fix(search): honor per-call source_id/all_sources in the search op — the #1484 hint's advised retry was silently ignored

The zero-hit CLI hint tells users to retry with --source-id __all__, which
works for `query` (routes through resolveRequestedScope) but the `search`
op had no source_id/all_sources params: the flag parsed into params, nothing
consumed it, and the retry re-ran the same single-source search — an
invisible false negative whose params.source_id also suppressed the hint on
the retry. search now resolves per-call scope through the same canonical
fail-closed resolver as query (local __all__ spans the brain; remote
collapses to the caller's grant; out-of-grant source_id is denied).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/architecture/KEY_FILES.md

@@ -79,7 +79,7 @@ per-release `**vX.Y.Z:**` narration — CI enforces this
 - `docs/architecture/RETRIEVAL.md` + `docs/architecture/RETRIEVAL_MAXPOOL_INCIDENT.md` — retrieval-pipeline architecture reference + the named-thing-miss incident write-up (root cause, the five-layer fix, the eval that pins it).
 - `src/core/types.ts` extension + `src/core/operations.ts:search` + `src/core/import-file.ts` + `src/cli.ts` + `src/core/search/telemetry.ts` — the wiring layer for the retrieval cathedral. `SearchResult` gains `evidence`, `create_safety`, `title_match_boost`, `alias_hit` (all optional; evidence/create_safety reference the union types in `evidence.ts`). The `search` MCP op uses a cheap-hybrid path by default and accepts a per-call `mode` (conservative|balanced|tokenmax) honored ONLY for trusted/local callers (`resolvePerCallMode(ctx, ...)` — remote callers use the configured mode so a remote provider can't force tokenmax spend); every search path stamps evidence fail-soft. `importFromContent` projects frontmatter `aliases:` into `page_aliases` via `normalizeAliasList` + `engine.setPageAliases` so new + changed pages register aliases at ingest. `src/cli.ts` adds the `gbrain search diagnose` dispatch (lazy import) and reconciles the `search` CLI path with the cheap-hybrid op. `src/core/search/telemetry.ts` extends the rollup with the rank-1 base_score drift signal (sum/count + 3 coarse buckets, aggregate not per-query), surfaced via `gbrain search stats`, backed by migration v111's `search_telemetry` columns. Tests: `test/cli-search-dispatch.test.ts`, `test/search/per-call-mode.test.ts`, `test/search/telemetry-rank1.test.ts`, `test/search/title-boost-stage.test.ts`, `test/search/alias-hop.test.ts`, `test/search/evidence.test.ts`, `test/search/searchvector-maxpool.test.ts`, `test/search/pre-migration-failopen.test.ts`.
 - `src/commands/eval.ts` — `gbrain eval` command: single-run table + A/B config comparison. Sub-subcommand dispatch on `args[0]` routes `gbrain eval export` + `gbrain eval prune` + `gbrain eval replay` into session-capture handlers; bare `gbrain eval --qrels …` fall-through preserves the legacy IR-metrics flow. `gbrain eval cross-modal` is in the dispatch (the user-facing path is the cli.ts no-DB branch — `src/commands/eval.ts:cross-modal` only fires when callers re-enter with an existing engine).
-- `src/commands/eval-cross-modal.ts` — multi-model quality gate. Three different-provider frontier models score the OUTPUT against the TASK on a 5-dim list. Verdict `pass` (exit 0) / `fail` (exit 1) / `inconclusive` (exit 2; <2/3 model successes). Reuses `src/core/ai/gateway.ts:chat()` so config/auth/aliasing comes from the gateway recipe registry — no parallel provider stack. Self-configures the gateway via `buildGatewayConfig(loadConfig() ?? {})` since the cli.ts dispatch bypasses `connectEngine()`, so file-plane keys, env base URLs, and provider_chat_options follow the same adapter path as runtime. Default cycles 3 in TTY, 1 in non-TTY (partial cost guardrail) via the shared `resolveCycleDefault(explicit, isTty)` in `src/core/eval/cycle-default.ts`; the cost-estimate banner appends `cycleDefaultSuffix(...)` (`for 1 cycle(s) (non-interactive default; --cycles N for more)`) when the value is the silent non-TTY fallback, so the 1-vs-3 difference isn't hidden. Receipts land at `gbrainPath('eval-receipts')/<slug>-<sha8-of-output>.json`. `--batch <jsonl> [--limit N] [--concurrent N] [--max-usd FLOAT] [--yes]` fans out cross-modal scoring across a LongMemEval-shape JSONL; mutually exclusive with `--task` (fail-fast usage error if both set); filters `kind: "by_type_summary"` rows; pre-flight cost estimate refuses if `> --max-usd` without `--yes` (default cap 5.00 USD). Semaphore-bounded fan-out via inline `runWithLimit<T>(items, limit, fn)` (exported for unit tests): max N questions in-flight × 3 model slots = ceiling of 3N parallel API calls (default `--concurrent 3` → 9). Per-question receipts land in a per-batch tempdir and are deleted at end of run; the summary receipt inlines per-question verdicts as JSON, not file paths. Exit precedence (batch-level policy, NOT inherited from aggregate.ts): ERROR > FAIL > INCONCLUSIVE > PASS. DI seam: `runEvalCrossModal(args, opts?: {runEval?: typeof runEval})` mirrors `runEvalLongMemEval(args, {client?})`; tests pass `opts.runEval` to bypass real LLM calls AND the gateway availability check. Pinned by `test/eval-cross-modal-batch.test.ts`.
+- `src/commands/eval-cross-modal.ts` — multi-model quality gate. Three different-provider frontier models score the OUTPUT against the TASK on a 5-dim list. Verdict `pass` (exit 0) / `fail` (exit 1) / `inconclusive` (exit 2; <2/3 model successes). Reuses `src/core/ai/gateway.ts:chat()` so config/auth/aliasing comes from the gateway recipe registry — no parallel provider stack. Self-configures the gateway (`configureGateway(loadConfig() + process.env)`) since the cli.ts dispatch bypasses `connectEngine()`. Default cycles 3 in TTY, 1 in non-TTY (partial cost guardrail) via the shared `resolveCycleDefault(explicit, isTty)` in `src/core/eval/cycle-default.ts`; the cost-estimate banner appends `cycleDefaultSuffix(...)` (`for 1 cycle(s) (non-interactive default; --cycles N for more)`) when the value is the silent non-TTY fallback, so the 1-vs-3 difference isn't hidden. Receipts land at `gbrainPath('eval-receipts')/<slug>-<sha8-of-output>.json`. `--batch <jsonl> [--limit N] [--concurrent N] [--max-usd FLOAT] [--yes]` fans out cross-modal scoring across a LongMemEval-shape JSONL; mutually exclusive with `--task` (fail-fast usage error if both set); filters `kind: "by_type_summary"` rows; pre-flight cost estimate refuses if `> --max-usd` without `--yes` (default cap 5.00 USD). Semaphore-bounded fan-out via inline `runWithLimit<T>(items, limit, fn)` (exported for unit tests): max N questions in-flight × 3 model slots = ceiling of 3N parallel API calls (default `--concurrent 3` → 9). Per-question receipts land in a per-batch tempdir and are deleted at end of run; the summary receipt inlines per-question verdicts as JSON, not file paths. Exit precedence (batch-level policy, NOT inherited from aggregate.ts): ERROR > FAIL > INCONCLUSIVE > PASS. DI seam: `runEvalCrossModal(args, opts?: {runEval?: typeof runEval})` mirrors `runEvalLongMemEval(args, {client?})`; tests pass `opts.runEval` to bypass real LLM calls AND the gateway availability check. Pinned by `test/eval-cross-modal-batch.test.ts`.
 - `src/core/eval/cycle-default.ts` — single source of truth for the eval cycle-count default. Exports `DEFAULT_CYCLES_TTY = 3`, `DEFAULT_CYCLES_NONTTY = 1`, `resolveCycleDefault(explicit, isTty): {cycles, usedNonTtyDefault}`, and `cycleDefaultSuffix(r)` (returns ` (non-interactive default; --cycles N for more)` only when the non-TTY default was applied, else `''`). Consumed by `eval-cross-modal.ts`, `eval-takes-quality.ts` (run + regress), and `takes-quality-eval/runner.ts` (core uses only the constant — library stays TTY-agnostic; the CLI owns the TTY=3 upgrade + banner annotation). `eval-suspected-contradictions.ts` applies the same transparency to its `$5`/`$1` budget default via a `budgetUsdExplicit` flag (the budget is overwritten in-place so explicitness can't be inferred post-hoc). Not shared with `resolveWorkersWithClamp` (different domain, no engine, no dedup). Pinned by `test/eval/cycle-default.test.ts`, `test/eval-suspected-contradictions-budget-default.test.ts`.
 - `src/core/cross-modal-eval/json-repair.ts` — `parseModelJSON(raw)` named export with a 4-strategy fallback chain (direct parse → fence-strip → trailing-comma + single-quote + embedded-newline repair → regex nuclear option). Adversarial input throws rather than fabricating scores — the aggregator treats a throw as "this model contributed nothing this cycle" so the gate stays correct at >=2/3 successes.
 - `src/core/cross-modal-eval/aggregate.ts` — pure verdict logic. Pass criterion: `(successes >= 2) AND (every dim mean >= 7) AND (every dim min across models >= 5)`. Inconclusive when <2/3 models returned parseable scores (regression guard for the v1 `Object.values({}).every(...) === true` empty-array PASS bug).
@@ -138,7 +138,7 @@ per-release `**vX.Y.Z:**` narration — CI enforces this
 - `src/core/minions/queue.ts` extension — `MinionQueue.add()` rejects `subagent` jobs whose `data.model` resolves via `isAnthropicProvider()` to a non-Anthropic provider. Lazy-imports `model-config.ts` to avoid pulling engine types into queue's eager-load surface. Layer 1 of the three-layer subagent provider enforcement (layers 2+3: `model-config.ts:enforceSubagentAnthropic` runtime fallback + `src/commands/doctor.ts` `subagent_provider` check). Pinned by `test/agent-cli.test.ts`.
