@andespindola/brainlink 1.6.9 → 1.6.11

package/dist/application/frontend/settings-page.js

@@ -183,6 +183,113 @@ select {
 .settings-back:hover,
 .settings-back:focus {
   color: var(--accent);
+}
+
+.settings-section {
+  margin-top: 28px;
+  padding-top: 24px;
+  border-top: 1px solid var(--line);
+  display: grid;
+  gap: 16px;
+}
+
+.settings-section h2 {
+  margin: 0;
+  font-size: 16px;
+  letter-spacing: 0.01em;
+}
+
+.settings-hint {
+  margin: 0;
+  color: var(--muted);
+  font-size: 12px;
+  line-height: 1.5;
+}
+
+.settings-status {
+  margin: 0;
+  padding: 10px 12px;
+  border: 1px solid var(--line);
+  border-radius: 8px;
+  background: rgba(12, 24, 36, 0.6);
+  color: var(--muted);
+  font-size: 12px;
+  line-height: 1.5;
+  overflow-wrap: anywhere;
+}
+
+.settings-secondary {
+  height: 42px;
+  border: 1px solid var(--line);
+  border-radius: 8px;
+  background: rgba(12, 24, 36, 0.94);
+  color: var(--text);
+  cursor: pointer;
+  transition: border-color 120ms ease, background 120ms ease, opacity 120ms ease;
+}
+
+.settings-secondary:hover:not(:disabled),
+.settings-secondary:focus:not(:disabled) {
+  border-color: var(--accent);
+  background: rgba(90, 168, 255, 0.14);
+}
+
+.settings-secondary:disabled {
+  cursor: progress;
+  opacity: 0.6;
+}
+
+.settings-key {
+  display: grid;
+  gap: 8px;
+}
+
+.settings-key[hidden] {
+  display: none;
+}
+
+.settings-key textarea {
+  width: 100%;
+  min-height: 96px;
+  padding: 10px 12px;
+  border: 1px solid var(--line);
+  border-radius: 8px;
+  outline: none;
+  resize: vertical;
+  background: rgba(12, 24, 36, 0.94);
+  color: var(--text);
+  font: inherit;
+  font-size: 11px;
+  line-height: 1.4;
+  overflow-wrap: anywhere;
+}
+
+.settings-key textarea:focus {
+  border-color: var(--accent);
+}
+
+.settings-key-actions {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+}
+
+.settings-copy {
+  height: 32px;
+  padding: 0 14px;
+  border: 1px solid var(--line);
+  border-radius: 8px;
+  background: rgba(12, 24, 36, 0.94);
+  color: var(--text);
+  cursor: pointer;
+  font-size: 12px;
+  transition: border-color 120ms ease, background 120ms ease;
+}
+
+.settings-copy:hover,
+.settings-copy:focus {
+  border-color: var(--accent);
+  background: rgba(90, 168, 255, 0.14);
 }`;
 const settingsScript = () => `(function () {
   var form = document.getElementById('settingsForm');
@@ -268,6 +375,187 @@ const settingsScript = () => `(function () {
         button.disabled = false;
       });
   });
+
+  var generateKey = document.getElementById('generateKey');
+  var deployKey = document.getElementById('deployKey');
+  var deployKeyWrap = document.getElementById('deployKeyWrap');
+  var copyKey = document.getElementById('copyKey');
+  var remoteUrl = document.getElementById('remoteUrl');
+  var connectRemote = document.getElementById('connectRemote');
+  var versioningMessage = document.getElementById('versioningMessage');
+  var versioningStatus = document.getElementById('versioningStatus');
+
+  function showVersioning(text, kind) {
+    versioningMessage.textContent = text;
+    versioningMessage.className =
+      'settings-message ' + (kind === 'success' ? 'is-success' : 'is-error');
+    versioningMessage.hidden = false;
+  }
+
+  function clearVersioning() {
+    versioningMessage.textContent = '';
+    versioningMessage.className = 'settings-message';
+    versioningMessage.hidden = true;
+  }
+
+  var connectReasons = {
