--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Node / ReticulumProjects / MeshChatX.git / files / docs / agents / skills / landlock-sqlite / SKILL.md
docs/agents/skills/landlock-sqlite/SKILL.md fa46dc4ce9ab50cbe66a7a9e4b3bca0140102345 (fa46dc4c) Text, 2.72 KB
Skill: landlock-sqlite
Landlock / Windows AppContainer + SQLite conversation-load failures (temp_store, slim queries, memory pressure).
MeshChatX FS sandbox + SQLite
Symptoms
• T383838/api/v1/lxmf/conversations or T383838/api/v1/notifications return 500/503
• Logs show T383838sqlite3.OperationalError: unable to open database file
• Happens after Landlock or Windows AppContainer enables, often with large message T383838fields / base64 blobs
Root causes (priority order)
1. Worker-thread connections missing T383838PRAGMA temp_store=MEMORY (T383838DatabaseProvider._configure_connection)
2. Conversation SELECT pulling full T383838content / T383838fields
3. Memory-pressure switching to T383838temp_store=FILE under a filesystem sandbox
4. Identity context not ready (should be 503, not 500)
Required behavior
• Default: T383838temp_store=MEMORY on every new connection
• FS sandbox active (T383838landlock_active or T383838appcontainer_active / T383838fs_sandbox_active) + memory pressure: shrink cache/mmap, keep MEMORY temp
• Non-sandbox memory pressure may use FILE temp + storage-local T383838sqlite-tmp TMPDIR
• List queries: T383838substr(content, 1, 240) and SQL T383838instr flags for attachments
• API: map OperationalError / unable-to-open / locked to 503 with retryable message
Windows counterpart
• Module: T383838meshchatx/src/backend/appcontainer_sandbox.py
• Launcher: T383838meshchatx/src/backend/appcontainer_launcher.py via T383838--meshchatx-run-module
• Electron win32 spawn uses the launcher unless T383838MESHCHAT_APPCONTAINER=0
• Docs: T383838meshchatx-docs/en/platform-guides/windows-sandbox.md
Verification
T282828
uv run pytest tests/backend/test_sqlite_landlock_temp_store.py tests/backend/test_sqlite_memory_pressure.py tests/backend/test_landlock_sandbox.py tests/backend/test_appcontainer_sandbox.py tests/backend/test_self_check.py -q
pnpm Tffa657exec vitest run tests/frontend/i18n.test.js
bash scripts/ci/github-verify-frozen-sandbox.sh build/exe
For live stress, run Landlock in a subprocess (sandbox applies once per process). Expect FILE temp complex queries to fail under Landlock. MEMORY must pass. On Windows, confirm T383838appcontainer_active via T383838/api/v1/server/security. Headless self-check includes T383838FS Sandbox Modules and requires AppContainer status fields on T383838/api/v1/server/security.
Key files
• T383838meshchatx/src/backend/database/provider.py
• T383838meshchatx/src/backend/database/__init__.py
• T383838meshchatx/src/backend/memory_pressure.py
• T383838meshchatx/src/backend/landlock_sandbox.py
• T383838meshchatx/src/backend/appcontainer_sandbox.py
• T383838meshchatx/src/backend/appcontainer_launcher.py
• T383838meshchatx/src/backend/seccomp_sandbox.py (syscall denylist after Landlock)
• T383838meshchatx/meshchat.py (conversations/notifications error mapping)
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────