superlocalmemory 3.6.9 → 3.6.11

package/src/superlocalmemory/optimize/proxy/capture.py

@@ -0,0 +1,243 @@
+"""capture.py — Lossless shadow-capture of real proxy traffic (v3.6.10, plan §7).
+
+Purpose: build a dogfood corpus of real {request, response, model, tokens,
+content_type} pairs so the cache + compression benchmark (benchmarks/optimize/)
+can be replayed against authentic traffic instead of only synthetic prompts.
+
+Activation: set ``SLM_OPTIMIZE_CAPTURE=1`` in the daemon's environment. When on:
+  * the proxy runs in PURE PASSTHROUGH — cache + compression hooks are disabled
+    at load time (see server._load_hooks), so capture never observes a mutated
+    request or a cache hit; every line is a genuine upstream exchange.
+  * each completed exchange is appended as one JSON line to
+    ``~/.superlocalmemory/optimize_capture.jsonl`` (0600, gitignored).
+
+ISOLATION GUARANTEE: this module writes ONLY to optimize_capture.jsonl. It never
+opens memory.db, llmcache.db, or any SLM memory store. (Plan §9 hard rule.)
+
+FAIL-OPEN: a capture failure (disk full, permission, encode error) is logged and
+swallowed — it MUST NOT break the proxied request the user is waiting on.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import logging
+import os
+import threading
+from pathlib import Path
+from typing import Any
+
+logger = logging.getLogger("slm.optimize.proxy.capture")
+
+_CAPTURE_DIRNAME = ".superlocalmemory"
+_CAPTURE_FILENAME = "optimize_capture.jsonl"
+_CAPTURE_ENV = "SLM_OPTIMIZE_CAPTURE"
+_TRUTHY = frozenset({"1", "true", "yes", "on"})
+
+# Cap a single captured body so a pathological 10 MB request can't bloat the
+# corpus line beyond what the replay harness will read back. Bodies above this
+# are recorded truncated with a marker (capture is for benchmarking, not audit).
+_MAX_CAPTURE_BODY_BYTES = 1 * 1024 * 1024  # 1 MB per side
+
+# Providers whose response bodies follow the OpenAI usage schema
+# ({"usage": {"prompt_tokens", "completion_tokens"}, "model"}).
+_OPENAI_FORMAT_PROVIDERS = frozenset({"openai", "gemini-openai-compat"})
+
+
+def capture_enabled() -> bool:
+    """True iff ``SLM_OPTIMIZE_CAPTURE`` is set to a truthy value."""
+    return os.environ.get(_CAPTURE_ENV, "").strip().lower() in _TRUTHY
+
+
+def _capture_path() -> Path:
+    return Path.home() / _CAPTURE_DIRNAME / _CAPTURE_FILENAME
+
+
+class ShadowCapture:
+    """Thread-safe append-only JSONL writer for proxy exchanges (singleton)."""
+
+    _instance: "ShadowCapture | None" = None
+    _instance_lock = threading.Lock()
+
+    def __init__(self, path: Path | None = None) -> None:
+        self._path = path or _capture_path()
+        self._write_lock = threading.Lock()
+        self._count = 0
+
+    @classmethod
+    def get_instance(cls) -> "ShadowCapture":
+        # Double-checked locking: cheap fast-path after first construction.
+        if cls._instance is None:
+            with cls._instance_lock:
+                if cls._instance is None:
+                    cls._instance = cls()
+        return cls._instance
+
+    @classmethod
+    def reset_instance(cls) -> None:
+        """Test hook — drop the singleton so a fresh path can be injected."""
+        with cls._instance_lock:
+            cls._instance = None
+
+    @property
+    def path(self) -> Path:
+        return self._path
+
+    @property
+    def count(self) -> int:
+        return self._count
+
+    def record(self, entry: dict[str, Any]) -> bool:
+        """Append one capture entry as a JSON line. Returns True on success.
+
+        Fail-open: any error is logged and False is returned; never raised.
+
+        Security: opens with a single ``os.open`` carrying ``O_CREAT |
+        O_APPEND | O_NOFOLLOW`` and mode ``0o600`` on EVERY write. O_NOFOLLOW
+        refuses a symlink pre-placed at the path (symlink-append attack), and
+        the unconditional 0600-on-create removes the stat/exists TOCTOU that
+        could otherwise drop the file to the process umask.
+        """
+        try:
+            line = json.dumps(entry, ensure_ascii=False, separators=(",", ":"))
+        except (TypeError, ValueError) as exc:
+            logger.warning("capture: entry not JSON-serialisable, dropped: %r", exc)
+            return False
+
+        try:
+            with self._write_lock:
+                self._path.parent.mkdir(parents=True, exist_ok=True)
+                flags = os.O_CREAT | os.O_WRONLY | os.O_APPEND | getattr(os, "O_NOFOLLOW", 0)
+                fd = os.open(self._path, flags, 0o600)
+                with os.fdopen(fd, "a", encoding="utf-8") as fh:
