mcp-memory-bucket 0.10.10 → 0.10.11

package/dist/src/memory/repository.js

@@ -10,7 +10,7 @@ import { applyBodyEdits } from '../shared/body-edits.js';
 import { attachmentsDirFor } from '../attachments/storage.js';
 import { rebaseFolderPath } from '../config.js';
 import { normalizeKey } from '../types.js';
-import { readFile as readRemoteFile, writeFile as writeRemoteFile, writeBinaryFile as writeRemoteBinaryFile, renameFile as renameRemoteFile, trashFile as trashRemoteFile, joinRemoteFolderPath, assertRemoteFolderExists } from '../remote/folderfoo-client.js';
+import { readFile as readRemoteFile, writeFile as writeRemoteFile, writeBinaryFile as writeRemoteBinaryFile, renameFile as renameRemoteFile, trashFile as trashRemoteFile, joinRemoteFolderPath, assertRemoteFolderExists, FolderfooRequestError } from '../remote/folderfoo-client.js';
 import { isFolderVisible } from '../remote/identity.js';
 import { writeRemoteThenLocal } from '../remote/write-order.js';
 /** Uppercases and strips everything but letters/digits — used to compare keys that differ only in
@@ -169,6 +169,18 @@ export class MemoryRepository {
         }
         throw new Error(`multiple memory folders configured — specify folder: one of ${this.folders.map((f) => f.name).join(', ')}`);
     }
+    /**
+     * Validates a caller-supplied `folder` filter (getByKey/getByFilenameContains/search) against the
+     * configured folder list, throwing the same "unknown memory folder" error resolveFolder() uses for
+     * writes. Without this, an unrecognized folder name (typo, stale name from a since-removed folder,
+     * or an outright made-up one) silently matched zero rows via `folder = ?` in SQL instead of erroring
+     * — indistinguishable from "folder is real but has no matches".
+     */
+    assertKnownFolder(folderName) {
+        if (!this.folders.some((f) => f.name === folderName)) {
+            throw new Error(`unknown memory folder "${folderName}" — valid folders: ${this.folders.map((f) => f.name).join(', ') || '(none configured)'}`);
+        }
+    }
     /**
      * Registers a new REMOTE (folderfoo) folder: creates its local mirror
      * directory, registers it exactly like a local addFolder (so it starts
@@ -245,6 +257,7 @@ export class MemoryRepository {
             params.push(docType);
         }
         if (opts.folder) {
+            this.assertKnownFolder(opts.folder);
             conditions.push('folder = ?');
             params.push(opts.folder);
         }
@@ -281,6 +294,7 @@ export class MemoryRepository {
             params.push(docType);
         }
         if (opts.folder) {
+            this.assertKnownFolder(opts.folder);
             conditions.push('folder = ?');
             params.push(opts.folder);
         }
@@ -317,6 +331,7 @@ export class MemoryRepository {
             params.push(status);
         }
         if (folder) {
+            this.assertKnownFolder(folder);
             conditions.push('m.folder = ?');
             params.push(folder);
         }
@@ -382,7 +397,21 @@ export class MemoryRepository {
         // blob, nesting one level deeper on every single edit (confirmed via a
         // real corrupted doc: 3 levels of self-nested frontmatter+body after 3
         // edits). Must parse it exactly like a local file read would.
-        const liveBody = matter(await readRemoteFile(remote.server, this.credentialsBaseDir, remote.tenantId, dir, name)).content.trim();
+        let raw;
+        try {
