memorix 1.9.4 → 1.9.6

package/dist/maintenance-runner.js

@@ -380,11 +380,21 @@ function applySchemaMigrations(db2) {
     apply();
   }
 }
+function normalizeDataDir(dataDir) {
+  return path3.resolve(dataDir);
+}
+function touchDatabase(normalized, db2) {
+  _dbCache.delete(normalized);
+  _dbCache.set(normalized, db2);
+}
 function getDatabase(dataDir) {
-  const normalized = path3.resolve(dataDir);
+  const normalized = normalizeDataDir(dataDir);
   assertNotHomeDataDir(normalized);
   const existing = _dbCache.get(normalized);
-  if (existing) return existing;
+  if (existing) {
+    touchDatabase(normalized, existing);
+    return existing;
+  }
   loadBetterSqlite3();
   fs.mkdirSync(dataDir, { recursive: true });
   const dbPath = path3.join(dataDir, "memorix.db");
@@ -414,6 +424,8 @@ function getDatabase(dataDir) {
     db2.exec(CREATE_MAINTENANCE_JOBS_TABLE);
     db2.exec(CREATE_MAINTENANCE_TARGETS_TABLE);
     db2.exec(CREATE_COMPACTION_CHECKPOINTS_TABLE);
+    db2.exec(CREATE_TASK_CONTINUITY_EVENTS_TABLE);
+    db2.exec(CREATE_AGENT_EFFECTS_TABLE);
     try {
       db2.exec(`ALTER TABLE mini_skills ADD COLUMN sourceSnapshot TEXT NOT NULL DEFAULT ''`);
     } catch {
@@ -452,7 +464,7 @@ function getDatabase(dataDir) {
     db2.prepare(`INSERT OR IGNORE INTO meta (key, value) VALUES ('storage_generation', '0')`).run();
     db2.prepare(`INSERT OR IGNORE INTO meta (key, value) VALUES ('next_id', '1')`).run();
     db2.prepare(`INSERT OR IGNORE INTO meta (key, value) VALUES ('mini_skills_generation', '0')`).run();
-    _dbCache.set(normalized, db2);
+    touchDatabase(normalized, db2);
     return db2;
   } catch (error) {
     try {
@@ -470,8 +482,9 @@ function closeAllDatabases() {
     }
     _dbCache.delete(key);
   }
+  _dbLeases.clear();
 }
-var BetterSqlite3, CREATE_OBSERVATIONS_TABLE, CREATE_MINI_SKILLS_TABLE, CREATE_SESSIONS_TABLE, CREATE_META_TABLE, CREATE_TEAM_AGENTS_TABLE, CREATE_TEAM_MESSAGES_TABLE, CREATE_TEAM_TASKS_TABLE, CREATE_TEAM_TASK_DEPS_TABLE, CREATE_TEAM_LOCKS_TABLE, CREATE_TEAM_ROLES_TABLE, CREATE_CHAT_TRANSCRIPT_TABLE, CREATE_GRAPH_ENTITIES_TABLE, CREATE_GRAPH_RELATIONS_TABLE, CREATE_CODE_FILES_TABLE, CREATE_CODE_SYMBOLS_TABLE, CREATE_CODE_EDGES_TABLE, CREATE_OBSERVATION_CODE_REFS_TABLE, CREATE_SCHEMA_MIGRATIONS_TABLE, CREATE_CODE_STATE_SNAPSHOTS_TABLE, CREATE_CODE_STATE_SNAPSHOT_FILES_TABLE, CREATE_KNOWLEDGE_CLAIMS_TABLE, CREATE_KNOWLEDGE_CLAIM_EVIDENCE_TABLE, CREATE_KNOWLEDGE_CLAIM_EVENTS_TABLE, CREATE_KNOWLEDGE_WORKSPACES_TABLE, CREATE_KNOWLEDGE_PAGES_TABLE, CREATE_KNOWLEDGE_PAGE_CLAIMS_TABLE, CREATE_KNOWLEDGE_PAGE_LINKS_TABLE, CREATE_KNOWLEDGE_PROPOSALS_TABLE, CREATE_KNOWLEDGE_WORKFLOWS_TABLE, CREATE_KNOWLEDGE_WORKFLOW_RUNS_TABLE, CREATE_LONG_TERM_MEMORIES_TABLE, CREATE_LONG_TERM_MEMORY_EVIDENCE_TABLE, CREATE_LONG_TERM_MEMORY_EVENTS_TABLE, CREATE_MEMORY_OUTCOME_SIGNALS_TABLE, CREATE_MEDIA_ASSETS_TABLE, CREATE_MEDIA_ASSET_LINKS_TABLE, CREATE_MEDIA_DERIVATIONS_TABLE, CREATE_MEDIA_EMBEDDING_PROFILES_TABLE, CREATE_MEDIA_EMBEDDINGS_TABLE, CREATE_MEDIA_JOBS_TABLE, CREATE_MAINTENANCE_JOBS_TABLE, CREATE_MAINTENANCE_TARGETS_TABLE, CREATE_COMPACTION_CHECKPOINTS_TABLE, CREATE_EVIDENCE_CARDS_TABLE, CREATE_EVIDENCE_CARD_EVENTS_TABLE, CREATE_MEMORY_FEEDBACK_STATES_TABLE, CREATE_MEMORY_FEEDBACK_EVENTS_TABLE, CREATE_MCP_BINDINGS_TABLE, CREATE_INDEXES, SCHEMA_MIGRATIONS, _dbCache;
+var BetterSqlite3, CREATE_OBSERVATIONS_TABLE, CREATE_MINI_SKILLS_TABLE, CREATE_SESSIONS_TABLE, CREATE_META_TABLE, CREATE_TEAM_AGENTS_TABLE, CREATE_TEAM_MESSAGES_TABLE, CREATE_TEAM_TASKS_TABLE, CREATE_TEAM_TASK_DEPS_TABLE, CREATE_TEAM_LOCKS_TABLE, CREATE_TEAM_ROLES_TABLE, CREATE_CHAT_TRANSCRIPT_TABLE, CREATE_GRAPH_ENTITIES_TABLE, CREATE_GRAPH_RELATIONS_TABLE, CREATE_CODE_FILES_TABLE, CREATE_CODE_SYMBOLS_TABLE, CREATE_CODE_EDGES_TABLE, CREATE_OBSERVATION_CODE_REFS_TABLE, CREATE_SCHEMA_MIGRATIONS_TABLE, CREATE_CODE_STATE_SNAPSHOTS_TABLE, CREATE_CODE_STATE_SNAPSHOT_FILES_TABLE, CREATE_KNOWLEDGE_CLAIMS_TABLE, CREATE_KNOWLEDGE_CLAIM_EVIDENCE_TABLE, CREATE_KNOWLEDGE_CLAIM_EVENTS_TABLE, CREATE_KNOWLEDGE_WORKSPACES_TABLE, CREATE_KNOWLEDGE_PAGES_TABLE, CREATE_KNOWLEDGE_PAGE_CLAIMS_TABLE, CREATE_KNOWLEDGE_PAGE_LINKS_TABLE, CREATE_KNOWLEDGE_PROPOSALS_TABLE, CREATE_KNOWLEDGE_WORKFLOWS_TABLE, CREATE_KNOWLEDGE_WORKFLOW_RUNS_TABLE, CREATE_LONG_TERM_MEMORIES_TABLE, CREATE_LONG_TERM_MEMORY_EVIDENCE_TABLE, CREATE_LONG_TERM_MEMORY_EVENTS_TABLE, CREATE_MEMORY_OUTCOME_SIGNALS_TABLE, CREATE_MEDIA_ASSETS_TABLE, CREATE_MEDIA_ASSET_LINKS_TABLE, CREATE_MEDIA_DERIVATIONS_TABLE, CREATE_MEDIA_EMBEDDING_PROFILES_TABLE, CREATE_MEDIA_EMBEDDINGS_TABLE, CREATE_MEDIA_JOBS_TABLE, CREATE_MAINTENANCE_JOBS_TABLE, CREATE_MAINTENANCE_TARGETS_TABLE, CREATE_COMPACTION_CHECKPOINTS_TABLE, CREATE_EVIDENCE_CARDS_TABLE, CREATE_EVIDENCE_CARD_EVENTS_TABLE, CREATE_MEMORY_FEEDBACK_STATES_TABLE, CREATE_MEMORY_FEEDBACK_EVENTS_TABLE, CREATE_TASK_CONTINUITY_EVENTS_TABLE, CREATE_AGENT_EFFECTS_TABLE, CREATE_MCP_BINDINGS_TABLE, CREATE_INDEXES, SCHEMA_MIGRATIONS, _dbCache, _dbLeases;
 var init_sqlite_db = __esm({
   "src/store/sqlite-db.ts"() {
     "use strict";
@@ -643,18 +656,21 @@ CREATE TABLE IF NOT EXISTS chat_transcript (
 `;
     CREATE_GRAPH_ENTITIES_TABLE = `
 CREATE TABLE IF NOT EXISTS graph_entities (
-  name            TEXT PRIMARY KEY,
+  projectId       TEXT NOT NULL,
+  name            TEXT NOT NULL,
   entityType      TEXT NOT NULL DEFAULT '',
-  observations    TEXT NOT NULL DEFAULT '[]'
+  observations    TEXT NOT NULL DEFAULT '[]',
+  PRIMARY KEY (projectId, name)
 );
 `;
     CREATE_GRAPH_RELATIONS_TABLE = `
 CREATE TABLE IF NOT EXISTS graph_relations (
   id              INTEGER PRIMARY KEY AUTOINCREMENT,
+  projectId       TEXT NOT NULL,
   from_entity     TEXT NOT NULL,
   to_entity       TEXT NOT NULL,
   relationType    TEXT NOT NULL DEFAULT '',
-  UNIQUE(from_entity, to_entity, relationType)
+  UNIQUE(projectId, from_entity, to_entity, relationType)
 );
 `;
     CREATE_CODE_FILES_TABLE = `
@@ -1185,6 +1201,43 @@ CREATE TABLE IF NOT EXISTS memory_feedback_events (
   delta           REAL NOT NULL DEFAULT 0,
   observed_at     TEXT NOT NULL
 );
+`;
+    CREATE_TASK_CONTINUITY_EVENTS_TABLE = `
+CREATE TABLE IF NOT EXISTS task_continuity_events (
+  id              TEXT PRIMARY KEY,
+  project_id      TEXT NOT NULL,
+  task_id         TEXT NOT NULL,
+  task            TEXT NOT NULL,
+  kind            TEXT NOT NULL,
+  content         TEXT NOT NULL,
+  item_status     TEXT,
+  source_ref      TEXT,
+  evidence_json   TEXT NOT NULL DEFAULT '[]',
+  actor           TEXT,
+  created_at      TEXT NOT NULL,
+  event_key       TEXT,
+  item_key        TEXT,
+  supersedes_id   TEXT
+);
+`;
+    CREATE_AGENT_EFFECTS_TABLE = `
+CREATE TABLE IF NOT EXISTS agent_effects (
+  id                TEXT PRIMARY KEY,
+  pipeline_id       TEXT NOT NULL,
+  task_id           TEXT NOT NULL,
+  attempt           INTEGER NOT NULL,
+  effect_key        TEXT NOT NULL,
