-                body: JSON.stringify({ model: this.model, input: text }),
-            });
-            if (!resp.ok) {
-                const body = await resp.text().catch(() => "");
-                throw new Error(`Ollama embed failed: ${resp.status} ${body}`);
-            }
-            const data = (await resp.json());
-            if (!data.embeddings?.[0]) {
-                throw new Error("Ollama returned no embedding for input");
-            }
-            embeddings.push(data.embeddings[0]);
+        const endpoint = this.url.endsWith("/v1/embeddings")
+            ? this.url
+            : `${this.url.replace(/\/+$/, "")}/v1/embeddings`;
+        const headers = { "Content-Type": "application/json" };
+        if (this.apiKey)
+            headers.Authorization = `Bearer ${this.apiKey}`;
+        const resp = await fetch(endpoint, {
+            method: "POST",
+            headers,
+            body: JSON.stringify({ model: this.model, input: texts }),
+        });
+        if (!resp.ok) {
+            const body = await resp.text().catch(() => "");
+            throw new Error(`Embed failed: ${resp.status} ${body}`);
         }
-        return embeddings;
+        const data = (await resp.json());
+        if (!data.data || !Array.isArray(data.data)) {
+            throw new Error("Invalid embedding response");
+        }
+        return data.data.map((d) => d.embedding);
     }
 }
 /**
@@ -243,6 +243,9 @@ function makeModalCollectionSchema(dim) {
         new arrow.Field("tag", new arrow.Utf8(), true),
         new arrow.Field("artifact", new arrow.Utf8(), true),
         new arrow.Field("created_at", new arrow.Utf8(), true),
+        new arrow.Field("origin_identity", new arrow.Utf8(), true),
+        new arrow.Field("visibility", new arrow.Utf8(), true),
+        new arrow.Field("identity", new arrow.Utf8(), true),
         new arrow.Field("vector", vec, true),
     ]);
 }
@@ -269,6 +272,7 @@ const getModalCollectionTable = async (dataDir, collection, model, dim, cfg) =>
         let t;
         if (existing.includes(tableName)) {
             t = await conn.openTable(tableName);
+            await ensureIdentityColumn(t);
         }
         else {
             const schema = makeModalCollectionSchema(dim);
@@ -318,44 +322,47 @@ const findModalTable = async (dataDir, collection, model) => {
  * (offline + no same-space local fallback) so a search degrades to keyword
  * search instead of crashing.
  */
-const modalFtsFallback = async (dataDir, collection, model, query, limit) => {
+const modalFtsFallback = async (dataDir, collection, model, query, limit, identity) => {
     const found = await findModalTable(dataDir, collection, model);
     if (!found)
         return [];
     try {
-        return await found.table.search(query).limit(limit).toArray();
+        const results = await found.table.search(query).limit(limit).toArray();
+        return filterByVisibility(results, identity);
     }
     catch {
         return [];
     }
 };
 /**
- * Offline fallback embed for a query. Only used when Modal is unreachable and a
- * same-space local provider is configured (same canonical model → same vector
- * space → can query the same namespaced table). Returns null when no same-space
- * fallback is available, so the caller degrades to FTS.
+ * Offline fallback embed for a query. Only used when the remote endpoint is
+ * unreachable and a same-space local provider is configured (same canonical
+ * model → same vector space → can query the same namespaced table). Returns
+ * null when no same-space fallback is available, so the caller degrades to FTS.
  */
 const fallbackQueryEmbed = async (cfg, collection, text) => {
     const fb = cfg.embedding.modal?.fallback;
     if (fb?.enabled === false)
         return null;
-    if (fb?.provider !== "ollama")
-        return null; // transformers is 384-dim ≠ canonical space
+    if (fb?.provider !== "openai-compatible")
+        return null;
+    if (!cfg.embedding.localUrl)
+        return null;
     const canonical = resolveModel(cfg, collection);
-    // Same-space only: the local Ollama model must match the canonical model.
