sift-light 1.1.0 → 1.1.1-1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 1.1.1-1 — 2026-10-12
+
+- Bind retained ordinary search results to verified worktree content identities instead of relying on file metadata alone.
+- Recheck the stored content identity before source inspection, navigation and saved-evidence validation; changed, missing or incomplete sources remain explicit.
+- Preserve exact locations, independent result lanes, source verification and existing result budgets while adding regression coverage for content changes that metadata checks can miss.
+
 ## 1.1.0 — 2026-10-12
 
 - Add opt-in BYO HTTP JSON providers for Jev-compatible semantic judging and multimodal retrieval.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sift-light",
-  "version": "1.1.0",
+  "version": "1.1.1-1",
   "description": "Context-efficient local search for files, documents, notes and logs across Pi, OMP and MCP clients",
   "keywords": [
     "ai-agent",

package/plugins/sift-light/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "sift-light",
-  "version": "1.1.0",
+  "version": "1.1.1-1",
   "description": "Require sift-light for conventional local searches while keeping development tools available.",
   "author": {
     "name": "baoer"

package/plugins/sift-light/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "sift-light",
-  "version": "1.1.0",
+  "version": "1.1.1-1",
   "description": "Require sift-light for conventional local searches while keeping development tools available.",
   "author": {
     "name": "baoer"

package/plugins/sift-light/.mcp.json

@@ -5,7 +5,7 @@
       "args": [
         "--yes",
         "--package",
-        "sift-light-runtime@npm:sift-light@1.1.0",
+        "sift-light-runtime@npm:sift-light@1.1.1-1",
         "sift-light-mcp",
         "--stdio"
       ],

package/plugins/sift-light/kimi.plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "sift-light",
-  "version": "1.1.0",
+  "version": "1.1.1-1",
   "description": "Require sift-light for conventional local searches while keeping development tools available.",
   "author": {
     "name": "baoer"
@@ -13,7 +13,7 @@
       "args": [
         "--yes",
         "--package",
-        "sift-light-runtime@npm:sift-light@1.1.0",
+        "sift-light-runtime@npm:sift-light@1.1.1-1",
         "sift-light-mcp",
         "--stdio"
       ],

package/plugins/sift-light/omp-extension.mjs

@@ -1406,7 +1406,10 @@ function sourceRangeFromBytes(content, startLine, endLine, targetLine = startLin
 }
 
 // src/scan-revisions.ts
+import { createHash } from "crypto";
+import { open } from "fs/promises";
 import { resolve as resolve4 } from "path";
+var SOURCE_HASH_CONCURRENCY = 4;
 async function captureRevision(path, revisions, onRevisionError) {
   let failed = false;
   let failure;
@@ -1502,6 +1505,67 @@ async function retainStableSourceRevisions(paths, before, signal) {
     return initial !== undefined && sameSourceRevision(initial, revision);
   }));
 }
+async function captureStableSourceReference(path, expected, signal) {
+  if (signal?.aborted)
+    throw abortError();
+  const before = await getSourceRevision(path);
+  if (!before || !sameSourceRevision(expected, before))
+    return;
+  const handle2 = await open(path, "r");
+  try {
+    const metadata2 = await handle2.stat();
+    if (!metadata2.isFile() || !sameSourceRevision(before, sourceRevisionFromStats(metadata2))) {
+      return;
+    }
+    const hash = createHash("sha256");
+    const buffer = Buffer.allocUnsafe(64 * 1024);
+    let offset = 0;
+    while (offset < before.size) {
+      if (signal?.aborted)
+        throw abortError();
+      const read = await handle2.read(buffer, 0, Math.min(buffer.length, before.size - offset), offset);
+      if (read.bytesRead === 0)
+        return;
+      hash.update(buffer.subarray(0, read.bytesRead));
+      offset += read.bytesRead;
+    }
+    const after = await getSourceRevision(path);
+    if (!after || !sameSourceRevision(before, after))
+      return;
+    return {
+      path,
+      origin: { kind: "worktree", revision: after, contentHash: hash.digest("hex") }
+    };
+  } finally {
+    await handle2.close();
+  }
+}
+async function captureStableSourceReferences(paths, before, signal) {
+  const candidates = [...paths].filter((path) => before.has(path));
+  const references = new Map;
+  for (let offset = 0;offset < candidates.length; offset += SOURCE_HASH_CONCURRENCY) {
+    if (signal?.aborted)
+      throw abortError();
+    const batch = candidates.slice(offset, offset + SOURCE_HASH_CONCURRENCY);
+    const captured = await Promise.all(batch.map(async (path) => {
+      const expected = before.get(path);
+      if (!expected)
+        return;
+      try {
+        return await captureStableSourceReference(path, expected, signal);
+      } catch (error) {
+        if (signal?.aborted)
+          throw error;
+        return;
+      }
+    }));
+    for (const reference of captured) {
+      if (reference)
+        references.set(reference.path, reference);
+    }
+  }
+  return references;
+}
 
