superlocalmemory 3.6.23 → 3.7.1

package/src/superlocalmemory/mcp/tools_v33.py

@@ -17,15 +17,14 @@ Part of Qualixar | Author: Varun Pratap Bhardwaj
 from __future__ import annotations
 
 import logging
-from pathlib import Path
 from typing import Callable
 
 from mcp.types import ToolAnnotations
 
 logger = logging.getLogger(__name__)
 
-MEMORY_DIR = Path.home() / ".superlocalmemory"
-DB_PATH = MEMORY_DIR / "memory.db"
+from superlocalmemory.infra.data_root import state_path
+from superlocalmemory.mcp.shared import authorize_mcp_mutation
 
 
 def _try_daemon_post(path: str, body: dict, timeout_s: float = 60.0) -> dict | None:
@@ -62,7 +61,7 @@ def _emit_event(event_type: str, payload: dict | None = None,
     """Emit an event to the EventBus (best-effort, never raises)."""
     try:
         from superlocalmemory.infra.event_bus import EventBus
-        bus = EventBus.get_instance(str(DB_PATH))
+        bus = EventBus.get_instance(str(state_path("memory.db")))
         bus.emit(event_type, payload=payload, source_agent=source_agent,
                  source_protocol="mcp")
     except Exception:
@@ -121,14 +120,22 @@ def register_v33_tools(server, get_engine: Callable) -> None:
                     total += int(r["cnt"])
                 result = {"total": total, "transitions": 0, "dry_run_zones": zones}
             else:
+                authorization = authorize_mcp_mutation(
+                    engine,
+                    "delete",
+                    mutation_source="mcp-forgetting-cycle",
+                    profile_id=pid,
+                )
                 result = scheduler.run_decay_cycle(pid, force=True)
+                authorization.complete()
 
-            _emit_event("forgetting.cycle_complete", {
-                "profile_id": pid,
-                "dry_run": dry_run,
-                "total": result.get("total", 0),
-                "transitions": result.get("transitions", 0),
-            })
+            if not dry_run:
+                _emit_event("forgetting.cycle_complete", {
+                    "profile_id": pid,
+                    "dry_run": False,
+                    "total": result.get("total", 0),
+                    "transitions": result.get("transitions", 0),
+                })
 
             return {"success": True, "dry_run": dry_run, **result}
 
@@ -183,15 +190,23 @@ def register_v33_tools(server, get_engine: Callable) -> None:
                 facts = engine._db.get_all_facts(pid)
                 result = {"total": len(facts), "would_quantize": 0, "dry_run": True}
             else:
+                authorization = authorize_mcp_mutation(
+                    engine,
+                    "update",
+                    mutation_source="mcp-quantization-cycle",
+                    profile_id=pid,
+                )
                 result = scheduler.run_eap_cycle(pid)
+                authorization.complete()
 
-            _emit_event("eap.cycle_complete", {
-                "profile_id": pid,
-                "dry_run": dry_run,
-                "total": result.get("total", 0),
-                "downgrades": result.get("downgrades", 0),
-                "upgrades": result.get("upgrades", 0),
-            })
+            if not dry_run:
+                _emit_event("eap.cycle_complete", {
+                    "profile_id": pid,
+                    "dry_run": False,
+                    "total": result.get("total", 0),
+                    "downgrades": result.get("downgrades", 0),
+                    "upgrades": result.get("upgrades", 0),
+                })
 
             return {"success": True, "dry_run": dry_run, **result}
 
@@ -245,8 +260,15 @@ def register_v33_tools(server, get_engine: Callable) -> None:
                 CognitiveConsolidator,
             )
 
+            authorization = authorize_mcp_mutation(
+                engine,
+                "update",
+                mutation_source="mcp-cognitive-consolidation",
+                profile_id=pid,
+            )
             consolidator = CognitiveConsolidator(db=engine._db)
             result = consolidator.run_pipeline(pid)
+            authorization.complete()
 
