memorix 1.9.3 → 1.9.5

package/dist/media-video-runner.js

@@ -835,18 +835,21 @@ CREATE TABLE IF NOT EXISTS chat_transcript (
 `;
     CREATE_GRAPH_ENTITIES_TABLE = `
 CREATE TABLE IF NOT EXISTS graph_entities (
-  name            TEXT PRIMARY KEY,
+  projectId       TEXT NOT NULL,
+  name            TEXT NOT NULL,
   entityType      TEXT NOT NULL DEFAULT '',
-  observations    TEXT NOT NULL DEFAULT '[]'
+  observations    TEXT NOT NULL DEFAULT '[]',
+  PRIMARY KEY (projectId, name)
 );
 `;
     CREATE_GRAPH_RELATIONS_TABLE = `
 CREATE TABLE IF NOT EXISTS graph_relations (
   id              INTEGER PRIMARY KEY AUTOINCREMENT,
+  projectId       TEXT NOT NULL,
   from_entity     TEXT NOT NULL,
   to_entity       TEXT NOT NULL,
   relationType    TEXT NOT NULL DEFAULT '',
-  UNIQUE(from_entity, to_entity, relationType)
+  UNIQUE(projectId, from_entity, to_entity, relationType)
 );
 `;
     CREATE_CODE_FILES_TABLE = `
@@ -1714,6 +1717,21 @@ var init_sqlite_reliability = __esm({
 import { promises as fs2 } from "fs";
 import { randomUUID } from "crypto";
 import path4 from "path";
+function canReclaimStaleLock(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    const pid = Number(parsed.pid);
+    if (!Number.isSafeInteger(pid) || pid < 1) return true;
+    try {
+      process.kill(pid, 0);
+      return false;
+    } catch (error) {
+      return error.code !== "EPERM";
+    }
+  } catch {
+    return true;
+  }
+}
 async function acquireLock(lockPath) {
   for (let i2 = 0; i2 < MAX_RETRIES; i2++) {
     try {
@@ -1727,9 +1745,12 @@ async function acquireLock(lockPath) {
         try {
           const stat5 = await fs2.stat(lockPath);
           if (Date.now() - stat5.mtimeMs > LOCK_STALE_MS) {
-            await fs2.unlink(lockPath).catch(() => {
-            });
-            continue;
+            const raw2 = await fs2.readFile(lockPath, "utf8").catch(() => "");
+            if (canReclaimStaleLock(raw2)) {
+              await fs2.unlink(lockPath).catch(() => {
+              });
+              continue;
+            }
           }
         } catch {
           continue;
@@ -1740,6 +1761,10 @@ async function acquireLock(lockPath) {
       }
     }
   }
+  const raw = await fs2.readFile(lockPath, "utf8").catch(() => "");
+  if (!canReclaimStaleLock(raw)) {
+    throw new Error(`Failed to acquire lock: ${lockPath} (owner is still running)`);
+  }
   await fs2.unlink(lockPath).catch(() => {
   });
   try {
@@ -5670,6 +5695,7 @@ var init_sqlite_store = __esm({
     init_sqlite_db();
     init_sqlite_reliability();
     init_sqlite_fts();
+    init_file_lock();
     SqliteBackend = class {
       db = null;
       dataDir = "";
@@ -5833,38 +5859,43 @@ var init_sqlite_store = __esm({
       }
       // ── Migration ────────────────────────────────────────────────────
       async migrateFromJsonIfNeeded() {
-        const count2 = this.db.prepare(`SELECT COUNT(*) AS cnt FROM observations`).get();
-        if (count2.cnt > 0) return;
         const jsonPath = path7.join(this.dataDir, "observations.json");
         if (!fs4.existsSync(jsonPath)) return;
-        try {
+        await withFileLock(this.dataDir, async () => {
+          const count2 = this.db.prepare(`SELECT COUNT(*) AS cnt FROM observations`).get();
+          if (count2.cnt > 0) return;
           const raw = fs4.readFileSync(jsonPath, "utf-8");
-          const observations2 = JSON.parse(raw);
+          const parsed = JSON.parse(raw);
+          if (!Array.isArray(parsed)) {
+            throw new Error("[memorix] observations.json migration refused: expected a JSON array");
+          }
+          const observations2 = parsed;
           if (observations2.length === 0) return;
+          if (observations2.some((obs) => !obs || !Number.isSafeInteger(obs.id) || obs.id < 1 || typeof obs.projectId !== "string")) {
+            throw new Error("[memorix] observations.json migration refused: invalid observation record");
+          }
           console.error(`[memorix] Migrating ${observations2.length} observations from JSON to SQLite...`);
           const insertMany = this.db.transaction((obsList) => {
             for (const obs of obsList) {
               this.stmtInsert.run(obsToRow(obs));
             }
-          });
-          insertMany(observations2);
-          const counterPath = path7.join(this.dataDir, "counter.json");
-          if (fs4.existsSync(counterPath)) {
-            try {
+            const counterPath = path7.join(this.dataDir, "counter.json");
+            let counterNextId;
+            if (fs4.existsSync(counterPath)) {
               const counterData = JSON.parse(fs4.readFileSync(counterPath, "utf-8"));
-              const nextId2 = counterData.nextId ?? counterData.next_id ?? Math.max(...observations2.map((o) => o.id)) + 1;
-              this.rawSaveIdCounter(nextId2);
-            } catch {
-              this.rawSaveIdCounter(Math.max(...observations2.map((o) => o.id)) + 1);
+              const candidate = counterData.nextId ?? counterData.next_id;