 // src/rg.ts
 function isRecord(value) {
@@ -1903,6 +1967,7 @@ function createRipgrepRunner(options = {}) {
       const retainedPaths = new Set(matches.map((match) => match.absolutePath).filter((path) => !lossyPaths.has(path)));
       await assertRetainedPathsAllowed(policy, [...retainedPaths], signal);
       const sourceRevisions = await retainStableSourceRevisions(retainedPaths, before.revisions, signal);
+      const sourceReferences = await captureStableSourceReferences(retainedPaths, sourceRevisions, signal);
       if (signal?.aborted)
         throw abortError();
       return {
@@ -1911,6 +1976,7 @@ function createRipgrepRunner(options = {}) {
         totalMatches,
         fileCounts,
         sourceRevisions,
+        sourceReferences,
         snapshotComplete: matches.length === totalMatches && !modificationTimeFilterIncomplete && retention.details.reasons.length === 0,
         filesystemCoverage,
         filesystemErrorSamples: [...filesystemErrorSamples],
@@ -2117,7 +2183,7 @@ function createCtagsStructureProvider(options = {}) {
 // package.json
 var package_default = {
   name: "sift-light",
-  version: "1.1.0",
+  version: "1.1.1-1",
   description: "Context-efficient local search for files, documents, notes and logs across Pi, OMP and MCP clients",
   keywords: [
     "ai-agent",
@@ -2733,7 +2799,7 @@ class OperationLifecycle {
 }
 
 // src/media-search.ts
-import { createHash, randomUUID as randomUUID4 } from "crypto";
+import { createHash as createHash2, randomUUID as randomUUID4 } from "crypto";
 import { mkdtemp, mkdir, readFile as readFile4, realpath as realpath3, rm, stat as stat5, writeFile } from "fs/promises";
 import { tmpdir } from "os";
 import { basename as basename2, dirname as dirname2, extname as extname2, join as join3, resolve as resolve8 } from "path";
@@ -5643,7 +5709,7 @@ function bucketFor(state, inst) {
   return bucket;
 }
 var handoff;
-var open = [];
+var open2 = [];
 var memo = {
   alloc(_inst, payload, empty) {
     const bucket = handoff;
@@ -5652,7 +5718,7 @@ var memo = {
     handoff = undefined;
     const entry = { value: empty, issues: null };
     bucket.set(payload.value, entry);
-    open.push(entry);
+    open2.push(entry);
     return empty;
   },
   guard(inst) {
@@ -5718,10 +5784,10 @@ var memo = {
           return payload;
         }
         handoff = bucket;
-        const depth = open.length;
+        const depth = open2.length;
         const result = base(payload, ctx);
         handoff = undefined;
-        const entry = open.length > depth ? open.pop() : undefined;
+        const entry = open2.length > depth ? open2.pop() : undefined;
         if (result instanceof Promise) {
           return result.then((r) => {
             if (entry)
@@ -8775,7 +8841,7 @@ var extensions = new Set([
 var maxFileBytes = 20 * 1024 * 1024;
 var maxCorpusBytes = 256 * 1024 * 1024;
 function hash(bytes) {
-  return createHash("sha256").update(bytes).digest("hex");
+  return createHash2("sha256").update(bytes).digest("hex");
 }
 async function sourceBytes(cwd, path, signal) {
   const policy = new SearchPathPolicy(cwd);
@@ -8920,7 +8986,7 @@ class MediaSearch {
       } else if (this.#remoteConfig) {
         this.#remote ??= new RemoteMediaClient(this.#remoteConfig);
         const remoteFiles = [...admitted.values()].map((entry) => ({
-          id: createHash("sha256").update(entry.staged).digest("hex").slice(0, 32),
+          id: createHash2("sha256").update(entry.staged).digest("hex").slice(0, 32),
           path: entry.staged
         }));
         response = await this.#remote.search({
@@ -9086,7 +9152,7 @@ ${JSON.stringify(details)}`,
 }
 
