feat: semantic memory with LanceDB + Gemini embeddings

[5queezer]

Summary

• Semantic memory: Adds LanceDB-powered vector memory to container agents via 4 MCP tools (memory_store, memory_search, memory_delete, memory_count). Uses Gemini embedding-001 (3072-dim) for embeddings. Supports local embedded LanceDB or cloud via LANCEDB_URI env var.
• Migration script: scripts/migrate-memories.mjs imports memories from OpenClaw JSONL backups with re-embedding.
• Container runner: passes GEMINI_API_KEY, LANCEDB_URI, LANCEDB_API_KEY env vars to containers for MCP tool access.

Security fixes applied

• Sanitized LanceDB filter inputs (category, ID) to prevent injection
• crypto.randomUUID() for memory IDs instead of Math.random()
• 30s fetch timeout on Gemini API calls
• Race-safe singleton for LanceDB table initialization

Review fixes applied

• Configurable LanceDB path via MEMORY_LANCEDB_DIR env var (no more hardcoded path)
• Gemini error body included in thrown error messages
• LanceDB version aligned to ^0.26.2 (matches root)
• Float32Array used consistently for vectors (matches schema + migration)

Removed from PR

• Telegram agent swarm (bot pool) — already available as an upstream skill at nanoclaw.dev/skills/telegram-swarm

Test plan

• Ask agent to store and search memories
• Verify memory_count returns correct total
• Test with LANCEDB_URI set (cloud) and unset (local)

🤖 Generated with Claude Code

[5queezer]

Issues by priority:

🔴 High
• Hardcoded /workspace/group/memory/lancedb path — use an env var instead
• Suppressed Gemini error body (err is read but never included in the thrown message) — makes debugging hard
• LanceDB version mismatch: root uses ^0.26.2, agent-runner uses ^0.17.0

🟡 Medium
• memory.ts stores vectors as Float32 schema but passes raw number[] — the migration script already uses Float32Array correctly, inconsistency should be fixed
• Math.random() still used for IPC filenames/task IDs despite PR claiming crypto.randomUUID() was adopted
• Message splitting cuts at hard character boundaries — can break mid-word or split Markdown markup (e.g. bold)
• setTimeout(r, 2000) hardcoded rename propagation delay is fragile

🟢 Low
• Multiple ctx.chat as any casts — grammY has proper discriminated union types
• npm test 2>/dev/null silences test errors in CI, making failures hard to diagnose
• Migration script has a hardcoded dated backup path and no retry/checkpoint logic — if it fails halfway, you lose progress

---

Overall the architecture is solid. The main things I'd fix before merging: the hardcoded path, the error suppression, the LanceDB version mismatch, and the Float32Array inconsistency. The rest are nice-to-haves. 👍