talos-code 0.0.1 → 0.2.0

package/vendor/harness-ui/src/context-desktop-service.mjs

@@ -0,0 +1,253 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { parseContextSettings, ContextEngineError } from '../../context-engine/src/contracts.mjs';
+import { importLegacySession } from '../../context-engine/src/node/legacy-import.mjs';
+
+const fail = (code, message) => { throw new ContextEngineError(message, code); };
+const digest = value => createHash('sha256').update(JSON.stringify(value)).digest('hex');
+const terminal = new Set(['committed', 'failed', 'cancelled']);
+const validId = value => typeof value === 'string' && value.length > 0 && value.length <= 256 && !value.includes('\0');
+
+/** Desktop ownership and transport adaptation; archive paths and model credentials
+ * never originate in the HTTP request. Every durable mutation has a receipt. */
+export function createDesktopContextService({ engine, store, loadLegacy, resolveSessionModel, isSessionEnabled, readSession, onEvent, runInference, registraAncora, clock = () => new Date().toISOString() }) {
+  if (!engine || !store || typeof readSession !== 'function' || typeof resolveSessionModel !== 'function' || typeof isSessionEnabled !== 'function') fail('CTX_PORT_MISSING', 'Servizi desktop del contesto incompleti.');
+  const queues = new Map();
+  const deliveries = new Map();
+  const ownedJobs = new Map();
+  /* 24/09 — F4: l'ultima proiezione preparata per sessione (ciò che è andato al modello) è la base
+     dell'ancora del fornitore: `captureProviderResponse` la sposa con `usage.prompt_tokens`. */
+  const ultimeProiezioni = new Map();
+  /* 24/09 — F4: le sessioni per cui questo processo ha già cercato job orfani (basta una volta: in
+     questo processo un job attivo è sempre nella mappa `running` del motore). */
+  const recuperate = new Set();
+  let closed = false;
+  function serial(sessionId, task) {
+    const previous = queues.get(sessionId) ?? Promise.resolve();
+    const next = previous.catch(() => {}).then(task);
+    queues.set(sessionId, next);
+    next.finally(() => { if (queues.get(sessionId) === next) queues.delete(sessionId); }).catch(() => {});
+    return next;
+  }
+  async function ensure(sessionId) {
+    if (closed) fail('CTX_SERVICE_CLOSED', 'Il servizio del contesto è chiuso.');
+    if (!validId(sessionId) || !await readSession(sessionId)) fail('CTX_SESSION_NOT_FOUND', 'Conversazione non trovata.');
+    if (!await isSessionEnabled(sessionId)) fail('CTX_NOT_ENABLED', 'Il motore del contesto non è attivo per questa conversazione di prova.');
+    let snapshot = await store.readContextSnapshot({ sessionId });
+    if (!snapshot) {
+      const jsonl = await loadLegacy?.({ sessionId });
+      snapshot = jsonl ? await importLegacySession({ sessionId, jsonl, settings: parseContextSettings({}), metadata: {} }, { store }) : await store.initSession({ sessionId, settings: parseContextSettings({}) });
+    } else if (!recuperate.has(sessionId) && typeof engine.recoverInterruptedJobs === 'function') {
+      /*
+       * 24/09/2026 — F4, CTX-RESTART-ACTIVE-JOB-RECOVERY: al primo tocco della sessione in questo processo un job
+       * lasciato «in corso» da un processo morto viene dichiarato interrotto (`paused` + `CTX_JOB_INTERRUPTED`,
+       * vedi `engine.mjs::recoverInterrupted`), così il pannello non mostra un avanzamento che non avanza e la
+       * sessione può compattare di nuovo. Prima di oggi `GET /` rileggeva la riga com'era, per sempre.
