@hasna/mementos 0.14.85 → 0.14.87

package/dist/mcp/index.js

@@ -320,6 +320,7 @@ function translateSql(sql) {
   let translated = sql.replace(/\?/g, () => `$${++parameterIndex}`);
   const ISO_FMT = `'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'`;
   translated = translated.replace(/datetime\s*\(\s*'now'\s*\)/gi, `to_char(now() AT TIME ZONE 'UTC', ${ISO_FMT})`);
+  translated = translated.replace(/strftime\s*\(\s*'%Y-%m-%dT%H:%M:%fZ'\s*,\s*'now'\s*\)/gi, `to_char(now() AT TIME ZONE 'UTC', ${ISO_FMT})`);
   translated = translated.replace(/datetime\s*\(\s*'now'\s*,\s*'(-?\d+)\s+(minutes?|hours?|days?|seconds?)'\s*\)/gi, (_match, amount, unit) => {
     const parsed = parseInt(String(amount), 10);
     const absolute = Math.abs(parsed);
@@ -804,16 +805,24 @@ function transferRows(target, table, rows, options) {
   const conflictColumn = options.conflictColumn ?? "updated_at";
   let written = 0;
   let skipped = 0;
+  let maxSyncedAt = null;
   const errors = [];
+  const bumpMaxSyncedAt = (row) => {
+    const value = row[conflictColumn];
+    if (typeof value === "string" && (maxSyncedAt === null || value > maxSyncedAt)) {
+      maxSyncedAt = value;
+    }
+  };
   if (rows.length === 0) {
-    return { written, skipped, errors };
+    return { written, skipped, errors, maxSyncedAt };
   }
   const columns = Object.keys(rows[0] ?? {});
   if (!columns.includes(primaryKey)) {
     return {
       written,
       skipped,
-      errors: [`Table "${table}" has no "${primaryKey}" column; skipping`]
+      errors: [`Table "${table}" has no "${primaryKey}" column; skipping`],
+      maxSyncedAt
     };
   }
   const hasConflictColumn = columns.includes(conflictColumn);
@@ -826,6 +835,7 @@ function transferRows(target, table, rows, options) {
           const incomingTime = Date.parse(String(row[conflictColumn]));
           if (Number.isFinite(existingTime) && Number.isFinite(incomingTime) && existingTime >= incomingTime) {
             skipped++;
+            bumpMaxSyncedAt(row);
             continue;
           }
         }
@@ -838,11 +848,12 @@ function transferRows(target, table, rows, options) {
         target.run(`INSERT INTO "${table}" (${columnList}) VALUES (${placeholders})`, ...columns.map((column) => row[column]));
       }
       written++;
+      bumpMaxSyncedAt(row);
     } catch (error) {
       errors.push(`Row ${String(row[primaryKey] ?? "unknown")}: ${error instanceof Error ? error.message : String(error)}`);
     }
   }
-  return { written, skipped, errors };
+  return { written, skipped, errors, maxSyncedAt };
 }
 function incrementalSyncPush(local, remote, tables, options = {}) {
   return runIncrementalSync("push", local, remote, local, tables, options);
@@ -880,22 +891,29 @@ function runIncrementalSync(direction, source, target, metaDb, tables, options)
         rows = source.all(`SELECT * FROM "${table}"`);
         stat.first_sync = true;
       }
+      let maxSyncedAt = null;
       for (let offset = 0;offset < rows.length; offset += batchSize) {
         const batch = rows.slice(offset, offset + batchSize);
         const result = transferRows(target, table, batch, options);
         stat.synced_rows += result.written;
         stat.skipped_rows += result.skipped;
         stat.errors.push(...result.errors);
+        if (result.maxSyncedAt !== null && (maxSyncedAt === null || result.maxSyncedAt > maxSyncedAt)) {
+          maxSyncedAt = result.maxSyncedAt;
+        }
       }
       if (rows.length === 0) {
         stat.skipped_rows = stat.total_rows;
       }
-      upsertSyncMeta(metaDb, {
-        table_name: table,
-        last_synced_at: new Date().toISOString(),
-        last_synced_row_count: stat.synced_rows,
-        direction
-      });
+      const nextCursor = maxSyncedAt ?? meta?.last_synced_at ?? null;
+      if (rows.length > 0 && stat.errors.length === 0 && nextCursor !== null) {
+        upsertSyncMeta(metaDb, {
+          table_name: table,
+          last_synced_at: nextCursor,
+          last_synced_row_count: stat.synced_rows,
+          direction
+        });
+      }
     } catch (error) {
       stat.errors.push(`Table "${table}": ${error instanceof Error ? error.message : String(error)}`);
     }
@@ -923,8 +941,13 @@ var init_storage = __esm(() => {
     data;
     closed = false;
     lastError = null;
+    generation = 0;
     static DATA_BYTES = 128 * 1024 * 1024;
-    static QUERY_TIMEOUT_MS = 60000;
+    static queryTimeoutMs() {
+      const raw = process.env["MEMENTOS_PGSYNC_QUERY_TIMEOUT_MS"]?.trim();
