trusty-memory 0.15.0

//! CLI entry point for the `trusty-memory` binary.
//!
//! Why: ship a thin clap-to-handler shim so users can `cargo install
//! trusty-memory` and invoke `trusty-memory serve` (the HTTP/SSE daemon
//! consumed by Claude Code via the `trusty-memory-mcp-bridge` companion
//! binary) or `trusty-memory migrate kuzu-memory` (which rewrites Claude
//! settings files that still reference the legacy kuzu-memory MCP server).
//! All real logic lives in the library and the `commands::migrate` module —
//! this file does CLI parsing and dispatch only.
//! What: defines a `clap::Parser` with `serve` and `migrate` subcommands.
//! `serve` defers to `trusty_memory::run_http` / `run_http_dynamic`;
//! Claude Code talks to the daemon through the `trusty-memory-mcp-bridge`
//! stdio-to-UDS pipe (PR #149). `migrate` defers to
//! `commands::migrate::handle_migrate`.
//! Test: `cargo run -p trusty-memory -- --help` lists both subcommands.
//! `cargo run -p trusty-memory -- migrate kuzu-memory --dry-run` exercises
//! the migrate path end-to-end without modifying any files.

use anyhow::Result;
use clap::{Parser, Subcommand};
use std::net::SocketAddr;
use trusty_memory::commands::inbox_check::handle_inbox_check;
use trusty_memory::commands::link::handle_link;
use trusty_memory::commands::migrate::{handle_migrate, MigrateTarget};
use trusty_memory::commands::note::handle_note;
use trusty_memory::commands::prompt_context::handle_prompt_context;
use trusty_memory::commands::send_message::handle_send_message;
use trusty_memory::commands::service::{handle_service, ServiceAction};
use trusty_memory::commands::setup::handle_setup;
use trusty_memory::commands::start::handle_start;
use trusty_memory::commands::stop::handle_stop;
use trusty_memory::commands::upgrade::handle_upgrade;
use trusty_memory::{resolve_palace_registry_dir, run_http, run_http_dynamic, AppState};

/// Top-level CLI for `trusty-memory`.
#[derive(Debug, Parser)]
#[command(
    name = "trusty-memory",
    version,
    about = "Memory palace MCP server + migration utility",
    long_about = "MCP server (stdio + HTTP/SSE) for trusty-memory, plus a \
                  `migrate kuzu-memory` subcommand that rewrites Claude \
                  settings files referencing the legacy kuzu-memory server."
)]
struct Cli {
    /// Increase tracing verbosity (`-v` = debug, `-vv` = trace).
    #[arg(short, long, action = clap::ArgAction::Count, global = true)]
    verbose: u8,

    #[command(subcommand)]
    command: Command,
}

/// Top-level subcommands.
///
/// Why: keep the surface small and mirror the `trusty-search` pattern so
/// users moving between the two tools have a consistent experience.
/// What: `serve` runs the MCP server; `migrate` rewrites Claude settings.
/// Test: clap's `--help` output enumerates both.
#[derive(Debug, Subcommand)]
enum Command {
    /// Start the HTTP daemon in the background and return control to the shell.
    ///
    /// Why: matches `trusty-search start` so the trusty-* daemons share a
    /// `start` / `serve` / `stop` surface. The detached child runs
    /// `serve --foreground` so it does not respawn recursively.
    Start,

    /// Stop every running trusty-memory daemon process.
    ///
    /// Why: with `start` now self-spawning a detached daemon, operators need a
    /// way to take it down that does not depend on launchd / systemd.
    Stop,

    /// Run the daemon.
    ///
    /// Default mode is HTTP/SSE with dynamic port selection (7070..=7079, OS
    /// fallback). Without `--foreground`, `serve` self-spawns a detached
    /// background daemon (alias for `start`) and returns immediately so the
    /// parent shell gets its prompt back. Pass `--foreground` to keep the
    /// daemon in the foreground (used internally by `start` to host the
    /// actual HTTP server, and by launchd / systemd). Pass `--http <ADDR>`
    /// to bind a specific address.
    ///
    /// Claude Code integration: install the `trusty-memory-mcp-bridge`
    /// binary into your `.mcp.json` — it pipes stdio between Claude Code
    /// and the daemon over a Unix domain socket (PR #149). The legacy
    /// `serve --stdio` flag was removed in PR for #150 because it
    /// deadlocked on the redb exclusive write lock whenever a daemon was
    /// already running.
    Serve {
        /// Bind the HTTP/SSE server to a specific address. When omitted,
        /// the daemon binds dynamically.
        #[arg(long, value_name = "ADDR")]
        http: Option<SocketAddr>,

        /// Run the HTTP daemon in the foreground (do not self-spawn).
        ///
        /// Why: `serve` defaults to background mode so the trusty-* daemons
        /// share a `start` / `serve` UX. Long-running supervisors (launchd,
        /// systemd, Docker) need a foreground process to manage, so they
        /// pass `--foreground` to opt out of the spawn.
        #[arg(long)]
        foreground: bool,

        /// Bind every MCP tool call to this palace when the caller omits the
        /// `palace` argument.
        #[arg(long, value_name = "NAME")]
        palace: Option<String>,
    },

