codemem 0.29.3 → 0.30.0-alpha.2

package/dist/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { DEDUP_KEY_BACKFILL_JOB, DEFAULT_COORDINATOR_DB_PATH, DedupKeyBackfillRunner, MUTATING_TOOL_NAMES, MemoryStore, ObserverClient, REF_BACKFILL_JOB, RawEventSweeper, RefBackfillRunner, SESSION_CONTEXT_BACKFILL_JOB, SUMMARY_DEDUP_BACKFILL_JOB, SessionContextBackfillRunner, SummaryDedupBackfillRunner, SyncRetentionRunner, VERSION, VectorModelMigrationRunner, aiBackfillStructuredContent, applyBootstrapSnapshot, backfillMemoryDedupKeys, backfillNarrativeFromBody, backfillTagsText, backfillVectors, buildAuthHeaders, buildBaseUrl, buildRawEventEnvelopeFromHook, compareMemoryRoleReports, connect, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorDisableDeviceAction, coordinatorEnrollDeviceAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, createBetterSqliteCoordinatorApp, deactivateLowSignalMemories, deactivateLowSignalObservations, dedupNearDuplicateMemories, ensureDeviceIdentity, ensureSchemaBootstrapped, exportMemories, extractApplyPatchPaths, fetchAllSnapshotPages, fingerprintPublicKey, flushRawEvents, getExtractionBenchmarkProfile, getInjectionEvalScenarioPack, getInjectionEvalScenarioPrompts, getMaintenanceJob, getMemoryRoleReport, getRawEventRelinkPlan, getRawEventRelinkReport, getRawEventStatus, getSemanticIndexDiagnostics, getSessionExtractionEval, getSessionExtractionEvalScenario, getWorkspaceCodememConfigPath, hasPendingDedupKeyBackfill, hasPendingRefBackfill, hasPendingSessionContextBackfill, hasPendingSummaryDedupBackfill, hasUnsyncedSharedMemoryChanges, importMemories, initDatabase, isEmbeddingDisabled, listMaintenanceJobs, loadObserverConfig, loadPublicKey, loadSqliteVec, mdnsEnabled, planReplicationOpsAgePrune, pruneReplicationOpsUntilCaughtUp, rawEventsGate, readCodememConfigFile, readCodememConfigFileAtPath, readCoordinatorSyncConfig, readImportPayload, replayBatchExtraction, replayBatchExtractionWithTierRouting, requestJson, resolveCodememConfigPath, resolveDbPath, resolveHookProject, resolveProject, retryRawEventFailures, runSyncDaemon, runSyncPass, scanSecretsRetroactive, schema, setPeerProjectFilter, stripJsonComments, stripPrivateObj, stripTrailingCommas, syncPassPreflight, updatePeerAddresses, vacuumDatabase, writeCodememConfigFile } from "@codemem/core";
+import { DEDUP_KEY_BACKFILL_JOB, DEFAULT_COORDINATOR_DB_PATH, DedupKeyBackfillRunner, MUTATING_TOOL_NAMES, MemoryStore, ObserverClient, REF_BACKFILL_JOB, RawEventSweeper, RefBackfillRunner, SCOPE_BACKFILL_JOB, SESSION_CONTEXT_BACKFILL_JOB, SUMMARY_DEDUP_BACKFILL_JOB, ScopeBackfillRunner, SessionContextBackfillRunner, SummaryDedupBackfillRunner, SyncRetentionRunner, VERSION, VectorModelMigrationRunner, aiBackfillStructuredContent, applyBootstrapSnapshot, backfillMemoryDedupKeys, backfillNarrativeFromBody, backfillTagsText, backfillVectors, buildAuthHeaders, buildBaseUrl, buildRawEventEnvelopeFromHook