nlm-memory 0.5.0 → 0.5.2

package/logs/CHANGELOG/CHANGELOG.md

@@ -1,209 +0,0 @@
-# nlm-memory-ts CHANGELOG
-
-Session-level log per session protocol. Cap: 10 entries — archive older to `CHANGELOG-YYYY.md` when exceeded.
-
-## 2026-05-29 — v0.5.0: cross-platform parity, security hardening, model picker
-
-**Cross-platform daemon + hooks** — the missing platforms now install cleanly:
-
-- **Windows hook command format.** `buildHookCommand` is platform-aware: emits `set NLM_HOOK_MODE=mode && "exec" "script"` on Windows so cmd.exe parses it correctly; `smokeTestHookCommand` dispatches via `cmd.exe /c` instead of `sh -c`. Adds `cmdQuote()` for cmd.exe double-quote escaping. Pre-fix, hook install would silently roll back on any Windows-native install because the POSIX `sh -c` smoke test failed at `spawnSync`.
-- **Linux systemd user unit.** New `~/.config/systemd/user/nlm.service` template — `Type=simple`, `Restart=on-failure`, logs to `~/.nlm/logs/daemon-{out,err}.log`. `nlm install` / `nlm uninstall` / `nlm setup` all branch into systemd on Linux (was hint-only). Detects `XDG_RUNTIME_DIR` + `systemctl --user` presence so headless servers get a `loginctl enable-linger` callout instead of a confusing error.
-- Setup wizard now branches on `process.platform` for all three OSes; macOS LaunchAgent flow unchanged.
-
-**Hook mode default flipped: shadow → live.** Shadow remains opt-in via `NLM_HOOK_MODE=shadow` in the command, but the wizard and `nlm hook install` now ship `live` so new users see pointer-block injection on the first prompt. Earlier behavior left the hook silent until the user found the toggle, which fails the recall hook's own value prop. Install message text + descriptions updated.
-
-**Security hardening** — closes three classes of exposure on top of the existing 127.0.0.1 bind:
-
-- **`~/.nlm/` perms backfill.** New `src/install/nlm-dir-perms.ts` recursively chmods dirs → `0o700` and files → `0o600`, idempotent, runs on every `nlm setup`, `nlm install`, and `nlm start`. Covers the upgrade path for installs from before v0.4.2 (when explicit chmod was added only to `writeClassifierConfig`'s output) — existing `~/.nlm/.env` and `canonical.sqlite` would otherwise stay `0o644` forever.
-- **Local-only HTTP middleware** on `/api/*`. Threat model: external network blocked by bind, but DNS rebinding, browser drive-by from cross-origin tabs, and port-forwarded clients on other machines remained. New middleware enforces (1) Host header on the allowed loopback list with or without port, (2) Origin header (when present) on the same loopback list, (3) Bearer token (`Authorization: Bearer ${NLM_MCP_TOKEN}`, timing-safe compared) when Origin is absent. `/api/health` bypasses Origin/Bearer for liveness probes but is still Host-checked. Skipped under Vitest via `!!process.env["VITEST"]` so in-process `app.request()` tests still work.
-- **Auto-generated `NLM_MCP_TOKEN`.** New `ensureMcpToken()` in `src/install/ollama.ts` generates 32 random bytes (64-char hex, 256-bit entropy) and persists to `~/.nlm/.env` if no token is set. Idempotent — re-reads file before writing to survive parallel setup runs. Called from `runSetup` and `nlm start` so existing installs upgrade without operator action.
-- **Hook auth headers.** New `src/hook/hook-auth.ts` exports `hookAuthHeaders()` that attaches Bearer when `NLM_MCP_TOKEN` is set. All three hooks (`prompt-recall-hook`, `session-start-hook`, `stop-hook`) now call `autoloadEnv()` at startup and route their fetch headers through it so they continue to reach `/api/recall` and `/api/recall/cite-event` after the gate goes on.
-
-**Classifier provider + model picker.** Wizard now asks for provider (DeepSeek cloud / Ollama local) and model:
-
-- DeepSeek path surfaces an explicit privacy callout before the API key prompt: "DeepSeek classification sends up to 30K chars of each session transcript to api.deepseek.com." Then picks from `deepseek-v4-flash` / `deepseek-v4-pro` / `deepseek-chat`.
-- Ollama path queries `localhost:11434/api/tags`, filters out embedding-only models (`nomic-embed`, `mxbai-embed`, `snowflake-arctic-embed`, `bge-*`), and shows the rest as a sorted list. Falls back to `phi4-mini:latest` with a warning if Ollama isn't reachable.
-- `writeClassifierConfig` is now overloaded: legacy `(choice, apiKey?)` signature still works; new `({choice, model, apiKey})` form persists `NLM_CLASSIFIER`, `NLM_CLASSIFIER_MODEL`, and `DEEPSEEK_API_KEY` in `~/.nlm/.env`.
-
-**Switch default-case exhaustiveness.** `runSetup`'s runtime-loop switch now has a `default: never` arm that warns on an unknown id — guards against the `multiselect<RuntimeId>` runtime cast silently producing an unmatched value.
-
-**Dry-run path fixes.** `nlm connect claude-code --dry-run` now calls `mcpConfigPath()` instead of hardcoding `~/.mcp.json`, so users with `NLM_MCP_CONFIG` set see the right path in the dry-run output.
-