 - `src/commands/models.ts` — `gbrain models [--json]` read-only routing dashboard: prints tier defaults (`utility`/`reasoning`/`deep`/`subagent`), the resolved value for each (re-walking the resolution chain), every per-task override (11 `PER_TASK_KEYS`: `models.dream.synthesize`, `models.dream.patterns`, `models.drift`, `models.auto_think`, `models.think`, `models.subagent`, `facts.extraction_model`, `models.eval.longmemeval`, `models.expansion`, `models.chat`, `models.dream.synthesize_verdict`), the alias map, and a source-of-truth column (`default` / `config: <key>` / `env: <VAR>`). `gbrain models doctor [--skip=<provider>] [--json]` fires a 1-token `gateway.chat()` probe against each configured chat + expansion model and classifies failures into `{model_not_found, auth, rate_limit, network, unknown}`. Wired into `cli.ts` dispatch + `CLI_ONLY` set. A zero-token `embedding_config` probe runs FIRST, before any chat/expansion probes spend money: `probeEmbeddingConfig()` reads `getEmbeddingModel()` + `getEmbeddingDimensions()` and (for Voyage flexible-dim models) checks `isValidVoyageOutputDim(dims)` against `VOYAGE_VALID_OUTPUT_DIMS`. `ProbeStatus` variant `'config'` + optional `fix?: string` on `ProbeResult` surface a paste-ready `gbrain config set ...` line in human + JSON output; touchpoint label `'embedding_config'` joins `'chat'` and `'expansion'`.
 - `src/core/init-embed-check.ts` — embedding-key validation at `gbrain init`. `runInitEmbedCheck(opts)` runs a config-only `diagnoseEmbedding` (catches a missing key for ANY provider) plus a best-effort `liveTestEmbed` (1-token `gateway.embed(['probe'], {inputType:'query', abortSignal})`, 5s `AbortController` timeout, never throws — catches an invalid/expired key). Loud warning to stderr; init still exits 0 (`--no-embedding` is the deferred-setup escape; `--skip-embed-check` / `GBRAIN_INIT_SKIP_EMBED_CHECK=1` skip the check). Builds the effective env (`process.env` + file-plane `openai/anthropic/zeroentropy_api_key` from `loadConfigFileOnly()` + `opts.apiKey`) and configures the gateway via `buildGatewayConfig` before diagnose/probe, so the check sees the same keys AND provider base URLs runtime will (no false "missing key" for config.json-keyed users; the probe hits the right endpoint). Init-specific warning text names `--no-embedding` / `--skip-embed-check`, not the sync-flavored `--no-embed`. Wired into `initPGLite` + `initPostgres` in `src/commands/init.ts`, with the result added to the `--json` envelope as `embedding_check {ok, reason?, live_ok?}`. Pinned by `test/init-embed-check.test.ts` (hermetic via the gateway embed-transport seam + `withEnv`).
-- `src/core/ai/build-gateway-config.ts` — `buildGatewayConfig(c: GBrainConfig): AIGatewayConfig`, extracted from `src/cli.ts` (which re-exports it for back-compat). Single owner of translating stored config into gateway config — consumed by CLI runtime, init (`gbrain init`'s three configureGateway sites), `init-embed-check.ts`, the eval commands (cross-modal, takes-quality), provider diagnostics, and the in-process migration path. Folds file-plane API keys (openai/anthropic/zeroentropy/openrouter) into the gateway env and threads local-server `*_BASE_URL` env vars into base_urls; caller-provided `provider_base_urls` config wins over env base URLs. `process.env` wins EXCEPT empty-string / undefined values are dropped before the merge, so an injected empty `ANTHROPIC_API_KEY=''` (Claude Code neuters subprocess LLM calls this way) can't clobber a valid config-plane key; `'0'` / `'false'` are preserved. Pinned by `test/ai/build-gateway-config.test.ts`.
+- `src/core/ai/build-gateway-config.ts` — `buildGatewayConfig(c: GBrainConfig): AIGatewayConfig`, extracted from `src/cli.ts` (which re-exports it for back-compat). Lets core modules (`init-embed-check.ts`) reuse it without importing the CLI entrypoint. Single owner of folding file-plane API keys (openai/anthropic/zeroentropy) into the gateway env and threading local-server `*_BASE_URL` env vars into base_urls. `process.env` wins EXCEPT empty-string / undefined values are dropped before the merge, so an injected empty `ANTHROPIC_API_KEY=''` (Claude Code neuters subprocess LLM calls this way) can't clobber a valid config-plane key; `'0'` / `'false'` are preserved. Pinned by `test/ai/build-gateway-config.test.ts`.
 - `src/commands/doctor.ts` extension — `subagent_provider` check (layer 3 of 3). Warns when `models.tier.subagent` is explicitly set non-Anthropic (message names the bad value + paste-ready fix `gbrain config set models.tier.subagent anthropic:claude-sonnet-4-6`); also warns when `models.default` would sneak `subagent` into a non-Anthropic provider via tier inheritance. OK when subagent tier resolves to Anthropic. Tests in `test/doctor.test.ts`.
 - `src/core/skill-trigger-index.ts` — Shared loader that unions per-skill SKILL.md frontmatter `triggers:` with curated RESOLVER.md / AGENTS.md rows from `skillsDir` AND the parent dir (preserves the OpenClaw workspace-root layout). UNION semantics: explicit RESOLVER.md rows ADD to frontmatter triggers (don't replace). Dedup keyed on `(skillPath, trigger.trim().toLowerCase())`. Three consumers fold through this primitive — `checkResolvable`, `runRoutingEvalCli`, `mounts-cache.composeResolvers` — so fixing frontmatter reaches all of them. Exports `loadSkillTriggerIndex(skillsDir): SkillTriggerEntry[]`, `entriesToResolverContent(entries): string` (synthesizes a markdown-table resolver string for `runRoutingEval`'s string-content API), `findPrimaryResolverPath(skillsDir): string | null`, the `FRONTMATTER_SECTION` constant, and `_resetWarnedSkillsForTests`. Skip rules: non-directory entries, `_*`/`.*` prefixes, `conventions/`+`migrations/` subdirs, skills with no `SKILL.md` (deprecated `install/` graceful-skipped), no `triggers:` array, or malformed YAML (warn-once + skip). Reuses `parseSkillFrontmatter` from `src/core/skill-frontmatter.ts` (regex-based, not full YAML). Pinned by `test/skill-trigger-index.test.ts` (18 hermetic cases). CI gate `bun run check:resolver` (= `bun src/cli.ts check-resolvable --strict --skills-dir skills/`) wired into `bun run verify`.
 - `src/core/skill-catalog.ts` — host-repo skill catalog backing the MCP `list_skills` / `get_skill` ops. Lets a thin MCP client (Codex desktop, Claude Code, Claude Cowork, Perplexity) DISCOVER + FOLLOW the agent repo's fat-markdown skills over `gbrain serve` — a skill is prose, so "using" one = fetching its body then calling the gbrain MCP tools the server already exposes. Read-scope, NOT localOnly (defensible only via the full mitigation stack): (1) **publish gate** — `assertPublishEnabled(ctx, publishSkills)`; remote callers require `mcp.publish_skills === true`, default-OFF so an upgrade never silently grants existing read tokens host-skill read; local callers (`ctx.remote === false`) always pass. (2) **path confinement** — `assertSkillNameShape` rejects separators/`..`/null/space before any FS access; the client `name` is a manifest LOOKUP KEY (via `loadOrDeriveManifest`), never a raw path segment; `confineManifestPath` does realpath + relative-containment + `SKILL.md`-regular-file check on EVERY entry (defeats poisoned manifest.json `path`, symlink/`..` escape). (3) **frontmatter allowlist** — `GetSkillResult.frontmatter` projects a safe subset; private `writes_to` + `sources` dropped. (4) **prose-only + 256KB cap** (`MAX_SKILL_MD_BYTES`, env `GBRAIN_MAX_SKILL_MD_BYTES`), size-checked twice (statSync + UTF-8 byte length). (5) **no install_path serve for remote** — remote callers use `autoDetectSkillsDir` (no install-path tier) so a hosted gbrain with no agent repo returns `storage_error`; local callers use `autoDetectSkillsDirReadOnly`. (6) MCP rate-limiter caps call rate. Config reads honor BOTH planes: `readMcpPublishSkills` / `readMcpSkillsDir` prefer the DB plane (`engine.getConfig`) over the file plane (`ctx.config.mcp`). Tool-honesty: `crossReferenceTools(declared, ctx)` splits a skill's declared `tools:` into `usable_tools` vs `unavailable_tools`; `buildSkillCatalog`'s `instructions` envelope (`SKILL_CATALOG_INSTRUCTIONS`) carries the "these are prose, follow-then-call-tools" protocol. Skills are host-filesystem repo-global — `sourceScopeOpts(ctx)` / `ctx.brainId` deliberately do NOT apply. `buildSkillCatalog` is resilient (one malformed/escaping skill is skipped, never throws). Config keys in `src/core/config.ts`: `GBrainConfig.mcp?: { publish_skills?, skills_dir? }` + `KNOWN_CONFIG_KEYS` entries `mcp.publish_skills`/`mcp.publish_skills_prompted`/`mcp.skills_dir` + `mcp.` prefix in `KNOWN_CONFIG_KEY_PREFIXES`. `src/commands/init.ts` writes `config.mcp = { publish_skills: true, ... }` for new installs (existing config wins on re-init). `src/commands/upgrade.ts:runPostUpgrade` adds a one-time consent prompt (gated by `mcp.publish_skills_prompted`; existing installs stay OFF until owner opts in). Two ops register in `src/core/operations.ts` (`list_skills` with optional `section` filter + `cliHints:{name:'skills'}`; `get_skill` taking `name` + `cliHints:{name:'skill', positional:['name']}`) and dynamically import this module to avoid the import cycle (skill-catalog statically imports the `operations` array). Descriptions in `src/core/operations-descriptions.ts` (`LIST_SKILLS_DESCRIPTION`, `GET_SKILL_DESCRIPTION`, `SKILL_CATALOG_INSTRUCTIONS`, `SKILL_CLIENT_GUIDANCE`), pinned by `test/operations-descriptions.test.ts`. CLI: `gbrain skills` / `gbrain skill <name>`. Pinned by `test/skill-catalog.test.ts`, `test/skill-catalog-security.test.ts` (path-confinement / poisoned-manifest / symlink-escape), `test/skill-catalog-transports.test.ts` (publish-gate + remote-vs-local) over `test/fixtures/skill-catalog/`.