+       */
+      snapshot = await engine.recoverInterruptedJobs({ sessionId });
+      recuperate.add(sessionId);
+    }
+    return snapshot;
+  }
+  async function allRecords(sessionId) {
+    const records = []; let afterSequence = 0;
+    for (;;) {
+      const page = await store.readOriginals({ sessionId, afterSequence, limit: 1000 });
+      records.push(...page);
+      if (page.length < 1000) return records;
+      afterSequence = page.at(-1).sequence;
+    }
+  }
+  function deliver(sessionId) {
+    if (!onEvent) return Promise.resolve();
+    if (deliveries.has(sessionId)) return deliveries.get(sessionId);
+    const pending = (async () => {
+      for (;;) {
+        const events = await store.readContextOutbox({ sessionId });
+        if (!events.length) return;
+        for (const event of events) {
+          await onEvent({ sessionId, event });
+          await store.ackContextEvent({ sessionId, eventId: event.id });
+        }
+      }
+    })();
+    deliveries.set(sessionId, pending);
+    pending.finally(() => { if (deliveries.get(sessionId) === pending) deliveries.delete(sessionId); }).catch(() => {});
+    return pending;
+  }
+  async function modelFor(sessionId) { return resolveSessionModel({ sessionId, session: await readSession(sessionId) }); }
+  function common(body, fields = []) {
+    if (!body || typeof body !== 'object' || Array.isArray(body) || Object.keys(body).some(k => !['expectedRevision', 'idempotencyKey', ...fields].includes(k))) fail('CTX_INVALID_INPUT', 'Richiesta del contesto non valida.');
+    if (!Number.isSafeInteger(body.expectedRevision) || body.expectedRevision < 0 || !validId(body.idempotencyKey)) fail('CTX_INVALID_INPUT', 'Revisione e identità della richiesta sono necessarie.');
+  }
+  async function mutation(sessionId, method, path, body, operation, args) {
+    const requestFingerprint = digest({ method, path, body });
+    return store[operation]({ ...args, sessionId, idempotencyKey: body.idempotencyKey, requestFingerprint });
+  }
+  const api = {
+    async createKernelHooks({ sessionId, runId }) {
+      if (!await isSessionEnabled(sessionId)) return undefined;
+      if (!validId(runId)) fail('CTX_INVALID_INPUT', 'Identità del giro non valida.');
+      await serial(sessionId, () => ensure(sessionId));
+      return Object.freeze({
+        capture: ({ messages }) => api.syncOriginals({ sessionId, messages }),
+        /* 24/09 — F4, contratto con l'adapter (F1): `messages` = proiezione corretta, `originali` = grezzo. */
+        prepare: ({ messages, originali, tools, signal }) => api.prepare({ sessionId, messages, originali, tools, signal }),
+        infer: ({ signal }, operation) => runInference ? runInference({ sessionId, priority: 'chat', signal }, operation) : operation(signal),
+        captureProviderResponse: async ({ response, giro, usage }) => {
+          if (!response || typeof response !== 'object' || !Number.isSafeInteger(giro) || giro < 0) fail('CTX_INVALID_INPUT', 'Risposta del modello non archiviabile.');
+          const bytes = Buffer.from(JSON.stringify({ schema: 'talos.context.provider-response.v1', runId, giro, response }), 'utf8');
+          return serial(sessionId, async () => {
+            await ensure(sessionId);
+            const receipt = await store.putBlob({ sessionId, id: `provider-response-${digest({ runId, giro })}`, bytes, mimeType: 'application/json' });
+            /*
+             * 24/09/2026 — F4, punto 5: il numero VERO del fornitore (`usage.prompt_tokens`) diventa l'ancora della
+             * misura successiva, sposato alla proiezione appena inviata; il contatore separato (una chiamata in più,
+             * e per OpenRouter una stima) si usa solo quando il prefisso non combacia. Come Hermes
+             * `agent/usage_anchor.py:46-60`. ⛔ Il kernel oggi passa `{ response, giro }` senza `usage`
+             * (`talosHarness.mjs:8281`): finché quella riga non porta `usage`, qui non arriva nulla e si conta come prima.
+             */
+            if (registraAncora && usage && typeof usage === 'object' && ultimeProiezioni.has(sessionId)) {
+              const profile = await modelFor(sessionId);
+              registraAncora({ provider: profile.provider, model: profile.model, messages: ultimeProiezioni.get(sessionId), usage });
+            }
+            return receipt;
+          });
+        },
+      });
+    },
+    async compact({ sessionId, messages }) {
+      if (!await isSessionEnabled(sessionId)) return undefined;
+      const session = await readSession(sessionId);
+      if (Array.isArray(messages) && session?.conclusa !== false) await api.syncOriginals({ sessionId, messages });
+      const snapshot = await serial(sessionId, () => ensure(sessionId));
+      const { job } = await api.request({ sessionId, method: 'POST', path: '/jobs', body: { kind: 'compact', expectedRevision: snapshot.revision, idempotencyKey: randomUUID() } });
+      const finished = await engine.waitForCompaction({ sessionId, jobId: job.id });
+      await deliver(sessionId);
+      return { ok: true, compattato: finished.state === 'committed', jobId: job.id, ...(finished.error ? { error: finished.error } : {}) };
+    },
+    async request({ sessionId, method, path = '/', body, signal }) {
+      signal?.throwIfAborted();
+      let snapshot = await serial(sessionId, () => ensure(sessionId));
+      path = path.replace(/\/$/u, '') || '/';
+      if (method === 'GET') {
+        if (path === '/') { await deliver(sessionId); return { ...snapshot, usage: await store.readUsage({ sessionId }), semanticStatus: 'not-qualified' }; }
+        if (path === '/versions') return { versions: await engine.listContextVersions({ sessionId }) };
+        if (path === '/facts') return { facts: snapshot.facts };
+        if (path === '/export') return engine.exportContext({ sessionId });
+        let match = /^\/jobs\/([^/]+)$/u.exec(path);
+        if (match) {
+          const job = await store.readContextJob({ sessionId, jobId: match[1] });
+          if (!job) fail('CTX_JOB_NOT_FOUND', 'Compattazione non trovata.');