+                    fh.write(line + "\n")
+                self._count += 1
+            return True
+        except OSError as exc:
+            # PermissionError / symlink-refusal (ELOOP) are security-relevant —
+            # surface the errno but still fail open so the request is never blocked.
+            logger.warning("capture: write failed (fail-open): %r", exc)
+            return False
+
+
+def _truncate(raw: bytes) -> tuple[str, bool]:
+    """Decode bytes for storage; truncate beyond the per-side cap."""
+    truncated = len(raw) > _MAX_CAPTURE_BODY_BYTES
+    head = raw[:_MAX_CAPTURE_BODY_BYTES] if truncated else raw
+    return head.decode("utf-8", errors="replace"), truncated
+
+
+def build_entry(
+    *,
+    provider: str,
+    model: str,
+    request_body: bytes,
+    response_body: bytes,
+    content_type: str,
+    input_tokens: int,
+    output_tokens: int,
+    status_code: int,
+    stream: bool,
+) -> dict[str, Any]:
+    """Construct a capture entry dict from a completed exchange.
+
+    No timestamp is stamped here (Date.now is intentionally avoided in some
+    runtimes); the replay harness keys on content, not time, and the file's own
+    line order preserves arrival sequence.
+    """
+    req_str, req_trunc = _truncate(request_body)
+    resp_str, resp_trunc = _truncate(response_body)
+    return {
+        "provider": provider,
+        "model": model,
+        "content_type": content_type,
+        "stream": stream,
+        "status_code": status_code,
+        "input_tokens": int(input_tokens),
+        "output_tokens": int(output_tokens),
+        "request": req_str,
+        "response": resp_str,
+        "request_truncated": req_trunc,
+        "response_truncated": resp_trunc,
+    }
+
+
+def extract_usage(provider: str, body: bytes | None) -> tuple[int, int, str]:
+    """Best-effort (input_tokens, output_tokens, model) from a provider JSON body.
+
+    Works on the normalised JSON the SSE parsers emit AND on non-streaming
+    upstream JSON. Returns (0, 0, "") when the body is missing/unparseable —
+    capture must never fail because usage couldn't be read.
+    """
+    if not body:
+        return 0, 0, ""
+    try:
+        data = json.loads(body)
+    except (json.JSONDecodeError, ValueError, TypeError):
+        return 0, 0, ""
+    if not isinstance(data, dict):
+        return 0, 0, ""
+
+    if provider == "gemini":
+        usage = data.get("usageMetadata") or {}
+        return (
+            int(usage.get("promptTokenCount", 0) or 0),
+            int(usage.get("candidatesTokenCount", 0) or 0),
+            str(data.get("modelVersion", "") or ""),
+        )
+
+    usage = data.get("usage") or {}
+    if provider == "anthropic":
+        return (
+            int(usage.get("input_tokens", 0) or 0),
+            int(usage.get("output_tokens", 0) or 0),
+            str(data.get("model", "") or ""),
+        )
+    # OpenAI-format providers (explicit allowlist so a future provider variant
+    # is not silently parsed with the wrong schema — it warns + returns zeros).
+    if provider not in _OPENAI_FORMAT_PROVIDERS:
+        logger.warning(
+            "capture.extract_usage: unknown provider %r — recording zero tokens", provider
+        )
+        return 0, 0, str(data.get("model", "") or "")
+    return (
+        int(usage.get("prompt_tokens", 0) or 0),
+        int(usage.get("completion_tokens", 0) or 0),
+        str(data.get("model", "") or ""),
+    )
+
+
+def record_exchange(
+    *,
+    provider: str,
+    model: str,
+    request_body: bytes,
+    response_body: bytes,
+    content_type: str = "application/json",
+    input_tokens: int = 0,
+    output_tokens: int = 0,
+    status_code: int = 200,
+    stream: bool = False,
+) -> bool:
+    """Build + append a capture entry. Fail-open. Returns True on success."""
+    entry = build_entry(
+        provider=provider,
+        model=model,
+        request_body=request_body,
+        response_body=response_body,
+        content_type=content_type,
+        input_tokens=input_tokens,
+        output_tokens=output_tokens,
+        status_code=status_code,
+        stream=stream,
+    )
+    return ShadowCapture.get_instance().record(entry)
+
+
+async def record_exchange_async(**kwargs: Any) -> bool:
+    """Async wrapper for ``record_exchange`` that offloads the synchronous file
+    write to a worker thread so it never blocks the proxy event loop — relevant
+    when many streaming responses complete in the same loop iteration.
+    """
+    return await asyncio.to_thread(lambda: record_exchange(**kwargs))