    /// Migrate from another memory MCP server to trusty-memory.
    ///
    /// For `kuzu-memory`: rewrites Claude `mcpServers` config entries.
    /// For `kuzu-data`: imports entity/relation data from a kuzu-memory
    /// `store.redb` file into a trusty-memory palace (requires `--from`
    /// and `--palace`).
    Migrate {
        /// What to migrate from.
        #[arg(value_enum)]
        target: MigrateTarget,

        /// Print what would change without writing any files.
        #[arg(long)]
        dry_run: bool,

        /// Accepted for parity with `trusty-search migrate`. Today the
        /// migration only has a config phase, so this flag is a no-op.
        #[arg(long)]
        config_only: bool,

        /// Path to the kuzu-memory `store.redb` file (required for
        /// `kuzu-data`).
        #[arg(long, value_name = "PATH")]
        from: Option<std::path::PathBuf>,

        /// Target palace name to import into (required for `kuzu-data`).
        /// The palace is created if it does not already exist.
        #[arg(long, value_name = "NAME")]
        palace: Option<String>,

        /// Maximum number of entities to import (default: import all).
        #[arg(long, value_name = "N")]
        limit: Option<usize>,
    },

    /// First-time setup: data dir + launchd (macOS) + Claude settings patch.
    Setup,

    /// Print the daemon's prompt-context block to stdout (Claude Code hook).
    ///
    /// Why: installed as a Claude Code `UserPromptSubmit` hook by
    /// `trusty-memory setup`. Claude Code injects whatever the hook writes to
    /// stdout as additional context for the next prompt, so this command
    /// fetches the daemon's pre-formatted prompt-context block and prints it
    /// verbatim. Every failure path exits 0 silently so the hook can never
    /// block a Claude Code prompt; the `CLAUDE_MPM_SUB_AGENT` env var also
    /// short-circuits this command to keep nested MPM agents from piling on
    /// duplicate prompt-context blocks.
    /// What: see `commands::prompt_context::handle_prompt_context`.
    /// Test: covered by the unit test in that module plus the integration
    /// path `cargo run -p trusty-memory -- prompt-context` against a live
    /// daemon.
    #[command(name = "prompt-context")]
    PromptContext,

    /// Diagnose daemon health: fastembed cache, launchd plist, HTTP /health,
    /// and stale palace locks. With `--fix-palaces`, audit existing palaces
    /// for project-mapping compliance (issue #88).
    ///
    /// Why: GH #62 / #88 — silent failures (missing `FASTEMBED_CACHE_PATH` in
    /// the plist, missing model cache, daemon not bound) currently force users
    /// to grep through several directories by hand. `doctor` runs the
    /// equivalent checks in one shot. `--fix-palaces` layers in the palace =
    /// project audit so users can see which palaces are orphaned (no matching
    /// project directory on disk).
    /// What: a one-shot CLI command that prints a ✅/❌ line per check and
    /// exits non-zero on any failure. See `commands::doctor`.
    /// Test: `cargo run -p trusty-memory -- doctor` after `setup`.
    ///       `cargo run -p trusty-memory -- doctor --fix-palaces` for the
    ///       palace audit (read-only by default; add `--fix` to suggest renames).
    Doctor {
        /// Audit existing palaces and report orphaned ones (palaces whose name
        /// does not match any detectable project directory on disk).
        ///
        /// Why: issue #88 — users accumulate palaces across many projects;
        /// `--fix-palaces` surfaces which names are orphaned so they can be
        /// cleaned up manually or via `--fix`.
        #[arg(long)]
        fix_palaces: bool,

        /// Print rename suggestions for orphaned palaces (dry-run by default).
        ///
        /// Why: issue #88 conservative default — users may have data in
        /// orphaned palaces; we never auto-rename without confirmation. `--fix`
        /// prints the "would rename X → Y" suggestions that can then be
        /// executed manually.
        #[arg(long, requires = "fix_palaces")]
        fix: bool,
    },

    /// Manage the macOS launchd LaunchAgent for the daemon.
    Service {
        #[command(subcommand)]
        action: ServiceAction,
    },

    /// Monitor the trusty-memory daemon via web UI or terminal dashboard.
    ///
    /// `monitor web` prints the daemon's admin-panel URL; `monitor tui`
    /// launches the trusty-memory-specific ratatui dashboard: a palace list,
    /// a live dream/recall activity log, and a recall query bar.
    #[command(subcommand_required = true)]
    Monitor {
        #[command(subcommand)]
        target: MonitorTarget,
    },

    /// Send an inter-project message to another palace (issue #99).
    ///
    /// Why: replaces the Python `/mpm-message` skill with a trusty-memory
    /// native primitive. Writes a tagged drawer into the recipient palace;
    /// the recipient's SessionStart hook picks it up via `inbox-check`.
    ///
    /// Example: `trusty-memory send-message --to claude-mpm --purpose task \
    ///           --content "Please refresh the messaging.db schema"`.
    #[command(name = "send-message")]
    SendMessage {
        /// Recipient palace id (repo slug). Required.
        #[arg(long, value_name = "PALACE")]
        to: String,