+          await deliver(sessionId); return { job };
+        }
+        match = /^\/sources\/([^/]+)$/u.exec(path);
+        if (match) return { source: await engine.readContextSource({ sessionId, sourceId: match[1] }) };
+        fail('CTX_ROUTE_NOT_FOUND', 'Operazione del contesto non trovata.');
+      }
+      const fields = path === '/settings' ? ['patch'] : path === '/jobs' ? ['kind'] : path.endsWith('/resolve') ? ['accept'] : path.startsWith('/facts') ? ['fact'] : [];
+      common(body, fields);
+      const requestFingerprint = digest({ method, path, body });
+      const receipt = await store.readContextMutation({ sessionId, idempotencyKey: body.idempotencyKey, requestFingerprint });
+      const wrap = result => path.startsWith('/facts') ? { fact: result } : path.startsWith('/versions') ? { version: result } : path.startsWith('/jobs') ? { job: result } : result;
+      if (receipt) return wrap(receipt.result);
+      if (method === 'POST' && path === '/jobs') {
+        const existing = snapshot.jobs.find(job => job.idempotencyKey === body.idempotencyKey);
+        if (existing) return { job: await engine.startCompaction({ sessionId, idempotencyKey: body.idempotencyKey, kind: body.kind ?? 'compact', sessionModel: await modelFor(sessionId) }) };
+      }
+      if (snapshot.revision !== body.expectedRevision) fail('CTX_STALE_REVISION', 'La conversazione è cambiata. Aggiorna il pannello prima di modificare il contesto.');
+      signal?.throwIfAborted();
+      if (method === 'PATCH' && path === '/settings') {
+        const settings = parseContextSettings({ ...snapshot.settings, ...body.patch });
+        return mutation(sessionId, method, path, body, 'updateSessionSettings', { settings, expectedRevision: body.expectedRevision });
+      }
+      if (method === 'POST' && path === '/jobs') {
+        if (!['compact', 'regenerate'].includes(body.kind ?? 'compact')) fail('CTX_INVALID_INPUT', 'Tipo di compattazione non valido.');
+        const job = await engine.startCompaction({ sessionId, idempotencyKey: body.idempotencyKey, kind: body.kind ?? 'compact', sessionModel: await modelFor(sessionId) });
+        ownedJobs.set(`${sessionId}:${job.id}`, { sessionId, jobId: job.id });
+        return { job };
+      }
+      let match = /^\/jobs\/([^/]+)(\/resume)?$/u.exec(path);
+      if (match && (method === 'DELETE' && !match[2] || method === 'POST' && match[2])) {
+        const jobId = match[1];
+        const job = method === 'DELETE' ? await engine.cancelCompaction({ sessionId, jobId }) : await engine.resumeCompaction({ sessionId, jobId, sessionModel: await modelFor(sessionId) });
+        const result = await mutation(sessionId, method, path, body, 'saveJobProgress', { job });
+        return { job: result };
+      }
+      match = /^\/versions\/([^/]+)\/restore$/u.exec(path);
+      if (method === 'POST' && match) {
+        const version = await mutation(sessionId, method, path, body, 'restoreContextVersion', { versionId: match[1], expectedRevision: body.expectedRevision, newVersionId: randomUUID(), createdAt: clock() });
+        await deliver(sessionId); return { version };
+      }
+      match = /^\/facts(?:\/([^/]+))?(\/resolve)?$/u.exec(path);
+      if (match) {
+        const factId = match[1];
+        if (method === 'DELETE' && factId && !match[2]) return { fact: await mutation(sessionId, method, path, body, 'removeProtectedFact', { factId, expectedRevision: body.expectedRevision }) };
+        let input = body.fact;
+        const prior = snapshot.facts.find(f => f.id === factId || f.id === input?.id);
+        if (method === 'POST' && match[2]) {
+          if (typeof body.accept !== 'boolean' || prior?.status !== 'conflict') fail('CTX_FACT_CONFLICT_NOT_FOUND', 'Nessun conflitto da risolvere.');
+          input = { id: factId, text: body.accept ? prior.conflict.proposedText : prior.text, sources: body.accept ? prior.conflict.sources : prior.sources };
+        } else if (!(method === 'POST' && !factId || method === 'PATCH' && factId)) fail('CTX_ROUTE_NOT_FOUND', 'Operazione del contesto non trovata.');
+        if (!input || typeof input !== 'object' || Array.isArray(input) || Object.keys(input).some(k => !['id', 'text', 'sources'].includes(k)) || (factId && input.id && input.id !== factId)) fail('CTX_INVALID_INPUT', 'Informazione protetta non valida.');
+        const fact = { id: factId ?? input.id ?? randomUUID(), text: input.text, sources: input.sources ?? [], status: 'active', revision: (prior?.revision ?? 0) + 1 };
+        return { fact: await mutation(sessionId, method, path, body, 'upsertProtectedFact', { fact, expectedRevision: body.expectedRevision }) };
+      }
+      fail('CTX_ROUTE_NOT_FOUND', 'Operazione del contesto non trovata.');
+    },
+    syncOriginals({ sessionId, messages }) {
+      return serial(sessionId, async () => {
+        const snapshot = await ensure(sessionId);
+        if (!Array.isArray(messages)) fail('CTX_INVALID_INPUT', 'Cronologia non valida.');
+        const saved = await allRecords(sessionId);
+        if (messages.length < saved.length || saved.some((record, index) => record.sha256 !== digest(messages[index]))) fail('CTX_HISTORY_DIVERGED', 'La cronologia attiva differisce dall’archivio. Gli originali sono conservati; occorre recuperare la versione completa.');
+        const records = messages.slice(saved.length).map((message, offset) => ({ id: `message-${saved.length + offset + 1}`, message, createdAt: clock(), origin: 'desktop-kernel' }));
+        if (records.length) await store.appendOriginalBatch({ sessionId, records, expectedRevision: snapshot.revision });
+        return store.readContextSnapshot({ sessionId });
+      });
+    },
+    /*
+     * 24/09/2026 — F4: ARCHIVIO ≠ PROIEZIONE (T1/T2 della ricognizione). L'adapter desktop corregge gli esiti
+     * degli attrezzi PRIMA della richiesta; archiviare quella proiezione faceva divergere l'archivio (grezzo, da
+     * `capture`) alla richiesta dopo: `CTX_HISTORY_DIVERGED` alla seconda richiesta, riprodotto dalla sonda T2.
