om-memory-system 3.0.0

package/dist/services/tags.js

@@ -0,0 +1,251 @@
+import { createHash } from "node:crypto";
+import { execFileSync } from "node:child_process";
+import { CONFIG } from "../config.js";
+import { normalize, resolve, isAbsolute, basename, dirname, join, delimiter, relative, } from "node:path";
+import { accessSync, constants, realpathSync, existsSync } from "node:fs";
+function sha256(input) {
+    return createHash("sha256").update(input).digest("hex").slice(0, 16);
+}
+/**
+ * Marker files whose presence pins a directory as the omms project root.
+ *
+ * A multi-repo workspace (e.g. a tree managed by Google `repo`, a monorepo,
+ * or any layout where several nested git repositories should share one memory
+ * store) drops this file at the workspace root. Every session started anywhere
+ * underneath then resolves onto that root instead of onto whichever physical
+ * git repository the working directory happens to live in.
+ *
+ * Unlike an environment variable or a config-file value, the marker is found
+ * by walking up from the working directory that every code path already passes
+ * in (the plugin's `ctx.directory`, the web API's `process.cwd()`), so project
+ * identity never depends on which long-lived opencode process happens to own
+ * the shared web server.
+ */
+const PROJECT_MARKERS = [
+    ".omms-project",
+    // Legacy marker from the opencode-mem days; still honoured.
+    ".opencode-mem-project",
+];
+function hasProjectMarker(dir) {
+    return PROJECT_MARKERS.some((marker) => existsSync(join(dir, marker)));
+}
+function canonicalPath(path) {
+    try {
+        return process.platform === "win32"
+            ? normalize(realpathSync.native(path))
+            : normalize(realpathSync(path));
+    }
+    catch {
+        return normalize(resolve(path));
+    }
+}
+function isPathInside(root, candidate) {
+    const rel = relative(root, candidate);
+    return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
+}
+function findUntrustedProjectRoot(directory) {
+    let current = canonicalPath(directory);
+    while (true) {
+        if (existsSync(join(current, ".git")) || hasProjectMarker(current)) {
+            return current;
+        }
+        const parent = dirname(current);
+        if (parent === current)
+            return canonicalPath(directory);
+        current = parent;
+    }
+}
+function resolveTrustedWindowsShell(untrustedRoot) {
+    const candidates = [
+        process.env.ComSpec,
+        process.env.SystemRoot ? join(process.env.SystemRoot, "System32", "cmd.exe") : undefined,
+    ];
+    for (const path of candidates) {
+        if (!path || !isAbsolute(path))
+            continue;
+        try {
+            accessSync(path, constants.X_OK);
+            const candidate = canonicalPath(path);
+            if (!isPathInside(untrustedRoot, candidate))
+                return candidate;
+        }
+        catch {
+            // ignore unreadable or untrusted PATH entries
+        }
+    }
+    return null;
+}
+function resolveTrustedGitCommand(directory) {
+    const untrustedRoot = findUntrustedProjectRoot(directory);
+    const executableNames = process.platform === "win32" ? ["git.exe", "git.cmd", "git.bat"] : ["git"];
+    for (const rawEntry of (process.env.PATH ?? "").split(delimiter)) {
+        const entry = rawEntry.trim().replace(/^"(.*)"$/, "$1");
+        if (!entry || !isAbsolute(entry))
+            continue;
+        for (const executableName of executableNames) {
+            const candidatePath = join(entry, executableName);
+            try {
+                accessSync(candidatePath, constants.X_OK);
+                const executable = canonicalPath(candidatePath);
+                if (isPathInside(untrustedRoot, executable))
+                    continue;
+                if (executableName === "git.exe" || process.platform !== "win32") {
+                    return { executable, shell: false };
+                }
+                const shell = resolveTrustedWindowsShell(untrustedRoot);
+                if (shell)
+                    return { executable, shell };
+            }
+            catch {
+                // ignore unreadable or untrusted PATH entries
+            }
+        }
+    }
+    return null;
+}
+function runGit(args, directory = process.cwd()) {
+    const gitCommand = resolveTrustedGitCommand(directory);
+    if (!gitCommand)
+        return null;
+    try {
+        const output = execFileSync(gitCommand.executable, args, {
+            encoding: "utf-8",
+            cwd: directory,
+            stdio: ["ignore", "pipe", "ignore"],
+            shell: gitCommand.shell,
+        }).trim();
+        return output || null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Walk up from `directory` (inclusive) to the filesystem root looking for the