-    if ((cfg.embedding.ollamaModel || "embeddinggemma") !== canonical)
+    if ((cfg.embedding.model || "embeddinggemma") !== canonical)
         return null;
     try {
-        const fn = new OllamaEmbeddingFunction({
-            model: cfg.embedding.ollamaModel || "embeddinggemma",
-            host: cfg.embedding.ollamaHost || "http://127.0.0.1:11434",
+        const fn = new OpenAICompatibleEmbeddingFunction({
+            url: cfg.embedding.localUrl,
+            model: cfg.embedding.model || "embeddinggemma",
+            apiKey: cfg.embedding.apiKey,
         });
         await fn.init();
         const vecs = await fn.generateEmbeddings([text]);
         return vecs[0];
     }
     catch (err) {
-        console.warn(`[pi-vault-mind] Modal offline and Ollama fallback failed: ${err.message}`);
+        console.warn(`[pi-vault-mind] Remote offline and local fallback failed: ${err.message}`);
         return null;
     }
 };
@@ -372,170 +379,27 @@ const disposeCoalescers = async () => {
     }
     coalescerCache.clear();
 };
-const getModelsJsonPath = () => path.join(homedir(), ".pi", "agent", "models.json");
-/** Read Pi's models.json for already-registered Ollama models. */
-const loadPiModelsJson = () => {
-    const p = getModelsJsonPath();
-    if (!fs.existsSync(p))
-        return null;
-    try {
-        const data = JSON.parse(fs.readFileSync(p, "utf-8"));
-        return data?.providers?.ollama?.models || null;
-    }
-    catch {
-        return null;
-    }
-};
-/** Parse `ollama list` output (same format pi-model-router uses). */
-const parseOllamaList = (output) => {
-    const lines = output.trim().split("\n");
-    const models = [];
-    for (let i = 1; i < lines.length; i++) {
-        const line = lines[i].trim();
-        if (!line)
-            continue;
-        const parts = line.split(/\s{2,}/);
-        if (parts.length >= 3) {
-            models.push({
-                name: parts[0],
-                size: parts[2],
-                modified: parts.slice(3).join(" "),
-            });
-        }
-    }
-    return models;
-};
-/**
- * Discover Ollama models using multiple paths (matching pi-model-router pattern):
- * 1. Try `pi.exec('ollama', ['list'])` — Pi's managed shell execution
- * 2. Fall back to HTTP /api/tags
- * 3. Fall back to Pi's cached models.json
- */
-export const discoverOllamaModels = async (piOrHost) => {
-    const host = typeof piOrHost === "string" ? piOrHost : "http://127.0.0.1:11434";
-    const pi = typeof piOrHost === "object" ? piOrHost : undefined;
-    // Path 1: pi.exec (preferred — uses Pi's managed process execution)
-    if (pi) {
-        try {
-            const result = await pi.exec("ollama", ["list"], { timeout: 10000 });
-            if (result.code === 0 && result.stdout) {
-                return parseOllamaList(result.stdout);
-            }
-        }
-        catch {
-            /* exec failed, try HTTP */
-        }
-    }
-    // Path 2: HTTP API
-    try {
-        const resp = await fetch(`${host}/api/tags`);
-        if (resp.ok) {
-            const data = (await resp.json());
-            return (data.models || []).map((m) => ({
-                name: m.name,
-                size: m.size ? `${(m.size / 1e9).toFixed(1)} GB` : "unknown",
-                modified: m.modified_at || "",
-                details: m.details,
-            }));
-        }
-    }
-    catch {
-        /* HTTP failed */
-    }
-    // Path 3: cached models.json (stale but no network needed)
-    const cached = loadPiModelsJson();
-    if (cached) {
-        return cached.map((m) => ({ name: m.id, size: "cached", modified: "" }));
-    }
-    return [];
-};
-/**
- * Test Ollama connectivity. Uses pi.exec first, then HTTP.
- */
-export const testOllamaConnection = async (hostOrPi) => {
-    const models = await discoverOllamaModels(hostOrPi);
-    if (models.length > 0)
-        return { reachable: true, models };
-    // Last-ditch: raw connectivity test
-    const host = typeof hostOrPi === "string" ? hostOrPi : undefined;
-    if (host) {
-        try {
-            const resp = await fetch(`${host}/api/tags`, { signal: AbortSignal.timeout(3000) });
-            if (resp.ok) {
-                const data = (await resp.json());
-                return {
-                    reachable: true,
-                    models: (data.models || []).map((m) => ({ name: m.name, size: "", modified: "" })),
-                };
-            }
-            return { reachable: false, models: [], error: `HTTP ${resp.status}` };
-        }
-        catch (err) {
-            return { reachable: false, models: [], error: err.message };
-        }
-    }
-    return { reachable: false, models: [], error: "No connectivity paths available" };
-};
-/**
- * Pull a model from Ollama. Uses pi.exec for managed timeout, falls back to HTTP.