+      const parsed = raw ? Number(raw) : Number.NaN;
+      return Number.isFinite(parsed) && parsed > 0 ? parsed : 60000;
+    }
     static resolveWorkerPath() {
       const ext = import.meta.url.endsWith(".ts") ? ".ts" : ".js";
       const here = fileURLToPath(new URL(".", import.meta.url));
@@ -939,12 +962,12 @@ var init_storage = __esm(() => {
       }
       return candidates[0];
     }
-    constructor(connectionString) {
-      const control = new SharedArrayBuffer(8);
+    constructor(connectionString, workerPath) {
+      const control = new SharedArrayBuffer(12);
       const dataSab = new SharedArrayBuffer(PgSyncPool.DATA_BYTES);
       this.status = new Int32Array(control);
       this.data = new Uint8Array(dataSab);
-      this.worker = new Worker(PgSyncPool.resolveWorkerPath(), {
+      this.worker = new Worker(workerPath ?? PgSyncPool.resolveWorkerPath(), {
         workerData: {
           dsn: stripSslParams(connectionString),
           ssl: sslConfigFor(connectionString),
@@ -962,21 +985,35 @@ var init_storage = __esm(() => {
         throw new Error("PgSyncPool is closed");
       if (this.lastError)
         throw this.lastError;
+      const timeoutMs = PgSyncPool.queryTimeoutMs();
+      const gen = ++this.generation;
       Atomics.store(this.status, 0, 0);
-      this.worker.postMessage({ sql, params });
-      const waitResult = Atomics.wait(this.status, 0, 0, PgSyncPool.QUERY_TIMEOUT_MS);
-      const code = Atomics.load(this.status, 0);
-      if (code === 0 || waitResult === "timed-out") {
-        if (this.lastError)
-          throw this.lastError;
-        throw new Error("PostgreSQL query timed out after 60s");
-      }
-      const len = Atomics.load(this.status, 1);
-      const payload = JSON.parse(new TextDecoder().decode(this.data.subarray(0, len)));
-      if (code === 2) {
-        throw new Error(payload.message ?? "PostgreSQL error");
+      Atomics.store(this.status, 2, 0);
+      this.worker.postMessage({ sql, params, gen });
+      const deadline = Date.now() + timeoutMs;
+      for (;; ) {
+        const remaining = deadline - Date.now();
+        const responding = Atomics.load(this.status, 0);
+        if (responding === gen) {
+          const code = Atomics.load(this.status, 2);
+          const len = Atomics.load(this.status, 1);
+          const payload = JSON.parse(new TextDecoder().decode(this.data.subarray(0, len)));
+          if (code === 2) {
+            throw new Error(payload.message ?? "PostgreSQL error");
+          }
+          return payload;
+        }
+        if (responding !== 0) {
+          Atomics.compareExchange(this.status, 0, responding, 0);
+          continue;
+        }
+        if (remaining <= 0) {
+          if (this.lastError)
+            throw this.lastError;
+          throw new Error(`PostgreSQL query timed out after ${timeoutMs}ms`);
+        }
+        Atomics.wait(this.status, 0, 0, remaining);
       }
-      return payload;
     }
     end() {
       if (this.closed)
@@ -3252,6 +3289,7 @@ __export(exports_memories, {
   updateMemory: () => updateMemory,
   touchMemory: () => touchMemory,
   semanticSearch: () => semanticSearch,
+  reservedAgentIdViolation: () => reservedAgentIdViolation,
   parseMemoryRow: () => parseMemoryRow,
   listMemoryHistoryPage: () => listMemoryHistoryPage,
   listMemoryHistory: () => listMemoryHistory,
@@ -3323,7 +3361,20 @@ function parseMemoryRow(row) {
     accessed_at: row["accessed_at"] || null
   };
 }
+function reservedAgentIdViolation(agentId) {
+  if (!agentId)
+    return null;
+  const normalized = agentId.trim().toLowerCase();
+  if (RESERVED_AGENT_IDS.has(normalized)) {
+    return `Reserved placeholder agent id "${agentId}" cannot own a memory. ` + `Refusing to write: test harnesses must not write memories under placeholder agent ` + `identities. Register a real agent (mementos register-agent <name>) and pass its id.`;
+  }
+  return null;
+}
 function createMemory(input, dedupeMode = "merge", db) {
+  const reservedViolation = reservedAgentIdViolation(input.agent_id);
+  if (reservedViolation) {
+    throw new Error(reservedViolation);
+  }
   if (!db && isApiMode()) {
     const { status, data } = apiJson("POST", "/memories", { ...input, dedupe: dedupeMode });
     if (!data || !data.id) {
@@ -3373,7 +3424,8 @@ function createMemory(input, dedupeMode = "merge", db) {
            importance = ?, metadata = ?, expires_at = ?,
            when_to_use = ?,
            pinned = COALESCE(pinned, 0),
-           version = version + 1, updated_at = ?
