superlocalmemory 3.8.2 → 3.8.5

package/src/superlocalmemory/hooks/adapter_base.py

@@ -32,6 +32,8 @@ from datetime import datetime, timezone
 from pathlib import Path
 from typing import Protocol, runtime_checkable
 
+from superlocalmemory.storage.write_lock import get_write_lock
+
 
 # ---------------------------------------------------------------------------
 # Constants
@@ -86,25 +88,31 @@ def _ensure_memory_log(db_path: Path) -> None:
     """Lazily create ``cross_platform_sync_log`` if a test-mode memory.db is
     fresh. Production code goes through the migration runner, but tests can
     hand us an empty DB; this keeps adapters usable without pre-running
-    migrations."""
-    conn = sqlite3.connect(str(db_path))
-    try:
-        conn.executescript(
-            "CREATE TABLE IF NOT EXISTS cross_platform_sync_log ("
-            " adapter_name TEXT NOT NULL,"
-            " profile_id TEXT NOT NULL,"
-            " target_path_sha256 TEXT NOT NULL,"
-            " target_basename TEXT NOT NULL,"
-            " last_sync_at TEXT NOT NULL,"
-            " bytes_written INTEGER NOT NULL,"
-            " content_sha256 TEXT NOT NULL,"
-            " success INTEGER NOT NULL,"
-            " error_msg TEXT,"
-            " PRIMARY KEY (adapter_name, target_path_sha256));"
-        )
-        conn.commit()
-    finally:
-        conn.close()
+    migrations.
+
+    Acquires the process-level write lock for *db_path* before opening
+    a sqlite3 connection so that this DDL write is serialised with all
+    other in-process writers (DatabaseManager, VectorStore, etc.).
+    """
+    with get_write_lock(db_path):
+        conn = sqlite3.connect(str(db_path))
+        try:
+            conn.executescript(
+                "CREATE TABLE IF NOT EXISTS cross_platform_sync_log ("
+                " adapter_name TEXT NOT NULL,"
+                " profile_id TEXT NOT NULL,"
+                " target_path_sha256 TEXT NOT NULL,"
+                " target_basename TEXT NOT NULL,"
+                " last_sync_at TEXT NOT NULL,"
+                " bytes_written INTEGER NOT NULL,"
+                " content_sha256 TEXT NOT NULL,"
+                " success INTEGER NOT NULL,"
+                " error_msg TEXT,"
+                " PRIMARY KEY (adapter_name, target_path_sha256));"
+            )
+            conn.commit()
+        finally:
+            conn.close()
 
 
 def sync_log_last_content_sha256(
@@ -156,31 +164,37 @@ def sync_log_record(
         )
     if os.sep in target_path_sha256 or "/" in target_path_sha256:
         raise ValueError("target_path_sha256 must be a hash, not a raw path")
-    _ensure_memory_log(db_path)
-    conn = sqlite3.connect(str(db_path))
-    try:
-        conn.execute(
-            "INSERT INTO cross_platform_sync_log ("
-            "adapter_name, profile_id, target_path_sha256, target_basename, "
-            "last_sync_at, bytes_written, content_sha256, success, error_msg"
-            ") VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?) "
-            "ON CONFLICT(adapter_name, target_path_sha256) DO UPDATE SET "
-            " profile_id = excluded.profile_id,"
-            " target_basename = excluded.target_basename,"
-            " last_sync_at = excluded.last_sync_at,"
-            " bytes_written = excluded.bytes_written,"
-            " content_sha256 = excluded.content_sha256,"
-            " success = excluded.success,"
-            " error_msg = excluded.error_msg",
-            (
-                adapter_name, profile_id, target_path_sha256, target_basename,
-                _now_iso(), bytes_written, content_sha256,
-                1 if success else 0, error_msg,
-            ),
-        )
-        conn.commit()
-    finally:
-        conn.close()
+    # Acquire the process-level write lock BEFORE opening the sqlite3 connection.
+    # This ensures the INSERT/UPDATE below is serialised with all other in-process
+    # writers (DatabaseManager, VectorStore, consolidation) via the single shared
+    # RLock for memory.db, eliminating SQLITE_BUSY races at the WAL layer.
+    # _ensure_memory_log also acquires the same RLock (re-entrant — safe).
+    with get_write_lock(db_path):
+        _ensure_memory_log(db_path)
+        conn = sqlite3.connect(str(db_path))
+        try:
+            conn.execute(
+                "INSERT INTO cross_platform_sync_log ("
+                "adapter_name, profile_id, target_path_sha256, target_basename, "
+                "last_sync_at, bytes_written, content_sha256, success, error_msg"
+                ") VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?) "
+                "ON CONFLICT(adapter_name, target_path_sha256) DO UPDATE SET "
+                " profile_id = excluded.profile_id,"
+                " target_basename = excluded.target_basename,"
+                " last_sync_at = excluded.last_sync_at,"
+                " bytes_written = excluded.bytes_written,"
+                " content_sha256 = excluded.content_sha256,"
+                " success = excluded.success,"
+                " error_msg = excluded.error_msg",
+                (
+                    adapter_name, profile_id, target_path_sha256, target_basename,
+                    _now_iso(), bytes_written, content_sha256,
+                    1 if success else 0, error_msg,
+                ),
+            )
+            conn.commit()
+        finally:
+            conn.close()
 
