eagle-mem 4.14.0 → 4.14.1

package/CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to the **Eagle Mem** project are documented here.
 
 ---
 
+## v4.14.1 busy_timeout Echo Fix
+
+A latent data-corruption and statusline-display bug, introduced when `busy_timeout` protection was added to three hot SQLite paths (the 2026-06-10 data-integrity hardening). No new feature; pure correctness.
+
+- **Root cause.** Setting the busy timeout with an inline value-form `PRAGMA busy_timeout=10000;` run in the *same* `sqlite3` invocation as a `SELECT` makes SQLite echo the timeout value (`10000`) as the **first output row**. Any caller that reads the first line then mis-reads `10000` as query data.
+- **Impact (all three fixed).**
+  - `scripts/statusline-em.sh`: the HUD parsed the echoed `10000` as the session count, rendering `Sessions: 10000`, `Memories: 0`, `Last: never`.
+  - `lib/common.sh` `eagle_get_session_project_light`: returned `10000` as the project, **mis-filing sessions under a phantom `10000` project key** (the data-corruption vector).
+  - `lib/common.sh` `eagle_project_has_table_row`: the echoed value failed the `= "1"` test, so it **always reported "no row"**, breaking ancestor-project repair.
+- **Fix.** All three set the timeout via the silent `-cmd ".timeout 10000"` dot-command, which emits no row. No SQL behavior, hook contract, statusline schema, or output format changes — only the timeout-set mechanism. `db/migrate.sh` (uses `tail -n1`) and the `.output`-bracketed setups in `lib/db-core.sh` were already echo-safe and are unchanged.
+- **No data migration needed for most installs.** The corruption only accrues while running unpatched code, and only affects session→project tags. The release ships the durable source fix so `eagle-mem update` can no longer reintroduce the bug.
+
+New coverage: `tests/test_busy_timeout_echo.sh` (reproduces the failure — buggy form returns `10000`/always-false — plus a structural guard against re-introducing the inline value-PRAGMA-before-SELECT shape). Compatibility evidence: `docs/agent-compatibility/claude-code.md`.
+
+---
+
 ## v4.14.0 Governance Parity & Curator Provenance
 
 Two trust-surface features that close the remaining governance gaps from the v4.13.0 review.

package/docs/agent-compatibility/claude-code.md

@@ -84,3 +84,12 @@ Phase 4 token-economy hardening added a generous global size ceiling on the reca
 
 Covered by `tests/test_context_budget.sh`.
 
+### Evidence: busy_timeout echo fix (2026-06-13)
+
+Corrects a regression introduced by the 2026-06-10 data-integrity note above. Setting the SQLite busy timeout with an inline value-form `PRAGMA busy_timeout=10000;` run in the *same* `sqlite3` invocation as a `SELECT` echoes the timeout value (`10000`) as the first output row. Any caller that reads the first row then misreads `10000` as data. The earlier note's claim that "statusline output rendering [is] unchanged" was therefore wrong — the statusline showed `Sessions: 10000`, `Memories: 0`. The fix sets the timeout via the silent `-cmd ".timeout 10000"` dot-command (no echoed row); no Claude Code contract changes (hook events, statusline stdin schema, and stdout/exit semantics are all unchanged). Specifically:
+
+- `scripts/statusline-em.sh`: the stats query drops the inline `PRAGMA busy_timeout=10000;` prefix and passes `-cmd ".timeout 10000"` to `sqlite3` instead, so `IFS='|' read` parses the real `sessions|memories|last` row rather than the echoed `10000`.
+- `lib/common.sh`: `eagle_get_session_project_light` (was returning `10000` as the project, mis-filing sessions under a phantom `10000` project key) and `eagle_project_has_table_row` (whose `= "1"` test always failed on the echoed value, so ancestor-project repair always saw "no row") use the same `-cmd ".timeout"` form.
+
+Covered by `tests/test_busy_timeout_echo.sh` (reproduces the failure: the buggy form returns `10000`/always-false; also a structural guard against re-introducing the inline value-PRAGMA-before-SELECT shape).
+

package/lib/common.sh

@@ -456,9 +456,12 @@ eagle_get_session_project_light() {
 
     local sid_sql project
     sid_sql=$(eagle_sql_escape "$session_id")
-    # busy_timeout so a momentary SQLITE_BUSY waits for the lock instead of
-    # exiting non-zero and being misread as "session has no project" (fail-open).
-    project=$("$sqlite_bin" "$EAGLE_MEM_DB" "PRAGMA busy_timeout=10000; SELECT project FROM sessions WHERE id = '$sid_sql' AND project != '' LIMIT 1;" 2>/dev/null | awk 'NF { print; exit }')
+    # busy_timeout (via the silent `-cmd ".timeout"` dot-command, NOT an inline
+    # `PRAGMA busy_timeout=N;`) so a momentary SQLITE_BUSY waits for the lock
+    # instead of exiting non-zero and being misread as "session has no project"
+    # (fail-open). An inline value-setting PRAGMA echoes its value ("10000") as
+    # the first output row, which `awk 'NF{...}'` would then return as the project.
+    project=$("$sqlite_bin" -cmd ".timeout 10000" "$EAGLE_MEM_DB" "SELECT project FROM sessions WHERE id = '$sid_sql' AND project != '' LIMIT 1;" 2>/dev/null | awk 'NF { print; exit }')
     [ -n "$project" ] || return 1
     printf '%s\n' "$project"
 }
@@ -481,9 +484,12 @@ eagle_project_has_table_row() {
 