+           version = version + 1, updated_at = ?,
+           updated_by_agent = ?
          WHERE id = ?`, [
         safeValue,
         input.category || "knowledge",
@@ -3384,6 +3436,7 @@ function createMemory(input, dedupeMode = "merge", db) {
         expiresAt,
         input.when_to_use || null,
         timestamp,
+        input.agent_id || null,
         existing.id
       ]);
       d.run("DELETE FROM memory_tags WHERE memory_id = ?", [existing.id]);
@@ -3488,6 +3541,12 @@ function bulkUpsertMemories(memories, db) {
         errors.push(`Rejected "${key}": ${formatEnumViolation(violation)}`);
         continue;
       }
+      const agentViolation = reservedAgentIdViolation(typeof mem["agent_id"] === "string" ? mem["agent_id"] : undefined);
+      if (agentViolation) {
+        rejected++;
+        errors.push(`Rejected "${key}": ${agentViolation}`);
+        continue;
+      }
       const timestamp = now();
       let tags = [];
       const rawTags = mem["tags"];
@@ -3766,6 +3825,11 @@ function listMemoriesPage(filter, db) {
       agent_id: f.agent_id,
       project_id: f.project_id,
       session_id: f.session_id,
+      machine_id: f.machine_id,
+      visible_to_machine_id: f.visible_to_machine_id,
+      search: f.search,
+      source: f.source,
+      flag: f.flag,
       namespace: f.namespace,
       as_of: f.as_of,
       limit: f.limit,
@@ -4045,20 +4109,29 @@ function updateMemory(id, input, db) {
     sets.push("when_to_use = ?");
     params.push(input.when_to_use ?? null);
   }
+  if (input.updated_by_agent !== undefined) {
+    sets.push("updated_by_agent = ?");
+    params.push(input.updated_by_agent ?? null);
+  }
   if (input.tags !== undefined) {
     sets.push("tags = ?");
     params.push(JSON.stringify(input.tags));
-    d.run("DELETE FROM memory_tags WHERE memory_id = ?", [memoryId]);
-    const insertTag = d.prepare("INSERT OR IGNORE INTO memory_tags (memory_id, tag) VALUES (?, ?)");
-    for (const tag of input.tags) {
-      insertTag.run(memoryId, tag);
-    }
   }
   params.push(memoryId);
-  const result = d.run(`UPDATE memories SET ${sets.join(", ")} WHERE id = ?`, params);
-  if (result.changes === 0) {
-    throw new Error(`Update affected no rows for memory ${memoryId}: the record was read but not written. ` + `This is a bug in @hasna/mementos, not a bad argument \u2014 please report it.`);
-  }
+  d.transaction(() => {
+    const res = d.run(`UPDATE memories SET ${sets.join(", ")} WHERE id = ?`, params);
+    if (res.changes === 0) {
+      throw new Error(`Update affected no rows for memory ${memoryId}: the record was read but not written. ` + `This is a bug in @hasna/mementos, not a bad argument \u2014 please report it.`);
+    }
+    if (input.tags !== undefined) {
+      d.run("DELETE FROM memory_tags WHERE memory_id = ?", [memoryId]);
+      const insertTag = d.prepare("INSERT OR IGNORE INTO memory_tags (memory_id, tag) VALUES (?, ?)");
+      for (const tag of input.tags) {
+        insertTag.run(memoryId, tag);
+      }
+    }
+    return res;
+  });
   const updated = getMemory(memoryId, d);
   if (input.value !== undefined) {
     try {
@@ -4229,7 +4302,7 @@ async function semanticSearch(queryText, options = {}, db) {
   scored.sort((a, b) => b.score - a.score);
   return scored.slice(0, limit);
 }
-var RECALL_PROMOTE_THRESHOLD = 3;
+var RESERVED_AGENT_IDS, RECALL_PROMOTE_THRESHOLD = 3;
 var init_memories = __esm(() => {
   init_types();
   init_database();
@@ -4239,6 +4312,12 @@ var init_memories = __esm(() => {
   init_poisoning();
   init_entity_memories();
   init_api_mode();
+  RESERVED_AGENT_IDS = new Set([
+    "agent-a",
+    "agent-x",
+    "agent-z",
+    "nonexistent-agent"
+  ]);
 });
 
 // src/db/machines.ts
@@ -4333,6 +4412,8 @@ var init_machines = __esm(() => {
 });
 
 // src/db/webhook_hooks.ts
+import { isIP } from "net";
+import { lookup as dnsLookup } from "dns/promises";
 function parseRow(row) {
   return {
     id: row["id"],
@@ -4349,7 +4430,153 @@ function parseRow(row) {
     failureCount: row["failure_count"]
   };
 }
-function createWebhookHook(input, db) {
+function isBlockedIpv4(parts) {
+  const a = parts[0];
+  const b = parts[1];
+  if (a === 0)
+    return true;
+  if (a === 127)
+    return true;