src/cli.ts

@@ -466,6 +466,11 @@ async function main() {
     const result = JSON.parse(JSON.stringify(rawResult, bigintToStringReplacer));
     const output = formatResult(op.name, result);
     if (output) process.stdout.write(output);
+    // #1484 — invisible-miss hint: a bare query/search that hit zero results
+    // on a multi-source brain tells the user (stderr) which source it
+    // actually searched and how to widen the scope.
+    const hint = await sourceScopeHint(op.name, params, ctx.sourceId, engine, result);
+    if (hint) console.error(hint);
   } catch (e: unknown) {
     // v0.42.20.0 (codex D4): on error, set exitCode + return so the `finally`
     // STILL runs (drains every background-work sink + disconnects). A bare
@@ -837,6 +842,44 @@ async function makeContext(engine: BrainEngine, params: Record<string, unknown>)
   };
 }
 
+/**
+ * #1484 — a bare `gbrain query`/`search` silently scopes to the resolved
+ * source (usually 'default'); on a multi-source brain a zero-hit run looks
+ * identical to "the brain doesn't know this" even when the answer lives in
+ * another source. Returns a stderr hint when (a) the op is query/search,
+ * (b) it returned zero results, (c) the caller did NOT scope explicitly
+ * (--source / --source-id / --all-sources), and (d) the brain has >1
+ * registered source. Best-effort: any lookup failure returns null.
+ *
+ * Exported for tests (same import-safety contract as formatResult).
+ */
+export async function sourceScopeHint(
+  opName: string,
+  params: Record<string, unknown>,
+  sourceId: string,
+  engine: BrainEngine,
+  result: unknown,
+): Promise<string | null> {
+  if (opName !== 'query' && opName !== 'search') return null;
+  if (!Array.isArray(result) || result.length > 0) return null;
+  // Explicit scoping (flag tier) = user intent; don't second-guess it.
+  if (params.source || params.source_id || params.all_sources) return null;
+  if (sourceId === '__all__') return null;
+  try {
+    const rows = await engine.executeRaw<{ n: number }>(
+      `SELECT count(*)::int AS n FROM sources`,
+    );
+    const n = Number(rows[0]?.n ?? 0);
+    if (n <= 1) return null;
+    return (
+      `Hint: this brain has ${n} sources; you searched only "${sourceId}". ` +
+      `Retry with --source-id __all__ (all sources) or --source-id <id>.`
+    );
+  } catch {
+    return null; // hint is best-effort; never fail the query over it
+  }
+}
+
 // Exported for tests (same import-safety contract as cliAliases/printOpHelp).
 export function formatResult(opName: string, result: unknown): string {
   switch (opName) {

src/commands/eval-cross-modal.ts

@@ -21,8 +21,7 @@ import { join } from 'path';
 import { tmpdir } from 'os';
 import { createHash } from 'crypto';
 
-import { gbrainPath, loadConfig, type GBrainConfig } from '../core/config.ts';
-import { buildGatewayConfig } from '../core/ai/build-gateway-config.ts';
+import { gbrainPath, loadConfig } from '../core/config.ts';
 import { configureGateway, isAvailable } from '../core/ai/gateway.ts';
 import { runWithLimit } from '../core/worker-pool.ts';
 import { resolveCycleDefault, cycleDefaultSuffix } from '../core/eval/cycle-default.ts';
@@ -265,11 +264,32 @@ function isTTY(): boolean {
  * Returns true on success; false (and prints a hint) when no config is found.
  */
 function configureGatewayForCli(): boolean {
-  // Route through buildGatewayConfig (the single adapter seam) so file-plane
-  // API keys, env base URLs, and provider_chat_options follow the same
-  // precedence as the runtime path. No config file is fine — env alone serves.
   const config = loadConfig();
-  configureGateway(buildGatewayConfig(config ?? ({} as GBrainConfig)));
+  if (!config) {
+    // No config file is fine for the eval command — env vars alone may serve.
+    // We still call configureGateway so gateway recipes can read the env map.
+    configureGateway({
+      embedding_model: undefined,
+      embedding_dimensions: undefined,
+      expansion_model: undefined,
+      chat_model: undefined,
+      chat_fallback_chain: undefined,
+      base_urls: undefined,
+      provider_chat_options: undefined,
+      env: { ...process.env },
+    });
+    return true;
+  }
+  configureGateway({
+    embedding_model: config.embedding_model,
+    embedding_dimensions: config.embedding_dimensions,
+    expansion_model: config.expansion_model,
+    chat_model: config.chat_model,
+    chat_fallback_chain: config.chat_fallback_chain,
+    base_urls: config.provider_base_urls,
+    provider_chat_options: config.provider_chat_options,
+    env: { ...process.env },
+  });
   return true;
 }
 

