Fix audit findings: GPU pool, index integrity, worker/snapshot, API, CI

[codewarnab]

Summary

Fixes 22 bugs and security issues from a repo audit. The silent benchmark auto-send is intentional and unchanged.

High

• GPU device pool: concurrent create() calls share one in-flight acquisition, so they no longer reset the refcount or destroy each other's device. Release and device-lost handling now check the device's identity.
• Buffer limits: GPU buffers are clamped to maxStorageBufferBindingSize. Before, an oversized binding made every query return 0 results while the engine still reported 'webgpu'.
• Batch atomicity: filter getters run before any change, so a getter that throws no longer leaves DocumentIndex corrupted.

Library

• Readback captures the generation number before awaiting, so a destroy during the wait throws AbortError, not TypeError. The engine is torn down if init fails, and calling init() twice releases the previous device.
• Filters on high-cardinality string fields use posting lists, so memory stays bounded. Field reads use own properties only, highlights are safe for a __proto__ field, and the ID comparator is a total order. Number and boolean filter values are coerced more strictly.
• The worker builds a new index before swapping it in and handles messages one at a time; DESTROY resets the session. The client applies state only after the worker succeeds.
• Snapshots reject duplicate or non-scalar docIds and non-object docs, and accept typed-array buffers. Custom IndexedDB stores are now created on an existing database.
• The native CPU baseline uses the same normalization as the exact scorer. Bun now loads .wgsl imports as text.

API / site / CI

• /api/submit-benchmark keeps a capped list of submissions per fingerprint, deduped per IP, so nobody can poison a slot by submitting first. It stores only validated fields and returns 413 for bodies over 8 KB, 400 for null entries, and 502 when the store is down. The rate-limit expiry now heals itself.
• The site clamps the payload to server limits and validates saved history. The corpus page defaults to 100k when size is missing and builds large corpora in chunks. The benchmark app's test engine is gated to dev mode.
• Workflow actions are pinned to commit SHAs with least-privilege permissions. Release runs only after CI passes on main.

Behaviour changes

• Boolean filter fields accept only true/false (or "true"/"false"). Blank number bounds throw InvalidFilterError.
• Numeric IDs sort before string IDs when scores tie.
• A database upgraded to create custom IndexedDB store names can't be opened by older library versions. Default store names aren't affected.
• The benchmark's native baseline is slower, so its numbers can't be compared with past history.
• The bundle budget goes from 90 KB to 96 KB gzip; this PR adds about 4.8 KB.

Known follow-ups

• The vgpu mock never runs WGSL, so check:shaders is still the only real check of the shaders.
• The release job runs the browser test but never installs Chrome. This predates this PR.
• Two low-priority items: the client and worker could disagree if a worker sent back a malformed restore result, and restoring a snapshot with embedded docs now copies its records back from the worker.

Test plan

• check:shaders, typecheck, build, check:bundle-size, check:public-api
• test:mock, contracts, records, highlight, mutations, worker, snapshot, observability, parity, filtering, faceting, diagnostics, search-modes, cpu-baseline, reliability, benchmarks, and normalization (including the Turkish locale run)
• New test:regressions (38 tests, added to CI); bun test packages/webgpu-search/test passes 260/260
• Handler tests for the API with a mocked fetch

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
webgpu-search	Ignored		Oct 4, 2026 3:54pm UTC

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.