@lotargo/memory_plugin 1.4.620 → 1.5.0

package/mcp-server/config/auth_store.js

@@ -7,10 +7,28 @@ import { MEMORY_DIR, ensureDirSync } from "../memory.js";
 
 const SECRETS_FILE = path.join(MEMORY_DIR, "auth_secrets.enc");
 
+// ── Module-level caches ─────────────────────────────────────────────────────
+// These avoid re-running expensive sync operations (execSync, PBKDF2, file I/O)
+// on every CLI navigation or tool call.  invalidateAuthCache() must be called
+// whenever secrets are deleted or the API key is removed.
+let _cachedMachineId = undefined;  // undefined = not yet resolved
+let _cachedFingerprint = null;
+let _cachedEncryptionKey = null;
+let _cachedSecrets = undefined;    // undefined = not loaded, null = no secrets, object = cached
+let _cachedSecretsMtime = 0;
+
+export function invalidateAuthCache() {
+  _cachedSecrets = undefined;
+  _cachedSecretsMtime = 0;
+  // Keep machineId / fingerprint / key cached — they don't change per-session.
+}
+
 // Stable per-machine identifier. Must NOT rely on volatile values (e.g.
 // os.networkInterfaces() — VPN adapters, hotspot IPs and IPv6 privacy
 // addresses rotate constantly and would silently change the AES key).
 function getMachineId() {
+  if (_cachedMachineId !== undefined) return _cachedMachineId;
+  let id = null;
   try {
     if (process.platform === "win32") {
       const out = execSync("reg query HKLM\\SOFTWARE\\Microsoft\\Cryptography /v MachineGuid", {
@@ -18,12 +36,12 @@ function getMachineId() {
         stdio: ["ignore", "pipe", "ignore"],
       });
       const m = out.match(/MachineGuid\s+REG_SZ\s+([0-9a-fA-F-]{36})/i);
-      if (m) return m[1].toLowerCase();
+      if (m) id = m[1].toLowerCase();
     } else if (process.platform === "linux") {
       for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
         try {
           const v = fs.readFileSync(p, "utf8").trim();
-          if (v) return v;
+          if (v) { id = v; break; }
         } catch {}
       }
     } else if (process.platform === "darwin") {
@@ -32,15 +50,17 @@ function getMachineId() {
         stdio: ["ignore", "pipe", "ignore"],
       });
       const m = out.match(/"IOPlatformUUID"\s*=\s*"([^"]+)"/);
-      if (m) return m[1];
+      if (m) id = m[1];
     }
   } catch {}
-  return null;
+  _cachedMachineId = id;
+  return _cachedMachineId;
 }
 
 // Generate a deterministic hardware + system fingerprint (stable across reboots,
 // network changes and user sessions on the same machine).
 function getSystemFingerprint() {
+  if (_cachedFingerprint !== null && _cachedFingerprint !== undefined) return _cachedFingerprint;
   const parts = [
     getMachineId() || "no-machine-id",
     os.hostname() || "localhost",
@@ -48,15 +68,18 @@ function getSystemFingerprint() {
     os.platform() || "unknown",
     os.arch() || "unknown",
   ];
-  return parts.join("|");
+  _cachedFingerprint = parts.join("|");
+  return _cachedFingerprint;
 }
 
 // Derive a 256-bit (32 bytes) key using PBKDF2 with salt derived from fingerprint
 function deriveEncryptionKey() {
+  if (_cachedEncryptionKey) return _cachedEncryptionKey;
   const fingerprint = getSystemFingerprint();
   const salt = crypto.createHash("sha256").update(fingerprint).digest();
   // PBKDF2 with 10,000 iterations to derive a secure 32-byte key
-  return crypto.pbkdf2Sync(fingerprint, salt, 10000, 32, "sha256");
+  _cachedEncryptionKey = crypto.pbkdf2Sync(fingerprint, salt, 10000, 32, "sha256");
+  return _cachedEncryptionKey;
 }
 
 // Encrypt data using AES-256-GCM
@@ -95,39 +118,175 @@ export function decryptData(encryptedStr) {
   return decrypted;
 }
 