src/commands/eval-takes-quality.ts

@@ -21,8 +21,7 @@
  */
 import type { BrainEngine } from '../core/engine.ts';
 import { configureGateway } from '../core/ai/gateway.ts';
-import { buildGatewayConfig } from '../core/ai/build-gateway-config.ts';
-import { loadConfig, type GBrainConfig } from '../core/config.ts';
+import { loadConfig } from '../core/config.ts';
 import { runEval, DEFAULT_MODEL_PANEL } from '../core/takes-quality-eval/runner.ts';
 import { resolveCycleDefault, cycleDefaultSuffix } from '../core/eval/cycle-default.ts';
 import { writeReceipt } from '../core/takes-quality-eval/receipt-write.ts';
@@ -128,12 +127,8 @@ export async function runReplayNoBrain(argv: string[]): Promise<number> {
 export async function runEvalTakesQuality(engine: BrainEngine, args: string[]): Promise<void> {
   // Self-configure the AI gateway (mirrors eval-cross-modal pattern). The
   // gateway needs config.ai_gateway + env vars; configureGateway reads both.
-  // Route through buildGatewayConfig: the old `{ ...cfg, ...process.env }`
-  // spread never populated the gateway's `env` field (the gateway NEVER reads
-  // process.env at call time), so availability checks saw no keys at all and
-  // file-plane API keys / provider base URLs were dropped.
   const cfg = loadConfig();
-  configureGateway(buildGatewayConfig(cfg ?? ({} as GBrainConfig)));
+  configureGateway({ ...cfg, ...(process.env as Record<string, string>) } as any);
 
   const { subcmd, argv, json } = parseSubcmd(args);
 

src/commands/init.ts

@@ -7,7 +7,6 @@ import { homedir } from 'os';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 import { saveConfig, loadConfig, loadConfigFileOnly, toEngineConfig, gbrainPath, configPath, isThinClient, effectiveEnvDatabaseUrl, type GBrainConfig } from '../core/config.ts';
-import { buildGatewayConfig } from '../core/ai/build-gateway-config.ts';
 import { createEngine } from '../core/engine-factory.ts';
 import { discoverOAuth, mintClientCredentialsToken, smokeTestMcp } from '../core/remote-mcp-probe.ts';
 import { runInitEmbedCheck } from '../core/init-embed-check.ts';
@@ -723,8 +722,7 @@ async function configureGatewayWithMergedPrecedence(
   // pollutes config.json.
   const envOverlay = loadConfig() ?? ({} as GBrainConfig);
 
-  const merged: GBrainConfig = {
-    ...envOverlay,
+  const merged = {
     embedding_model: aiOpts?.embedding_model ?? envOverlay.embedding_model ?? existingFile.embedding_model,
     embedding_dimensions: aiOpts?.embedding_dimensions ?? envOverlay.embedding_dimensions ?? existingFile.embedding_dimensions,
     expansion_model: aiOpts?.expansion_model ?? envOverlay.expansion_model ?? existingFile.expansion_model,
@@ -732,9 +730,13 @@ async function configureGatewayWithMergedPrecedence(
   };
 
   const { configureGateway, getEmbeddingModel, getEmbeddingDimensions, getExpansionModel, getChatModel } = await import('../core/ai/gateway.ts');
-  // buildGatewayConfig (the single adapter seam) so file-plane API keys and
-  // env base URLs reach the gateway — a hand-rolled config here dropped them.
-  configureGateway(buildGatewayConfig(merged));
+  configureGateway({
+    embedding_model: merged.embedding_model,
+    embedding_dimensions: merged.embedding_dimensions,
+    expansion_model: merged.expansion_model,
+    chat_model: merged.chat_model,
+    env: { ...process.env },
+  });
 
   // Read back resolved values — gateway applies internal defaults for unset
   // fields, so these are the values that actually shaped the schema.
@@ -829,13 +831,13 @@ async function initPGLite(opts: {
   // resolveAIOptions above: CLI flags > env vars > existing file > gateway
   // defaults.
   const { configureGateway } = await import('../core/ai/gateway.ts');
-  configureGateway(buildGatewayConfig({
-    ...(loadConfig() ?? ({} as GBrainConfig)),
+  configureGateway({
     embedding_model: resolvedModel ?? opts.aiOpts?.embedding_model,
     embedding_dimensions: resolvedDim ?? opts.aiOpts?.embedding_dimensions,
     expansion_model: opts.aiOpts?.expansion_model,
     chat_model: opts.aiOpts?.chat_model,
-  } as GBrainConfig));
+    env: { ...process.env },
+  });
   if (resolvedModel) console.log(`  Embedding: ${resolvedModel} (${resolvedDim}d)`);
   if (opts.aiOpts?.expansion_model) console.log(`  Expansion: ${opts.aiOpts.expansion_model}`);
   if (opts.aiOpts?.chat_model) console.log(`  Chat: ${opts.aiOpts.chat_model}`);
@@ -1044,13 +1046,13 @@ async function initPostgres(opts: {
 
   // T6: unconditional configureGateway BEFORE initSchema.
   const { configureGateway } = await import('../core/ai/gateway.ts');
-  configureGateway(buildGatewayConfig({
-    ...(loadConfig() ?? ({} as GBrainConfig)),
+  configureGateway({
     embedding_model: resolvedModel ?? opts.aiOpts?.embedding_model,
     embedding_dimensions: resolvedDim ?? opts.aiOpts?.embedding_dimensions,
     expansion_model: opts.aiOpts?.expansion_model,
     chat_model: opts.aiOpts?.chat_model,
-  } as GBrainConfig));
+    env: { ...process.env },
+  });
   if (resolvedModel) console.log(`  Embedding: ${resolvedModel} (${resolvedDim}d)`);
   if (opts.aiOpts?.expansion_model) console.log(`  Expansion: ${opts.aiOpts.expansion_model}`);
   if (opts.aiOpts?.chat_model) console.log(`  Chat: ${opts.aiOpts.chat_model}`);

src/commands/migrations/in-process.ts

@@ -66,11 +66,15 @@ export async function runMigrateOnlyCore(opts?: { timeoutMs?: number }): Promise
 
   // configureGateway BEFORE initSchema (init.ts B.3): a schema bump on a brain
   // whose file config is missing embedding fields must not fall through to
-  // stale hardcoded fallbacks. Route through buildGatewayConfig so file-plane
-  // API keys and provider base URLs follow the same precedence as runtime.
+  // stale hardcoded fallbacks. loadConfig already merged env; propagate it.
   const { configureGateway } = await import('../../core/ai/gateway.ts');
-  const { buildGatewayConfig } = await import('../../core/ai/build-gateway-config.ts');
-  configureGateway(buildGatewayConfig(config));
+  configureGateway({
+    embedding_model: config.embedding_model,
+    embedding_dimensions: config.embedding_dimensions,
+    expansion_model: config.expansion_model,
+    chat_model: config.chat_model,
+    env: { ...process.env },
+  });
 
   const timeoutMs = opts?.timeoutMs ?? MIGRATE_ONLY_TIMEOUT_MS;
   const engine = await createEngine(toEngineConfig(config));

