superlocalmemory 3.4.21 → 3.4.23

package/src/superlocalmemory/server/routes/brain.py

@@ -1,10 +1,10 @@
 # Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
 # Licensed under AGPL-3.0-or-later - see LICENSE file
-# Part of SuperLocalMemory v3.4.21 — LLD-04 §4.1 + §3
+# Part of SuperLocalMemory v3.4.22 — LLD-04 §4.1 + §3
 
 """``/api/v3/brain`` — unified Brain endpoint (LLD-04 v2).
 
-Merges the pre-3.4.21 Patterns / Learning / Behavioral dashboard tabs
+Merges the pre-3.4.22 Patterns / Learning / Behavioral dashboard tabs
 into one auth-gated, honestly-labelled JSON payload. Every metric has
 an ``is_real`` (numeric counters) or ``is_real_ml`` (ML-derived) flag
 and points at the real table it was computed from. No metric is
@@ -24,7 +24,7 @@ Design notes (LLD-04 §7 hard rules):
 * **U2** — every metric section carries ``is_real`` or ``is_real_ml``.
 * **U3** — ``learning.phase`` never returns ``3`` without an active
   model row AND passing SHA check. Both conditions computed here.
-* **U4** — response shape must not contain the three pre-3.4.21
+* **U4** — response shape must not contain the three pre-3.4.22
   fabricated metrics (24h hit-rate, avg age on hit, skill-evolution
   row counts). A static test greps this file to verify; therefore we
   never spell those names anywhere in this module.
@@ -64,7 +64,7 @@ router = APIRouter(prefix="/api/v3", tags=["brain"])
 # LLD-03 v2 stratum space = 4 query types × 3 entity bins × 4 time buckets.
 _STRATA_TOTAL: int = 48
 
-_VERSION: str = "3.4.21"
+_VERSION: str = "3.4.23"
 
 # Banned metric names (LLD-04 U4). Kept as a tuple for grep visibility;
 # the source-level test asserts we don't accidentally reintroduce them.
@@ -246,7 +246,7 @@ def _compute_learning_status(profile_id: str,
     """Section ``learning`` — LLD-02 §4.10 phase truth + counters."""
     signals_total = _safe_count(lrn_db, "learning_signals", profile_id)
     features_total = _safe_count(lrn_db, "learning_features", profile_id)
-    # Raw count of historic pre-v3.4.21 feedback rows (the source table)
+    # Raw count of historic pre-v3.4.22 feedback rows (the source table)
     legacy_feedback_rows = _safe_count(lrn_db, "learning_feedback", profile_id)
     # Count of rows actually copied forward into learning_signals by
     # legacy_migration.migrate_legacy_feedback (signal_type='legacy_feedback').
@@ -289,7 +289,7 @@ def _compute_learning_status(profile_id: str,
         "signals_last_hour": signals_last_hour,
         "features_total": features_total,
         "feature_count_expected": FEATURE_DIM,
-        # Honest split (v3.4.21+): raw historic table count vs rows
+        # Honest split (v3.4.22+): raw historic table count vs rows
         # actually copied forward via the migrate-legacy flow.
         "legacy_feedback_rows": legacy_feedback_rows,
         "legacy_migrated_count": legacy_migrated,
@@ -356,7 +356,7 @@ def _top_query_types(
     ``query_type_od`` (features.py FEATURE_NAMES). We aggregate by the
     active one-hot slot. Missing table or zero rows → empty list.
     """
-    # E.1 (v3.4.21 perf): push the query-type classification into SQL via
+    # E.1 (v3.4.22 perf): push the query-type classification into SQL via
     # json_extract so we don't drag 10k rows' worth of JSON through Python.
     # SQLite's json1 extension treats json_extract as an ordinary scalar
     # function, so the whole aggregation becomes a single COUNT(*)
@@ -601,7 +601,7 @@ def _compute_cross_platform() -> dict:
     reports ``active: false`` with ``reason: error:<ExcName>`` rather
     than crashing the whole Brain endpoint (LLD-04 §2 — "honest, never
     fake"). An unimportable adapter means the install is missing Wave 2C
-    components, which is legitimate for an older 3.4.20 → 3.4.21 upgrade
+    components, which is legitimate for an older 3.4.20 → 3.4.22 upgrade
     mid-migration.
     """
     out: dict = {}
@@ -871,7 +871,7 @@ def _action_outcomes_count(lrn_db: LearningDatabase,
                            profile_id: str) -> int:
     """Row count in ``action_outcomes`` for ``profile_id``.
 