 // src/data-source-http.ts
-import { open as open2 } from "fs/promises";
+import { open as open3 } from "fs/promises";
 class DataSourceError extends Error {
   code;
   constructor(code) {
@@ -9101,7 +9167,7 @@ async function credential(config) {
     value = process.env[config.tokenEnv];
   if (config.tokenFile) {
     try {
-      const handle2 = await open2(config.tokenFile, "r");
+      const handle2 = await open3(config.tokenFile, "r");
       try {
         const info2 = await handle2.stat();
         if (!info2.isFile() || info2.size > 16384)
@@ -9396,7 +9462,7 @@ class DataSources {
 }
 
 // src/service.ts
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 
 // src/concept-worker-client.ts
 import { randomUUID as randomUUID5 } from "crypto";
@@ -9940,7 +10006,7 @@ function rangeEvidence(document2, range) {
 
 // src/concept-search.ts
 import { resolve as resolve14 } from "path";
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 
 // src/request.ts
 function list(value) {
@@ -10802,13 +10868,13 @@ async function parseSyntax(path, text, signal, pattern) {
 }
 
 // src/concept-source-generation.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 
 // src/source-access.ts
 import { extname as extname4, resolve as resolve13 } from "path";
 
 // src/historical-paths.ts
-import { lstat, mkdir as mkdir3, mkdtemp as mkdtemp2, open as open3, rm as rm3, writeFile as writeFile2 } from "fs/promises";
+import { lstat, mkdir as mkdir3, mkdtemp as mkdtemp2, open as open4, rm as rm3, writeFile as writeFile2 } from "fs/promises";
 import { constants as constants2 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
 import { dirname as dirname5, join as join6, parse as parse4, relative as relative4, resolve as resolve10 } from "path";
@@ -10870,7 +10936,7 @@ async function filterHistoricalPaths(cwd, paths, request, signal) {
             throw new SiftLightError("Current ignore rules are not regular files; historical path filtering is unavailable");
           if (before.size > MAX_SOURCE_FILE_BYTES || ignoreBytesRead + before.size > MAX_STRUCTURE_BYTES)
             throw new SiftLightError("Current ignore rules exceed the source read budget");
-          const handle2 = await open3(path, constants2.O_RDONLY | (constants2.O_NOFOLLOW ?? 0));
+          const handle2 = await open4(path, constants2.O_RDONLY | (constants2.O_NOFOLLOW ?? 0));
           let bytes;
           try {
             if (!sameSourceRevision(sourceRevisionFromStats(before), sourceRevisionFromStats(await handle2.stat())))
@@ -11107,9 +11173,9 @@ async function sourceSimilarity(oldContent, newContent, budget) {
 }
 
 // src/git-repository.ts
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 import { constants as constants3 } from "fs";
-import { lstat as lstat2, open as open4 } from "fs/promises";
+import { lstat as lstat2, open as open5 } from "fs/promises";
 import { isAbsolute as isAbsolute7, relative as relative5, resolve as resolve11, sep as sep3 } from "path";
 