-**Tests:** 601/601 passing. New tests cover the Windows hook command format and the cmd.exe smoke-test branch. The local-only middleware is exercised in-process via the existing Vitest harness (skip-gate active under `VITEST`).
-
-**Next:** publish v0.5.0 to npm + tag GitHub. Consider an `nlm hook live` / `nlm hook shadow` toggle command so existing v0.4.x installs can flip without re-running `hook install`.
-
-## 2026-05-29 — Search rebuild, Thread runtime filters, SessionDrawer nav, pagination
-
-**Search page full rewrite** — replaced a hard-capped 50-result list with a production-grade search UI:
-- Pagination: `PAGE_SIZE_OPTIONS = [10, 25, 50, 100]`, default 25, prev/next/first/last controls
-- Filter chips: runtime, status, entity (top 12 + overflow `<select>`), sort mode (relevance/recent)
-- Match snippets: 120-char window anchored on first token hit, `<mark>` highlighting, XSS-safe via HTML escape before regex
-- Field-origin live-tag: shows which field (label/entity/decision/open/summary) matched
-- Score weights: label×3, entity-exact×4, entity-substring×2, decision×2, open×2, summary×1, phrase-bonus+5
-- Sticky search header, "clear filters" button, `anyFilterActive` empty-state hint
-- SessionDrawer integrated; prev/next from paged slice
-
-**Thread page** — runtime/agent filter chips:
-- `EntityPicker` now has: search input, sort chips (most-active/least-active/a-z/z-a), pagination [24,48,96] default 48, runtime filter chips
-- `ThreadSessionList` adds runtime filter chip row (only rendered when `threadRuntimes.length > 1`)
-- Bug fixed: runtime filter reset now depends on `entity` string prop, not `thread` object reference (was resetting on sort)
-
-**SessionDrawer** — keyboard and button navigation:
-- `prevSessionId` / `nextSessionId` props; ← / → arrow key nav
-- Chevron SVG buttons in drawer header
-
-**UI/UX review loop** — spec-first pass (Opus) before developer subagent; review pass after. Caught 3 runtime bugs: hooks ordering, Vitest env detection (`VITEST=1` not `"true"`), CSS currentColor misuse on dot-pulse.
-
-**Tests:** 601/601 passing.
-
-**Next:** Supersedence visible in River + `get_session` MCP response (editable timeline moat needs to be visible in the UI).
-
-## 2026-05-29 — Workspace coverage, global DB mode, CLI connect/disconnect (9503042)
-
-**CursorAdapter expansion** — three-format coverage via prefix-based dispatch:
-- `cr_` — global `cursorDiskKV` (current, v1.x+; already shipped)
-- `crw_` — workspace `ItemTable` `composer.composerData` → `allComposers[]` (v0.43–v1.x migration artifact)
-- `crc_` — workspace `ItemTable` `chatdata` tabs (all versions)
-
-`parseSession()` routes by prefix; `workspaceStorageDir()` derived from global DB path parent-of-parent so no extra config needed. `discover()` deduplicates across global + all workspace DBs via a `seen` Set.
-
-**WindsurfAdapter expansion** — global DB agent/flow sessions (`wsg_` prefix):
-- Tries `cursorDiskKV` first (`composerData:*`, `agentData:*`, `flowData:*`); falls back to `ItemTable` LIKE query on `%agent%`/`%flow%`/`%cascade%` keys when `cursorDiskKV` absent
-- `since` filter bug fixed: `lastSendTime=0` previously matched `0 < cutoff` and was filtered out; guard changed to `ts > 0 && ts < cutoff` so zero-timestamps (unknown age) are always included
-
-**All discover() IDs now prefixed** — prefix is the routing token, not decoration. Legacy unprefixed IDs still accepted in `parseSession()` via fallthrough.
-
-**CLI commands wired** — `nlm connect cursor`, `nlm connect windsurf`, `nlm disconnect cursor`, `nlm disconnect windsurf`. Each opens the NLM `SqliteSessionStore`, creates a `SourceRegistry`, calls the appropriate install function, prints a one-line report. Supports `--dry-run` and `--db-path`/`--user-dir` overrides. `exactOptionalPropertyTypes` fix: optional CLI option values spread conditionally (`...(opts.x ? { x: opts.x } : {})`).
-
-**Tests** — 596/596 passing (up from 543). Adapter tests grew from 39 to 53. Added workspace composer (`crw_`), chat tab (`crc_`), Windsurf global DB (`wsg_`), since=0 fix, and since-filter for all three tab types.
-
-**State:** v0.4.2 on npm (no bump this session — workspace+CLI work is additive on 0.4.2). 596 tests green. Commit `9503042`.
-
-**Next:** Dedicated UI session — supersedence visible in River + `get_session` MCP response (editable timeline moat needs to be visible).
-
-## 2026-05-29 — Cursor adapter + Windsurf adapter (NocoDB #182, #183)
-
-**CursorAdapter** (`src/core/adapters/cursor.ts`)
-
-Reads Cursor AI composer sessions from `globalStorage/state.vscdb` (macOS: `~/Library/Application Support/Cursor/User/globalStorage/state.vscdb`, Linux: `~/.config/Cursor/User/globalStorage/state.vscdb`). Schema: `cursorDiskKV` key-value table. Session = one `composerData:<composerId>` entry. Messages read from inline `conversation[]` (v1.x) or `bubbleId:<composerId>:*` separate storage (v1.5+). Type `1` = user, `2` = assistant. Session ID prefix `cr_`. Env override: `NLM_CURSOR_DB_PATH`. Migration 014 adds `'cursor'` to the `sources.kind` CHECK constraint.
