From 30194463b5c59a71dc2a47f72008f74218d35cf3 Mon Sep 17 00:00:00 2001 From: John Knapp Date: Fri, 12 Jun 2026 11:38:13 -0700 Subject: [PATCH 1/3] fix: bind memory.list tag filter as a single text[] param (#1) memory.list built its tag filter with a raw sql template: sql`${memories.tags} @> ${tags}::text[]` Drizzle expands a JS array embedded in a sql template into positional params, so one tag produced `@> ($1)::text[]` (Postgres rejected the bound string as a malformed array literal) and two tags produced `@> ($1,$2)::text[]` (a record, hence "cannot cast type record to text[]"). Switch to arrayContains(memories.tags, tags), which binds the array as one text[] param via the column's toDriver and preserves the "require ALL tags" (@>) semantics. Co-Authored-By: Claude Opus 4.8 (1M context) --- apps/web/lib/mcp/tools.ts | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/apps/web/lib/mcp/tools.ts b/apps/web/lib/mcp/tools.ts index 0ec4e00..6e4e8ac 100644 --- a/apps/web/lib/mcp/tools.ts +++ b/apps/web/lib/mcp/tools.ts @@ -1,4 +1,4 @@ -import { and, desc, eq, inArray, isNull, or, sql } from "drizzle-orm"; +import { and, arrayContains, desc, eq, inArray, isNull, or } from "drizzle-orm"; import { db } from "@/lib/db/client"; import { memories, @@ -465,7 +465,13 @@ const memoryList: ToolDef = { } if (parsed.data.tags && parsed.data.tags.length > 0) { - where.push(sql`${memories.tags} @> ${parsed.data.tags}::text[]`); + // Require ALL listed tags (array containment). Use Drizzle's + // arrayContains so the JS array binds as a single text[] param + // (via the column's toDriver) rather than being expanded into + // positional params — a raw `${tags}::text[]` template expands to + // `($1)::text[]` / `($1,$2)::text[]`, which Postgres rejects as a + // malformed array literal / record cast. + where.push(arrayContains(memories.tags, parsed.data.tags)); } const rows = await db From 86433afe1fcc1531a828df1c54b24079eafd0157 Mon Sep 17 00:00:00 2001 From: John Knapp Date: Fri, 12 Jun 2026 11:38:22 -0700 Subject: [PATCH 2/3] =?UTF-8?q?fix:=20list=20shared=20projects=20(owned=20?= =?UTF-8?q?=E2=88=AA=20shared)=20in=20Web=20UI=20project=20list=20(#2)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Projects page filtered with eq(projects.userId, userId), so a user with an rw (or ro) share on someone else's project never saw it in the list — even though project.identify already returned {shared, access} for the same project. Switch to getAccessibleProjects(userId, groupNames) (owner ∪ group-shared, the same helper search/memories use) and aggregate counts over that id set, and label non-owned rows with a 'shared · ro|rw' badge. Co-Authored-By: Claude Opus 4.8 (1M context) --- apps/web/app/(authed)/projects/page.tsx | 53 ++++++++++++++++--------- 1 file changed, 35 insertions(+), 18 deletions(-) diff --git a/apps/web/app/(authed)/projects/page.tsx b/apps/web/app/(authed)/projects/page.tsx index 2a6f1c1..7ebd91b 100644 --- a/apps/web/app/(authed)/projects/page.tsx +++ b/apps/web/app/(authed)/projects/page.tsx @@ -1,8 +1,9 @@ import Link from "next/link"; -import { and, desc, eq, isNull, sql } from "drizzle-orm"; +import { and, desc, eq, inArray, isNull, sql } from "drizzle-orm"; import { auth } from "@/auth"; import { db } from "@/lib/db/client"; import { memories, projects } from "@/lib/db/schema"; +import { getAccessibleProjects, getUserGroupNames } from "@/lib/access"; import { Container, PageHeader } from "@/app/_components/ui/container"; import { Card } from "@/app/_components/ui/card"; import { Badge } from "@/app/_components/ui/badge"; @@ -13,24 +14,37 @@ export const dynamic = "force-dynamic"; export