@claude-flow/cli 3.32.9 → 3.32.10

package/dist/src/memory/memory-bridge.js

@@ -23,28 +23,6 @@ import { createRequire } from 'node:module';
 let registryPromise = null;
 let registryInstance = null;
 let bridgeAvailable = null;
-// #2735 — the native-bridge -> sql.js whole-image fallback used to be
-// completely silent: a registry init failure cached `bridgeAvailable =
-// false` for the rest of the process, and a per-operation bridge exception
-// swallowed itself with a bare `catch { return null; }` — in both cases the
-// caller fell back to memory-initializer.ts's unsafe whole-image sql.js
-// path with zero diagnostic trail. When that path corrupted a database, the
-// demotion that caused it was structurally unknowable after the fact. Log
-// once per distinct reason (not once per call — a hot per-op catch could
-// otherwise spam stderr on every single memory operation) so the first
-// occurrence is attributable. Stderr only — never stdout, which callers may
-// be parsing as JSON.
-const loggedDemotions = new Set();
-function logDemotionOnce(where, reason) {
-    const dedupeKey = `${where}:${reason}`;
-    if (loggedDemotions.has(dedupeKey))
-        return;
-    loggedDemotions.add(dedupeKey);
-    try {
-        process.stderr.write(`[memory-bridge] demoted to sql.js fallback in ${where}: ${reason}\n`);
-    }
-    catch { /* stderr unavailable — nothing more we can do */ }
-}
 /**
  * Resolve database path with path traversal protection.
  * Only allows paths within or below the project's working directory,
@@ -87,6 +65,27 @@ function getDbPath(customPath) {
     }
     return resolved;
 }
+/**
+ * Resolve AgentDB's native better-sqlite3 database path (#2786).
+ *
+ * AgentDB is opened by ControllerRegistry via native better-sqlite3, which
+ * requires a plaintext SQLite file. The sibling `memory.db` file written by
+ * `memory-initializer.ts` (`writeFileRestricted(..., {encrypt: true})`) is
+ * encrypted-at-rest when `CLAUDE_FLOW_ENCRYPT_AT_REST=1` — pointing native
+ * better-sqlite3 at it fails with "file is not a database" and silently
+ * disables `learningSystem`/`reasoningBank`.
+ *
+ * Give AgentDB a distinct filename in the same directory so both writers
+ * coexist: sql.js keeps `memory.db` (possibly encrypted); AgentDB owns
+ * `agentdb-memory.db`. Preserves the traversal protection in `getDbPath()`
+ * because we derive from its already-validated return value.
+ */
+function getAgentDbPath() {
+    const dbPath = getDbPath();
+    if (dbPath === ':memory:')
+        return ':memory:';
+    return path.join(path.dirname(dbPath), 'agentdb-memory.db');
+}
 /**
  * Generate a secure random ID for memory entries.
  */
@@ -121,7 +120,8 @@ async function getRegistry(dbPath) {
                 };
                 try {
                     await registry.initialize({
-                        dbPath: dbPath || getDbPath(),
+                        // #2786: use agentdb-memory.db (plaintext) so native better-sqlite3 doesn't hit the encrypted memory.db.
+                        dbPath: dbPath || getAgentDbPath(),
                         embeddingModel: 'Xenova/all-MiniLM-L6-v2',
                         dimension: 384,
                         vectorBackend: 'auto',
@@ -372,10 +372,9 @@ async function getRegistry(dbPath) {
                 bridgeAvailable = true;
                 return registry;
             }
-            catch (err) {
+            catch {
                 bridgeAvailable = false;
                 registryPromise = null;
-                logDemotionOnce('getRegistry (process-wide, cached for the rest of this process)', err instanceof Error ? err.message : String(err));
                 return null;
             }
         })();
@@ -528,25 +527,25 @@ function getDb(registry) {
     // WeakSet so a new db instance re-ensures without a stale global flag.