package/src/superlocalmemory/optimize/proxy/gemini_surface.py

@@ -47,7 +47,10 @@ from superlocalmemory.optimize.proxy._helpers import (
     _safe_compress,
     _stream_and_cache_forward,
     _stream_forward,
+    capture_passthrough_forward,
 )
+from superlocalmemory.optimize.proxy.capture import capture_enabled
+from superlocalmemory.optimize.proxy.openai_surface import _parse_openai_sse_to_json
 from superlocalmemory.optimize.proxy.lifecycle import ProviderResponse, ProxyRequest
 
 logger = logging.getLogger("slm.optimize.proxy.gemini")
@@ -238,6 +241,24 @@ async def handle_gemini_native(
         stream = "streamGenerateContent" in model_and_method
         has_tools = _body_has_tools(body)
 
+        # v3.6.10 shadow-capture (plan §7): pure passthrough + corpus record.
+        if capture_enabled():
+            cap_model = model_and_method.split(":", 1)[0].replace("models/", "")
+            cap_url = upstream_url
+            if stream:
+                _allowed = {
+                    k: v for k, v in request.query_params.items()
+                    if k.lower() in _GEMINI_ALLOWED_QUERY_PARAMS
+                }
+                _allowed["alt"] = "sse"
+                cap_url = f"{upstream_url}?{urllib.parse.urlencode(_allowed)}"
+            return await capture_passthrough_forward(
+                proxy, request, provider="gemini", upstream_url=cap_url,
+                allowed_headers=_GEMINI_NATIVE_FORWARD_HEADERS, request_id=request_id,
+                model_hint=cap_model,
+                sse_parser=_parse_gemini_sse_to_json, is_stream=stream,
+            )
+
         ctx = ProxyRequest(
             provider="gemini",
             method="POST",
@@ -407,6 +428,16 @@ async def handle_gemini_openai_compat(proxy: object, request: Request) -> Respon
         has_tools = _body_has_tools(body)
         stream = bool(body.get("stream", False))
 
+        # v3.6.10 shadow-capture (plan §7): pure passthrough + corpus record.
+        if capture_enabled():
+            return await capture_passthrough_forward(
+                proxy, request, provider="gemini-openai-compat",
+                upstream_url=upstream_url,
+                allowed_headers=_GEMINI_OPENAI_COMPAT_FORWARD_HEADERS,
+                request_id=request_id, model_hint=str(body.get("model", "")),
+                sse_parser=_parse_openai_sse_to_json, is_stream=stream,
+            )
+
         ctx = ProxyRequest(
             provider="gemini-openai-compat",
             method="POST",

package/src/superlocalmemory/optimize/proxy/openai_surface.py

@@ -33,7 +33,9 @@ from superlocalmemory.optimize.proxy._helpers import (
     _safe_compress,
     _stream_and_cache_forward,
     _stream_forward,
+    capture_passthrough_forward,
 )
+from superlocalmemory.optimize.proxy.capture import capture_enabled
 from superlocalmemory.optimize.proxy.lifecycle import ProviderResponse, ProxyRequest
 
