kiro-memory 2.1.0 → 3.0.1

package/plugin/dist/services/search/index.js

@@ -125,7 +125,7 @@ function searchObservationsLIKE(db, query, filters = {}) {
     sql += " AND created_at_epoch <= ?";
     params.push(filters.dateEnd);
   }
-  sql += " ORDER BY created_at_epoch DESC LIMIT ?";
+  sql += " ORDER BY created_at_epoch DESC, id DESC LIMIT ?";
   params.push(limit);
   const stmt = db.query(sql);
   return stmt.all(...params);
@@ -150,7 +150,7 @@ function searchSummariesFiltered(db, query, filters = {}) {
     sql += " AND created_at_epoch <= ?";
     params.push(filters.dateEnd);
   }
-  sql += " ORDER BY created_at_epoch DESC LIMIT ?";
+  sql += " ORDER BY created_at_epoch DESC, id DESC LIMIT ?";
   params.push(limit);
   const stmt = db.query(sql);
   return stmt.all(...params);
@@ -160,7 +160,7 @@ function getObservationsByIds(db, ids) {
   const validIds = ids.filter((id) => typeof id === "number" && Number.isInteger(id) && id > 0).slice(0, 500);
   if (validIds.length === 0) return [];
   const placeholders = validIds.map(() => "?").join(",");
-  const sql = `SELECT * FROM observations WHERE id IN (${placeholders}) ORDER BY created_at_epoch DESC`;
+  const sql = `SELECT * FROM observations WHERE id IN (${placeholders}) ORDER BY created_at_epoch DESC, id DESC`;
   const stmt = db.query(sql);
   return stmt.all(...validIds);
 }
@@ -172,11 +172,11 @@ function getTimeline(db, anchorId, depthBefore = 5, depthAfter = 5) {
   const beforeStmt = db.query(`
     SELECT id, 'observation' as type, title, text as content, project, created_at, created_at_epoch
     FROM observations
-    WHERE created_at_epoch < ?
-    ORDER BY created_at_epoch DESC
+    WHERE (created_at_epoch < ? OR (created_at_epoch = ? AND id < ?))
+    ORDER BY created_at_epoch DESC, id DESC
     LIMIT ?
   `);
-  const before = beforeStmt.all(anchorEpoch, depthBefore).reverse();
+  const before = beforeStmt.all(anchorEpoch, anchorEpoch, anchorId, depthBefore).reverse();
   const selfStmt = db.query(`
     SELECT id, 'observation' as type, title, text as content, project, created_at, created_at_epoch
     FROM observations WHERE id = ?
@@ -185,11 +185,11 @@ function getTimeline(db, anchorId, depthBefore = 5, depthAfter = 5) {
   const afterStmt = db.query(`
     SELECT id, 'observation' as type, title, text as content, project, created_at, created_at_epoch
     FROM observations
-    WHERE created_at_epoch > ?
-    ORDER BY created_at_epoch ASC
+    WHERE (created_at_epoch > ? OR (created_at_epoch = ? AND id > ?))
+    ORDER BY created_at_epoch ASC, id ASC
     LIMIT ?