 
 # ---------------------------------------------------------------------------

package/src/superlocalmemory/hooks/ide_connector.py

@@ -188,8 +188,18 @@ class IDEConnector:  # pragma: no cover — legacy shim, covered by test_ide_con
         path.write_text(content + "\n" + section)
         return True
 
-    def _merge_json(self, path: Path) -> bool:
-        """Merge SLM config into a JSON config file."""
+    def _merge_json(
+        self,
+        path: Path,
+        transport: str = "stdio",
+        daemon_port: int = 8765,
+    ) -> bool:
+        """Merge SLM config into a JSON config file.
+
+        Args:
+            transport: "stdio" (default), "http", or "http-mcp-remote".
+            daemon_port: Daemon port for http transports (default 8765).
+        """
         data: dict[str, Any] = {}
         if path.exists():
             try:
@@ -201,12 +211,20 @@ class IDEConnector:  # pragma: no cover — legacy shim, covered by test_ide_con
         if "mcpServers" not in data:
             data["mcpServers"] = {}
 
-        data["mcpServers"]["superlocalmemory"] = {
-            "type": "stdio",
-            "command": "slm",
-            "args": ["mcp"],
-            "enabled": True,
-        }
+        base_url = f"http://127.0.0.1:{daemon_port}/mcp/"
+        if transport == "http":
+            block: dict[str, Any] = {"type": "http", "url": base_url}
+        elif transport == "http-mcp-remote":
+            block = {"type": "stdio", "command": "mcp-remote", "args": [base_url]}
+        else:
+            block = {
+                "type": "stdio",
+                "command": "slm",
+                "args": ["mcp"],
+                "enabled": True,
+            }
+
+        data["mcpServers"]["superlocalmemory"] = block
 
         path.parent.mkdir(parents=True, exist_ok=True)
         path.write_text(json.dumps(data, indent=2))

package/src/superlocalmemory/hooks/portable_kit.py

@@ -32,6 +32,12 @@ logger = logging.getLogger(__name__)
 SLM_MARKER_START = "<!-- SLM-START -->"
 SLM_MARKER_END = "<!-- SLM-END -->"
 
+# Valid transport values for connect_ide() and slm connect --transport.
+# "stdio"           — default, zero regression; uses desc.server_block as-is.
+# "http"            — native MCP Streamable-HTTP; requires daemon at :daemon_port.
+# "http-mcp-remote" — mcp-remote stdio bridge for stdio-only clients.
+VALID_TRANSPORTS: frozenset[str] = frozenset({"stdio", "http", "http-mcp-remote"})
+
 CLAUDE_CODE_PLUGIN_POINTER = (
     "slm connect claude-code: Claude Code is configured via the SLM plugin (WP-06).\n"
     "Run: slm plugin install  OR  see plugin-src/ for manual installation.\n"
@@ -241,16 +247,26 @@ def connect_ide(
     profile: str | None = None,
     agents_md_source: Callable[[], str] | None = None,
     dry_run: bool = False,
+    transport: str = "stdio",
+    daemon_port: int = 8765,
 ) -> dict[str, Any]:
     """Wire SLM into the target IDE config via merge-not-clobber.
 