 logger = logging.getLogger("slm.optimize.proxy.openai")
@@ -316,6 +318,16 @@ async def handle_chat_completions(proxy: object, request: Request) -> Response:
 
         stream = bool(body.get("stream", False))
         has_tools = _body_has_tools(body)
+
+        # v3.6.10 shadow-capture (plan §7): pure passthrough + corpus record.
+        if capture_enabled():
+            return await capture_passthrough_forward(
+                proxy, request, provider="openai", upstream_url=upstream_url,
+                allowed_headers=_OPENAI_FORWARD_HEADERS, request_id=request_id,
+                model_hint=str(body.get("model", "")),
+                sse_parser=_parse_openai_sse_to_json, is_stream=stream,
+            )
+
         ctx = ProxyRequest(
             provider="openai", method="POST", path="/v1/chat/completions",
             headers=_redact_headers(dict(request.headers)),

package/src/superlocalmemory/optimize/proxy/server.py

@@ -75,6 +75,24 @@ class ProxyApp:
             self._request_counter += 1
             return f"slm_{int(time.monotonic() * 1000)}_{self._request_counter:06d}"
 
+    def reload_from_config(self, config: OptimizeConfig) -> None:
+        """Hot-swap cache/compress behavior when optimize.json changes (v3.6.10).
+
+        Called by the ConfigStore change-callback (UI save → immediate; external
+        file/CLI edit → within the 2s watchdog poll). Rebuilds the HookChain so
+        ``cache_enabled`` and ``compress_enabled`` can be toggled INDEPENDENTLY
+        at runtime with no daemon restart. Note: ``proxy_enabled`` (whether the
+        proxy claims /v1/* at all) is a startup decision and is NOT changed here.
+        """
+        self.config = config
+        self.hooks = _load_hooks(config)
+        logger.info(
+            "slm.optimize.proxy reloaded (config v%s): cache=%s compress=%s",
+            getattr(config, "config_version", "?"),
+            type(self.hooks.cache).__name__ if self.hooks.cache else "None",
+            type(self.hooks.compress).__name__ if self.hooks.compress else "None",
+        )
+
 
 def build_proxy_router(proxy: ProxyApp) -> APIRouter:
     """Build and return the FastAPI router for all proxy surfaces."""
@@ -132,6 +150,17 @@ def build_proxy_router(proxy: ProxyApp) -> APIRouter:
 
 
 def _load_hooks(config: OptimizeConfig) -> HookChain:
+    # v3.6.10 shadow-capture (plan §7): capture mode is PURE passthrough — no
+    # cache, no compression — so the corpus records only authentic upstream
+    # exchanges. This is defense-in-depth alongside the per-surface guard.
+    from superlocalmemory.optimize.proxy.capture import capture_enabled
+    if capture_enabled():
+        logger.info(
+            "slm.optimize.proxy: SLM_OPTIMIZE_CAPTURE on — cache/compress "
+            "DISABLED, recording exchanges to optimize_capture.jsonl"
+        )
+        return HookChain.empty()
+
     cache_hook = None
     compress_hook = None
 

package/src/superlocalmemory/optimize/storage/db.py

@@ -33,6 +33,7 @@ import dataclasses
 import json
 import logging
 import os
+import re
 import sqlite3
 import struct
 import time
@@ -52,6 +53,25 @@ from superlocalmemory.optimize.storage import schema as _schema
 logger = logging.getLogger(__name__)
 