+              if (candidate !== void 0 && (!Number.isSafeInteger(candidate) || Number(candidate) < 1)) {
+                throw new Error("[memorix] counter.json migration refused: nextId must be a positive integer");
+              }
+              counterNextId = candidate === void 0 ? void 0 : Number(candidate);
             }
-          } else {
-            this.rawSaveIdCounter(Math.max(...observations2.map((o) => o.id)) + 1);
-          }
-          this.bumpGeneration();
+            const maxId = Math.max(...obsList.map((obs) => obs.id));
+            this.rawSaveIdCounter(Math.max(counterNextId ?? 1, maxId + 1));
+            this.bumpGeneration();
+          });
+          insertMany(observations2);
           console.error(`[memorix] Migration complete. ${observations2.length} observations now in SQLite.`);
-        } catch (err) {
-          console.error(`[memorix] JSON\u2192SQLite migration failed (non-fatal, data preserved in JSON): ${err}`);
-        }
+        });
       }
       // ── Public read ──────────────────────────────────────────────────
       async loadAll() {
@@ -143454,7 +143485,20 @@ function normalizeMiniMaxVideoRequest(input) {
   if (ratio !== "adaptive" && ratio !== "16:9" && ratio !== "9:16" && ratio !== "1:1") {
     throw new Error("MiniMax video ratio must be adaptive, 16:9, 9:16, or 1:1");
   }
-  return { region, model, prompt, resolution, duration, ratio };
+  let firstFrameImageUrl;
+  if (input.firstFrameImageUrl !== void 0) {
+    firstFrameImageUrl = input.firstFrameImageUrl.trim();
+    let parsed;
+    try {
+      parsed = new URL(firstFrameImageUrl);
+    } catch {
+      throw new Error("MiniMax first-frame image must be a public HTTPS URL");
+    }
+    if (parsed.protocol !== "https:" || parsed.username || parsed.password || sanitizeCredentials(firstFrameImageUrl) !== firstFrameImageUrl) {
+      throw new Error("MiniMax first-frame image must be an HTTPS URL without credentials");
+    }
+  }
+  return { region, model, prompt, resolution, duration, ratio, ...firstFrameImageUrl ? { firstFrameImageUrl } : {} };
 }
 function videoRequestConfig(input) {
   const normalized = normalizeMiniMaxVideoRequest(input);
@@ -143531,7 +143575,14 @@ async function createMiniMaxVideoTask(input, dependencies = {}) {
       headers: videoHeaders(config.apiKey),
       body: JSON.stringify({
         model: config.model,
-        content: [{ type: "text", text: config.prompt }],
+        content: [
+          { type: "text", text: config.prompt },
+          ...config.firstFrameImageUrl ? [{
+            type: "image_url",
+            image_url: { url: config.firstFrameImageUrl },
+            role: "first_frame"
+          }] : []
+        ],
         resolution: config.resolution,
         duration: config.duration,
         ratio: config.ratio
@@ -143692,10 +143743,19 @@ function parseStoredRequest(value) {
   const duration = value.duration;
   const ratio = value.ratio;
   const maxBytes = value.maxBytes;
-  if (provider2 !== "minimax" && provider2 !== "minimax-cn" || region !== "global" && region !== "cn" || model !== "MiniMax-H3" || typeof prompt !== "string" || resolution !== "2K" || duration !== 5 && duration !== 10 || ratio !== "adaptive" && ratio !== "16:9" && ratio !== "9:16" && ratio !== "1:1" || typeof maxBytes !== "number" || !Number.isSafeInteger(maxBytes) || maxBytes < 1) {
+  if (provider2 !== "minimax" && provider2 !== "minimax-cn" || region !== "global" && region !== "cn" || model !== "MiniMax-H3" || typeof prompt !== "string" || value.firstFrameImageUrl !== void 0 && typeof value.firstFrameImageUrl !== "string" || resolution !== "2K" || duration !== 5 && duration !== 10 || ratio !== "adaptive" && ratio !== "16:9" && ratio !== "9:16" && ratio !== "1:1" || typeof maxBytes !== "number" || !Number.isSafeInteger(maxBytes) || maxBytes < 1) {
     throw new Error("Media video job has an invalid request payload");
   }
-  return { provider: provider2, region, model, prompt, resolution, duration, ratio, maxBytes };
+  const normalized = normalizeMiniMaxVideoRequest({
+    region,
+    model,
+    prompt,
+    resolution,
+    duration,
+    ratio,
+    firstFrameImageUrl: value.firstFrameImageUrl
+  });
+  return { provider: provider2, ...normalized, maxBytes };
 }
 function mediaJobIdFromMaintenance(job) {
   const mediaJobId = job.payload.mediaJobId;
@@ -143707,6 +143767,7 @@ function mediaJobIdFromMaintenance(job) {
 function toVideoRequest(request) {
   return {
     prompt: request.prompt,
+    firstFrameImageUrl: request.firstFrameImageUrl,
     model: request.model,
     region: request.region,
     resolution: request.resolution,
@@ -143798,6 +143859,7 @@ function queueMiniMaxVideoGeneration(input) {
     region: normalized.region,
     model: normalized.model,
     prompt: normalized.prompt,
+    ...normalized.firstFrameImageUrl ? { firstFrameImageUrl: normalized.firstFrameImageUrl } : {},
     resolution: normalized.resolution,
     duration: normalized.duration,
     ratio: normalized.ratio,

