@mxalbert/context-mode 2.0.2 → 2.0.4

package/build/server.js

@@ -21,7 +21,7 @@ import { detectRuntimes, getRuntimeSummary, getAvailableLanguages, hasBunRuntime
 import { classifyNonZeroExit } from "./exit-classify.js";
 import { startLifecycleGuard, noteMcpActivity, noteRequestStart, noteRequestEnd, attachMcpActivityTap } from "./lifecycle.js";
 import { charSafePrefix } from "./truncate.js";
-import { describeStorageDirectorySource, ensureWritableStorageDir, formatStorageDirectoryError, hashProjectDirCanonical, hashProjectDirLegacy, resolveContentStorePath, resolveContentStorageDir, resolveDefaultSessionDir, resolveSessionDbPath, resolveSessionStorageDir, resolveStatsStorageDir, SessionDB, StorageDirectoryError, } from "./session/db.js";
+import { describeStorageDirectorySource, ensureWritableStorageDir, formatStorageDirectoryError, hashProjectDirCanonical, hashProjectDirLegacy, resolveContentStorePath, resolveContentStorageDir, resolveDefaultSessionDir, resolveSessionDbPath, resolveSessionPath, resolveSessionStorageDir, resolveStatsStorageDir, SessionDB, StorageDirectoryError, } from "./session/db.js";
 import { purgeSession } from "./session/purge.js";
 import { NPM_LATEST_URL, PACKAGE_NAME, PLUGIN_KEY } from "./package-identity.js";
 import { emitCacheHitEvent, emitIndexWriteEvent, emitSandboxExecuteEvent, } from "./session/event-emit.js";
@@ -370,8 +370,19 @@ process.on("exit", () => { try {
     unlinkSync(CM_FS_PRELOAD);
 }
 catch { /* best effort */ } });
-// Lazy singleton — no DB overhead unless index/search is used
-let _store = null;
+// Lazy per-project store cache — no DB overhead unless index/search is used.
+// Keyed by resolved dbPath: multi-project hosts (opencode web serves MANY
+// projects inside ONE process, each plugin tool call arriving with its own
+// projectDir via withProjectDirOverride) get one store per project. A single
+// cached instance would funnel every project's reads/writes into whichever
+// project ran the first ctx_* tool — cross-project knowledge-base exposure
+// AND one long-lived connection whose files other processes' startup
+// cleanups may unlink (surfaces as disk I/O error, SQLITE_IOERR_VNODE).
+// Mirrors the #645 SessionDB singleton re-keying pattern applied to the
+// Pi/OMP/OpenClaw plugins.
+const _stores = new Map();
+/** True once the process-wide startup cleanups have run (see getStore). */
+let _startupCleanupsRan = false;
 /**
  * Build the FK-attribution object passed to every ContentStore.index*() call
  * in this process. CLAUDE_SESSION_ID is the only MCP-side handle we have on
@@ -434,27 +445,34 @@ export function resolveSessionIdFromSessionDB(opts) {
     }
 }
 /**
- * Auto-index session events files written by SessionStart hook.
- * Scans ~/.claude/context-mode/sessions/ for *-events.md files.
- * CLAUDE_PROJECT_DIR is NOT available to MCP servers — only to hooks —
- * so we glob-scan instead of computing a specific hash.
- * Files are consumed (deleted) after indexing to prevent double-indexing.
- * Called on every getStore() — readdirSync is sub-millisecond when no files match.
+ * Auto-index the CURRENT project's session events file written by the
+ * SessionStart hook (same per-project path derivation the hook uses —
+ * canonical hash + worktree suffix). The file is consumed (deleted) after
+ * indexing to prevent double-indexing. Called on every getStore().
+ *
+ * Scoped to this project deliberately: the events filename is per-project,
+ * and a multi-project host (opencode web) shares one sessions directory
+ * across projects. The previous implementation glob-scanned the whole
+ * directory, so whichever project ran the first ctx_* tool indexed — and
+ * consumed — every OTHER project's pending events into its own store.
  */
 function maybeIndexSessionEvents(store) {
     try {
         const sessionsDir = getSessionDir();
         if (!existsSync(sessionsDir))
             return;
-        const files = readdirSync(sessionsDir).filter(f => f.endsWith("-events.md"));
-        for (const file of files) {
-            const filePath = join(sessionsDir, file);
-            try {
-                store.index({ path: filePath, source: "session-events", attribution: currentAttribution() });
-                unlinkSync(filePath);
-            }
-            catch { /* best-effort per file */ }
+        const eventsPath = resolveSessionPath({
+            projectDir: getProjectDir(),
+            sessionsDir,
+            ext: "-events.md",
+        });
+        if (!existsSync(eventsPath))
+            return;
+        try {
+            store.index({ path: eventsPath, source: "session-events", attribution: currentAttribution() });
+            unlinkSync(eventsPath);
         }
+        catch { /* best-effort */ }
     }
     catch { /* best-effort — session continuity never blocks tools */ }
 }
@@ -632,19 +650,27 @@ function getStorePath() {
     return resolveContentStorePath({ projectDir: getProjectDir(), contentDir: dir });
 }
 function getStore() {
-    if (!_store) {
-        // Content DB cleanup on fresh start is handled by SessionStart hook.
-        // Server just opens whatever DB exists (or creates new if hook deleted it).
-        const dbPath = getStorePath();
-        _store = new ContentStore(dbPath);
+    // Opens whatever DB exists (or creates a new one). Routine retention
+    // never deletes per-platform DB FILES — it is row-level only
+    // (cleanupStaleSources below) and on-disk reclamation is ctx_purge's
+    // job (rationale in the startup block below). The only file-deleting
+    // exception is the constructor's corruption-recovery path.
+    const dbPath = getStorePath();
+    let store = _stores.get(dbPath);
+    if (!store) {
+        store = new ContentStore(dbPath);
+        _stores.set(dbPath, store);
         // Wire deny-policy hook: store re-checks the Read deny list before
         // re-reading any file_path during auto-refresh. Catches policy edits
-        // made after a file was originally indexed. See #442 round-3.