   `);
-  const after = afterStmt.all(anchorEpoch, depthAfter);
+  const after = afterStmt.all(anchorEpoch, anchorEpoch, anchorId, depthAfter);
   return [...before, ...self, ...after];
 }
 function getProjectStats(db, project) {
@@ -232,7 +232,7 @@ function getStaleObservations(db, project) {
   const rows = db.query(`
     SELECT * FROM observations
     WHERE project = ? AND files_modified IS NOT NULL AND files_modified != ''
-    ORDER BY created_at_epoch DESC
+    ORDER BY created_at_epoch DESC, id DESC
     LIMIT 500
   `).all(project);
   const staleObs = [];
@@ -275,6 +275,290 @@ var init_Search = __esm({
   }
 });
 
+// src/utils/secrets.ts
+function redactSecrets(text) {
+  if (!text) return text;
+  let redacted = text;
+  for (const { pattern } of SECRET_PATTERNS) {
+    pattern.lastIndex = 0;
+    redacted = redacted.replace(pattern, (match) => {
+      const prefix = match.substring(0, Math.min(4, match.length));
+      return `${prefix}***REDACTED***`;
+    });
+  }
+  return redacted;
+}
+var SECRET_PATTERNS;
+var init_secrets = __esm({
+  "src/utils/secrets.ts"() {
+    "use strict";
+    SECRET_PATTERNS = [
+      // AWS Access Keys (AKIA, ABIA, ACCA, ASIA prefixes + 16 alphanumeric chars)
+      { name: "aws-key", pattern: /(?:AKIA|ABIA|ACCA|ASIA)[A-Z0-9]{16}/g },
+      // JWT tokens (three base64url segments separated by dots)
+      { name: "jwt", pattern: /eyJ[a-zA-Z0-9_-]{10,}\.eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}/g },
+      // Generic API keys in key=value or key: value assignments
+      { name: "api-key", pattern: /(?:api[_-]?key|apikey|api[_-]?secret)\s*[:=]\s*['"]?([a-zA-Z0-9_\-]{20,})['"]?/gi },
+      // Password/secret/token in variable assignments
+      { name: "credential", pattern: /(?:password|passwd|pwd|secret|token|auth[_-]?token|access[_-]?token|bearer)\s*[:=]\s*['"]?([^\s'"]{8,})['"]?/gi },
+      // Credentials embedded in URLs (user:pass@host)
+      { name: "url-credential", pattern: /(?:https?:\/\/)([^:]+):([^@]+)@/g },
+      // PEM-encoded private keys (RSA, EC, DSA, OpenSSH)
+      { name: "private-key", pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/g },
+      // GitHub personal access tokens (ghp_, gho_, ghu_, ghs_, ghr_ prefixes)
+      { name: "github-token", pattern: /gh[pousr]_[a-zA-Z0-9]{36,}/g },
+      // Slack bot/user/app tokens
+      { name: "slack-token", pattern: /xox[bpoas]-[a-zA-Z0-9-]{10,}/g },
+      // HTTP Authorization Bearer header values
+      { name: "bearer-header", pattern: /\bBearer\s+([a-zA-Z0-9_\-\.]{20,})/g },
+      // Generic hex secrets (32+ hex chars after a key/secret/token/password label)
+      { name: "hex-secret", pattern: /(?:key|secret|token|password)\s*[:=]\s*['"]?([0-9a-f]{32,})['"]?/gi }
+    ];
+  }
+});
+
+// src/utils/categorizer.ts
+function categorize(input) {
+  const scores = /* @__PURE__ */ new Map();
+  const searchText = [
+    input.title,
+    input.text || "",
+    input.narrative || "",
+    input.concepts || ""
+  ].join(" ").toLowerCase();
+  const allFiles = [input.filesModified || "", input.filesRead || ""].join(",");
+  for (const rule of CATEGORY_RULES) {
+    let score = 0;
+    for (const kw of rule.keywords) {
+      if (searchText.includes(kw.toLowerCase())) {
+        score += rule.weight;
+      }
+    }
+    if (rule.types && rule.types.includes(input.type)) {
+      score += rule.weight * 2;
+    }
+    if (rule.filePatterns && allFiles) {
+      for (const pattern of rule.filePatterns) {
+        if (pattern.test(allFiles)) {
+          score += rule.weight;
+        }
+      }
+    }
+    if (score > 0) {
+      scores.set(rule.category, (scores.get(rule.category) || 0) + score);
+    }
+  }
+  let bestCategory = "general";
+  let bestScore = 0;
+  for (const [category, score] of scores) {
+    if (score > bestScore) {
+      bestScore = score;
+      bestCategory = category;
+    }
+  }
+  return bestCategory;
+}
+var CATEGORY_RULES;
+var init_categorizer = __esm({
+  "src/utils/categorizer.ts"() {
+    "use strict";
+    CATEGORY_RULES = [
+      {
+        category: "security",
+        keywords: [
+          "security",
+          "vulnerability",
+          "cve",
+          "xss",
+          "csrf",
+          "injection",
+          "sanitize",
+          "escape",
+          "auth",
+          "authentication",
+          "authorization",
+          "permission",
+          "helmet",
+          "cors",
+          "rate-limit",
+          "token",
+          "encrypt",
+          "decrypt",
+          "secret",
+          "redact",
+          "owasp"
+        ],
+        filePatterns: [/security/i, /auth/i, /secrets?\.ts/i],
+        weight: 10
+      },
+      {
+        category: "testing",
+        keywords: [
+          "test",
+          "spec",
+          "expect",
+          "assert",
+          "mock",
+          "stub",
+          "fixture",
+          "coverage",
+          "jest",
+          "vitest",
+          "bun test",
+          "unit test",
+          "integration test",
+          "e2e"
+        ],
+        types: ["test"],
+        filePatterns: [/\.test\./i, /\.spec\./i, /tests?\//i, /__tests__/i],
+        weight: 8
+      },
+      {