src/core/ai/gateway.ts

@@ -1000,9 +1000,24 @@ const voyageCompatFetch = (async (input: RequestInfo | URL, init?: RequestInit)
   // Voyage diverges from OpenAI in two places that break the parser:
   //   - `embedding` is a base64 string (SDK schema expects `number[]`)
   //   - `usage` lacks `prompt_tokens` (SDK schema requires it when usage present)
+  //
+  // #1610: read the body ONCE via text() and JSON.parse it. The pre-fix
+  // `await resp.clone().json()` truncated large bodies on bun < 1.1.27
+  // (oven-sh/bun#6348) — the parse threw, the catch fell back to the raw
+  // response, and multi-chunk pages died with "Invalid JSON response".
+  // Every JSON return path below rebuilds the Response so a stale
+  // Content-Length/Content-Encoding header from the original can't lie
+  // about the rewritten body.
+  const bodyText = await resp.text();
+  const rebuild = (body: string) => {
+    const headers = new Headers(resp.headers);
+    headers.delete('content-length');
+    headers.delete('content-encoding');
+    return new Response(body, { status: resp.status, statusText: resp.statusText, headers });
+  };
   try {
-    const json: any = await resp.clone().json();
-    if (!json || typeof json !== 'object') return resp;
+    const json: any = JSON.parse(bodyText);
+    if (!json || typeof json !== 'object') return rebuild(bodyText);
     let modified = false;
     if (Array.isArray(json.data)) {
       for (const item of json.data) {
@@ -1037,22 +1052,19 @@ const voyageCompatFetch = (async (input: RequestInfo | URL, init?: RequestInit)
         : 0;
       modified = true;
     }
-    if (!modified) return resp;
-    return new Response(JSON.stringify(json), {
-      status: resp.status,
-      statusText: resp.statusText,
-      headers: resp.headers,
-    });
+    if (!modified) return rebuild(bodyText);
+    return rebuild(JSON.stringify(json));
   } catch (err) {
     // OOM-cap throws MUST propagate. The catch is here for "Voyage returned
     // JSON I can't reshape" (parse error, unexpected schema) — falling back
-    // to the original response is correct in that case. Letting the
+    // to the original body is correct in that case. Letting the
     // too-large response through here would defeat the entire purpose of
     // Layer 2 (the per-embedding cap that fires when Content-Length wasn't
     // available to Layer 1).
     if (err instanceof VoyageResponseTooLargeError) throw err;
-    // If parsing/transformation fails, fall back to the original response.
-    return resp;
+    // If parsing/transformation fails, pass the original body through
+    // (rebuilt — resp's body stream is already consumed by text()).
+    return rebuild(bodyText);
   }
 }) as unknown as typeof fetch;
 
@@ -1192,9 +1204,21 @@ const zeroEntropyCompatFetch = (async (input: RequestInfo | URL, init?: RequestI
   // validates. Also map usage.total_tokens → prompt_tokens (SDK requires
   // prompt_tokens when `usage` is present — same divergence Voyage hit at
   // gateway.ts:655).
+  //
+  // #1610: read the body ONCE via text() + JSON.parse — `resp.clone().json()`
+  // truncated large bodies on bun < 1.1.27 (oven-sh/bun#6348), so the parse
+  // threw and the catch fell back to the RAW ZE `{results: ...}` shape, which
+  // the AI SDK schema rejects → "Invalid JSON response" on multi-chunk pages.
+  const bodyText = await resp.text();
+  const rebuild = (body: string) => {
+    const headers = new Headers(resp.headers);
+    headers.delete('content-length');
+    headers.delete('content-encoding');
+    return new Response(body, { status: resp.status, statusText: resp.statusText, headers });
+  };
   try {
-    const json: any = await resp.clone().json();
-    if (!json || typeof json !== 'object') return resp;
+    const json: any = JSON.parse(bodyText);
+    if (!json || typeof json !== 'object') return rebuild(bodyText);
     let modified = false;
     if (Array.isArray(json.results) && !Array.isArray(json.data)) {
       // Layer 2 OOM cap — per-embedding size. ZE returns float[] arrays,
@@ -1228,20 +1252,25 @@ const zeroEntropyCompatFetch = (async (input: RequestInfo | URL, init?: RequestI
       // SDK also expects total_tokens; ZE provides it directly.
       modified = true;
     }
-    if (!modified) return resp;
-    return new Response(JSON.stringify(json), {
-      status: resp.status,
-      statusText: resp.statusText,
-      headers: resp.headers,
-    });
+    if (!modified) return rebuild(bodyText);
+    return rebuild(JSON.stringify(json));
   } catch (err) {
     // OOM-cap throws MUST propagate. Voyage's pattern: instanceof check on
     // its own tagged class. Same here — only rethrow our own cap class.
     if (err instanceof ZeroEntropyResponseTooLargeError) throw err;
-    return resp;
+    return rebuild(bodyText);
   }
 }) as unknown as typeof fetch;
 
+/**
+ * Test-only seams (#1610): the compat shims are module-private closures;
+ * exporting them lets tests drive the response-rewrite paths behaviorally
+ * (truncating clone(), stale Content-Length) without a live provider.
+ * Same pattern as __getShrinkStateForTests.
+ */
+export const __voyageCompatFetchForTests = voyageCompatFetch;
+export const __zeroEntropyCompatFetchForTests = zeroEntropyCompatFetch;
+
 /**
  * Generic asymmetric-embedding shim for openai-compatible recipes that
  * ship no compat fetch of their own (llama-server, litellm, ollama, ...).

src/core/brain-score-recommendations.ts

@@ -12,8 +12,8 @@ import { parseModelId } from './ai/model-resolver.ts';
  * `resolveKey` closure without re-parsing recipes.
  *
  * Only OPENAI_API_KEY and ZEROENTROPY_API_KEY appear here because those are the
- * only embedding keys `buildGatewayConfig` (src/core/ai/build-gateway-config.ts)
- * folds from config into the gateway env. VOYAGE_API_KEY / GOOGLE_GENERATIVE_AI_API_KEY are deliberately
+ * only embedding keys `buildGatewayConfig` (src/cli.ts) folds from config into
+ * the gateway env. VOYAGE_API_KEY / GOOGLE_GENERATIVE_AI_API_KEY are deliberately
  * absent: their config fields are NOT threaded to the gateway today, so the
  * producer closures fall through to checking `process.env` ONLY for them. That
  * matches what the gateway can actually use (the recipes read those keys from

src/core/operations.ts

@@ -499,7 +499,7 @@ export function linkReadScopeOpts(ctx: OperationContext): { sourceId?: string; s
  * FAIL-CLOSED: anything not strictly `ctx.remote === false` is untrusted.
  *
  * This is the SINGLE resolver for every read op that accepts a per-call
- * `source_id` / `all_sources` parameter (query, code_callers, code_callees,
+ * `source_id` / `all_sources` parameter (query, search, code_callers, code_callees,
  * get_page, search_by_image, code_blast, code_flow). Inlining the `__all__`
  * branch per handler is the bug class that leaked cross-source reads (#1924,
  * #1371): a remote client could pass `source_id: '__all__'` to opt out of its
@@ -1442,13 +1442,24 @@ const search: Operation = {
     limit: { type: 'number', description: 'Max results (default 20)' },
     offset: { type: 'number', description: 'Skip first N results (for pagination)' },
     mode: { type: 'string', description: 'Search mode (conservative|balanced|tokenmax). Local callers only.' },
+    source_id: {
+      type: 'string',
+      description:
+        "Scope search to a single source. Defaults to OperationContext.sourceId. Pass '__all__' to span every source for trusted local callers; for remote callers '__all__' spans only your granted sources.",
+    },
+    all_sources: { type: 'boolean', description: "Span sources (equivalent to source_id=__all__): every source locally, your grant remotely." },
   },
   handler: async (ctx, p) => {
     const startedAt = Date.now();
     const queryText = p.query as string;
     const limit = (p.limit as number) || 20;
     const offset = (p.offset as number) || 0;
-    const scope = sourceScopeOpts(ctx);
+    // #1484 follow-up: route through the canonical fail-closed resolver so
+    // `--source-id __all__` / `all_sources` behave the same as on `query`
+    // (the zero-hit CLI hint advises exactly that retry). Without a per-call
+    // param, `search` silently ignored --source-id — the retry looked like
+    // a genuine miss.
+    const scope = resolveRequestedScope(ctx, p.source_id as string | undefined, p.all_sources === true);
 