+     * Ora: si ARCHIVIA da `originali` quando c'è (ripiego: `messages`, come prima per chi non lo passa), si
+     * PROIETTA e si RIASSUME da `messages`. Una proiezione non allineata (lunghezza o ruoli diversi) si rifiuta
+     * prima di toccare l'archivio. Come Hermes (`hermes_state_messages.py:735-741`, clone `65ad529`) e Claude
+     * Code (issue #26125, 16/02/2026: «The full transcript is preserved in transcript.jsonl on disk» mentre al
+     * modello arrivano i «compacted summaries»): la trascrizione grezza e il contesto inviato sono due cose.
+     */
+    async prepare({ sessionId, messages, originali, tools, signal }) {
+      let projection;
+      if (originali !== undefined) {
+        if (!Array.isArray(originali) || !Array.isArray(messages) || messages.length !== originali.length || messages.some((message, index) => message?.role !== originali[index]?.role)) fail('CTX_INVALID_INPUT', 'La proiezione della richiesta non è allineata agli originali (lunghezza o ruoli diversi).');
+        projection = messages;
+      }
+      await api.syncOriginals({ sessionId, messages: originali === undefined ? messages : originali });
+      let result;
+      try { result = await engine.prepareForRequest({ sessionId, projection, tools, sessionModel: await modelFor(sessionId), signal }); }
+      catch (error) {
+        /* 25/09 — l'avviso «compattazione automatica in pausa» nasce anche quando la richiesta MUORE (contesto che non entra,
+           riassunto rifiutato mentre si aspettava): senza questa consegna restava nella coda fino alla richiesta dopo. Una
+           consegna fallita non copre l'errore vero della richiesta. */
+        await deliver(sessionId).catch(() => {});
+        throw error;
+      }
+      if (Array.isArray(result?.messages)) ultimeProiezioni.set(sessionId, result.messages);
+      await deliver(sessionId);
+      return result;
+    },
+    async append({ sessionId, record }) { await serial(sessionId, () => ensure(sessionId)); return engine.appendOriginal({ sessionId, record }); },
+    async close() {
+      if (closed) return;
+      closed = true;
+      await Promise.allSettled([...queues.values()]);
+      await Promise.allSettled([...deliveries.values()]);
+      for (const options of ownedJobs.values()) {
+        const job = await store.readContextJob(options);
+        if (job && !terminal.has(job.state)) await engine.cancelCompaction(options);
+        await engine.waitForCompaction(options);
+      }
+      ownedJobs.clear();
+    },
+  };
+  return Object.freeze(api);
+}

package/vendor/harness-ui/src/context-embedding-runtime.mjs

@@ -0,0 +1,252 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { createReadStream } from 'node:fs';
+import { stat } from 'node:fs/promises';
+import { createServer } from 'node:net';
+import { dirname, isAbsolute } from 'node:path';
+
+const MODEL_ID = 'qwen3-embedding-0.6b-q8_0';
+const MODEL = Object.freeze({
+  id: MODEL_ID, repo: 'Qwen/Qwen3-Embedding-0.6B-GGUF', revision: '370f27d7550e0def9b39c1f16d3fbaa13aa67728',
+  bytes: 639150592, sha256: '06507c7b42688469c4e7298b0a1e16deff06caf291cf0a5b278c308249c3e439',
+  license: 'Apache-2.0', path: MODEL_ID,
+  files: [{ path: 'Qwen3-Embedding-0.6B-Q8_0.gguf', bytes: 639150592, sha256: '06507c7b42688469c4e7298b0a1e16deff06caf291cf0a5b278c308249c3e439' }],
+});
+const QUERY_INSTRUCTION = 'Given a conversation search query, retrieve relevant passages from the same conversation';
+const PROFILE = Object.freeze({ runtime: 'llama.cpp', runtimeVersion: 'b10517', runtimeCommit: 'dc72703fc69698b1ea68ece8d2dd8a96e6a4e1fe', dimensions: 1024, pooling: 'last', queryInstruction: QUERY_INSTRUCTION });
+const HEALTH_TIMEOUT = 30000;
+const REQUEST_TIMEOUT = 30000;
+const MAX_RESPONSE = 2 * 1024 * 1024;
+const fail = (message, code) => { throw Object.assign(new Error(message), { code }); };
+
+async function allocateLoopbackPort() {
+  const server = createServer();
+  await new Promise((resolve, reject) => { server.once('error', reject); server.listen(0, '127.0.0.1', resolve); });
+  const { port } = server.address();
+  await new Promise((resolve, reject) => server.close(error => error ? reject(error) : resolve()));
+  return port;
+}
+
+// A promise race also bounds injected transports that do not honor AbortSignal.