-// Save secrets securely
-export function saveSecrets(secrets) {
-  ensureDirSync();
-  const plainText = JSON.stringify(secrets);
-  const encrypted = encryptData(plainText);
-  fs.writeFileSync(SECRETS_FILE, encrypted, "utf-8");
+// Load a KEY=VALUE .env file from MEMORY_DIR (global environment override for
+// headless / Docker / CI deployments). Values may optionally be quoted.
+function loadEnvFile() {
+  const envFile = path.join(MEMORY_DIR, ".env");
+  if (!fs.existsSync(envFile)) return {};
+  try {
+    const out = {};
+    const raw = fs.readFileSync(envFile, "utf-8");
+    for (const line of raw.split(/\r?\n/)) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#")) continue;
+      const eq = trimmed.indexOf("=");
+      if (eq <= 0) continue;
+      const key = trimmed.slice(0, eq).trim();
+      let value = trimmed.slice(eq + 1).trim();
+      if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
+        value = value.slice(1, -1);
+      }
+      if (key) out[key] = value;
+    }
+    return out;
+  } catch {
+    return {};
+  }
 }
 
-// Load secrets securely
-export function loadSecrets() {
-  if (!fs.existsSync(SECRETS_FILE)) {
-    return null;
+const ENV_DB_URL_KEYS = ["TURSO_DB_URL", "TURSO_URL"];
+const ENV_DB_TOKEN_KEYS = ["TURSO_DB_TOKEN", "TURSO_TOKEN"];
+
+function firstDefined(source, keys) {
+  for (const k of keys) {
+    const v = source[k];
+    if (v && String(v).trim()) return String(v).trim();
   }
+  return null;
+}
+
+// Resolve cloud credentials from the environment (process.env) or a
+// MEMORY_DIR/.env file — the headless alternative to browser OAuth login.
+// Supported vars: TURSO_DB_URL / TURSO_URL, TURSO_DB_TOKEN / TURSO_TOKEN,
+// TURSO_API_TOKEN, TURSO_ORG, TURSO_DATABASE / TURSO_DB_NAME, TURSO_USERNAME.
+// Returns null when no cloud secrets are present at all.
+export function resolveEnvSecrets() {
+  const fileVars = loadEnvFile();
+  const merged = { ...fileVars, ...process.env };
+  const dbUrl = firstDefined(merged, ENV_DB_URL_KEYS);
+  const token = firstDefined(merged, ENV_DB_TOKEN_KEYS);
+  const apiToken = firstDefined(merged, ["TURSO_API_TOKEN"]);
+  const org = firstDefined(merged, ["TURSO_ORG"]);
+  const database = firstDefined(merged, ["TURSO_DATABASE", "TURSO_DB_NAME"]);
+  const username = firstDefined(merged, ["TURSO_USERNAME"]);
+  if (!dbUrl && !token && !apiToken) return null;
+  return { dbUrl, token, apiToken, org, database, username, source: "env" };
+}
+
+// Read the encrypted store file ONLY (no environment merge). Returns the raw
+// parsed record, or null when the file is missing / undecryptable.
+function readStoredSecrets() {
+  try {
+    if (fs.existsSync(SECRETS_FILE)) {
+      const mtime = fs.statSync(SECRETS_FILE).mtimeMs;
+      if (_cachedSecrets !== undefined && mtime === _cachedSecretsMtime) {
+        return _cachedSecrets;
+      }
+      _cachedSecretsMtime = mtime;
+    } else {
+      // File doesn't exist — clear cache
+      if (_cachedSecrets !== undefined && _cachedSecrets === null) return null;
+      _cachedSecrets = null;
+      _cachedSecretsMtime = 0;
+      return null;
+    }
+  } catch {}
   try {
     const encrypted = fs.readFileSync(SECRETS_FILE, "utf-8").trim();
-    if (!encrypted) return null;
-    const decrypted = decryptData(encrypted);
-    return JSON.parse(decrypted);
+    if (!encrypted) { _cachedSecrets = null; return null; }
+    _cachedSecrets = JSON.parse(decryptData(encrypted));
+    return _cachedSecrets;
   } catch (err) {
     console.error(
       "Failed to decrypt or load cloud secrets:",
       err.message,
       "— the file was encrypted with a different machine key. Re-run login to recreate it."
     );
+    _cachedSecrets = null;
     return null;
   }
 }
 