-
-**WindsurfAdapter** (`src/core/adapters/windsurf.ts`)
-
-Reads Windsurf (Codeium Cascade) chat sessions from workspace-scoped SQLite DBs in `<UserDir>/workspaceStorage/<hash>/state.vscdb`. Schema: `ItemTable`, key `workbench.panel.aichat.view.aichat.chatdata`, value JSON with `tabs[]`. Each tab = one session. Bubble role: `type: 'user'`→user, `type: 'ai'`→assistant; prefers `rawText` over `text`. Session ID prefix `ws_`. `pathOrUrl` = User directory (adapter discovers all workspace DBs by scanning). Env override: `NLM_WINDSURF_USER_DIR`. Migration 015 adds `'windsurf'` to the constraint.
-
-**Wiring:**
-- `from-source.ts`: `cursor` and `windsurf` cases added
-- `source-registry.ts`: `SourceKind` extended; `seedDefaults()` now seeds 8 presets (cursor + windsurf auto-enabled if their paths exist)
-- `tests/integration/source-registry.test.ts`: preset assertions updated to 8
-
-**State:** 582 tests passing (was 543, +39 new). Build clean, typecheck clean.
-
-**Next:** Training pipeline (#185, deferred until `nlm useful-scan --stats` shows >50 useful-hit-log positives). Consider bumping to v0.5.0 after `nlm connect cursor` CLI wiring.
-
-## 2026-05-29 — Credential file permissions hardening (v0.4.2)
-
-**Security fix (automated plugin review catch):** `src/install/ollama.ts` `writeClassifierConfig()` now creates `~/.nlm` with `mode: 0o700` and writes `.env` with `mode: 0o600`. Added `chmodSync` on both dir and file to repair permissions on pre-existing installations. This was flagged as HIGH by the `security-guidance@claude-code-plugins` stop hook after the manual audit and peer review had both noted the `644` file issue but the prior session ended before fixing it. Published as `nlm-memory@0.4.2`.
-
-**State:** 543 tests passing. GitHub tag `v0.4.2` pushed.
-
-**Next:** Cursor adapter (NocoDB task #182), Windsurf adapter (#183). Training pipeline (#185) deferred until >50 useful hits in `useful-hit-log.jsonl`.
-
-## 2026-05-29 — Security hardening: bind address, timing-safe auth, backup/restore gate
-
-**Changes:**
-- `src/cli/nlm.ts`: `serve()` now passes `hostname: "127.0.0.1"` — daemon no longer listens on all interfaces. Verified: `lsof` shows `127.0.0.1:3940` only.
-- `src/http/app.ts`: `/mcp` bearer token comparison replaced with `timingSafeEqual` (was `!==`).
-- `src/http/app.ts`: `/api/data/backup` and `/api/data/restore` now require `Authorization: Bearer <NLM_MCP_TOKEN>` when that env var is set. When unset (local-only use), the `127.0.0.1` bind is the guard.
-- Import: `timingSafeEqual` from `node:crypto` added.
-
-**Findings that prompted this (peer-reviewed audit 2026-05-29):**
-- MEDIUM: `0.0.0.0` binding exposed all HTTP endpoints to LAN — root finding that amplified everything else.
-- MEDIUM: backup/restore unauthenticated — full DB exfiltration from LAN with one HTTP call (peer reviewer caught this; primary auditor missed).
-- LOW: non-timing-safe bearer comparison on `/mcp`.
-
-**State:** 543 tests passing (no regressions). Daemon reloaded; bind address confirmed.
-
-**Next:** Cursor adapter (NocoDB task #182), Windsurf adapter (#183). Deferred: training pipeline (#185, needs >50 useful hits).
-
-## 2026-05-28 — Scheduler failure backoff (a5c29b0)
-
-**Bug fixed: infinite classify retry storm**
-
-Session `517ca931.jsonl` (230KB, Whtnxt Agent project) was failing DeepSeek classification every 30-min tick because no `adapter_state` row was ever written on failure — so `scanOnce` saw a "new" file every tick. The daemon log showed hundreds of `[scheduler] classifier error for cc_517ca931 — skipping` with no error detail.
-
-Migration 013 adds `failure_count INTEGER DEFAULT 0` to `adapter_state`. `recordFailed()` increments `failure_count` and writes the current `file_size`. `scanOnce` skips files whose size hasn't changed, whether clean or failed — so any stuck file stops retrying until new content arrives. When the file grows, `failure_count` resets to 0.
-
-The scheduler now logs the actual error message and a `failure N/M` counter (e.g. `error: LLM unreachable: deepseek for cc_517ca931 (failure 1/3)`). The real error was `LLM unreachable: deepseek` — now diagnosable. 2 new integration tests; 543 total passing.
-
-**State:** daemon reloaded, migration applied, first retry logged correctly. Session `517ca931` will hit ceiling at failure 3/3 and stop.
-
-**Outstanding:** npm publish v0.4.0 (needs `npm login` in terminal). Scheduler (Phase D) is already fully implemented in `nlm start` — confirm via NocoDB task #184 whether anything remains scoped there.
-
-## 2026-05-28 — Aider adapter + useful-scan cron + v0.4.0 release (ece591a, a222f44, 708f49d)
-
-Three items shipped in this session.
-
-**Aider TranscriptAdapter (ece591a)**
-