+async function abortable(action, signal) {
+  if (signal.aborted) throw signal.reason;
+  let listener;
+  const stopped = new Promise((_, reject) => { listener = () => reject(signal.reason); signal.addEventListener('abort', listener, { once: true }); });
+  try { return await Promise.race([Promise.resolve().then(action), stopped]); }
+  finally { signal.removeEventListener('abort', listener); }
+}
+
+async function pause(ms, signal) {
+  let timer;
+  try { await abortable(() => new Promise(resolve => { timer = setTimeout(resolve, ms); }), signal); }
+  finally { clearTimeout(timer); }
+}
+
+export function createContextEmbeddingRuntime({ binaryPath, modelPath, modelSha256, processPolicy, fetchFn, downloadModel, modelStore, clock = () => new Date().toISOString() } = {}) {
+  if (typeof binaryPath !== 'string' || !isAbsolute(binaryPath) || typeof modelPath !== 'string' || !isAbsolute(modelPath)
+    || typeof modelSha256 !== 'string' || !/^[a-f0-9]{64}$/iu.test(modelSha256) || !processPolicy || typeof processPolicy.spawn !== 'function'
+    || typeof fetchFn !== 'function' || (downloadModel !== undefined && typeof downloadModel !== 'function') || typeof clock !== 'function') fail('Embedding dependencies are invalid', 'CTX_EMBEDDING_CONFIG');
+  const digest = modelSha256.toLowerCase();
+  const profile = { ...PROFILE, modelId: MODEL_ID, modelSha256: digest, revision: MODEL.revision };
+  const profileId = createHash('sha256').update(JSON.stringify(profile)).digest('hex');
+  const lifetime = new AbortController();
+  let closed = false; let active = null; let running = false; let downloadFlight = null; let verified = null; let state = 'unavailable';
+
+  const manifest = (status, extra = {}) => ({ ...structuredClone(MODEL), ...profile, profileId, sha256: digest, state: status, observedAt: clock(), ...extra });
+  function check(signal) {
+    if (closed) fail('Embedding runtime is closed', 'CTX_EMBEDDING_CLOSED');
+    if (signal?.aborted) fail('Embedding operation cancelled', 'CTX_CANCELLED');
+  }
+  function scopedSignal(signal, timeout = REQUEST_TIMEOUT) {
+    return AbortSignal.any([lifetime.signal, AbortSignal.timeout(timeout), ...(signal ? [signal] : [])]);
+  }
+  function translate(error, signal, defaultCode = 'CTX_EMBEDDING_FAILED') {
+    check(signal);
+    if (error?.code?.startsWith('CTX_')) return error;
+    if (error instanceof SyntaxError) return Object.assign(new Error('Local embedding endpoint returned malformed JSON'), { code: 'CTX_EMBEDDING_RESPONSE' });
+    return Object.assign(new Error(error?.name === 'TimeoutError' ? 'Embedding operation timed out' : 'Local embedding runtime failed'), { code: error?.name === 'TimeoutError' ? 'CTX_EMBEDDING_TIMEOUT' : defaultCode });
+  }
+
+  async function verifyWeights(signal) {
+    check(signal);
+    let info;
+    try { info = await stat(modelPath); } catch (error) { if (error.code === 'ENOENT') return null; throw error; }
+    if (!info.isFile() || info.size === 0) fail('Embedding model is not a regular nonempty file', 'CTX_EMBEDDING_HASH');
+    const key = `${info.dev}:${info.ino}:${info.size}:${info.mtimeMs}:${info.ctimeMs}`;
+    if (verified?.key === key) return verified;
+    const hash = createHash('sha256');
+    const stream = createReadStream(modelPath, { signal: scopedSignal(signal, 60000) });
+    for await (const chunk of stream) { check(signal); hash.update(chunk); }
+    if (hash.digest('hex') !== digest) fail('Embedding model SHA-256 mismatch', 'CTX_EMBEDDING_HASH');
+    if (digest === MODEL.sha256 && info.size !== MODEL.bytes) fail('Embedding model size mismatch', 'CTX_EMBEDDING_HASH');
+    verified = { key, byteLength: info.size };
+    return verified;
+  }
+
+  async function ensureEmbeddingModel({ approved = false, signal } = {}) {
+    check(signal);
+    if (typeof approved !== 'boolean') fail('Download approval must be explicit', 'CTX_EMBEDDING_INVALID');
+    try {
+      const local = await verifyWeights(signal);
+      check(signal);
+      if (local) return manifest('ready', { byteLength: local.byteLength });
+      if (approved !== true) return manifest('approval-required');
+      if (!downloadModel) fail('Guided embedding download is unavailable', 'CTX_EMBEDDING_DOWNLOAD_UNAVAILABLE');
+      if (!downloadFlight) {
+        // The owner binds this port to the existing HF transfer/model store.