 // src/git-process.ts
@@ -11377,7 +11443,7 @@ async function readGitBlob(cwd, commit, entry, budget, signal) {
   budget.bytes += output.length;
   if (output.length !== size)
     throw new SiftLightError("Git blob size does not match its immutable tree entry");
-  const verifiedBlob = createHash2(blob.length === 40 ? "sha1" : "sha256").update(`blob ${String(output.length)}\x00`).update(output).digest("hex");
+  const verifiedBlob = createHash3(blob.length === 40 ? "sha1" : "sha256").update(`blob ${String(output.length)}\x00`).update(output).digest("hex");
   if (verifiedBlob !== blob)
     throw new SiftLightError("Git blob bytes do not match their immutable object identity");
   return {
@@ -11386,7 +11452,7 @@ async function readGitBlob(cwd, commit, entry, budget, signal) {
     sourceStatus: output.includes(0) ? "binary" : "available",
     ...output.includes(0) ? { reason: "Binary source contains NUL bytes" } : { content: output },
     origin: { kind: "git", commit, blob },
-    contentHash: createHash2("sha256").update(output).digest("hex")
+    contentHash: createHash3("sha256").update(output).digest("hex")
   };
 }
 async function readWorktreeSource(cwd, path, budget, signal) {
@@ -11417,7 +11483,7 @@ async function readWorktreeSource(cwd, path, budget, signal) {
     if (budget.bytes + before.size > budget.maxBytes)
       return limitedSource(path, mode, `Source reads exceed the ${String(budget.maxBytes)} byte request limit`);
     await assertExistingPathInsideCwd(absolute, cwd);
-    const handle2 = await open4(absolute, constants3.O_RDONLY | (constants3.O_NOFOLLOW ?? 0));
+    const handle2 = await open5(absolute, constants3.O_RDONLY | (constants3.O_NOFOLLOW ?? 0));
     try {
       if (!sameSourceRevision(sourceRevisionFromStats(before), sourceRevisionFromStats(await handle2.stat())))
         throw new SiftLightError("Working source changed before reading");
@@ -11446,9 +11512,9 @@ async function readWorktreeSource(cwd, path, budget, signal) {
         origin: {
           kind: "worktree",
           revision: sourceRevisionFromStats(after),
-          contentHash: createHash2("sha256").update(content).digest("hex")
+          contentHash: createHash3("sha256").update(content).digest("hex")
         },
-        contentHash: createHash2("sha256").update(content).digest("hex")
+        contentHash: createHash3("sha256").update(content).digest("hex")
       };
     } finally {
       await handle2.close();
@@ -11693,8 +11759,8 @@ async function readGitSource(cwd, identity, signal, options = {}) {
 
 // src/source-document.ts
 import { isUtf8 } from "buffer";
-import { createHash as createHash3 } from "crypto";
-import { open as open5, realpath as realpath4 } from "fs/promises";
+import { createHash as createHash4 } from "crypto";
+import { open as open6, realpath as realpath4 } from "fs/promises";
 import { relative as relative6, resolve as resolve12 } from "path";
 class SourceDocumentError extends SiftLightError {
   reason;
@@ -11705,7 +11771,7 @@ class SourceDocumentError extends SiftLightError {
   }
 }
 function contentHash(bytes) {
-  return createHash3("sha256").update(bytes).digest("hex");
+  return createHash4("sha256").update(bytes).digest("hex");
 }
 
