
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@illodev/workfile-search-local
Advanced tools
Local embeddings semantic search provider for Workfile. Models run on-device; repository content never leaves the machine.
Local embeddings semantic search provider for Workfile. Models run on-device via onnxruntime-web and @huggingface/tokenizers (ONNX on CPU, WASM) — repository content never leaves the machine.
pnpm add -D @illodev/workfile-search-local
// project.config.mjs — the import is GUARDED on purpose. A bare
// `import ... from "@illodev/workfile-search-local"` resolves from this file,
// so the config would only load with node_modules present — and the generated
// CI job runs `npx --yes @illodev/workfile@X doctor` on a clean clone. With
// the guard, no package means lexical search, not a red pipeline.
export const integrations = await (async () => {
try {
const { localSearchIntegration } = await import(
"@illodev/workfile-search-local"
);
return [localSearchIntegration()];
} catch {
return [];
}
})();
export default {
schemaVersion: 2,
name: "My project",
search: { provider: "local-embeddings" }
};
That is all: workfile search, the HTTP API, the UI and the MCP server rank
hybrid results automatically. workfile search QUERY --mode lexical opts out
per call.
The first hybrid search over a workspace embeds every candidate record that is not yet cached. On a few thousand records that is minutes of sustained CPU, and it is triggered by whichever surface searches first — the CLI, the board UI, or the MCP server a coding agent loads. The provider is built so that pass is survivable:
numThreads): ONNX no longer takes the whole
machine. Raise it deliberately if the box is idle.batchSize, default 32): killing the
process keeps every completed batch; the next search resumes where it died
instead of starting over.onProgress replaces it with your own sink.Afterwards the cache makes searches fast (typically seconds), and editing a record re-embeds that record only.
Xenova/multilingual-e5-small, quantized, multilingual)
is downloaded once on first use into modelDir — about 135 MB of tokenizer
and weights — and everything afterwards is offline. Point model at a
directory holding tokenizer.json and the ONNX file to skip the download
entirely, which is how this runs on a machine with no network.~/.cache/workfile/embeddings, keyed by
content hash — editing a card re-embeds that card only. Only the first
passageChars characters of a body are embedded, so edits beyond that
boundary intentionally do not invalidate the vector.search.semanticWeight, default 0.35).search.maxProviderRecords — size that cap
to your corpus if you want every record eligible.localSearchIntegration({
id: "local-embeddings", // integration id, referenced by search.provider
model: "Xenova/multilingual-e5-small",
dtype: "q8", // which exported ONNX weights to load
cacheDir: "~/.cache/workfile/embeddings-or-null",
modelDir: "~/.cache/workfile/models", // where the model and tokenizer are kept
passageChars: 2000, // body characters embedded per record
embedder: null, // inject your own (texts) => vectors
numThreads: 4, // ONNX WASM threads; default: half the cores
batchSize: 32, // records per model call; cache persists per batch
onProgress: ({ done, total }) => {} // default: stderr lines on large passes
});
FAQs
Local embeddings semantic search provider for Workfile. Models run on-device; repository content never leaves the machine.
The npm package @illodev/workfile-search-local receives a total of 961 weekly downloads. As such, @illodev/workfile-search-local popularity was classified as not popular.
We found that @illodev/workfile-search-local demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.