+        downloadFlight = Promise.resolve().then(() => downloadModel({ ...structuredClone(MODEL), approved: true, signal: scopedSignal(signal, 600000) }));
+        downloadFlight.finally(() => { downloadFlight = null; }).catch(() => {});
+      }
+      const result = await abortable(() => downloadFlight, scopedSignal(signal, 600000));
+      check(signal);
+      const ready = await verifyWeights(signal);
+      if (ready) return manifest('ready', { byteLength: ready.byteLength });
+      const pending = result?.state;
+      if (!['queued', 'downloading', 'incomplete', 'paused'].includes(pending)) fail('Embedding download did not produce verified model bytes', 'CTX_EMBEDDING_DOWNLOAD_FAILED');
+      return manifest(pending);
+    } catch (error) { throw translate(error, signal); }
+  }
+
+  async function jsonRequest(entry, path, options, signal, timeout = REQUEST_TIMEOUT) {
+    const requestSignal = scopedSignal(signal, timeout);
+    return abortable(async () => {
+      const response = await fetchFn(`${entry.baseURL}${path}`, {
+        ...options, redirect: 'error', signal: requestSignal,
+        headers: { Accept: 'application/json', 'Content-Type': 'application/json', Authorization: `Bearer ${entry.token}` },
+      });
+      if (!response?.ok) fail('Local embedding endpoint is unavailable', path === '/health' ? 'CTX_EMBEDDING_HEALTH' : 'CTX_EMBEDDING_HTTP');
+      const declaredSize = response.headers?.get?.('content-length');
+      if (declaredSize && Number(declaredSize) > MAX_RESPONSE) fail('Embedding response exceeds limit', 'CTX_EMBEDDING_RESPONSE');
+      if (response.body?.getReader) {
+        const reader = response.body.getReader(); const chunks = []; let size = 0;
+        try {
+          for (;;) {
+            const { value, done } = await abortable(() => reader.read(), requestSignal);
+            if (done) break;
+            size += value.byteLength;
+            if (size > MAX_RESPONSE) fail('Embedding response exceeds limit', 'CTX_EMBEDDING_RESPONSE');
+            chunks.push(Buffer.from(value));
+          }
+          return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks)));
+        } finally { void reader.cancel().catch(() => {}); }
+      }
+      const data = await response.json();
+      if (Buffer.byteLength(JSON.stringify(data), 'utf8') > MAX_RESPONSE) fail('Embedding response exceeds limit', 'CTX_EMBEDDING_RESPONSE');
+      return data;
+    }, requestSignal);
+  }
+
+  async function stopEntry(entry) {
+    if (!entry) return;
+    if (entry.stopping) return entry.stopping;
+    entry.stopping = (async () => {
+      const waitForExit = async () => {
+        let timer;
+        try { await Promise.race([entry.completion, new Promise(resolve => { timer = setTimeout(resolve, 1000); })]); }
+        finally { clearTimeout(timer); }
+      };
+      if (entry.child && !entry.closed) {
+        try { entry.child.kill('SIGTERM'); } catch { /* child can exit concurrently */ }
+        await waitForExit();
+        if (!entry.closed) {
+          try { entry.child.kill('SIGKILL'); } catch { /* child can exit concurrently */ }
+          await waitForExit();
+        }
+        if (!entry.closed) fail('Embedding process did not confirm shutdown', 'CTX_EMBEDDING_STOP_FAILED');
+      }
+      if (entry.locked) { await modelStore.unlock(MODEL_ID); entry.locked = false; }
+      if (active === entry) active = null;
+      if (!closed) state = 'unavailable';
+    })();
+    try { await entry.stopping; } catch (error) { entry.stopping = null; throw error; }
+  }
+
+  async function start(signal) {
+    if (active && state === 'ready' && !active.closed) return active;
+    if (active) await stopEntry(active);
+    const local = await ensureEmbeddingModel({ approved: false, signal });
+    if (local.state !== 'ready') fail('Download the local embedding model to enable semantic search', 'CTX_EMBEDDING_MODEL_REQUIRED');
+    const port = await allocateLoopbackPort(); check(signal);
+    const entry = { baseURL: `http://127.0.0.1:${port}`, token: randomBytes(32).toString('hex'), child: null, closed: false, failure: null, locked: false };
+    try {
+      if (modelStore) {
+        const stored = await modelStore.inspect(MODEL_ID);
+        if (stored) {
+          if (stored.sha256 !== digest || stored.state !== 'ready') fail('Registered embedding model is not ready or has another digest', 'CTX_EMBEDDING_HASH');
+          await modelStore.lock(MODEL_ID); entry.locked = true;
+        }
+      }
+      check(signal);
+      entry.child = processPolicy.spawn(binaryPath, [
+        '-m', modelPath, '--alias', MODEL_ID, '--host', '127.0.0.1', '--port', String(port), '--api-key', entry.token,
+        '--embedding', '--pooling', 'last', '-ngl', '0', '--device', 'none', '-c', '8192', '-b', '8192', '-ub', '8192',
+        '--parallel', '1', '--threads', '2', '--threads-batch', '2', '--no-webui',
+      ], { cwd: dirname(binaryPath), shell: false, windowsHide: true, stdio: ['ignore', 'pipe', 'pipe'] });
+      if (!entry.child || typeof entry.child.once !== 'function') fail('Embedding process did not start', 'CTX_EMBEDDING_PROCESS');
+      entry.completion = new Promise(resolve => entry.child.once('close', () => { entry.closed = true; if (active === entry) state = 'failed'; resolve(); }));
+      entry.child.on('error', () => { entry.failure = true; if (active === entry) state = 'failed'; });
+      // Drain diagnostic output without persisting prompt text or credentials.