-`AiderAdapter` reads `.aider.chat.history.md` (or `$AIDER_CHAT_HISTORY_FILE`). A single file may contain multiple sessions, each opened by a `# aider chat started at YYYY-MM-DD HH:MM:SS` header. User turns are H4 headings (`#### ...`); assistant responses are plain text; blockquote lines (`> ...`) become `[tool_action: ...]` summaries. Session IDs derive from the header timestamp as `ai_YYYYMMDD_HHMMSS`. `endedAt` uses the next session's `startedAt` when available (no per-turn timestamps in markdown). Migration `012_sources_aider.sql` adds `'aider'` to the `sources.kind` CHECK constraint. `seedDefaults()` now seeds 6 presets. 21 new unit tests; 541 total pass.
-
-**useful-scan cron wiring (a222f44)**
-
-`nlm-daily-digest.sh` now calls `nlm useful-scan --days 1` before the Python stats fetch so `useful_hit_rate` is populated in the Telegram digest instead of showing "pending". Scan output goes to `logs/daily-digest/useful-scan.log`; `|| true` keeps the digest alive on scan failure. Dry-run confirmed: 161 recalls scanned, 0% useful (accurate — no `cite_session` calls yet).
-
-**v0.4.0 (708f49d)**
-
-Version bump and `git tag v0.4.0`. npm publish requires `npm login` — tag is set, publish when authenticated.
-
-**State:** build clean, 541 tests green. Outstanding: npm publish (needs `npm login`); C2 Aider and useful-scan cron are now complete.
-
-**Next:** README is rewritten. No outstanding P1s remaining. Consider: npm publish, prose-citation soft labels (deferred), or new feature work.
-
-## 2026-05-28 — HermesAgentAdapter: TranscriptAdapter for NousResearch Hermes Agent (7b9074b)
-
-`src/core/adapters/hermes-agent.ts` — reads `~/.hermes/state.db` (WAL mode, schema v11). Extracts user/assistant/tool turns; tool calls in assistant messages summarized as `[tool_use: <name>]`; tool-role messages summarized as `[tool_result: <name>: <preview>]`; system messages skipped. Label from session `title` field, fallback to first user turn. DB path overridable via `NLM_HERMES_AGENT_DB_PATH` or `HERMES_HOME`.
-
-**Migration 011** (`migrations/011_sources_hermes_agent.sql`) adds `'hermes-agent'` to the `sources.kind` CHECK constraint (same rename-recreate-copy pattern as migration 010).
-
-**Source registry:** `SourceKind` extended; `seedDefaults()` now seeds 5 presets (hermes-agent inserted between hermes and opencode, auto-enabled if state.db exists).
-
-**`from-source.ts`:** `'hermes-agent'` case added, delegates to `HermesAgentAdapter`.
-
-**Tests: 520 pass** (was 501, +19 new in `tests/unit/core/adapters/hermes-agent.test.ts`). `source-registry.test.ts` updated for 5 presets. Build clean, typecheck clean.
-
-**State:** NousResearch Hermes Agent is now fully integrated — plugin hooks (pre/post-turn, session lifecycle) from the previous session + transcript indexing from this session. End-to-end: sessions indexed in SQLite → recalled by the daemon → injected into Hermes Agent via the Python plugin.
-
-**Next:** C2 Aider adapter; B3 extract-triples improvements.
-
-## 2026-05-28 — NousResearch Hermes adapter + README rewrite
-
-**README rewrite**
-
-Lead with the three moats (cross-runtime reach, editable timeline, 97.2% R@5). Dropped "self-improving accuracy" framing. Added OpenCode to the shipped runtime list. Added `nlm connect hermes-agent` to the install table.
-
-**NousResearch Hermes Agent plugin (#165)**
-
-Python plugin for NousResearch Hermes Agent's `plugin.yaml` lifecycle hook system. Covers all 6 events the plugin system exposes.
-
-New files:
-- `plugin-hermes-agent/plugin.yaml` — manifest (`kind: memory`, 6 hooks declared)
-- `plugin-hermes-agent/__init__.py` — Python shim; each hook POSTs to the local nlm daemon (stdlib only, no PyPI deps)
-- `plugin-hermes-agent/README.md` — install guide
-
-New HTTP endpoints in the nlm daemon:
-- `POST /api/hook/hermes-agent/pre-turn` — keyword recall for `pre_llm_call`; updates memo; returns `{"context": str|null}`
-- `POST /api/hook/hermes-agent/post-turn` — prose citation detect for `post_llm_call`; logs to citation-log.jsonl
-- `POST /api/hook/hermes-agent/session-lifecycle` — clears surfaced-ID memo on end/finalize/reset
-
-New install module: `src/install/hermes-agent.ts` — `connectHermesAgent` / `disconnectHermesAgent` (copies plugin dir to `~/.hermes/plugins/nlm-memory/`, enables via `hermes plugins enable` if available).
-
-CLI: `nlm connect hermes-agent` / `nlm disconnect hermes-agent` added to `src/cli/nlm.ts`.
-
-**Tests: 501 pass** (was 488, +13 new in `tests/integration/hermes-agent-hooks.test.ts`). Build clean, typecheck clean.
-
-**State:** all three hermes-agent endpoints tested end-to-end without a TTY. Python plugin is a thin HTTP shim — no Python test harness needed.
-
-**Next:** transcript adapter for NousResearch Hermes sessions (session files stored in `~/.hermes-agent/sessions/` or equivalent); C2 Aider adapter; B3 extract-triples improvements.
-
-_Older entries archived in CHANGELOG-2026.md_