             _emit_event("ccq.consolidation_complete", {
                 "profile_id": pid,
@@ -338,6 +360,14 @@ def register_v33_tools(server, get_engine: Callable) -> None:
             dry_run: If True, report orphans but don't kill them.
         """
         try:
+            engine = get_engine()
+            authorization = None
+            if not dry_run:
+                authorization = authorize_mcp_mutation(
+                    engine,
+                    "delete",
+                    mutation_source="mcp-process-reaper",
+                )
             from superlocalmemory.infra.process_reaper import (
                 cleanup_all_orphans,
                 ReaperConfig,
@@ -345,6 +375,8 @@ def register_v33_tools(server, get_engine: Callable) -> None:
 
             config = ReaperConfig()
             result = cleanup_all_orphans(config, dry_run=dry_run)
+            if authorization is not None:
+                authorization.complete()
 
             return {
                 "success": True,
@@ -446,6 +478,12 @@ def register_v33_tools(server, get_engine: Callable) -> None:
                 daemon_result["via"] = "daemon"
                 return daemon_result
 
+            authorization = authorize_mcp_mutation(
+                engine,
+                "update",
+                mutation_source="mcp-maintenance-cycle",
+                profile_id=pid,
+            )
             results = {}
 
             # 1. Langevin dynamics step (lifecycle evolution)
@@ -476,6 +514,7 @@ def register_v33_tools(server, get_engine: Callable) -> None:
             except Exception as exc:
                 results["behavioral"] = {"error": str(exc)}
 
+            authorization.complete()
             return {"success": True, "profile": pid, **results}
 
         except Exception as exc:

package/src/superlocalmemory/mesh/broker.py

@@ -301,6 +301,7 @@ class MeshBroker:
                 "FROM mesh_messages m "
                 "LEFT JOIN mesh_reads r ON m.id = r.message_id AND r.peer_id = ? "
                 "WHERE m.target_type='broadcast' AND m.from_peer != ? "
+                "AND r.peer_id IS NULL "
                 "AND (m.expires_at IS NULL OR m.expires_at > ?) "
                 "ORDER BY m.created_at DESC LIMIT 50",
                 (peer_id, peer_id, now),
@@ -316,6 +317,7 @@ class MeshBroker:
                     "FROM mesh_messages m "
                     "LEFT JOIN mesh_reads r ON m.id = r.message_id AND r.peer_id = ? "
                     "WHERE m.target_type='project' AND m.project_path=? AND m.from_peer != ? "
+                    "AND r.peer_id IS NULL "
                     "AND (m.expires_at IS NULL OR m.expires_at > ?) "
                     "ORDER BY m.created_at DESC LIMIT 50",
                     (peer_id, project_path, peer_id, now),

package/src/superlocalmemory/mesh/remote_sync.py

@@ -21,12 +21,52 @@ import logging
 import os
 import threading
 import time
+import ipaddress
 from typing import Any
 
 import httpx
 
 logger = logging.getLogger("superlocalmemory.mesh.remote_sync")
 
+
+def _service_ip_addresses(info: Any) -> list[str]:
+    """Return validated textual IPs from current and older Zeroconf APIs."""
+    candidates: list[Any] = []
+    parsed = getattr(info, "parsed_addresses", None)
+    if callable(parsed):
+        try:
+            candidates.extend(parsed())
+        except (OSError, TypeError, ValueError):
+            pass
+    candidates.extend(getattr(info, "addresses", None) or [])
+
+    addresses: list[str] = []
+    for candidate in candidates:
+        try:
+            address = ipaddress.ip_address(candidate)
+        except (TypeError, ValueError):
+            continue
+        # An mDNS peer must name a routable endpoint, never a wildcard or
+        # multicast destination.  Authentication is still enforced by mesh.
+        if address.is_unspecified or address.is_multicast:
+            continue
+        rendered = str(address)
+        if rendered not in addresses:
+            addresses.append(rendered)
+    return addresses
+
+
+def _peer_url(host: str, port: int) -> str:
+    """Format an IP literal safely for an HTTP authority."""
+    address = ipaddress.ip_address(host)
+    rendered = str(address)
+    if address.version == 6:
+        # RFC 6874 requires a percent sign in an IPv6 zone identifier to be
+        # escaped when the literal appears inside a URI authority.
+        rendered = rendered.replace("%", "%25")
+        rendered = f"[{rendered}]"
+    return f"http://{rendered}:{int(port)}"
+
 # Optional zeroconf for mDNS discovery
 try:
     from zeroconf import ServiceBrowser, ServiceInfo, Zeroconf
@@ -236,17 +276,15 @@ class RemoteSyncClient:
             if not ZEROCONF_AVAILABLE:
                 return
             info = zeroconf.get_service_info(service_type, name)
-            if info and info.addresses:
-                # Get first IPv4 address
-                for addr in info.addresses:
-                    if isinstance(addr, str) and "." in addr:  # IPv4
-                        port = info.port or 8765
-                        peer_url = f"http://{addr}:{port}"
-                        self._update_peer_url(addr, port)
-                        logger.info(
-                            "RemoteSyncClient: discovered SLM at %s", peer_url
-                        )
-                        return
+            if info:
+                for addr in _service_ip_addresses(info):
+                    port = info.port or 8765
+                    peer_url = _peer_url(addr, port)
+                    self._update_peer_url(addr, port)
+                    logger.info(
+                        "RemoteSyncClient: discovered SLM at %s", peer_url
+                    )
+                    return
         except Exception as e:
             logger.debug("RemoteSyncClient: mDNS add_service error: %s", e)
 