+            raw = await readRemoteFile(remote.server, this.credentialsBaseDir, remote.tenantId, dir, name);
+        }
+        catch (err) {
+            // Also try the LEGACY extensionless remote name — a doc pushed before the
+            // extension-preserving fix still sits on folderfoo under its bare id (no ".md") and always
+            // will, until it's renamed/re-saved (same tolerance reconcileDeletions already applies via
+            // remoteFilename.toLocal/toRemote — see remote-sync.ts). Only retry on a 404, never for a
+            // FolderfooAuthError or any other failure, which must surface as-is.
+            if (!(err instanceof FolderfooRequestError) || err.status !== 404 || !name.endsWith('.md'))
+                throw err;
+            raw = await readRemoteFile(remote.server, this.credentialsBaseDir, remote.tenantId, dir, name.slice(0, -3));
+        }
+        const liveBody = matter(raw).content.trim();
         return { ...doc, body: liveBody };
     }
     /** Fetches many memory docs by (folder, filename) in one call — e.g. hydrating full bodies for a batch of search() hits. Missing docs are simply absent from the result, not errors. */
@@ -391,9 +420,16 @@ export class MemoryRepository {
         return docs.filter((doc) => doc !== null);
     }
     listKeys(keyPrefix) {
+        const conditions = ['paused = 0'];
+        const params = [];
+        const hidden = this.hiddenFolderNames();
+        if (hidden.length > 0) {
+            conditions.push(`folder NOT IN (${hidden.map(() => '?').join(', ')})`);
+            params.push(...hidden);
+        }
         const rows = this.db
-            .prepare(`SELECT key, COUNT(*) as doc_count FROM memory_docs GROUP BY key ORDER BY key`)
-            .all();
+            .prepare(`SELECT key, COUNT(*) as doc_count FROM memory_docs WHERE ${conditions.join(' AND ')} GROUP BY key ORDER BY key`)
+            .all(...params);
         const prefix = keyPrefix ? normalizeKey(keyPrefix) : undefined;
         return rows
             .filter((r) => !prefix || r.key.startsWith(prefix))
@@ -647,7 +683,19 @@ export class MemoryRepository {
             const dir = joinRemoteFolderPath(remote.folderPath, path.dirname(oldRelPath));
             const oldName = path.basename(oldRelPath);
             const newName = path.basename(newPath);
-            await renameRemoteFile(remote.server, this.credentialsBaseDir, remote.tenantId, dir, oldName, newName);
+            try {
+                await renameRemoteFile(remote.server, this.credentialsBaseDir, remote.tenantId, dir, oldName, newName);
+            }
+            catch (err) {
+                // Same legacy-extensionless fallback as get() above: a doc pushed before the
+                // extension-preserving fix still sits on folderfoo under its bare id (no ".md"), so
+                // renaming by the .md-suffixed name 404s even though the doc reads back fine via get()'s
+                // own fallback. Retry once against the bare name — only on a 404, never for any other
+                // failure, which must surface as-is.
+                if (!(err instanceof FolderfooRequestError) || err.status !== 404 || !oldName.endsWith('.md'))
+                    throw err;
+                await renameRemoteFile(remote.server, this.credentialsBaseDir, remote.tenantId, dir, oldName.slice(0, -3), newName);
+            }
         }, () => {
             fs.renameSync(existing.source_path, newPath);
             if (fs.existsSync(oldAttachmentsWrapper)) {