 class SourceDocument {
@@ -11860,14 +11926,14 @@ async function readWorkspaceDocument(path, cwd, signal, expected, readBudget = M
   if (!before)
     throw new SourceDocumentError("source-unavailable", "Source is unavailable");
   if (expected && !sameSourceRevision(before, expected.revision)) {
-    throw new SourceDocumentError("source-changed", "Source changed; start a new inspection");
+    throw new SourceDocumentError("source-changed", "Source changed; refresh the search");
   }
   if (before.size > Math.min(MAX_SOURCE_FILE_BYTES, readBudget)) {
     throw new SourceDocumentError("file-too-large", "Source exceeds the 5 MiB file limit");
   }
   if (signal?.aborted)
     throw abortError();
-  const handle2 = await open5(canonical, "r");
+  const handle2 = await open6(canonical, "r");
   let bytes;
   try {
     const metadata2 = await handle2.stat();
@@ -11902,7 +11968,7 @@ async function readWorkspaceDocument(path, cwd, signal, expected, readBudget = M
     throw abortError();
   const hash = contentHash(bytes);
   if (expected && expected.contentHash !== hash) {
-    throw new SourceDocumentError("source-changed", "Source content changed; start a new inspection");
+    throw new SourceDocumentError("source-changed", "Source content changed; refresh the search");
   }
   return new SourceDocument({
     path: isPathInsideCwd(canonical, canonicalCwd) ? relative6(canonicalCwd, canonical).replaceAll("\\", "/") : canonical.replaceAll("\\", "/"),
@@ -12197,7 +12263,7 @@ async function createConceptSourceGeneration(access, filters, providedFiles) {
       reasons.push(`${path}: ${error.message}`);
     }
   }
-  const inventoryHash = createHash4("sha256").update(JSON.stringify(inventory)).digest("hex").slice(0, 32);
+  const inventoryHash = createHash5("sha256").update(JSON.stringify(inventory)).digest("hex").slice(0, 32);
   return {
     cwd: access.cwd,
     filters: {
@@ -12536,7 +12602,7 @@ async function runConceptSearch(input, access, infer, onProgress, options = {})
     batchFileLimit: MAX_STRUCTURE_FILES,
     fileLimit: access.maxFiles,
     startedAt: generationStartedAt,
-    inventoryHash: createHash5("sha256").update(JSON.stringify(inventory)).digest("hex").slice(0, 32)
+    inventoryHash: createHash6("sha256").update(JSON.stringify(inventory)).digest("hex").slice(0, 32)
   };
   result.counts = {
     ...lexical ? { relevanceRanking: 1 } : {},
@@ -12716,7 +12782,7 @@ async function structuralSearch(input, access) {
 }
 