@@ -260,7 +298,7 @@ class RemoteSyncClient:
 
     def _update_peer_url(self, host: str, port: int) -> None:
         """Update peer URL from discovery."""
-        new_url = f"http://{host}:{port}"
+        new_url = _peer_url(host, port)
         if self._peer_url != new_url:
             self._peer_url = new_url
             logger.info("RemoteSyncClient: updated peer URL to %s", new_url)

package/src/superlocalmemory/optimize/cache/manager.py

@@ -79,6 +79,33 @@ class NoOpSemantic(SemanticTier):
         return False
 
 
+class _LazySemanticEmbedder:
+    """Start the canonical embedding service only after an opted-in lookup."""
+
+    def __init__(self) -> None:
+        self._lock = threading.Lock()
+        self._service = None
+
+    def __call__(self, text: str) -> list[float] | None:
+        if self._service is None:
+            with self._lock:
+                if self._service is None:
+                    from superlocalmemory.core.config import SLMConfig
+                    from superlocalmemory.core.embeddings import EmbeddingService
+
+                    self._service = EmbeddingService(SLMConfig.load().embedding)
+        return self._service.embed(text)
+
+    def close(self) -> None:
+        service = self._service
+        self._service = None
+        if service is not None:
+            try:
+                service.unload()
+            except Exception:
+                pass
+
+
 # ---------------------------------------------------------------------------
 # Metrics
 # ---------------------------------------------------------------------------
@@ -130,13 +157,23 @@ class CacheManager:
         self._metrics = CacheMetrics()
 
     @classmethod
-    def get_instance(cls) -> "CacheManager":
+    def get_instance(
+        cls,
+        *,
+        optimize_config: Any | None = None,
+        semantic_embedder: Callable[[str], list[float] | None] | None = None,
+    ) -> "CacheManager":
         if cls._instance is None:
             with cls._instance_lock:
                 if cls._instance is None:
                     from superlocalmemory.optimize.storage.db import CacheDB as _CacheDB
                     _db = _CacheDB.get_default()
                     cls._instance = cls(db=_db)
+        if optimize_config is not None:
+            cls._instance.configure_semantic(
+                optimize_config,
+                embedder=semantic_embedder,
+            )
         return cls._instance
 
     @classmethod
@@ -149,6 +186,7 @@ class CacheManager:
         """Reset the singleton (testing only)."""
         with cls._instance_lock:
             if cls._instance is not None:
+                cls._instance._close_semantic()
                 try:
                     cls._instance._db.close()  # type: ignore[attr-defined]
                 except Exception:
@@ -416,8 +454,46 @@ class CacheManager:
         MetricsCollector.get_instance().on_miss()
 
     def set_semantic_tier(self, tier: SemanticTier) -> None:
+        self._close_semantic()
         self._semantic = tier
 
+    def _close_semantic(self) -> None:
+        close = getattr(self._semantic, "close", None)
+        if callable(close):
+            try:
+                close()
+            except Exception:
+                pass
+
+    def configure_semantic(
+        self,
+        optimize_config: Any,
+        *,
+        embedder: Callable[[str], list[float] | None] | None = None,
+    ) -> None:
+        """Wire or disable the real semantic tier from live proxy config."""
+        enabled = bool(getattr(optimize_config, "semantic_enabled", False))
+        if not enabled:
+            if not isinstance(self._semantic, NoOpSemantic):
+                self.set_semantic_tier(NoOpSemantic())
+            return
+
+        from superlocalmemory.optimize.cache.semantic import VCacheSemantic
+
+        desired_embedder = embedder or _LazySemanticEmbedder()
+        current = self._semantic
+        if (
+            isinstance(current, VCacheSemantic)
+            and current._config == optimize_config
+            and (embedder is None or current._embedder is embedder)
+        ):
+            return
+        self.set_semantic_tier(VCacheSemantic(
+            db=self._db,
+            config=optimize_config,
+            embedder=desired_embedder,
+        ))
+
     # ---- core request path ----
 