     if (!_schemaEnsuredDbs.has(db)) {
         try {
-            db.exec(`CREATE TABLE IF NOT EXISTS memory_entries (
-        id TEXT PRIMARY KEY,
-        key TEXT NOT NULL,
-        namespace TEXT DEFAULT 'default',
-        content TEXT NOT NULL,
-        type TEXT DEFAULT 'semantic',
-        embedding TEXT,
-        embedding_model TEXT DEFAULT 'local',
-        embedding_dimensions INTEGER,
-        tags TEXT,
-        metadata TEXT,
-        owner_id TEXT,
-        created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now') * 1000),
-        updated_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now') * 1000),
-        expires_at INTEGER,
-        last_accessed_at INTEGER,
-        access_count INTEGER DEFAULT 0,
-        status TEXT DEFAULT 'active',
-        UNIQUE(namespace, key)
+            db.exec(`CREATE TABLE IF NOT EXISTS memory_entries (
+        id TEXT PRIMARY KEY,
+        key TEXT NOT NULL,
+        namespace TEXT DEFAULT 'default',
+        content TEXT NOT NULL,
+        type TEXT DEFAULT 'semantic',
+        embedding TEXT,
+        embedding_model TEXT DEFAULT 'local',
+        embedding_dimensions INTEGER,
+        tags TEXT,
+        metadata TEXT,
+        owner_id TEXT,
+        created_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now') * 1000),
+        updated_at INTEGER NOT NULL DEFAULT (strftime('%s', 'now') * 1000),
+        expires_at INTEGER,
+        last_accessed_at INTEGER,
+        access_count INTEGER DEFAULT 0,
+        status TEXT DEFAULT 'active',
+        UNIQUE(namespace, key)
       )`);
             // Ensure indexes
             db.exec(`CREATE INDEX IF NOT EXISTS idx_bridge_ns ON memory_entries(namespace)`);
@@ -693,18 +692,47 @@ export async function bridgeStoreEntry(options) {
                 // Embedding failed — store without
             }
         }
-        // better-sqlite3 uses synchronous .run() with positional params
+        // #2775: strict-insert path now auto-resurrects soft-deleted tombstones
+        // via ON CONFLICT DO UPDATE ... WHERE status='deleted'. Rationale:
+        // `bridgeDeleteEntry` performs a soft delete (status='deleted'), so the
+        // `UNIQUE(namespace, key)` slot stays occupied — before this fix, a
+        // natural `delete → store` sequence hit UNIQUE, the catch below returned
+        // `null`, `storeEntry` fell back to the sql.js whole-image path, and the
+        // #2735 -wal/-shm sidecar guard refused with a message about a "native
+        // WAL connection" that had nothing to do with the actual failure.
+        //
+        // Semantics under the new strict-insert SQL:
+        //   • no existing row               → INSERT succeeds, changes = 1
+        //   • existing row, status='deleted' → resurrected in-place, changes = 1
+        //   • existing row, status='active'  → ON CONFLICT WHERE=false suppresses
+        //                                       the update, changes = 0 (checked
+        //                                       below → typed "already exists"
+        //                                       error, NEVER a null demotion).
+        // Upsert path (INSERT OR REPLACE) is unchanged.