package/dist/src/remote/folderfoo-client.js

@@ -6,6 +6,15 @@ export class FolderfooAuthError extends Error {
         this.name = 'FolderfooAuthError';
     }
 }
+/** Thrown for any non-ok, non-401 folderfoo response — carries the HTTP status so callers can distinguish e.g. a 404 (file genuinely absent) from other failures without string-matching the message. */
+export class FolderfooRequestError extends Error {
+    status;
+    constructor(status, message) {
+        super(`folderfoo request failed (${status}): ${message}`);
+        this.status = status;
+        this.name = 'FolderfooRequestError';
+    }
+}
 export async function login(server, username, password) {
     const res = await fetch(`${server}/login`, {
         method: 'POST',
@@ -79,7 +88,7 @@ async function withAuth(server, baseDir, call, parse) {
     }
     if (!res.ok) {
         const body = await res.json().catch(() => ({}));
-        throw new Error(`folderfoo request failed (${res.status}): ${body.error ?? res.statusText}`);
+        throw new FolderfooRequestError(res.status, body.error ?? res.statusText);
     }
     return parse(res);
 }

package/dist/src/remote/remote-sync.js

@@ -236,7 +236,17 @@ export function startRemotePolling(db, spec, remoteFolders, credentialsBaseDir,
 // above this module (server.ts, once MemoryRepository/SkillRepository/AttachmentRepository all
 // exist) run its own post-sync work without remote-sync.ts needing to depend on those repos
 // itself — see healAttachmentsAfterSync's doc comment for what server.ts actually wires in here.
-onSynced) {
+onSynced, 
+// True when `folder` should actually be reached over the network right now — server.ts wires this
+// to isFolderVisible(folder, identity.current()). A folder connected under a DIFFERENT mode/user
+// than the one currently logged in (e.g. a `dev` folder left over from a previous
+// --folderfoo-mode session, while this run is `cloud`) is skipped entirely here, not just hidden
+// from tools afterward — without this, every interval tick, the startup resyncAll, and the web
+// UI's "resync all" button would all still try to reach that folder's server and throw a raw
+// fetch/ECONNREFUSED (or worse, succeed against a DIFFERENT server that happens to be listening on
+// that host:port right now) for a source nothing can currently see anyway. Defaults to "always
+// visible" so existing callers/tests that don't care about identity keep working unchanged.
+isVisible = () => true) {
     const byName = new Map(remoteFolders.map((f) => [f.name, f]));
     async function pollAndNotify(folder, options) {
         await pollOne(db, spec, folder, credentialsBaseDir, options);
@@ -244,6 +254,8 @@ onSynced) {
     }
     const interval = setInterval(() => {
         for (const folder of remoteFolders) {
+            if (!isVisible(folder))
+                continue;
             pollAndNotify(folder).catch((err) => console.error(`[memory-bucket] remote poll failed for ${folder.name}:`, err));
         }
     }, POLL_INTERVAL_MS);
@@ -256,10 +268,14 @@ onSynced) {
             const folder = byName.get(folderName);
             if (!folder)
                 throw new Error(`no remote source configured with name "${folderName}"`);
+            if (!isVisible(folder))
+                throw new Error(`remote source "${folderName}" is not visible under the current login — reconnect or log in as the identity it was connected under`);
             await pollAndNotify(folder, { force: true });
         },
         resyncAll: async () => {
             for (const folder of remoteFolders) {
+                if (!isVisible(folder))
+                    continue;
                 await pollAndNotify(folder, { force: true });
             }
         },