- */
-export const pullOllamaModel = async (model, piOrHost) => {
-    const host = typeof piOrHost === "string" ? piOrHost : "http://127.0.0.1:11434";
-    const pi = typeof piOrHost === "object" ? piOrHost : undefined;
-    // Check if model already exists
-    const models = await discoverOllamaModels(piOrHost);
-    if (models.some((m) => m.name === model)) {
-        return { success: true, message: `Model "${model}" already exists` };
-    }
-    // Pull via pi.exec (preferred)
-    if (pi) {
-        try {
-            const result = await pi.exec("ollama", ["pull", model], { timeout: 120000 });
-            if (result.code === 0) {
-                return { success: true, message: `Successfully pulled "${model}"` };
-            }
-            return { success: false, message: `Pull exited with code ${result.code}: ${result.stderr}` };
-        }
-        catch (err) {
-            return { success: false, message: `Pull timed out or failed: ${err.message}` };
-        }
-    }
-    // Fall back to HTTP
-    try {
-        const resp = await fetch(`${host}/api/pull`, {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({ name: model, stream: false }),
-        });
-        if (!resp.ok) {
-            const body = await resp.text().catch(() => "");
-            return { success: false, message: `Pull failed: ${resp.status} ${body}` };
-        }
-        return { success: true, message: `Successfully pulled "${model}"` };
-    }
-    catch (err) {
-        return { success: false, message: `Error: ${err.message}` };
-    }
-};
 // ── Embedding Provider Factory ──────────────────────────────────────────────
 const getEmbeddingFunction = async (cfg) => {
-    if (cfg.embedding.provider === "modal") {
-        // Used by graph tables (auto-embed via sourceField). The main collection
-        // path bypasses this and inserts precomputed vectors (see upsertEntry).
+    if (cfg.embedding.remoteUrl) {
         const dim = effectiveDim(cfg);
         return new ModalEmbeddingFunction(cfg, undefined, dim);
     }
-    if (cfg.embedding.provider === "ollama") {
-        const fn = new OllamaEmbeddingFunction({
-            model: cfg.embedding.ollamaModel || "embeddinggemma",
-            host: cfg.embedding.ollamaHost || "http://127.0.0.1:11434",
+    if (cfg.embedding.localUrl) {
+        const fn = new OpenAICompatibleEmbeddingFunction({
+            url: cfg.embedding.localUrl,
+            model: cfg.embedding.model || "embeddinggemma",
+            apiKey: cfg.embedding.apiKey,
         });
         await fn.init();
         return fn;
     }
-    const fn = new TransformersEmbeddingFunction();
-    await fn.init();
-    return fn;
+    if (cfg.embedding.useTransformers !== false) {
+        const fn = new TransformersEmbeddingFunction();
+        await fn.init();
+        return fn;
+    }
+    throw new Error("No embedding provider configured. Set remoteUrl, localUrl, or useTransformers: true.");
 };
 // ── Schema Builders ─────────────────────────────────────────────────────────
 function makeCollectionSchema(embeddingFn) {
@@ -547,9 +411,22 @@ function makeCollectionSchema(embeddingFn) {
         tag: new arrow.Utf8(),
         artifact: new arrow.Utf8(),
         created_at: new arrow.Utf8(),
+        origin_identity: new arrow.Utf8(),
+        visibility: new arrow.Utf8(),
+        identity: new arrow.Utf8(),
         vector: embeddingFn.vectorField(),
     });
 }
+/**
+ * Backwards-compat: ensure the `identity` column exists on tables created before
+ * this field was added. The column is nullable so old rows remain readable.
+ */
+async function ensureIdentityColumn(table) {
+    const schema = await table.schema();
+    if (!schema.fields.find((f) => f.name === "identity")) {
+        await table.addColumns(new arrow.Field("identity", new arrow.Utf8(), true));
+    }
+}
 function makeEntitySchema(embeddingFn) {
     return LanceSchema({
         id: new arrow.Utf8(),
@@ -589,6 +466,7 @@ const getCollectionTable = async (dataDir, collectionName, cfg) => {
     const existing = await conn.tableNames();
     if (existing.includes(tableName)) {
         tables[tableName] = await conn.openTable(tableName);
+        await ensureIdentityColumn(tables[tableName]);
         return tables[tableName];
     }
     tables[tableName] = await conn.createEmptyTable(tableName, schema);
@@ -604,14 +482,14 @@ const getCollectionTable = async (dataDir, collectionName, cfg) => {
 };
 /**
  * Graph (entity/relation) schemas embed a fixed-size vector field, so they need
- * a concrete dimension. Under the modal provider the dim may be unresolved until
+ * a concrete dimension. Under the remote provider the dim may be unresolved until
  * the first embed/sync caches it — fail with a clear message instead of building
  * a schema with an undefined dimension. (These tables are not yet wired into the
  * active graph path; this guards them for when they are.)
