@lotargo/memory_plugin 1.4.621 → 1.5.0

package/mcp-server/config/auth_store.js

@@ -7,10 +7,28 @@ import { MEMORY_DIR, ensureDirSync } from "../memory.js";
 
 const SECRETS_FILE = path.join(MEMORY_DIR, "auth_secrets.enc");
 
+// ── Module-level caches ─────────────────────────────────────────────────────
+// These avoid re-running expensive sync operations (execSync, PBKDF2, file I/O)
+// on every CLI navigation or tool call.  invalidateAuthCache() must be called
+// whenever secrets are deleted or the API key is removed.
+let _cachedMachineId = undefined;  // undefined = not yet resolved
+let _cachedFingerprint = null;
+let _cachedEncryptionKey = null;
+let _cachedSecrets = undefined;    // undefined = not loaded, null = no secrets, object = cached
+let _cachedSecretsMtime = 0;
+
+export function invalidateAuthCache() {
+  _cachedSecrets = undefined;
+  _cachedSecretsMtime = 0;
+  // Keep machineId / fingerprint / key cached — they don't change per-session.
+}
+
 // Stable per-machine identifier. Must NOT rely on volatile values (e.g.
 // os.networkInterfaces() — VPN adapters, hotspot IPs and IPv6 privacy
 // addresses rotate constantly and would silently change the AES key).
 function getMachineId() {
+  if (_cachedMachineId !== undefined) return _cachedMachineId;
+  let id = null;
   try {
     if (process.platform === "win32") {
       const out = execSync("reg query HKLM\\SOFTWARE\\Microsoft\\Cryptography /v MachineGuid", {
@@ -18,12 +36,12 @@ function getMachineId() {
         stdio: ["ignore", "pipe", "ignore"],
       });
       const m = out.match(/MachineGuid\s+REG_SZ\s+([0-9a-fA-F-]{36})/i);
-      if (m) return m[1].toLowerCase();
+      if (m) id = m[1].toLowerCase();
     } else if (process.platform === "linux") {
       for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
         try {
           const v = fs.readFileSync(p, "utf8").trim();
-          if (v) return v;
+          if (v) { id = v; break; }
         } catch {}
       }
     } else if (process.platform === "darwin") {
@@ -32,15 +50,17 @@ function getMachineId() {
         stdio: ["ignore", "pipe", "ignore"],
       });
       const m = out.match(/"IOPlatformUUID"\s*=\s*"([^"]+)"/);
-      if (m) return m[1];
+      if (m) id = m[1];
     }
   } catch {}
-  return null;
+  _cachedMachineId = id;
+  return _cachedMachineId;
 }
 
 // Generate a deterministic hardware + system fingerprint (stable across reboots,
 // network changes and user sessions on the same machine).
 function getSystemFingerprint() {
+  if (_cachedFingerprint !== null && _cachedFingerprint !== undefined) return _cachedFingerprint;
   const parts = [
     getMachineId() || "no-machine-id",
     os.hostname() || "localhost",
@@ -48,15 +68,18 @@ function getSystemFingerprint() {
     os.platform() || "unknown",
     os.arch() || "unknown",
   ];
-  return parts.join("|");
+  _cachedFingerprint = parts.join("|");
+  return _cachedFingerprint;
 }
 
 // Derive a 256-bit (32 bytes) key using PBKDF2 with salt derived from fingerprint
 function deriveEncryptionKey() {
+  if (_cachedEncryptionKey) return _cachedEncryptionKey;
   const fingerprint = getSystemFingerprint();
   const salt = crypto.createHash("sha256").update(fingerprint).digest();
   // PBKDF2 with 10,000 iterations to derive a secure 32-byte key
-  return crypto.pbkdf2Sync(fingerprint, salt, 10000, 32, "sha256");
+  _cachedEncryptionKey = crypto.pbkdf2Sync(fingerprint, salt, 10000, 32, "sha256");
+  return _cachedEncryptionKey;
 }
 
 // Encrypt data using AES-256-GCM
@@ -153,17 +176,33 @@ export function resolveEnvSecrets() {
 // Read the encrypted store file ONLY (no environment merge). Returns the raw
 // parsed record, or null when the file is missing / undecryptable.
 function readStoredSecrets() {
-  if (!fs.existsSync(SECRETS_FILE)) return null;
+  try {
+    if (fs.existsSync(SECRETS_FILE)) {
+      const mtime = fs.statSync(SECRETS_FILE).mtimeMs;
+      if (_cachedSecrets !== undefined && mtime === _cachedSecretsMtime) {
+        return _cachedSecrets;
+      }
+      _cachedSecretsMtime = mtime;
+    } else {
+      // File doesn't exist — clear cache
+      if (_cachedSecrets !== undefined && _cachedSecrets === null) return null;
+      _cachedSecrets = null;
+      _cachedSecretsMtime = 0;
+      return null;
+    }
+  } catch {}
   try {
     const encrypted = fs.readFileSync(SECRETS_FILE, "utf-8").trim();
-    if (!encrypted) return null;
-    return JSON.parse(decryptData(encrypted));
+    if (!encrypted) { _cachedSecrets = null; return null; }
+    _cachedSecrets = JSON.parse(decryptData(encrypted));
+    return _cachedSecrets;
   } catch (err) {
     console.error(
       "Failed to decrypt or load cloud secrets:",
       err.message,
       "— the file was encrypted with a different machine key. Re-run login to recreate it."
     );
+    _cachedSecrets = null;
     return null;
   }
 }
@@ -187,8 +226,14 @@ export function saveSecrets(secrets) {
   const plainText = JSON.stringify(secrets);
   const encrypted = encryptData(plainText);
   fs.writeFileSync(SECRETS_FILE, encrypted, "utf-8");
+  _cachedSecrets = undefined;  // invalidate so readStoredSecrets re-reads
+  _cachedSecretsMtime = 0;
+  if (typeof _onSecretsChanged === "function") _onSecretsChanged();
 }
 
