superlocalmemory 4.0.4 → 4.0.6

package/src/superlocalmemory/cli/gdpr_io.py

@@ -0,0 +1,109 @@
+# Copyright (c) 2026 Varun Pratap Bhardwaj / Qualixar
+# Licensed under AGPL-3.0-or-later - see LICENSE file
+# Part of SuperLocalMemory V4 | https://qualixar.com | https://varunpratap.com
+
+"""Shared I/O helpers and compliance constants for ``slm gdpr`` subcommands.
+
+Separated from gdpr_cmd.py to honour the 800-line file cap (coding-style.md).
+All symbols here are internal (prefixed ``_``) or ALL_CAPS constants.
+"""
+
+from __future__ import annotations
+
+import json as _json
+import sys
+from pathlib import Path
+from typing import Any
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Output helpers
+# ─────────────────────────────────────────────────────────────────────────────
+
+def _die(message: str, code: int = 1) -> None:
+    """Print an actionable error to stderr and exit non-zero."""
+    print(f"error: {message}", file=sys.stderr)
+    sys.exit(code)
+
+
+def _print_json(data: Any) -> None:
+    """Emit pretty-printed JSON to stdout (evidence-pipeline format)."""
+    print(_json.dumps(data, indent=2, default=str))
+
+
+def _json_envelope(
+    command: str, *, data: dict | None = None, error: dict | None = None
+) -> dict:
+    """Build the standard agent-native JSON envelope used across all SLM CLIs."""
+    from superlocalmemory.cli.json_output import _get_version
+
+    env: dict = {
+        "success": error is None,
+        "command": command,
+        "version": _get_version(),
+    }
+    if error is not None:
+        env["error"] = error
+    else:
+        env["data"] = data if data is not None else {}
+    return env
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Path helpers
+# ─────────────────────────────────────────────────────────────────────────────
+
+def _data_root() -> Path:
+    """Resolve the canonical SLM data root (honours SLM_DATA_DIR env var)."""
+    from superlocalmemory.infra.data_root import canonical_data_root
+
+    return canonical_data_root()
+
+
+def _db_path() -> Path:
+    return _data_root() / "memory.db"
+
+
+def _audit_chain_path() -> Path:
+    return _data_root() / "audit_chain.db"
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# GDPR compliance constants (DPO-facing, surfaced in ``status`` output)
+# ─────────────────────────────────────────────────────────────────────────────
+
+# Known gaps in this release — reported honestly so a DPO can plan remediation.
+# Gaps C1 and C2 are tracked as open items in the Wave 3 backlog.
+KNOWN_GAPS = [
+    {
+        "ref": "C1",
+        "summary": "backups/ directory is outside erasure scope",
+        "detail": (
+            "Up to 10 rotating snapshots of memory.db, learning.db and "
+            "related DB files survive an Art.17 erasure.  The erasure receipt "
+            "records a 'backup_obligation' so the obligation is tracked, but "
+            "the snapshots are not automatically purged.  Snapshots are "
+            "re-erased on restore."
+        ),
+    },
+    {
+        "ref": "C2",
+        "summary": "code_graph.db is not in erasure scope",
+        "detail": (
+            "Repository paths, file names and symbol names (identifying data "
+            "in a work context) are stored in code_graph.db.  This file is "
+            "covered by compliance/gdpr.py but the per-table discovery "
+            "operates on the main memory.db only."
+        ),
+    },
+]
+
+# Art. coverage flags that compliance/gdpr.py actively implements.
+ART_COVERAGE = {
+    "art15_right_to_access": True,
+    "art17_right_to_erasure": True,
+    "art20_right_to_portability": True,
+    "backup_scope": "outstanding_obligation_recorded_on_receipt",
+    "audit_chain": "HMAC-chained tamper-evident",
+    "erasure_fails_closed": True,
+}

package/src/superlocalmemory/cli/main.py

@@ -88,6 +88,8 @@ _NO_DAEMON_COMMANDS = {
     "help",
     # Lifecycle orchestration must run before any global auto-start hook.
     "serve", "restart",
+    # V4.0.6: GDPR CLI accesses the DB directly; no daemon required.
+    "gdpr",
 }
 
 
@@ -484,6 +486,18 @@ def main() -> None:
     update_p.add_argument("content", help="New content for the memory")
     update_p.add_argument("--json", action="store_true", help="Output structured JSON (agent-native)")
 