package/dist/memcode-runtime/CHANGELOG.md

@@ -2,7 +2,55 @@
 
 All notable changes to this project will be documented in this file.
 
-## [Unreleased]
+## [1.9.5] - 2026-09-20
+
+### Added
+- **Setup HTTP MCP** -- `memorix setup --mcp http` honors Grok (writes a
+  `[mcp_servers.memorix]` URL in Grok `config.toml`) and rewrites installed
+  plugin/extension bundled MCP manifests from `memorix serve` to
+  `http://localhost:3211/mcp`. Default Grok MCP stays host-owned. Docs include
+  generic systemd user unit and LaunchAgent KeepAlive examples for
+  `memorix serve-http`.
+- **User-global store sync** -- `memorix sync store push|pull|status --scope user`
+  replicates every local project's eligible observations through the existing
+  opt-in relay. Default `--scope project` is unchanged. Privacy filters still
+  drop personal, agent-targeted, candidate, and ephemeral rows. The live
+  SQLite file is never copied.
+
+### Fixed
+- **HTTP control-plane safety** -- JSON request bodies are bounded, non-loopback
+  binds require an explicit Bearer token or unsafe opt-in, listen failures are
+  reported synchronously, background startup removes unverified state, and
+  shutdown waits for HTTP and SQLite resources to close.
+- **Project-scoped graph storage** -- graph entities and relations now carry a
+  project key, legacy JSONL migration recovers ownership from observation
+  references, and Dashboard/MCP graph access no longer crosses projects.
+- **Migration and lifecycle reliability** -- legacy observation/subdirectory
+  migrations use locks and atomic writes, malformed observation JSON fails
+  closed, stale file locks cannot evict a live writer, stateless MCP bindings
+  expire and are cleaned up, and SDK clients share resources safely.
+- **User-scope sync correctness** -- imported observation IDs are remapped on
+  collision, tombstones validate their source project, and user namespaces
+  must be explicit per-user values.
+- **Release contract** -- publish workflow validates tag/version/commit
+  identity, waits for npm visibility before MCP Registry publication, and
+  keeps prepublish checks non-mutating.
+
+## [1.9.4] - 2026-09-18
+
+### Added
+- **MiniMax first-frame video input** -- image-to-video generation now accepts
+  a public HTTPS first-frame image URL through the CLI and MCP surfaces,
+  preserves it in durable media jobs, and submits it with the provider's
+  `first_frame` image role.
+
+### Fixed
+- **First-frame URL safety** -- rejects non-HTTPS URLs and embedded credentials
+  before a media request is submitted or persisted.
+
+### Changed
+- **Grok Build documentation** -- the README comparison now uses the official
+  Grok Build logo assets.
 
 ## [1.9.3] - 2026-09-14
 

package/dist/sdk.d.ts

@@ -120,6 +120,7 @@ declare class MemoryClient {
     private _oramaStore;
     private _obsStore;
     private _freshness;
+    private _sdkRefRegistered;
     /** @internal — use createMemoryClient() instead */
     constructor(projectId: string, projectRoot: string, dataDir: string);
     /** The canonical project ID (derived from Git remote or local path) */