-        _store.setDenyChecker((filePath) => {
+        // made after a file was originally indexed. See #442 round-3. The
+        // project dir is pinned at creation — the store is project-scoped, so
+        // its deny policy stays this project's even when other projects make
+        // calls into the same process.
+        const storeProjectDir = getProjectDir();
+        store.setDenyChecker((filePath) => {
             try {
-                const projectDir = getProjectDir();
-                const denyGlobs = readToolDenyPatterns("Read", projectDir);
-                const r = evaluateFilePath(filePath, denyGlobs, process.platform === "win32", projectDir);
+                const denyGlobs = readToolDenyPatterns("Read", storeProjectDir);
+                const r = evaluateFilePath(filePath, denyGlobs, undefined, storeProjectDir);
                 return r.denied;
             }
             catch {
@@ -652,22 +678,36 @@ function getStore() {
                 return true;
             }
         });
-        // One-time startup cleanup: remove stale content DBs (>14 days)
+        // Per-store: drop this project's sources untouched for 14 days.
         try {
-            const contentDir = dirname(getStorePath());
-            cleanupStaleContentDBs(contentDir, 14);
-            _store.cleanupStaleSources(14);
-            // Also clean legacy shared dir from before platform isolation
-            const legacyDir = join(homedir(), ".context-mode", "content");
-            if (existsSync(legacyDir))
-                cleanupStaleContentDBs(legacyDir, 0);
+            store.cleanupStaleSources(14);
         }
         catch { /* best-effort */ }
-        // Also clean old PID-based DBs from migration
-        cleanupStaleDBs();
+        // Process-wide, once: sweep the legacy shared content dir (pre-platform-
+        // isolation) and orphaned PID-based tmpdir DBs from the migration. Runs
+        // on FIRST store creation only — not once per project.
+        //
+        // The per-platform content dir gets NO automatic file deletion: mtime
+        // cannot distinguish a long-idle LIVE connection (a web host with a
+        // project open but untouched for weeks) from an abandoned DB, and
+        // unlinking an open store's db/-wal/-shm surfaces as unrecoverable
+        // disk I/O errors (SQLITE_IOERR_VNODE on macOS). Retention inside
+        // each store is handled logically above (cleanupStaleSources);
+        // on-disk reclamation is ctx_purge's job.
+        if (!_startupCleanupsRan) {
+            _startupCleanupsRan = true;
+            try {
+                const legacyDir = join(homedir(), ".context-mode", "content");
+                if (existsSync(legacyDir))
+                    cleanupStaleContentDBs(legacyDir, 0);
+            }
+            catch { /* best-effort */ }
+            // Also clean old PID-based DBs from migration
+            cleanupStaleDBs();
+        }
     }
-    maybeIndexSessionEvents(_store);
-    return _store;
+    maybeIndexSessionEvents(store);
+    return store;
 }
 // ─────────────────────────────────────────────────────────
 // Session stats — track context consumption per tool
@@ -1099,7 +1139,7 @@ function checkFilePathDenyPolicy(filePath, toolName) {
     try {
         const projectDir = getProjectDir();
         const denyGlobs = readToolDenyPatterns("Read", projectDir);
-        const result = evaluateFilePath(filePath, denyGlobs, process.platform === "win32", projectDir);
+        const result = evaluateFilePath(filePath, denyGlobs, undefined, projectDir);
         if (result.denied) {
             return trackResponse(toolName, {
                 content: [{
@@ -2087,10 +2127,9 @@ EXAMPLE: ctx_index(path: "/path/to/large-spec.md", source: "openapi-v2-spec")`,
             const store = getStore();
             const projectDir = getProjectDir();
             const denyGlobs = readToolDenyPatterns("Read", projectDir);
-            const isWin32 = process.platform === "win32";
             const perFileDeny = (absPath) => {
                 try {
-                    return evaluateFilePath(absPath, denyGlobs, isWin32, projectDir).denied;
+                    return evaluateFilePath(absPath, denyGlobs, undefined, projectDir).denied;
                 }
                 catch {
                     return false; // fail-open consistent with checkFilePathDenyPolicy
@@ -4629,12 +4668,17 @@ EXAMPLE: ctx_purge(confirm: true, scope: "project")`,
         storePathForPurge = getStorePath();
     }
     catch { /* best effort — store path may be unresolvable on fresh install */ }
-    if (_store) {
-        try {
-            _store.cleanup();
+    if (storePathForPurge) {
+        // Close ONLY the calling project's store — other projects' stores in a
+        // multi-project host (opencode web) are neither purged nor disturbed.
+        const openStore = _stores.get(storePathForPurge);
+        if (openStore) {
+            try {
+                openStore.cleanup();
+            }
+            catch { /* best effort */ }
+            _stores.delete(storePathForPurge);
         }
-        catch { /* best effort */ }
-        _store = null;
     }
     // FTS5 store: pass contentDir so purgeSession sweeps BOTH canonical
     // and legacy raw-casing variants (dual-hash, mirrors session events).
@@ -4906,8 +4950,15 @@ async function main() {
     // Clean up own DB + backgrounded processes + preload script on shutdown
     const shutdown = () => {
         executor.cleanupBackgrounded();
-        if (_store)
-            _store.close(); // persist DB for --continue sessions
+        // Persist every open per-project DB for --continue sessions. Cleared
+        // after close so a repeated shutdown call cannot double-close a store.
+        for (const openStore of _stores.values()) {
+            try {
+                openStore.close();
+            }
+            catch { /* best effort */ }
+        }
+        _stores.clear();
         try {
             unlinkSync(CM_FS_PRELOAD);
         }