package/migrations/000_initial_schema.sql

@@ -1,174 +0,0 @@
--- NLE Memory canonical store — SQLite schema
--- Default zero-config backend. Postgres mirror lives in schema/postgres.sql (TBD).
---
--- Design principles:
---   • Sessions are immutable once written — supersedence is via edges, never via UPDATE
---   • Entity registry is mutable (canonical merges, retitles, retirements)
---   • All timestamps are ISO 8601 strings in TEXT columns (SQLite lacks a native datetime type;
---     ISO strings sort correctly and are dialect-portable to Postgres)
---   • Foreign keys enforced; ON DELETE CASCADE only on edges, never on sessions
-
-PRAGMA foreign_keys = ON;
-PRAGMA journal_mode = WAL;
-
--- ── Sessions ───────────────────────────────────────────────────────────────
-CREATE TABLE IF NOT EXISTS sessions (
-  id                  TEXT PRIMARY KEY,           -- e.g. sess_2026-05-07T14-32-CAMEL
-  runtime             TEXT NOT NULL,              -- e.g. claude-code/1.0, hermes/0.5
-  runtime_session_id  TEXT,                       -- the runtime's own session identifier
-  started_at          TEXT NOT NULL,              -- ISO 8601
-  ended_at            TEXT,                       -- ISO 8601; NULL while session is active
-  duration_min        INTEGER,                    -- computed; null while active
-  label               TEXT NOT NULL,              -- human-readable session title
-  summary             TEXT NOT NULL,              -- ~80-token classifier output
-  body                TEXT,                       -- full markdown body with inline markers
-  status              TEXT NOT NULL CHECK(status IN ('active','closed','superseded')),
-  transcript_kind     TEXT,                       -- e.g. claude-code-jsonl
-  transcript_path     TEXT,                       -- runtime-resolvable opaque pointer
-  transcript_offset   INTEGER,                    -- byte offset start
-  transcript_length   INTEGER,                    -- byte length
-  created_at          TEXT NOT NULL DEFAULT (datetime('now')),
-  updated_at          TEXT NOT NULL DEFAULT (datetime('now'))
-);
-
-CREATE INDEX IF NOT EXISTS idx_sessions_started_at ON sessions(started_at DESC);
-CREATE INDEX IF NOT EXISTS idx_sessions_status ON sessions(status);
-CREATE INDEX IF NOT EXISTS idx_sessions_runtime ON sessions(runtime);
-
--- ── Entities ───────────────────────────────────────────────────────────────
-CREATE TABLE IF NOT EXISTS entities (
-  canonical           TEXT PRIMARY KEY,           -- preferred spelling — also the primary key
-  type                TEXT NOT NULL,              -- 'candidate' until labeled. Built-in labels: project | tool | contact | service | concept. Custom labels are user-defined via the UI / `nle-daemon action label` and have no CHECK constraint.
-  status              TEXT NOT NULL CHECK(status IN ('active','dormant','retired','rejected','candidate')),
-  source              TEXT,                       -- e.g. 'property:.claude/properties/polysignal.yaml', 'auto-detected', 'user-registered'
-  notes               TEXT,                       -- freeform user notes
-  first_seen_session  TEXT REFERENCES sessions(id),
-  last_seen_session   TEXT REFERENCES sessions(id),
-  session_count       INTEGER NOT NULL DEFAULT 0,
-  created_at          TEXT NOT NULL DEFAULT (datetime('now')),
-  updated_at          TEXT NOT NULL DEFAULT (datetime('now'))
-);
-
-CREATE INDEX IF NOT EXISTS idx_entities_type ON entities(type);
-CREATE INDEX IF NOT EXISTS idx_entities_status ON entities(status);
-
--- ── Entity variants (case-insensitive normalization) ───────────────────────
-CREATE TABLE IF NOT EXISTS entity_variants (
-  variant             TEXT PRIMARY KEY,           -- raw form as it appeared
-  canonical           TEXT NOT NULL REFERENCES entities(canonical) ON DELETE CASCADE,
-  source_session_id   TEXT REFERENCES sessions(id)
-);
-
-CREATE INDEX IF NOT EXISTS idx_entity_variants_canonical ON entity_variants(canonical);
-
--- ── Session ↔ Entity (many-to-many) ───────────────────────────────────────
-CREATE TABLE IF NOT EXISTS session_entities (
-  session_id          TEXT NOT NULL REFERENCES sessions(id) ON DELETE CASCADE,
-  entity_canonical    TEXT NOT NULL REFERENCES entities(canonical),
-  PRIMARY KEY (session_id, entity_canonical)
-);
-
-CREATE INDEX IF NOT EXISTS idx_session_entities_entity ON session_entities(entity_canonical);
-
--- ── Markers (decisions / open questions) ──────────────────────────────────
--- Extracted from inline body markers. Body is canonical — these rows are a queryable cache.
-CREATE TABLE IF NOT EXISTS markers (
-  id                  INTEGER PRIMARY KEY AUTOINCREMENT,
-  session_id          TEXT NOT NULL REFERENCES sessions(id) ON DELETE CASCADE,
-  kind                TEXT NOT NULL CHECK(kind IN ('decision','open')),
-  text                TEXT NOT NULL,
-  position            INTEGER NOT NULL DEFAULT 0  -- ordering within session
-);
-
-CREATE INDEX IF NOT EXISTS idx_markers_session ON markers(session_id);
-CREATE INDEX IF NOT EXISTS idx_markers_kind ON markers(kind);
