eagle-mem 4.10.6 → 4.10.7

package/CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to the **Eagle Mem** project are documented here.
 
 ---
 
+## v4.10.7 Graph Rebuild Hotfix
+
+This hotfix closes an installed-runtime failure found after the v4.10.6 graph-memory release:
+
+- **Import Parser Hardening**: Restricts quoted local import detection to `./` and `../` paths, and limits shell `source` parsing to shell-like files so SQL columns named `source` are not mistaken for shell commands.
+- **SQL-Safe Import Lookup**: Escapes import lookup terms before querying graph file nodes, preventing single quotes in source files from breaking `eagle-mem graph rebuild`.
+- **Regression Coverage**: Extends the graph-memory regression test with a SQL fixture containing `source TEXT NOT NULL DEFAULT 'manual'`, matching the installed-runtime failure mode.
+
+---
+
 ## v4.10.6 Graph Memory Rebuild Release
 
 This patch turns the local graph-memory workarounds into supported product behavior:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eagle-mem",
-  "version": "4.10.6",
+  "version": "4.10.7",
   "description": "Shared memory, release guardrails, RTK token protection, and worker lanes for Claude Code, Codex, Grok, and Google Antigravity",
   "bin": {
     "eagle-mem": "bin/eagle-mem"

package/scripts/index.sh

@@ -238,10 +238,14 @@ COMMIT;"
         fi
 
         # 2. Parse local relative imports/requires/sources
-        # Matches paths starting with dot (./ or ../) or sourcing .sh files
-        local_imports=$(grep -oE "['\"](\.[^'\"]+)['\"]" "$full_path" 2>/dev/null | tr -d "'\"" || true)
-        # Also grab shell source files
-        shell_sources=$(grep -E "^[[:space:]]*(\.|source) " "$full_path" 2>/dev/null | sed -E "s/^[[:space:]]*(\.|source)[[:space:]]+(.*)/\\2/" || true)
+        # Matches quoted paths starting with ./ or ../ and shell source lines.
+        local_imports=$(grep -oE "['\"](\./[^'\"]+|\.\./[^'\"]+)['\"]" "$full_path" 2>/dev/null | tr -d "'\"" || true)
+        shell_sources=""
+        case "$file" in
+            *.sh|*.bash|*.zsh|*.envrc|.envrc)
+                shell_sources=$(grep -E "^[[:space:]]*(source[[:space:]]+|\. [^[:space:]])" "$full_path" 2>/dev/null | sed -E "s/^[[:space:]]*(source[[:space:]]+|\. )([^#[:space:]]+).*/\\2/" || true)
+                ;;
+        esac
         
         all_refs=$(printf "%s\n%s\n" "$local_imports" "$shell_sources" | sort -u)
         if [ -n "$all_refs" ]; then
@@ -250,9 +254,10 @@ COMMIT;"
                 # Clean up path variables in shell sources (e.g. $_eagle_db_dir/db-core.sh -> db-core.sh)
                 ref_clean=$(echo "$ref" | sed -E 's/.*\///; s/\.sh$//; s/\.js$//; s/\.ts$//')
                 [ -z "$ref_clean" ] && continue
+                ref_sql=$(eagle_sql_escape "$ref_clean")
                 
                 # Check if there is a known file node in our graph that matches this basename or path
-                matched_file=$(eagle_db "SELECT node_name FROM graph_nodes WHERE project = '$project_sql' AND node_type = 'file' AND (node_name LIKE '%/$ref_clean%' OR node_name = '$ref_clean') LIMIT 1;")
+                matched_file=$(eagle_db "SELECT node_name FROM graph_nodes WHERE project = '$project_sql' AND node_type = 'file' AND (node_name LIKE '%/$ref_sql%' OR node_name = '$ref_sql') LIMIT 1;")
                 if [ -n "$matched_file" ]; then
                     target_file_id=$(eagle_graph_get_node_id "$PROJECT" "file" "$matched_file")
                     if [ -n "$target_file_id" ]; then

package/tests/test_graph_memory.sh

@@ -68,7 +68,16 @@ function CloudDictationPipeline() {
 }
 EOF
 
-git -C "$repo" add a.sh b.sh old.sh
+mkdir -p "$repo/db"
+cat > "$repo/db/source_column.sql" <<'EOF'
+CREATE TABLE graph_fixture (
+  id TEXT PRIMARY KEY,
+  source TEXT NOT NULL DEFAULT 'manual',
+  note TEXT DEFAULT './not-a-real-import'
+);
+EOF
+
+git -C "$repo" add a.sh b.sh old.sh db/source_column.sql
 
 "$EAGLE_BIN" scan --force "$repo" >/dev/null
 "$EAGLE_BIN" index --force "$repo" >/dev/null