+  tool              TEXT NOT NULL,
+  risk_tier         TEXT NOT NULL,
+  replay_policy     TEXT NOT NULL,
+  status            TEXT NOT NULL,
+  call_id           TEXT,
+  idempotency_key   TEXT NOT NULL,
+  input_fingerprint TEXT,
+  detail            TEXT,
+  started_at        INTEGER NOT NULL,
+  finished_at       INTEGER
+);
 `;
     CREATE_MCP_BINDINGS_TABLE = `
 CREATE TABLE IF NOT EXISTS mcp_bindings (
@@ -1263,7 +1316,18 @@ CREATE INDEX IF NOT EXISTS idx_evidence_cards_candidate ON evidence_cards(projec
 CREATE INDEX IF NOT EXISTS idx_evidence_card_events_card ON evidence_card_events(card_id, created_at);
 CREATE INDEX IF NOT EXISTS idx_memory_feedback_states_project ON memory_feedback_states(project_id, candidate_kind, updated_at DESC);
 CREATE INDEX IF NOT EXISTS idx_memory_feedback_events_candidate ON memory_feedback_events(project_id, candidate_kind, candidate_id, observed_at DESC);
+CREATE INDEX IF NOT EXISTS idx_task_continuity_project_task ON task_continuity_events(project_id, task_id, created_at ASC);
+CREATE INDEX IF NOT EXISTS idx_task_continuity_project_recent ON task_continuity_events(project_id, created_at DESC);
+CREATE INDEX IF NOT EXISTS idx_task_continuity_item ON task_continuity_events(project_id, task_id, kind, item_key, created_at DESC);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_task_continuity_event_key
+  ON task_continuity_events(project_id, task_id, event_key)
+  WHERE event_key IS NOT NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS idx_agent_effect_identity
+  ON agent_effects(pipeline_id, task_id, attempt, effect_key);
+CREATE INDEX IF NOT EXISTS idx_agent_effect_pipeline ON agent_effects(pipeline_id, started_at ASC);
 CREATE INDEX IF NOT EXISTS idx_mcp_bindings_project ON mcp_bindings(project_id, last_used_at DESC);
+CREATE INDEX IF NOT EXISTS idx_mcp_bindings_root ON mcp_bindings(project_root, last_used_at DESC);
+CREATE INDEX IF NOT EXISTS idx_mcp_bindings_expiry ON mcp_bindings(expires_at);
 CREATE UNIQUE INDEX IF NOT EXISTS idx_maintenance_jobs_active_dedupe
   ON maintenance_jobs(project_id, kind, dedupe_key)
   WHERE status IN ('pending', 'running', 'retry');
@@ -1434,6 +1498,8 @@ CREATE UNIQUE INDEX IF NOT EXISTS idx_maintenance_jobs_active_dedupe
           db2.exec("CREATE INDEX IF NOT EXISTS idx_memory_feedback_states_project ON memory_feedback_states(project_id, candidate_kind, updated_at DESC)");
           db2.exec("CREATE INDEX IF NOT EXISTS idx_memory_feedback_events_candidate ON memory_feedback_events(project_id, candidate_kind, candidate_id, observed_at DESC)");
           db2.exec("CREATE INDEX IF NOT EXISTS idx_mcp_bindings_project ON mcp_bindings(project_id, last_used_at DESC)");
+          db2.exec("CREATE INDEX IF NOT EXISTS idx_mcp_bindings_root ON mcp_bindings(project_root, last_used_at DESC)");
+          db2.exec("CREATE INDEX IF NOT EXISTS idx_mcp_bindings_expiry ON mcp_bindings(expires_at)");
         }
       },
       {
@@ -1444,9 +1510,22 @@ CREATE UNIQUE INDEX IF NOT EXISTS idx_maintenance_jobs_active_dedupe
           addColumnIfMissing(db2, "code_symbols", "source", "source TEXT");
           addColumnIfMissing(db2, "code_edges", "source", "source TEXT");
         }
+      },
+      {
+        id: "1.9-continuity-v2",
+        apply: (db2) => {
+          addColumnIfMissing(db2, "task_continuity_events", "event_key", "event_key TEXT");
+          addColumnIfMissing(db2, "task_continuity_events", "item_key", "item_key TEXT");
+          addColumnIfMissing(db2, "task_continuity_events", "supersedes_id", "supersedes_id TEXT");
+          db2.exec("CREATE INDEX IF NOT EXISTS idx_task_continuity_item ON task_continuity_events(project_id, task_id, kind, item_key, created_at DESC)");
+          db2.exec(`CREATE UNIQUE INDEX IF NOT EXISTS idx_task_continuity_event_key
+        ON task_continuity_events(project_id, task_id, event_key)
+        WHERE event_key IS NOT NULL`);
+        }
       }
     ];
     _dbCache = /* @__PURE__ */ new Map();
+    _dbLeases = /* @__PURE__ */ new Map();
   }
 });
 
@@ -1549,15 +1628,20 @@ var init_dotenv_loader = __esm({
 import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
 import { homedir as homedir2 } from "os";
 import { parse as parseYamlDocument } from "yaml";
+function cacheKey(homeDir, projectRoot) {
+  return `${homeDir}\0${projectRoot ?? ""}`;
+}
 function initProjectRoot(root) {
   globalProjectRoot = root;
-  configCache.delete(root);
+  configCache.delete(cacheKey(homedir2(), root));
 }
-function loadYamlConfig(projectRoot) {
+function loadYamlConfig(projectRoot, options = {}) {
+  const homeDir = options.homeDir ?? homedir2();
   const resolvedRoot = projectRoot === null ? null : projectRoot ?? globalProjectRoot ?? null;
-  const cached = configCache.get(resolvedRoot ?? null);
+  const key = cacheKey(homeDir, resolvedRoot);
+  const cached = configCache.get(key);
   if (cached) return cached;
-  const userYaml = getGlobalYamlPath(homedir2());
+  const userYaml = getGlobalYamlPath(homeDir);
   const projectYaml = resolvedRoot ? getProjectYamlPath(resolvedRoot) : null;
   let userConfig = {};
   let projectConfig = {};
@@ -1589,7 +1673,7 @@ function loadYamlConfig(projectRoot) {
     server: { ...userConfig.server, ...projectConfig.server },
     team: { ...userConfig.team, ...projectConfig.team }
   };
-  configCache.set(resolvedRoot ?? null, merged);
+  configCache.set(key, merged);
   return merged;
 }
 function parseYaml(content) {
@@ -1765,9 +1849,9 @@ var init_detector = __esm({
 // src/config/legacy-loader.ts
 import { existsSync as existsSync5, readFileSync as readFileSync5 } from "fs";
 import { homedir as homedir3 } from "os";
-function loadFileConfig() {
+function loadFileConfig(homeDir = homedir3()) {
   if (cachedConfig !== null) return cachedConfig;
-  const configPath = getLegacyConfigJsonPath(homedir3());
+  const configPath = getLegacyConfigJsonPath(homeDir);
   try {
     if (existsSync5(configPath)) {
       cachedConfig = JSON.parse(readFileSync5(configPath, "utf-8"));
@@ -1797,15 +1881,15 @@ import { homedir as homedir4 } from "os";
 function loadTomlConfig(options = {}) {
   const homeDir = options.homeDir ?? homedir4();
   const projectRoot = options.projectRoot ?? null;
-  const cacheKey = `${homeDir}\0${projectRoot ?? ""}`;
-  const cached = configCache2.get(cacheKey);
+  const cacheKey3 = `${homeDir}\0${projectRoot ?? ""}`;
+  const cached = configCache2.get(cacheKey3);
   if (cached) return cached;
   const userToml = getGlobalConfigTomlPath(homeDir);
   const projectToml = projectRoot ? getProjectConfigTomlPath(projectRoot) : null;
   const userConfig = existsSync6(userToml) ? parseTomlConfig(readFileSync6(userToml, "utf8"), userToml) : {};
   const projectConfig = projectToml && existsSync6(projectToml) ? parseTomlConfig(readFileSync6(projectToml, "utf8"), projectToml) : {};
   const merged = mergeTomlConfig(userConfig, projectConfig);