-
--- ── Supersedence + continues edges ────────────────────────────────────────
--- Edge table for non-destructive editing. A session can supersede or continue another.
--- Bidirectional lookups handled by indexes on both columns.
-CREATE TABLE IF NOT EXISTS session_edges (
-  from_session        TEXT NOT NULL REFERENCES sessions(id) ON DELETE CASCADE,
-  to_session          TEXT NOT NULL REFERENCES sessions(id) ON DELETE CASCADE,
-  kind                TEXT NOT NULL CHECK(kind IN ('supersedes','continues','branched_from','merged_from')),
-  PRIMARY KEY (from_session, to_session, kind)
-);
-
-CREATE INDEX IF NOT EXISTS idx_session_edges_from ON session_edges(from_session);
-CREATE INDEX IF NOT EXISTS idx_session_edges_to ON session_edges(to_session);
-CREATE INDEX IF NOT EXISTS idx_session_edges_kind ON session_edges(kind);
-
--- ── Full-text search over sessions ────────────────────────────────────────
--- FTS5 virtual table for label/summary/body search. Maintained via triggers.
-CREATE VIRTUAL TABLE IF NOT EXISTS sessions_fts USING fts5(
-  label, summary, body,
-  content='sessions',
-  content_rowid='rowid'
-);
-
-CREATE TRIGGER IF NOT EXISTS sessions_ai AFTER INSERT ON sessions BEGIN
-  INSERT INTO sessions_fts(rowid, label, summary, body)
-  VALUES (new.rowid, new.label, new.summary, new.body);
-END;
-
-CREATE TRIGGER IF NOT EXISTS sessions_au AFTER UPDATE ON sessions BEGIN
-  INSERT INTO sessions_fts(sessions_fts, rowid, label, summary, body)
-  VALUES('delete', old.rowid, old.label, old.summary, old.body);
-  INSERT INTO sessions_fts(rowid, label, summary, body)
-  VALUES (new.rowid, new.label, new.summary, new.body);
-END;
-
-CREATE TRIGGER IF NOT EXISTS sessions_ad AFTER DELETE ON sessions BEGIN
-  INSERT INTO sessions_fts(sessions_fts, rowid, label, summary, body)
-  VALUES('delete', old.rowid, old.label, old.summary, old.body);
-END;
-
--- ── Vector embeddings (sqlite-vec) ────────────────────────────────────────
--- Loaded as an extension at runtime: SELECT load_extension('vec0');
--- Schema declared here for reference; real CREATE happens at daemon startup
--- after the extension is loaded.
---
--- CREATE VIRTUAL TABLE session_embeddings USING vec0(
---   session_id TEXT PRIMARY KEY,
---   embedding float[768]      -- nomic-embed-text dim; configurable
--- );
-
--- ── Schema migrations tracker ─────────────────────────────────────────────
--- Applied by SQLiteStore.migrate() on daemon start. Tracks which versioned
--- migration files in daemon/migrations/ have been run on this database.
-CREATE TABLE IF NOT EXISTS schema_migrations (
-  version     INTEGER PRIMARY KEY,
-  name        TEXT NOT NULL,
-  applied_at  TEXT NOT NULL DEFAULT (datetime('now'))
-);
-
--- ── Adapter state (per-runtime offsets for resumability) ──────────────────
-CREATE TABLE IF NOT EXISTS adapter_state (
-  adapter_name        TEXT NOT NULL,              -- e.g. 'claude-code'
-  source_path         TEXT NOT NULL,              -- e.g. ~/.claude/projects/foo/abc123.jsonl
-  last_offset         INTEGER NOT NULL DEFAULT 0,
-  last_processed_at   TEXT NOT NULL DEFAULT (datetime('now')),
-  PRIMARY KEY (adapter_name, source_path)
-);
-
--- ── Actions (event-sourced action log) ────────────────────────────────────
--- Universal primitive for every interactive change: alert dismiss/snooze, entity
--- retire, link supersedes/continues, mark intentional, undo, etc. Append-only.
--- Computed tables (session_edges, entities.status) become projections of this log.
--- Same schema across web UI, MCP tool calls, CLI, future mobile/api.
-CREATE TABLE IF NOT EXISTS actions (
-  id                  TEXT PRIMARY KEY,           -- act_<iso-ts>_<short-uuid>
-  timestamp           TEXT NOT NULL,              -- ISO 8601 — when the action was taken
-  kind                TEXT NOT NULL,              -- dismiss | snooze | retire_entity | label_entity | merge_entity | link_supersedes | link_continues | resolve_open | mark_intentional | undo | sync_localstorage
-  subject_type        TEXT NOT NULL,              -- alert | entity | session | decision | open_question | action
-  subject_id          TEXT NOT NULL,              -- e.g. 'stale_Squarespace', 'sess_002', 'NocoDB'
-  payload             TEXT,                       -- JSON: action-specific data (snoozed_until, target_session_id, new_type, ...)
-  actor               TEXT NOT NULL DEFAULT 'user', -- user | agent:claude-code | agent:hermes | system
-  runtime             TEXT,                       -- web-ui | mcp:claude-code | cli | mobile-ios | api
-  reverted_by         TEXT REFERENCES actions(id), -- the action that undid this one (null = active)
-  created_at          TEXT NOT NULL DEFAULT (datetime('now'))
-);
-
-CREATE INDEX IF NOT EXISTS idx_actions_subject ON actions(subject_type, subject_id);
-CREATE INDEX IF NOT EXISTS idx_actions_kind ON actions(kind);
-CREATE INDEX IF NOT EXISTS idx_actions_timestamp ON actions(timestamp DESC);
-CREATE INDEX IF NOT EXISTS idx_actions_active ON actions(subject_type, subject_id, reverted_by) WHERE reverted_by IS NULL;