        /// Free-text purpose / category (e.g. `task`, `notify`, `reply`).
        #[arg(long, value_name = "PURPOSE")]
        purpose: String,

        /// Message body. Plain text; rendered into the recipient session as
        /// a Markdown block.
        #[arg(long, value_name = "TEXT")]
        content: String,

        /// Sender palace id (defaults to the cwd-derived slug).
        #[arg(long, value_name = "PALACE")]
        from: Option<String>,
    },

    /// Pick up unread inter-project messages for the calling project
    /// (issue #99).
    ///
    /// Why: installed as a Claude Code `SessionStart` hook by
    /// `trusty-memory setup`. Reads the receiver palace's unread messages,
    /// prints them as Markdown to stdout (Claude Code injects stdout as
    /// session context), and marks them read via the daemon's HTTP API.
    /// Every failure path degrades to silence so a slow daemon never blocks
    /// session start.
    ///
    /// `--palace` overrides the cwd-derived slug; useful for test rigs and
    /// for projects whose repo basename does not match their preferred
    /// palace name.
    #[command(name = "inbox-check")]
    InboxCheck {
        /// Receiver palace id (defaults to cwd-derived repo slug).
        #[arg(long, value_name = "PALACE")]
        palace: Option<String>,
    },

    /// Fire-and-forget save of a memory note to the running daemon.
    ///
    /// Why: sub-agents spawned via Claude Code's Agent tool do not inherit
    /// any MCP connections, so the `mcp__trusty-memory__memory_remember`
    /// tool is unreachable to them. They can still execute shell commands,
    /// so this subcommand POSTs to `POST /api/v1/remember` and returns
    /// immediately — the daemon dispatches `memory_remember` on a detached
    /// task. Errors degrade to stderr warnings + zero exit because the
    /// agent has already left the room by the time the write completes.
    ///
    /// Example: `trusty-memory note "User prefers tabs" --palace my-project \
    ///           --tag style --tag preferences`.
    Note {
        /// Drawer body. Required.
        #[arg(value_name = "CONTENT")]
        content: String,

        /// Target palace (defaults to the daemon's `--palace` default when
        /// omitted; required when the daemon was started without one).
        #[arg(long, value_name = "NAME")]
        palace: Option<String>,

        /// Tag to attach to the drawer. Repeatable.
        #[arg(long = "tag", value_name = "TAG")]
        tags: Vec<String>,
    },

    /// Re-run auto-KG extraction across every drawer in a palace.
    ///
    /// Why: Issue #97 — `memory_remember` now extracts triples on write,
    /// but existing palaces sit at zero auto-extracted triples until
    /// back-filled. `kg-rebuild` walks every drawer and re-asserts the
    /// heuristic triples so the visual graph view is immediately useful.
    /// What: Loads palaces from disk, processes each palace (or just one
    /// when `--palace` is supplied), and prints a per-palace summary plus
    /// an aggregate total. Failures on individual asserts are logged but
    /// never abort the run.
    /// Test: `commands::kg_rebuild::tests::kg_rebuild_processes_all_drawers`.
    #[command(name = "kg-rebuild")]
    KgRebuild {
        /// Restrict the rebuild to a single palace id. When omitted, every
        /// palace under the data root is processed.
        #[arg(long, value_name = "ID")]
        palace: Option<String>,
    },

    /// Pin this project's palace slug in `.trusty-tools/trusty-memory.yaml`.
    ///
    /// Why: the lazy write in normal memory operations locks in the slug the
    /// first time a memory is saved. `link` lets you do this explicitly
    /// *before* a directory rename or drive reorg, so the slug is already
    /// committed and the palace linkage never breaks.
    ///
    /// The generated file should be committed to version control; it travels
    /// with the repository regardless of where the directory lives on disk.
    ///
    /// Examples:
    ///   trusty-memory link                        # pin CWD's project
    ///   trusty-memory link --path ~/projects/foo  # pin a specific project
    ///   trusty-memory link --slug custom-slug     # override the derived slug
    ///   trusty-memory link --force                # overwrite existing pin
    Link {
        /// Project directory to pin (default: current directory). The
        /// command walks upward from here to find the project root.
        #[arg(long, value_name = "DIR")]
        path: Option<std::path::PathBuf>,

        /// Override the derived palace slug. When omitted the slug is
        /// derived from the project root's directory basename.
        #[arg(long, value_name = "SLUG")]
        slug: Option<String>,

        /// Optional human note to embed in the pin file
        /// (e.g. "pinned before GDrive reorganisation 2026-06").
        #[arg(long, value_name = "TEXT")]
        note: Option<String>,

        /// Overwrite an existing pin file even when the slug differs.
        /// Without this flag, `link` refuses to overwrite an existing pin
        /// with a different slug to prevent accidental data loss.
        #[arg(long)]
        force: bool,
    },

    /// Print the daemon's listening port (or address) to stdout.
    ///
    /// Reads the address the running daemon persisted to its `http_addr`
    /// discovery file. Useful for shell substitution:
    ///   curl http://127.0.0.1:$(trusty-memory port)/api/v1/health
    ///
    /// Exits non-zero (with a message on stderr) when no daemon is running
    /// or the address file is missing, so substitution fails cleanly.
    ///
    /// Examples:
    ///   trusty-memory port               # bare port: 7070
    ///   trusty-memory port --addr        # host:port: 127.0.0.1:7070
    ///   trusty-memory port --json        # {"addr":"127.0.0.1","port":7070}
    Port {
        /// Emit full `host:port` instead of the bare port number.
        #[arg(long, conflicts_with = "json")]
        addr: bool,

