hermes: retain SQLite search and extension support

dockerfiles/Dockerfile.hermes-agent

@@ -44,7 +44,8 @@ RUN apt-get update \
     && tar -xzf /tmp/sqlite.tar.gz -C /tmp \
     && /opt/hermes/.venv/bin/python -c 'import hashlib, pathlib, sys; expected=sys.argv[1]; actual=hashlib.sha3_256(pathlib.Path(sys.argv[2]).read_bytes()).hexdigest(); raise SystemExit(actual != expected)' "${SQLITE_AMALGAMATION_SHA3}" "/tmp/sqlite-autoconf-${SQLITE_AUTOCONF_VERSION}/sqlite3.c" \
     && cd "/tmp/sqlite-autoconf-${SQLITE_AUTOCONF_VERSION}" \
-    && ./configure --prefix=/opt/sqlite --disable-static \
+    && CFLAGS='-DSQLITE_ENABLE_COLUMN_METADATA -DSQLITE_ENABLE_PREUPDATE_HOOK -DSQLITE_ENABLE_UNLOCK_NOTIFY -DSQLITE_ENABLE_UPDATE_DELETE_LIMIT -DSQLITE_SOUNDEX' \
+        ./configure --prefix=/opt/sqlite --disable-static --all --scanstatus \
     && make -j"$(nproc)" \
     && make install \
     && test -L /opt/sqlite/lib/libsqlite3.so.0 \
@@ -56,7 +57,7 @@ USER root
 
 COPY --from=sqlite-build /opt/sqlite/lib/ /usr/local/lib/
 RUN ldconfig \
-    && /opt/hermes/.venv/bin/python -c 'import sqlite3; assert sqlite3.sqlite_version_info >= (3, 51, 3), sqlite3.sqlite_version'
+    && /opt/hermes/.venv/bin/python -c 'import sqlite3; connection=sqlite3.connect(":memory:"); connection.execute("CREATE VIRTUAL TABLE documents USING fts5(body)"); connection.execute("CREATE VIRTUAL TABLE ranges USING rtree(id, low, high)"); assert connection.execute("SELECT json_valid(?), sqrt(9)", ("[]",)).fetchone() == (1, 3.0); options={row[0] for row in connection.execute("PRAGMA compile_options")}; required={"ENABLE_COLUMN_METADATA", "ENABLE_FTS4", "ENABLE_FTS5", "ENABLE_MATH_FUNCTIONS", "ENABLE_PREUPDATE_HOOK", "ENABLE_RTREE", "ENABLE_SESSION", "ENABLE_UNLOCK_NOTIFY", "ENABLE_UPDATE_DELETE_LIMIT"}; assert required <= options, sorted(required - options); assert sqlite3.sqlite_version_info >= (3, 51, 3), sqlite3.sqlite_version'
 
 FROM sqlite-runtime
 

testing/tests/test_hermes_image_builder.py

@@ -18,6 +18,7 @@ PIPELINE_PATH = REPO_ROOT / "ci/Jenkinsfile.hermes-agent-image"
 RELEASE_SCRIPT = REPO_ROOT / "ci/scripts/hermes_image_release.py"
 TRIGGER_SCRIPT = REPO_ROOT / "services/hermes/scripts/jenkins_image_build_trigger.py"
 HEREDOC_RUNNER = REPO_ROOT / "dockerfiles/hermes-kaniko-heredoc-runner.py"
+AGENT_DOCKERFILE = REPO_ROOT / "dockerfiles/Dockerfile.hermes-agent"
 
 
 def _load_release_module():
@@ -56,6 +57,30 @@ def _pod_spec() -> dict:
     return yaml.safe_load(pod_yaml)["spec"]
 
 
+def test_sqlite_runtime_keeps_hermes_required_extensions() -> None:
+    """The WAL fix must not remove state and search capabilities from SQLite."""
+    source = AGENT_DOCKERFILE.read_text(encoding="utf-8")
+    assert "./configure --prefix=/opt/sqlite --disable-static --all --scanstatus" in source
+    for option in (
+        "SQLITE_ENABLE_COLUMN_METADATA",
+        "SQLITE_ENABLE_PREUPDATE_HOOK",
+        "SQLITE_ENABLE_UNLOCK_NOTIFY",
+        "SQLITE_ENABLE_UPDATE_DELETE_LIMIT",
+    ):
+        assert option in source
+    assert 'CREATE VIRTUAL TABLE documents USING fts5(body)' in source
+    assert 'CREATE VIRTUAL TABLE ranges USING rtree(id, low, high)' in source
+    assert 'json_valid(?), sqrt(9)' in source
+    for option in (
+        "ENABLE_FTS4",
+        "ENABLE_FTS5",
+        "ENABLE_RTREE",
+        "ENABLE_SESSION",
+        "ENABLE_COLUMN_METADATA",
+    ):
+        assert option in source
+
+
 def test_builder_pod_is_daemonless_and_kernel_bounded() -> None:
     """The builder gets only proven build caps, never host, daemon, or K8s access."""
     source = PIPELINE_PATH.read_text(encoding="utf-8")