Add ONNX Runtime support for embeddings on macOS

- Introduced ONNX Runtime as an optional embedding provider with CPU and CoreML execution providers.
- Updated README.md with instructions for using ONNX embeddings and enabling CoreML support.
- Modified configuration to include ONNX settings and compatibility.
- Implemented ONNX embedding provider with support for model loading from Hugging Face Hub.
- Enhanced local embedding provider to handle device fallbacks for CUDA and Metal.
- Added tolerant cleaning mechanism in the parser to improve parsing robustness.
- Updated dependencies in Cargo.toml to include ONNX Runtime and related features.

Author: jruokola

Cargo.lock

@@ -41,15 +41,15 @@ futures = "0.3"
 # Serialization
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
-toml = "0.8"
+toml = "0.9.5"
 
 # Zero-copy serialization
 rkyv = { version = "0.8", features = ["alloc", "std"] }
 bytecheck = "0.8"
 rend = "0.5"
 
 # Error Handling
-thiserror = "1.0"
+thiserror = "2.0.16"
 anyhow = "1.0"
 
 # Utilities
@@ -69,29 +69,32 @@ arc-swap = "1.7"
 
 # System Information
 num_cpus = "1.16"
-sysinfo = "0.30"
+sysinfo = "0.37.0"
 
 # Database
 rocksdb = "0.22"
 
 # Vector Search (FAISS bindings and scientific computing)
 faiss = "0.12"
-ndarray = "0.15"
+ndarray = "0.16.1"
 
 # OpenAI API client
 # Minimize reqwest features for smaller binaries; prefer system TLS
 reqwest = { version = "0.12", default-features = false, features = ["json", "stream", "native-tls"] }
 
+# ONNX ort format
+# ort = "=2.0.0-rc.10"
+ort = { version = "2", features = [ "load-dynamic" ] }
 
 # Additional utilities
 bincode = "1.3"
 dashmap = "6.0"
 parking_lot = "0.12"
 tokio-util = "0.7"
-tokio-uring = { version = "0.4" }
+tokio-uring = { version = "0.5.0" }
 
 # File system monitoring and diff processing
-notify = "6.1"
+notify = "8.2.0"
 similar = "2.4"
 memmap2 = "0.9"
 flate2 = "1.0"
@@ -100,18 +103,18 @@ zstd = "0.13"
 lz4_flex = "0.11"
 globset = "0.4"
 ignore = "0.4"
-rand = "0.8"
+rand = "0.9.2"
 
 # Git integration
 git2 = "0.20"
 
 # Tree-sitter for parsing
 tree-sitter = "0.25"
 tree-sitter-rust = "0.24"
-tree-sitter-python = "0.23"
+tree-sitter-python = "0.25.0"
 tree-sitter-javascript = "0.25"
 tree-sitter-typescript = "0.23"
-tree-sitter-go = "0.23"
+tree-sitter-go = "0.25.0"
 tree-sitter-java = "0.23"
 tree-sitter-cpp = "0.23"
 
@@ -121,15 +124,15 @@ async-graphql-axum = "7.0"
 
 # Web framework
 axum = "0.8"
-tower = { version = "0.4", features = ["util"] }
-tower-http = "0.5"
-hyper = "1.0"
-http = "1.1"
-prometheus = { version = "0.13", features = ["process"] }
+tower = { version = "0.5.2", features = ["util"] }
+tower-http = "0.6.6"
+hyper = "1.7.0"
+http = "1.3.1"
+prometheus = { version = "0.14.0", features = ["process"] }
 
 # OpenAPI / Swagger documentation for Axum
-utoipa = { version = "4", features = ["axum_extras", "uuid", "chrono"] }
-utoipa-swagger-ui = { version = "7", features = ["axum"] }
+utoipa = { version = "5.4.0", features = ["axum_extras", "uuid", "chrono"] }
+utoipa-swagger-ui = { version = "9.0.2", features = ["axum"] }
 
 # Memory leak detection and tracking (optional, feature-gated in binaries)
 memscope-rs = "0.1.4"
@@ -143,26 +146,26 @@ tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 tracing-appender = "0.2"
 once_cell = "1.19"
-hashbrown = "0.14"
-rustc-hash = "1.1"
+hashbrown = "0.16.0"
+rustc-hash = "2.1.1"
 bytes = "1.6"
 
 # Memory allocator + profiling
-tikv-jemallocator = { version = "0.5", default-features = true }
-tikv-jemalloc-ctl = "0.5"
+tikv-jemallocator = { version = "0.6.0", default-features = true }
+tikv-jemalloc-ctl = "0.6.0"
 backtrace = "0.3"
 