, compareMemoryRoleReports, connect, coordinatorCreateGroupAction, coordinatorCreateInviteAction, coordinatorCreateScopeAction, coordinatorDisableDeviceAction, coordinatorEnrollDeviceAction, coordinatorGrantScopeMembershipAction, coordinatorImportInviteAction, coordinatorListBootstrapGrantsAction, coordinatorListDevicesAction, coordinatorListGroupsAction, coordinatorListJoinRequestsAction, coordinatorListScopeMembershipsAction, coordinatorListScopesAction, coordinatorRemoveDeviceAction, coordinatorRenameDeviceAction, coordinatorReviewJoinRequestAction, coordinatorRevokeBootstrapGrantAction, coordinatorRevokeScopeMembershipAction, coordinatorUpdateScopeAction, createBetterSqliteCoordinatorApp, deactivateLowSignalMemories, deactivateLowSignalObservations, dedupNearDuplicateMemories, ensureDeviceIdentity, ensureSchemaBootstrapped, exportMemories, extractApplyPatchPaths, fetchAllSnapshotPages, fingerprintPublicKey, flushRawEvents, getExtractionBenchmarkProfile, getInjectionEvalScenarioPack, getInjectionEvalScenarioPrompts, getMaintenanceJob, getMemoryRoleReport, getRawEventRelinkPlan, getRawEventRelinkReport, getRawEventStatus, getSemanticIndexDiagnostics, getSessionExtractionEval, getSessionExtractionEvalScenario, getWorkspaceCodememConfigPath, hasPendingDedupKeyBackfill, hasPendingRefBackfill, hasPendingScopeBackfill, hasPendingSessionContextBackfill, hasPendingSummaryDedupBackfill, hasUnsyncedSharedMemoryChanges, importMemories, initDatabase, isEmbeddingDisabled, listMaintenanceJobs, loadObserverConfig, loadPublicKey, loadSqliteVec, mdnsEnabled, planReplicationOpsAgePrune, pruneReplicationOpsUntilCaughtUp, rawEventsGate, readCodememConfigFile, readCodememConfigFileAtPath, readCoordinatorSyncConfig, readImportPayload, replayBatchExtraction, replayBatchExtractionWithTierRouting, requestJson, resolveCodememConfigPath, resolveDbPath, resolveHookProject, resolveProject, retryRawEventFailures, runSyncDaemon, runSyncPass, scanSecretsRetroactive, schema, setPeerProjectFilter, stripJsonComments, stripPrivateObj, stripTrailingCommas, syncPassPreflight, updatePeerAddresses, vacuumDatabase, writeCodememConfigFile } from "@codemem/core";
 import { Command, Option } from "commander";
 import omelette from "omelette";
 import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, writeFileSync } from "node:fs";
@@ -1669,6 +1669,12 @@ function readCoordinatorPublicKey(opts) {
 	if (!inline) throw new Error("Public key required via --public-key or --public-key-file");
 	return inline;
 }
+function parseOptionalInteger(value, name) {
+	if (value == null || !String(value).trim()) return null;
+	const parsed = Number.parseInt(String(value), 10);
+	if (!Number.isFinite(parsed)) throw new Error(`${name} must be an integer`);
+	return parsed;
+}
 /**
 * Build a fresh coordinator command tree. Each call returns independent
 * Commander instances so the tree can be mounted under multiple parents.