 _DEFAULT_TENANT: str = "default"
+_TENANT_HEX64 = re.compile(r"[0-9a-f]{64}")
+
+
+def _normalize_tenant_id(tenant_id: str) -> str:
+    """Match CacheManager.build_key tenant normalization (v3.6.10 fix).
+
+    The proxy stores entries under SHA-256(tenant) when the tenant is not
+    already a 64-char hex digest. Public tenant-scoped helpers (entry_count,
+    clear_tenant, entry_exists) MUST apply the same hashing or they query the
+    wrong tenant — the cause of the dashboard reporting "0 entries" while the
+    cache is in fact populated.
+    """
+    tid = tenant_id or _DEFAULT_TENANT
+    if _TENANT_HEX64.fullmatch(tid):
+        return tid
+    import hashlib as _hashlib
+    return _hashlib.sha256(tid.encode()).hexdigest()
+
+
 _ZLIB_LEVEL: int = 6
 _AES_NONCE_BYTES: int = 12
 _PBKDF2_ITERATIONS: int = 100_000
@@ -61,6 +81,9 @@ LLMCACHE_DBNAME: str = "llmcache.db"
 MID_FILENAME: str = ".llmcache_key"
 SALT_PREFIX: str = "salt:"
 
+# C-06: persisted AES key — survives machine-id changes after first run
+_KEY_FILE: Path = Path.home() / LLMCACHE_DIRNAME / "opt-key.bin"
+
 _FORBIDDEN_MEMORY_TABLES: frozenset[str] = frozenset({
     "memories", "atomic_facts", "profiles", "canonical_entities",
     "entity_aliases", "consolidation_log", "trust_scores", "bm25_tokens",
@@ -74,7 +97,13 @@ _FORBIDDEN_MEMORY_TABLES: frozenset[str] = frozenset({
 
 @dataclass
 class MetricsSnapshot:
-    """Mirror of llmcache_metrics columns — names MUST match exactly."""
+    """Mirror of llmcache_metrics columns — names MUST match exactly.
+
+    S-03 / M-03 note: compress_bytes_original and compress_bytes_after store
+    WORD-COUNT proxy values (len(text.split())), NOT byte counts. The column
+    names use "bytes" for DB schema backward compatibility. Treat these fields
+    as token-count proxies, not literal byte measurements.
+    """
     id: int = 1
     hits: int = 0
     misses: int = 0
@@ -86,8 +115,8 @@ class MetricsSnapshot:
     latency_overhead_ms_sum: float = 0.0
     latency_samples: int = 0
     compress_runs: int = 0
-    compress_bytes_original: int = 0
-    compress_bytes_after: int = 0
+    compress_bytes_original: int = 0  # unit: word-count proxy (see S-03 note above)
+    compress_bytes_after: int = 0     # unit: word-count proxy (see S-03 note above)
     cache_size_bytes: int = 0
     cache_entry_count: int = 0
     updated_at: float = 0.0
@@ -209,8 +238,7 @@ class CacheDB:
         except OSError as exc:
             logger.warning("CacheDB: could not chmod 600 on %s: %s", self._db_path, exc)
         self._salt = self._load_or_create_salt()
-        machine_id = self._get_machine_id()
-        self._aes_key = self._derive_aes_key(machine_id, self._salt)
+        self._aes_key = self._get_or_persist_aes_key(self._salt)
         self.assert_no_memory_db_tables()
 
     # ---- context manager ----
@@ -292,6 +320,33 @@ class CacheDB:
                     logger.warning("CacheDB: could not persist machine id: %s", exc)
         return mid
 
+    def _get_or_persist_aes_key(self, salt: bytes) -> bytes:
+        """C-06: Load persisted key from disk, or derive + persist on first run.
+
+        Surviving a machine-id change: after first derivation the key is saved to
+        opt-key.bin (0600). On subsequent starts the file is read directly,
+        so changing the underlying machine-id string cannot invalidate existing
+        cache entries.
+        """
+        try:
+            if _KEY_FILE.exists():
+                key = _KEY_FILE.read_bytes()
+                if len(key) == 32:
+                    return key
+        except Exception as exc:
+            logger.warning("CacheDB: could not read persisted AES key: %s", exc)
+
+        # First run (or corrupted file): derive from machine-id and persist.
+        machine_id = self._get_machine_id()
+        key = self._derive_aes_key(machine_id, salt)
+        try:
+            _KEY_FILE.parent.mkdir(parents=True, exist_ok=True)
+            _KEY_FILE.write_bytes(key)
+            os.chmod(_KEY_FILE, 0o600)
+        except Exception as exc:
+            logger.warning("CacheDB: could not persist AES key (fail-open): %s", exc)
+        return key
+
     def _derive_aes_key(self, machine_id: str, salt: bytes) -> bytes:
         kdf = PBKDF2HMAC(
             algorithm=hashes.SHA256(),
@@ -366,6 +421,30 @@ class CacheDB:
             logger.warning("CacheDB.get failed (cache miss): %s", exc)
             return None
 
