fix(agentdb): cache prepared statements to plug sql.js leak

[ruvnet]

Summary

Both sql.js wrappers in packages/agentdb/src/db-fallback.ts tracked every prepare() call in activeStatements but only removed entries on finalize() or error. The idiomatic better-sqlite3 pattern db.prepare(sql).run(...) — which relies on V8 to GC the handle — leaks unbounded under sql.js because WASM-backed Statement objects need explicit .free().

Observed in mcp-bridge Cloud Run logs (~3 statements/s growth):

[ruflo] ⚠️ Detected 562 active SQL statements - possible memory leak
[ruflo] ⚠️ Detected 612 active SQL statements - possible memory leak
[ruflo] ⚠️ Detected 621 active SQL statements - possible memory leak

Fix

Cache wrappers by SQL text. Repeated prepare(sameSql) returns the same wrapper; activeStatements.size is now bounded by the count of distinct SQL strings the application uses.

• Safe under single-threaded JS: bind/step/reset are synchronous, so no two run/get/all calls can interleave on a shared stmt.
• finalize() is a no-op on cached wrappers; close() owns teardown.
• Auto-free-on-error also evicts from the cache, so a broken stmt isn't reused.

Applied identically to both SqlJsDatabase (line ~94) and wrapExistingSqlJsDatabase (line ~305).

Test plan

• tsc --noEmit clean
• Smoke test — 5000× db.prepare('INSERT...').run() + 1× db.prepare('SELECT').get():

  activeStatements_size: 2   (was 5001 pre-patch)
  statementCache_size:   2
  post_close_active:     0
  post_close_cache:      0
  

• Pre-existing test failures (jest stubs in vitest project, hnsw zero-vector edge case) — unrelated to this change.

Out of scope

• npm publish + downstream redeploy of mcp-bridge Cloud Run service. The fix won't reach production until consumers pick up a published version.

🤖 Generated with claude-flow