package/build/session/purge.js

@@ -131,7 +131,8 @@ export function purgeSession(opts) {
         //
         // Caller is responsible for closing any persistent ContentStore
         // handle BEFORE invoking purgeSession (Windows file lock). The
-        // ctx_purge handler does this via _store?.cleanup() before delegating.
+        // ctx_purge handler does this via the per-project store cache's
+        // cleanup() before delegating.
         const ftsTargets = [];
         if (storePath && existsSync(storePath))
             ftsTargets.push(storePath);

package/build/store.d.ts

@@ -19,9 +19,28 @@ export declare function sanitizeTrigramQuery(query: string, mode?: "AND" | "OR")
 export declare function cleanupStaleDBs(): number;
 /**
  * Clean up stale per-project content store DBs older than maxAgeDays.
- * Scans the given directory for *.db files and checks mtime.
- * Also detects zombie processes holding WAL locks — if a WAL file exists
- * but the owning PID is dead, the DB files are cleaned up regardless of age.
+ * Scans the given directory for *.db files and unlinks each (plus its
+ * -wal/-shm sidecars) when its EFFECTIVE last-write time — the newer of the
+ * main .db mtime and a non-empty -wal mtime — exceeds the cutoff.
+ *
+ * Why the -wal mtime participates: in WAL mode commits touch only the -wal
+ * file; the main .db mtime advances at checkpoint. A main-only check can
+ * delete an actively-used store that simply hasn't checkpointed within the
+ * window. Conversely, a non-empty -wal older than some threshold is NOT
+ * proof the owning process is dead — a live-but-idle connection (a session
+ * quiet over lunch) is indistinguishable from a crashed process by mtime
+ * alone. The pre-fix heuristic deleted such DBs unconditionally after 1h,
+ * which on macOS unlinks the files under an open connection and surfaces
+ * as disk I/O error (SQLITE_IOERR_VNODE) on every later write — no amount
+ * of retrying recovers an invalidated fd.
+ *
+ * Contract: a -wal can only EXTEND a DB's life (its mtime counts as the
+ * latest write), never shorten it. A WAL never triggers deletion on its
+ * own — the way the old 1-hour zombie rule did — and once the whole DB
+ * (main + non-empty wal) is beyond maxAgeDays, the caller's retention
+ * policy owns the consequences. Callers that cannot tolerate deleting a
+ * possibly-live DB (the per-platform content dir — see getStore() in
+ * src/server.ts) must not call this with a nonzero maxAgeDays.
  */
 export declare function cleanupStaleContentDBs(contentDir: string, maxAgeDays: number): number;
 export declare class ContentStore {