  */
 const assertGraphDim = (cfg, kind) => {
-    if (cfg.embedding.provider === "modal" && effectiveDim(cfg) == null) {
-        throw new Error(`Graph ${kind} table needs a known embedding dimension under the modal provider. Set wiki.embedding.modal.dim, or run an embed/sync first so the native dim is cached.`);
+    if (cfg.embedding.remoteUrl && effectiveDim(cfg) == null) {
+        throw new Error(`Graph ${kind} table needs a known embedding dimension. Set vaultMind.embedding.dim, or run an embed/sync first so the native dim is cached.`);
     }
 };
 const getEntityTable = async (dataDir, cfg) => {
@@ -647,10 +525,10 @@ const getRelationTable = async (dataDir, cfg) => {
     return tables[tableName];
 };
 // ── Public API ──────────────────────────────────────────────────────────────
-const isModal = (cfg) => cfg.embedding.provider === "modal";
-export const upsertEntry = async (dataDir, collectionName, entry, cfg) => {
+const isModal = (cfg) => !!cfg.embedding.remoteUrl && !!cfg.embedding.modal;
+export const upsertEntry = async (dataDir, collectionName, entry, cfg, identity) => {
     if (isModal(cfg))
-        return upsertEntryModal(dataDir, collectionName, entry, cfg);
+        return upsertEntryModal(dataDir, collectionName, entry, cfg, identity);
     const table = await getCollectionTable(dataDir, collectionName, cfg);
     const row = {
         id: entry.id || crypto.randomUUID(),
@@ -660,18 +538,21 @@ export const upsertEntry = async (dataDir, collectionName, entry, cfg) => {
         tag: entry.tag || "",
         artifact: entry.artifact || "",
         created_at: entry.created_at || new Date().toISOString(),
+        origin_identity: identity?.id || "",
+        visibility: identity?.visibility || "vault",
+        identity: entry.identity || identity?.id || "",
     };
     await table.add([row]);
 };
 /**
  * Modal append path: embed the document text via the coalescer (debounced +
  * batched), then merge-insert the row with its precomputed vector into the
- * namespaced `col_{collection}__{model}__{dim}` table. If Modal is offline and
- * no same-space local fallback is configured, it warns and skips the vector
- * index (the JSONL append is the source of truth; reindex recovers) — it does
- * not crash. Keyed by `id` (upsert, idempotent).
+ * namespaced `col_{collection}__{model}__{dim}` table. If the remote endpoint is
+ * offline and no same-space local fallback is configured, it warns and skips
+ * the vector index (the JSONL append is the source of truth; reindex recovers)
+ * — it does not crash. Keyed by `id` (upsert, idempotent).
  */
-const upsertEntryModal = async (dataDir, collectionName, entry, cfg) => {
+const upsertEntryModal = async (dataDir, collectionName, entry, cfg, identity) => {
     const model = resolveModel(cfg, collectionName);
     const text = entry.fact || "";
     let vector;
@@ -685,7 +566,7 @@ const upsertEntryModal = async (dataDir, collectionName, entry, cfg) => {
             vector = fb;
         }
         else {
-            console.warn(`[pi-vault-mind] Modal embed failed for "${collectionName}" and no same-space fallback — skipping vector index: ${err.message}`);
+            console.warn(`[pi-vault-mind] Remote embed failed for "${collectionName}" and no same-space fallback — skipping vector index: ${err.message}`);
             return;
         }
     }
@@ -700,31 +581,37 @@ const upsertEntryModal = async (dataDir, collectionName, entry, cfg) => {
         tag: entry.tag || "",
         artifact: entry.artifact || "",
         created_at: entry.created_at || new Date().toISOString(),
+        origin_identity: identity?.id || "",
+        visibility: identity?.visibility || "vault",
+        identity: entry.identity || identity?.id || "",
         vector,
     };
     await table.mergeInsert(["id"]).whenMatchedUpdateAll().whenNotMatchedInsertAll().execute([row]);
 };
-/** Offline fallback embed for a document (storage). Same-space ollama only. */
+/** Offline fallback embed for a document (storage). Same-space local only. */
 const fallbackDocumentEmbed = async (cfg, collection, text) => {
     const fb = cfg.embedding.modal?.fallback;
     if (fb?.enabled === false)
         return null;
-    if (fb?.provider !== "ollama")
+    if (fb?.provider !== "openai-compatible")
+        return null;
+    if (!cfg.embedding.localUrl)
         return null;
     const canonical = resolveModel(cfg, collection);
-    if ((cfg.embedding.ollamaModel || "embeddinggemma") !== canonical)
+    if ((cfg.embedding.model || "embeddinggemma") !== canonical)
         return null;
     try {
-        const fn = new OllamaEmbeddingFunction({
-            model: cfg.embedding.ollamaModel || "embeddinggemma",
-            host: cfg.embedding.ollamaHost || "http://127.0.0.1:11434",
+        const fn = new OpenAICompatibleEmbeddingFunction({