-  configCache2.set(cacheKey, merged);
+  configCache2.set(cacheKey3, merged);
   return merged;
 }
 function mergeTomlConfig(base, override) {
@@ -1926,8 +2010,8 @@ function getResolvedConfig(options = {}) {
   const projectRoot = options.projectRoot === void 0 ? detectProject()?.rootPath ?? null : options.projectRoot;
   loadDotenv(projectRoot === null ? void 0 : projectRoot ?? void 0, { userHomeDir: homeDir });
   const toml = loadTomlConfig({ projectRoot: projectRoot ?? null, homeDir });
-  const yaml = loadYamlConfig(projectRoot ?? null);
-  const legacy = loadFileConfig();
+  const yaml = loadYamlConfig(projectRoot ?? null, { homeDir });
+  const legacy = loadFileConfig(homeDir);
   const embeddingBaseUrl = first(process.env.MEMORIX_EMBEDDING_BASE_URL, toml.embedding?.base_url, yaml.embedding?.baseUrl, legacy.embeddingApi?.baseUrl);
   const openRouterEmbeddingApiKey = isOpenRouterUrl(embeddingBaseUrl) ? process.env.OPENROUTER_API_KEY : void 0;
   const memoryLlmProvider = first(
@@ -1949,15 +2033,17 @@ function getResolvedConfig(options = {}) {
     legacy.llm?.baseUrl
   );
   const openRouterMemoryLlmApiKey = isOpenRouterMemoryLane(memoryLlmProvider, memoryLlmBaseUrl) ? process.env.OPENROUTER_API_KEY : void 0;
+  const isAtlasCloud = memoryLlmProvider === "atlascloud";
   const memoryLlmApiKey = first(
     process.env.MEMORIX_LLM_API_KEY,
     process.env.MEMORIX_API_KEY,
     toml.memory?.llm?.api_key,
     yaml.llm?.apiKey,
     legacy.llm?.apiKey,
-    process.env.OPENAI_API_KEY,
-    process.env.ANTHROPIC_API_KEY,
-    openRouterMemoryLlmApiKey
+    // Never borrow another provider's credentials for the Atlas Cloud preset.
+    isAtlasCloud ? process.env.ATLASCLOUD_API_KEY : process.env.OPENAI_API_KEY,
+    isAtlasCloud ? void 0 : process.env.ANTHROPIC_API_KEY,
+    isAtlasCloud ? void 0 : openRouterMemoryLlmApiKey
   );
   const resolved = {
     agent: {
@@ -2136,7 +2222,8 @@ function getEnvSourceNames() {
     "MEMORIX_CODEGRAPH_EXTERNAL_CONTEXT",
     "MEMORIX_CODEGRAPH_EXTERNAL_COMMAND",
     "MEMORIX_CODEGRAPH_EXTERNAL_TIMEOUT_MS",
-    "OPENROUTER_API_KEY"
+    "OPENROUTER_API_KEY",
+    "ATLASCLOUD_API_KEY"
   ].filter((name) => process.env[name]);
 }
 function isOpenRouterUrl(value) {
@@ -2967,6 +3054,7 @@ var init_provider = __esm({
       openai: { baseUrl: "https://api.openai.com/v1", model: "gpt-4.1-nano" },
       anthropic: { baseUrl: "https://api.anthropic.com/v1", model: "claude-3-5-haiku-latest" },
       openrouter: { baseUrl: "https://openrouter.ai/api/v1", model: "openai/gpt-4.1-nano" },
+      atlascloud: { baseUrl: "https://api.atlascloud.ai/v1", model: "deepseek-ai/deepseek-v3.2" },
       custom: { baseUrl: "http://localhost:11434/v1", model: "llama3" }
     };
     currentConfig = null;
@@ -3041,13 +3129,120 @@ var init_sqlite_reliability = __esm({
   }
 });
 
+// src/store/file-lock.ts
+import { promises as fs2 } from "fs";
+import { randomUUID } from "crypto";
+import path5 from "path";
+function canReclaimStaleLock(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    const pid = Number(parsed.pid);
+    if (!Number.isSafeInteger(pid) || pid < 1) return true;
+    try {
+      process.kill(pid, 0);
+      return false;
+    } catch (error) {
+      return error.code !== "EPERM";
+    }
+  } catch {
+    return true;
+  }
+}
+async function acquireLock(lockPath) {
+  for (let i2 = 0; i2 < MAX_RETRIES; i2++) {
+    try {
+      const fd = await fs2.open(lockPath, "wx");
+      await fd.writeFile(JSON.stringify({ pid: process.pid, time: Date.now() }));
+      await fd.close();
+      return;
+    } catch (err) {
+      const code = err instanceof Error && "code" in err ? err.code : void 0;
+      if (code === "EEXIST" || code === "EPERM") {
+        try {
+          const stat5 = await fs2.stat(lockPath);
+          if (Date.now() - stat5.mtimeMs > LOCK_STALE_MS) {
+            const raw2 = await fs2.readFile(lockPath, "utf8").catch(() => "");
+            if (canReclaimStaleLock(raw2)) {
+              await fs2.unlink(lockPath).catch(() => {
+              });
+              continue;
+            }
+          }
+        } catch {
+          continue;
+        }
+        await new Promise((r2) => setTimeout(r2, RETRY_INTERVAL_MS));
+      } else {
+        throw err;
+      }
+    }
+  }
+  const raw = await fs2.readFile(lockPath, "utf8").catch(() => "");
+  if (!canReclaimStaleLock(raw)) {
+    throw new Error(`Failed to acquire lock: ${lockPath} (owner is still running)`);
+  }
+  await fs2.unlink(lockPath).catch(() => {
+  });
+  try {
+    const fd = await fs2.open(lockPath, "wx");
+    await fd.writeFile(JSON.stringify({ pid: process.pid, time: Date.now() }));
+    await fd.close();
+    return;
+  } catch {
+    throw new Error(`Failed to acquire lock: ${lockPath} (timeout after ${MAX_RETRIES * RETRY_INTERVAL_MS}ms)`);
+  }
+}
+async function releaseLock(lockPath) {
+  await fs2.unlink(lockPath).catch(() => {
+  });
+}
+async function withFileLock(projectDir2, fn) {
+  const lockPath = path5.join(projectDir2, ".memorix.lock");
+  await acquireLock(lockPath);
+  try {
+    return await fn();
+  } finally {
+    await releaseLock(lockPath);
+  }
+}
+async function atomicWriteFileOnce(filePath, data) {
+  const tmpPath = filePath + `.tmp.${process.pid}.${randomUUID()}`;
+  try {
+    await fs2.writeFile(tmpPath, data, "utf-8");
+    await fs2.rename(tmpPath, filePath);
+  } catch (error) {
+    await fs2.unlink(tmpPath).catch(() => {
+    });
+    throw error;
+  }
+}
+function atomicWriteFile(filePath, data) {
+  const previous = atomicWriteTails.get(filePath) ?? Promise.resolve();
+  const next = previous.catch(() => void 0).then(() => atomicWriteFileOnce(filePath, data));
+  atomicWriteTails.set(filePath, next);
+  return next.finally(() => {
+    if (atomicWriteTails.get(filePath) === next) atomicWriteTails.delete(filePath);
+  });
+}
+var LOCK_STALE_MS, RETRY_INTERVAL_MS, MAX_RETRIES, atomicWriteTails;
+var init_file_lock = __esm({
+  "src/store/file-lock.ts"() {
+    "use strict";
+    init_esm_shims();
+    LOCK_STALE_MS = 1e4;
+    RETRY_INTERVAL_MS = 50;
+    MAX_RETRIES = 60;
+    atomicWriteTails = /* @__PURE__ */ new Map();
+  }
+});
+
 // src/store/sqlite-store.ts
 var sqlite_store_exports = {};
 __export(sqlite_store_exports, {
   SqliteBackend: () => SqliteBackend
 });
-import path5 from "path";
-import fs2 from "fs";
+import path6 from "path";
+import fs3 from "fs";
 function obsToRow(obs) {
   return {
     id: obs.id,
@@ -3134,6 +3329,7 @@ var init_sqlite_store = __esm({
     init_sqlite_db();
     init_sqlite_reliability();
     init_sqlite_fts();
+    init_file_lock();
     SqliteBackend = class {
       db = null;
       dataDir = "";
@@ -3297,38 +3493,43 @@ var init_sqlite_store = __esm({
       }
       // ── Migration ────────────────────────────────────────────────────
       async migrateFromJsonIfNeeded() {