     // T4/D5 — per-call mode honored ONLY for trusted/local callers so a remote
     // OAuth client can't escalate to the costly tokenmax bundle. Local + unknown

src/core/search/hybrid.ts

@@ -1323,8 +1323,18 @@ export async function hybridSearch(
       if (effectiveModality === 'both' && imageVectorList !== null) {
         vectorLists = [...vectorLists, imageVectorList];
       }
-    } catch {
-      // Embedding failure is non-fatal, fall back to keyword-only
+    } catch (err) {
+      // Embedding/vector failure is non-fatal — fall back to keyword-only —
+      // but say WHY (#1626): this arm only runs when the embedding provider
+      // probed available, so a throw here is a real failure (embed timeout,
+      // transient pooler error on the searchVector fan-out). Pre-fix the bare
+      // catch made a cross-source `--source __all__` run silently collapse to
+      // keyword-only/"No results" with zero diagnostics.
+      warnOncePerProcess(
+        'hybrid-vector-arm-failed',
+        `[gbrain] vector arm failed (fail-open, keyword-only fallback): ` +
+          `${err instanceof Error ? err.message : String(err)}`,
+      );
     }
   }
 

test/ai/build-gateway-config.test.ts

@@ -25,7 +25,6 @@ import { withEnv } from '../helpers/with-env.ts';
 
 const PASSTHROUGHS: Array<{ envVar: string; recipeId: string }> = [
   { envVar: 'LLAMA_SERVER_BASE_URL', recipeId: 'llama-server' },
-  { envVar: 'LLAMA_SERVER_RERANKER_BASE_URL', recipeId: 'llama-server-reranker' },
   { envVar: 'OLLAMA_BASE_URL', recipeId: 'ollama' },
   { envVar: 'LMSTUDIO_BASE_URL', recipeId: 'lmstudio' },
   { envVar: 'LITELLM_BASE_URL', recipeId: 'litellm' },

test/ai/compat-fetch-body-read.serial.test.ts

@@ -0,0 +1,115 @@
+/**
+ * #1610 — Voyage/ZeroEntropy compat shims must read the response body ONCE
+ * via text() instead of `resp.clone().json()`.
+ *
+ * On bun < 1.1.27, Response.clone() truncates large bodies (oven-sh/bun#6348):
+ * the clone().json() parse threw, the shim's catch fell back to the ORIGINAL
+ * response — whose wire shape (ZE `{results: ...}`, Voyage base64 embeddings)
+ * the AI SDK's openai-compatible Zod schema rejects — and multi-chunk pages
+ * failed with "Invalid JSON response".
+ *
+ * These tests simulate the truncating clone() and assert the shims still
+ * return the fully rewritten body. They also pin that the rewritten Response
+ * does NOT carry the original (now stale) Content-Length header, which lied
+ * about the rewritten body's size (gateway.ts previously copied
+ * `headers: resp.headers` verbatim).
+ */
+
+import { afterEach, describe, expect, test } from 'bun:test';
+import {
+  __voyageCompatFetchForTests,
+  __zeroEntropyCompatFetchForTests,
+} from '../../src/core/ai/gateway.ts';
+
+const origFetch = globalThis.fetch;
+afterEach(() => {
+  globalThis.fetch = origFetch;
+});
+
+/** Build a Response whose clone() truncates the body (bun < 1.1.27 behavior). */
+function truncatingCloneResponse(body: string): Response {
+  const headers = {
+    'content-type': 'application/json',
+    // Deliberately stale after any rewrite: the original wire body's length.
+    'content-length': String(Buffer.byteLength(body)),
+  };
+  const resp = new Response(body, { status: 200, headers });
+  (resp as any).clone = () =>
+    new Response(body.slice(0, 32), { status: 200, headers });
+  return resp;
+}
+
+describe('voyageCompatFetch — single body read (#1610)', () => {
+  test('rewrites base64 embeddings even when clone() truncates the body', async () => {
+    const floats = new Float32Array([0.5, 0.25, -1]);
+    const b64 = Buffer.from(floats.buffer).toString('base64');
+    const wireBody = JSON.stringify({
+      object: 'list',
+      data: [{ object: 'embedding', embedding: b64, index: 0 }],
+      model: 'voyage-3',
+      usage: { total_tokens: 7 },
+    });
+    globalThis.fetch = (async () => truncatingCloneResponse(wireBody)) as unknown as typeof fetch;
+
+    const out = await __voyageCompatFetchForTests('https://api.voyageai.com/v1/embeddings', {
+      method: 'POST',
+      body: JSON.stringify({ input: ['hello'], model: 'voyage-3' }),
+      headers: { 'content-type': 'application/json' },
+    });
+
+    const json: any = await out.json();
+    expect(Array.from(json.data[0].embedding)).toEqual([0.5, 0.25, -1]);
+    expect(json.usage.prompt_tokens).toBe(7);
+    // Stale Content-Length from the wire body must not survive the rewrite.
+    expect(out.headers.get('content-length')).toBeNull();
+    expect(out.headers.get('content-encoding')).toBeNull();
+  });
+});
+
+describe('zeroEntropyCompatFetch — single body read (#1610)', () => {
+  test('rewrites {results} → {data} even when clone() truncates the body', async () => {
+    const wireBody = JSON.stringify({
+      results: [{ embedding: [0.1, 0.2] }, { embedding: [0.3, 0.4] }],
+      usage: { total_bytes: 42, total_tokens: 9 },
+    });
+    let fetchedUrl = '';
+    globalThis.fetch = (async (url: string | URL | Request) => {
+      fetchedUrl = String(url);
+      return truncatingCloneResponse(wireBody);
+    }) as unknown as typeof fetch;
+
+    const out = await __zeroEntropyCompatFetchForTests('https://api.zeroentropy.dev/v1/embeddings', {
+      method: 'POST',
+      body: JSON.stringify({ input: ['hello'], model: 'zembed-1' }),
+      headers: { 'content-type': 'application/json' },
+    });
+
+    expect(fetchedUrl.endsWith('/v1/models/embed')).toBe(true);
+    const json: any = await out.json();
+    // The AI SDK schema requires {data: [{embedding, index}]} — the raw ZE
+    // {results} fallback is exactly the pre-fix "Invalid JSON response".
+    expect(json.results).toBeUndefined();
+    expect(json.data).toHaveLength(2);
+    expect(json.data[0]).toEqual({ object: 'embedding', embedding: [0.1, 0.2], index: 0 });
+    expect(json.data[1].index).toBe(1);
+    expect(json.usage.prompt_tokens).toBe(9);
+    expect(out.headers.get('content-length')).toBeNull();
+  });
+
+  test('non-JSON body falls back to the original bytes (rebuilt, still readable)', async () => {
+    const wireBody = 'plain text, not json';
+    globalThis.fetch = (async () =>
+      new Response(wireBody, {
+        status: 200,
+        headers: { 'content-type': 'application/json' },
+      })) as unknown as typeof fetch;
+
+    const out = await __zeroEntropyCompatFetchForTests('https://api.zeroentropy.dev/v1/embeddings', {
+      method: 'POST',
+      body: JSON.stringify({ input: ['hello'] }),
+    });
+    // Body was consumed by the shim's single read; the fallback must
+    // rebuild a readable Response rather than return the drained original.
+    expect(await out.text()).toBe(wireBody);
+  });
+});

test/ai/zeroentropy-compat-fetch.test.ts

@@ -98,16 +98,18 @@ describe('zeroEntropyCompatFetch — OOM caps', () => {
     expect(src).toMatch(/MAX_ZEROENTROPY_RESPONSE_BYTES\s*=\s*256\s*\*\s*1024\s*\*\s*1024/);
   });
 