+    'ssh-url-required': 'Use an SSH URL (git@github.com:...)',
+    'missing-remote': 'Enter the repository URL',
+    'no-deploy-key': 'Generate the deploy key first'
+  };
+
+  fetch('/api/versioning-status', { headers: { accept: 'application/json' } })
+    .then(function (response) {
+      if (!response.ok) {
+        return {};
+      }
+      return response.json().catch(function () {
+        return {};
+      });
+    })
+    .then(function (data) {
+      data = data || {};
+      var parts = [];
+      parts.push(data.hasKey ? 'Deploy key: present' : 'Deploy key: not generated');
+      if (typeof data.remote === 'string' && data.remote.length > 0) {
+        versioningStatus.textContent = '';
+        var prefix = document.createTextNode('Deploy key: ' + (data.hasKey ? 'present' : 'not generated') + ' · Remote: ');
+        var code = document.createElement('code');
+        code.textContent = data.remote;
+        versioningStatus.appendChild(prefix);
+        versioningStatus.appendChild(code);
+        versioningStatus.appendChild(
+          document.createTextNode(' · Auto-version: ' + (data.autoVersion === true ? 'on' : 'off'))
+        );
+        return;
+      }
+      parts.push('Remote: none');
+      parts.push('Auto-version: ' + (data.autoVersion === true ? 'on' : 'off'));
+      versioningStatus.textContent = parts.join(' · ');
+    })
+    .catch(function () {
+      versioningStatus.textContent = 'Versioning status unavailable.';
+    });
+
+  generateKey.addEventListener('click', function () {
+    clearVersioning();
+    generateKey.disabled = true;
+    fetch('/api/versioning/generate-key', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' }
+    })
+      .then(function (response) {
+        if (!response.ok) {
+          showVersioning('Unable to generate a deploy key. Please try again.', 'error');
+          generateKey.disabled = false;
+          return;
+        }
+        return response
+          .json()
+          .catch(function () {
+            return {};
+          })
+          .then(function (data) {
+            data = data || {};
+            deployKey.value = typeof data.publicKey === 'string' ? data.publicKey : '';
+            deployKeyWrap.hidden = false;
+            showVersioning(
+              'Add this as a Deploy key (with write access) in your GitHub repo settings, then connect below.',
+              'success'
+            );
+            generateKey.disabled = false;
+          });
+      })
+      .catch(function () {
+        showVersioning('Something went wrong. Please try again.', 'error');
+        generateKey.disabled = false;
+      });
+  });
+
+  copyKey.addEventListener('click', function () {
+    var text = deployKey.value;
+    if (navigator.clipboard && navigator.clipboard.writeText) {
+      navigator.clipboard.writeText(text).then(
+        function () {
+          copyKey.textContent = 'Copied';
+          setTimeout(function () {
+            copyKey.textContent = 'Copy';
+          }, 1200);
+        },
+        function () {
+          deployKey.select();
+        }
+      );
+      return;
+    }
+    deployKey.select();
+    try {
+      document.execCommand('copy');
+      copyKey.textContent = 'Copied';
+      setTimeout(function () {
+        copyKey.textContent = 'Copy';
+      }, 1200);
+    } catch (err) {
+      // Selection is left in place so the user can copy manually.