 // src/native-text-search.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 import { mkdtemp as mkdtemp3, mkdir as mkdir4, readFile as readFile5, realpath as realpath5, rm as rm4, writeFile as writeFile3 } from "fs/promises";
 import { tmpdir as tmpdir3 } from "os";
 import { basename as basename3, dirname as dirname6, isAbsolute as isAbsolute8, join as join7, resolve as resolve15 } from "path";
@@ -12792,11 +12858,11 @@ function createNativeTextSearch(config, search) {
           if (access.signal?.aborted)
             throw abortError();
           const path = document2.path;
-          const relative = isAbsolute8(path) ? join7(createHash6("sha256").update(dirname6(path)).digest("hex"), basename3(path)) : path;
+          const relative = isAbsolute8(path) ? join7(createHash7("sha256").update(dirname6(path)).digest("hex"), basename3(path)) : path;
           const staged = resolve15(corpus, relative);
           if (!staged.startsWith(corpus + "/"))
             throw new SiftLightError("Native staging path escaped its corpus");
-          const hash = createHash6("sha256").update(document2.bytes).digest("hex");
+          const hash = createHash7("sha256").update(document2.bytes).digest("hex");
           const previous = known.get(path);
           if (!previous || previous.hash !== hash) {
             await mkdir4(dirname6(staged), { recursive: true });
@@ -12842,7 +12908,7 @@ function createNativeTextSearch(config, search) {
           throw new SiftLightError("Native text returned an unknown or duplicate source");
         seen.add(entry.staged);
         const content = await readFile5(entry.staged);
-        if (createHash6("sha256").update(content).digest("hex") !== entry.hash)
+        if (createHash7("sha256").update(content).digest("hex") !== entry.hash)
           throw new SiftLightError("Native staged source changed");
         const document2 = new SourceDocument(entry.source, content);
         const range = document2.lineRange(hit.line);
@@ -13656,6 +13722,7 @@ function resolveInspectionTarget(input, cwd, snapshots) {
   const absolutePath = retainedMatch?.absolutePath ?? resolve16(cwd, path);
   new SearchPathPolicy(cwd).assertPath(absolutePath);
   let expectedRevision;
+  let expectedReference;
   if (input.cursor) {
     const { snapshot } = snapshots.resolve(input.cursor);
     retainedMatch ??= snapshot.matches.find((match) => match.absolutePath === absolutePath && match.lineNumber === line);
@@ -13663,13 +13730,15 @@ function resolveInspectionTarget(input, cwd, snapshots) {
       throw new CursorError("The requested line is not a retained match in this snapshot.");
     }
     expectedRevision = snapshot.sourceRevisions.get(absolutePath);
+    expectedReference = snapshot.sourceReferences?.get(absolutePath);
   }
   return {
     path,
     absolutePath,
     line,
-    unverified: input.cursor !== undefined && expectedRevision === undefined,
+    unverified: input.cursor !== undefined && (expectedReference === undefined || expectedRevision === undefined),
     ...retainedMatch ? { retainedMatch } : {},
+    ...expectedReference ? { expectedReference } : {},
     ...expectedRevision ? { expectedRevision } : {}
   };
 }
@@ -15767,6 +15836,7 @@ function matchInspectionTarget(target) {
     path: target.path,
     line: target.line,
     unverified: target.unverified,
+    ...target.expectedReference ? { reference: target.expectedReference } : {},
     ...target.expectedRevision ? { expectedRevision: target.expectedRevision } : {},
     ...target.retainedMatch?.occurrences[0] ? { focus: target.retainedMatch.occurrences[0].byteStart } : {}
   };
@@ -16352,9 +16422,6 @@ async function failure(error, expected, path, cwd, signal) {
 function sourceKey(reference) {
   return JSON.stringify([reference.path, reference.origin]);
 }
-function revisionKey(path, revision) {
-  return JSON.stringify([path, revision]);
-}
 function selectedIndex(index, count, label) {
   if (index === undefined)
     return;
@@ -16405,8 +16472,8 @@ function snapshotTargets(snapshot, matchIndex) {
   const missing = [];
   const seen = new Set;
   for (const path of selectedPaths) {
-    const revision = snapshot.sourceRevisions.get(path);
-    if (!revision) {
+    const reference = snapshot.sourceReferences?.get(path);
+    if (!reference) {
       const key = JSON.stringify(["missing", path]);
       if (!seen.has(key)) {
         seen.add(key);
@@ -16414,74 +16481,19 @@ function snapshotTargets(snapshot, matchIndex) {
           path,
           role: "source",
           status: "unknown",
-          reason: "Saved search has no source revision"
+          reason: "Saved search has no verified source content identity"
         });
       }
       continue;
     }
     addUniqueTarget(targets, seen, {
-      key: revisionKey(path, revision),
+      key: sourceKey(reference),
       path,
-      revision
+      expected: reference
     });
   }
   return { targets, missing };
 }
-async function validateSnapshotTarget(target, cwd, policy, signal) {
-  if (!target.revision)
-    throw new Error("Snapshot validation target omitted its revision");
-  try {
-    const absolute = resolve22(cwd, target.path);
-    const canonical = await policy.resolveExistingPath(absolute);
-    if (!canonical) {
-      const result = await confirmWorktreeState(target.path, cwd, signal);
-      return { path: target.path, role: "source", ...result };
-    }
-    const before = await stat7(absolute);
-    const beforeCanonical = canonical;
-    const after = await stat7(absolute);