     def get_or_call(

package/src/superlocalmemory/optimize/cache/semantic.py

@@ -22,7 +22,7 @@ import logging
 import random
 import threading
 import time
-from typing import TYPE_CHECKING, Any
+from typing import TYPE_CHECKING, Any, Callable
 
 import numpy as np
 
@@ -77,9 +77,12 @@ class VCacheSemantic(SemanticTier):
         self,
         db: "CacheDB",
         config: "OptimizeConfig",
+        *,
+        embedder: Callable[[str], list[float] | np.ndarray | None] | None = None,
     ) -> None:
         self._db = db
         self._config = config
+        self._embedder = embedder
         # TODO(v3.7): when entry_count > 10_000, promote to sqlite-vec. Config flag: semantic_use_vec.
 
         self._boundary_store = BoundaryStore(
@@ -134,7 +137,13 @@ class VCacheSemantic(SemanticTier):
             return None
         try:
             if embed is None:
-                return None
+                if self._embedder is None:
+                    return None
+                messages = _extract_messages(req)
+                system = _extract_system(req)
+                embed = self._embedder(self._build_query_text(messages, system))
+                if embed is None:
+                    return None
             vec = np.asarray(embed, dtype=np.float32)
             if vec.shape[0] != _EMBED_DIM:
                 logger.debug(
@@ -190,7 +199,13 @@ class VCacheSemantic(SemanticTier):
             return
         try:
             if embed is None:
-                return
+                if self._embedder is None:
+                    return
+                messages = _extract_messages(req)
+                system = _extract_system(req)
+                embed = self._embedder(self._build_query_text(messages, system))
+                if embed is None:
+                    return
             messages = _extract_messages(req)
             system = _extract_system(req)
             query_text = self._build_query_text(messages, system)
@@ -247,6 +262,11 @@ class VCacheSemantic(SemanticTier):
                 tenant_id, exc, exc_info=True,
             )
 
+    def close(self) -> None:
+        close = getattr(self._embedder, "close", None)
+        if callable(close):
+            close()
+
     # ------------------------------------------------------------------
     # Internal lookup
     # ------------------------------------------------------------------

package/src/superlocalmemory/optimize/compress/ccr.py

@@ -17,6 +17,10 @@ from __future__ import annotations
 import logging
 import re
 import threading
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from superlocalmemory.optimize.storage.db import CacheDB
 
 logger = logging.getLogger("slm.optimize.compress.ccr")
 

package/src/superlocalmemory/optimize/compress/router.py

@@ -18,11 +18,16 @@ import json
 import logging
 import threading
 from dataclasses import dataclass
-from typing import Any
+from typing import TYPE_CHECKING, Any
 
 from superlocalmemory.optimize.proxy.lifecycle import ProxyRequest, CompressHook
 from superlocalmemory.optimize.config.store import ConfigStore
 
+if TYPE_CHECKING:
+    from superlocalmemory.optimize.compress.align import CacheAligner
+    from superlocalmemory.optimize.compress.ccr import CCRStore
+    from superlocalmemory.optimize.compress.prose_llmlingua import LLMLinguaCompressor
+
 logger = logging.getLogger("slm.optimize.compress.router")
 
 _MIN_CHARS_FOR_COMPRESSION: int = 500

package/src/superlocalmemory/optimize/config/__init__.py

@@ -6,8 +6,13 @@ module. They NEVER construct ConfigStore themselves or read optimize.json direct
 
 from __future__ import annotations
 
+from typing import TYPE_CHECKING
+
 from superlocalmemory.optimize.config.schema import OptimizeConfig
 
+if TYPE_CHECKING:
+    from superlocalmemory.optimize.config.store import ConfigStore
+
 _store: "ConfigStore | None" = None
 
 

package/src/superlocalmemory/optimize/config/store.py

@@ -17,16 +17,16 @@ import json
 import logging
 import os
 import threading
-import time
 from pathlib import Path
 from typing import Any, Callable
 