+    }
+  });
+
+  connectRemote.addEventListener('click', function () {
+    clearVersioning();
+    connectRemote.disabled = true;
+    var url = remoteUrl.value.trim();
+    fetch('/api/versioning/connect', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ remoteUrl: url })
+    })
+      .then(function (response) {
+        if (response.ok) {
+          return response
+            .json()
+            .catch(function () {
+              return {};
+            })
+            .then(function (data) {
+              data = data || {};
+              if (data.aggregated) {
+                var imported =
+                  typeof data.aggregated.imported === 'number' ? data.aggregated.imported : 0;
+                var conflicts =
+                  typeof data.aggregated.conflicts === 'number' ? data.aggregated.conflicts : 0;
+                showVersioning(
+                  'Connected. Imported ' +
+                    imported +
+                    ' notes from the repo (' +
+                    conflicts +
+                    ' conflicts preserved).',
+                  'success'
+                );
+              } else {
+                showVersioning('Connected and synced to the repository.', 'success');
+              }
+              connectRemote.disabled = false;
+            });
+        }
+        return response
+          .json()
+          .catch(function () {
+            return {};
+          })
+          .then(function (data) {
+            var reason = data && data.reason ? data.reason : '';
+            showVersioning(
+              connectReasons[reason] || 'Unable to connect the repository. Please try again.',
+              'error'
+            );
+            connectRemote.disabled = false;
+          });
+      })
+      .catch(function () {
+        showVersioning('Something went wrong. Please try again.', 'error');
+        connectRemote.disabled = false;
+      });
+  });
 })();`;
 export const createSettingsPageHtml = () => `<!DOCTYPE html>
 <html lang="en">
@@ -315,6 +603,28 @@ export const createSettingsPageHtml = () => `<!DOCTYPE html>
         <p id="message" class="settings-message" role="alert" aria-live="polite" hidden></p>
         <button id="submit" class="settings-submit" type="submit">Save</button>
       </form>
+      <section class="settings-section" aria-labelledby="versioningTitle">
+        <h2 id="versioningTitle">Vault versioning (git)</h2>
+        <p class="settings-hint">
+          Push your vault to a private GitHub repository over SSH so its history is versioned and portable.
+        </p>
+        <p id="versioningStatus" class="settings-status" aria-live="polite">Loading versioning status…</p>
+        <button id="generateKey" class="settings-secondary" type="button">Generate deploy key</button>
+        <div id="deployKeyWrap" class="settings-key" hidden>
+          <label for="deployKey">Deploy key (public)</label>
+          <textarea id="deployKey" readonly rows="4" spellcheck="false"></textarea>
+          <div class="settings-key-actions">
+            <button id="copyKey" class="settings-copy" type="button">Copy</button>
+            <span class="settings-hint">Add it as a Deploy key with write access in your GitHub repo settings.</span>
+          </div>
+        </div>
+        <div class="settings-field">
+          <label for="remoteUrl">Repository URL</label>
+          <input id="remoteUrl" name="remoteUrl" type="text" autocomplete="off" placeholder="git@github.com:user/repo.git" />
+        </div>
+        <p id="versioningMessage" class="settings-message" role="status" aria-live="polite" hidden></p>
+        <button id="connectRemote" class="settings-secondary" type="button">Connect &amp; sync</button>
+      </section>
       <a class="settings-back" href="/">&larr; Back</a>
     </main>
     <script>${settingsScript()}</script>

package/dist/application/get-graph-layout.js

@@ -29,14 +29,25 @@ const writePersistedLayout = async (vaultPath, options, cached) => {
     await writeFile(temp, `${JSON.stringify(cached)}\n`, { encoding: 'utf8', mode: 0o600 });
     await rename(temp, target);
 };
+// Invalidates the persisted graph layout when the index changes. The default
+// binary backend never writes `.brainlink/index.json` (it uses `store/` +
+// `index-state.json`), so signing on index.json alone left the layout stat
+// permanently at '0:0' — the cached layout never refreshed and the graph froze
+// on its first snapshot. `index-state.json` is rewritten on every reindex for
+// every backend, so it is the reliable invalidation source (index.json stays as
+// a fallback for the legacy JSON backend).