package/dist/src/server.js

@@ -86,23 +86,31 @@ const attachmentRepo = new AttachmentRepository(memoryRepo, skillRepo, db);
 // comment for why this lives here (needs memoryRepo/skillRepo, which remote-sync.ts itself doesn't
 // depend on) rather than inside pollOne/reconcileDeletions.
 //
-// Skipped entirely for a folder connected under a DIFFERENT identity than the one currently logged
-// in (or connected while nobody was logged in) — same visibility rule memoryRepo.get()/
-// skillRepo.get() already enforce (isFolderVisible). The poller itself has no notion of "current
-// identity" and keeps polling every configured remote source regardless of who's logged in right
-// now, so without this check, repairUnlistedInFolder would sweep a currently-invisible folder's
-// docs, call skillRepo.get()/memoryRepo.get() on them, and get a spurious "not found" per doc —
-// not a real bug, just this visibility rule surfacing as a scary per-doc error instead of a no-op.
+// startRemotePolling below only ever calls onSynced for a folder that passed its own isVisible
+// check first (isRemoteFolderVisible), so this never runs for a folder connected under a
+// different identity than the one currently logged in — repairUnlistedInFolder can safely call
+// skillRepo.get()/memoryRepo.get() without a spurious "not found" from a currently-invisible doc.
 function onAttachmentSync(table, folder) {
-    if (!isFolderVisible(folder, identity.current()))
-        return;
     attachmentRepo.repairUnlistedInFolder(table, folder.name).catch((err) => console.error(`[memory-bucket] failed to repair attachments for folder "${folder.name}":`, err));
 }
-const remoteSkillPoller = config.remoteSkillFolders.length > 0
-    ? startRemotePolling(db, skillSpec, config.remoteSkillFolders, config.baseDir, (folder) => onAttachmentSync('skills', folder))
+// folderfoo integration off means nobody can ever be logged in this process (identity.mode stays
+// 'off'), so every remote folder is permanently invisible per isFolderVisible/matchesCurrentIdentity
+// above regardless of polling - polling them anyway just hits a folderfoo host that was never meant
+// to be reachable this run (e.g. a `dev` host from a previous --folderfoo-mode session) and throws a
+// raw fetch/ECONNREFUSED error on every resync, since pollOne only swallows FolderfooAuthError.
+// Gates the actual network poll, not just the post-sync attachment repair (onAttachmentSync
+// above already had this check, but only for its own callback — pollOne itself ran regardless).
+// A folder connected under a different --folderfoo-mode/identity than the one currently logged in
+// (e.g. a leftover `dev` source from a prior session while this run is `cloud`) is invisible to
+// every tool already; without this it was still polled every interval tick and on every
+// resyncAll, hitting whatever host:port it points at (often nothing, hence the raw
+// fetch/ECONNREFUSED) for a source nothing can currently see anyway.
+const isRemoteFolderVisible = (folder) => isFolderVisible(folder, identity.current());
+const remoteSkillPoller = config.folderfooMode !== 'off' && config.remoteSkillFolders.length > 0
+    ? startRemotePolling(db, skillSpec, config.remoteSkillFolders, config.baseDir, (folder) => onAttachmentSync('skills', folder), isRemoteFolderVisible)
     : undefined;
-const remoteMemoryPoller = config.remoteMemoryFolders.length > 0
-    ? startRemotePolling(db, memorySpec, config.remoteMemoryFolders, config.baseDir, (folder) => onAttachmentSync('memory_docs', folder))
+const remoteMemoryPoller = config.folderfooMode !== 'off' && config.remoteMemoryFolders.length > 0
+    ? startRemotePolling(db, memorySpec, config.remoteMemoryFolders, config.baseDir, (folder) => onAttachmentSync('memory_docs', folder), isRemoteFolderVisible)
     : undefined;
 // Forces one immediate poll of every remote source at process start, instead
 // of leaving the cache to show whatever was last synced until the first
@@ -169,8 +177,9 @@ app.listen(PORT, () => {
     console.error(`[memory-bucket] skill folders: ${config.skillFolders.map((f) => `${f.name}=${f.path}`).join(', ') || '(none)'}`);
     console.error(`[memory-bucket] memory folders: ${config.memoryFolders.map((f) => `${f.name}=${f.path}`).join(', ') || '(none)'}`);
     if (config.remoteSkillFolders.length > 0 || config.remoteMemoryFolders.length > 0) {
-        console.error(`[memory-bucket] remote (folderfoo) skill folders: ${config.remoteSkillFolders.map((f) => `${f.name}@${f.server}`).join(', ') || '(none)'}`);
-        console.error(`[memory-bucket] remote (folderfoo) memory folders: ${config.remoteMemoryFolders.map((f) => `${f.name}@${f.server}`).join(', ') || '(none)'}`);
+        const suffix = config.folderfooMode === 'off' ? ' (folderfoo integration off — not synced, ignored)' : '';
+        console.error(`[memory-bucket] remote (folderfoo) skill folders${suffix}: ${config.remoteSkillFolders.map((f) => `${f.name}@${f.server}`).join(', ') || '(none)'}`);
+        console.error(`[memory-bucket] remote (folderfoo) memory folders${suffix}: ${config.remoteMemoryFolders.map((f) => `${f.name}@${f.server}`).join(', ') || '(none)'}`);
     }
 });
 process.on('SIGINT', () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-memory-bucket",
-  "version": "0.10.10",
+  "version": "0.10.11",
   "type": "module",
   "description": "MCP server exposing skill_* (reusable coding patterns) and memory_* (point-in-time working context) tools over a markdown+frontmatter source, cached into SQLite at runtime.",
   "repository": {