+ * {@link PROJECT_MARKERS}. Returns the first directory that contains it, or
+ * `null` when no marker is found so the caller can fall back to git detection.
+ */
+export function findMarkerProjectRoot(directory) {
+    let dir = resolve(directory);
+    while (true) {
+        if (hasProjectMarker(dir)) {
+            return dir;
+        }
+        const parent = dirname(dir);
+        if (parent === dir) {
+            break;
+        }
+        dir = parent;
+    }
+    return null;
+}
+export function getGitEmail(directory = process.cwd()) {
+    return runGit(["config", "user.email"], directory);
+}
+export function getGitName(directory = process.cwd()) {
+    return runGit(["config", "user.name"], directory);
+}
+export function getGitRepoUrl(directory) {
+    return runGit(["config", "--get", "remote.origin.url"], directory);
+}
+export function getGitCommonDir(directory) {
+    try {
+        const commonDir = runGit(["rev-parse", "--git-common-dir"], directory);
+        if (!commonDir)
+            return null;
+        const resolved = isAbsolute(commonDir)
+            ? normalize(commonDir)
+            : normalize(resolve(directory, commonDir));
+        if (existsSync(resolved)) {
+            const canonical = process.platform === "win32" ? realpathSync.native(resolved) : realpathSync(resolved);
+            return normalize(canonical);
+        }
+        return resolved;
+    }
+    catch {
+        return null;
+    }
+}
+export function getGitTopLevel(directory) {
+    return runGit(["rev-parse", "--show-toplevel"], directory);
+}
+// Git-only fallbacks, kept separate so the marker-aware entry points below
+// can short-circuit on a marker and reuse these without re-running detection.
+function getGitProjectRoot(directory) {
+    const commonDir = getGitCommonDir(directory);
+    if (commonDir && basename(commonDir) === ".git") {
+        return dirname(commonDir);
+    }
+    const topLevel = getGitTopLevel(directory);
+    if (topLevel) {
+        return topLevel;
+    }
+    return directory;
+}
+function getGitProjectIdentity(directory) {
+    const commonDir = getGitCommonDir(directory);
+    if (commonDir) {
+        return `git-common:${commonDir}`;
+    }
+    const gitRepoUrl = getGitRepoUrl(directory);
+    if (gitRepoUrl) {
+        return `remote:${gitRepoUrl}`;
+    }
+    return `path:${normalize(directory)}`;
+}
+export function getProjectRoot(directory) {
+    return findMarkerProjectRoot(directory) ?? getGitProjectRoot(directory);
+}
+export function getProjectIdentity(directory) {
+    const markerRoot = findMarkerProjectRoot(directory);
+    return markerRoot ? `path:${markerRoot}` : getGitProjectIdentity(directory);
+}
+export function getProjectName(directory) {
+    const normalized = normalize(directory).replace(/\\/g, "/");
+    const parts = normalized.split("/").filter((p) => p && p !== ".");
+    return parts[parts.length - 1] || directory;
+}
+export function getUserTagInfo(directory = process.cwd()) {
+    const email = CONFIG.userEmailOverride || getGitEmail(directory);
+    const name = CONFIG.userNameOverride || getGitName(directory);
+    if (email) {
+        return {
+            tag: `${CONFIG.containerTagPrefix}_user_${sha256(email)}`,
+            displayName: name || email,
+            userName: name || undefined,
+            userEmail: email,
+        };
+    }
+    const fallback = name || process.env.USER || process.env.USERNAME || "anonymous";
+    return {
+        tag: `${CONFIG.containerTagPrefix}_user_${sha256(fallback)}`,
+        displayName: fallback,
+        userName: fallback,
+        userEmail: undefined,
+    };
+}
+export function getProjectTagInfo(directory) {
+    // Resolve the marker exactly once and derive root + identity from it, so a
+    // single getProjectTagInfo call never walks the ancestry more than once.
+    const markerRoot = findMarkerProjectRoot(directory);
+    const projectRoot = markerRoot ?? getGitProjectRoot(directory);
+    const projectName = getProjectName(projectRoot);
+    // When a marker pins the project root, any git remote belongs to a single
+    // nested sub-repo and would be misleading for the grouped workspace, so
+    // leave it unset.
+    const gitRepoUrl = markerRoot ? null : getGitRepoUrl(directory);
+    const projectIdentity = markerRoot ? `path:${markerRoot}` : getGitProjectIdentity(projectRoot);
+    return {
+        tag: `${CONFIG.containerTagPrefix}_project_${sha256(projectIdentity)}`,
+        displayName: projectRoot,
+        projectPath: projectRoot,
+        projectName,
+        gitRepoUrl: gitRepoUrl || undefined,
+    };
+}
+export function getTags(directory) {
+    return {
+        user: getUserTagInfo(directory),
+        project: getProjectTagInfo(directory),
+    };
+}