+const indexStateStoragePath = (vaultPath) => join(vaultPath, '.brainlink', 'index-state.json');
 const readDatabaseSignature = async (vaultPath) => {
-    try {
-        const info = await stat(indexStoragePath(vaultPath));
-        return `${Math.floor(info.mtimeMs)}:${info.size}`;
-    }
-    catch {
-        return '0:0';
+    for (const candidate of [indexStateStoragePath(vaultPath), indexStoragePath(vaultPath)]) {
+        try {
+            const info = await stat(candidate);
+            return `${Math.floor(info.mtimeMs)}:${info.size}`;
+        }
+        catch {
+            // Try the next candidate.
+        }
     }
+    return '0:0';
 };
 const createGraphSignature = (graph) => {
     const nodesSignature = graph.nodes.map((node) => `${node.id}|${node.agentId}|${node.title}|${node.path}`).join('\n');

package/dist/application/server/routes.js

@@ -26,6 +26,7 @@ import { createLoginPageHtml, createChangePasswordPageHtml } from '../frontend/l
 import { buildClearSessionCookie, buildSessionSetCookie, changeWebPassword, createSessionToken, parseCookies, resolveWebAuth, SESSION_COOKIE_NAME, verifySessionToken, verifyWebPassword } from './web-auth.js';
 import { getGraphVersion } from './graph-version.js';
 import { readAuthStatus, readEditableSettings, updateEditableSettings } from './settings-store.js';
+import { connectVaultRemote, ensureDeployKey, readVersioningStatus } from './versioning.js';
 import { createSettingsPageHtml } from '../frontend/settings-page.js';
 import { contentTypes, createJsonResponse, isReadMethod, parsePositiveInteger } from './http.js';
 import { parseMultipartForm } from './multipart.js';
@@ -544,6 +545,24 @@ export const route = async (request, url, vaultPath, options = {}) => {
     if (isReadMethod(request) && url.pathname === '/settings') {
         return createResponse(createSettingsPageHtml(), 200, contentTypes['.html']);
     }
+    // Vault git versioning: generate an SSH deploy key on demand and connect a
+    // GitHub repo (clone-and-aggregate, conflict-preserving — never overwrites).
+    if (isReadMethod(request) && url.pathname === '/api/versioning-status') {
+        return createResponse(createJsonResponse(await readVersioningStatus(vaultPath)), 200, contentTypes['.json']);
+    }
+    if (request.method === 'POST' && url.pathname === '/api/versioning/generate-key') {
+        try {
+            return createResponse(createJsonResponse(await ensureDeployKey()), 200, contentTypes['.json']);
+        }
+        catch (error) {
+            return createResponse(createJsonResponse({ error: error instanceof Error ? error.message : 'keygen-failed' }), 500, contentTypes['.json']);
+        }
+    }
+    if (request.method === 'POST' && url.pathname === '/api/versioning/connect') {
+        const body = await readJsonBody(request);
+        const result = await connectVaultRemote(vaultPath, readStringField(body, 'remoteUrl'));
+        return createResponse(createJsonResponse(result), result.ok ? 200 : 400, contentTypes['.json']);
+    }
     if (isReadMethod(request) && url.pathname === '/api/graph-contexts') {
         return createResponse(createJsonResponse({ contexts: await getGraphContexts(vaultPath, readAgentQuery(url)) }), 200, contentTypes['.json']);
     }

package/dist/application/server/versioning.js

@@ -0,0 +1,194 @@
+// Backend for configuring vault git versioning from the hosted Settings screen:
+// generate an SSH deploy key on demand, connect a GitHub repo over SSH, and
+// CLONE-AND-AGGREGATE existing versioned data into the vault without ever
+// overwriting local notes. Aggregation reuses the conflict-preserving snapshot
+// primitives (buildSnapshotEnvelope + applySnapshotEnvelope), which write
+// divergent incoming files as `*.conflict-<ts>.md` rather than overwriting.