default async function ProjectsPage() { const session = await auth(); const userId = session!.user.id; + const groupNames = await getUserGroupNames(userId); - const rows = await db - .select({ - id: projects.id, - key: projects.key, - displayName: projects.displayName, - createdAt: projects.createdAt, - memoryCount: sql`count(${memories.id})::int`, - lastActivity: sql`max(${memories.createdAt})`, - }) - .from(projects) - .leftJoin( - memories, - and(eq(memories.projectId, projects.id), isNull(memories.deletedAt)), - ) - .where(eq(projects.userId, userId)) - .groupBy(projects.id) - .orderBy(desc(sql`max(${memories.createdAt})`)); + // The project list is owned ∪ shared: projects the user owns PLUS + // projects shared with one of their groups (any access). Visibility was + // previously owner-only (`eq(projects.userId, userId)`), which hid + // projects another user shared in via project_shares even though + // project.identify already reported them as {shared, access}. + const accessible = await getAccessibleProjects(userId, groupNames); + const accessById = new Map(accessible.map((p) => [p.projectId, p.access])); + const accessibleIds = accessible.map((p) => p.projectId); + + const rows = + accessibleIds.length === 0 + ? [] + : await db + .select({ + id: projects.id, + key: projects.key, + displayName: projects.displayName, + createdAt: projects.createdAt, + memoryCount: sql`count(${memories.id})::int`, + lastActivity: sql`max(${memories.createdAt})`, + }) + .from(projects) + .leftJoin( + memories, + and(eq(memories.projectId, projects.id), isNull(memories.deletedAt)), + ) + .where(inArray(projects.id, accessibleIds)) + .groupBy(projects.id) + .orderBy(desc(sql`max(${memories.createdAt})`)); return ( @@ -57,6 +71,9 @@ export default async function ProjectsPage() {
{p.key} {p.memoryCount} + {accessById.get(p.id) !== "owner" ? ( + shared · {accessById.get(p.id)} + ) : null}
{p.displayName && p.displayName !== p.key ? (
{p.displayName}
From b3f7e6006e19eb56bc030c6b0f6aaa87e9d9ab63 Mon Sep 17 00:00:00 2001 From: John Knapp Date: Fri, 12 Jun 2026 11:46:44 -0700 Subject: [PATCH 3/3] fix: snippet.list tag filter (same array-binding bug as memory.list) (#1) Replace the raw `${snippets.tags} @> ${tags}::text[]` template with Drizzle's arrayContains, matching the memory.list fix. The raw template expanded the JS array into positional params, producing a malformed array literal (one tag) / record-cast error (two tags) at runtime. Co-Authored-By: Claude Opus 4.8 (1M context) --- apps/web/lib/snippets.ts | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/apps/web/lib/snippets.ts b/apps/web/lib/snippets.ts index 668aab8..4fba1a7 100644 --- a/apps/web/lib/snippets.ts +++ b/apps/web/lib/snippets.ts @@ -1,4 +1,4 @@ -import { and, desc, eq, inArray, isNull, or, sql } from "drizzle-orm"; +import { and, arrayContains, desc, eq, inArray, isNull, or } from "drizzle-orm"; import { db } from "@/lib/db/client"; import { snippets, projects } from "@/lib/db/schema"; import type { Snippet } from "@/lib/db/schema"; @@ -349,7 +349,13 @@ export async function listSnippets( } if (tags && tags.length > 0) { - where.push(sql`${snippets.tags} @> ${tags}::text[]`); + // Require ALL listed tags (array containment). Use Drizzle's + // arrayContains so the JS array binds as a single text[] param + // (via the column's toDriver) rather than being expanded into + // positional params — a raw `${tags}::text[]` template expands to + // `($1)::text[]` / `($1,$2)::text[]`, which Postgres rejects as a + // malformed array literal / record cast. + where.push(arrayContains(snippets.tags, tags)); } const rows = await db