+// Where are cloud credentials coming from right now?
+//   "env"     — TURSO_API_TOKEN / TURSO_DB_URL + TURSO_DB_TOKEN from env or .env
+//   "api-key" — a stored Turso account API-token session (takes priority over browser)
+//   "store"   — a stored browser OAuth / database-token session
+//   null      — nothing configured
+export function getSecretsSource() {
+  const envSecrets = resolveEnvSecrets();
+  if (envSecrets && (envSecrets.apiToken || envSecrets.dbUrl)) return "env";
+  const stored = readStoredSecrets();
+  if (stored) return stored.apiToken ? "api-key" : "store";
+  return null;
+}
+
+// Save secrets securely
+export function saveSecrets(secrets) {
+  ensureDirSync();
+  const plainText = JSON.stringify(secrets);
+  const encrypted = encryptData(plainText);
+  fs.writeFileSync(SECRETS_FILE, encrypted, "utf-8");
+  _cachedSecrets = undefined;  // invalidate so readStoredSecrets re-reads
+  _cachedSecretsMtime = 0;
+  if (typeof _onSecretsChanged === "function") _onSecretsChanged();
+}
+
+let _onSecretsChanged = null;
+export function onSecretsChanged(cb) { _onSecretsChanged = cb; }
+
+// Load secrets securely. Priority (highest first):
+//   1. Env account API token (TURSO_API_TOKEN) — reused from the store when a
+//      session was already minted for this exact token, else returned with
+//      needsResolution: true so callers can mint a DB JWT asynchronously.
+//   2. Env database URL + token (TURSO_DB_URL + TURSO_DB_TOKEN).
+//   3. Encrypted store: an API-key session beats a browser/database-token session.
+// The env sources let Docker, Google Jules and VPS deployments work without
+// any interactive login step.
+export function loadSecrets() {
+  const envSecrets = resolveEnvSecrets();
+  if (envSecrets && envSecrets.apiToken) {
+    const stored = readStoredSecrets();
+    if (stored && stored.apiToken === envSecrets.apiToken && stored.dbUrl) {
+      return { ...stored, source: "api-key" };
+    }
+    return {
+      token: envSecrets.apiToken,
+      apiToken: envSecrets.apiToken,
+      dbUrl: envSecrets.dbUrl || "",
+      org: envSecrets.org || "",
+      db: envSecrets.database || "",
+      username: envSecrets.username || "",
+      authorized: true,
+      source: "env",
+      needsResolution: true,
+    };
+  }
+  if (envSecrets && envSecrets.dbUrl && envSecrets.token) {
+    return {
+      token: envSecrets.token,
+      dbUrl: envSecrets.dbUrl,
+      org: envSecrets.org || "",
+      db: envSecrets.database || "",
+      username: envSecrets.username || "",
+      authorized: true,
+      source: "env",
+    };
+  }
+  const stored = readStoredSecrets();
+  if (stored) {
+    if (stored.apiToken) return { ...stored, source: "api-key" };
+    return stored;
+  }
+  return null;
+}
+
 // Delete secrets from disk
 export function deleteSecrets() {
   if (fs.existsSync(SECRETS_FILE)) {
     try {
       fs.unlinkSync(SECRETS_FILE);
+      _cachedSecrets = null;
+      _cachedSecretsMtime = 0;
       return true;
     } catch (err) {
       console.error("Failed to delete secrets file:", err.message);

package/mcp-server/config/config_manager.js

@@ -15,6 +15,7 @@ export const DEFAULT_CONFIG = {
   onnxThreads: 0,          // ONNX WASM threads: 0 = auto-detect CPU cores, or 1-16
   executionDevice: "cpu",  // "cpu" | "webgpu"
   mode: "only-local",     // "only-local" | "only-cloud" | "hybrid-sync"
+  injectLimit: 10,
   conflictStrategy: "merge", // "merge" | "cloud-wins" | "local-wins"
   tursoUrl: "",           // Connection endpoint URL for Turso DB
   failoverUrl: "",        // Failover connection endpoint URL (Fly.io + LiteFS)