+    correction_p = sub.add_parser(
+        "review-correction", help="Apply, reject, or roll back a reviewed correction case"
+    )
+    correction_p.add_argument("case_id", help="Correction case ID returned by slm update")
+    correction_p.add_argument("action", choices=("apply", "reject", "rollback"))
+    correction_p.add_argument("expected_version", type=int, help="Current case version (CAS guard)")
+    correction_p.add_argument(
+        "--event-valid-until",
+        help="Optional reviewer-approved RFC3339 event-time boundary (apply only)",
+    )
+    correction_p.add_argument("--json", action="store_true", help="Output structured JSON (agent-native)")
+
     list_p = sub.add_parser("list", help="List recent memories chronologically (shows IDs for delete/update)")
     list_p.add_argument(
         "--limit", "-n", type=int, default=20, help="Number of entries (default 20)",
@@ -954,6 +968,80 @@ def main() -> None:
         _sp.add_argument("--json", action="store_true",
                          help="Output structured JSON (agent-native)")
 
+    # Wave-3 / V4.0.6: GDPR subject-rights CLI (Art.15/17/20)
+    gdpr_p = sub.add_parser(
+        "gdpr",
+        help="GDPR subject rights: status, export (Art.15/20), erase (Art.17), verify",
+    )
+    gdpr_sub = gdpr_p.add_subparsers(dest="gdpr_command", title="gdpr subcommands")
+
+    gdpr_status_p = gdpr_sub.add_parser(
+        "status",
+        help="Compliance posture: receipts, audit events, known gaps (read-only)",
+    )
+    gdpr_status_p.add_argument(
+        "--profile", default=None, metavar="PROFILE",
+        help="Scope to a specific profile (default: report all)",
+    )
+    gdpr_status_p.add_argument(
+        "--json", action="store_true", help="Output structured JSON (agent-native)",
+    )
+
+    gdpr_export_p = gdpr_sub.add_parser(
+        "export",
+        help="Art.15/20 subject access / data portability export",
+    )
+    gdpr_export_p.add_argument(
+        "--profile", required=True, metavar="PROFILE",
+        help="Profile to export (required)",
+    )
+    gdpr_export_p.add_argument(
+        "--output", default=None, metavar="FILE",
+        help="Write export JSON to FILE (default: stdout)",
+    )
+    gdpr_export_p.add_argument(
+        "--json", action="store_true", help="Output structured JSON envelope",
+    )
+
+    gdpr_erase_p = gdpr_sub.add_parser(
+        "erase",
+        help=(
+            "Art.17 right to erasure — IRREVERSIBLE. "
+            "Requires --profile PROFILE AND --yes."
+        ),
+    )
+    gdpr_erase_p.add_argument(
+        "--profile", default=None, metavar="PROFILE",
+        help="Profile to erase (required for live erasure)",
+    )
+    gdpr_erase_p.add_argument(
+        "--yes", action="store_true",
+        help="Confirm irreversible erasure (required together with --profile)",
+    )
+    gdpr_erase_p.add_argument(
+        "--dry-run", action="store_true", dest="dry_run",
+        help="Preview what would be erased without deleting anything",
+    )
+    gdpr_erase_p.add_argument(
+        "--json", action="store_true", help="Output structured JSON",
+    )
+
+    gdpr_verify_p = gdpr_sub.add_parser(
+        "verify",
+        help="Verify HMAC integrity of an erasure receipt (exit 0=ok, 1=tampered, 2=not-found)",
+    )
+    gdpr_verify_p.add_argument(
+        "--receipt-id", dest="receipt_id", default=None, metavar="ID",
+        help="Erasure receipt ID to verify",
+    )
+    gdpr_verify_p.add_argument(
+        "--profile", default=None, metavar="PROFILE",
+        help="Scope receipt lookup to a specific profile",
+    )
+    gdpr_verify_p.add_argument(
+        "--json", action="store_true", help="Output structured JSON",
+    )
+
     # Wave-3: operational recovery & admin remediation
     ops_p = sub.add_parser(
         "ops",