-        const count2 = this.db.prepare(`SELECT COUNT(*) AS cnt FROM observations`).get();
-        if (count2.cnt > 0) return;
-        const jsonPath = path5.join(this.dataDir, "observations.json");
-        if (!fs2.existsSync(jsonPath)) return;
-        try {
-          const raw = fs2.readFileSync(jsonPath, "utf-8");
-          const observations2 = JSON.parse(raw);
+        const jsonPath = path6.join(this.dataDir, "observations.json");
+        if (!fs3.existsSync(jsonPath)) return;
+        await withFileLock(this.dataDir, async () => {
+          const count2 = this.db.prepare(`SELECT COUNT(*) AS cnt FROM observations`).get();
+          if (count2.cnt > 0) return;
+          const raw = fs3.readFileSync(jsonPath, "utf-8");
+          const parsed = JSON.parse(raw);
+          if (!Array.isArray(parsed)) {
+            throw new Error("[memorix] observations.json migration refused: expected a JSON array");
+          }
+          const observations2 = parsed;
           if (observations2.length === 0) return;
+          if (observations2.some((obs) => !obs || !Number.isSafeInteger(obs.id) || obs.id < 1 || typeof obs.projectId !== "string")) {
+            throw new Error("[memorix] observations.json migration refused: invalid observation record");
+          }
           console.error(`[memorix] Migrating ${observations2.length} observations from JSON to SQLite...`);
           const insertMany = this.db.transaction((obsList) => {
             for (const obs of obsList) {
               this.stmtInsert.run(obsToRow(obs));
             }
+            const counterPath = path6.join(this.dataDir, "counter.json");
+            let counterNextId;
+            if (fs3.existsSync(counterPath)) {
+              const counterData = JSON.parse(fs3.readFileSync(counterPath, "utf-8"));
+              const candidate = counterData.nextId ?? counterData.next_id;
+              if (candidate !== void 0 && (!Number.isSafeInteger(candidate) || Number(candidate) < 1)) {
+                throw new Error("[memorix] counter.json migration refused: nextId must be a positive integer");
+              }
+              counterNextId = candidate === void 0 ? void 0 : Number(candidate);
+            }
+            const maxId = Math.max(...obsList.map((obs) => obs.id));
+            this.rawSaveIdCounter(Math.max(counterNextId ?? 1, maxId + 1));
+            this.bumpGeneration();
           });
           insertMany(observations2);
-          const counterPath = path5.join(this.dataDir, "counter.json");
-          if (fs2.existsSync(counterPath)) {
-            try {
-              const counterData = JSON.parse(fs2.readFileSync(counterPath, "utf-8"));
-              const nextId2 = counterData.nextId ?? counterData.next_id ?? Math.max(...observations2.map((o) => o.id)) + 1;
-              this.rawSaveIdCounter(nextId2);
-            } catch {
-              this.rawSaveIdCounter(Math.max(...observations2.map((o) => o.id)) + 1);
-            }
-          } else {
-            this.rawSaveIdCounter(Math.max(...observations2.map((o) => o.id)) + 1);
-          }
-          this.bumpGeneration();
           console.error(`[memorix] Migration complete. ${observations2.length} observations now in SQLite.`);
-        } catch (err) {
-          console.error(`[memorix] JSON\u2192SQLite migration failed (non-fatal, data preserved in JSON): ${err}`);
-        }
+        });
       }
       // ── Public read ──────────────────────────────────────────────────
       async loadAll() {
@@ -3657,91 +3858,6 @@ var init_types = __esm({
   }
 });
 
-// src/store/file-lock.ts
-import { promises as fs3 } from "fs";
-import { randomUUID } from "crypto";
-import path6 from "path";
-async function acquireLock(lockPath) {
-  for (let i2 = 0; i2 < MAX_RETRIES; i2++) {
-    try {
-      const fd = await fs3.open(lockPath, "wx");
-      await fd.writeFile(JSON.stringify({ pid: process.pid, time: Date.now() }));
-      await fd.close();
-      return;
-    } catch (err) {
-      const code = err instanceof Error && "code" in err ? err.code : void 0;
-      if (code === "EEXIST" || code === "EPERM") {
-        try {
-          const stat5 = await fs3.stat(lockPath);
-          if (Date.now() - stat5.mtimeMs > LOCK_STALE_MS) {
-            await fs3.unlink(lockPath).catch(() => {
-            });
-            continue;
-          }
-        } catch {
-          continue;
-        }
-        await new Promise((r2) => setTimeout(r2, RETRY_INTERVAL_MS));
-      } else {
-        throw err;
-      }
-    }
-  }
-  await fs3.unlink(lockPath).catch(() => {
-  });
-  try {
-    const fd = await fs3.open(lockPath, "wx");
-    await fd.writeFile(JSON.stringify({ pid: process.pid, time: Date.now() }));
-    await fd.close();
-    return;
-  } catch {
-    throw new Error(`Failed to acquire lock: ${lockPath} (timeout after ${MAX_RETRIES * RETRY_INTERVAL_MS}ms)`);
-  }
-}
-async function releaseLock(lockPath) {
-  await fs3.unlink(lockPath).catch(() => {
-  });
-}
-async function withFileLock(projectDir2, fn) {
-  const lockPath = path6.join(projectDir2, ".memorix.lock");
-  await acquireLock(lockPath);
-  try {
-    return await fn();
-  } finally {
-    await releaseLock(lockPath);
-  }
-}
-async function atomicWriteFileOnce(filePath, data) {
-  const tmpPath = filePath + `.tmp.${process.pid}.${randomUUID()}`;
-  try {
-    await fs3.writeFile(tmpPath, data, "utf-8");
-    await fs3.rename(tmpPath, filePath);
-  } catch (error) {
-    await fs3.unlink(tmpPath).catch(() => {
-    });
-    throw error;
-  }
-}
-function atomicWriteFile(filePath, data) {
-  const previous = atomicWriteTails.get(filePath) ?? Promise.resolve();
-  const next = previous.catch(() => void 0).then(() => atomicWriteFileOnce(filePath, data));
-  atomicWriteTails.set(filePath, next);
-  return next.finally(() => {
-    if (atomicWriteTails.get(filePath) === next) atomicWriteTails.delete(filePath);
-  });
-}
-var LOCK_STALE_MS, RETRY_INTERVAL_MS, MAX_RETRIES, atomicWriteTails;
-var init_file_lock = __esm({
-  "src/store/file-lock.ts"() {
-    "use strict";
-    init_esm_shims();
-    LOCK_STALE_MS = 1e4;
-    RETRY_INTERVAL_MS = 50;
-    MAX_RETRIES = 60;
-    atomicWriteTails = /* @__PURE__ */ new Map();
-  }
-});
-
 // src/store/mini-skill-store.ts
 import path7 from "path";
 import fs4 from "fs";
@@ -3915,12 +4031,45 @@ function textHash(text2) {
 async function loadDiskCache() {
   try {
     const raw = await readFile(CACHE_FILE, "utf-8");
+    if (Buffer.byteLength(raw, "utf8") > MAX_CACHE_FILE_BYTES) {
+      console.error("[memorix] FastEmbed cache exceeds the disk load limit; starting with an empty cache");
+      return;
+    }
     const entries = JSON.parse(raw);
-    for (const [k, v] of entries) cache.set(k, v);
-    console.error(`[memorix] Loaded ${entries.length} cached embeddings from disk`);
+    if (!Array.isArray(entries)) return;
+    for (const entry of entries) {