package/migrations/001_entity_type_rename.sql

@@ -1,17 +0,0 @@
--- Migration 001: rename entity types and action kind
---
--- Renames entity.type values: property→project, person→contact, external→service
--- (The CHECK constraint on entities.type was already dropped in the initial schema.)
--- Safe to re-run: CASE expression only matches old values; INSERT OR IGNORE is a no-op
--- if this migration has already been applied.
-
-UPDATE entities
-SET type = CASE
-  WHEN type = 'property' THEN 'project'
-  WHEN type = 'person'   THEN 'contact'
-  WHEN type = 'external' THEN 'service'
-  ELSE type
-END
-WHERE type IN ('property', 'person', 'external');
-
-INSERT OR IGNORE INTO schema_migrations (version, name) VALUES (1, 'entity_type_rename');

package/migrations/002_adapter_state_extend.sql

@@ -1,12 +0,0 @@
--- Migration 002: extend adapter_state with columns needed for supersede-on-resume.
---
--- file_size — bytes-on-disk at last classification (detects file growth)
--- session_id — NLE session id produced by the last classification (target for supersede)
---
--- last_offset stays for future chunking use (Phase 3+). For supersede-on-resume in
--- Phase 2, file_size carries the equivalent signal at whole-file granularity.
-
-ALTER TABLE adapter_state ADD COLUMN file_size INTEGER;
-ALTER TABLE adapter_state ADD COLUMN session_id TEXT;
-
-INSERT OR IGNORE INTO schema_migrations (version, name) VALUES (2, '002_adapter_state_extend');

package/migrations/003_session_embeddings.sql

@@ -1,11 +0,0 @@
--- Migration 003: session_embeddings virtual table via sqlite-vec.
---
--- Requires sqlite-vec loaded at connection time (handled by SQLiteStore.connect()).
--- 768 dims matches nomic-embed-text, the default embedding model.
-
-CREATE VIRTUAL TABLE IF NOT EXISTS session_embeddings USING vec0(
-  session_id TEXT PRIMARY KEY,
-  embedding  float[768]
-);
-
-INSERT OR IGNORE INTO schema_migrations (version, name) VALUES (3, '003_session_embeddings');

package/migrations/004_facts.sql

@@ -1,46 +0,0 @@
--- Migration 004: facts + fact_embeddings.
---
--- Facts are the agent-recall projection of session content: normalized
--- (subject, predicate, value) triples derived from session classifier output,
--- supersedence-aware via the tombstone pointer `superseded_by`. See
--- docs/plans/factstore-design.md.
---
--- Phase B.1 creates the tables. Writes start in Phase B.2 (classifier prompt
--- extension). The fact_embeddings vec0 table is created now so Phase B.3 can
--- light up semantic fact recall without a second migration.
-
-CREATE TABLE IF NOT EXISTS facts (
-  id                 TEXT PRIMARY KEY,
-  kind               TEXT NOT NULL CHECK (kind IN ('decision', 'open', 'attribute')),
-  subject            TEXT NOT NULL,
-  predicate          TEXT NOT NULL,
-  value              TEXT NOT NULL,
-  source_session_id  TEXT NOT NULL REFERENCES sessions(id) ON DELETE CASCADE,
-  source_quote       TEXT,
-  created_at         TEXT NOT NULL DEFAULT (datetime('now')),
-  superseded_by      TEXT REFERENCES facts(id) ON DELETE SET NULL,
-  confidence         REAL NOT NULL CHECK (confidence >= 0.0 AND confidence <= 1.0)
-);
-
--- Hot path: deterministic supersedence collision check on ingest
--- (subject, predicate) lookups against current rows only.
-CREATE INDEX IF NOT EXISTS idx_facts_subject_predicate_current
-  ON facts(subject, predicate)
-  WHERE superseded_by IS NULL;
-
--- "What do we know about X?" — subject-only browsing.
-CREATE INDEX IF NOT EXISTS idx_facts_subject_current
-  ON facts(subject)
-  WHERE superseded_by IS NULL;
-
--- Reverse lookup: which facts came from this session?
-CREATE INDEX IF NOT EXISTS idx_facts_session
-  ON facts(source_session_id);
-
--- Semantic recall index (Phase B.3). 768 dims matches nomic-embed-text.
-CREATE VIRTUAL TABLE IF NOT EXISTS fact_embeddings USING vec0(
-  fact_id    TEXT PRIMARY KEY,
-  embedding  float[768]
-);
-
-INSERT OR IGNORE INTO schema_migrations (version, name) VALUES (4, '004_facts');

package/migrations/005_sources.sql

@@ -1,31 +0,0 @@
--- Migration 005: sources registry.
---
--- Each row represents one transcript source the daemon should scan. The
--- three hardcoded adapters (claude-code / hermes / pi) become seeded rows
--- pointing at the same parse logic; future custom JSONL or webhook sources
--- live alongside them.
---
--- Parse config is a JSON blob whose shape depends on `kind`:
---   - "claude-code" / "hermes" / "pi": preset adapters. parse_config is
---     reserved but unused — paths come from path_or_url.
---   - "jsonl-generic": { sessionIdField, textField, startedAtField,
---     roleField, runtimeLabel, ... }
---   - "webhook": parse_config is empty; ingest is push-based.
---
--- See docs/plans/desktop-product.md (Phase 0).
-
-CREATE TABLE IF NOT EXISTS sources (
-  id            INTEGER PRIMARY KEY AUTOINCREMENT,
-  kind          TEXT    NOT NULL CHECK (kind IN ('claude-code', 'hermes', 'pi', 'jsonl-generic', 'webhook')),
-  name          TEXT    NOT NULL UNIQUE,
-  path_or_url   TEXT,
-  runtime_label TEXT    NOT NULL,
-  parse_config  TEXT    NOT NULL DEFAULT '{}',
-  enabled       INTEGER NOT NULL DEFAULT 1,
-  created_at    TEXT    NOT NULL DEFAULT (datetime('now')),
-  updated_at    TEXT    NOT NULL DEFAULT (datetime('now'))
-);
-
-CREATE INDEX IF NOT EXISTS idx_sources_enabled ON sources(enabled) WHERE enabled = 1;
-
-INSERT OR IGNORE INTO schema_migrations (version, name) VALUES (5, '005_sources');