     local project_sql found
     project_sql=$(eagle_sql_escape "$project")
-    # busy_timeout so a momentary SQLITE_BUSY waits for the lock instead of
-    # exiting non-zero and being misread as "row doesn't exist" (fail-open).
-    found=$("$sqlite_bin" "$EAGLE_MEM_DB" "PRAGMA busy_timeout=10000; SELECT 1 FROM $table WHERE project = '$project_sql' LIMIT 1;" 2>/dev/null | awk 'NF { print; exit }')
+    # busy_timeout (via the silent `-cmd ".timeout"` dot-command, NOT an inline
+    # `PRAGMA busy_timeout=N;`) so a momentary SQLITE_BUSY waits for the lock
+    # instead of exiting non-zero and being misread as "row doesn't exist"
+    # (fail-open). An inline value-setting PRAGMA echoes its value ("10000") as
+    # the first output row, which would then fail the `= "1"` test below.
+    found=$("$sqlite_bin" -cmd ".timeout 10000" "$EAGLE_MEM_DB" "SELECT 1 FROM $table WHERE project = '$project_sql' LIMIT 1;" 2>/dev/null | awk 'NF { print; exit }')
     [ "$found" = "1" ]
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eagle-mem",
-  "version": "4.14.0",
+  "version": "4.14.1",
   "description": "Shared memory, release guardrails, RTK token protection, and worker lanes for Claude Code, Codex, OpenCode, Grok, and Google Antigravity",
   "bin": {
     "eagle-mem": "bin/eagle-mem"

package/scripts/statusline-em.sh

@@ -65,11 +65,13 @@ eagle_mem_statusline_stats() {
     project_scope=$(eagle_recall_project_scope_from_cwd "${current_dir:-$project_dir}" "$project_key")
     project_condition=$(eagle_sql_project_scope_condition "project" "$project_scope")
 
-    # busy_timeout so a momentary SQLITE_BUSY (this is the hottest standalone
-    # query during live sessions) waits for the lock instead of exiting non-zero,
-    # which would otherwise escalate to an integrity-status mislabel below.
-    stats=$("$sqlite_bin" "$em_db" "PRAGMA busy_timeout=10000;
-        SELECT
+    # busy_timeout (via the silent `-cmd ".timeout"` dot-command, NOT an inline
+    # `PRAGMA busy_timeout=N;`) so a momentary SQLITE_BUSY (this is the hottest
+    # standalone query during live sessions) waits for the lock instead of exiting
+    # non-zero, which would otherwise escalate to an integrity-status mislabel below.
+    # An inline value-setting PRAGMA echoes "10000" as the first output row, which
+    # the `IFS='|' read` below would parse as sessions=10000, memories=0, last=never.
+    stats=$("$sqlite_bin" -cmd ".timeout 10000" "$em_db" "SELECT
         COUNT(*) || '|' ||
         (SELECT COUNT(*) FROM agent_memories WHERE $project_condition) || '|' ||
         COALESCE(MAX(COALESCE(last_activity_at, started_at)), 'never')

package/scripts/test.sh

@@ -96,6 +96,7 @@ run_check "Test Runner No-Abort (failing check does not kill the suite under set
 run_check "Antigravity Hook (native Python SDK lifecycle, mocked)" "( command -v python3 >/dev/null 2>&1 || exit 2; python3 \"$SCRIPTS_DIR/../tests/test_antigravity_hook.py\" )"
 run_check "Release Gate Parity (eagle-mem gate: blocks pending, fails open, pre-push install)" "bash \"$SCRIPTS_DIR/../tests/test_release_gate_prepush.sh\""
 run_check "Command Rule Provenance (curator rules tagged + trust_learned_rules gate)" "bash \"$SCRIPTS_DIR/../tests/test_command_rule_provenance.sh\""
+run_check "busy_timeout Echo (no PRAGMA value leaks into project/row/statusline reads)" "bash \"$SCRIPTS_DIR/../tests/test_busy_timeout_echo.sh\""
 
