shadowdaoandClaude Opus 5
c3bbea5134
memory.get no longer returns the embedding and content_tsv ---------------------------------------------------------- It used a bare select() and returned the raw DB row, while memory.list and memory.search already projected an explicit 9-field shape. On a ~13k-char memory those two internal columns were 55% of the response and pushed it past the MCP tool-output cap, so large memories could not be fetched inline at all. memory.get now returns the same 9 fields as its siblings; user_id is still selected for the authorization check and stripped before responding. memory.patch ------------ memory.update only accepts full replacement, so adding one line to a large document meant resending the whole document — expensive enough that edits were being skipped rather than risk silently truncating shared team documents. memory.patch replaces one exact occurrence of old_string. An absent or ambiguous match is an error, never a silent no-op and never an arbitrary pick; that refusal is what makes the operation safe to hand to an agent. The semantics live in lib/memory-patch.ts as a pure function, free of DB and auth, so both surfaces share them. Shared mutation layer --------------------- The MCP tools and the Web UI Server Actions each reimplemented authorize -> mutate -> re-embed -> CAS -> audit, and had drifted. Both now route through lib/memory-mutations.ts. BEHAVIOUR CHANGE: memory.delete over MCP skipped the project ACL whenever the caller authored the row, so a memory written while a share was rw stayed deletable by its author after an owner downgraded that share to ro. memory.update and the whole Web UI always checked. Authoring a row now grants no standing write privilege on any path. The one deliberate difference between the surfaces is injected as a ProjectResolver: MCP refuses an unknown project key so an agent cannot spawn near-miss projects off a typo, while the Web UI creates one because a person typing a name into a form means to. Tests and lint -------------- Adds vitest. The integration tests run against a real Postgres rather than a mocked DB. The embedder sidecar is the only stub and it is deterministic per-text, so re-embedding is verified by asserting the stored vector actually changed rather than that a mock was called. One test pins that content_tsv is a generated column and therefore cannot rot after a patch — only the embedding needs an explicit recompute. pnpm lint previously dropped into an interactive `next lint` setup prompt and exited 1; ESLint had never been configured here. Replaced with the ESLint CLI and a flat config bridging eslint-config-next through FlatCompat. Clean at --max-warnings=0. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
46 lines
1.2 KiB
JSON
46 lines
1.2 KiB
JSON
{
|
|
"name": "@shared-memory/web",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "next dev --port 3000",
|
|
"build": "next build",
|
|
"start": "next start --port 3000",
|
|
"lint": "eslint .",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest",
|
|
"typecheck": "tsc --noEmit",
|
|
"db:generate": "drizzle-kit generate",
|
|
"db:migrate": "tsx ./scripts/migrate.ts",
|
|
"db:studio": "drizzle-kit studio"
|
|
},
|
|
"dependencies": {
|
|
"@modelcontextprotocol/sdk": "^1.0.4",
|
|
"@shared-memory/schemas": "workspace:*",
|
|
"drizzle-orm": "^0.36.4",
|
|
"jose": "^5.9.6",
|
|
"next": "^15.1.0",
|
|
"next-auth": "5.0.0-beta.25",
|
|
"postgres": "^3.4.5",
|
|
"react": "^19.0.0",
|
|
"react-dom": "^19.0.0",
|
|
"zod": "^3.23.8"
|
|
},
|
|
"devDependencies": {
|
|
"@eslint/eslintrc": "^3.3.6",
|
|
"@tailwindcss/postcss": "^4.0.0",
|
|
"@types/node": "^22.10.2",
|
|
"@types/react": "^19.0.2",
|
|
"@types/react-dom": "^19.0.2",
|
|
"drizzle-kit": "^0.30.1",
|
|
"esbuild": "^0.24.2",
|
|
"eslint": "^9.17.0",
|
|
"eslint-config-next": "^15.1.0",
|
|
"tailwindcss": "^4.0.0",
|
|
"tsx": "^4.19.2",
|
|
"typescript": "^5.7.2",
|
|
"vitest": "^2"
|
|
}
|
|
}
|