-    ``action_outcomes`` ships in v3.4.21 (M006). While absent, returns 0.
+    ``action_outcomes`` ships in v3.4.22 (M006). While absent, returns 0.
     """
     try:
         conn = sqlite3.connect(lrn_db.path, timeout=5.0)
@@ -963,7 +963,7 @@ async def get_brain(profile_id: str = "default") -> dict:
         "outcomes_preview": {
             "action_outcomes_rows":
                 0 if isinstance(outcomes_rows, Exception) else outcomes_rows,
-            "ships_in": "3.4.21",
+            "ships_in": "3.4.22",
         },
         # S9-defer H-22: live tile data for the Reward / Shadow /
         # Evolution-Cost dashboard tiles. Each block is a honest-empty

package/src/superlocalmemory/server/routes/prewarm.py

@@ -1,6 +1,6 @@
 # Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
 # Licensed under AGPL-3.0-or-later - see LICENSE file
-# Part of SuperLocalMemory v3.4.21 — LLD-01 §4.4 / §4.5
+# Part of SuperLocalMemory v3.4.22 — LLD-01 §4.4 / §4.5
 
 """POST /internal/prewarm — populates the context cache for a session.
 

package/src/superlocalmemory/server/security_middleware.py

@@ -33,7 +33,7 @@ class SecurityHeadersMiddleware(BaseHTTPMiddleware):
         # Enable browser XSS filter (legacy, but doesn't hurt)
         response.headers["X-XSS-Protection"] = "1; mode=block"
 
-        # Content Security Policy (v3.4.21 — vendored assets, no CDN hosts).
+        # Content Security Policy (v3.4.22 — vendored assets, no CDN hosts).
         # All Bootstrap/D3/Sigma/graphology/Inter assets ship locally under
         # /static/vendor/, so we drop every CDN host from the allow-list.
         # 'unsafe-inline' stays on script-src/style-src for the legacy inline
@@ -56,9 +56,27 @@ class SecurityHeadersMiddleware(BaseHTTPMiddleware):
         # Control referrer information leakage
         response.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"
 
-        # Prevent caching of sensitive data (for API endpoints)
-        if request.url.path.startswith("/api/"):
+        # v3.4.23: Cache-Control strategy
+        # ---------------------------------------------------------------
+        # Three classes of paths, three policies:
+        #
+        #   /api/*        -> no-store (sensitive data, never cache)
+        #   index.html    -> no-cache, must-revalidate (always revalidate)
+        #   /static/*     -> no-cache, must-revalidate (always revalidate
+        #                    with ETag; fast reloads but never stale-after-
+        #                    upgrade)
+        #
+        # Before v3.4.23 only /api/* had cache headers. Browsers then cached
+        # JS/CSS/HTML aggressively via default heuristics, and after a daemon
+        # upgrade the dashboard showed an infinite spinner because old cached
+        # JS was calling endpoints with stale response shapes. "no-cache"
+        # (not "no-store") still allows 304s on unchanged files, so reload
+        # cost stays low.
+        path = request.url.path
+        if path.startswith("/api/"):
             response.headers["Cache-Control"] = "no-store, no-cache, must-revalidate"
             response.headers["Pragma"] = "no-cache"
+        elif path == "/" or path.endswith(".html") or path.startswith("/static/"):
+            response.headers["Cache-Control"] = "no-cache, must-revalidate"
 
         return response

package/src/superlocalmemory/server/unified_daemon.py

@@ -369,7 +369,7 @@ async def lifespan(application: FastAPI):
             )
 
