[community-bleeding-edge] Integrate safe community PRs through Batch 3

[thedotmack]

Scope

This PR is the Community Bleeding Edge integration branch through Batch 3 only. It is not the full final bleeding-edge plan from #3139. Conflicting batches 4-9 remain to be handled separately after this checkpoint.

Plan issue: #3139
Branch SHA at PR open: a941ac7

Merged PRs

Batch 1: #3136, #3084, #3018, #2884.

Batch 2: #3112, #3108, #3099, #3095, #3061, #3055, #3006, #2998, #2945, #2944, #2890, #2889, #2887, #2830, #2775.

Batch 3: #3125, #3093, #3079, #3058, #3041, #3023, #3015, #3005, #2981, #2936, #2930, #2902, #2886, #2856, #2777, #2700, #2692, #2633, #2619, #2580.

Held or blocked

• fix: the express api endpoints in serverv1routes in ServerV1Routes.ts #3008: blocked after safety/review concerns around rate-limit behavior and tests.
• fix: the worker service exposes /api/health and /api... in... #2575: held because scanner-authored security change had unresolved localhost guard concerns.
• fix(packaging): bundle plugin/node_modules so marketplace install ships runtime deps (closes #2407) #2531: held because maintainer comment blocks it as-is and it adds install/native packaging risk.
• fix(build): ship & harden plugin/node_modules so hooks resolve zod/v3 (#2379) #2710: held because it introduces runtime/build-time install self-heal behavior.
• test(worker): guard in-memory buffer reclaim #2951: held because it is still draft.
• Add Related Resources section with Vexilo field guide #3103 and Add MseeP.ai badge #3003: held as default promotional/spam-review holds.

Remaining work

Batches 4-9 remain. This branch intentionally stops at the verified Batch 3 checkpoint so review can focus on the safe mergeable community PR set integrated so far.

Verification summary

Passed before opening this PR:

• npm install --no-audit --no-fund: up to date.
• npm run typecheck: passed.
• npm run build: passed.
• bun test: 2389 pass, 15 skip, 0 fail.
• npm run test:context: 74 pass.
• npm run test:search: 41 pass.
• npm run test:server: 162 pass, 13 skip.
• npm run test:sqlite: 63 pass.
• npm run test:agents: 23 pass.
• npm run test:infra: 200 pass.
• npm run lint:hook-io: passed.
• npm run lint:spawn-env: passed.
• npm run check:postinstall-allowlist: passed, 26 plugin deps checked.
• cd plugin && bun install --frozen-lockfile --ignore-scripts: no changes.
• npm run smoke:clean-room: passed.
• npm run e2e:server:docker: passed on final retry, run 1783236993-9289.

Docker notes:

• First Docker attempt was blocked by another worktree holding fixed port 37877: Bind for :::37877 failed: port is already allocated.
• Second retry reached phase 1 then exited 137 during key revocation.
• Final retry passed phase 1, phase 2, and local-dev auth rejection inside Docker.

Safety checks

• No conflict markers.
• No Vexilo/MseeP promotional strings.
• No Add Related Resources section with Vexilo field guide #3103/Add MseeP.ai badge #3003 merge commits.
• No new package manifest install-script entries.
• Hook I/O, spawn-env, and postinstall allowlist checks passed.

[greptile-apps]

Greptile Summary

This PR integrates the Batch 1-3 community changes. The main changes are:

• Kiro CLI hook support, installer flows, MCP/skills registration, and a Kiro-backed provider.
• Codex/Kiro provider and provider-status updates for CLI-authenticated compression paths.
• Smart-explore parser/runtime hardening, including C# tree-sitter grammar support and tree-sitter CLI provisioning.
• Worker startup resilience for stale or invalid port bindings.
• First-run search welcome guidance, project-name override support, UI/settings updates, docs, and expanded tests.

Confidence Score: 5/5

This PR appears safe to merge.

No accepted bug findings remain in the reviewed changed paths. The major installer, provider, hook, parser, worker-spawn, and settings changes include targeted tests. The added C# tree-sitter dependency was checked against external package metadata.

No files require special attention.

T-Rex Logs

What T-Rex did

• T-Rex produced a finding-comment-proof for a posted P1 finding.
• T-Rex ran the verification suite and captured results showing safety checks and focused tests completed, with one parser test failing to extract symbols and a direct runtime repro confirming no symbols were produced.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
package.json	Updates packaged artifacts and adds C# tree-sitter grammar/runtime script allowlist.
src/cli/adapters/kiro.ts	Adds Kiro hook payload normalization and raw-context output handling.
src/services/integrations/KiroCliInstaller.ts	Adds Kiro CLI installation, hook merging, MCP/skills registration, observer agent creation, and uninstall/status paths.
src/services/worker/KiroProvider.ts	Adds a Kiro CLI-backed compression provider with observer chat isolation and output cleanup.
src/npx-cli/install/setup-runtime.ts	Adds tree-sitter-cli executable provisioning and install-current validation.
src/services/worker-spawner.ts	Adds pre-spawn bind probing for stale or invalid worker port bindings.
src/services/worker/http/routes/SearchRoutes.ts	Adds first-run credential guidance while exempting CLI-auth providers.
src/services/smart-file-read/parser.ts	Extends smart file parsing with C# language detection, grammar resolution, and symbol queries.
src/supervisor/env-sanitizer.ts	Preserves proxy environment variables for subprocesses.
src/utils/project-name.ts	Adds project-name override support via .claude-mem.json.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
participant Kiro as Kiro CLI hooks
participant Hook as worker-service.cjs hook kiro
participant Adapter as kiroAdapter
participant Handler as Hook handlers
participant Worker as claude-mem worker API
participant Provider as KiroProvider
participant CLI as kiro-cli chat