+        category: "debugging",
+        keywords: [
+          "debug",
+          "fix",
+          "bug",
+          "error",
+          "crash",
+          "stacktrace",
+          "stack trace",
+          "exception",
+          "breakpoint",
+          "investigate",
+          "root cause",
+          "troubleshoot",
+          "diagnose",
+          "bisect",
+          "regression"
+        ],
+        types: ["bugfix"],
+        weight: 8
+      },
+      {
+        category: "architecture",
+        keywords: [
+          "architect",
+          "design",
+          "pattern",
+          "modular",
+          "migration",
+          "schema",
+          "database",
+          "api design",
+          "abstract",
+          "dependency injection",
+          "singleton",
+          "factory",
+          "observer",
+          "middleware",
+          "pipeline",
+          "microservice",
+          "monolith"
+        ],
+        types: ["decision", "constraint"],
+        weight: 7
+      },
+      {
+        category: "refactoring",
+        keywords: [
+          "refactor",
+          "rename",
+          "extract",
+          "inline",
+          "move",
+          "split",
+          "merge",
+          "simplify",
+          "cleanup",
+          "clean up",
+          "dead code",
+          "consolidate",
+          "reorganize",
+          "restructure",
+          "decouple"
+        ],
+        weight: 6
+      },
+      {
+        category: "config",
+        keywords: [
+          "config",
+          "configuration",
+          "env",
+          "environment",
+          "dotenv",
+          ".env",
+          "settings",
+          "tsconfig",
+          "eslint",
+          "prettier",
+          "webpack",
+          "vite",
+          "esbuild",
+          "docker",
+          "ci/cd",
+          "github actions",
+          "deploy",
+          "build",
+          "bundle",
+          "package.json"
+        ],
+        filePatterns: [
+          /\.config\./i,
+          /\.env/i,
+          /tsconfig/i,
+          /\.ya?ml/i,
+          /Dockerfile/i,
+          /docker-compose/i
+        ],
+        weight: 5
+      },
+      {
+        category: "docs",
+        keywords: [
+          "document",
+          "readme",
+          "changelog",
+          "jsdoc",
+          "comment",
+          "explain",
+          "guide",
+          "tutorial",
+          "api doc",
+          "openapi",
+          "swagger"
+        ],
+        types: ["docs"],
+        filePatterns: [/\.md$/i, /docs?\//i, /readme/i, /changelog/i],
+        weight: 5
+      },
+      {
+        category: "feature-dev",
+        keywords: [
+          "feature",
+          "implement",
+          "add",
+          "create",
+          "new",
+          "endpoint",
+          "component",
+          "module",
+          "service",
+          "handler",
+          "route",
+          "hook",
+          "plugin",
+          "integration"
+        ],
+        types: ["feature", "file-write"],
+        weight: 3
+        // lowest — generic catch-all for development
+      }
+    ];
+  }
+});
+
 // src/services/sqlite/Observations.ts
 var Observations_exports = {};
 __export(Observations_exports, {
@@ -300,11 +584,23 @@ function isDuplicateObservation(db, contentHash, windowMs = 3e4) {
 }
 function createObservation(db, memorySessionId, project, type, title, subtitle, text, narrative, facts, concepts, filesRead, filesModified, promptNumber, contentHash = null, discoveryTokens = 0) {
   const now = /* @__PURE__ */ new Date();
+  const safeTitle = redactSecrets(title);
+  const safeText = text ? redactSecrets(text) : text;
+  const safeNarrative = narrative ? redactSecrets(narrative) : narrative;
+  const autoCategory = categorize({
+    type,
+    title: safeTitle,
+    text: safeText,
+    narrative: safeNarrative,
+    concepts,
+    filesModified,
+    filesRead
+  });
   const result = db.run(
     `INSERT INTO observations
-     (memory_session_id, project, type, title, subtitle, text, narrative, facts, concepts, files_read, files_modified, prompt_number, created_at, created_at_epoch, content_hash, discovery_tokens)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-    [memorySessionId, project, type, title, subtitle, text, narrative, facts, concepts, filesRead, filesModified, promptNumber, now.toISOString(), now.getTime(), contentHash, discoveryTokens]
+     (memory_session_id, project, type, title, subtitle, text, narrative, facts, concepts, files_read, files_modified, prompt_number, created_at, created_at_epoch, content_hash, discovery_tokens, auto_category)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+    [memorySessionId, project, type, safeTitle, subtitle, safeText, safeNarrative, facts, concepts, filesRead, filesModified, promptNumber, now.toISOString(), now.getTime(), contentHash, discoveryTokens, autoCategory]
   );
   return Number(result.lastInsertRowid);
 }
@@ -316,16 +612,16 @@ function getObservationsBySession(db, memorySessionId) {
 }
 function getObservationsByProject(db, project, limit = 100) {
   const query = db.query(
-    "SELECT * FROM observations WHERE project = ? ORDER BY created_at_epoch DESC LIMIT ?"