        /// Emit a JSON object: `{"addr":"…","port":…}`.
        #[arg(long, conflicts_with = "addr")]
        json: bool,
    },

    /// Check for or install a new version of trusty-memory.
    ///
    /// Why: Gives operators a single command to go from "I wonder if I'm up
    /// to date" through `cargo install` and daemon restart — without having
    /// to remember the exact `cargo install` invocation.
    ///
    /// Without flags: checks crates.io, shows current → available, prompts
    /// for confirmation, then installs + restarts (if newer exists).
    /// With `--check`: report versions only, no install.
    /// With `--yes`: skip the confirmation prompt.
    ///
    /// After a successful install the daemon restarts automatically when
    /// running under launchd (`KeepAlive::OnSuccess`). When not supervised,
    /// a restart hint is printed instead.
    ///
    /// Examples:
    ///   trusty-memory upgrade               # interactive
    ///   trusty-memory upgrade --check       # report only
    ///   trusty-memory upgrade --yes         # non-interactive
    Upgrade {
        /// Report current and available versions without installing anything.
        #[arg(long)]
        check: bool,

        /// Skip the confirmation prompt and install immediately.
        #[arg(short = 'y', long)]
        yes: bool,
    },
}

/// Target surface for the `monitor` subcommand.
///
/// Why: operators want a quick link to the daemon's web UI, the
/// memory-specific terminal UI, OR the same dashboard data as plain text /
/// JSON so scripts and CI can read it without a TUI (issues #33, #34).
/// What: `Web` prints the daemon's `/ui` URL; `Tui` launches the
/// trusty-memory-specific `trusty_common::monitor::memory_tui` dashboard;
/// `Status` and `Palaces` print scriptable health and per-palace stats.
/// Test: `cargo run -p trusty-memory -- monitor --help` lists every variant.
#[derive(Debug, Subcommand)]
enum MonitorTarget {
    /// Open the web dashboard URL in the terminal (or browser).
    Web,
    /// Launch the trusty-memory terminal UI: palaces, recall, and dream monitor.
    Tui,
    /// Print daemon status: version and aggregate palace/drawer/vector counts.
    ///
    /// Examples:
    ///   trusty-memory monitor status
    ///   trusty-memory monitor status --json
    Status {
        /// Emit the status as a JSON object instead of plain text.
        #[arg(long)]
        json: bool,
    },
    /// List every palace, or show one palace's detail when an ID is given.
    ///
    /// Examples:
    ///   trusty-memory monitor palaces
    ///   trusty-memory monitor palaces default
    ///   trusty-memory monitor palaces --json
    Palaces {
        /// Optional palace ID to show detail for (omit to list all).
        id: Option<String>,
        /// Emit the result as JSON instead of a plain-text table.
        #[arg(long)]
        json: bool,
    },
}

/// Bundled declarative help config (issue #216). Loaded once per process.
///
/// Why: every binary in the workspace embeds its `help.yaml` via
/// `include_str!` so the workspace-shared `trusty_common::help::suggest`
/// helper has a config to consult when the user types an unknown subcommand.
/// What: `LazyLock<HelpConfig>` parsed from `help.yaml` at first access.
/// Test: parse coverage lives in `trusty-common`; this site is exercised
/// manually via `trusty-memory dotor`.
static HELP: std::sync::LazyLock<trusty_common::help::HelpConfig> =
    std::sync::LazyLock::new(|| {
        trusty_common::help::load_help(include_str!("../help.yaml"))
            .expect("trusty-memory help.yaml is bundled and valid")
    });

#[tokio::main]
async fn main() -> Result<()> {
    // Why: parse via `try_parse` so we can attach the workspace-shared
    // "did you mean?" suggestion to clap's standard error rendering before
    // exiting (issue #216).
    let argv: Vec<String> = std::env::args().collect();
    let cli = match Cli::try_parse() {
        Ok(cli) => cli,
        Err(e) => {
            e.print().ok();
            if matches!(
                e.kind(),
                clap::error::ErrorKind::InvalidSubcommand | clap::error::ErrorKind::UnknownArgument
            ) {
                trusty_common::help::print_suggestion_hint(&argv, &HELP);
            }
            std::process::exit(e.exit_code());
        }
    };
    // Issue #35: initialise tracing with an in-memory `LogBuffer` so the HTTP
    // daemon's `GET /api/v1/logs/tail` endpoint can serve recent logs. The
    // buffer-backed subscriber still writes the standard `fmt` layer to
    // stderr, so non-HTTP subcommands (and the MCP stdio path, which must
    // keep stdout clean) are unaffected. The buffer is only wired into the
    // `AppState` on the HTTP serve path.
    //
    // Bug-reporting #478 (Phase 1 wire-up): compose the bug-capture layer in
    // the same registry so all three layers are installed in one `try_init`.
    // The `ErrorStore` is forwarded to `run_serve` which stashes it in
    // `AppState` so Phase 2 can expose it via HTTP / MCP tools.
    let (log_buffer, error_store) = trusty_common::init_tracing_with_buffer_and_capture(
        cli.verbose,
        trusty_common::log_buffer::DEFAULT_LOG_CAPACITY,
        "trusty-memory",
        env!("CARGO_PKG_VERSION"),
    );