         const insertSql = options.upsert
-            ? `INSERT OR REPLACE INTO memory_entries (
-          id, key, namespace, content, type,
-          embedding, embedding_dimensions, embedding_model,
-          tags, metadata, created_at, updated_at, expires_at, status
+            ? `INSERT OR REPLACE INTO memory_entries (
+          id, key, namespace, content, type,
+          embedding, embedding_dimensions, embedding_model,
+          tags, metadata, created_at, updated_at, expires_at, status
         ) VALUES (?, ?, ?, ?, 'semantic', ?, ?, ?, ?, ?, ?, ?, ?, 'active')`
-            : `INSERT INTO memory_entries (
-          id, key, namespace, content, type,
-          embedding, embedding_dimensions, embedding_model,
-          tags, metadata, created_at, updated_at, expires_at, status
-        ) VALUES (?, ?, ?, ?, 'semantic', ?, ?, ?, ?, ?, ?, ?, ?, 'active')`;
+            : `INSERT INTO memory_entries (
+          id, key, namespace, content, type,
+          embedding, embedding_dimensions, embedding_model,
+          tags, metadata, created_at, updated_at, expires_at, status
+        ) VALUES (?, ?, ?, ?, 'semantic', ?, ?, ?, ?, ?, ?, ?, ?, 'active')
+        ON CONFLICT(namespace, key) DO UPDATE SET
+          id                    = excluded.id,
+          content               = excluded.content,
+          embedding             = excluded.embedding,
+          embedding_dimensions  = excluded.embedding_dimensions,
+          embedding_model       = excluded.embedding_model,
+          tags                  = excluded.tags,
+          metadata              = excluded.metadata,
+          created_at            = excluded.created_at,
+          updated_at            = excluded.updated_at,
+          expires_at            = excluded.expires_at,
+          status                = 'active'
+        WHERE memory_entries.status = 'deleted'`;
         // #1941: provision a `vector_indexes` row for this namespace before the
         // entry insert. AgentDB's HNSW/router keys lookups by namespace via this
         // table — if it has no row for e.g. `claude-memories`, `memory_search`
@@ -717,15 +745,27 @@ export async function bridgeStoreEntry(options) {
         }
         catch { /* vector_indexes may not exist on legacy DBs — fall through */ }
         const stmt = ctx.db.prepare(insertSql);
-        stmt.run(id, key, namespace, value, embeddingJson, dimensions || null, model, tags.length > 0 ? JSON.stringify(tags) : null, '{}', now, now, ttl ? now + (ttl * 1000) : null);
+        const runResult = stmt.run(id, key, namespace, value, embeddingJson, dimensions || null, model, tags.length > 0 ? JSON.stringify(tags) : null, '{}', now, now, ttl ? now + (ttl * 1000) : null);
+        // #2775: strict insert against an ACTIVE existing row → changes === 0
+        // (the ON CONFLICT WHERE clause above suppressed the update). Surface
+        // this as a typed data-level error rather than a bridge failure —
+        // returning non-null so the caller does NOT demote to sql.js and does
+        // NOT trip the #2735 whole-image guard with a misleading message.
+        if (!options.upsert && (runResult?.changes ?? 0) === 0) {
+            return {
+                success: false,
+                id,
+                error: `key "${key}" already exists in namespace "${namespace}" — pass upsert=true (--upsert on the CLI) to update it`,
+            };
+        }
         // #2558: keep `vector_indexes.total_vectors` accurate so status/tooling
         // stop reporting "HNSW index: 0 vectors" while embedded entries exist.
         try {
             ctx.db
-                .prepare(`UPDATE vector_indexes SET
-             total_vectors = (SELECT COUNT(*) FROM memory_entries
-                              WHERE namespace = ? AND embedding IS NOT NULL),
-             updated_at = ?
+                .prepare(`UPDATE vector_indexes SET
+             total_vectors = (SELECT COUNT(*) FROM memory_entries
+                              WHERE namespace = ? AND embedding IS NOT NULL),
+             updated_at = ?
            WHERE name = ?`)
                 .run(namespace, now, namespace);
         }
@@ -761,7 +801,24 @@ export async function bridgeStoreEntry(options) {
         };
     }
     catch (err) {
-        logDemotionOnce('bridgeStoreEntry', err instanceof Error ? err.message : String(err));
+        // #2775: distinguish a data-level UNIQUE constraint violation (key
+        // already exists — expected outcome of a strict insert) from a real
+        // bridge failure (registry gone, DB locked, disk full, etc.). The
+        // ON CONFLICT clause on the strict-insert SQL above should normally
+        // convert UNIQUE hits into a `changes === 0` result, so reaching here
+        // with a UNIQUE error means the schema pre-dates the (namespace, key)
+        // unique index or the conflict target didn't match — treat it as a
+        // clean "already exists" so the caller never demotes to sql.js and
+        // never triggers the #2735 whole-image guard with a misleading
+        // "active native WAL connection" error.