-from superlocalmemory.optimize.config.schema import OptimizeConfig
+from superlocalmemory.infra.data_root import DynamicStatePath
 from superlocalmemory.optimize.config.defaults import DEFAULT_OPTIMIZE_CONFIG
+from superlocalmemory.optimize.config.schema import OptimizeConfig
 
 logger = logging.getLogger(__name__)
 
-_DEFAULT_CONFIG_PATH: Path = Path.home() / ".superlocalmemory" / "optimize.json"
+_DEFAULT_CONFIG_PATH = DynamicStatePath("optimize.json")
 _POLL_INTERVAL_SECONDS: float = 2.0
 
 
@@ -38,7 +38,9 @@ class ConfigStore:
         config_path: Path | None = None,
         poll_interval: float = _POLL_INTERVAL_SECONDS,
     ) -> None:
-        self._config_path = Path(config_path) if config_path else _DEFAULT_CONFIG_PATH
+        self._config_path = Path(
+            config_path if config_path is not None else _DEFAULT_CONFIG_PATH
+        )
         self._poll_interval_seconds = float(poll_interval)
         self._lock = threading.RLock()
         self._change_callbacks: list[Callable[[OptimizeConfig], None]] = []

package/src/superlocalmemory/optimize/proxy/_helpers.py

@@ -7,6 +7,7 @@ import inspect
 import json
 import logging
 from typing import Any, AsyncIterator, Callable
+from weakref import WeakKeyDictionary
 
 import httpx
 from fastapi.requests import Request
@@ -24,8 +25,10 @@ _get_running_loop = asyncio.get_running_loop
 logger = logging.getLogger("slm.optimize.proxy.helpers")
 
 # Per-callable cache of "does this hook method accept a tenant_id kwarg?".
-# Keyed by id() of the bound method's __func__ so it is stable per hook class.
-_HOOK_TENANT_SUPPORT: dict[int, bool] = {}
+# Keep the callable itself as the key. Integer id() values can be reused after
+# a hook class is collected, which can apply a stale legacy signature result
+# to a new tenant-aware hook and silently drop tenant isolation.
+_HOOK_TENANT_SUPPORT: WeakKeyDictionary[object, bool] = WeakKeyDictionary()
 
 
 def _accepts_tenant_id(fn: Callable) -> bool:
@@ -42,8 +45,12 @@ def _accepts_tenant_id(fn: Callable) -> bool:
     raises fails open to a cache MISS, never the shared namespace.
     """
     target = getattr(fn, "__func__", fn)
-    key = id(target)
-    cached = _HOOK_TENANT_SUPPORT.get(key)
+    try:
+        cached = _HOOK_TENANT_SUPPORT.get(target)
+    except TypeError:
+        # Some extension callables cannot be weak-referenced. Inspect them on
+        # every use instead of falling back to an unsafe integer identity.
+        cached = None
     if cached is None:
         try:
             params = inspect.signature(fn).parameters
@@ -53,7 +60,10 @@ def _accepts_tenant_id(fn: Callable) -> bool:
         except (ValueError, TypeError):
             # Builtins / C callables without a signature — assume legacy.
             cached = False
-        _HOOK_TENANT_SUPPORT[key] = cached
+        try:
+            _HOOK_TENANT_SUPPORT[target] = cached
+        except TypeError:
+            pass
     return cached
 
 # SEC-M-02 (CWE-400): reject oversized bodies to prevent compression-bomb DoS.

package/src/superlocalmemory/optimize/proxy/capture.py

@@ -28,9 +28,10 @@ import threading
 from pathlib import Path
 from typing import Any
 
+from superlocalmemory.infra.data_root import state_path
+
 logger = logging.getLogger("slm.optimize.proxy.capture")
 
-_CAPTURE_DIRNAME = ".superlocalmemory"
 _CAPTURE_FILENAME = "optimize_capture.jsonl"
 _CAPTURE_ENV = "SLM_OPTIMIZE_CAPTURE"
 _TRUTHY = frozenset({"1", "true", "yes", "on"})
@@ -51,7 +52,7 @@ def capture_enabled() -> bool:
 
 
 def _capture_path() -> Path:
-    return Path.home() / _CAPTURE_DIRNAME / _CAPTURE_FILENAME
+    return state_path(_CAPTURE_FILENAME)
 
 
 class ShadowCapture:

package/src/superlocalmemory/optimize/proxy/server.py

@@ -17,7 +17,7 @@ from superlocalmemory.optimize.proxy.lifecycle import HookChain
 
 logger = logging.getLogger("slm.optimize.proxy")
 