+      entry.child.stdout?.resume?.(); entry.child.stderr?.resume?.();
+      active = entry; state = 'loading';
+      const startupSignal = scopedSignal(signal, HEALTH_TIMEOUT);
+      while (!startupSignal.aborted) {
+        if (entry.closed || entry.failure) fail('Embedding process exited before becoming ready', 'CTX_EMBEDDING_PROCESS');
+        try {
+          const result = await jsonRequest(entry, '/health', { method: 'GET' }, startupSignal, 2000);
+          if (result?.status !== 'ok') fail('Embedding health response is invalid', 'CTX_EMBEDDING_HEALTH');
+          if (entry.closed || entry.failure) fail('Embedding process exited during health probe', 'CTX_EMBEDDING_PROCESS');
+          check(signal); state = 'ready'; return entry;
+        } catch (error) {
+          if (!['CTX_EMBEDDING_HEALTH', 'CTX_EMBEDDING_HTTP'].includes(error?.code) && error?.name !== 'TypeError' && error?.name !== 'TimeoutError') throw error;
+        }
+        await pause(100, startupSignal);
+      }
+      throw startupSignal.reason;
+    } catch (error) { await stopEntry(entry); throw translate(error, signal); }
+  }
+
+  async function embedContextBatch({ texts, kind, signal } = {}) {
+    check(signal);
+    if (!Array.isArray(texts) || texts.length > 32 || !['query', 'document'].includes(kind)
+      || [...texts].some(text => typeof text !== 'string' || !text.trim() || !text.isWellFormed() || Buffer.byteLength(text, 'utf8') > 7680)
+      || texts.reduce((sum, text) => sum + Buffer.byteLength(text, 'utf8'), 0) > 32768) fail('Embedding input must contain at most 32 bounded text passages', 'CTX_EMBEDDING_INVALID');
+    if (texts.length === 0) return [];
+    if (running) fail('Another embedding request is active', 'CTX_EMBEDDING_BUSY');
+    check(signal); running = true;
+    try {
+      if (typeof processPolicy.isChatBusy === 'function' && await processPolicy.isChatBusy()) fail('Embedding yields to active chat', 'CTX_EMBEDDING_BUSY');
+      const entry = await start(signal);
+      if (typeof processPolicy.isChatBusy === 'function' && await processPolicy.isChatBusy()) fail('Embedding yields to active chat', 'CTX_EMBEDDING_BUSY');
+      const input = texts.map(text => kind === 'query' ? `Instruct: ${QUERY_INSTRUCTION}\nQuery: ${text}` : text);
+      const response = await jsonRequest(entry, '/v1/embeddings', { method: 'POST', body: JSON.stringify({ model: MODEL_ID, input, encoding_format: 'float' }) }, signal);
+      check(signal);
+      if (!Array.isArray(response?.data) || response.data.length !== texts.length) fail('Embedding response has the wrong batch shape', 'CTX_EMBEDDING_RESPONSE');
+      const vectors = new Array(texts.length);
+      for (const row of response.data) {
+        if (!Number.isSafeInteger(row?.index) || row.index < 0 || row.index >= texts.length || vectors[row.index] !== undefined
+          || !Array.isArray(row.embedding) || row.embedding.length !== PROFILE.dimensions || [...row.embedding].some(value => typeof value !== 'number' || !Number.isFinite(value))) fail('Embedding response has invalid indexes, dimensions or values', 'CTX_EMBEDDING_RESPONSE');
+        vectors[row.index] = [...row.embedding];
+      }
+      return vectors;
+    } catch (error) {
+      if (signal?.aborted || closed || error?.name === 'TimeoutError') await stopEntry(active);
+      throw translate(error, signal);
+    } finally { running = false; }
+  }
+
+  async function health() {
+    if (closed) return { ready: false, state: 'closed', profileId, profile: { ...profile } };
+    let ready = false;
+    if (active && state === 'ready' && !active.closed && !active.failure) {
+      try { ready = (await jsonRequest(active, '/health', { method: 'GET' }, undefined, 2000))?.status === 'ok'; } catch { ready = false; }
+    }
+    return { ready, state: ready ? 'ready' : state === 'ready' ? 'unavailable' : state, profileId, profile: { ...profile } };
+  }
+
+  async function close() {
+    if (closed && !active) return;
+    closed = true; lifetime.abort(); state = 'closed'; verified = null;
+    await stopEntry(active);
+  }
+
+  return Object.freeze({ ensureEmbeddingModel, embedContextBatch, health, close });
+}