+  if (a === 169 && b === 254)
+    return true;
+  if (a === 10)
+    return true;
+  if (a === 172 && b >= 16 && b <= 31)
+    return true;
+  if (a === 192 && b === 168)
+    return true;
+  return false;
+}
+function isBlockedIpv6(bytes) {
+  const mapped = bytes.slice(0, 10).every((b) => b === 0) && bytes[10] === 255 && bytes[11] === 255;
+  if (mapped)
+    return isBlockedIpv4(bytes.slice(12, 16));
+  if (bytes.every((b) => b === 0))
+    return true;
+  if (bytes.slice(0, 15).every((b) => b === 0) && bytes[15] === 1)
+    return true;
+  if ((bytes[0] & 254) === 252)
+    return true;
+  if (bytes[0] === 254 && (bytes[1] & 192) === 128)
+    return true;
+  return false;
+}
+function quadToGroups(quad) {
+  const nums = quad.split(".").map((p) => Number(p));
+  const [a, b, c, d] = nums;
+  const valid = [a, b, c, d].every((n) => n !== undefined && Number.isInteger(n) && n >= 0 && n <= 255);
+  if (!valid)
+    return null;
+  return [a << 8 | b, c << 8 | d];
+}
+function parseIpv6Bytes(host) {
+  const groups = host.split("::");
+  if (groups.length > 2)
+    return null;
+  const headRaw = groups[0] ?? "";
+  const tailRaw = groups[1] ?? "";
+  const head = headRaw === "" ? [] : headRaw.split(":");
+  const tail = tailRaw === "" ? [] : tailRaw.split(":");
+  const headNums = [];
+  for (const g of head) {
+    if (!/^[0-9a-f]{1,4}$/i.test(g))
+      return null;
+    headNums.push(parseInt(g, 16));
+  }
+  const tailNums = [];
+  for (const g of tail) {
+    if (/^\d+\.\d+\.\d+\.\d+$/.test(g)) {
+      const quads = quadToGroups(g);
+      if (!quads)
+        return null;
+      tailNums.push(...quads);
+    } else if (/^[0-9a-f]{1,4}$/i.test(g)) {
+      tailNums.push(parseInt(g, 16));
+    } else {
+      return null;
+    }
+  }
+  const hasCompression = groups.length === 2;
+  if (!hasCompression && headNums.length !== 8)
+    return null;
+  if (hasCompression && headNums.length + tailNums.length >= 8)
+    return null;
+  const zeros = 8 - headNums.length - tailNums.length;
+  const all = [...headNums, ...new Array(zeros).fill(0), ...tailNums];
+  const bytes = [];
+  for (const n of all) {
+    bytes.push(n >> 8 & 255, n & 255);
+  }
+  return bytes;
+}
+function defaultResolveHost(hostname2) {
+  return dnsLookup(hostname2, { all: true, verbatim: true });
+}
+function assertResolvedAddressPublic(address, url) {
+  const version = isIP(address);
+  if (version === 4) {
+    if (isBlockedIpv4(address.split(".").map((p) => Number(p)))) {
+      throw new Error(`${BLOCKED_TARGET_MESSAGE}: "${url}"`);
+    }
+  } else if (version === 6) {
+    const bytes = parseIpv6Bytes(address);
+    if (!bytes || isBlockedIpv6(bytes)) {
+      throw new Error(`${BLOCKED_TARGET_MESSAGE}: "${url}"`);
+    }
+  } else {
+    throw new Error(`${BLOCKED_TARGET_MESSAGE}: "${url}"`);
+  }
+}
+async function validateWebhookHandlerUrl(url, opts) {
+  const resolveHost = opts?.lookup ?? defaultResolveHost;
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error(`Invalid webhook handler URL "${url}" \u2014 must be a valid http(s) URL`);
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new Error(`Invalid webhook handler URL "${url}" \u2014 only http and https are allowed`);
+  }
+  if (parsed.username || parsed.password) {
+    throw new Error(`Invalid webhook handler URL "${url}" \u2014 embedded credentials are not allowed`);
+  }
+  const host = parsed.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  if (host === "localhost" || host.endsWith(".localhost")) {
+    throw new Error(`${BLOCKED_TARGET_MESSAGE}: "${url}"`);
+  }
+  const version = isIP(host);
+  if (version === 4 || version === 6) {
+    if (version === 4) {
+      if (isBlockedIpv4(host.split(".").map((p) => Number(p)))) {
+        throw new Error(`${BLOCKED_TARGET_MESSAGE}: "${url}"`);
+      }
+    } else {
+      const bytes = parseIpv6Bytes(host);
+      if (!bytes || isBlockedIpv6(bytes)) {
+        throw new Error(`${BLOCKED_TARGET_MESSAGE}: "${url}"`);
+      }
+    }
+    return;
+  }
+  if (/^[0-9]+(\.[0-9]+)*$/.test(host) || /^0x[0-9a-f]+$/i.test(host) || host.includes("%")) {
+    throw new Error(`${BLOCKED_TARGET_MESSAGE}: "${url}"`);
+  }
+  let addrs;
+  try {
+    addrs = await resolveHost(host);
+  } catch {