+    def get_value(self, cache_key: str, tenant_id: str) -> bytes | None:
+        """Pure value lookup — no hit_count increment (unlike get()).
+
+        Used by MCP KV tools which manage their own hit/miss counters.
+        Caller must have already normalized tenant_id. Fail-open: returns None on error.
+        """
+        try:
+            rows = self._db.execute(
+                "SELECT value_blob, compressed FROM llmcache_entries "
+                "WHERE cache_key = ? AND tenant_id = ? "
+                "AND (ttl_expires IS NULL OR ttl_expires > ?) LIMIT 1",
+                (cache_key, tenant_id, time.time()),
+            )
+            if not rows:
+                return None
+            row = dict(rows[0])
+            plaintext = self._decrypt(row["value_blob"])
+            if row.get("compressed", 0):
+                plaintext = zlib.decompress(plaintext)
+            return plaintext
+        except (sqlite3.Error, ValueError, zlib.error) as exc:
+            logger.warning("CacheDB.get_value failed (fail-open): %s", exc)
+            return None
+
     def set(
         self,
         key: str,
@@ -626,11 +705,12 @@ class CacheDB:
         try:
             dim = int(meta.get("dim", len(vector) // 4))
             model_name = str(meta.get("model", "nomic-ai/nomic-embed-text-v1.5"))
+            context_fp = str(meta.get("context_fp", ""))  # C-10: persist context fingerprint
             self._db.execute(
                 "INSERT OR REPLACE INTO llmcache_semantic_vectors "
-                "(entry_id, tenant_id, vector_blob, vector_dim, model_name) "
-                "VALUES (?, ?, ?, ?, ?)",
-                (entry_id, tenant_id, vector, dim, model_name),
+                "(entry_id, tenant_id, vector_blob, vector_dim, model_name, context_fp) "
+                "VALUES (?, ?, ?, ?, ?, ?)",
+                (entry_id, tenant_id, vector, dim, model_name, context_fp),
             )
         except sqlite3.Error as exc:
             logger.warning("CacheDB.vec_add failed: %s", exc)
@@ -855,14 +935,22 @@ class CacheDB:
 
     # ---- v2 additions ----
 
-    def get_all_vectors(self, tenant_id: str) -> list[tuple[str, bytes]]:
+    def get_all_vectors(self, tenant_id: str) -> list[tuple[str, bytes, str]]:
+        """Return (entry_id, vector_blob, context_fp) for all vectors in a tenant.
+
+        C-10: context_fp is included so _lazy_warm_tenant() can restore it without
+        recomputing embeddings from messages that may no longer be in scope.
+        """
         try:
             rows = self._db.execute(
-                "SELECT entry_id, vector_blob FROM llmcache_semantic_vectors "
+                "SELECT entry_id, vector_blob, context_fp FROM llmcache_semantic_vectors "
                 "WHERE tenant_id = ?",
                 (tenant_id,),
             )
-            return [(dict(r)["entry_id"], dict(r)["vector_blob"]) for r in rows]
+            return [
+                (dict(r)["entry_id"], dict(r)["vector_blob"], dict(r).get("context_fp", ""))
+                for r in rows
+            ]
         except sqlite3.Error as exc:
             logger.warning("CacheDB.get_all_vectors failed: %s", exc)
             return []
@@ -919,6 +1007,7 @@ class CacheDB:
     # ---- convenience / non-contract helpers ----
 
     def entry_exists(self, cache_key: str, tenant_id: str = _DEFAULT_TENANT) -> bool:
+        tenant_id = _normalize_tenant_id(tenant_id)
         try:
             rows = self._db.execute(
                 "SELECT 1 FROM llmcache_entries WHERE cache_key = ? AND tenant_id = ? LIMIT 1",
@@ -929,6 +1018,7 @@ class CacheDB:
             return False
 