package/src/superlocalmemory/code_graph/extractors/__init__.py

@@ -76,3 +76,20 @@ class BaseExtractor(ABC):
         import_edges, import_map = self.extract_imports()
         call_edges = self.extract_calls(import_map)
         return (classes + functions, import_edges + call_edges)
+
+    def extract_with_import_map(
+        self,
+    ) -> tuple[list[GraphNode], list[GraphEdge], dict[str, tuple[str, str]]]:
+        """Like extract() but also returns the per-file import map.
+
+        The import map has the form {local_name: (module_path, imported_name)}
+        and is needed by ImportResolver.resolve_call_targets (Strategy 1).
+
+        Returns:
+            (nodes, edges, import_map)
+        """
+        classes = self.extract_classes()
+        functions = self.extract_functions()
+        import_edges, import_map = self.extract_imports()
+        call_edges = self.extract_calls(import_map)
+        return (classes + functions, import_edges + call_edges, import_map)

package/src/superlocalmemory/code_graph/graph_store.py

@@ -70,19 +70,196 @@ class GraphStore:
         4. Insert new edges
         5. Upsert file record
 
-        The database's ``store_file_parse_results`` already does this.
+        Fix B — Defensive pre-filter:
+        Before delegating to the DB, drop any edge whose source_node_id or
+        target_node_id is absent from *both* the local node set AND the
+        database.  This guards the incremental update path (update_code_graph
+        → parse_file → here) which does not run the parse_all resolver
+        pipeline.  After a full build, parse_all's resolution pass should make
+        this a no-op; the filter is a belt-and-braces against partial runs.
+
+        DO NOT fix by disabling the FK — the FK is correct and protects graph
+        integrity.
         """
+        # ── build valid-id set: local nodes ──────────────────────────────
+        #
+        # REPLACE semantics: `store_file_parse_results` uses INSERT OR REPLACE.
+        # graph_nodes has a UNIQUE constraint on `qualified_name`.  When two
+        # nodes share a qualified_name (e.g. a @property getter AND setter, or
+        # a function defined twice in source), the LATER insert wins — the
+        # EARLIER node is deleted via REPLACE, and ON DELETE CASCADE removes
+        # any edges that already referenced it.  We simulate this here: only
+        # the LAST node per qualified_name survives; edges referencing the
+        # earlier "losers" must be dropped before we reach the DB.
+        qn_last: dict[str, GraphNode] = {}
+        for n in nodes:
+            qn_last[n.qualified_name] = n          # last occurrence wins
+        surviving_ids = {n.node_id for n in qn_last.values()}
+
+        # Collect foreign endpoints (not satisfied locally) for a single
+        # batch DB check — avoids N+1 queries.
+        foreign_ids: set[str] = set()
+        for edge in edges:
+            if edge.source_node_id not in surviving_ids:
+                foreign_ids.add(edge.source_node_id)
+            if edge.target_node_id not in surviving_ids:
+                foreign_ids.add(edge.target_node_id)
+
+        db_ids: set[str] = set()
+        if foreign_ids:
+            placeholders = ",".join("?" * len(foreign_ids))
+            rows = self._db.execute(
+                f"SELECT node_id FROM graph_nodes WHERE node_id IN ({placeholders})",
+                tuple(foreign_ids),
+            )
+            db_ids = {row["node_id"] for row in rows}
+
+        valid_ids = surviving_ids | db_ids
+
+        safe_edges: list[GraphEdge] = []
+        dropped = 0
+        for edge in edges:
+            if edge.source_node_id in valid_ids and edge.target_node_id in valid_ids:
+                safe_edges.append(edge)
+            else:
+                dropped += 1
+                logger.debug(
+                    "store_file_nodes_edges: dropped dangling edge %s→%s "
+                    "for file %s (resolver may not have run on this path)",
+                    edge.source_node_id, edge.target_node_id, file_path,
+                )
+        if dropped:
+            logger.debug(
+                "store_file_nodes_edges: total %d dangling edge(s) dropped for %s",
+                dropped, file_path,
+            )
+
         self._db.store_file_parse_results(
             file_path,
             list(nodes),
-            list(edges),
+            safe_edges,
             file_record,
         )
         logger.debug(
             "Stored %d nodes, %d edges for %s",
-            len(nodes), len(edges), file_path,
+            len(nodes), len(safe_edges), file_path,
         )
 