+    throw new Error(`${BLOCKED_TARGET_MESSAGE}: "${url}"`);
+  }
+  if (addrs.length === 0) {
+    throw new Error(`${BLOCKED_TARGET_MESSAGE}: "${url}"`);
+  }
+  for (const { address } of addrs) {
+    assertResolvedAddressPublic(address, url);
+  }
+}
+async function createWebhookHook(input, db, opts) {
+  await validateWebhookHandlerUrl(input.handlerUrl, opts);
   if (!db && isApiMode()) {
     const { data } = apiJson("POST", "/webhooks", {
       type: input.type,
@@ -4467,6 +4694,7 @@ function recordWebhookInvocation(id, success, db) {
     d.run("UPDATE webhook_hooks SET invocation_count = invocation_count + 1, failure_count = failure_count + 1 WHERE id = ?", [id]);
   }
 }
+var BLOCKED_TARGET_MESSAGE = "Invalid webhook handler URL \u2014 loopback, link-local, and private network targets are not allowed";
 var init_webhook_hooks = __esm(() => {
   init_database();
   init_api_mode();
@@ -5116,7 +5344,7 @@ function buildFilterConditions(filter) {
   const conditions = [];
   const params = [];
   conditions.push("m.status = 'active'");
-  conditions.push("(m.expires_at IS NULL OR m.expires_at >= datetime('now'))");
+  conditions.push("(m.expires_at IS NULL OR m.expires_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))");
   if (!filter)
     return { conditions, params };
   if (filter.scope) {
@@ -7125,7 +7353,7 @@ async function detectContradiction(newKey, newValue, options = {}, db) {
     conditions.push("project_id = ?");
     params.push(project_id);
   }
-  conditions.push("(valid_until IS NULL OR valid_until > datetime('now'))");
+  conditions.push("(valid_until IS NULL OR valid_until > strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))");
   const sql = `SELECT * FROM memories WHERE ${conditions.join(" AND ")} ORDER BY importance DESC LIMIT 10`;
   const rows = d.query(sql).all(...params);
   if (rows.length === 0) {
@@ -7172,6 +7400,7 @@ var init_contradiction = __esm(() => {
 var exports_built_in_hooks = {};
 __export(exports_built_in_hooks, {
   reloadWebhooks: () => reloadWebhooks,
+  makeWebhookHandler: () => makeWebhookHandler,
   loadWebhooksFromDb: () => loadWebhooksFromDb
 });
 async function getAutoMemory() {
@@ -7181,13 +7410,19 @@ async function getAutoMemory() {
   }
   return _processConversationTurn;
 }
-function loadWebhooksFromDb() {
+async function loadWebhooksFromDb() {
   if (_webhooksLoaded)
     return;
   _webhooksLoaded = true;
   try {
     const webhooks = listWebhookHooks({ enabled: true });
     for (const wh of webhooks) {
+      try {
+        await validateWebhookHandlerUrl(wh.handlerUrl);
+      } catch (err) {
+        console.error(`[hooks] Skipping webhook ${wh.id} (${wh.type}): ${err instanceof Error ? err.message : String(err)}`);
+        continue;
+      }
       hookRegistry.register({
         type: wh.type,
         blocking: wh.blocking,
@@ -7205,9 +7440,10 @@ function loadWebhooksFromDb() {
     console.error("[hooks] Failed to load webhooks from DB:", err);
   }
 }
-function makeWebhookHandler(webhookId, url) {
+function makeWebhookHandler(webhookId, url, opts) {
   return async (context) => {
     try {
+      await validateWebhookHandlerUrl(url, opts);
       const res = await fetch(url, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
@@ -7220,9 +7456,9 @@ function makeWebhookHandler(webhookId, url) {
     }
   };
 }
-function reloadWebhooks() {
+async function reloadWebhooks() {
   _webhooksLoaded = false;
-  loadWebhooksFromDb();
+  await loadWebhooksFromDb();
 }
 var _processConversationTurn = null, _webhooksLoaded = false;
 var init_built_in_hooks = __esm(() => {
@@ -23314,7 +23550,7 @@ class JSONSchemaGenerator {
               if (val === undefined) {
                 if (this.unrepresentable === "throw") {
                   throw new Error("Literal `undefined` cannot be represented in JSON Schema");
-                }
+                } else {}
               } else if (typeof val === "bigint") {
                 if (this.unrepresentable === "throw") {
                   throw new Error("BigInt literals cannot be represented in JSON Schema");
@@ -44964,7 +45200,7 @@ var require_tracestate_impl = __commonJS((exports) => {
           const value = listMember.slice(i + 1, part.length);