+        const msg = err instanceof Error ? err.message : String(err);
+        if (/UNIQUE constraint failed/i.test(msg)) {
+            return {
+                success: false,
+                id: '',
+                error: `key "${options.key}" already exists in namespace "${options.namespace ?? 'default'}" — pass upsert=true (--upsert on the CLI) to update it`,
+            };
+        }
         return null;
     }
 }
@@ -799,11 +856,11 @@ export async function bridgeSearchEntries(options) {
             : '';
         let rows;
         try {
-            const stmt = ctx.db.prepare(`
-        SELECT id, key, namespace, content, embedding
-        FROM memory_entries
-        WHERE status = 'active' ${nsFilter}
-        LIMIT 1000
+            const stmt = ctx.db.prepare(`
+        SELECT id, key, namespace, content, embedding
+        FROM memory_entries
+        WHERE status = 'active' ${nsFilter}
+        LIMIT 1000
       `);
             rows = effectiveNamespace !== 'all' ? stmt.all(effectiveNamespace) : stmt.all();
         }
@@ -924,12 +981,12 @@ export async function bridgeListEntries(options) {
         // List
         const entries = [];
         try {
-            const stmt = ctx.db.prepare(`
-        SELECT id, key, namespace, content, embedding, access_count, created_at, updated_at
-        FROM memory_entries
-        WHERE ${statusFilter} ${nsFilter}
-        ORDER BY updated_at DESC
-        LIMIT ? OFFSET ?
+            const stmt = ctx.db.prepare(`
+        SELECT id, key, namespace, content, embedding, access_count, created_at, updated_at
+        FROM memory_entries
+        WHERE ${statusFilter} ${nsFilter}
+        ORDER BY updated_at DESC
+        LIMIT ? OFFSET ?
       `);
             const rows = stmt.all(...nsParams, limit, offset);
             for (const row of rows) {
@@ -998,11 +1055,11 @@ export async function bridgeGetEntry(options) {
         }
         let row;
         try {
-            const stmt = ctx.db.prepare(`
-        SELECT id, key, namespace, content, embedding, access_count, created_at, updated_at, tags
-        FROM memory_entries
-        WHERE status = 'active' AND key = ? AND namespace = ?
-        LIMIT 1
+            const stmt = ctx.db.prepare(`
+        SELECT id, key, namespace, content, embedding, access_count, created_at, updated_at, tags
+        FROM memory_entries
+        WHERE status = 'active' AND key = ? AND namespace = ?
+        LIMIT 1
       `);
             row = stmt.get(key, namespace);
         }
@@ -1041,8 +1098,7 @@ export async function bridgeGetEntry(options) {
         await cacheSet(registry, cacheKey, entry);
         return { success: true, found: true, cacheHit: false, entry };
     }
-    catch (err) {
-        logDemotionOnce('bridgeGetEntry', err instanceof Error ? err.message : String(err));
+    catch {
         return null;
     }
 }
@@ -1067,16 +1123,31 @@ export async function bridgeDeleteEntry(options) {
         // Soft delete using parameterized query
         let changes = 0;
         try {
-            const result = ctx.db.prepare(`
-        UPDATE memory_entries
-        SET status = 'deleted', updated_at = ?
-        WHERE key = ? AND namespace = ? AND status = 'active'
+            const result = ctx.db.prepare(`
+        UPDATE memory_entries
+        SET status = 'deleted', updated_at = ?