     def clear_tenant(self, tenant_id: str) -> int:
+        tenant_id = _normalize_tenant_id(tenant_id)
         try:
             with self._db.transaction():
                 rows = self._db.execute(
@@ -955,6 +1045,7 @@ class CacheDB:
             return 0
 
     def entry_count(self, tenant_id: str = _DEFAULT_TENANT) -> int:
+        tenant_id = _normalize_tenant_id(tenant_id)
         try:
             rows = self._db.execute(
                 "SELECT COUNT(*) AS n FROM llmcache_entries "

package/src/superlocalmemory/optimize/storage/schema.py

@@ -53,6 +53,7 @@ _DDL_STATEMENTS: tuple[str, ...] = (
         vector_blob     BLOB    NOT NULL,
         vector_dim      INTEGER NOT NULL DEFAULT 768,
         model_name      TEXT    NOT NULL DEFAULT 'nomic-ai/nomic-embed-text-v1.5',
+        context_fp      TEXT    NOT NULL DEFAULT '',
         created_at      TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
     )
     """,
@@ -127,10 +128,20 @@ def create_all_tables(conn: sqlite3.Connection) -> None:
 
     Safe to call repeatedly — all DDL uses IF NOT EXISTS.
     Also seeds the single llmcache_metrics row (id=1) via INSERT OR IGNORE.
+    C-10: adds context_fp column to existing DBs via ALTER TABLE migration.
     """
     for stmt in _DDL_STATEMENTS:
         conn.execute(stmt)
     conn.execute("INSERT OR IGNORE INTO llmcache_metrics(id) VALUES (1)")
+    # C-10 migration: add context_fp column if missing (existing installs pre-v3.6.10)
+    existing_cols = {
+        row[1]
+        for row in conn.execute("PRAGMA table_info(llmcache_semantic_vectors)")
+    }
+    if "context_fp" not in existing_cols:
+        conn.execute(
+            "ALTER TABLE llmcache_semantic_vectors ADD COLUMN context_fp TEXT NOT NULL DEFAULT ''"
+        )
     row = conn.execute(
         "SELECT 1 FROM llmcache_schema_version WHERE version = ?",
         (CACHE_SCHEMA_VERSION,),

package/src/superlocalmemory/server/routes/optimize.py

@@ -32,17 +32,15 @@ class ConfigUpdateRequest(BaseModel):
     semantic_enabled: bool | None = None
     compress_enabled: bool | None = None
     compress_mode: Literal['safe', 'aggressive'] | None = None
-    compress_code: bool | None = None
     compress_prose: bool | None = None
-    compress_ccr: bool | None = None
 
 
 @router.get("/config")
 async def get_config() -> dict[str, Any]:
     """Return current optimize config as JSON."""
     try:
-        from superlocalmemory.optimize.config.store import ConfigStore
-        cfg = ConfigStore().get()
+        from superlocalmemory.optimize.config import get_shared_store
+        cfg = get_shared_store().get()
         return cfg.as_dict()
     except Exception as exc:
         logger.warning("GET /api/optimize/config failed: %s", exc)
@@ -54,8 +52,8 @@ async def put_config(body: ConfigUpdateRequest) -> dict[str, Any]:
     """Update optimize config (partial). Daemon hot-reloads within 2s."""
     try:
         import dataclasses
-        from superlocalmemory.optimize.config.store import ConfigStore
-        store = ConfigStore()
+        from superlocalmemory.optimize.config import get_shared_store
+        store = get_shared_store()
         cfg = store.get()
         updates: dict[str, Any] = {}
         for field_name in ConfigUpdateRequest.model_fields:
@@ -80,11 +78,11 @@ async def get_savings() -> dict[str, Any]:
     Field names match INTERFACE-CONTRACT §5 exactly.
     """
     try:
-        from superlocalmemory.optimize.config.store import ConfigStore
+        from superlocalmemory.optimize.config import get_shared_store
         from superlocalmemory.optimize.metrics.counters import get_metrics
         from superlocalmemory.optimize.storage.db import CacheDB
 
-        cfg = ConfigStore().get()
+        cfg = get_shared_store().get()
         collector = get_metrics()
         db = CacheDB()
         snap = collector.snapshot(