@@ -1814,6 +1820,231 @@ function buildCoordinatorCommand() {
 		}
 	});
 	cmd.addCommand(listDevicesCmd);
+	const listScopesCmd = new Command("list-scopes").configureHelp(helpStyle).description("List coordinator Sharing domains for a group").argument("<group>", "group id").option("--include-inactive", "include inactive Sharing domains").option("--remote-url <url>", "remote coordinator URL override").option("--admin-secret <secret>", "remote coordinator admin secret override");
+	addDbOption(listScopesCmd);
+	addJsonOption(listScopesCmd);
+	listScopesCmd.action(async (groupId, opts) => {
+		try {
+			const rows = await coordinatorListScopesAction({
+				groupId,
+				includeInactive: opts.includeInactive === true,
+				dbPath: resolveDbOpt(opts) ?? null,
+				remoteUrl: opts.remoteUrl?.trim() || null,
+				adminSecret: opts.adminSecret?.trim() || null
+			});
+			if (opts.json) {
+				console.log(JSON.stringify(rows, null, 2));
+				return;
+			}
+			p.intro("codemem coordinator list-scopes");
+			if (rows.length === 0) {
+				p.outro(`No Sharing domains for ${groupId.trim()}`);
+				return;
+			}
+			for (const row of rows) p.log.message(`- ${row.label} (${row.scope_id}) status=${row.status} epoch=${row.membership_epoch}`);
+			p.outro(`${rows.length} Sharing domain(s)`);
+		} catch (err) {
+			if (opts.json) {
+				emitJsonError("list_scopes_failed", err instanceof Error ? err.message : String(err));
+				return;
+			}
+			p.log.error(err instanceof Error ? err.message : String(err));
+			process.exitCode = 1;
+		}
+	});
+	cmd.addCommand(listScopesCmd);
+	const createScopeCmd = new Command("create-scope").configureHelp(helpStyle).description("Create a coordinator Sharing domain").argument("<group>", "group id").argument("<scope-id>", "Sharing domain scope_id").requiredOption("--label <label>", "Sharing domain label").option("--kind <kind>", "Sharing domain kind").option("--authority-type <type>", "authority type").option("--coordinator-id <id>", "coordinator id assertion").option("--membership-epoch <epoch>", "membership epoch").option("--manifest-hash <hash>", "membership manifest hash").option("--status <status>", "Sharing domain status").option("--remote-url <url>", "remote coordinator URL override").option("--admin-secret <secret>", "remote coordinator admin secret override");
+	addDbOption(createScopeCmd);
+	addJsonOption(createScopeCmd);
+	createScopeCmd.action(async (groupId, scopeId, opts) => {
+		try {
+			const scope = await coordinatorCreateScopeAction({
+				groupId,
+				scopeId,
+				label: opts.label.trim(),
+				kind: opts.kind?.trim() || null,
+				authorityType: opts.authorityType?.trim() || null,
+				coordinatorId: opts.coordinatorId?.trim() || null,
+				membershipEpoch: parseOptionalInteger(opts.membershipEpoch, "membership epoch"),
+				manifestHash: opts.manifestHash?.trim() || null,
+				status: opts.status?.trim() || null,
+				dbPath: resolveDbOpt(opts) ?? null,
+				remoteUrl: opts.remoteUrl?.trim() || null,
+				adminSecret: opts.adminSecret?.trim() || null
+			});
+			if (opts.json) {
+				console.log(JSON.stringify(scope, null, 2));
+				return;
+			}
+			p.intro("codemem coordinator create-scope");
+			p.log.success(`Sharing domain ready: ${scope.scope_id}`);
+			p.outro(scope.label);
+		} catch (err) {
+			if (opts.json) {
+				emitJsonError("create_scope_failed", err instanceof Error ? err.message : String(err));
+				return;
+			}
+			p.log.error(err instanceof Error ? err.message : String(err));
+			process.exitCode = 1;
+		}
+	});
+	cmd.addCommand(createScopeCmd);
+	const updateScopeCmd = new Command("update-scope").configureHelp(helpStyle).description("Update coordinator Sharing domain metadata").argument("<group>", "group id").argument("<scope-id>", "Sharing domain scope_id").option("--label <label>", "Sharing domain label").option("--kind <kind>", "Sharing domain kind").option("--authority-type <type>", "authority type").option("--coordinator-id <id>", "coordinator id assertion").option("--membership-epoch <epoch>", "membership epoch").option("--manifest-hash <hash>", "membership manifest hash").option("--status <status>", "Sharing domain status").option("--remote-url <url>", "remote coordinator URL override").option("--admin-secret <secret>", "remote coordinator admin secret override");