+let _onSecretsChanged = null;
+export function onSecretsChanged(cb) { _onSecretsChanged = cb; }
+
 // Load secrets securely. Priority (highest first):
 //   1. Env account API token (TURSO_API_TOKEN) — reused from the store when a
 //      session was already minted for this exact token, else returned with
@@ -240,6 +285,8 @@ export function deleteSecrets() {
   if (fs.existsSync(SECRETS_FILE)) {
     try {
       fs.unlinkSync(SECRETS_FILE);
+      _cachedSecrets = null;
+      _cachedSecretsMtime = 0;
       return true;
     } catch (err) {
       console.error("Failed to delete secrets file:", err.message);

package/mcp-server/config/config_manager.js

@@ -15,6 +15,7 @@ export const DEFAULT_CONFIG = {
   onnxThreads: 0,          // ONNX WASM threads: 0 = auto-detect CPU cores, or 1-16
   executionDevice: "cpu",  // "cpu" | "webgpu"
   mode: "only-local",     // "only-local" | "only-cloud" | "hybrid-sync"
+  injectLimit: 10,
   conflictStrategy: "merge", // "merge" | "cloud-wins" | "local-wins"
   tursoUrl: "",           // Connection endpoint URL for Turso DB
   failoverUrl: "",        // Failover connection endpoint URL (Fly.io + LiteFS)

package/mcp-server/db/database.js

@@ -9,6 +9,8 @@ import { createClient } from "@libsql/client";
 
 let dbInstance = null;
 let dbInitPromise = null;
+let dbLastFailAt = 0;
+const DB_FAIL_COOLDOWN_MS = 5_000;  // don't retry cloud init within 5s of a failure
 
 export const STORAGE_DIR = join(MEMORY_DIR, "storage");
 export const BLOBS_DIR = join(STORAGE_DIR, "blobs");
@@ -207,10 +209,20 @@ export async function getDatabase(customPath = null, forceMode = null) {
     if (dbInstance && dbInstance.mode === mode) {
       return dbInstance;
     }
+    // After a failed init, wait before retrying to avoid hammering cloud auth
+    if (!dbInitPromise && dbLastFailAt && (Date.now() - dbLastFailAt) < DB_FAIL_COOLDOWN_MS) {
+      throw new Error("Database initialization failed recently. Retrying in a few seconds...");
+    }
     // Deduplicate concurrent default-DB initialization so migrations never run
     // on multiple connections at once (avoids "database is locked" crashes).
     if (!dbInitPromise) {
-      dbInitPromise = openDatabase(null, mode).finally(() => {
+      dbInitPromise = openDatabase(null, mode).then((result) => {
+        dbLastFailAt = 0;
+        return result;
+      }).catch((err) => {
+        dbLastFailAt = Date.now();
+        throw err;
+      }).finally(() => {
         dbInitPromise = null;
       });
     }
@@ -222,6 +234,7 @@ export async function getDatabase(customPath = null, forceMode = null) {
 
 export function closeDatabase() {
   dbInitPromise = null;
+  dbLastFailAt = 0;
   if (dbInstance) {
     dbInstance.close();
     dbInstance = null;

package/mcp-server/db/migrations.js

@@ -110,6 +110,34 @@ const MIGRATIONS = [
       } catch (e) {}
     },
   },
+  {
+    version: 4,
+    name: "004_git_project_identity",
+    up: async (db) => {
+      await db.exec(`
+        CREATE TABLE IF NOT EXISTS project_identities (
+          key           TEXT PRIMARY KEY,
+          name          TEXT NOT NULL,
+          primary_remote TEXT,
+          created_at    INTEGER NOT NULL,
+          updated_at    INTEGER NOT NULL
+        );
+      `);
+
+      await db.exec(`
+        CREATE TABLE IF NOT EXISTS project_aliases (
+          alias        TEXT PRIMARY KEY,
+          identity_key TEXT NOT NULL REFERENCES project_identities(key) ON DELETE CASCADE,
+          kind         TEXT NOT NULL,
+          created_at   INTEGER NOT NULL
+        );
+      `);
+
+      await db.exec(`
+        CREATE INDEX IF NOT EXISTS idx_project_aliases_identity ON project_aliases(identity_key);
+      `);
+    },
+  },
 ];
 
 export async function runMigrations(db) {