           if ((0, tracestate_validators_1.validateKey)(key) && (0, tracestate_validators_1.validateValue)(value)) {
             agg.set(key, value);
-          }
+          } else {}
         }
         return agg;
       }, new Map);
@@ -60192,7 +60428,10 @@ function getMemoryStats(db) {
   const byCategory = d.query("SELECT category, COUNT(*) as c FROM memories WHERE status = 'active' GROUP BY category").all();
   const byStatus = d.query("SELECT status, COUNT(*) as c FROM memories WHERE status = 'active' GROUP BY status").all();
   const pinnedCount = d.query("SELECT COUNT(*) as c FROM memories WHERE pinned = 1 AND status = 'active'").get().c;
-  const expiredCount = d.query("SELECT COUNT(*) as c FROM memories WHERE status = 'expired' OR (expires_at IS NOT NULL AND expires_at < datetime('now'))").get().c;
+  const expiredCount = d.query("SELECT COUNT(*) as c FROM memories WHERE status = 'expired'").get().c;
+  const expiresAtCount = d.query("SELECT COUNT(*) as c FROM memories WHERE expires_at IS NOT NULL").get().c;
+  const nowIso = new Date().toISOString();
+  const expiredDueCount = d.query("SELECT COUNT(*) as c FROM memories WHERE status = 'expired' OR (expires_at IS NOT NULL AND expires_at < ?)").get(nowIso).c;
   const stats = {
     total,
     by_scope: { global: 0, shared: 0, private: 0, working: 0 },
@@ -60200,7 +60439,9 @@ function getMemoryStats(db) {
     by_status: { active: 0, archived: 0, expired: 0 },
     by_agent: {},
     pinned_count: pinnedCount,
-    expired_count: expiredCount
+    expired_count: expiredCount,
+    expires_at_count: expiresAtCount,
+    expired_due_count: expiredDueCount
   };
   for (const row of byScope)
     if (row.scope in stats.by_scope)
@@ -60234,7 +60475,9 @@ function normalizeStats(data) {
     by_status: { active: 0, archived: 0, expired: 0, ...data?.by_status ?? {} },
     by_agent: data?.by_agent ?? {},
     pinned_count: data?.pinned_count ?? 0,
-    expired_count: data?.expired_count ?? 0
+    expired_count: data?.expired_count ?? 0,
+    expires_at_count: data?.expires_at_count ?? 0,
+    expired_due_count: data?.expired_due_count ?? 0
   };
 }
 function getMemoryActivity(filter = {}, db) {
@@ -60332,7 +60575,7 @@ function getStaleMemoriesPage(filter = {}, db) {
   const limit = filter.limit ?? 20;
   const offset = filter.offset ?? 0;
   if (!db && isApiMode()) {
-    const q = toQuery({ days, project_id: filter.project_id, agent_id: filter.agent_id, limit, offset });
+    const q = toQuery({ days, project_id: filter.project_id, agent_id: filter.agent_id, pinned: filter.pinned, limit, offset });
     const { data } = apiJson("GET", `/memories/stale${q}`);
     const rows2 = data?.memories ?? [];
     return {
@@ -60344,8 +60587,14 @@ function getStaleMemoriesPage(filter = {}, db) {
   }
   const d = db || getDatabase();
   const cutoffDate = new Date(Date.now() - days * 86400000).toISOString();
-  const conds = ["status = 'active'", "(accessed_at IS NULL OR accessed_at < ?)", "pinned = 0"];
+  const conds = ["status = 'active'", "(accessed_at IS NULL OR accessed_at < ?)"];
   const params = [cutoffDate];
+  if (filter.pinned !== undefined) {
+    conds.push("pinned = ?");
+    params.push(filter.pinned ? 1 : 0);
+  } else {
+    conds.push("pinned = 0");
+  }
   if (filter.project_id) {
     conds.push("project_id = ?");
     params.push(filter.project_id);
@@ -60543,7 +60792,7 @@ function hasFts5Table2(db) {
 function buildScopeFilter(opts) {
   const conditions = [
     "m.status = 'active'",
-    "(m.expires_at IS NULL OR m.expires_at >= datetime('now'))",
+    "(m.expires_at IS NULL OR m.expires_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))",
     "m.category IN ('preference', 'fact', 'knowledge')"
   ];
   const params = [];
@@ -60811,7 +61060,7 @@ async function runTemporalAgent(db, query, opts) {
   const maxResults = opts.max_results ?? 20;
   const limit = maxResults * 3;
   const conditions = [
-    "(m.expires_at IS NULL OR m.expires_at >= datetime('now'))"
+    "(m.expires_at IS NULL OR m.expires_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))"
   ];
   const params = [];
   if (opts.project_id) {
@@ -61529,6 +61778,7 @@ function registerMemoryLifecycleTools(server) {
   });
   server.tool("memory_stale", "Find memories not accessed recently. Useful for cleanup or review.", {