+	addDbOption(updateScopeCmd);
+	addJsonOption(updateScopeCmd);
+	updateScopeCmd.action(async (groupId, scopeId, opts) => {
+		try {
+			const scope = await coordinatorUpdateScopeAction({
+				groupId,
+				scopeId,
+				label: opts.label?.trim(),
+				kind: opts.kind?.trim(),
+				authorityType: opts.authorityType?.trim(),
+				coordinatorId: opts.coordinatorId?.trim(),
+				membershipEpoch: parseOptionalInteger(opts.membershipEpoch, "membership epoch"),
+				manifestHash: opts.manifestHash?.trim(),
+				status: opts.status?.trim(),
+				dbPath: resolveDbOpt(opts) ?? null,
+				remoteUrl: opts.remoteUrl?.trim() || null,
+				adminSecret: opts.adminSecret?.trim() || null
+			});
+			if (!scope) {
+				if (opts.json) {
+					emitJsonError("scope_not_found", `Sharing domain not found: ${scopeId.trim()}`);
+					return;
+				}
+				p.log.error(`Sharing domain not found: ${scopeId.trim()}`);
+				process.exitCode = 1;
+				return;
+			}
+			if (opts.json) {
+				console.log(JSON.stringify(scope, null, 2));
+				return;
+			}
+			p.intro("codemem coordinator update-scope");
+			p.log.success(`Updated Sharing domain: ${scope.scope_id}`);
+			p.outro(scope.label);
+		} catch (err) {
+			if (opts.json) {
+				emitJsonError("update_scope_failed", err instanceof Error ? err.message : String(err));
+				return;
+			}
+			p.log.error(err instanceof Error ? err.message : String(err));
+			process.exitCode = 1;
+		}
+	});
+	cmd.addCommand(updateScopeCmd);
+	const listScopeMembersCmd = new Command("list-scope-members").configureHelp(helpStyle).description("List explicit members of a Sharing domain").argument("<group>", "group id").argument("<scope-id>", "Sharing domain scope_id").option("--include-revoked", "include revoked memberships").option("--remote-url <url>", "remote coordinator URL override").option("--admin-secret <secret>", "remote coordinator admin secret override");
+	addDbOption(listScopeMembersCmd);
+	addJsonOption(listScopeMembersCmd);
+	listScopeMembersCmd.action(async (groupId, scopeId, opts) => {
+		try {
+			const rows = await coordinatorListScopeMembershipsAction({
+				groupId,
+				scopeId,
+				includeRevoked: opts.includeRevoked === true,
+				dbPath: resolveDbOpt(opts) ?? null,
+				remoteUrl: opts.remoteUrl?.trim() || null,
+				adminSecret: opts.adminSecret?.trim() || null
+			});
+			if (opts.json) {
+				console.log(JSON.stringify(rows, null, 2));
+				return;
+			}
+			p.intro("codemem coordinator list-scope-members");
+			if (rows.length === 0) {
+				p.outro(`No members for Sharing domain ${scopeId.trim()}`);
+				return;
+			}
+			for (const row of rows) p.log.message(`- ${row.device_id} role=${row.role} status=${row.status} epoch=${row.membership_epoch}`);
+			p.outro(`${rows.length} member(s)`);
+		} catch (err) {
+			if (opts.json) {
+				emitJsonError("list_scope_members_failed", err instanceof Error ? err.message : String(err));
+				return;
+			}
+			p.log.error(err instanceof Error ? err.message : String(err));
+			process.exitCode = 1;
+		}
+	});
+	cmd.addCommand(listScopeMembersCmd);
+	const grantScopeMemberCmd = new Command("grant-scope-member").configureHelp(helpStyle).description("Grant a device explicit access to a Sharing domain").argument("<group>", "group id").argument("<scope-id>", "Sharing domain scope_id").argument("<device-id>", "device id").option("--role <role>", "membership role").option("--membership-epoch <epoch>", "membership epoch").option("--manifest-hash <hash>", "membership manifest hash").option("--remote-url <url>", "remote coordinator URL override").option("--admin-secret <secret>", "remote coordinator admin secret override");
+	addDbOption(grantScopeMemberCmd);
+	addJsonOption(grantScopeMemberCmd);
+	grantScopeMemberCmd.action(async (groupId, scopeId, deviceId, opts) => {
+		try {