+        WHERE key = ? AND namespace = ? AND status = 'active'
       `).run(Date.now(), key, namespace);
             changes = result?.changes ?? 0;
         }
         catch {
             return null;
         }
+        // #2775: mirror the #2558 PASSIVE checkpoint after the delete. Without
+        // this, the tombstone stays WAL-only until some unrelated store
+        // eventually checkpoints — meaning WAL-blind readers (sql.js fallback,
+        // statusline's read-only sqlite3 counter) keep serving the deleted row.
+        // If the process exits before another checkpoint, on live multi-worktree
+        // installations we've observed rows `active` in the main image but
+        // `deleted` in the -wal, or rows existing only in an orphaned -wal
+        // invisible to every image reader. PASSIVE flushes committed pages
+        // without blocking writers. Best-effort, never fatal.
+        try {
+            if (typeof ctx.db.pragma === 'function') {
+                ctx.db.pragma('wal_checkpoint(PASSIVE)');
+            }
+        }
+        catch { /* non-WAL, busy, or unsupported — non-fatal */ }
         // Phase 2: Invalidate cache
         const safeNs = String(namespace).replace(/:/g, '_');
         const safeKey = String(key).replace(/:/g, '_');
@@ -1102,8 +1173,7 @@ export async function bridgeDeleteEntry(options) {
             guarded: true,
         };
     }
-    catch (err) {
-        logDemotionOnce('bridgeDeleteEntry', err instanceof Error ? err.message : String(err));
+    catch {
         return null;
     }
 }
@@ -1154,8 +1224,7 @@ export async function bridgePurgeNamespace(options) {
             guarded: true,
         };
     }
-    catch (err) {
-        logDemotionOnce('bridgePurgeNamespace', err instanceof Error ? err.message : String(err));
+    catch {
         return null;
     }
 }
@@ -1285,11 +1354,11 @@ export async function bridgeSearchHNSW(queryEmbedding, options, dbPath) {
             : '';
         let rows;
         try {
-            const stmt = ctx.db.prepare(`
-        SELECT id, key, namespace, content, embedding
-        FROM memory_entries
-        WHERE status = 'active' AND embedding IS NOT NULL ${nsFilter}
-        LIMIT 10000
+            const stmt = ctx.db.prepare(`
+        SELECT id, key, namespace, content, embedding
+        FROM memory_entries
+        WHERE status = 'active' AND embedding IS NOT NULL ${nsFilter}
+        LIMIT 10000
       `);
             rows = nsFilter
                 ? stmt.all(options.namespace)
@@ -1341,12 +1410,12 @@ export async function bridgeAddToHNSW(id, embedding, entry, dbPath) {
     try {
         const now = Date.now();
         const embeddingJson = JSON.stringify(embedding);
-        ctx.db.prepare(`
-      INSERT OR REPLACE INTO memory_entries (
-        id, key, namespace, content, type,
-        embedding, embedding_dimensions, embedding_model,
-        created_at, updated_at, status
-      ) VALUES (?, ?, ?, ?, 'semantic', ?, ?, 'Xenova/all-MiniLM-L6-v2', ?, ?, 'active')
+        ctx.db.prepare(`
+      INSERT OR REPLACE INTO memory_entries (
+        id, key, namespace, content, type,
+        embedding, embedding_dimensions, embedding_model,
+        created_at, updated_at, status
+      ) VALUES (?, ?, ?, ?, 'semantic', ?, ?, 'Xenova/all-MiniLM-L6-v2', ?, ?, 'active')
     `).run(id, entry.key, entry.namespace, entry.content, embeddingJson, embedding.length, now, now);
         return true;
     }
@@ -1670,9 +1739,9 @@ export async function bridgeRecordCausalEdge(options) {
         const ctx = getDb(registry);
         if (ctx) {
             try {
-                ctx.db.prepare(`
-          INSERT OR REPLACE INTO memory_entries (id, key, namespace, content, type, created_at, updated_at, status)
-          VALUES (?, ?, 'causal-edges', ?, 'procedural', ?, ?, 'active')
+                ctx.db.prepare(`
+          INSERT OR REPLACE INTO memory_entries (id, key, namespace, content, type, created_at, updated_at, status)
+          VALUES (?, ?, 'causal-edges', ?, 'procedural', ?, ?, 'active')
         `).run(generateId('edge'), `${options.sourceId}→${options.targetId}`, JSON.stringify(options), Date.now(), Date.now());
                 return { success: true, controller: 'bridge-fallback' };
             }
@@ -1751,10 +1820,10 @@ export async function bridgeDeleteHierarchical(options) {
         const ctx = getDb(registry);
         if (ctx) {
             try {
-                const result = ctx.db.prepare(`
-          UPDATE memory_entries
-          SET status = 'deleted', updated_at = ?
