docs: document libSQL CLI connection crash issue

Add detailed documentation for the libSQL CLI crash that blocks interactive
setup flows on libSQL deployments (ironclaw tool setup, ironclaw secret set,
ironclaw mcp auth).

- Add known issue comment to src/db/mod.rs create_secrets_store() documenting
  the "invalid connection string" crash on libSQL CLI subcommands
- Add related comments to src/cli/tool.rs init_secrets_store() and
  src/cli/mcp.rs get_secrets_store() functions
- Add to CLAUDE.md Current Limitations section as priority item #1
- Include workaround: manually read master key from /proc/PID/environ,
  encrypt secrets with AES-256-GCM, write directly to secrets table
- Root cause unknown: libSQL works fine in main process but fails when
  called from CLI subcommands (possibly path resolution, file permissions,
  or WAL mode conflicts)
- Related: #655 (libSQL backend gaps)

Co-Authored-By: Claude Haiku 4.5 <[email protected]>
This commit is contained in:
Nick Pismenkov
2026-03-09 16:01:07 -07:00
co-authored by Claude Haiku 4.5
parent 14aadd3063
commit f5123055b5
4 changed files with 36 additions and 8 deletions
+4
View File
@@ -551,6 +551,10 @@ fn validate_tool_name(name: &str) -> anyhow::Result<()> {
}
/// Initialize the secrets store from environment config.
///
/// **Known Issue:** This function crashes with "invalid connection string" on libSQL deployments
/// when called from `tool setup` or `secret set` subcommands. See `src/db/mod.rs` `create_secrets_store()`
/// documentation for details and workaround.
async fn init_secrets_store() -> anyhow::Result<Arc<dyn SecretsStore + Send + Sync>> {
let config = Config::from_env().await?;
let master_key = config.secrets.master_key().ok_or_else(|| {