 # Configuration
-config = "0.14"
-schemars = "0.8"
-secrecy = { version = "0.8", features = ["serde"] }
+config = "0.15.15"
+schemars = "1.0.4"
+secrecy = { version = "0.10.3", features = ["serde"] }
 chacha20poly1305 = { version = "0.10", features = ["std"] }
 base64 = "0.22"
 
 # CLI
 clap = { version = "4.5", features = ["derive", "cargo", "env", "wrap_help"] }
-colored = "2.1"
-indicatif = "0.17"
+colored = "3.0.0"
+indicatif = "0.18.0"
 
 # Security
 jsonwebtoken = "9.3"
@@ -172,13 +175,13 @@ argon2 = "0.5"
 tempfile = "3.8"
 tokio-test = "0.4"
 approx = "0.5"
-criterion = { version = "0.5", features = ["html_reports"] }
+criterion = { version = "0.7.0", features = ["html_reports"] }
 
 # LRU cache utility
-lru = "0.12"
+lru = "0.16.1"
 
 # Official MCP Rust SDK
-rmcp = { version = "0.6.0", features = ["server", "transport-io", "transport-streamable-http-server"] }
+rmcp = { version = "0.6.4", features = ["server", "transport-io", "transport-streamable-http-server"] }
 
 # Internal crates
 codegraph-core = { path = "crates/codegraph-core" }

Cargo.toml

@@ -92,6 +92,36 @@ CodeGraph System Architecture
 └─────────────────────────────────────────────────────┘
 ```
 
+## 🧠 Embeddings with ONNX Runtime (macOS)
+
+- Default provider: CPU EP. Works immediately with Homebrew `onnxruntime`.
+- Optional CoreML EP: Set `CODEGRAPH_ONNX_EP=coreml` to prefer CoreML when using an ONNX Runtime build that includes CoreML.
+- Fallback: If CoreML EP init fails, CodeGraph logs a warning and falls back to CPU.
+
+How to use ONNX embeddings
+
+```bash
+# CPU-only (default)
+export CODEGRAPH_EMBEDDING_PROVIDER=onnx
+export CODEGRAPH_ONNX_EP=cpu
+
+# CoreML (requires CoreML-enabled ORT build)
+export CODEGRAPH_EMBEDDING_PROVIDER=onnx
+export CODEGRAPH_ONNX_EP=coreml
+```
+
+Notes
+
+- ONNX Runtime on Apple platforms accelerates via CoreML, not Metal. If you need GPU acceleration on Apple Silicon, use CoreML where supported.
+- Some models/operators may still run on CPU if CoreML doesn’t support them.
+
+Enabling CoreML feature at build time
+
+- The CoreML registration path is gated by the Cargo feature `onnx-coreml` in `codegraph-vector`.
+- Build with: `cargo build -p codegraph-vector --features "onnx,onnx-coreml"`
+- In a full workspace build, enable it via your consuming crate’s features or by adding: `--features codegraph-vector/onnx,codegraph-vector/onnx-coreml`.
+- You still need an ONNX Runtime library that was compiled with CoreML support; the feature only enables the registration call in our code.
+
 ## 📦 Prerequisites
 
 ### System Requirements
@@ -118,7 +148,7 @@ sudo dnf install cmake clang openssl-devel
 ### Optional Dependencies
 
 - **FAISS** (for vector search acceleration)
-- **Local Embeddings (Hugging Face + Candle)**
+- **Local Embeddings (Hugging Face + Candle + ONNX osx-metal/cuda/cpu)**
   - Enables on-device embedding generation (no external API calls)
   - Downloads models from Hugging Face Hub on first run and caches them locally
   - Internet access required for the initial model download (or pre-populate cache)
@@ -132,7 +162,7 @@ sudo dnf install cmake clang openssl-devel
 
 ```bash
 # Clone the repository
-git clone https://github.com/your-org/codegraph-cli-mcp.git
+git clone https://github.com/jakedismo/codegraph-cli-mcp.git
 cd codegraph-cli-mcp
 
 # Build the project
@@ -183,7 +213,7 @@ Model cache locations:
 
 ```bash
 # Download the latest release
-curl -L https://github.com/your-org/codegraph-cli-mcp/releases/latest/download/codegraph-$(uname -s)-$(uname -m).tar.gz | tar xz
+curl -L https://github.com/jakedismo/codegraph-cli-mcp/releases/latest/download/codegraph-$(uname -s)-$(uname -m).tar.gz | tar xz
 
 # Move to PATH
 sudo mv codegraph /usr/local/bin/
@@ -248,8 +278,6 @@ export CODEGRAPH_LOCAL_MODEL=sentence-transformers/all-MiniLM-L6-v2
 cargo run -p codegraph-api --features codegraph-vector/local-embeddings
 ```
 