+      if (!Array.isArray(entry) || typeof entry[0] !== "string" || !isVector(entry[1])) continue;
+      cacheSet(entry[0], entry[1], false);
+    }
+    console.error(`[memorix] Loaded ${cache.size} cached embeddings from disk`);
   } catch {
   }
 }
+function isVector(value) {
+  return Array.isArray(value) && value.every((entry) => typeof entry === "number");
+}
+function maxCachePayloadBytes() {
+  const raw = Number.parseInt(process.env.MEMORIX_EMBEDDING_CACHE_MAX_BYTES ?? "", 10);
+  return Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_CACHE_PAYLOAD_BYTES;
+}
+function cacheSet(hash4, value, markDirty = true) {
+  const incomingBytes = value.length * 8;
+  if (incomingBytes > maxCachePayloadBytes()) return;
+  const existing = cache.get(hash4);
+  if (existing) cachePayloadBytes -= existing.length * 8;
+  else {
+    while (cache.size >= MAX_CACHE_SIZE || cachePayloadBytes + incomingBytes > maxCachePayloadBytes()) {
+      const firstKey = cache.keys().next().value;
+      if (firstKey === void 0) break;
+      const old = cache.get(firstKey);
+      cache.delete(firstKey);
+      if (old) cachePayloadBytes -= old.length * 8;
+    }
+  }
+  cache.set(hash4, value);
+  cachePayloadBytes += incomingBytes;
+  if (markDirty) diskCacheDirty = true;
+}
 async function saveDiskCache() {
   if (!diskCacheDirty) return;
   try {
@@ -3931,7 +4080,7 @@ async function saveDiskCache() {
   } catch {
   }
 }
-var CACHE_DIR, CACHE_FILE, cache, MAX_CACHE_SIZE, diskCacheDirty, FastEmbedProvider;
+var CACHE_DIR, CACHE_FILE, cache, MAX_CACHE_SIZE, DEFAULT_CACHE_PAYLOAD_BYTES, MAX_CACHE_FILE_BYTES, cachePayloadBytes, diskCacheDirty, FastEmbedProvider;
 var init_fastembed_provider = __esm({
   "src/embedding/fastembed-provider.ts"() {
     "use strict";
@@ -3941,6 +4090,9 @@ var init_fastembed_provider = __esm({
     CACHE_FILE = join2(CACHE_DIR, ".embedding-cache.json");
     cache = /* @__PURE__ */ new Map();
     MAX_CACHE_SIZE = 5e3;
+    DEFAULT_CACHE_PAYLOAD_BYTES = 64 * 1024 * 1024;
+    MAX_CACHE_FILE_BYTES = 128 * 1024 * 1024;
+    cachePayloadBytes = 0;
     diskCacheDirty = false;
     FastEmbedProvider = class _FastEmbedProvider {
       name = "fastembed-bge-small";
@@ -3982,7 +4134,7 @@ var init_fastembed_provider = __esm({
         if (result.length !== this.dimensions) {
           throw new Error(`Expected ${this.dimensions}d embedding, got ${result.length}d`);
         }
-        this.cacheSet(hash4, result);
+        cacheSet(hash4, result);
         return result;
       }
       async embedBatch(texts) {
@@ -4007,7 +4159,7 @@ var init_fastembed_provider = __esm({
               const originalIdx = uncachedIndices[batchIdx];
               const plain = Array.from(vec);
               results[originalIdx] = plain;
-              this.cacheSet(textHash(uncachedTexts[batchIdx]), plain);
+              cacheSet(textHash(uncachedTexts[batchIdx]), plain);
               batchIdx++;
             }
           }
@@ -4015,14 +4167,6 @@ var init_fastembed_provider = __esm({
         }
         return results;
       }
-      cacheSet(hash4, value) {
-        if (cache.size >= MAX_CACHE_SIZE) {
-          const firstKey = cache.keys().next().value;
-          if (firstKey !== void 0) cache.delete(firstKey);
-        }
-        cache.set(hash4, value);
-        diskCacheDirty = true;
-      }
     };
   }
 });
@@ -4032,7 +4176,15 @@ var transformers_provider_exports = {};
 __export(transformers_provider_exports, {
   TransformersProvider: () => TransformersProvider
 });
-var cache2, MAX_CACHE_SIZE2, TransformersProvider;
+import { createHash as createHash2 } from "crypto";
+function cacheKey2(text2) {
+  return createHash2("sha256").update(text2).digest("hex");
+}
+function maxCachePayloadBytes2() {
+  const raw = Number.parseInt(process.env.MEMORIX_EMBEDDING_CACHE_MAX_BYTES ?? "", 10);
+  return Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_CACHE_PAYLOAD_BYTES2;
+}
+var cache2, MAX_CACHE_SIZE2, DEFAULT_CACHE_PAYLOAD_BYTES2, cachePayloadBytes2, TransformersProvider;
 var init_transformers_provider = __esm({
   "src/embedding/transformers-provider.ts"() {
     "use strict";
@@ -4040,6 +4192,8 @@ var init_transformers_provider = __esm({
     init_provider2();
     cache2 = /* @__PURE__ */ new Map();
     MAX_CACHE_SIZE2 = 5e3;
+    DEFAULT_CACHE_PAYLOAD_BYTES2 = 64 * 1024 * 1024;
+    cachePayloadBytes2 = 0;
     TransformersProvider = class _TransformersProvider {
       name = "transformers-minilm";
       dimensions = 384;
@@ -4074,7 +4228,7 @@ var init_transformers_provider = __esm({
         return Promise.all(inputs.map((input) => this.embedInput(input, options)));
       }
       async embed(text2) {
-        const cached = cache2.get(text2);
+        const cached = cache2.get(cacheKey2(text2));
         if (cached) return cached;
         const output = await this.extractor(text2, {
           pooling: "mean",
@@ -4084,7 +4238,7 @@ var init_transformers_provider = __esm({
         if (result.length !== this.dimensions) {
           throw new Error(`Expected ${this.dimensions}d embedding, got ${result.length}d`);
         }
-        this.cacheSet(text2, result);
+        this.cacheSet(cacheKey2(text2), result);
         return result;
       }
       async embedBatch(texts) {
@@ -4092,7 +4246,7 @@ var init_transformers_provider = __esm({
         const uncachedIndices = [];
         const uncachedTexts = [];
         for (let i2 = 0; i2 < texts.length; i2++) {
-          const cached = cache2.get(texts[i2]);
+          const cached = cache2.get(cacheKey2(texts[i2]));
           if (cached) {
             results[i2] = cached;
           } else {
@@ -4110,17 +4264,27 @@ var init_transformers_provider = __esm({
             const vec = Array.from(allVecs[i2]);
             const originalIdx = uncachedIndices[i2];
             results[originalIdx] = vec;
-            this.cacheSet(uncachedTexts[i2], vec);
+            this.cacheSet(cacheKey2(uncachedTexts[i2]), vec);
           }
         }
         return results;
       }
       cacheSet(key, value) {
-        if (cache2.size >= MAX_CACHE_SIZE2) {
-          const firstKey = cache2.keys().next().value;
-          if (firstKey !== void 0) cache2.delete(firstKey);
+        const incomingBytes = value.length * 8;
+        if (incomingBytes > maxCachePayloadBytes2()) return;
+        const existing = cache2.get(key);
+        if (existing) cachePayloadBytes2 -= existing.length * 8;
+        else {
+          while (cache2.size >= MAX_CACHE_SIZE2 || cachePayloadBytes2 + incomingBytes > maxCachePayloadBytes2()) {
+            const firstKey = cache2.keys().next().value;
+            if (firstKey === void 0) break;
+            const old = cache2.get(firstKey);
+            cache2.delete(firstKey);
+            if (old) cachePayloadBytes2 -= old.length * 8;
+          }
         }
         cache2.set(key, value);