         # S9-DASH-02: start the outcome-queue worker so recall →
-        # pending_outcomes is actually produced. Before v3.4.21 this
+        # pending_outcomes is actually produced. Before v3.4.22 this
         # producer had zero callers and the closed-loop pipeline was
         # dark. Worker drains at 250 ms cadence; one SQLite INSERT per
         # event via EngagementRewardModel.record_recall.
@@ -457,7 +457,7 @@ async def lifespan(application: FastAPI):
     if enable_legacy:
         asyncio.create_task(_start_legacy_redirect(_DEFAULT_PORT, _LEGACY_PORT))
 
-    # V3.4.21 LLD-02: signal-worker background drainer (S8-SK-01 fix).
+    # V3.4.22 LLD-02: signal-worker background drainer (S8-SK-01 fix).
     # Without this, ``signals.enqueue`` fills a bounded queue and drops
     # silently after ~250 recalls — learning_signals never populates,
     # Phase 3 never activates, the whole Living Brain stays cold.
@@ -473,7 +473,7 @@ async def lifespan(application: FastAPI):
             logger.warning("signal_worker failed to start: %s", exc)
             application.state.signal_worker_started = False
 
-    # V3.4.21 LLD-05: cross-platform adapter sync loop
+    # V3.4.22 LLD-05: cross-platform adapter sync loop
     if os.environ.get("SLM_CROSS_PLATFORM_SYNC_DISABLED", "").lower() not in ("1", "true"):
         try:
             from superlocalmemory.cli.context_commands import build_default_adapters
@@ -482,7 +482,7 @@ async def lifespan(application: FastAPI):
         except Exception as exc:  # pragma: no cover — defensive
             logger.warning("cross-platform sync loop failed to start: %s", exc)
 
-    # V3.4.21 LLD-03: bandit reward proxy settler + retention sweep loops
+    # V3.4.22 LLD-03: bandit reward proxy settler + retention sweep loops
     if os.environ.get("SLM_BANDIT_DISABLED", "0") != "1":
         try:
             from superlocalmemory.server.bandit_loops import (
@@ -495,9 +495,20 @@ async def lifespan(application: FastAPI):
     global _start_time
     _start_time = time.monotonic()
     _last_activity = time.monotonic()
-    logger.info("Unified daemon ready on port %d (24/7 mode)" if idle_timeout <= 0
-                else "Unified daemon ready on port %d (idle timeout: %ds)",
-                _DEFAULT_PORT, idle_timeout)
+    # v3.4.23: pre-format the ready message. Previous code passed a ternary as
+    # the log format string with a fixed 2-arg tuple; when idle_timeout<=0 the
+    # chosen branch had only one %d, triggering a TypeError on every startup.
+    # Python's logging module then wrote the full stack to stderr. Because the
+    # call runs inside FastAPI's stacked merged_lifespan, each dump was ~30 KB
+    # and the error log grew to tens of MB within a day.
+    if idle_timeout <= 0:
+        _ready_msg = f"Unified daemon ready on port {_DEFAULT_PORT} (24/7 mode)"
+    else:
+        _ready_msg = (
+            f"Unified daemon ready on port {_DEFAULT_PORT} "
+            f"(idle timeout: {idle_timeout}s)"
+        )
+    logger.info(_ready_msg)
 
     yield
 
@@ -850,7 +861,18 @@ def _register_dashboard_routes(application: FastAPI) -> None:
     _data_io_mod.ws_manager = ws_manager
 
     # Root page
-    from fastapi.responses import HTMLResponse
+    from fastapi.responses import HTMLResponse, JSONResponse
+
+    # v3.4.23: /api/version — dashboard polls this to detect daemon upgrades
+    # and auto-reload stale tabs (see ui/js/core.js::checkVersionFingerprint).
+    try:
+        from superlocalmemory import __version__ as _SLM_VERSION
+    except Exception:  # pragma: no cover — defensive
+        _SLM_VERSION = "unknown"
+
+    @application.get("/api/version")
+    async def api_version():
+        return JSONResponse({"version": _SLM_VERSION})
 