package/dist/services/turso/connection-manager.d.ts

@@ -0,0 +1,15 @@
+import { createClient } from "@libsql/client";
+import { TursoDb } from "./turso-db.js";
+export declare class TursoConnectionManager {
+    private readonly clientFactory;
+    private readonly connections;
+    private readonly pending;
+    private readonly closingConnections;
+    private closingPromise;
+    constructor(clientFactory?: typeof createClient);
+    getConnection(dbPath: string): Promise<TursoDb>;
+    closeConnection(dbPath: string): Promise<void>;
+    closeAll(): Promise<void>;
+    closeAllSync(): void;
+}
+export declare const tursoConnectionManager: TursoConnectionManager;

package/dist/services/turso/connection-manager.js

@@ -0,0 +1,163 @@
+import { createClient } from "@libsql/client";
+import { existsSync, mkdirSync } from "node:fs";
+import { dirname, resolve, relative, isAbsolute, sep } from "node:path";
+import { CONFIG } from "../../config.js";
+import { log } from "../logger.js";
+import { collectReleasedSqliteHandles } from "./sqlite-handle-release.js";
+import { TursoDb } from "./turso-db.js";
+function toFileUrl(dbPath) {
+    return dbPath.startsWith("file:") ? dbPath : `file:${dbPath}`;
+}
+function assertPathInsideStorage(dbPath) {
+    const storageRoot = resolve(CONFIG.storagePath);
+    const resolvedPath = resolve(dbPath);
+    const relativePath = relative(storageRoot, resolvedPath);
+    // Only treat path-segment traversal as escape (not filenames containing "..").
+    if (relativePath === ".." || relativePath.startsWith(`..${sep}`) || isAbsolute(relativePath)) {
+        throw new Error(`Refusing to open database outside storagePath: ${dbPath}`);
+    }
+}
+export class TursoConnectionManager {
+    clientFactory;
+    connections = new Map();
+    pending = new Map();
+    closingConnections = new Map();
+    closingPromise = null;
+    constructor(clientFactory = createClient) {
+        this.clientFactory = clientFactory;
+    }
+    async getConnection(dbPath) {
+        if (this.closingPromise) {
+            await this.closingPromise;
+        }
+        const closingConnection = this.closingConnections.get(dbPath);
+        if (closingConnection) {
+            await closingConnection;
+        }
+        assertPathInsideStorage(dbPath);
+        const existing = this.connections.get(dbPath);
+        if (existing) {
+            return existing;
+        }
+        const inFlight = this.pending.get(dbPath);
+        if (inFlight) {
+            return inFlight;
+        }
+        const openPromise = (async () => {
+            const dir = dirname(dbPath);
+            if (!existsSync(dir)) {
+                mkdirSync(dir, { recursive: true });
+            }
+            // One pooled handle per client: the pragmas below are per-connection,
+            // so a larger pool would mint unconfigured handles that fail with
+            // SQLITE_BUSY under cross-process contention. Writes are serialised
+            // per scope anyway (withScopeWriteLock); WAL keeps cross-process
+            // readers concurrent.
+            const client = this.clientFactory({ url: toFileUrl(dbPath), concurrency: 1 });
+            try {
+                const db = new TursoDb(client);
+                // Cross-process safety: busy_timeout makes this connection queue
+                // instead of failing with SQLITE_BUSY when another process holds the
+                // write lock, and one pooled handle per client guarantees the pragma
+                // covers every handle the client will ever use. Writers are fully
+                // serialised across processes by the per-scope cross-process write
+                // lock (see cross-process-write-lock.ts); the default rollback
+                // journal is kept because file-level migration copies rely on the
+                // main database file being current after every commit.
+                await db.execute("PRAGMA busy_timeout = 5000");
+                await db.execute("PRAGMA foreign_keys = ON");
+                this.connections.set(dbPath, db);
+                return db;
+            }
+            catch (error) {
+                try {
+                    client.close();
+                }
+                catch {
+                    // ignore close errors during cleanup
+                }
+                throw error;
+            }
+        })();
+        this.pending.set(dbPath, openPromise);
+        try {
+            return await openPromise;
+        }
+        catch (error) {
+            this.connections.delete(dbPath);
+            throw error;
+        }
+        finally {
+            this.pending.delete(dbPath);
+        }
+    }
+    async closeConnection(dbPath) {
+        if (this.closingPromise) {
+            await this.closingPromise;
+        }
+        const existingClose = this.closingConnections.get(dbPath);
+        if (existingClose) {
+            return existingClose;
+        }
+        const closePromise = Promise.resolve()
+            .then(async () => {
+            const pending = this.pending.get(dbPath);
+            if (pending) {
+                await Promise.allSettled([pending]);
+            }
+            const db = this.connections.get(dbPath);
+            if (db) {
+                try {
+                    await db.close();
+                }
+                catch (error) {
+                    log("Error closing Turso database", { path: dbPath, error: String(error) });
+                }
+                this.connections.delete(dbPath);
+            }
+            await collectReleasedSqliteHandles();
+        })
+            .finally(() => {
+            this.closingConnections.delete(dbPath);
+        });
+        this.closingConnections.set(dbPath, closePromise);
+        return closePromise;
+    }
+    async closeAll() {
+        if (this.closingPromise)
+            return this.closingPromise;
+        this.closingPromise = (async () => {
+            await Promise.allSettled([...this.pending.values(), ...this.closingConnections.values()]);
+            for (const [path, db] of this.connections) {
+                try {
+                    await db.close();
+                }
+                catch (error) {
+                    log("Error closing Turso database", { path, error: String(error) });
+                }
+            }
+            this.connections.clear();
+            this.pending.clear();
+            await collectReleasedSqliteHandles();
+        })();
+        try {
+            await this.closingPromise;
+        }
+        finally {
+            this.closingPromise = null;
+        }
+    }
+    closeAllSync() {
+        for (const [path, db] of this.connections) {
+            try {
+                db.getClient().close();
+            }
+            catch (error) {
+                log("Error closing Turso database (sync)", { path, error: String(error) });
+            }
+        }
+        this.connections.clear();
+        this.pending.clear();
+    }
+}
+export const tursoConnectionManager = new TursoConnectionManager();