-```
-
 ### 4. Search Your Code
 
 ```bash
@@ -811,7 +839,7 @@ We welcome contributions! Please see our [Contributing Guide](CONTRIBUTING.md) f
 
 ```bash
 # Clone repository
-git clone https://github.com/your-org/codegraph-cli-mcp.git
+git clone https://github.com/jakedismo/codegraph-cli-mcp.git
 cd codegraph-cli-mcp
 
 # Install development dependencies

README.md

@@ -321,11 +321,14 @@ impl ConfigManager {
 pub mod crypto {
     use super::*;
     use rand::rngs::OsRng;
-    use rand::RngCore;
+    use rand::TryRngCore;
 
     pub fn generate_key() -> String {
         let mut key = [0u8; 32];
-        OsRng.fill_bytes(&mut key);
+        // rand 0.9 OsRng implements RngCore; use trait method on a mutable instance
+        let mut rng = OsRng;
+        // rand 0.9 switched to Result-returning try_fill_bytes
+        rng.try_fill_bytes(&mut key).expect("OsRng available");
         general_purpose::STANDARD.encode(key)
     }
 
@@ -334,7 +337,8 @@ pub mod crypto {
         anyhow::ensure!(key.len() == 32, "key must be 32 bytes (base64)");
         let cipher = ChaCha20Poly1305::new(Key::from_slice(&key));
         let mut nonce = [0u8; 12];
-        OsRng.fill_bytes(&mut nonce);
+        let mut rng = OsRng;
+        rng.try_fill_bytes(&mut nonce).expect("OsRng available");
         let nonce_obj = Nonce::from_slice(&nonce);
         let mut out = Vec::with_capacity(12 + plaintext.len() + 16);
         out.extend_from_slice(&nonce);

crates/codegraph-core/src/config.rs

@@ -4,7 +4,9 @@ use std::fmt;
 use thiserror::Error;
 use uuid::Uuid;
 use chrono::{DateTime, Utc};
-use argon2::{Argon2, PasswordHash, PasswordHasher, PasswordVerifier, password_hash::{SaltString, rand_core::OsRng}};
+use argon2::{Argon2, PasswordHash, PasswordHasher, PasswordVerifier, password_hash::{SaltString}};
+use rand::rngs::OsRng;
+use rand::RngCore;
 use dashmap::DashMap;
 
 #[derive(Error, Debug)]
@@ -203,7 +205,9 @@ impl ApiKeyManager {
     }
 
     fn hash_api_key(&self, key: &str) -> Result<String, SecurityError> {
-        let salt = SaltString::generate(&mut OsRng);
+    let mut rng = OsRng;
+    // rand_core trait impl is available via rand; SaltString expects rand_core::CryptoRng + RngCore
+    let salt = SaltString::generate(&mut rng);
         let password_hash = self.argon2
             .hash_password(key.as_bytes(), &salt)
             .map_err(|e| SecurityError::CryptographicFailure(e.to_string()))?;
@@ -467,4 +471,4 @@ mod tests {
         assert!(AuthorizationEngine::has_permission(&context, &[Permission::READ_CODE]));
         assert!(!AuthorizationEngine::has_permission(&context, &[Permission::ADMIN_SYSTEM]));
     }
-}
+}

crates/codegraph-core/src/security.rs

@@ -1,6 +1,6 @@
 use codegraph_core::{traits::FileWatcher, ChangeEvent, Result};
 use crossbeam_channel::Sender;
-use notify::{RecommendedWatcher, RecursiveMode, Watcher};
+use notify::{Error as NotifyError, RecommendedWatcher, RecursiveMode, Watcher};
 use std::path::Path;
 
 pub struct FileWatcherImpl {
@@ -19,9 +19,12 @@ impl FileWatcher for FileWatcherImpl {
     fn watch(&self, tx: Sender<ChangeEvent>) -> Result<()> {
         let (notify_tx, notify_rx) = std::sync::mpsc::channel();
 
-        let mut watcher: RecommendedWatcher = Watcher::new(notify_tx, notify::Config::default())?;
+        let mut watcher: RecommendedWatcher = Watcher::new(notify_tx, notify::Config::default())
+            .map_err(|e: NotifyError| codegraph_core::CodeGraphError::Notify(e))?;
 
-        watcher.watch(Path::new(&self.path), RecursiveMode::Recursive)?;
+        watcher
+            .watch(Path::new(&self.path), RecursiveMode::Recursive)
+            .map_err(|e: NotifyError| codegraph_core::CodeGraphError::Notify(e))?;
 
         for res in notify_rx {
             match res {
@@ -45,7 +48,7 @@ impl FileWatcher for FileWatcherImpl {
                         })?;
                     }
                 }
-                Err(e) => return Err(e.into()),
+                Err(e) => return Err(codegraph_core::CodeGraphError::Notify(e.into())),
             }
         }