+    Args:
+        transport: MCP transport to write into the config.
+            "stdio" (default, zero regression) — uses the IDE's canonical server_block.
+            "http" — native MCP Streamable-HTTP block; requires SLM daemon at daemon_port.
+            "http-mcp-remote" — stdio bridge via mcp-remote for stdio-only clients.
+        daemon_port: Daemon listen port for http / http-mcp-remote (default 8765).
+
     Returns a result dict:
-        {ide, mcp_config: wrote|merged|unchanged|would_write|skipped|error,
+        {ide, transport, mcp_config: wrote|merged|unchanged|would_write|skipped|error,
          mcp_path, agents_md: wrote|skipped(...)|unchanged|error,
          servers_preserved: int, error: str|None}
     """
     result: dict[str, Any] = {
         "ide": ide_id,
+        "transport": transport,
         "mcp_config": "error",
         "mcp_path": "",
         "agents_md": "skipped(not-run)",
@@ -258,6 +274,14 @@ def connect_ide(
         "error": None,
     }
 
+    # Step 0 — validate transport
+    if transport not in VALID_TRANSPORTS:
+        result["error"] = (
+            f"Invalid transport '{transport}'. "
+            f"Valid choices: {', '.join(sorted(VALID_TRANSPORTS))}"
+        )
+        return result
+
     # Step 1 — resolve
     desc = resolve_descriptor(ide_id)
     if desc is None:
@@ -303,9 +327,25 @@ def connect_ide(
         # File is untouched (we never wrote; abort)
         return result
 
-    # Step 4 — extract server container
-    # For continue (yaml list), special-case
+    # Step 4 — daemon health-check for HTTP transports (advisory, never blocks write)
+    if transport in ("http", "http-mcp-remote") and desc.fmt != "":
+        if not _check_daemon_health(daemon_port):
+            print(
+                f"[SLM] Warning: daemon not reachable at http://127.0.0.1:{daemon_port}/api/v3/health. "
+                f"Run `slm serve start` to start it, or `slm serve install` to register as an OS service.",
+                file=sys.stderr,
+            )
+
+    # Step 5 — extract server container and build block
+    # For YAML-format IDEs (continue.dev), transport is ignored — their block
+    # structure is list-based and incompatible with the JSON http/mcp-remote block.
     if desc.fmt == "yaml":
+        if transport != "stdio":
+            logger.warning(
+                "transport=%r is not supported for YAML-format IDE %r; using stdio fallback.",
+                transport,
+                ide_id,
+            )
         mcp_status, servers_preserved = _merge_yaml_list(
             data, desc, profile
         )
@@ -316,10 +356,8 @@ def connect_ide(
         pre_count = len(servers)
         pre_slm = copy.deepcopy(servers.get("superlocalmemory"))
 
-        # Step 5 — merge
-        block = copy.deepcopy(desc.server_block)
-        if profile:
-            block.setdefault("env", {})["SLM_MCP_PROFILE"] = profile
+        # Build the server block for the requested transport
+        block = _build_server_block(desc, transport, daemon_port, profile)
 
         servers["superlocalmemory"] = block
 
@@ -384,6 +422,8 @@ def connect_many(
     here: bool = False,
     profile: str | None = None,
     agents_md_source: Callable[[], str] | None = None,
+    transport: str = "stdio",
+    daemon_port: int = 8765,
 ) -> list[dict[str, Any]]:
     """Wire SLM into multiple IDE configs via non-destructive merge.
 
@@ -402,14 +442,17 @@ def connect_many(
         home: Override ``$HOME`` (test hook).
         project: Project root for ``here=True`` installs.
         here: When True, write to project-relative path instead of global.
-        profile: Inject ``SLM_MCP_PROFILE`` env-var into every server block.
+        profile: Inject ``SLM_MCP_PROFILE`` env-var (stdio) or URL param (http).
         agents_md_source: Callable returning AGENTS.md content to append.
+        transport: MCP transport to use for all IDEs ("stdio", "http",
+            "http-mcp-remote"). Default "stdio" preserves existing behavior.
+        daemon_port: Daemon listen port for http/http-mcp-remote (default 8765).
 