-    const afterCanonical = await realpath7(absolute);
-    if (!before.isFile() || !after.isFile()) {
-      return {
-        path: target.path,
-        role: "source",
-        status: "stale",
-        reason: "Source is no longer a regular file"
-      };
-    }
-    if (beforeCanonical !== afterCanonical || !sameSourceRevision(sourceRevisionFromStats(before), sourceRevisionFromStats(after))) {
-      return {
-        path: target.path,
-        role: "source",
-        status: "stale",
-        reason: "Source changed while checking its revision"
-      };
-    }
-    const current = sourceRevisionFromStats(after);
-    const unchanged = sameSourceRevision(target.revision, current);
-    return {
-      path: target.path,
-      role: "source",
-      status: unchanged ? "current" : "stale",
-      ...unchanged ? {} : { reason: "Source revision changed" }
-    };
-  } catch (error) {
-    if (isAbort(error, signal))
-      throw error;
-    const code = systemErrorCode(error);
-    if (code === "ENOENT") {
-      const classified = await confirmWorktreeState(target.path, cwd, signal);
-      return { path: target.path, role: "source", ...classified };
-    }
-    const classified = await failure(error, undefined, target.path, cwd, signal);
-    return {
-      path: target.path,
-      role: "source",
-      status: classified.status,
-      reason: classified.reason
-    };
-  }
-}
 async function validateAnalysisTarget(target, access, cwd, signal) {
   if (!target.expected)
     throw new Error("Analysis validation target omitted its source reference");
@@ -16579,14 +16591,17 @@ async function validateSavedEvidence(options) {
     const selected = snapshotTargets(snapshot, options.matchIndex);
     targets = selected.targets;
     missing.push(...selected.missing);
-    const policy = new SearchPathPolicy(options.cwd);
     sources = [...missing];
-    let checked = 0;
     const maxFiles = options.maxFiles ?? MAX_STRUCTURE_FILES;
+    const access = new SourceAccess(options.cwd, options.queue, options.signal, {
+      maxFiles
+    });
+    let checked = 0;
+    let budgetExhausted = false;
     for (const target of targets) {
       if (options.signal?.aborted)
         throw abortError();
-      if (checked >= maxFiles) {
+      if (budgetExhausted || checked >= maxFiles) {
         sources.push({
           path: target.path,
           role: "source",
@@ -16596,7 +16611,11 @@ async function validateSavedEvidence(options) {
         continue;
       }
       checked += 1;
-      sources.push(await validateSnapshotTarget(target, options.cwd, policy, options.signal));
+      const status = await validateAnalysisTarget(target, access, options.cwd, options.signal);
+      const { budgetReached, ...sourceStatus } = status;
+      sources.push(sourceStatus);
+      if (budgetReached)
+        budgetExhausted = true;
     }
   }
   if (sources.length === 0)
@@ -19490,7 +19509,7 @@ class EvidenceService {
       if (selected.unverified)
         throw new SiftLightError("Snapshot source revision is unverified; refresh the search");
       if (selected.expectedRevision) {
-        const doc = await access.load(path);
+        const doc = await access.load(path, selected.reference);
         if (doc.reference.origin.kind !== "worktree" || !sameSourceRevision(selected.expectedRevision, doc.reference.origin.revision))
           throw new SiftLightError("Source changed; refresh the search");
         reference = doc.reference;
@@ -20275,7 +20294,8 @@ class SnapshotStore {
     return scan.retention?.accountedBytes ?? Buffer.byteLength(JSON.stringify({
       matches: scan.matches,
       fileCounts: [...scan.fileCounts],
-      sourceRevisions: [...scan.sourceRevisions]
+      sourceRevisions: [...scan.sourceRevisions],
+      sourceReferences: scan.sourceReferences ? [...scan.sourceReferences] : []
     }));
   }
   #scanOccurrences(scan) {
@@ -20804,11 +20824,11 @@ function cursorPathSelection(input, cwd) {
     absolutePaths.add(absolutePath);
     labels.push(label);
   }
-  const key = createHash7("sha256").update([...absolutePaths].toSorted((left, right) => left.localeCompare(right)).join("\x00")).digest("hex").slice(0, 16);
+  const key = createHash8("sha256").update([...absolutePaths].toSorted((left, right) => left.localeCompare(right)).join("\x00")).digest("hex").slice(0, 16);
   return { labels, absolutePaths, key };
 }
 function baseDetails2(snapshot, mode) {
-  const sourceUnverifiedFileCount = new Set(snapshot.matches.filter((match) => !snapshot.sourceRevisions.has(match.absolutePath)).map((match) => match.absolutePath)).size;
+  const sourceUnverifiedFileCount = new Set(snapshot.matches.filter((match) => !snapshot.sourceReferences?.has(match.absolutePath)).map((match) => match.absolutePath)).size;
   return {
     version: 1,
     mode,

package/plugins/sift-light/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sift-light",
-  "version": "1.1.0",
+  "version": "1.1.1-1",
   "private": true,
   "type": "module",
   "omp": {

package/src/evidence-service.ts

@@ -1012,7 +1012,7 @@ export class EvidenceService {
       if (selected.unverified)
         throw new SiftLightError("Snapshot source revision is unverified; refresh the search");
       if (selected.expectedRevision) {
-        const doc = await access.load(path);
+        const doc = await access.load(path, selected.reference);
         if (
           doc.reference.origin.kind !== "worktree" ||
           !sameSourceRevision(selected.expectedRevision, doc.reference.origin.revision)