+    "SELECT * FROM observations WHERE project = ? ORDER BY created_at_epoch DESC, id DESC LIMIT ?"
   );
   return query.all(project, limit);
 }
 function searchObservations(db, searchTerm, project) {
   const sql = project ? `SELECT * FROM observations
        WHERE project = ? AND (title LIKE ? ESCAPE '\\' OR text LIKE ? ESCAPE '\\' OR narrative LIKE ? ESCAPE '\\')
-       ORDER BY created_at_epoch DESC` : `SELECT * FROM observations
+       ORDER BY created_at_epoch DESC, id DESC` : `SELECT * FROM observations
        WHERE title LIKE ? ESCAPE '\\' OR text LIKE ? ESCAPE '\\' OR narrative LIKE ? ESCAPE '\\'
-       ORDER BY created_at_epoch DESC`;
+       ORDER BY created_at_epoch DESC, id DESC`;
   const pattern = `%${escapeLikePattern2(searchTerm)}%`;
   const query = db.query(sql);
   if (project) {
@@ -381,7 +677,7 @@ function consolidateObservations(db, project, options = {}) {
       const obsIds = group.ids.split(",").map(Number);
       const placeholders = obsIds.map(() => "?").join(",");
       const observations = db.query(
-        `SELECT * FROM observations WHERE id IN (${placeholders}) ORDER BY created_at_epoch DESC`
+        `SELECT * FROM observations WHERE id IN (${placeholders}) ORDER BY created_at_epoch DESC, id DESC`
       ).all(...obsIds);
       if (observations.length < minGroupSize) continue;
       const keeper = observations[0];
@@ -412,6 +708,8 @@ function consolidateObservations(db, project, options = {}) {
 var init_Observations = __esm({
   "src/services/sqlite/Observations.ts"() {
     "use strict";
+    init_secrets();
+    init_categorizer();
   }
 });
 
@@ -635,14 +933,48 @@ ${data.stack}` : ` ${data.message}`;
 var logger = new Logger();
 
 // src/services/search/EmbeddingService.ts
+var MODEL_CONFIGS = {
+  "all-MiniLM-L6-v2": {
+    modelId: "Xenova/all-MiniLM-L6-v2",
+    dimensions: 384
+  },
+  "jina-code-v2": {
+    modelId: "jinaai/jina-embeddings-v2-base-code",
+    dimensions: 768
+  },
+  "bge-small-en": {
+    modelId: "BAAI/bge-small-en-v1.5",
+    dimensions: 384
+  }
+};
+var FASTEMBED_COMPATIBLE_MODELS = /* @__PURE__ */ new Set(["all-MiniLM-L6-v2", "bge-small-en"]);
 var EmbeddingService = class {
   provider = null;
   model = null;
   initialized = false;
   initializing = null;
+  config;
+  configName;
+  constructor() {
+    const envModel = process.env.KIRO_MEMORY_EMBEDDING_MODEL || "all-MiniLM-L6-v2";
+    this.configName = envModel;
+    if (MODEL_CONFIGS[envModel]) {
+      this.config = MODEL_CONFIGS[envModel];
+    } else if (envModel.includes("/")) {
+      const dimensions = parseInt(process.env.KIRO_MEMORY_EMBEDDING_DIMENSIONS || "384", 10);
+      this.config = {
+        modelId: envModel,
+        dimensions: isNaN(dimensions) ? 384 : dimensions
+      };
+    } else {
+      logger.warn("EMBEDDING", `Unknown model name '${envModel}', falling back to 'all-MiniLM-L6-v2'`);
+      this.configName = "all-MiniLM-L6-v2";
+      this.config = MODEL_CONFIGS["all-MiniLM-L6-v2"];
+    }
+  }
   /**
    * Initialize the embedding service.