     days: exports_external.coerce.number().optional(),
+    pinned: exports_external.boolean().optional().describe("Review stale pinned memories (default excludes pinned)"),
     project_id: exports_external.string().optional(),
     agent_id: exports_external.string().optional(),
     limit: exports_external.coerce.number().optional()
@@ -61537,6 +61787,7 @@ function registerMemoryLifecycleTools(server) {
       const days = args.days || 30;
       const rows = getStaleMemories({
         days,
+        pinned: args.pinned,
         project_id: args.project_id,
         agent_id: args.agent_id,
         limit: args.limit || 20
@@ -63213,6 +63464,7 @@ function syncMemoriesTable(source, target, local, direction, currentMachineId) {
     const countResult = source.get(`SELECT COUNT(*) as cnt FROM "${MEMORY_TABLE}"`);
     stat.total_rows = countResult?.cnt ?? 0;
     const rows = since ? source.all(`SELECT * FROM "${MEMORY_TABLE}" WHERE updated_at > ?`, since) : source.all(`SELECT * FROM "${MEMORY_TABLE}"`);
+    const erroredRowIds = new Set;
     for (const row of rows) {
       try {
         const sourceMachine = sourceMachineRef(row, currentMachineId);
@@ -63271,18 +63523,34 @@ function syncMemoriesTable(source, target, local, direction, currentMachineId) {
         clearMemoryEmbedding(winnerDb, String(winner["id"]));
         stat.synced_rows++;
       } catch (error) {
+        erroredRowIds.add(String(row["id"] ?? "unknown"));
         stat.errors.push(`Memory ${String(row["id"] ?? "unknown")}: ${error instanceof Error ? error.message : String(error)}`);
       }
     }
     if (rows.length === 0) {
       stat.skipped_rows = stat.total_rows;
     }
-    upsertMemorySyncMeta(local, {
-      table_name: MEMORY_TABLE,
-      direction,
-      last_synced_at: new Date().toISOString(),
-      last_synced_row_count: stat.synced_rows
-    });
+    if (rows.length > 0 && stat.errors.length === 0) {
+      let maxSyncedAt = null;
+      for (const row of rows) {
+        if (erroredRowIds.has(String(row["id"] ?? "unknown"))) {
+          continue;
+        }
+        const value = row["updated_at"];
+        if (typeof value === "string" && (maxSyncedAt === null || value > maxSyncedAt)) {
+          maxSyncedAt = value;
+        }
+      }
+      const nextCursor = maxSyncedAt ?? syncMeta?.last_synced_at ?? null;
+      if (nextCursor !== null) {
+        upsertMemorySyncMeta(local, {
+          table_name: MEMORY_TABLE,
+          direction,
+          last_synced_at: nextCursor,
+          last_synced_row_count: stat.synced_rows
+        });
+      }
+    }
   } catch (error) {
     stat.errors.push(error instanceof Error ? error.message : String(error));
   }
@@ -63683,7 +63951,7 @@ function acquireLock(agentId, resourceType, resourceId, lockType = "exclusive",
   }
   const d = db || getDatabase();
   cleanExpiredLocks(d);
-  const ownLock = d.query("SELECT * FROM resource_locks WHERE resource_type = ? AND resource_id = ? AND agent_id = ? AND lock_type = ? AND expires_at > datetime('now')").get(resourceType, resourceId, agentId, lockType);
+  const ownLock = d.query("SELECT * FROM resource_locks WHERE resource_type = ? AND resource_id = ? AND agent_id = ? AND lock_type = ? AND expires_at > strftime('%Y-%m-%dT%H:%M:%fZ', 'now')").get(resourceType, resourceId, agentId, lockType);
   if (ownLock) {
     const newExpiry = new Date(Date.now() + ttlSeconds * 1000).toISOString();
     d.run("UPDATE resource_locks SET expires_at = ? WHERE id = ?", [
@@ -63693,7 +63961,7 @@ function acquireLock(agentId, resourceType, resourceId, lockType = "exclusive",
     return parseLockRow({ ...ownLock, expires_at: newExpiry });
   }
   if (lockType === "exclusive") {
-    const existing = d.query("SELECT * FROM resource_locks WHERE resource_type = ? AND resource_id = ? AND lock_type = 'exclusive' AND agent_id != ? AND expires_at > datetime('now')").get(resourceType, resourceId, agentId);
+    const existing = d.query("SELECT * FROM resource_locks WHERE resource_type = ? AND resource_id = ? AND lock_type = 'exclusive' AND agent_id != ? AND expires_at > strftime('%Y-%m-%dT%H:%M:%fZ', 'now')").get(resourceType, resourceId, agentId);
     if (existing) {
       return null;
     }