    // Update check: emitted only for human-facing subcommands. `serve`
    // (foreground) is the long-running HTTP/MCP daemon — stdout/stderr are
    // owned by the supervisor or the JSON-RPC framing, so we must not print
    // anything there. `start` self-spawns a detached `serve --foreground`
    // child and exits immediately; the very brief window makes the notice
    // useless. `upgrade` does its own fresh check, so we skip the throttled
    // notice to avoid a redundant second check on the same run.
    // The check is throttled to once per 24 h (on-disk cache), so on a
    // typical run this is a sub-millisecond cache-hit with no network I/O.
    let is_daemon_path = matches!(cli.command, Command::Serve { .. } | Command::Start);
    let is_upgrade = matches!(cli.command, Command::Upgrade { .. });
    if !is_daemon_path && !is_upgrade {
        if let Some(info) = trusty_common::update::check_throttled(
            env!("CARGO_PKG_NAME"),
            env!("CARGO_PKG_VERSION"),
        )
        .await
        {
            eprintln!("{}", trusty_common::update::notice(&info));
        }
    }

    match cli.command {
        Command::Start => handle_start().await,
        Command::Stop => handle_stop().await,
        Command::Serve {
            http,
            foreground,
            palace,
        } => run_serve(http, foreground, palace, log_buffer, error_store).await,
        Command::Migrate {
            target,
            dry_run,
            config_only,
            from,
            palace,
            limit,
        } => handle_migrate(target, dry_run, config_only, from, palace, limit),
        Command::Setup => handle_setup(),
        Command::PromptContext => handle_prompt_context().await,
        Command::Service { action } => handle_service(&action),
        Command::Doctor { fix_palaces, fix } => {
            if fix_palaces {
                trusty_memory::commands::doctor::handle_doctor_fix_palaces(fix).await?;
            }
            trusty_memory::commands::doctor::handle_doctor().await
        }
        Command::Monitor { target } => run_monitor(target).await,
        Command::SendMessage {
            to,
            purpose,
            content,
            from,
        } => handle_send_message(to, purpose, content, from).await,
        Command::InboxCheck { palace } => handle_inbox_check(palace).await,
        Command::Note {
            content,
            palace,
            tags,
        } => handle_note(content, palace, tags).await,
        Command::KgRebuild { palace } => {
            trusty_memory::commands::kg_rebuild::handle_kg_rebuild(palace).await
        }
        Command::Link {
            path,
            slug,
            note,
            force,
        } => handle_link(path, slug, note, force),
        Command::Port { addr, json } => {
            let format = if json {
                trusty_memory::commands::port::PortFormat::Json
            } else if addr {
                trusty_memory::commands::port::PortFormat::Addr
            } else {
                trusty_memory::commands::port::PortFormat::Port
            };
            trusty_memory::commands::port::handle_port(format)
        }
        Command::Upgrade { check, yes } => handle_upgrade(check, yes).await,
    }
}

/// Dispatch the `monitor` subcommand.
///
/// Why: keeps `main` focused on parsing while putting the daemon-address
/// discovery and dashboard launch in one place.
/// What: `Web` delegates to `daemon_guard::open_web_dashboard` which
/// auto-starts the daemon when not running, then opens the browser.
/// `Tui` launches the trusty-memory-specific
/// `trusty_common::monitor::memory_tui` ratatui dashboard; `Status` and
/// `Palaces` print scriptable health and per-palace stats via the
/// `commands::monitor` handlers.
/// Test: not unit-tested (process-level entry point); `cargo run -p
/// trusty-memory -- monitor web` with no daemon auto-starts it then opens
/// the browser.
async fn run_monitor(target: MonitorTarget) -> Result<()> {
    use trusty_memory::commands::monitor;
    match target {
        MonitorTarget::Web => trusty_memory::commands::daemon_guard::open_web_dashboard().await,
        MonitorTarget::Tui => trusty_common::monitor::memory_tui::run().await,
        MonitorTarget::Status { json } => monitor::handle_status(json).await,
        MonitorTarget::Palaces { id, json } => monitor::handle_palaces(id, json).await,
    }
}