-  test('Layer 1: Content-Length pre-check before resp.clone().json()', async () => {
+  test('Layer 1: Content-Length pre-check before the body is read', async () => {
     const src = await Bun.file(GATEWAY_PATH).text();
     // Find the zeroEntropyCompatFetch block bounds, then assert ordering
-    // within it (mirroring the voyage cap test pattern).
+    // within it (mirroring the voyage cap test pattern). #1610 moved the
+    // body read from `resp.clone().json()` to a single `resp.text()` (bun
+    // < 1.1.27 truncates clone()d bodies, oven-sh/bun#6348).
     const zeFetchStart = src.indexOf('const zeroEntropyCompatFetch');
     expect(zeFetchStart).toBeGreaterThan(0);
-    const block = src.slice(zeFetchStart, zeFetchStart + 8000);
+    const block = src.slice(zeFetchStart, zeFetchStart + 9000);
 
     const preCheckIdx = block.indexOf("resp.headers.get('content-length')");
-    const jsonParseIdx = block.indexOf('await resp.clone().json()');
+    const jsonParseIdx = block.indexOf('const bodyText = await resp.text()');
     expect(preCheckIdx).toBeGreaterThan(0);
     expect(jsonParseIdx).toBeGreaterThan(0);
     // The pre-check MUST appear before the JSON parse — Voyage's lesson

test/cli-multimodal-integration.test.ts

@@ -11,13 +11,32 @@
 import { afterAll, beforeAll, beforeEach, describe, expect, test } from 'bun:test';
 import { PGLiteEngine } from '../src/core/pglite-engine.ts';
 import { loadConfigWithEngine, type GBrainConfig } from '../src/core/config.ts';
-import { buildGatewayConfig } from '../src/core/ai/build-gateway-config.ts';
 import {
   configureGateway,
   getEmbeddingModel,
   getMultimodalModel,
   resetGateway,
 } from '../src/core/ai/gateway.ts';
+import type { AIGatewayConfig } from '../src/core/ai/types.ts';
+
+// Mirror the cli.ts buildGatewayConfig helper exactly. Keeping a copy here
+// (instead of exporting from cli.ts) is intentional: the test asserts the
+// shape of the contract, not the helper's identity. If cli.ts drifts, the
+// e2e behavior these tests care about (DB-set value lands in gateway) still
+// holds, but a helper-shape test would also catch the drift in PR review.
+function buildGatewayConfig(c: GBrainConfig): AIGatewayConfig {
+  return {
+    embedding_model: c.embedding_model,
+    embedding_dimensions: c.embedding_dimensions,
+    embedding_multimodal_model: c.embedding_multimodal_model,
+    expansion_model: c.expansion_model,
+    chat_model: c.chat_model,
+    chat_fallback_chain: c.chat_fallback_chain,
+    base_urls: c.provider_base_urls,
+    provider_chat_options: c.provider_chat_options,
+    env: { ...process.env },
+  };
+}
 
 let engine: PGLiteEngine;
 
@@ -28,7 +47,6 @@ beforeAll(async () => {
 });
 
 afterAll(async () => {
-  resetGateway(); // don't leak this file's gateway config into shard siblings
   await engine.disconnect();
 });
 

test/cli-source-scope-hint.test.ts

@@ -0,0 +1,61 @@
+/**
+ * #1484 — invisible-miss hint. A bare `gbrain query` resolves to a single
+ * source (usually 'default'); on a multi-source brain a zero-hit run gave no
+ * signal that the answer might live in another source. sourceScopeHint
+ * returns the stderr hint exactly when: query/search op + zero results +
+ * no explicit scoping param + >1 registered source.
+ */
+
+import { describe, expect, test } from 'bun:test';
+import { sourceScopeHint } from '../src/cli.ts';
+import type { BrainEngine } from '../src/core/engine.ts';
+
+function fakeEngine(sourceCount: number, fail = false): BrainEngine {
+  return {
+    executeRaw: async () => {
+      if (fail) throw new Error('sources table missing');
+      return [{ n: sourceCount }];
+    },
+  } as unknown as BrainEngine;
+}
+
+describe('sourceScopeHint (#1484)', () => {
+  test('fires on a bare zero-hit query against a multi-source brain', async () => {
+    const hint = await sourceScopeHint('query', {}, 'default', fakeEngine(3), []);
+    expect(hint).toContain('3 sources');
+    expect(hint).toContain('"default"');
+    expect(hint).toContain('--source-id __all__');
+  });
+
+  test('fires for search too', async () => {
+    const hint = await sourceScopeHint('search', {}, 'wiki', fakeEngine(2), []);
+    expect(hint).toContain('"wiki"');
+  });
+
+  test('silent when results were found', async () => {
+    expect(await sourceScopeHint('query', {}, 'default', fakeEngine(3), [{ slug: 'a' }])).toBeNull();
+  });
+
+  test('silent when the caller scoped explicitly', async () => {
+    expect(await sourceScopeHint('query', { source_id: 'wiki' }, 'wiki', fakeEngine(3), [])).toBeNull();
+    expect(await sourceScopeHint('query', { source: 'wiki' }, 'wiki', fakeEngine(3), [])).toBeNull();
+    expect(await sourceScopeHint('query', { all_sources: true }, '__all__', fakeEngine(3), [])).toBeNull();
+  });
+
+  test('silent when the resolved scope is already __all__', async () => {
+    expect(await sourceScopeHint('query', {}, '__all__', fakeEngine(3), [])).toBeNull();
+  });
+
+  test('silent on a single-source brain', async () => {
+    expect(await sourceScopeHint('query', {}, 'default', fakeEngine(1), [])).toBeNull();
+  });
+
+  test('silent for non-search ops and non-array results', async () => {
+    expect(await sourceScopeHint('get_stats', {}, 'default', fakeEngine(3), [])).toBeNull();
+    expect(await sourceScopeHint('query', {}, 'default', fakeEngine(3), { rows: [] })).toBeNull();
+  });
+
+  test('best-effort: sources lookup failure returns null, never throws', async () => {
+    expect(await sourceScopeHint('query', {}, 'default', fakeEngine(3, true), [])).toBeNull();
+  });
+});

test/eval-takes-quality-gateway.test.ts

@@ -1,57 +0,0 @@
-/**
- * eval-takes-quality gateway self-config — adapter-boundary regression
- * (takeover of PR #2430).
- *
- * The old callsite spread `{ ...cfg, ...process.env }` straight into
- * configureGateway. The gateway NEVER reads process.env at call time — it
- * reads `_config.env` — and that spread never populated an `env` field at
- * all, so every availability/diagnose check dereferenced `undefined.env[k]`
- * and file-plane API keys (config.json `openai_api_key` etc.) were dropped.
- * Routing through buildGatewayConfig fixes both. This test fails (throws)
- * on the old code path.
- */
-import { afterAll, describe, expect, test } from 'bun:test';
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { runEvalTakesQuality } from '../src/commands/eval-takes-quality.ts';
-import { isAvailable, resetGateway } from '../src/core/ai/gateway.ts';
-import { withEnv } from './helpers/with-env.ts';
-import type { BrainEngine } from '../src/core/engine.ts';
-
-afterAll(() => {
-  resetGateway();
-});
-
-describe('runEvalTakesQuality — gateway self-config routes through buildGatewayConfig', () => {
-  test('file-plane openai_api_key reaches the gateway env (help path, engine untouched)', async () => {
-    const home = mkdtempSync(join(tmpdir(), 'gbrain-etq-gw-'));
-    try {
-      mkdirSync(join(home, '.gbrain'), { recursive: true });
-      writeFileSync(
-        join(home, '.gbrain', 'config.json'),
-        JSON.stringify({
-          engine: 'pglite',
-          database_path: join(home, '.gbrain', 'brain'),
-          openai_api_key: 'sk-file-plane-test',
-        }),
-      );
-      await withEnv(
-        {
-          GBRAIN_HOME: home,
-          OPENAI_API_KEY: undefined,
-          DATABASE_URL: undefined,
-          GBRAIN_DATABASE_URL: undefined,
-        },
-        async () => {
-          // 'help' returns before touching the engine, but the gateway is
-          // configured first — exactly the seam under test.
-          await runEvalTakesQuality({} as BrainEngine, ['--help']);
-          expect(isAvailable('embedding', 'openai:text-embedding-3-small')).toBe(true);
-        },
-      );
-    } finally {
-      rmSync(home, { recursive: true, force: true });
-    }
-  });
-});