-          WHERE key = ? AND namespace LIKE 'hierarchical%' AND status = 'active'
+                const result = ctx.db.prepare(`
+          UPDATE memory_entries
+          SET status = 'deleted', updated_at = ?
+          WHERE key = ? AND namespace LIKE 'hierarchical%' AND status = 'active'
         `).run(Date.now(), key);
                 const changes = result?.changes ?? 0;
                 if (changes > 0) {
@@ -1830,10 +1899,10 @@ export async function bridgeDeleteCausalEdge(options) {
         const ctx = getDb(registry);
         if (ctx) {
             try {
-                const result = ctx.db.prepare(`
-          UPDATE memory_entries
-          SET status = 'deleted', updated_at = ?
-          WHERE key = ? AND namespace = 'causal-edges' AND status = 'active'
+                const result = ctx.db.prepare(`
+          UPDATE memory_entries
+          SET status = 'deleted', updated_at = ?
+          WHERE key = ? AND namespace = 'causal-edges' AND status = 'active'
         `).run(Date.now(), edgeKey);
                 const changes = result?.changes ?? 0;
                 if (changes > 0) {
@@ -1905,18 +1974,18 @@ export async function bridgeDeleteCausalNode(options) {
         let deletedEdges = 0;
         let deletedNode = false;
         try {
-            const edgeResult = ctx.db.prepare(`
-        UPDATE memory_entries
-        SET status = 'deleted', updated_at = ?
-        WHERE namespace = 'causal-edges'
-          AND status = 'active'
-          AND (key LIKE ? OR key LIKE ?)
+            const edgeResult = ctx.db.prepare(`
+        UPDATE memory_entries
+        SET status = 'deleted', updated_at = ?
+        WHERE namespace = 'causal-edges'
+          AND status = 'active'
+          AND (key LIKE ? OR key LIKE ?)
       `).run(Date.now(), `${nodeId}→%`, `%→${nodeId}`);
             deletedEdges = edgeResult?.changes ?? 0;
-            const nodeResult = ctx.db.prepare(`
-        UPDATE memory_entries
-        SET status = 'deleted', updated_at = ?
-        WHERE key = ? AND status = 'active'
+            const nodeResult = ctx.db.prepare(`
+        UPDATE memory_entries
+        SET status = 'deleted', updated_at = ?
+        WHERE key = ? AND status = 'active'
       `).run(Date.now(), nodeId);
             deletedNode = (nodeResult?.changes ?? 0) > 0;
             await logAttestation(registry, 'delete', nodeId, { namespace: 'causal-nodes', deletedEdges });
@@ -2403,11 +2472,11 @@ export async function bridgeGetAllEmbeddings(options) {
     try {
         const dims = options?.dimensions ?? 384;
         const maxRows = options?.limit ?? 50000;
-        const rows = ctx.db.prepare(`
-      SELECT id, key, namespace, embedding
-      FROM memory_entries
-      WHERE status = 'active' AND embedding IS NOT NULL
-      LIMIT ?
+        const rows = ctx.db.prepare(`
+      SELECT id, key, namespace, embedding
+      FROM memory_entries
+      WHERE status = 'active' AND embedding IS NOT NULL
+      LIMIT ?
     `).all(maxRows);
         const results = [];
         for (const row of rows) {