/// Dispatch `serve` to the HTTP server (background spawn or inline foreground).
///
/// Why: keeps `main` focused on parsing while putting the `AppState`
/// construction in one place. Issue #150 removed the legacy `--stdio` flag
/// — Claude Code now talks to the daemon through the
/// `trusty-memory-mcp-bridge` binary (PR #149) over a Unix domain socket,
/// which sidesteps the redb exclusive-lock deadlock that made the in-process
/// stdio path unusable whenever a long-lived daemon was already running.
/// What: resolves the palace registry directory (descending into the legacy
/// `palaces/` subdirectory when present — see `resolve_palace_registry_dir`),
/// builds an `AppState` rooted there, applies the `--palace` default if any,
/// re-hydrates every persisted palace, wires the issue-#35 `LogBuffer` so
/// `GET /api/v1/logs/tail` serves captured logs, and installs the Phase 1
/// bug-capture `ErrorStore` (bug-reporting #478) so Phase 2 can query errors.
/// Test: not unit-tested (process-level entry point); exercised manually via
/// `cargo run -p trusty-memory -- serve` and the parent integration tests.
async fn run_serve(
    http: Option<SocketAddr>,
    foreground: bool,
    palace: Option<String>,
    log_buffer: trusty_common::log_buffer::LogBuffer,
    error_store: trusty_common::error_capture::ErrorStore,
) -> Result<()> {
    // Background self-spawn path: when invoked without `--http` or
    // `--foreground`, fork a detached copy of ourselves with `serve
    // --foreground` and return immediately. Mirrors `trusty-search start` so
    // the parent shell keeps its prompt and tmux pane closures do not
    // SIGHUP the daemon.
    //
    // Supervisors (launchd, systemd, Docker) always pass `--foreground` and
    // stay on the inline path so they can manage the process lifecycle.
    if !foreground && http.is_none() {
        return trusty_memory::commands::start::handle_start().await;
    }

    // Single-instance guard (Fix B): if another healthy daemon is already
    // running (detected via the http_addr discovery file + /health probe),
    // exit 0. launchd's `KeepAlive { SuccessfulExit: false }` only respawns
    // on *non-zero* exits, so exit 0 stops the respawn storm cleanly.
    // This check runs on every `serve --foreground` invocation — both those
    // spawned by launchd and those spawned manually — so the guard is always
    // active regardless of how the daemon was launched.
    {
        use trusty_memory::commands::single_instance::{single_instance_check, StartupAction};
        let addr_file = trusty_memory::http_addr_path();
        let action = single_instance_check(addr_file.as_deref()).await;
        match action {
            StartupAction::Proceed => {
                // Normal path: no live daemon detected, continue to bind.
            }
            StartupAction::ExitAlreadyRunning => {
                tracing::info!(
                    "single-instance guard: another trusty-memory instance is \
                     already running; exiting 0 to stop launchd respawn storm"
                );
                eprintln!(
                    "trusty-memory: another instance is already running; \
                     exiting cleanly (exit 0 stops launchd KeepAlive respawn)"
                );
                std::process::exit(0);
            }
            StartupAction::Fail(msg) => {
                anyhow::bail!("single-instance check failed unexpectedly: {msg}");
            }
        }
    }

    // Resolve the standard data dir, then descend into `palaces/` if that
    // legacy-layout subdirectory exists. Using the resolved directory as
    // `data_root` keeps every call site (status, palace_list, open_palace,
    // palace_create, load_palaces_from_disk) pointed at the same place.
    let data_dir = trusty_common::resolve_data_dir("trusty-memory")?;
    // Defense-in-depth (belt-and-suspenders, #503): assert the resolved data
    // root is absolute and not the filesystem root before binding. This guards
    // against any future resolver path that could produce a bad dir — even if
    // trusty_common::resolve_data_dir's own guards fire first, a second check
    // here means a misconfigured deployment fails loudly at startup rather than
    // silently scattering palaces across `/`.
    if !data_dir.is_absolute() {
        anyhow::bail!(
            "resolved trusty-memory data directory {:?} is not absolute; \
             refusing to start to prevent palace directories from being created \
             under the daemon working directory",
            data_dir
        );
    }
    if data_dir == std::path::Path::new("/") {
        anyhow::bail!(
            "resolved trusty-memory data directory is the filesystem root (/); \
             refusing to start to prevent palace directories from being created \
             directly under /",
        );
    }
    let data_root = resolve_palace_registry_dir(data_dir);

    // Apply one-shot, idempotent on-disk migrations before any in-memory
    // registry hydration so subsequent `load_palaces_from_disk` calls see the
    // updated metadata. Currently this rewrites the default `localLLM`
    // palace's display name to "User Memories" when the legacy literal is
    // still present (issue #98). Failures here are logged but do not abort
    // startup — a single bad migration must not take the daemon down.
    if let Err(e) = trusty_memory::commands::migrations::migrate_default_palace_name(&data_root) {
        tracing::warn!("default-palace name migration skipped: {e:#}");
    }

    if let Some(addr) = http {
        let state = AppState::new(data_root)
            .with_default_palace(palace)
            .with_log_buffer(log_buffer)
            // Bug-reporting #478: wire the bug-capture ErrorStore into AppState
            // so Phase 2 HTTP / MCP endpoints can query it. The store is an
            // Arc-backed clone of the same ring the BugCaptureLayer writes to.
            .with_error_store(error_store)
            // Issue #156 + #193: opt in to the BM25 lexical lane (and its
            // spawn supervisor) when TRUSTY_BM25_DAEMON=1. The builder is
            // a no-op when the env var is unset so existing deployments
            // see no behavioural change.
            .with_bm25_client_from_env();
        spawn_startup_tasks(&state);
        run_http(state, addr).await
    } else {
        // Default: dynamic-port HTTP daemon. Mirrors the explicit `--http`
        // branch above (log buffer, background hydration) but lets the
        // library pick a port from 7070..=7079 (OS-fallback) and write
        // `~/.trusty-memory/http_addr` for clients to discover.
        let state = AppState::new(data_root)
            .with_default_palace(palace)
            .with_log_buffer(log_buffer)
            // Bug-reporting #478: wire the bug-capture ErrorStore into AppState
            // so Phase 2 HTTP / MCP endpoints can query it.
            .with_error_store(error_store)
            // Issue #156 + #193: opt in to the BM25 lexical lane (and its
            // spawn supervisor) when TRUSTY_BM25_DAEMON=1. The builder is
            // a no-op when the env var is unset so existing deployments
            // see no behavioural change.
            .with_bm25_client_from_env();
        spawn_startup_tasks(&state);
        run_http_dynamic(state).await
    }
}

/// Why: startup tasks (palace hydration, alias discovery, pin scan) are the
///      same regardless of whether HTTP binds to a fixed or dynamic port;
///      keeping the logic in a single helper means a new startup task only has
///      to be added in one place. Previously, `load_palaces_from_disk` was
///      awaited synchronously before binding the HTTP listener — a single
///      broken `kg.db` (stale WAL sidecar, corrupt file, permissions) could
///      stall hydration for seconds per palace, deferring `/health` becoming
///      reachable until every palace had been visited. The dashboard, MCP
///      clients, and `launchctl` health-probes all interpret that as "the
///      daemon is dead", so the launchd job thrashes and operators see no
///      useful output. Spawning hydration as a background task lets the HTTP
///      server bind immediately; palaces appear in `palace_list` and the
///      dashboard as each one finishes opening. Per-palace failures are
///      already logged and skipped inside `load_palaces_from_disk` so a
///      single bad `kg.db` can never abort the daemon.
/// What: clones `state` (cheap — `AppState` derives `Clone` with `Arc`-wrapped
///       internals) and spawns a background task that (1) hydrates persisted
///       palaces from disk with timing logs, (2) once palaces are live,
///       kicks off issue-#42 alias auto-discovery against the cwd targeting
///       the default palace (if configured), and (3) runs the issue-#470
///       single-pass pin scan and populates `AppState::pin_project_map`
///       (scan-only — NO palace opens). Returns immediately — the spawned
///       task runs concurrently with the HTTP listener bind.
/// Test: `spawn_startup_tasks_populates_pin_map` verifies the scan path runs
///       and populates the map; the log emission is confirmed by the throwaway
///       daemon run documented in the session notes.
fn spawn_startup_tasks(state: &AppState) {
    let bg_state = state.clone();
    tokio::spawn(async move {
        let started = std::time::Instant::now();
        tracing::info!("starting background palace hydration");
        match bg_state.load_palaces_from_disk().await {
            Ok(count) => tracing::info!(
                elapsed_ms = started.elapsed().as_millis() as u64,
                "background palace hydration complete: {count} palaces loaded"
            ),
            Err(e) => tracing::error!(
                elapsed_ms = started.elapsed().as_millis() as u64,
                "background palace hydration failed: {e:#}"
            ),
        }
        // Issue #42: once palaces are live, kick off auto-discovery against
        // cwd targeting the default palace (if configured). Without a default
        // palace there's no obvious destination, so skip — explicit MCP
        // `discover_aliases` calls still work.
        if let Some(palace) = bg_state.default_palace.clone() {
            if let Ok(cwd) = std::env::current_dir() {
                bg_state.spawn_alias_discovery(palace, cwd);
            }
        }
        // Issue #537: throttled startup update check. Runs once per 24h (on-disk
        // cache). Result stored in AppState::update_available for /health.
        // Non-blocking: failure degrades to "no update info" — never aborts startup.
        {
            let update_available = bg_state.update_available.clone();
            tokio::spawn(async move {
                let crate_name = env!("CARGO_PKG_NAME");
                let current = env!("CARGO_PKG_VERSION");
                if let Some(info) =
                    trusty_common::update::check_throttled(crate_name, current).await
                {
                    tracing::info!(
                        latest = %info.latest,
                        "update available: {}",
                        trusty_common::update::notice(&info)
                    );
                    eprintln!("{}", trusty_common::update::notice(&info));
                    if let Ok(mut guard) = update_available.lock() {
                        *guard = Some(info.latest);
                    }
                }
            });
        }

        // Issue #470 / #474: single-pass scan-only pin discovery — NO palace
        // opens. Run on the blocking pool because readdir is blocking I/O;
        // the scan is bounded (one level under each search root) so it
        // completes quickly. We populate `pin_project_map` on the shared
        // `AppState` arc so handlers can look up palace_id → project_path
        // cheaply.
        //
        // Fix #474: the completion log is emitted at `info!` level AND via
        // `eprintln!` to stderr directly. The `info!` is visible under
        // `RUST_LOG=info`; the `eprintln!` is visible regardless of the
        // tracing filter and matches the pattern used by `run_http_on` for
        // the bind-address announcement. This dual-emit guarantees the
        // operator can always confirm the scan ran, even when the daemon is
        // started via launchd (stderr → log file) or with the default
        // `RUST_LOG=warn` level.
        let pin_scan_started = std::time::Instant::now();
        let pin_map_ref = bg_state.pin_project_map.clone();
        let scan_result = tokio::task::spawn_blocking(move || {
            let search_dirs = trusty_memory::startup_scan::default_search_dirs();
            trusty_memory::startup_scan::scan_pin_map(&search_dirs)
        })
        .await;
        match scan_result {
            Ok(map) => {
                let count = map.len();
                let elapsed_ms = pin_scan_started.elapsed().as_millis() as u64;
                for (palace_id, project_path) in map {
                    pin_map_ref.insert(palace_id, project_path);
                }
                // Dual-emit: tracing INFO (visible under RUST_LOG=info) +
                // eprintln! to stderr (visible at any filter level, matching
                // the `run_http_on` bind-address announcement pattern).
                // Root cause of #474: when the daemon is started via
                // `trusty-memory start`, the child's stderr is redirected to
                // /dev/null and tracing output is silently lost; when started
                // via launchd the default RUST_LOG=warn suppresses info!.
                // eprintln! bypasses the tracing filter so the completion is
                // always visible in launchd logs and on the operator's
                // terminal when run in the foreground.
                tracing::info!(
                    pins_found = count,
                    elapsed_ms,
                    "startup pin scan complete: {count} pin(s) discovered in {elapsed_ms}ms"
                );
                eprintln!("startup pin scan complete: {count} pin(s) discovered in {elapsed_ms}ms");
            }
            Err(e) => {
                // spawn_blocking join error — should not happen in practice.
                tracing::warn!("startup pin scan task panicked or was cancelled: {e}");
                eprintln!("startup pin scan task panicked or was cancelled: {e}");
            }
        }
    });
}

// ---------------------------------------------------------------------------
// Tests for spawn_startup_tasks (#474)
// ---------------------------------------------------------------------------

#[cfg(test)]
mod startup_task_tests {
    use super::*;
    use std::fs;
    use trusty_memory::project_root::{write_project_pin, ProjectPin, PIN_SCHEMA_VERSION};

    /// Why: the pin scan inside `spawn_startup_tasks` must populate
    /// `AppState::pin_project_map` so handlers can resolve a palace id to a
    /// project path without a filesystem walk at request time (issue #470).
    /// This test verifies the full wiring: a real `AppState` with a real temp
    /// search root, a pinned project, and the async background task.
    /// What: creates a project with a pin file under a temp search root; then
    /// calls `spawn_startup_tasks` and yields to the tokio runtime until the
    /// task completes; asserts the pin map contains the expected entry.
    /// Test: itself (issue #474 regression guard).
    #[tokio::test]
    async fn spawn_startup_tasks_populates_pin_map() {
        // Build a temp search root with one pinned project.
        let tmp = tempfile::tempdir().expect("tempdir");
        let search_root = tmp.path().join("Projects");
        let project_dir = search_root.join("my-project");
        fs::create_dir_all(&project_dir).expect("create project dir");
        write_project_pin(
            &project_dir,
            &ProjectPin {
                schema_version: PIN_SCHEMA_VERSION,
                palace: "my-palace".to_string(),
                note: None,
            },
        )
        .expect("write pin");

        // Override HOME so `default_search_dirs()` points at our temp root.
        // SAFETY: single-threaded test; env var only affects this process.
        let prev_home = std::env::var_os("HOME");
        unsafe {
            std::env::set_var("HOME", tmp.path());
        }
        // Also bypass palace-slug enforcement so AppState::new doesn't
        // need a real project root.
        unsafe {
            std::env::set_var("TRUSTY_SKIP_PALACE_ENFORCEMENT", "1");
        }

        let state_root = tmp.path().join("data");
        fs::create_dir_all(&state_root).expect("create data dir");
        let state = AppState::new(state_root);

        // Fire the background task.
        spawn_startup_tasks(&state);

        // Yield to the tokio runtime repeatedly until the task populates the
        // pin map or a timeout is reached (50 × 10 ms = 500 ms ceiling).
        let deadline = std::time::Instant::now() + std::time::Duration::from_millis(500);
        loop {
            if state.pin_project_map.contains_key("my-palace") {
                break;
            }
            if std::time::Instant::now() >= deadline {
                panic!(
                    "pin_project_map was not populated within 500 ms; \
                     spawn_startup_tasks may not be running the pin scan"
                );
            }
            tokio::time::sleep(std::time::Duration::from_millis(10)).await;
        }

        // Restore HOME.
        match prev_home {
            Some(v) => unsafe { std::env::set_var("HOME", v) },
            None => unsafe { std::env::remove_var("HOME") },
        }

        let found = state.pin_project_map.get("my-palace").map(|e| e.clone());
        assert!(
            found.is_some(),
            "pin_project_map must contain 'my-palace' after spawn_startup_tasks"
        );
        // Canonicalize to handle macOS /private symlinks.
        let actual = fs::canonicalize(found.unwrap()).expect("canonicalize actual");
        let expected = fs::canonicalize(&project_dir).expect("canonicalize expected");
        assert_eq!(
            actual, expected,
            "pin_project_map entry must point to the project directory"
        );
    }
}