@@ -63729,7 +63997,7 @@ function checkLock(resourceType, resourceId, lockType, db) {
   }
   const d = db || getDatabase();
   cleanExpiredLocks(d);
-  const query = lockType ? "SELECT * FROM resource_locks WHERE resource_type = ? AND resource_id = ? AND lock_type = ? AND expires_at > datetime('now')" : "SELECT * FROM resource_locks WHERE resource_type = ? AND resource_id = ? AND expires_at > datetime('now')";
+  const query = lockType ? "SELECT * FROM resource_locks WHERE resource_type = ? AND resource_id = ? AND lock_type = ? AND expires_at > strftime('%Y-%m-%dT%H:%M:%fZ', 'now')" : "SELECT * FROM resource_locks WHERE resource_type = ? AND resource_id = ? AND expires_at > strftime('%Y-%m-%dT%H:%M:%fZ', 'now')";
   const rows = lockType ? d.query(query).all(resourceType, resourceId, lockType) : d.query(query).all(resourceType, resourceId);
   return rows.map(parseLockRow);
 }
@@ -63740,14 +64008,14 @@ function listAgentLocks(agentId, db) {
   }
   const d = db || getDatabase();
   cleanExpiredLocks(d);
-  const rows = d.query("SELECT * FROM resource_locks WHERE agent_id = ? AND expires_at > datetime('now') ORDER BY locked_at DESC").all(agentId);
+  const rows = d.query("SELECT * FROM resource_locks WHERE agent_id = ? AND expires_at > strftime('%Y-%m-%dT%H:%M:%fZ', 'now') ORDER BY locked_at DESC").all(agentId);
   return rows.map(parseLockRow);
 }
 function cleanExpiredLocksWithInfo(db) {
   const d = db || getDatabase();
-  const expired = d.query("SELECT id, resource_type, resource_id, agent_id, lock_type FROM resource_locks WHERE expires_at <= datetime('now')").all();
+  const expired = d.query("SELECT id, resource_type, resource_id, agent_id, lock_type FROM resource_locks WHERE expires_at <= strftime('%Y-%m-%dT%H:%M:%fZ', 'now')").all();
   if (expired.length > 0) {
-    d.run("DELETE FROM resource_locks WHERE expires_at <= datetime('now')");
+    d.run("DELETE FROM resource_locks WHERE expires_at <= strftime('%Y-%m-%dT%H:%M:%fZ', 'now')");
   }
   return expired;
 }
@@ -63757,7 +64025,7 @@ function cleanExpiredLocks(db) {
     return data?.cleaned ?? 0;
   }
   const d = db || getDatabase();
-  const result = d.run("DELETE FROM resource_locks WHERE expires_at <= datetime('now')");
+  const result = d.run("DELETE FROM resource_locks WHERE expires_at <= strftime('%Y-%m-%dT%H:%M:%fZ', 'now')");
   return result.changes;
 }
 
@@ -64096,7 +64364,7 @@ ${lines.join(`
   }, async (args) => {
     try {
       const { reloadWebhooks: reloadWebhooks2 } = await Promise.resolve().then(() => (init_built_in_hooks(), exports_built_in_hooks));
-      const wh = createWebhookHook({
+      const wh = await createWebhookHook({
         type: args.type,
         handlerUrl: args.handler_url,
         priority: args.priority,
@@ -64105,7 +64373,7 @@ ${lines.join(`
         projectId: args.project_id,
         description: args.description
       });
-      reloadWebhooks2();
+      await reloadWebhooks2();
       return { content: [{ type: "text", text: JSON.stringify(wh, null, 2) }] };
     } catch (e) {
       return { content: [{ type: "text", text: formatError6(e) }], isError: true };
@@ -65547,6 +65815,12 @@ function getNextPendingJob(db) {
     return null;
   return parseJobRow(row);
 }
+function claimSessionJob(id, db) {
+  const d = db || getDatabase();
+  const startedAt = now();
+  const result = d.run("UPDATE session_memory_jobs SET status = 'processing', started_at = ? WHERE id = ? AND status = 'pending'", [startedAt, id]);
+  return result.changes;
+}
 
 // src/lib/session-queue.ts
 init_database();
@@ -65890,7 +66164,11 @@ async function processSessionJob(jobId, db) {
     return result;
   }
   try {
-    updateSessionJob(jobId, { status: "processing", started_at: new Date().toISOString() }, db);
+    const changes = claimSessionJob(jobId, db);
+    if (changes === 0) {
+      result.errors.push(`Job already claimed or not pending: ${jobId}`);
+      return result;
+    }
   } catch (e) {
     result.errors.push(`Failed to mark job as processing: ${String(e)}`);
     return result;
@@ -68348,7 +68626,7 @@ async function prepareMcpRuntime() {
     }
   } catch {}
   await ensureRestServerRunning();
-  loadWebhooksFromDb();
+  await loadWebhooksFromDb();
 }
 async function main() {
   if (hasFlag("--help", "-h")) {