package/migrations/006_providers.sql

@@ -1,33 +0,0 @@
--- Migration 006: providers registry.
---
--- Each row represents one LLM endpoint configured for classification or
--- (future) embedding. The classifier reads this table to choose a
--- provider/model at boot; the UI mutates it through /api/providers.
---
--- API key storage. v0 stores keys in the api_key column. This is fine
--- because the SQLite file already contains the user's transcripts —
--- anyone with disk access already has everything sensitive. Phase 2
--- (Tauri shell) migrates keys to the OS keychain and replaces the column
--- with a keychain reference. The API shape stays the same.
---
--- `kind` is the structural family (openai-compatible, ollama,
--- anthropic-native, deepseek). The classifier+model UI uses it to decide
--- which client class to instantiate.
---
--- See docs/plans/desktop-product.md (Phase 0 task 3).
-
-CREATE TABLE IF NOT EXISTS providers (
-  id            INTEGER PRIMARY KEY AUTOINCREMENT,
-  kind          TEXT    NOT NULL CHECK (kind IN ('deepseek', 'ollama', 'openai', 'anthropic', 'openrouter', 'openai-compatible')),
-  name          TEXT    NOT NULL UNIQUE,
-  base_url      TEXT,
-  api_key       TEXT,
-  default_model TEXT,
-  enabled       INTEGER NOT NULL DEFAULT 1,
-  created_at    TEXT    NOT NULL DEFAULT (datetime('now')),
-  updated_at    TEXT    NOT NULL DEFAULT (datetime('now'))
-);
-
-CREATE INDEX IF NOT EXISTS idx_providers_enabled ON providers(enabled) WHERE enabled = 1;
-
-INSERT OR IGNORE INTO schema_migrations (version, name) VALUES (6, '006_providers');

package/migrations/007_source_tokens.sql

@@ -1,17 +0,0 @@
--- Migration 007: webhook token on sources.
---
--- Webhook sources need a bearer token so external tools (anything that
--- pushes sessions via POST /api/ingest) can authenticate. The token is
--- stored alongside the source row so one webhook = one token = one
--- provenance label.
---
--- Storage policy mirrors providers.api_key: column in the canonical
--- SQLite for v0 (the DB file already holds the user's transcripts,
--- adding a token doesn't change the threat model). Phase 2 migrates to
--- OS keychain without changing the API shape.
---
--- See docs/plans/desktop-product.md (Phase 0 task 5).
-
-ALTER TABLE sources ADD COLUMN token TEXT;
-
-INSERT OR IGNORE INTO schema_migrations (version, name) VALUES (7, '007_source_tokens');

package/migrations/008_fts_rebuild.sql

@@ -1,9 +0,0 @@
--- One-time safety rebuild of the sessions_fts external-content FTS5 index.
--- The virtual table and its sync triggers (sessions_ai / sessions_au /
--- sessions_ad) were declared in migration 000 and have fired on every write
--- since, so the index is normally already in sync. This rebuild guarantees
--- the index matches every existing sessions row before the recall path
--- starts depending on FTS5 for keyword search. Safe and idempotent.
-INSERT INTO sessions_fts(sessions_fts) VALUES('rebuild');
-
-INSERT OR IGNORE INTO schema_migrations (version, name) VALUES (8, 'fts_rebuild');

package/migrations/009_session_embedding_chunks.sql

@@ -1,46 +0,0 @@
--- Migration 009: chunk + max-pool semantic index.
---
--- Replaces session_embeddings (one vector per session, truncated at
--- MAX_EMBED_CHARS=8000) with per-chunk vectors. Recall-time score is
--- max cosine across chunks per session.
---
--- The 2026-05-25 LongMemEval-S baseline showed 98% of gold sessions
--- exceed 8000 chars and were silently truncated. Raising the per-call
--- cap (#172) hit Ollama 500s on >50% of long inputs. Chunking sidesteps
--- both: each chunk is well under the Ollama failure cliff, and the full
--- body becomes searchable. Expected lift: semantic R@5 87.2 → >92,
--- hybrid R@5 94.6 → >96.
---
--- Schema choices:
---   * Auxiliary columns (+session_id, +chunk_idx) so KNN queries return
---     session attribution without a join.
---   * Separate session_chunk_map keyed on session_id supports
---     `DELETE FROM session_embedding_chunks WHERE chunk_id IN
---     (SELECT chunk_id FROM session_chunk_map WHERE session_id = ?)`
---     since vec0 has no documented filtering on aux columns.
---
--- session_embeddings (single-vector) is intentionally left in place:
---   * keeps rollback trivial (revert recall code, old vectors still there)
---   * avoids forcing a multi-hour re-embed at deploy time; backfill
---     populates chunks asynchronously
---   * a future cleanup migration drops it once chunks are validated
-
-CREATE VIRTUAL TABLE IF NOT EXISTS session_embedding_chunks USING vec0(
-  chunk_id   INTEGER PRIMARY KEY,
-  embedding  float[768],
-  +session_id TEXT,
-  +chunk_idx  INTEGER
-);
-
-CREATE TABLE IF NOT EXISTS session_chunk_map (
-  chunk_id   INTEGER PRIMARY KEY,
-  session_id TEXT NOT NULL,
-  chunk_idx  INTEGER NOT NULL,
-  FOREIGN KEY (session_id) REFERENCES sessions(id) ON DELETE CASCADE
-);
-
-CREATE INDEX IF NOT EXISTS idx_session_chunk_map_session
-  ON session_chunk_map(session_id);
-
-INSERT OR IGNORE INTO schema_migrations (version, name)
-  VALUES (9, '009_session_embedding_chunks');