+        cachePayloadBytes2 += incomingBytes;
       }
     };
   }
@@ -4142,7 +4306,7 @@ __export(api_provider_exports, {
   saveDiskCacheNow: () => saveDiskCacheNow,
   seedApiEmbeddingCacheForTests: () => seedApiEmbeddingCacheForTests
 });
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 import { createReadStream, createWriteStream, constants as fsConstants } from "fs";
 import { access, readFile as readFile2, writeFile as writeFile2, mkdir as mkdir2, rename, stat, unlink } from "fs/promises";
 import { join as join3 } from "path";
@@ -4169,7 +4333,7 @@ function cacheStatFile() {
 function payloadBytes(vector) {
   return vector.length * BYTES_PER_DIM;
 }
-function maxCachePayloadBytes() {
+function maxCachePayloadBytes3() {
   const raw = process.env.MEMORIX_EMBEDDING_CACHE_MAX_BYTES;
   if (raw) {
     const parsed = Number.parseInt(raw, 10);
@@ -4179,7 +4343,7 @@ function maxCachePayloadBytes() {
 }
 function maxEntriesForDimensions(dimensions) {
   const dim = Math.max(1, Math.floor(dimensions));
-  const byBytes = Math.floor(maxCachePayloadBytes() / (dim * BYTES_PER_DIM));
+  const byBytes = Math.floor(maxCachePayloadBytes3() / (dim * BYTES_PER_DIM));
   return Math.max(1, Math.min(MAX_CACHE_ENTRIES, byBytes));
 }
 function rememberDimensions(vector) {
@@ -4192,13 +4356,15 @@ function evictOldest() {
   if (firstKey === void 0) return;
   const old = cache3.get(firstKey);
   cache3.delete(firstKey);
-  if (old) cachePayloadBytes -= payloadBytes(old);
+  if (old) cachePayloadBytes3 -= payloadBytes(old);
 }
 function evictToFit(incomingBytes, incomingDims) {
+  if (incomingBytes > maxCachePayloadBytes3()) return false;
   const limit2 = maxEntriesForDimensions(incomingDims);
-  while (cache3.size > 0 && (cache3.size >= limit2 || cachePayloadBytes + incomingBytes > maxCachePayloadBytes())) {
+  while (cache3.size > 0 && (cache3.size >= limit2 || cachePayloadBytes3 + incomingBytes > maxCachePayloadBytes3())) {
     evictOldest();
   }
+  return true;
 }
 function isNumberArray(value) {
   return Array.isArray(value) && value.every((entry) => typeof entry === "number");
@@ -4225,12 +4391,12 @@ function cacheInsert(hash4, value, dirty) {
   const incoming = payloadBytes(value);
   const existing = cache3.get(hash4);
   if (existing) {
-    cachePayloadBytes -= payloadBytes(existing);
+    cachePayloadBytes3 -= payloadBytes(existing);
     cache3.delete(hash4);
   }
-  evictToFit(incoming, value.length || cacheDimensions || DEFAULT_ASSUMED_DIMENSIONS);
+  if (!evictToFit(incoming, value.length || cacheDimensions || DEFAULT_ASSUMED_DIMENSIONS)) return;
   cache3.set(hash4, value);
-  cachePayloadBytes += incoming;
+  cachePayloadBytes3 += incoming;
   if (dirty) diskCacheDirty2 = true;
 }
 async function readCacheStat() {
@@ -4266,7 +4432,7 @@ function cacheNamespace(config) {
   ].join("|");
 }
 function textHash2(text2, namespace) {
-  return createHash2("sha256").update(`${namespace}\0${text2}`).digest("hex").slice(0, 16);
+  return createHash3("sha256").update(`${namespace}\0${text2}`).digest("hex").slice(0, 16);
 }
 function inputIdentity(input, options = {}) {
   return JSON.stringify({
@@ -4608,7 +4774,7 @@ function getApiEmbeddingDiskCacheLoadCountForTests() {
 }
 function resetApiEmbeddingCacheForTests() {
   cache3.clear();
-  cachePayloadBytes = 0;
+  cachePayloadBytes3 = 0;
   cacheDimensions = null;
   diskCacheEntryCount = 0;
   diskCacheLoaded = false;
@@ -4619,14 +4785,14 @@ function resetApiEmbeddingCacheForTests() {
 }
 function seedApiEmbeddingCacheForTests(entries) {
   cache3.clear();
-  cachePayloadBytes = 0;
+  cachePayloadBytes3 = 0;
   cacheDimensions = null;
   for (const [key, value] of entries) cacheInsert(key, value, true);
   diskCacheLoaded = true;
   diskCacheDirty2 = true;
 }
 function getApiEmbeddingCachePayloadBytesForTests() {
-  return cachePayloadBytes;
+  return cachePayloadBytes3;
 }
 function getApiEmbeddingJsonlLineCountCallsForTests() {
   return jsonlLineCountCalls;
@@ -4800,7 +4966,7 @@ function scheduleDiskSave() {
     diskSaveTimer = null;
   }, DISK_SAVE_DEBOUNCE_MS);
 }
-function cacheSet(hash4, value) {
+function cacheSet2(hash4, value) {
   cacheInsert(hash4, value, true);
 }
 function resolveEnvEmbeddingApiKey() {
@@ -4920,7 +5086,7 @@ async function waitForRetry(waitMs, signal) {
     abortSignal.addEventListener("abort", onAbort, { once: true });
   });
 }
-var cache3, MAX_CACHE_ENTRIES, MAX_CACHE_PAYLOAD_BYTES, BYTES_PER_DIM, DEFAULT_ASSUMED_DIMENSIONS, MAX_MIGRATION_VALUE_BYTES, cachePayloadBytes, cacheDimensions, diskCacheEntryCount, diskCacheDirty2, diskSaveTimer, diskCacheLoaded, diskCacheLoadPromise, diskCacheLoadCount, jsonlLineCountCalls, MAX_INPUT_CHARS, MAX_CONCURRENCY, DISK_SAVE_DEBOUNCE_MS, DEFAULT_MAX_BATCH_SIZE, DASHSCOPE_MAX_BATCH_SIZE, MAX_RETRIES2, BASE_DELAY_MS, EmbeddingAPIError, APIEmbeddingProvider;
+var cache3, MAX_CACHE_ENTRIES, MAX_CACHE_PAYLOAD_BYTES, BYTES_PER_DIM, DEFAULT_ASSUMED_DIMENSIONS, MAX_MIGRATION_VALUE_BYTES, cachePayloadBytes3, cacheDimensions, diskCacheEntryCount, diskCacheDirty2, diskSaveTimer, diskCacheLoaded, diskCacheLoadPromise, diskCacheLoadCount, jsonlLineCountCalls, MAX_INPUT_CHARS, MAX_CONCURRENCY, DISK_SAVE_DEBOUNCE_MS, DEFAULT_MAX_BATCH_SIZE, DASHSCOPE_MAX_BATCH_SIZE, MAX_RETRIES2, BASE_DELAY_MS, EmbeddingAPIError, APIEmbeddingProvider;
 var init_api_provider = __esm({
   "src/embedding/api-provider.ts"() {
     "use strict";
@@ -4932,7 +5098,7 @@ var init_api_provider = __esm({
     BYTES_PER_DIM = 8;
     DEFAULT_ASSUMED_DIMENSIONS = 4096;
     MAX_MIGRATION_VALUE_BYTES = 16 * 1024 * 1024;
-    cachePayloadBytes = 0;
+    cachePayloadBytes3 = 0;
     cacheDimensions = null;
     diskCacheEntryCount = 0;
     diskCacheDirty2 = false;
@@ -5117,7 +5283,7 @@ var init_api_provider = __esm({
         } else {
           embedding = await apiCall();
         }
-        cacheSet(hash4, embedding);
+        cacheSet2(hash4, embedding);
         scheduleDiskSave();
         return embedding;
       }
@@ -5165,7 +5331,7 @@ var init_api_provider = __esm({
             for (const item of response.data) {
               const originalIdx = chunkIndices[item.index];
               results[originalIdx] = item.embedding;
-              cacheSet(textHash2(normalizedTexts[originalIdx], this.cacheKeyNamespace), item.embedding);
+              cacheSet2(textHash2(normalizedTexts[originalIdx], this.cacheKeyNamespace), item.embedding);
             }
           } catch (error) {
             const providerLimit = parseBatchLimit(error);
@@ -5243,7 +5409,7 @@ var init_api_provider = __esm({
           throw new Error(`Expected ${this.dimensions}d, got ${embedding.length}d; dimension mismatch`);
         }
         this.trackUsage(response);
-        cacheSet(hash4, embedding);
+        cacheSet2(hash4, embedding);
         scheduleDiskSave();
         return embedding;
       }
@@ -6164,7 +6330,7 @@ var init_timeout = __esm({