test/hybrid-vector-arm-warn.serial.test.ts

@@ -0,0 +1,77 @@
+/**
+ * #1626 — hybridSearch's text-vector arm must not fail DARK.
+ *
+ * The arm only runs when the embedding provider probed available, so a throw
+ * inside it (embed timeout, transient pooler error on searchVector) is a real
+ * failure. Pre-fix, a bare `catch {}` swallowed it and the run silently
+ * collapsed to keyword-only — under `--source __all__` on a strained pooler
+ * that read as a non-deterministic "No results". The fix logs the swallowed
+ * reason via warnOncePerProcess while keeping the keyword fallback.
+ */
+
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
+import { PGLiteEngine } from '../src/core/pglite-engine.ts';
+import { hybridSearch } from '../src/core/search/hybrid.ts';
+import {
+  __setEmbedTransportForTests,
+  configureGateway,
+  resetGateway,
+} from '../src/core/ai/gateway.ts';
+import { _resetWarnOnceForTests } from '../src/core/utils.ts';
+
+let engine: PGLiteEngine;
+const origWarn = console.warn;
+
+beforeAll(async () => {
+  // Pin the gateway to OpenAI with a stub key (put-page-provenance pattern):
+  // embed() runs instantiateEmbedding — which requires OPENAI_API_KEY — BEFORE
+  // the stubbed transport is reached. Without this, a keyless CI environment
+  // throws the config error instead of the transport's, and the assertion on
+  // the swallowed reason fails. The key never leaves the process.
+  configureGateway({
+    embedding_model: 'openai:text-embedding-3-large',
+    embedding_dimensions: 1536,
+    env: { ...process.env, OPENAI_API_KEY: process.env.OPENAI_API_KEY || 'sk-test-stub' },
+  });
+  engine = new PGLiteEngine();
+  await engine.connect({});
+  await engine.initSchema();
+  await engine.putPage('people/alice-example', {
+    type: 'person',
+    title: 'Alice Example',
+    compiled_truth: 'Alice Example is a test person for the vector-arm warn test.',
+  });
+});
+
+afterAll(async () => {
+  console.warn = origWarn;
+  __setEmbedTransportForTests(null);
+  resetGateway();
+  await engine.disconnect();
+});
+
+describe('hybridSearch vector-arm failure telemetry (#1626)', () => {
+  test('embed failure logs the swallowed reason and falls back to keyword', async () => {
+    _resetWarnOnceForTests();
+    // Installing a transport makes isAvailable('embedding') true (test-seam
+    // fast path), so the vector arm RUNS — and then throws.
+    __setEmbedTransportForTests(() => {
+      throw new Error('pooler exploded mid-fanout');
+    });
+    const warnings: string[] = [];
+    console.warn = (...args: unknown[]) => {
+      warnings.push(args.map(String).join(' '));
+    };
+    try {
+      const results = await hybridSearch(engine, 'alice');
+      // Keyword fallback still returns results — fail-open preserved.
+      expect(results.some((r) => r.slug === 'people/alice-example')).toBe(true);
+    } finally {
+      console.warn = origWarn;
+      __setEmbedTransportForTests(null);
+    }
+    const armWarnings = warnings.filter((w) => w.includes('vector arm failed'));
+    expect(armWarnings).toHaveLength(1);
+    expect(armWarnings[0]).toContain('pooler exploded mid-fanout');
+  });
+});

test/search-op-source-scope.test.ts

@@ -0,0 +1,87 @@
+/**
+ * #1484 follow-up — the `search` op must honor per-call `source_id` /
+ * `all_sources` through the canonical fail-closed resolver
+ * (resolveRequestedScope), exactly like `query` does.
+ *
+ * Pre-fix, `search` had no source_id param at all: the zero-hit CLI hint
+ * advised "retry with --source-id __all__", the flag parsed into params,
+ * NOTHING consumed it, and the retry silently re-ran the same single-source
+ * search — an invisible false negative (and the retry's params.source_id
+ * suppressed the hint, so the user got no second warning).
+ */
+
+import { describe, expect, test } from 'bun:test';
+import { operationsByName } from '../src/core/operations.ts';
+import type { OperationContext } from '../src/core/operations.ts';
+import type { BrainEngine } from '../src/core/engine.ts';
+
+const searchOp = operationsByName['search'];
+
+/** Fake engine: keyword-only config so the handler's scope goes straight to
+ *  searchKeyword, where we capture the opts it was called with. */
+function makeCtx(remote: boolean, allowedSources?: string[]) {
+  const captured: { opts?: Record<string, unknown> } = {};
+  const engine = {
+    getConfig: async (key: string) => (key === 'search.mcp_keyword_only' ? 'true' : null),
+    searchKeyword: async (_q: string, opts: Record<string, unknown>) => {
+      captured.opts = opts;
+      return [];
+    },
+  } as unknown as BrainEngine;
+  const ctx = {
+    engine,
+    config: { engine: 'pglite' },
+    logger: { info: () => {}, warn: () => {}, error: () => {} },
+    dryRun: false,
+    remote,
+    sourceId: 'default',
+    ...(allowedSources ? { auth: { allowedSources } } : {}),
+  } as unknown as OperationContext;
+  return { ctx, captured };
+}
+
+describe('search op per-call source scope (#1484 follow-up)', () => {
+  test('op declares source_id + all_sources params (the CLI hint advises them)', () => {
+    expect(searchOp.params.source_id).toBeDefined();
+    expect(searchOp.params.all_sources).toBeDefined();
+  });
+
+  test('default: scopes to ctx.sourceId', async () => {
+    const { ctx, captured } = makeCtx(false);
+    await searchOp.handler(ctx, { query: 'x' });
+    expect(captured.opts?.sourceId).toBe('default');
+  });
+
+  test("local + source_id '__all__' spans the whole brain (no source filter)", async () => {
+    const { ctx, captured } = makeCtx(false);
+    await searchOp.handler(ctx, { query: 'x', source_id: '__all__' });
+    expect(captured.opts?.sourceId).toBeUndefined();
+    expect(captured.opts?.sourceIds).toBeUndefined();
+  });
+
+  test('local + all_sources=true spans the whole brain', async () => {
+    const { ctx, captured } = makeCtx(false);
+    await searchOp.handler(ctx, { query: 'x', all_sources: true });
+    expect(captured.opts?.sourceId).toBeUndefined();
+    expect(captured.opts?.sourceIds).toBeUndefined();
+  });
+
+  test('explicit source_id wins over ctx.sourceId', async () => {
+    const { ctx, captured } = makeCtx(false);
+    await searchOp.handler(ctx, { query: 'x', source_id: 'wiki' });
+    expect(captured.opts?.sourceId).toBe('wiki');
+  });
+
+  test("remote + '__all__' collapses to the caller's grant (fail-closed)", async () => {
+    const { ctx, captured } = makeCtx(true, ['wiki', 'essays']);
+    await searchOp.handler(ctx, { query: 'x', source_id: '__all__' });
+    expect(captured.opts?.sourceIds).toEqual(['wiki', 'essays']);
+  });
+
+  test('remote + out-of-grant source_id is denied', async () => {
+    const { ctx } = makeCtx(true, ['wiki']);
+    await expect(searchOp.handler(ctx, { query: 'x', source_id: 'secrets' })).rejects.toThrow(
+      /outside your granted sources/,
+    );
+  });
+});

test/voyage-response-cap.test.ts

@@ -34,7 +34,7 @@ describe('v0.31.8 — voyage Content-Length pre-check + per-item cap', () => {
     expect(source).toMatch(/MAX_VOYAGE_RESPONSE_BYTES\s*=\s*256\s*\*\s*1024\s*\*\s*1024/);
   });
 
-  test('Layer 1: Content-Length pre-check fires BEFORE resp.clone().json() (D10 OOM defense)', async () => {
+  test('Layer 1: Content-Length pre-check fires BEFORE the body is read (D10 OOM defense)', async () => {
     const source = await Bun.file(new URL('../src/core/ai/gateway.ts', import.meta.url)).text();
     // Anchor relative to the post-fetch handler block. The function declaration
     // contains an OUTBOUND request body section earlier; we want to verify
@@ -47,8 +47,10 @@ describe('v0.31.8 — voyage Content-Length pre-check + per-item cap', () => {
     // doesn't pin to comment text.
     const preCheckIdx = inboundBlock.indexOf("resp.headers.get('content-length')");
     // Use the full lvalue assignment so the match doesn't accidentally hit
-    // comment text that mentions `await resp.clone().json()` for context.
-    const jsonParseIdx = inboundBlock.indexOf('const json: any = await resp.clone().json()');
+    // comment text that mentions the body read for context. (#1610 moved the
+    // read from `resp.clone().json()` to a single `resp.text()` — bun <
+    // 1.1.27 truncates clone()d bodies, oven-sh/bun#6348.)
+    const jsonParseIdx = inboundBlock.indexOf('const bodyText = await resp.text()');
     expect(preCheckIdx).toBeGreaterThan(0);
     expect(jsonParseIdx).toBeGreaterThan(0);
     // The pre-check MUST appear before the JSON parse — otherwise the OOM