+            url: cfg.embedding.localUrl,
+            model: cfg.embedding.model || "embeddinggemma",
+            apiKey: cfg.embedding.apiKey,
         });
         await fn.init();
         const vecs = await fn.generateEmbeddings([text]);
         return vecs[0];
     }
     catch (err) {
-        console.warn(`[pi-vault-mind] Modal offline and Ollama document fallback failed: ${err.message}`);
+        console.warn(`[pi-vault-mind] Remote offline and local document fallback failed: ${err.message}`);
         return null;
     }
 };
@@ -734,7 +621,7 @@ const fallbackDocumentEmbed = async (cfg, collection, text) => {
  * `id` (merge-insert). Bypasses the auto-embed source field entirely. Carries
  * text + metadata. Idempotent (re-fetching a boundary row is a no-op).
  */
-export const upsertPrecomputed = async (dataDir, collectionName, model, dim, rows, cfg) => {
+export const upsertPrecomputed = async (dataDir, collectionName, model, dim, rows, cfg, identity) => {
     if (rows.length === 0)
         return;
     const table = await getModalCollectionTable(dataDir, collectionName, model, dim, cfg);
@@ -751,27 +638,81 @@ export const upsertPrecomputed = async (dataDir, collectionName, model, dim, row
             tag: String(meta.tag ?? r.tag ?? ""),
             artifact: String(meta.artifact ?? r.artifact ?? ""),
             created_at: String(r.created_at ?? meta.created_at ?? new Date().toISOString()),
+            origin_identity: identity?.id || "",
+            visibility: identity?.visibility || "vault",
+            identity: String(meta.identity ?? r.identity ?? identity?.id ?? ""),
             vector: vec,
         };
     });
     await table.mergeInsert(["id"]).whenMatchedUpdateAll().whenNotMatchedInsertAll().execute(mapped);
 };
-export const searchHybrid = async (dataDir, collectionName, query, limit, cfg) => {
+/** Filter results by visibility: show public entries + entries owned by the reader. No identity = no filter (backward compat). */
+function filterByVisibility(results, identity) {
+    if (!identity)
+        return results;
+    return results.filter((r) => {
+        const vis = r.visibility;
+        const origin = r.origin_identity;
+        return vis === "public" || origin === identity.id;
+    });
+}
+/**
+ * Deterministic JSONL query for a collection. Applies optional substring search,
+ * exact field filters, identity visibility filter, and pagination.
+ */
+export const queryCollection = async (collectionPath, schema, query, filters, limit, offset, identity) => {
+    const safeLimit = Math.max(0, Number.isFinite(limit) ? limit : 50);
+    const safeOffset = Math.max(0, Number.isFinite(offset) ? offset : 0);
+    if (!fs.existsSync(collectionPath))
+        return [];
+    const lines = fs.readFileSync(collectionPath, "utf-8").split("\n").filter(Boolean);
+    const matches = [];
+    const lowerQ = query ? query.toLowerCase() : null;
+    for (const line of lines) {
+        try {
+            const entry = JSON.parse(line);
+            let match = true;
+            if (lowerQ) {
+                const text = schema
+                    .map((f) => entry[f] ?? "")
+                    .join(" ")
+                    .toLowerCase();
+                match = text.includes(lowerQ);
+            }
+            if (match && filters) {
+                for (const [k, v] of Object.entries(filters)) {
+                    if (String(entry[k] ?? "") !== String(v)) {
+                        match = false;
+                        break;
+                    }
+                }
+            }
+            if (match)
+                matches.push(entry);
+        }
+        catch {
+            /* ignore malformed */
+        }
+    }
+    const visible = filterByVisibility(matches, identity);
+    return safeLimit === 0 ? [] : visible.slice(safeOffset, safeOffset + safeLimit);
+};
+export const searchHybrid = async (dataDir, collectionName, query, limit, cfg, identity) => {
     if (isModal(cfg))
-        return searchHybridModal(dataDir, collectionName, query, limit, cfg);
+        return searchHybridModal(dataDir, collectionName, query, limit, cfg, identity);
     const table = await getCollectionTable(dataDir, collectionName, cfg);
     const embeddingFn = await getEmbeddingFunction(cfg);
     const queryVector = await embeddingFn.generateEmbeddings([query]);
     const results = await table.query().nearestTo(queryVector[0]).limit(limit).toArray();
-    return results;
+    return filterByVisibility(results, identity);
 };
 /**
  * Modal search path: embed the query immediately (bypasses the coalescer
- * debounce), then nearest-neighbor search the namespaced table. If Modal is
- * offline, fall back to a same-space local provider when available; otherwise
- * degrade to FTS/keyword search. Never crashes a search.