 });
 
 // src/search/semantic-index.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 import { createRequire as createRequire3 } from "module";
 import path8 from "path";
 function createSemanticIndexProfile(provider2) {
@@ -6178,7 +6344,7 @@ function stateKey(dataDir, profile) {
   return `${path8.resolve(dataDir)}::${profile.key}`;
 }
 function tableName(profile) {
-  const digest2 = createHash3("sha256").update(profile.key).digest("hex").slice(0, 20);
+  const digest2 = createHash4("sha256").update(profile.key).digest("hex").slice(0, 20);
   return `${TABLE_PREFIX}${digest2}`;
 }
 function indexRoot(dataDir) {
@@ -8218,6 +8384,7 @@ var init_secret_filter = __esm({
 // src/runtime/maintenance-jobs.ts
 var maintenance_jobs_exports = {};
 __export(maintenance_jobs_exports, {
+  DEFAULT_FAILED_HISTORY_RETENTION_MS: () => DEFAULT_FAILED_HISTORY_RETENTION_MS,
   MAINTENANCE_JOB_KINDS: () => MAINTENANCE_JOB_KINDS,
   MaintenanceJobStore: () => MaintenanceJobStore,
   MaintenanceJobWorker: () => MaintenanceJobWorker,
@@ -8267,7 +8434,7 @@ function normalizedKinds(kinds) {
 function getMaintenanceRetryDelayMs(attempts) {
   return Math.min(6e4, 1e3 * 2 ** Math.max(0, attempts - 1));
 }
-var MAINTENANCE_JOB_KINDS, DEFAULT_MAX_ATTEMPTS, DEFAULT_LEASE_MS, DEFAULT_POLL_INTERVAL_MS, MAX_ERROR_LENGTH, DEFAULT_COMPLETED_HISTORY_RETENTION_MS, MaintenanceJobStore, MaintenanceJobWorker;
+var MAINTENANCE_JOB_KINDS, DEFAULT_MAX_ATTEMPTS, DEFAULT_LEASE_MS, DEFAULT_POLL_INTERVAL_MS, MAX_ERROR_LENGTH, DEFAULT_COMPLETED_HISTORY_RETENTION_MS, DEFAULT_FAILED_HISTORY_RETENTION_MS, MaintenanceJobStore, MaintenanceJobWorker;
 var init_maintenance_jobs = __esm({
   "src/runtime/maintenance-jobs.ts"() {
     "use strict";
@@ -8294,6 +8461,7 @@ var init_maintenance_jobs = __esm({
     DEFAULT_POLL_INTERVAL_MS = 2e3;
     MAX_ERROR_LENGTH = 1e3;
     DEFAULT_COMPLETED_HISTORY_RETENTION_MS = 7 * 24 * 60 * 60 * 1e3;
+    DEFAULT_FAILED_HISTORY_RETENTION_MS = 30 * 24 * 60 * 60 * 1e3;
     MaintenanceJobStore = class {
       db;
       constructor(dataDir) {
@@ -8420,18 +8588,21 @@ var init_maintenance_jobs = __esm({
       }
       /**
        * Completed jobs are useful recent operator history, not permanent data.
-       * Failed jobs stay available for diagnosis until an operator explicitly
-       * resolves them or clears the database.
+       * Failed diagnostics are retained longer, but are still bounded so a
+       * permanently failing job kind cannot grow the database forever.
        */
       pruneCompletedHistory(options = {}) {
         const now3 = options.now ?? Date.now();
         const maxAgeMs = Number.isFinite(options.maxAgeMs) ? Math.max(0, Math.floor(options.maxAgeMs)) : DEFAULT_COMPLETED_HISTORY_RETENTION_MS;
+        const failedMaxAgeMs = Number.isFinite(options.failedMaxAgeMs) ? Math.max(0, Math.floor(options.failedMaxAgeMs)) : DEFAULT_FAILED_HISTORY_RETENTION_MS;
         const result = this.db.prepare(`
       DELETE FROM maintenance_jobs
-      WHERE status = 'completed'
+      WHERE (status = 'completed'
         AND completed_at IS NOT NULL
-        AND completed_at < ?
-    `).run(now3 - maxAgeMs);
+        AND completed_at < ?)
+        OR (status = 'failed'
+        AND updated_at < ?)
+    `).run(now3 - maxAgeMs, now3 - failedMaxAgeMs);
         return Number(result.changes ?? 0);
       }
       claimNext(options) {
@@ -8757,7 +8928,7 @@ var init_lifecycle = __esm({
 });
 
 // src/store/evidence-store.ts
-import { createHash as createHash4, randomUUID as randomUUID3 } from "crypto";
+import { createHash as createHash5, randomUUID as randomUUID3 } from "crypto";
 function safeJson(value, fallback) {
   if (typeof value !== "string" || value.length === 0) return fallback;
   try {
@@ -8791,7 +8962,7 @@ function rowToCard(row) {
   };
 }
 function observationHash(observation) {
-  return createHash4("sha256").update(JSON.stringify({
+  return createHash5("sha256").update(JSON.stringify({
     projectId: observation.projectId,
     id: observation.id,
     title: observation.title,
@@ -9251,13 +9422,13 @@ __export(workspace_exports, {
   loadKnowledgeWorkspace: () => loadKnowledgeWorkspace,
   resolveKnowledgeWorkspaceFile: () => resolveKnowledgeWorkspaceFile
 });
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 import { execFile } from "child_process";
 import { promises as fs6 } from "fs";
 import path11 from "path";
 import { promisify } from "util";
 function hash(value) {
-  return createHash5("sha256").update(value).digest("hex");
+  return createHash6("sha256").update(value).digest("hex");
 }
 function workspaceId(projectId, mode) {
   return "workspace:" + hash(projectId + ":" + mode).slice(0, 24);
@@ -10392,14 +10563,14 @@ var init_types2 = __esm({
 });
 
 // src/media/asset-store.ts
-import { createHash as createHash6, randomUUID as randomUUID6 } from "crypto";
+import { createHash as createHash7, randomUUID as randomUUID6 } from "crypto";
 import { copyFile, lstat, mkdir as mkdir3, open, readFile as readFile3, readdir, rename as rename2, rm, stat as stat2, writeFile as writeFile3 } from "fs/promises";
 import path12 from "path";
 function mediaRoot(dataDir) {
   return path12.resolve(dataDir, "media");
 }
 function projectStorageKey(projectId) {
-  return createHash6("sha256").update(projectId).digest("hex").slice(0, 16);
+  return createHash7("sha256").update(projectId).digest("hex").slice(0, 16);
 }
 function validateUnderRoot(root, candidate) {
   const resolved = path12.resolve(candidate);
@@ -10508,7 +10679,7 @@ async function importMediaBuffer(input) {
   if (input.bytes.length === 0) throw new Error("Media import rejects empty payloads");
   if (input.bytes.length > maxBytes) throw new Error(`Media payload is too large (${input.bytes.length} bytes; limit ${maxBytes})`);
   const detected = detectMedia(input.bytes.subarray(0, 32));
-  const sha256 = createHash6("sha256").update(input.bytes).digest("hex");
+  const sha256 = createHash7("sha256").update(input.bytes).digest("hex");
   return importKnownMedia({
     dataDir: input.dataDir,
     projectId: input.projectId,
@@ -10526,7 +10697,7 @@ async function readMediaAsset(dataDir, asset, maxBytes = DEFAULT_MAX_MEDIA_BYTES
   if (asset.byteSize > maxBytes) throw new Error(`Media asset exceeds read limit (${asset.byteSize} bytes; limit ${maxBytes})`);
   const bytes = await readFile3(getMediaAssetPath(dataDir, asset));
   if (bytes.length !== asset.byteSize) throw new Error(`Media asset size no longer matches metadata: ${asset.id}`);
-  const sha256 = createHash6("sha256").update(bytes).digest("hex");
+  const sha256 = createHash7("sha256").update(bytes).digest("hex");
   if (sha256 !== asset.sha256) throw new Error(`Media asset hash no longer matches metadata: ${asset.id}`);
   return bytes;
 }
@@ -69222,16 +69393,16 @@ var require_jwtaccess = __commonJS({
        * @returns A string that returns the cached key.