package/vendor/harness-ui/src/context-inference-scheduler.mjs

@@ -0,0 +1,81 @@
+const fault = (code, message) => Object.assign(new Error(message), { code });
+
+/** Serializes inference, not process/tool execution. A lease lasts until the
+ * operation settles, including complete stream consumption by its caller. */
+export function createContextInferenceScheduler() {
+  const resources = new Map();
+  let closed = false, closing;
+  function pump(resource, queue) {
+    if (queue.active || closed) return;
+    const index = queue.pending.findIndex(entry => entry.priority === 'chat');
+    const entry = queue.pending.splice(index < 0 ? 0 : index, 1)[0];
+    if (!entry) { resources.delete(resource); return; }
+    queue.active = entry;
+    entry.done = (async () => {
+      try {
+        entry.controller.signal.throwIfAborted();
+        const result = await entry.operation(entry.controller.signal);
+        if (entry.controller.signal.aborted) {
+          const reason = entry.controller.signal.reason;
+          if (reason && result?.usage !== undefined) reason.usage = result.usage;
+          throw reason;
+        }
+        entry.resolve(result);
+      } catch (error) {
+        const reason = entry.controller.signal.aborted ? entry.controller.signal.reason : error;
+        if (reason && error?.usage !== undefined) reason.usage = error.usage;
+        entry.reject(reason);
+      } finally {
+        entry.signal?.removeEventListener('abort', entry.abort);
+        queue.active = null;
+        if (closed) resources.delete(resource);
+        else pump(resource, queue);
+      }
+    })();
+  }
+  return Object.freeze({
+    run({ resource, priority, signal } = {}, operation) {
+      if (closed) return Promise.reject(fault('CTX_SCHEDULER_CLOSED', 'Il pianificatore delle inferenze è chiuso.'));
+      if (typeof resource !== 'string' || !resource.trim() || !['chat', 'background'].includes(priority) || typeof operation !== 'function') return Promise.reject(fault('CTX_RESOURCE_INVALID', 'Risorsa o priorità di inferenza non valida.'));
+      if (signal?.aborted) return Promise.reject(signal.reason);
+      let queue = resources.get(resource);
+      if (!queue) { queue = { active: null, pending: [] }; resources.set(resource, queue); }
+      return new Promise((resolve, reject) => {
+        const entry = { priority, operation, signal, resolve, reject, controller: new AbortController() };
+        entry.abort = () => {
+          entry.controller.abort(signal.reason);
+          if (queue.active !== entry) {
+            const index = queue.pending.indexOf(entry);
+            if (index >= 0) queue.pending.splice(index, 1);
+            signal.removeEventListener('abort', entry.abort);
+            reject(signal.reason);
+          }
+        };
+        signal?.addEventListener('abort', entry.abort, { once: true });
+        queue.pending.push(entry);
+        if (priority === 'chat' && queue.active?.priority === 'background') queue.active.controller.abort(fault('CTX_RESOURCE_BUSY', 'La sintesi lascia la risorsa alla chat. I segmenti già verificati restano salvati.'));
+        pump(resource, queue);
+      });
+    },
+    getState() {
+      return [...resources].map(([resource, queue]) => ({ resource, active: queue.active?.priority ?? null, queuedChat: queue.pending.filter(e => e.priority === 'chat').length, queuedBackground: queue.pending.filter(e => e.priority === 'background').length }));
+    },
+    close() {
+      if (closing) return closing;
+      closed = true;
+      const active = [];
+      for (const [resource, queue] of resources) {
+        for (const entry of queue.pending.splice(0)) {
+          entry.signal?.removeEventListener('abort', entry.abort);
+          entry.reject(fault('CTX_SCHEDULER_CLOSED', 'Il pianificatore delle inferenze è chiuso.'));
+        }
+        if (queue.active) {
+          if (queue.active.priority === 'background') queue.active.controller.abort(fault('CTX_SCHEDULER_CLOSED', 'Sintesi fermata durante la chiusura.'));
+          active.push(queue.active.done);
+        } else resources.delete(resource);
+      }
+      closing = Promise.allSettled(active).then(() => undefined);
+      return closing;
+    },
+  });
+}