+			const membership = await coordinatorGrantScopeMembershipAction({
+				groupId,
+				scopeId,
+				deviceId,
+				role: opts.role?.trim() || null,
+				membershipEpoch: parseOptionalInteger(opts.membershipEpoch, "membership epoch"),
+				manifestHash: opts.manifestHash?.trim() || null,
+				dbPath: resolveDbOpt(opts) ?? null,
+				remoteUrl: opts.remoteUrl?.trim() || null,
+				adminSecret: opts.adminSecret?.trim() || null
+			});
+			if (opts.json) {
+				console.log(JSON.stringify(membership, null, 2));
+				return;
+			}
+			p.intro("codemem coordinator grant-scope-member");
+			p.log.success(`Granted ${deviceId.trim()} to Sharing domain ${scopeId.trim()}`);
+			p.outro(membership.role);
+		} catch (err) {
+			if (opts.json) {
+				emitJsonError("grant_scope_member_failed", err instanceof Error ? err.message : String(err));
+				return;
+			}
+			p.log.error(err instanceof Error ? err.message : String(err));
+			process.exitCode = 1;
+		}
+	});
+	cmd.addCommand(grantScopeMemberCmd);
+	const revokeScopeMemberCmd = new Command("revoke-scope-member").configureHelp(helpStyle).description("Revoke a device from a Sharing domain").argument("<group>", "group id").argument("<scope-id>", "Sharing domain scope_id").argument("<device-id>", "device id").option("--membership-epoch <epoch>", "membership epoch").option("--manifest-hash <hash>", "membership manifest hash").option("--remote-url <url>", "remote coordinator URL override").option("--admin-secret <secret>", "remote coordinator admin secret override");
+	addDbOption(revokeScopeMemberCmd);
+	addJsonOption(revokeScopeMemberCmd);
+	revokeScopeMemberCmd.action(async (groupId, scopeId, deviceId, opts) => {
+		try {
+			if (!await coordinatorRevokeScopeMembershipAction({
+				groupId,
+				scopeId,
+				deviceId,
+				membershipEpoch: parseOptionalInteger(opts.membershipEpoch, "membership epoch"),
+				manifestHash: opts.manifestHash?.trim() || null,
+				dbPath: resolveDbOpt(opts) ?? null,
+				remoteUrl: opts.remoteUrl?.trim() || null,
+				adminSecret: opts.adminSecret?.trim() || null
+			})) {
+				if (opts.json) {
+					emitJsonError("scope_membership_not_found", "Sharing domain membership not found");
+					return;
+				}
+				p.log.error("Sharing domain membership not found");
+				process.exitCode = 1;
+				return;
+			}
+			if (opts.json) {
+				console.log(JSON.stringify({
+					ok: true,
+					scope_id: scopeId.trim(),
+					device_id: deviceId.trim()
+				}, null, 2));
+				return;
+			}
+			p.intro("codemem coordinator revoke-scope-member");
+			p.log.success(`Revoked ${deviceId.trim()} from Sharing domain ${scopeId.trim()}`);
+			p.outro("revoked");
+		} catch (err) {
+			if (opts.json) {
+				emitJsonError("revoke_scope_member_failed", err instanceof Error ? err.message : String(err));
+				return;
+			}
+			p.log.error(err instanceof Error ? err.message : String(err));
+			process.exitCode = 1;
+		}
+	});
+	cmd.addCommand(revokeScopeMemberCmd);
 	const renameDeviceCmd = new Command("rename-device").configureHelp(helpStyle).description("Rename an enrolled device in the local coordinator store").argument("<group>", "group id").argument("<device-id>", "device id").requiredOption("--name <name>", "display name");
 	addDbOption(renameDeviceCmd);
 	addJsonOption(renameDeviceCmd);
@@ -4297,6 +4528,15 @@ async function startForegroundViewer(invocation) {
 		signal: backfillAbort.signal
 	});
 	const backfillCoordinator = createSequentialBackfillCoordinator(store, [
+		{
+			name: "Sharing-domain",
+			kind: SCOPE_BACKFILL_JOB,
+			isPending: hasPendingScopeBackfill,
+			createRunner: () => new ScopeBackfillRunner({
+				dbPath,
+				signal: backfillAbort.signal
+			})
+		},
 		{
 			name: "Dedup-key",
 			kind: DEDUP_KEY_BACKFILL_JOB,
@@ -4398,6 +4638,7 @@ async function startForegroundViewer(invocation) {
 					host: syncConfig.syncHost,
 					port: syncConfig.syncPort,
 					signal: syncAbort.signal,
+					scanner: store.scanner,
 					onPhaseChange: (phase) => {
 						if (phase === "running") {
 							syncRuntimeStatus.phase = null;