package/dist/services/turso/cross-process-write-lock.d.ts

@@ -0,0 +1 @@
+export declare function withCrossProcessWriteLock<T>(scope: "user" | "project", hash: string, fn: () => Promise<T>): Promise<T>;

package/dist/services/turso/cross-process-write-lock.js

@@ -0,0 +1,89 @@
+import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { CONFIG } from "../../config.js";
+/**
+ * Cross-process advisory write lock, one per (scope, scopeHash).
+ *
+ * The in-process write queue in shard-manager only serialises writers inside
+ * one process. When two hosts (OpenCode and Pi, or two test workers) write the
+ * same project shard set concurrently, their read-modify-write sequences can
+ * interleave: COUNT()-based vector-count syncs straddle another process's
+ * insert-then-increment and double-count, and rollover decisions race. This
+ * lock serialises the whole write critical section across processes while
+ * leaving readers lock-free (WAL mode keeps them concurrent).
+ *
+ * Semantics match turso/operation-lock: PID-liveness staleness detection, so a
+ * crashed holder is cleaned up by the next acquirer. Acquisition blocks with
+ * polling and a timeout that fails loudly instead of hanging.
+ */
+const WRITE_LOCK_DIR = ".write-locks";
+const LOCK_TIMEOUT_MS = 15000;
+const LOCK_POLL_MS = 15;
+function isProcessAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function readLiveLock(path) {
+    if (!existsSync(path))
+        return null;
+    try {
+        const state = JSON.parse(readFileSync(path, "utf8"));
+        if (Number.isInteger(state.pid) && state.pid > 0 && isProcessAlive(state.pid)) {
+            return state;
+        }
+    }
+    catch {
+        // Corrupt lock files are stale; remove below.
+    }
+    try {
+        unlinkSync(path);
+    }
+    catch {
+        // Already removed by a racing acquirer — retry the acquisition.
+    }
+    return null;
+}
+function lockFilePath(scope, hash) {
+    return join(CONFIG.storagePath, WRITE_LOCK_DIR, `${scope}_${hash}.lock`);
+}
+export async function withCrossProcessWriteLock(scope, hash, fn) {
+    const dir = join(CONFIG.storagePath, WRITE_LOCK_DIR);
+    if (!existsSync(dir)) {
+        mkdirSync(dir, { recursive: true });
+    }
+    const path = lockFilePath(scope, hash);
+    const state = { pid: process.pid, timestamp: new Date().toISOString() };
+    const deadline = Date.now() + LOCK_TIMEOUT_MS;
+    for (;;) {
+        try {
+            writeFileSync(path, JSON.stringify(state), { flag: "wx" });
+            break;
+        }
+        catch {
+            const holder = readLiveLock(path);
+            if (!holder)
+                continue;
+            if (Date.now() > deadline) {
+                throw new Error(`Timed out acquiring the cross-process write lock for ${scope}/${hash}: ` +
+                    `held by pid ${holder.pid} since ${holder.timestamp}`);
+            }
+            await new Promise((resolve) => setTimeout(resolve, LOCK_POLL_MS + Math.random() * 10));
+        }
+    }
+    try {
+        return await fn();
+    }
+    finally {
+        try {
+            unlinkSync(path);
+        }
+        catch {
+            // Best effort: a stale file is cleaned up by the next acquirer.
+        }
+    }
+}

package/dist/services/turso/legacy-migrator.d.ts

@@ -0,0 +1 @@
+export declare function runLegacyTursoMigration(): Promise<void>;