+ * debounce), then nearest-neighbor search the namespaced table. If the remote
+ * endpoint is offline, fall back to a same-space local provider when available;
+ * otherwise degrade to FTS/keyword search. Never crashes a search.
  */
-const searchHybridModal = async (dataDir, collectionName, query, limit, cfg) => {
+const searchHybridModal = async (dataDir, collectionName, query, limit, cfg, identity) => {
     const model = resolveModel(cfg, collectionName);
     let queryVector;
     try {
@@ -781,8 +722,8 @@ const searchHybridModal = async (dataDir, collectionName, query, limit, cfg) =>
         // Offline: same-space local fallback, else degrade to FTS.
         const fb = await fallbackQueryEmbed(cfg, collectionName, query);
         if (!fb) {
-            console.warn(`[pi-vault-mind] Modal search offline, degrading to FTS for "${collectionName}": ${err.message}`);
-            return modalFtsFallback(dataDir, collectionName, model, query, limit);
+            console.warn(`[pi-vault-mind] Remote search offline, degrading to FTS for "${collectionName}": ${err.message}`);
+            return modalFtsFallback(dataDir, collectionName, model, query, limit, identity);
         }
         queryVector = fb;
     }
@@ -792,17 +733,18 @@ const searchHybridModal = async (dataDir, collectionName, query, limit, cfg) =>
     // Guard against space mismatch (shouldn't happen with one canonical model).
     if (found.dim !== queryVector.length) {
         console.warn(`[pi-vault-mind] Query dim ${queryVector.length} ≠ table dim ${found.dim} for "${collectionName}"; degrading to FTS.`);
-        return modalFtsFallback(dataDir, collectionName, model, query, limit);
+        return modalFtsFallback(dataDir, collectionName, model, query, limit, identity);
     }
     try {
-        return await found.table.query().nearestTo(queryVector).limit(limit).toArray();
+        const results = await found.table.query().nearestTo(queryVector).limit(limit).toArray();
+        return filterByVisibility(results, identity);
     }
     catch (err) {
-        console.warn(`[pi-vault-mind] Modal vector search failed, degrading to FTS: ${err.message}`);
-        return modalFtsFallback(dataDir, collectionName, model, query, limit);
+        console.warn(`[pi-vault-mind] Remote vector search failed, degrading to FTS: ${err.message}`);
+        return modalFtsFallback(dataDir, collectionName, model, query, limit, identity);
     }
 };
-export const searchFts = async (dataDir, collectionName, query, limit, cfg) => {
+export const searchFts = async (dataDir, collectionName, query, limit, cfg, identity) => {
     // For modal, FTS targets the namespaced table (the same one sync + query use).
     if (isModal(cfg)) {
         const model = resolveModel(cfg, collectionName);
@@ -810,7 +752,8 @@ export const searchFts = async (dataDir, collectionName, query, limit, cfg) => {
         if (!found)
             return [];
         try {
-            return await found.table.search(query).limit(limit).toArray();
+            const results = await found.table.search(query).limit(limit).toArray();
+            return filterByVisibility(results, identity);
         }
         catch {
             return [];
@@ -818,7 +761,7 @@ export const searchFts = async (dataDir, collectionName, query, limit, cfg) => {
     }
     const table = await getCollectionTable(dataDir, collectionName, cfg);
     const results = await table.search(query).limit(limit).toArray();
-    return results;
+    return filterByVisibility(results, identity);
 };
 export const getStatus = async (dataDir) => {
     const conn = await connect(dataDir);