        */
       getCachedKey(url, scopes) {
-        let cacheKey = url;
+        let cacheKey3 = url;
         if (scopes && Array.isArray(scopes) && scopes.length) {
-          cacheKey = url ? `${url}_${scopes.join("_")}` : `${scopes.join("_")}`;
+          cacheKey3 = url ? `${url}_${scopes.join("_")}` : `${scopes.join("_")}`;
         } else if (typeof scopes === "string") {
-          cacheKey = url ? `${url}_${scopes}` : scopes;
+          cacheKey3 = url ? `${url}_${scopes}` : scopes;
         }
-        if (!cacheKey) {
+        if (!cacheKey3) {
           throw Error("Scopes or url must be provided");
         }
-        return cacheKey;
+        return cacheKey3;
       }
       /**
        * Get a non-expired access token, after refreshing if necessary.
@@ -75777,7 +75948,7 @@ var require_websocket = __commonJS({
     var http3 = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes, createHash: createHash16 } = __require("crypto");
+    var { randomBytes, createHash: createHash17 } = __require("crypto");
     var { Duplex, Readable: Readable2 } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -76445,7 +76616,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest2 = createHash16("sha1").update(key + GUID).digest("base64");
+        const digest2 = createHash17("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest2) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -76817,7 +76988,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = __require("events");
     var http3 = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash16 } = __require("crypto");
+    var { createHash: createHash17 } = __require("crypto");
     var extension3 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -77124,7 +77295,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest2 = createHash16("sha1").update(key + GUID).digest("base64");
+        const digest2 = createHash17("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -145703,9 +145874,9 @@ var init_long_term = __esm({
 });
 
 // src/codegraph/ids.ts
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 function digest(input) {
-  return createHash7("sha256").update(input).digest("hex").slice(0, 16);
+  return createHash8("sha256").update(input).digest("hex").slice(0, 16);
 }
 function normalizeCodePath(path23) {
   return path23.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+/g, "/");
@@ -146753,7 +146924,7 @@ var init_store = __esm({
 
 // src/codegraph/code-state.ts
 import { execFile as execFile2 } from "child_process";
-import { createHash as createHash8 } from "crypto";
+import { createHash as createHash9 } from "crypto";
 import { promisify as promisify3 } from "util";
 async function runGit(rootPath, args) {
   try {
@@ -146782,7 +146953,7 @@ function changedPathCount(status) {
   return count2;
 }
 function fingerprint(baseRevision, status) {
-  return createHash8("sha256").update(baseRevision ?? "").update("\0").update(status).digest("hex");
+  return createHash9("sha256").update(baseRevision ?? "").update("\0").update(status).digest("hex");
 }
 async function collectCodeStateSnapshot(input) {
   const [revision, status] = await Promise.all([
@@ -146876,12 +147047,12 @@ var init_exclude3 = __esm({
 });
 
 // src/codegraph/semantic-provider.ts
-import { createHash as createHash9 } from "crypto";
+import { createHash as createHash10 } from "crypto";
 import "fs";
 import { resolve } from "path";
 import ts from "typescript";
 function hashText(value) {
-  return createHash9("sha256").update(value).digest("hex");
+  return createHash10("sha256").update(value).digest("hex");
 }
 function canonicalPath(value) {
   const normalized = resolve(value).replace(/\\/g, "/");
@@ -147226,11 +147397,11 @@ __export(lite_provider_exports, {
   indexProjectLite: () => indexProjectLite,
   refreshProjectLite: () => refreshProjectLite
 });
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash11 } from "crypto";
 import { existsSync as existsSync12, readdirSync as readdirSync2, readFileSync as readFileSync8, statSync as statSync3 } from "fs";
 import { join as join4, relative as relative2 } from "path";
 function hashText2(text2) {
-  return createHash10("sha256").update(text2).digest("hex");
+  return createHash11("sha256").update(text2).digest("hex");
 }
 function extension2(path23) {
   const index = path23.lastIndexOf(".");
@@ -147863,7 +148034,7 @@ var claim_store_exports = {};
 __export(claim_store_exports, {
   ClaimStore: () => ClaimStore
 });
-import { createHash as createHash11, randomUUID as randomUUID12 } from "crypto";
+import { createHash as createHash12, randomUUID as randomUUID12 } from "crypto";
 function optionalText3(value) {
   return typeof value === "string" && value ? value : void 0;
 }
@@ -147916,7 +148087,7 @@ function rowToEvent3(row) {
   };
 }
 function evidenceKey(input) {
-  return createHash11("sha256").update(JSON.stringify([
+  return createHash12("sha256").update(JSON.stringify([
     input.evidenceKind,
     input.evidenceId,
     input.relation,
@@ -148114,7 +148285,7 @@ __export(claims_exports, {
   supersedeClaim: () => supersedeClaim,
   writeClaim: () => writeClaim
 });
-import { createHash as createHash12, randomUUID as randomUUID13 } from "crypto";
+import { createHash as createHash13, randomUUID as randomUUID13 } from "crypto";
 function compactText2(value, field) {
   if (typeof value !== "string") throw new Error("Claim " + field + " must be text");
   const sanitized = sanitizeCredentials(value).trim().replace(/\s+/g, " ");
@@ -148126,7 +148297,7 @@ function normalizedTerm(value) {
   return compactText2(value, "identity").toLocaleLowerCase("en-US");
 }
 function hashIdentity(parts) {
-  return createHash12("sha256").update(parts.join(String.fromCharCode(31))).digest("hex");
+  return createHash13("sha256").update(parts.join(String.fromCharCode(31))).digest("hex");
 }
 function buildClaimIdentity(input) {
   const subject = normalizedTerm(input.subject);
@@ -148367,7 +148538,7 @@ function supersedeClaim(store, input) {
   });
 }
 function hashObservation(observation) {
-  return createHash12("sha256").update(JSON.stringify([
+  return createHash13("sha256").update(JSON.stringify([
     observation.title,
     observation.narrative,
     observation.facts,
@@ -148611,11 +148782,11 @@ var init_frontmatter = __esm({
 });
 
 // src/knowledge/markdown.ts
-import { createHash as createHash13 } from "crypto";
+import { createHash as createHash14 } from "crypto";
 import { promises as fs10 } from "fs";
 import path19 from "path";
 function hashContent(content) {
-  return createHash13("sha256").update(content).digest("hex");
+  return createHash14("sha256").update(content).digest("hex");
 }
 function stringField(data, key) {
   const value = data[key];
@@ -148741,11 +148912,11 @@ __export(wiki_exports, {
   lintKnowledgeWorkspace: () => lintKnowledgeWorkspace,
   readKnowledgePage: () => readKnowledgePage
 });
-import { createHash as createHash14 } from "crypto";
+import { createHash as createHash15 } from "crypto";
 import { promises as fs11 } from "fs";
 import path20 from "path";
 function hash2(value) {
-  return createHash14("sha256").update(value).digest("hex");
+  return createHash15("sha256").update(value).digest("hex");
 }
 function now() {
   return (/* @__PURE__ */ new Date()).toISOString();
@@ -149602,11 +149773,11 @@ __export(workflows_exports, {
   syncCanonicalWorkflows: () => syncCanonicalWorkflows,
   writeCanonicalWorkflow: () => writeCanonicalWorkflow
 });
-import { createHash as createHash15 } from "crypto";
+import { createHash as createHash16 } from "crypto";
 import { promises as fs12 } from "fs";
 import path21 from "path";
 function hash3(value) {
-  return createHash15("sha256").update(value).digest("hex");
+  return createHash16("sha256").update(value).digest("hex");
 }
 function now2() {
   return (/* @__PURE__ */ new Date()).toISOString();