+    def commit_build_batch(
+        self,
+        batch: list[tuple[str, list[GraphNode], list[GraphEdge], FileRecord]],
+    ) -> None:
+        """Two-phase bulk commit — order-independent storage for full builds.
+
+        The single-file ``store_file_nodes_edges`` is insertion-order-
+        dependent: when a caller file (a.py, has CALLS foo→bar) is stored
+        before the callee file (b.py, defines bar), the cross-file CALLS
+        edge is dropped because Fix-B's DB existence check for bar.node_id
+        fails (b.py has not been stored yet).
+
+        This method fixes the root cause by separating commits into two
+        phases, both executed in a single atomic transaction:
+
+        **Phase 1 — all nodes**: for every file in the batch, delete old
+        data and insert new nodes.  After Phase 1, every node_id from every
+        file in the batch is present in ``graph_nodes``.
+
+        **Phase 2 — all edges**: for every file, validate endpoints (the DB
+        existence check now finds callee nodes regardless of file order) and
+        insert qualifying edges.
+
+        Design pattern: *Separated Phases*.  Interleaved per-file commits
+        (the existing loop) are O(1) transaction boundaries but
+        insertion-order-dependent.  Separated phases add one extra pass but
+        are fully order-independent.
+
+        Use this for full builds (``build_code_graph``).  Single-file
+        updates (``update_code_graph``) continue to use
+        ``store_file_nodes_edges`` — the callee nodes from other files are
+        already in the DB from the previous build, so no ordering issue.
+        """
+        if not batch:
+            return
+
+        with self._db.transaction():
+            # ── Phase 1: delete old data + insert all new nodes ───────────
+            #
+            # Edges must be deleted before nodes (FK constraint prevents
+            # deleting a node that an edge still references).  We delete ALL
+            # file edges across the whole batch first, then delete nodes.
+            # This avoids cascade surprises when file A's nodes are deleted
+            # before file B's edges that target those nodes are cleaned up.
+            for fp, _, _, _ in batch:
+                self._db.delete_edges_by_file(fp)
+            for fp, nodes, _, fr in batch:
+                self._db.delete_nodes_by_file(fp)
+                for node in nodes:
+                    self._db.upsert_node(node)
+                self._db.upsert_file_record(fr)
+
+            # ── Phase 2: validate + insert all edges ──────────────────────
+            #
+            # All node_ids from Phase 1 are now in graph_nodes, so the
+            # batch-DB check for cross-file foreign endpoints succeeds
+            # regardless of which file was stored first.
+            total_dropped = 0
+            for fp, nodes, edges, _ in batch:
+                # Simulate INSERT OR REPLACE dedup: only the last node per
+                # qualified_name survives; edges referencing earlier losers
+                # must be pre-dropped (mirrors store_file_nodes_edges logic).
+                qn_last: dict[str, GraphNode] = {}
+                for n in nodes:
+                    qn_last[n.qualified_name] = n
+                surviving_ids = {n.node_id for n in qn_last.values()}
+
+                # Batch-check foreign endpoints against DB (avoids N+1).
+                foreign_ids: set[str] = set()
+                for edge in edges:
+                    if edge.source_node_id not in surviving_ids:
+                        foreign_ids.add(edge.source_node_id)
+                    if edge.target_node_id not in surviving_ids:
+                        foreign_ids.add(edge.target_node_id)
+
+                db_ids: set[str] = set()
+                if foreign_ids:
+                    placeholders = ",".join("?" * len(foreign_ids))
+                    rows = self._db.execute(
+                        f"SELECT node_id FROM graph_nodes "
+                        f"WHERE node_id IN ({placeholders})",
+                        tuple(foreign_ids),
+                    )
+                    db_ids = {row["node_id"] for row in rows}
+
+                valid_ids = surviving_ids | db_ids
+                dropped = 0
+                for edge in edges:
+                    if (
+                        edge.source_node_id in valid_ids
+                        and edge.target_node_id in valid_ids
+                    ):
+                        self._db.upsert_edge(edge)
+                    else:
+                        dropped += 1
+                        logger.debug(
+                            "commit_build_batch: dropped dangling edge "
+                            "%s→%s for %s",
+                            edge.source_node_id, edge.target_node_id, fp,
+                        )
+                if dropped:
+                    total_dropped += dropped
+                    logger.debug(
+                        "commit_build_batch: %d dangling edge(s) dropped for %s",
+                        dropped, fp,
+                    )
+
+        if total_dropped:
+            logger.debug(
+                "commit_build_batch: total %d dangling edges dropped across "
+                "batch of %d files",
+                total_dropped, len(batch),
+            )
+        logger.debug("commit_build_batch: committed %d files", len(batch))
+
     def remove_file(self, file_path: str) -> None:
         """Remove all graph data for *file_path*.