-_PROXY_VERSION = "3.6.3"
+_PROXY_VERSION = "3.7.1"
 _REQUEST_TIMEOUT_S = 300.0
 _CONNECT_TIMEOUT_S = 10.0
 _MAX_CONNECTIONS = 100
@@ -178,7 +178,7 @@ def _load_hooks(config: OptimizeConfig) -> HookChain:
     if config.cache_enabled:
         try:
             from superlocalmemory.optimize.cache.manager import CacheManager
-            cache_hook = CacheManager.get_instance()
+            cache_hook = CacheManager.get_instance(optimize_config=config)
         except Exception as exc:
             logger.warning(
                 "cache hook load failed (proxy continues without cache): %s", exc

package/src/superlocalmemory/optimize/storage/db.py

@@ -41,7 +41,6 @@ import os
 import platform
 import re
 import sqlite3
-import struct
 import time
 import uuid
 import zlib
@@ -50,12 +49,13 @@ from pathlib import Path
 from typing import Any
 
 from cryptography.exceptions import InvalidTag
+from cryptography.hazmat.primitives import hashes
 from cryptography.hazmat.primitives.ciphers.aead import AESGCM
 from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
-from cryptography.hazmat.primitives import hashes
 
-from superlocalmemory.storage.database import DatabaseManager
+from superlocalmemory.infra.data_root import DynamicStatePath, state_path
 from superlocalmemory.optimize.storage import schema as _schema
+from superlocalmemory.storage.database import DatabaseManager
 
 logger = logging.getLogger(__name__)
 
@@ -89,7 +89,7 @@ MID_FILENAME: str = ".llmcache_key"
 SALT_PREFIX: str = "salt:"
 
 # C-06: persisted AES key — survives machine-id changes after first run
-_KEY_FILE: Path = Path.home() / LLMCACHE_DIRNAME / "opt-key.bin"
+_KEY_FILE = DynamicStatePath("opt-key.bin")
 
 _FORBIDDEN_MEMORY_TABLES: frozenset[str] = frozenset({
     "memories", "atomic_facts", "profiles", "canonical_entities",
@@ -199,7 +199,7 @@ class CacheDB:
 
     def __init__(self, db_path: Path | None = None) -> None:
         if db_path is None:
-            db_path = Path.home() / LLMCACHE_DIRNAME / LLMCACHE_DBNAME
+            db_path = state_path(LLMCACHE_DBNAME)
         self._db_path = Path(db_path)
         self._db_path.parent.mkdir(parents=True, exist_ok=True)
         # If the file exists but is not a valid SQLite database (e.g. user
@@ -290,7 +290,6 @@ class CacheDB:
         mid: str | None = None
         if system == "Darwin":
             try:
-                import plistlib
                 import subprocess
                 out = subprocess.run(
                     ["ioreg", "-rd1", "-c", "IOPlatformExpertDevice"],
@@ -311,7 +310,7 @@ class CacheDB:
             except OSError:
                 mid = None
         if not mid:
-            mid_file = Path.home() / LLMCACHE_DIRNAME / MID_FILENAME
+            mid_file = state_path(MID_FILENAME)
             if mid_file.exists():
                 try:
                     mid = mid_file.read_text(encoding="utf-8").strip()
@@ -335,9 +334,10 @@ class CacheDB:
         so changing the underlying machine-id string cannot invalidate existing
         cache entries.
         """
+        key_file = Path(_KEY_FILE)
         try:
-            if _KEY_FILE.exists():
-                key = _KEY_FILE.read_bytes()
+            if key_file.exists():
+                key = key_file.read_bytes()
                 if len(key) == 32:
                     return key
         except Exception as exc:
@@ -347,9 +347,9 @@ class CacheDB:
         machine_id = self._get_machine_id()
         key = self._derive_aes_key(machine_id, salt)
         try:
-            _KEY_FILE.parent.mkdir(parents=True, exist_ok=True)
-            _KEY_FILE.write_bytes(key)
-            os.chmod(_KEY_FILE, 0o600)
+            key_file.parent.mkdir(parents=True, exist_ok=True)
+            key_file.write_bytes(key)
+            os.chmod(key_file, 0o600)
         except Exception as exc:
             logger.warning("CacheDB: could not persist AES key (fail-open): %s", exc)
         return key