Kiro->>Hook: agentSpawn / userPromptSubmit / postToolUse / stop JSON
Hook->>Adapter: normalizeInput(raw payload + KIRO_SESSION_ID)
Adapter-->>Hook: normalized cwd, sessionId, prompt/tool fields
Hook->>Handler: execute normalized event
Handler->>Worker: init, observation, summarize, or context request
Worker-->>Handler: hook result / additional context
Handler-->>Hook: HookResult
Hook->>Adapter: formatOutput(result)
Adapter-->>Kiro: raw context for context events, empty output otherwise
Worker->>Provider: "compression/generation request when provider=kiro"
Provider->>CLI: spawn `kiro-cli chat --no-interactive --agent claude-mem-observer`
CLI-->>Provider: styled stdout
Provider-->>Worker: cleaned model text

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
participant Kiro as Kiro CLI hooks
participant Hook as worker-service.cjs hook kiro
participant Adapter as kiroAdapter
participant Handler as Hook handlers
participant Worker as claude-mem worker API
participant Provider as KiroProvider
participant CLI as kiro-cli chat

Kiro->>Hook: agentSpawn / userPromptSubmit / postToolUse / stop JSON
Hook->>Adapter: normalizeInput(raw payload + KIRO_SESSION_ID)
Adapter-->>Hook: normalized cwd, sessionId, prompt/tool fields
Hook->>Handler: execute normalized event
Handler->>Worker: init, observation, summarize, or context request
Worker-->>Handler: hook result / additional context
Handler-->>Hook: HookResult
Hook->>Adapter: formatOutput(result)
Adapter-->>Kiro: raw context for context events, empty output otherwise
Worker->>Provider: "compression/generation request when provider=kiro"
Provider->>CLI: spawn `kiro-cli chat --no-interactive --agent claude-mem-observer`
CLI-->>Provider: styled stdout
Provider-->>Worker: cleaned model text

Loading

Comments Outside Diff (1)

1. General comment

   Smart file parser returns no TypeScript symbols under unwritable user cache regression scenario

   • Bug
     • The focused regression test tests/services/smart-file-read/parser.test.ts fails in this checkout. It sets XDG_CACHE_HOME=/dev/null/claude-mem-unwritable-cache and calls parseFile() on a TypeScript fixture containing an exported function and class. The parser returns parsed.symbols.map(...) === [] instead of ["smartExploreProbe", "ProbeClass"], and the class method child run is therefore also unavailable. A direct bun -e repro of the same parseFile() call produced the same empty symbol list.
   • Cause
     • The failure is anchored to src/services/smart-file-read/parser.ts's tree-sitter query path. runBatchQuery() catches tree-sitter execution failures and returns an empty match map, causing a symbol-less folded view. The changed cache handling intends to force a writable process-local cache via XDG_CACHE_HOME: getTreeSitterCacheDir(), but in this environment the TypeScript grammar query still produces no matches for the fixture.
   • Fix
     • Make the tree-sitter invocation robust for the unwritable-user-cache scenario and avoid silently degrading to empty symbols for installed grammars. Capture/log the underlying tree-sitter stderr during test/debugging, verify getTreeSitterBin() resolves the installed CLI and resolveGrammarPath('typescript') points to a valid grammar, and adjust the cache/env or grammar path handling so the TypeScript query returns function/class/method captures with XDG_CACHE_HOME originally unwritable.

   _{Ran code and verified through T-Rex}

_{Reviews (2): Last reviewed commit: "fix(worker): suppress credential warning..." | Re-trigger Greptile}

[thedotmack]

Babysit update after a20d1ac44:

• Addressed the Greptile P1 for CLI-auth providers: CLAUDE_MEM_PROVIDER=codex, codex-cli, kiro, and kiro-cli no longer show the API credential warning on the no-memory welcome path.
• Added targeted route coverage in tests/worker/http/routes/search-routes-welcome-hint.test.ts.
• Regenerated plugin/scripts/worker-service.cjs with npm run build.
• Rechecked the Greptile outside-diff parser note locally: bun test tests/services/smart-file-read/parser.test.ts passes (1 pass, 0 fail) under its unwritable cache test case, so I am treating that note as stale/not reproducible on this head unless CI or a reviewer provides a failing log for a20d1ac44.

[thedotmack]

Final babysit sweep for a20d1ac44:

• GitHub checks are green on the latest head: typecheck · build · test · bundle-size, Windows build, clean-room dependency closure smoke, and server-runtime e2e (docker · pg + valkey) all pass. Mintlify is skipped.
• Unresolved review threads: 0.
• Direct parser repro for the Greptile outside-diff note passes locally with XDG_CACHE_HOME=/dev/null/claude-mem-unwritable-cache: parseFile() returns smartExploreProbe and ProbeClass with child method run.
• Local focused checks also pass: bun test tests/worker/http/routes/search-routes-welcome-hint.test.ts, bun test tests/services/smart-file-read/parser.test.ts, npm run typecheck, and npm run build.

[thedotmack]

Promoted to long-lived branch community-edge; this is now a permanent release line, not a merge-to-main. See the Release Branches doc.