package/mcp-server/db/database.js

@@ -4,11 +4,13 @@ import { existsSync, mkdirSync } from "fs";
 import { MEMORY_DIR } from "../memory.js";
 import { runMigrations } from "./migrations.js";
 import { getConfig } from "../config/config_manager.js";
-import { loadSecrets } from "../config/auth_store.js";
+import { resolveCloudSecrets } from "../admin/auth.js";
 import { createClient } from "@libsql/client";
 
 let dbInstance = null;
 let dbInitPromise = null;
+let dbLastFailAt = 0;
+const DB_FAIL_COOLDOWN_MS = 5_000;  // don't retry cloud init within 5s of a failure
 
 export const STORAGE_DIR = join(MEMORY_DIR, "storage");
 export const BLOBS_DIR = join(STORAGE_DIR, "blobs");
@@ -159,7 +161,9 @@ async function openDatabase(customPath, mode) {
   let cloudClient = null;
   let failoverClient = null;
   if (mode === "only-cloud" || mode === "hybrid-sync") {
-    const secrets = loadSecrets();
+    // Resolve working cloud credentials. An env TURSO_API_TOKEN (which can only
+    // call the Platform API) is lazily minted into a per-database JWT here.
+    const secrets = await resolveCloudSecrets();
     const tursoUrl = customPath && customPath.startsWith("libsql:") ? customPath : (secrets?.dbUrl || config.tursoUrl);
     const failoverUrl = config.failoverUrl || "";
     const token = secrets?.token;
@@ -205,10 +209,20 @@ export async function getDatabase(customPath = null, forceMode = null) {
     if (dbInstance && dbInstance.mode === mode) {
       return dbInstance;
     }
+    // After a failed init, wait before retrying to avoid hammering cloud auth
+    if (!dbInitPromise && dbLastFailAt && (Date.now() - dbLastFailAt) < DB_FAIL_COOLDOWN_MS) {
+      throw new Error("Database initialization failed recently. Retrying in a few seconds...");
+    }
     // Deduplicate concurrent default-DB initialization so migrations never run
     // on multiple connections at once (avoids "database is locked" crashes).
     if (!dbInitPromise) {
-      dbInitPromise = openDatabase(null, mode).finally(() => {
+      dbInitPromise = openDatabase(null, mode).then((result) => {
+        dbLastFailAt = 0;
+        return result;
+      }).catch((err) => {
+        dbLastFailAt = Date.now();
+        throw err;
+      }).finally(() => {
         dbInitPromise = null;
       });
     }
@@ -220,6 +234,7 @@ export async function getDatabase(customPath = null, forceMode = null) {
 
 export function closeDatabase() {
   dbInitPromise = null;
+  dbLastFailAt = 0;
   if (dbInstance) {
     dbInstance.close();
     dbInstance = null;

package/mcp-server/db/migrations.js

@@ -110,6 +110,34 @@ const MIGRATIONS = [
       } catch (e) {}
     },
   },
+  {
+    version: 4,
+    name: "004_git_project_identity",
+    up: async (db) => {
+      await db.exec(`
+        CREATE TABLE IF NOT EXISTS project_identities (
+          key           TEXT PRIMARY KEY,
+          name          TEXT NOT NULL,
+          primary_remote TEXT,
+          created_at    INTEGER NOT NULL,
+          updated_at    INTEGER NOT NULL
+        );
+      `);
+
+      await db.exec(`
+        CREATE TABLE IF NOT EXISTS project_aliases (
+          alias        TEXT PRIMARY KEY,
+          identity_key TEXT NOT NULL REFERENCES project_identities(key) ON DELETE CASCADE,
+          kind         TEXT NOT NULL,
+          created_at   INTEGER NOT NULL
+        );
+      `);
+
+      await db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_project_aliases_identity ON project_aliases(identity_key);
+      `);
+    },
+  },
 ];
 
 export async function runMigrations(db) {