package/build/store.js

@@ -158,24 +158,30 @@ export function cleanupStaleDBs() {
     catch { /* ignore readdir errors */ }
     return cleaned;
 }
-/**
- * Check if a PID is still alive (not a zombie holding a WAL lock).
- * Returns true if the process exists, false if it's dead.
- */
-function isProcessAlive(pid) {
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
 /**
  * Clean up stale per-project content store DBs older than maxAgeDays.
- * Scans the given directory for *.db files and checks mtime.
- * Also detects zombie processes holding WAL locks — if a WAL file exists
- * but the owning PID is dead, the DB files are cleaned up regardless of age.
+ * Scans the given directory for *.db files and unlinks each (plus its
+ * -wal/-shm sidecars) when its EFFECTIVE last-write time — the newer of the
+ * main .db mtime and a non-empty -wal mtime — exceeds the cutoff.
+ *
+ * Why the -wal mtime participates: in WAL mode commits touch only the -wal
+ * file; the main .db mtime advances at checkpoint. A main-only check can
+ * delete an actively-used store that simply hasn't checkpointed within the
+ * window. Conversely, a non-empty -wal older than some threshold is NOT
+ * proof the owning process is dead — a live-but-idle connection (a session
+ * quiet over lunch) is indistinguishable from a crashed process by mtime
+ * alone. The pre-fix heuristic deleted such DBs unconditionally after 1h,
+ * which on macOS unlinks the files under an open connection and surfaces
+ * as disk I/O error (SQLITE_IOERR_VNODE) on every later write — no amount
+ * of retrying recovers an invalidated fd.
+ *
+ * Contract: a -wal can only EXTEND a DB's life (its mtime counts as the
+ * latest write), never shorten it. A WAL never triggers deletion on its
+ * own — the way the old 1-hour zombie rule did — and once the whole DB
+ * (main + non-empty wal) is beyond maxAgeDays, the caller's retention
+ * policy owns the consequences. Callers that cannot tolerate deleting a
+ * possibly-live DB (the per-platform content dir — see getStore() in
+ * src/server.ts) must not call this with a nonzero maxAgeDays.
  */
 export function cleanupStaleContentDBs(contentDir, maxAgeDays) {
     let cleaned = 0;
@@ -187,26 +193,18 @@ export function cleanupStaleContentDBs(contentDir, maxAgeDays) {
         for (const file of files) {
             try {
                 const filePath = join(contentDir, file);
-                const mtime = statSync(filePath).mtimeMs;
-                let shouldClean = mtime < cutoff;
-                // Detect zombie processes holding WAL locks:
-                // If a WAL file exists, try to read the WAL header to extract the PID.
-                // WAL files from dead processes can block new connections.
-                if (!shouldClean) {
-                    const walPath = filePath + "-wal";
-                    if (existsSync(walPath)) {
-                        try {
-                            const walStat = statSync(walPath);
-                            // If WAL file is non-empty and DB hasn't been modified in >1 hour,
-                            // the owning process may be dead — check via mtime staleness
-                            if (walStat.size > 0 && (Date.now() - walStat.mtimeMs) > 3600_000) {
-                                shouldClean = true;
-                            }
-                        }
-                        catch { /* ignore WAL check errors */ }
+                // Effective last-write: newer of main .db and non-empty -wal. A fresh
+                // WAL is evidence of a live (or recently-live) connection — it can
+                // only push the cutoff later, never mark a fresh DB stale.
+                let effectiveMs = statSync(filePath).mtimeMs;
+                try {
+                    const walStat = statSync(filePath + "-wal");
+                    if (walStat.size > 0 && walStat.mtimeMs > effectiveMs) {
+                        effectiveMs = walStat.mtimeMs;
                     }
                 }
-                if (shouldClean) {
+                catch { /* no -wal — main mtime stands */ }
+                if (effectiveMs < cutoff) {
                     for (const suffix of ["", "-wal", "-shm"]) {
                         try {
                             unlinkSync(filePath + suffix);