-   * Tries fastembed, then @huggingface/transformers, then fallback to null.
+   * Tries fastembed (when compatible), then @huggingface/transformers, then falls back to null.
    */
   async initialize() {
     if (this.initialized) return this.provider !== null;
@@ -653,32 +985,35 @@ var EmbeddingService = class {
     return result;
   }
   async _doInitialize() {
-    try {
-      const fastembed = await import("fastembed");
-      const EmbeddingModel = fastembed.EmbeddingModel || fastembed.default?.EmbeddingModel;
-      const FlagEmbedding = fastembed.FlagEmbedding || fastembed.default?.FlagEmbedding;
-      if (FlagEmbedding && EmbeddingModel) {
-        this.model = await FlagEmbedding.init({
-          model: EmbeddingModel.BGESmallENV15
-        });
-        this.provider = "fastembed";
-        this.initialized = true;
-        logger.info("EMBEDDING", "Initialized with fastembed (BGE-small-en-v1.5)");
-        return true;
+    const fastembedCompatible = FASTEMBED_COMPATIBLE_MODELS.has(this.configName);
+    if (fastembedCompatible) {
+      try {
+        const fastembed = await import("fastembed");
+        const EmbeddingModel = fastembed.EmbeddingModel || fastembed.default?.EmbeddingModel;
+        const FlagEmbedding = fastembed.FlagEmbedding || fastembed.default?.FlagEmbedding;
+        if (FlagEmbedding && EmbeddingModel) {
+          this.model = await FlagEmbedding.init({
+            model: EmbeddingModel.BGESmallENV15
+          });
+          this.provider = "fastembed";
+          this.initialized = true;
+          logger.info("EMBEDDING", `Initialized with fastembed (BGE-small-en-v1.5) for model '${this.configName}'`);
+          return true;
+        }
+      } catch (error) {
+        logger.debug("EMBEDDING", `fastembed not available: ${error}`);
       }
-    } catch (error) {
-      logger.debug("EMBEDDING", `fastembed not available: ${error}`);
     }
     try {
       const transformers = await import("@huggingface/transformers");
       const pipeline = transformers.pipeline || transformers.default?.pipeline;
       if (pipeline) {
-        this.model = await pipeline("feature-extraction", "Xenova/all-MiniLM-L6-v2", {
+        this.model = await pipeline("feature-extraction", this.config.modelId, {
           quantized: true
         });
         this.provider = "transformers";
         this.initialized = true;
-        logger.info("EMBEDDING", "Initialized with @huggingface/transformers (all-MiniLM-L6-v2)");
+        logger.info("EMBEDDING", `Initialized with @huggingface/transformers (${this.config.modelId})`);
         return true;
       }
     } catch (error) {
@@ -691,7 +1026,7 @@ var EmbeddingService = class {
   }
   /**
    * Generate embedding for a single text.
-   * Returns Float32Array with 384 dimensions, or null if not available.
+   * Returns Float32Array with configured dimensions, or null if not available.
    */
   async embed(text) {
     if (!this.initialized) await this.initialize();
@@ -742,10 +1077,17 @@ var EmbeddingService = class {
     return this.provider;
   }
   /**
-   * Embedding vector dimensions.
+   * Embedding vector dimensions for the active model configuration.
    */
   getDimensions() {
-    return 384;
+    return this.config.dimensions;
+  }
+  /**
+   * Human-readable model name used as identifier in the observation_embeddings table.
+   * Returns the short name (e.g., 'all-MiniLM-L6-v2') or the full HF model ID for custom models.
+   */
+  getModelName() {
+    return this.configName;
   }
   // --- Batch implementations ---
   /**
@@ -964,7 +1306,7 @@ var VectorSearch = class {
     `).all(batchSize);
     if (rows.length === 0) return 0;
     let count = 0;
-    const model = embeddingService2.getProvider() || "unknown";
+    const model = embeddingService2.getModelName();
     for (const row of rows) {
       const parts = [row.title];
       if (row.text) parts.push(row.text);