     Returns:
         List of per-IDE result dicts, one per input id.  Each dict has the
         same shape as :func:`connect_ide`'s return value::
 
-            {ide, mcp_config, mcp_path, agents_md, servers_preserved, error}
+            {ide, transport, mcp_config, mcp_path, agents_md, servers_preserved, error}
     """
     return [
         connect_ide(
@@ -419,6 +462,8 @@ def connect_many(
             here=here,
             profile=profile,
             agents_md_source=agents_md_source,
+            transport=transport,
+            daemon_port=daemon_port,
         )
         for ide_id in ide_ids
     ]
@@ -507,6 +552,57 @@ def _merge_yaml_list(
         return "wrote", pre_count
 
 
+def _build_server_block(
+    desc: IDEDescriptor,
+    transport: str,
+    daemon_port: int,
+    profile: str | None,
+) -> dict[str, Any]:
+    """Return the server block for the requested transport.
+
+    YAML and TOML IDEs use a format-specific block structure that is
+    incompatible with the JSON http/mcp-remote block — caller should never
+    reach here for those (they take the yaml branch in connect_ide).
+    For JSON-format IDEs:
+      "stdio"           → copy of desc.server_block with optional SLM_MCP_PROFILE env
+      "http"            → native MCP HTTP block; profile goes as URL query param
+      "http-mcp-remote" → mcp-remote stdio bridge; profile appended to proxied URL
+    """
+    base_url = f"http://127.0.0.1:{daemon_port}/mcp/"
+
+    if transport == "http":
+        url = base_url + (f"?profile={profile}" if profile else "")
+        return {"type": "http", "url": url}
+
+    if transport == "http-mcp-remote":
+        url = base_url + (f"?profile={profile}" if profile else "")
+        return {"type": "stdio", "command": "mcp-remote", "args": [url]}
+
+    # Default: stdio — preserve existing behavior exactly
+    block = copy.deepcopy(desc.server_block)
+    if profile:
+        block.setdefault("env", {})["SLM_MCP_PROFILE"] = profile
+    return block
+
+
+def _check_daemon_health(daemon_port: int, timeout: float = 2.0) -> bool:
+    """Non-blocking probe of the SLM daemon health endpoint.
+
+    Returns True if the daemon responds with HTTP 200, False otherwise.
+    Never raises — all exceptions are caught and treated as "unreachable".
+    """
+    try:
+        import urllib.request
+        import urllib.error
+
+        url = f"http://127.0.0.1:{daemon_port}/api/v3/health"
+        req = urllib.request.Request(url, method="GET")
+        with urllib.request.urlopen(req, timeout=timeout) as resp:
+            return resp.status == 200
+    except Exception:
+        return False
+
+
 def _atomic_write(path: Path, data: dict[str, Any], fmt: str) -> None:
     """Serialize data and atomically write to path (.tmp + os.replace)."""
     path.parent.mkdir(parents=True, exist_ok=True)

package/src/superlocalmemory/hooks/prewarm_auth.py

@@ -38,6 +38,8 @@ _ORIGIN_HEADER_VARIANTS: tuple[str, ...] = ("Origin", "origin")
 
 # Loopback addresses accepted by LLD-01. ``localhost`` is NOT included per
 # SEC-01-02 — we want literal IPs only to avoid DNS-based bypass tricks.
+# Note: ::ffff:127.x.x.x is handled dynamically via ipaddress.ip_address()
+# in is_loopback() below to cover dual-stack container deployments (#90).
 _LOOPBACK_ADDRS: frozenset[str] = frozenset({"127.0.0.1", "::1"})
 
 # Body-size cap: LLD-01 §4.5 step 4 → 8 KB.
@@ -65,10 +67,27 @@ class AuthDecision:
 
 
 def is_loopback(client_host: str) -> bool:
-    """Return True iff ``client_host`` is an accepted loopback literal."""
+    """Return True iff ``client_host`` is an accepted loopback literal.
+
+    Deliberately excludes ``"localhost"`` per SEC-01-02 — /internal/prewarm
+    callers are in-process hooks that always connect to a literal IP, so
+    hostname aliases are rejected to prevent DNS-based bypass tricks.
+
+    Accepts IPv4-mapped IPv6 loopback (``::ffff:127.x.x.x``) for dual-stack
+    correctness (issue #90), while still excluding ``"localhost"``.
+    """
     if not isinstance(client_host, str) or not client_host:
         return False
-    return client_host in _LOOPBACK_ADDRS
+    if client_host in _LOOPBACK_ADDRS:
+        return True
+    # Handle IPv4-mapped IPv6 loopback (::ffff:127.x.x.x) — dual-stack fix.
+    # Intentionally NOT accepting "localhost" (SEC-01-02 preserved).
+    try:
+        import ipaddress as _ipa
+        ip = _ipa.ip_address(client_host)
+        return ip.is_loopback
+    except ValueError:
+        return False
 