     @application.get("/", response_class=HTMLResponse)
     async def root():
@@ -863,7 +885,11 @@ def _register_dashboard_routes(application: FastAPI) -> None:
                 "<p><a href='/docs'>API Documentation</a></p>"
                 "</body></html>"
             )
-        return index_path.read_text()
+        # v3.4.23: substitute version placeholder so the dashboard can detect
+        # upgrades and auto-reload. Read fresh each request (daemon uptime is
+        # days, but we want zero caching surprises during development).
+        html = index_path.read_text()
+        return html.replace("__SLM_VERSION__", _SLM_VERSION)
 
     # Startup event for event listener
     @application.on_event("startup")
@@ -1066,6 +1092,13 @@ def start_server(port: int = _DEFAULT_PORT) -> None:
     global _start_time
     import uvicorn
 
+    # v3.4.23: rotate oversized logs before anything else so both the CLI
+    # path (`slm serve`) and the LaunchAgent path (__main__) are covered.
+    try:
+        rotate_oversized_logs()
+    except Exception:
+        pass  # never block startup on log housekeeping
+
     _PID_FILE.parent.mkdir(parents=True, exist_ok=True)
     _PID_FILE.write_text(str(os.getpid()))
     _PORT_FILE.write_text(str(port))
@@ -1094,11 +1127,80 @@ def start_server(port: int = _DEFAULT_PORT) -> None:
         _PORT_FILE.unlink(missing_ok=True)
 
 
+# ---------------------------------------------------------------------------
+# v3.4.23 — Startup log rotation
+# ---------------------------------------------------------------------------
+# The LaunchAgent plist redirects stdout/stderr to daemon.log and
+# daemon-error.log. Those files are managed by launchd, not Python, so
+# Python's RotatingFileHandler cannot prune them. If any bug ever writes
+# large amounts of data to stderr (the v3.4.22 logger-format bug produced
+# ~30 KB per startup and the file grew to 69 MB), end users end up with a
+# disk-eating log they never knew existed.
+#
+# rotate_oversized_logs() is a belt-and-suspenders guard: every time the
+# daemon starts, if either log exceeds MAX_LOG_BYTES we rename the current
+# file to ".1" (keeping one rotated copy) and truncate the original so
+# launchd's open file descriptor keeps working. This is cheap, stateless,
+# and independent of whatever caused the overflow.
+# ---------------------------------------------------------------------------
+
+_MAX_LOG_BYTES = 10 * 1024 * 1024  # 10 MB
+
+
+def rotate_oversized_logs(log_dir: Optional[Path] = None,
+                          max_bytes: int = _MAX_LOG_BYTES) -> None:
+    """Rotate daemon.log and daemon-error.log at startup if oversized.
+
+    Keeps one rotated copy (.1). Safe under concurrent start attempts:
+    rename is atomic on POSIX, and truncation is idempotent.
+    """
+    log_dir = log_dir or (Path.home() / ".superlocalmemory" / "logs")
+    try:
+        log_dir.mkdir(parents=True, exist_ok=True)
+    except Exception:
+        return
+    for name in ("daemon.log", "daemon-error.log", "daemon.json.log"):
+        path = log_dir / name
+        try:
+            if not path.exists() or path.stat().st_size <= max_bytes:
+                continue
+            rotated = log_dir / f"{name}.1"
+            try:
+                if rotated.exists():
+                    rotated.unlink()
+            except Exception:
+                pass
+            try:
+                path.rename(rotated)
+            except Exception:
+                # If rename fails (e.g., file is the open stderr fd under
+                # launchd), fall back to truncation so we at least reclaim
+                # disk without breaking the redirect.
+                try:
+                    with open(path, "w"):
+                        pass
+                except Exception:
+                    pass
+                continue
+            # Re-create the original path as empty so launchd's redirect
+            # keeps appending to a fresh file.
+            try:
+                path.touch()
+            except Exception:
+                pass
+        except Exception:
+            # Log rotation must never prevent daemon startup.
+            continue
+
+
 # ---------------------------------------------------------------------------
 # CLI entry point
 # ---------------------------------------------------------------------------
 
 if __name__ == "__main__":
+    # Rotate first, then configure logging, so the first log line lands in a
+    # freshly-sized file.
+    rotate_oversized_logs()
     logging.basicConfig(level=logging.INFO, format="%(asctime)s %(message)s")
     port = _DEFAULT_PORT
     for arg in sys.argv: