v3.0.0-alpha.1: Minimal core rewrite

[kevintseng]

Summary

• v3 大重構: 從 50+ source files 精簡到 6 個, 26 deps → 3 deps
• 3 MCP tools: remember, recall, forget — 移除其他 5 個 tools
• 2 hooks: session-start + post-commit — 移除其他 4 個 hooks
• memesh-view CLI: 新增 D3.js HTML dashboard (knowledge graph + entity table + stats)
• 95,001 lines deleted, 2,922 lines added
• 73 tests passing (BDD style, 7 test files)
• Backward compatible DB schema (existing data stays usable)

Breaking Changes

• MCP tools reduced: 8 → 3
• Plugin hooks reduced: 6 → 2
• Removed vector/ONNX embedding support (FTS5 only)
• Removed daemon/proxy server modes (stdio only)

Test plan

• npm run typecheck — clean
• npm run build — successful
• npx vitest run — 73/73 tests passing
• memesh-view smoke test — opens HTML dashboard in browser
• Comprehensive code review (Ripple Map + Reality Check) — all pass
• Verify existing DB data is still queryable after upgrade

🤖 Generated with Claude Code

In general, the fix is to stop manually constructing a filename in the OS temp directory and instead use a temp‑file helper that (a) creates the file atomically with exclusive access, (b) uses a unique, hard‑to‑predict name, and (c) sets secure permissions. For Node, the recommended approach is to use the well‑tested tmp package and call tmp.fileSync() (or tmp.file() for async) to obtain a securely created temp file path.

For this code, the best minimal‑impact fix is:

1. Import the tmp library at the top of src/cli/view.ts. We’ll keep existing imports intact and add import tmp from 'tmp';.
2. Replace the manual outPath = path.join(os.tmpdir(), 'memesh-dashboard.html'); with a call to tmp.fileSync(). We should:
   • Request a descriptive prefix or postfix/extension (e.g. .html) so the OS and browser treat it as HTML.
   • Use the returned .name field as the outPath.
3. Keep writing the HTML using fs.writeFileSync to that path and keep the browser‑opening logic unchanged.

Concretely, in src/cli/view.ts:

• Near the existing imports (around line 3–8), add import tmp from 'tmp';.

• Around line 550–551, replace:

  • const outPath = path.join(os.tmpdir(), 'memesh-dashboard.html');
  • fs.writeFileSync(outPath, html, 'utf-8');

  with something like:

  const tmpFile = tmp.fileSync({ postfix: '.html' });
  const outPath = tmpFile.name;
  fs.writeFileSync(outPath, html, 'utf-8');

This preserves functionality (a temp HTML file is created and opened) while ensuring a unique, securely created temp file.