 
 # ---------------------------------------------------------------------------

package/src/superlocalmemory/infra/auth_middleware.py

@@ -137,7 +137,9 @@ def authorize_http_mcp_request(
     peer must present the configured SLM API key.  The LAN allowlist limits
     reachability but deliberately does not grant a write identity.
     """
-    if client_host in ("127.0.0.1", "::1", "localhost"):
+    from superlocalmemory.server.loopback import is_loopback as _is_loopback_host
+
+    if _is_loopback_host(client_host):
         return True
     provided = request_headers.get("x-slm-api-key", "")
     return verify_api_key(provided, key_file=key_file)

package/src/superlocalmemory/infra/cloud_backup.py

@@ -26,6 +26,7 @@ from pathlib import Path
 from typing import Any
 
 from superlocalmemory.infra.data_root import canonical_data_root
+from superlocalmemory.storage.memory_write import memory_write
 
 logger = logging.getLogger("superlocalmemory.cloud_backup")
 
@@ -248,8 +249,7 @@ def add_destination(
 
     dest_id = _new_id()
     path = db_path or _default_db_path()
-    conn = sqlite3.connect(str(path))
-    try:
+    with memory_write(path) as conn:
         conn.execute(
             "INSERT INTO backup_destinations "
             "(id, destination_type, display_name, credentials_ref, config, "
@@ -257,32 +257,34 @@ def add_destination(
             (dest_id, destination_type, display_name, credentials_ref,
              json.dumps(config), datetime.now(UTC).isoformat()),
         )
-        conn.commit()
-        logger.info("Added backup destination: %s (%s)", display_name, destination_type)
-        return dest_id
-    finally:
-        conn.close()
+    logger.info("Added backup destination: %s (%s)", display_name, destination_type)
+    return dest_id
 
 
 def remove_destination(dest_id: str, db_path: Path | None = None) -> bool:
     """Remove a backup destination and its credentials."""
     path = db_path or _default_db_path()
-    conn = sqlite3.connect(str(path))
     try:
-        row = conn.execute(
-            "SELECT credentials_ref FROM backup_destinations WHERE id = ?",
-            (dest_id,),
-        ).fetchone()
-        if row and row[0]:
-            _delete_credential(row[0])
-        conn.execute("DELETE FROM backup_destinations WHERE id = ?", (dest_id,))
-        conn.commit()
+        # Fetch credentials_ref with a short read before taking the write lock.
+        import sqlite3 as _sqlite3
+        creds_ref = None
+        try:
+            with _sqlite3.connect(str(path)) as rconn:
+                row = rconn.execute(
+                    "SELECT credentials_ref FROM backup_destinations WHERE id = ?",
+                    (dest_id,),
+                ).fetchone()
+                creds_ref = row[0] if row else None
+        except Exception:
+            pass
+        if creds_ref:
+            _delete_credential(creds_ref)
+        with memory_write(path) as conn:
+            conn.execute("DELETE FROM backup_destinations WHERE id = ?", (dest_id,))
         return True
     except Exception as exc:
         logger.error("Failed to remove destination %s: %s", dest_id, exc)
         return False
-    finally:
-        conn.close()
 
 
 def update_sync_status(
@@ -293,18 +295,15 @@ def update_sync_status(
 ) -> None:
     """Update the sync status of a destination."""
     path = db_path or _default_db_path()
-    conn = sqlite3.connect(str(path))
     try:
-        conn.execute(
-            "UPDATE backup_destinations SET last_sync_at = ?, "
-            "last_sync_status = ?, last_sync_error = ? WHERE id = ?",
-            (datetime.now(UTC).isoformat(), status, error, dest_id),
-        )
-        conn.commit()
+        with memory_write(path) as conn:
+            conn.execute(
+                "UPDATE backup_destinations SET last_sync_at = ?, "
+                "last_sync_status = ?, last_sync_error = ? WHERE id = ?",
+                (datetime.now(UTC).isoformat(), status, error, dest_id),
+            )
     except Exception:
         pass
-    finally:
-        conn.close()
 
 
 # ---------------------------------------------------------------------------