 echo ""
 if [ "$errors" -eq 0 ]; then

package/tests/test_busy_timeout_echo.sh

@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+# ═══════════════════════════════════════════════════════════
+# Eagle Mem — busy_timeout echo regression test
+#
+# Root cause guarded here: an inline value-setting `PRAGMA busy_timeout=N;`
+# run in the SAME sqlite3 invocation as a SELECT echoes its value ("10000")
+# as the FIRST output row. Any caller that reads the first line then mis-reads
+# the timeout value as data:
+#   - eagle_get_session_project_light -> returns "10000" as the project,
+#     mis-filing every session under a phantom "10000" project.
+#   - eagle_project_has_table_row -> `[ "10000" = "1" ]` is false, so it
+#     ALWAYS reports "no row", breaking ancestor-project repair.
+#   - statusline stats -> `IFS='|' read` parses "10000" as sessions, 0 memories.
+# The fix sets the timeout via the silent `-cmd ".timeout"` dot-command, which
+# emits no output. This test reproduces the failure (buggy code returns 10000
+# / always-false) and structurally guards against re-introducing the shape.
+# ═══════════════════════════════════════════════════════════
+set -uo pipefail
+
+ROOT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+tmp_dir=$(mktemp -d)
+trap 'rm -rf "$tmp_dir"' EXIT
+
+export EAGLE_MEM_DIR="$tmp_dir/em"
+export EAGLE_AGENT_SOURCE="claude-code"
+export EAGLE_MEM_DISABLE_HOOKS=1
+mkdir -p "$EAGLE_MEM_DIR"
+
+pass=0; fail=0
+ok()  { echo "  ok: $1"; pass=$((pass+1)); }
+bad() { echo "  FAIL: $1" >&2; fail=$((fail+1)); }
+
+bash "$ROOT_DIR/db/migrate.sh" >/dev/null 2>&1
+
+. "$ROOT_DIR/lib/common.sh"
+. "$ROOT_DIR/lib/db.sh"
+
+# ── eagle_get_session_project_light returns the real project ────────────────
+SID="sess-busy-timeout-001"
+PROJ="personal_projects/eagle-mem"
+eagle_upsert_session "$SID" "$PROJ" "$tmp_dir" "" "test" "claude-code"
+
+got=$(eagle_get_session_project_light "$SID")
+if [ "$got" = "10000" ]; then
+    bad "eagle_get_session_project_light returned the busy_timeout echo ('10000') as the project"
+elif [ "$got" = "$PROJ" ]; then
+    ok "eagle_get_session_project_light returns the real project ('$got')"
+else
+    bad "eagle_get_session_project_light returned unexpected value: '$got' (expected '$PROJ')"
+fi
+
+# Unknown session must resolve to nothing (rc=1), never the echo value.
+if unknown=$(eagle_get_session_project_light "sess-does-not-exist-999"); then
+    bad "eagle_get_session_project_light succeeded for unknown session, returned '$unknown'"
+else
+    ok "eagle_get_session_project_light fails closed for unknown session"
+fi
+
+# ── eagle_project_has_table_row: true for present, false for absent ──────────
+if eagle_project_has_table_row "sessions" "$PROJ"; then
+    ok "eagle_project_has_table_row finds the existing project row"
+else
+    bad "eagle_project_has_table_row reports 'no row' for a project that HAS a row (busy_timeout echo broke the '= 1' test)"
+fi
+
+if eagle_project_has_table_row "sessions" "no/such/project-xyz"; then
+    bad "eagle_project_has_table_row reports a row for a project with none"
+else
+    ok "eagle_project_has_table_row correctly reports no row for an absent project"
+fi
+
+# ── Structural guard: no inline value-setting PRAGMA before a parsed SELECT ──
+# (comment lines are stripped so the explanatory comments above don't match)
+common_hit=$(grep -vE '^[[:space:]]*#' "$ROOT_DIR/lib/common.sh" | grep -nE 'busy_timeout=[0-9]+;[[:space:]]*SELECT' || true)
+if [ -n "$common_hit" ]; then
+    bad "lib/common.sh re-introduced an inline 'PRAGMA busy_timeout=N; SELECT' (echoes the value): $common_hit"
+else
+    ok "lib/common.sh has no inline value-setting PRAGMA before a SELECT"
+fi
+
+statusline_hit=$(grep -vE '^[[:space:]]*#' "$ROOT_DIR/scripts/statusline-em.sh" | grep -nE 'busy_timeout' || true)
+if [ -n "$statusline_hit" ]; then
+    bad "scripts/statusline-em.sh re-introduced an inline PRAGMA busy_timeout (use -cmd \".timeout\"): $statusline_hit"
+else
+    ok "scripts/statusline-em.sh sets the timeout via the silent -cmd \".timeout\" dot-command"
+fi
+
+echo
+echo "busy_timeout echo regression: $pass passed, $fail failed"
+[ "$fail" -eq 0 ]