feat(memory): fix AST extraction, cypher parsing, and add OMP harness support

[badrus123]

Summary

Fixes critical bugs and edge cases across the code memory subsystem (AST symbol extraction across Rust, JS/TS, Python; SQLite schema version retention and busy timeout; Cypher read-only keyword handling in literals; call-graph bidirectional tracing), adds native integration for the OMP (Oh My Pi) harness, updates Codex turnaround hook protocols, and addresses core scanner and duplication detection gaps.

Changes

• Memory Extraction (extract.rs):
  • Rust: Recognize is_exported on functions and types decorated with attributes (#[inline], #[tokio::main]) or doc comments (/// ...).
  • Rust: Extract actual function signature header in signature() instead of attribute lines.
  • JS/TS: Extract arrow functions and function expressions from parent declarator/assignment, and walk ancestors to detect export statements.
  • Python: Strip raw/format string prefixes (r, f, b, u) in route decorators (e.g. @app.route(r"/api/items")).
  • Python: Isolate terminal class name in class inheritance to prevent qualifier module pollution (e.g. models.Model -> Model).
• Memory Store & Persistence (store.rs, mod.rs):
  • Add 5-second busy_timeout to SQLite connection in Store::open_at to prevent SQLITE_BUSY crashes during concurrent access.
  • Retain schema_version on store.reset() and only drop tables on explicit SCHEMA_VERSION mismatch.
  • Copy commit and last_indexed metadata when importing committed artifacts in import_artifact.
  • Fix callees_of to avoid leaking global functions into receiver-qualified method calls.
  • Improve module_stem to strip known file extensions (.js, .ts, etc.) and support dotted paths.
• Cypher Query Engine (cypher.rs):
  • Strip string literals before running forbidden write keyword rejection, allowing safe queries with common method names like WHERE f.name = "delete".
  • Add quote tracking to find_keyword to prevent clause splitting on keywords inside literals.
• Call-Chain Tracing (trace.rs):
  • Maintain branch_direction during BFS traversal for Direction::Both to prevent sideways walks into sibling nodes at depth >= 2.
• Harness Integration (init.rs, doctor.rs, hook.rs, mcp.rs, main.rs):
  • Add AgentTarget::Omp with CLI support (AgentArg::Omp, HookAgentArg::Omp).
  • Install OMP rules (AGENTS.md), skills (.agents/skills/forgeguard-engineering), hooks (.agents/hooks.json), and MCP (.agents/mcp_config.json).
  • Support OMP wire protocols and wire ask tool for clarifying questions.
  • Add omp health validation to forgeguard doctor.
  • Update Codex stop hook block wire format with continue: true to support Codex's auto-turnaround protocol.
  • Introduce strongly typed DetailArg and DirectionArg with JsonSchema for MCP tools.
• Core Gate & Scanner (scanner.rs, duplication.rs, baseline.rs):
  • Ensure secret scanning runs even when syntax errors exist in the source file.
  • Populate end_line on duplicate block findings (FG-DRY-001, FG-DRY-002, FG-DRY-003) and include arrow_function in clone scope.
  • Normalize baseline evidence for FG-DRY-* by ignoring line shifts in secondary files.
• Tests:
  • Add regression tests in memory_test.rs covering Rust signatures/exports, TS arrow functions, Python raw routes, and Cypher literal safety.
  • Add OMP initialization test in init_test.rs.

User-visible result

• forgeguard init --agent omp installs rules, engineering skills, hooks, and MCP configuration into .agents/ and AGENTS.md.
• forgeguard doctor validates omp hooks alongside Claude Code, Codex, Cursor, and Antigravity.
• forgeguard memory query no longer errors on queries filtering by functions named delete, select, create, etc.
• Concurrent MCP queries while background indexing no longer crash with SQLite database lock errors.

Test plan

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test --locked --workspace
• cargo build --locked --workspace --release
• sh tests/install_test.sh
• sh tests/wizard_test.sh
• forgeguard gate --changed --output compact

Checklist

• The change is limited to the stated problem.
• The pull request explains what deliberately remains out of scope.
• Tests or verification cover behavioral changes.
• Documentation is updated where user-facing behavior changed.
• No secrets, tokens, or personal information are included.
• Commit messages use Conventional Commits.

[mulhamna]

Hey @badrus123, thanks for putting this together!

The bugfixes across the memory subsystem & core scanner look really solid:

• AST extraction in Rust (skipping attributes/doc comments in signature and is_exported) and TS arrow function exports address real edge cases nicely.
• Cypher parser fix stripping string literals before checking forbidden write keywords avoids false positives on common identifier names like delete or select.
• Adding the 5s busy_timeout to SQLite and killing process groups on runner timeout are great stability improvements.

That said, I have a few major architectural concerns regarding the OMP harness integration:

1. Bypassing the Kurir Abstraction:
   Across our repos, all harness handling (resolving skill directories, hook file discovery, and hook mutation) is standardized and delegated to suiflex/kurir. In kurir 0.2.0, skills_dir(Harness::Omp) and hook_file(Harness::Omp) are not yet implemented.
2. Borrowing Harness::Codex in init.rs:
   In install_omp, calling skill_directory(Harness::Codex, scope) to borrow Codex's skill directory bypasses the Kurir contract and introduces brittle coupling.
3. Collision on .agents/hooks.json:
   .agents/hooks.json is currently owned by Antigravity. Forcing OMP hooks into the same file via install_antigravity_simple_hook means lifecycle events (Stop, PreInvocation) will overwrite each other whenever both harnesses are configured or when running --agent all.

Suggested Path Forward:

• Split this PR:
  1. PR 1 (Core & Memory Fixes): Extract the memory extraction, Cypher parser, SQLite timeout, runner timeout, and duplication fixes. This part is clean, well-tested, and ready to merge immediately.
  2. OMP Support: Standardize OMP in suiflex/kurir first (implementing proper skills_dir, hook_file, and hook registration). Once a new kurir release is out, we can bump the dependency in ForgeGuard and consume OMP natively without borrowing other harnesses or conflicting on hook files.

What do you think?