Fix what live-testing code search and shared memory found

[uzayer]

What?

Fixes for what a live test of the code-search (#382) and shared-memory (#387) pipelines found, run against this repo and the installed 0.4.1 app. Three commits:

1. codeindex: the engine (vendor/atlas-engine, two thirds of the source) is indexed; built-in skips show up in the skipped counts; find_symbol says when nothing matches the name; the resolver types Rust method receivers.
2. models: an empty model folder is no longer counted as an install; a composer pill offers the code embedding model, which semantic search needs and nothing prompted for.
3. memory: capture recovers, the briefing is accurate, memory_search output is bounded and filtered by relevance, and the session token no longer reaches an agent's command line (ADR-0020).

Why?

What the live test found, each now covered by a test:

• Session token visible in ps. The token was in claude --mcp-config {…"Authorization":"Bearer <token>"}, and any local process could read it. Putting it in env instead doesn't help, because the adapter copies env onto the command line too.
• No durable memory captured since Oct 3. Only in-app sessions were extracted, and the work had moved to terminal sessions.
• The briefing:
  • showed an Aug plan, every item done, as "active";
  • listed files from other checkouts;
  • had no handoff field.
• memory_search:
  • returned whole transcripts, about 5–8k tokens for 5 results;
  • ranked unrelated entries at the top when nothing matched.
• The engine was missing from the code index, so find_symbol AppServerClient returned unrelated hits.
• find_symbol dressed loose matches up as answers.
• Semantic search silently ran keyword-only. The model was never downloaded, and looking up its path created an empty folder that looked like an install.

New data flow, behind a setting that is off by default. "Learn from sessions outside Atlas" lets extraction read sessions the recorder imported from the terminal. Their transcripts then go to the extraction model, the same way in-app sessions' do. It is a per-project switch next to the sharing switch, and it is greyed out while sharing is off.

How?

• Token (ADR-0020, amends 0010, 0015 and 0019).
  • Only the in-process native agent gets the loopback servers over HTTP. Every ACP agent gets them through the stdio bridge, which reads the token from a 0600 file. The decision is made per connection (in_process), never per agent id.
  • Each token file is deleted when its session ends. Files from ended launches are cleared at startup, off the runtime thread. A running launch holds a lock, so it is never cleared.
  • Proven against the live app: driven through the real claude-acp adapter and claude CLI, neither claude nor the bridge has the token in its command line.
• Capture. Catch-up passes are prompt-sized, at most 3 per job, and skip any session active in the last 15 minutes in any process. Failures log at warn.
• Briefing.
  • Finished or superseded plans are no longer shown as active.
  • Paths are kept to the project root and its worktrees, with .., ~ and linked-worktree roots resolved.
  • handoff is always present (null when there is none), and one is built for sessions that never recorded their end.
  • Tested on a copy of the live store, before → after:
    • plan: stale → none;
    • out-of-repo paths: 16 → 0;
    • handoff: missing → present;
    • newest durable memory: Oct 2 → Oct 9.
• memory_search.
  • Results are excerpts inside a max_output_tokens budget (default 4096), with a truncation marker.
  • A relevance floor: words or meaning must support each hit.
  • Tested on a copy of the live store: an off-topic query goes from about 1,390 tokens to an empty result with a note; "engine quarantine" goes from about 8,363 tokens to 324, the right passage only.
  • AtlasMemBench passes unchanged.
• Code index.
  • .atlasignore re-includes vendor/atlas-engine. A re-include now lifts only the skip it names, so vendor/atlas-engine/target stays pruned.
  • On a clone: 1,557 → 4,626 files, 21k → 69k symbols, and a full build in 6.5 s.
  • EXTRACTOR_VERSION is 2.3, so existing indexes rebuild once.
• Call graph, measured against rust-analyzer (SCIP) on crates/ and src-tauri/.
  • Calls-only recall goes 0.849 → 0.926, precision 0.972 → 0.980.
  • On Code search for agents: atlas_code tools, SQLite code index, graph, hybrid semantic search, grep index #382's metric, which counts every reference on a call line including types and fields, recall goes 0.661 → 0.700, and that metric can't get far above 0.70. The 0.85 target is met only on the calls-only measure; eval_edges now prints both.
  • The keyword-only MRR drop (0.582 → 0.504) is corpus growth, not a code change: the same code still scores 0.583 on the merge-time snapshot.

Not fixed:

• clippy.toml's config warnings: it is upstream's file.
• MemoryRegistry::request_reindex is already called only from tests at the base commit; probably dead since code left the memory corpus.
• For a query with no real answer, memory_search can still return a couple of loosely related excerpts.

Checklist

• Targets the current version branch
• New behaviour has a test; each bug fix has a test that fails without it
• You've run the app and used the change in a window. Not yet. The download pill and the new toggle were checked in bun run dev (headless Chrome). The token path was proven with a debug binary and the real claude-acp adapter against the installed app. No session has been driven through a debug build of Atlas itself.

bun run ci:local is green from clean builds, including app (src-tauri, Linux) in the container. The Windows compile is CI-only, and launching the stdio bridge on Windows is still the manual check ADR-0019 describes. It now applies to every ACP agent.

Co-authored-by: Ahammad Nafiz ahammadnafiz@outlook.com

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7e52d0ef-7ece-4510-8e24-67929f859263

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}