+//
+// Git is driven through the system binary via spawn (never a shell, args as an
+// array — no injection surface), mirroring vault-git's spawning style but with a
+// custom GIT_SSH_COMMAND env so clone/fetch/push authenticate with the deploy
+// key. No new dependencies; Node built-ins only.
+import { spawn } from 'node:child_process';
+import { chmod, mkdir, mkdtemp, readdir, readFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { getBrainlinkHomePath } from '../../infrastructure/paths.js';
+import { getGlobalConfigPath, loadBrainlinkConfig, writeRawConfig } from '../../infrastructure/config.js';
+import { initVaultGit, commitVault, pushVault } from '../vault-git.js';
+import { buildSnapshotEnvelope, applySnapshotEnvelope } from '../vault-snapshot.js';
+export const getVaultDeployKeyPath = () => join(getBrainlinkHomePath(), 'keys', 'vault-deploy-ed25519');
+// Run a binary with args as an array and no shell, so untrusted values (remote
+// URLs, key paths) can never be interpreted as shell syntax. An optional env is
+// merged over the current process env, used to inject GIT_SSH_COMMAND for git.
+const runProcess = (command, args, options = {}) => new Promise((resolvePromise, rejectPromise) => {
+    const child = spawn(command, [...args], {
+        cwd: options.cwd,
+        env: options.env ? { ...process.env, ...options.env } : process.env,
+        shell: false
+    });
+    let stdout = '';
+    let stderr = '';
+    child.stdout?.on('data', (chunk) => {
+        stdout += chunk.toString('utf8');
+    });
+    child.stderr?.on('data', (chunk) => {
+        stderr += chunk.toString('utf8');
+    });
+    child.on('error', (error) => rejectPromise(error));
+    child.on('close', (code) => resolvePromise({ code: code ?? 1, stdout, stderr }));
+});
+const buildSshEnv = (keyPath) => ({
+    GIT_SSH_COMMAND: `ssh -i ${keyPath} -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new`
+});
+const fileExists = async (path) => {
+    try {
+        await readFile(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+export const ensureDeployKey = async () => {
+    const keyPath = getVaultDeployKeyPath();
+    const publicKeyPath = `${keyPath}.pub`;
+    if (await fileExists(keyPath)) {
+        const publicKey = await readFile(publicKeyPath, 'utf8');
+        return { publicKey: publicKey.trim(), created: false };
+    }
+    await mkdir(join(getBrainlinkHomePath(), 'keys'), { recursive: true, mode: 0o700 });
+    const result = await runProcess('ssh-keygen', [
+        '-t',
+        'ed25519',
+        '-N',
+        '',
+        '-C',
+        'brainlink-vault',
+        '-f',
+        keyPath
+    ]).catch(() => {
+        throw new Error('ssh-keygen is not available on this host');
+    });
+    if (result.code !== 0) {
+        throw new Error('ssh-keygen is not available on this host');
+    }
+    await chmod(keyPath, 0o600);
+    const publicKey = await readFile(publicKeyPath, 'utf8');
+    return { publicKey: publicKey.trim(), created: true };
+};
+export const readVersioningStatus = async (_vaultPath) => {
+    const publicKeyPath = `${getVaultDeployKeyPath()}.pub`;
+    const publicKey = await readFile(publicKeyPath, 'utf8').then((value) => value.trim()).catch(() => null);
+    const config = await loadBrainlinkConfig();
+    return {
+        hasKey: publicKey !== null,
+        publicKey,
+        remote: config.vaultRemote ?? null,
+        autoVersion: config.autoVersion
+    };
+};
+// Accept only a bare SSH git URL (git@host:… or ssh://host/…). https URLs and
+// any URL carrying an inline credential are refused so no secret is ever written
+// to .git/config.
+const validateRemoteUrl = (remoteUrl) => {
+    const trimmed = remoteUrl.trim();
+    if (trimmed.length === 0) {
+        return { ok: false, reason: 'missing-remote' };
+    }
+    const isSsh = trimmed.startsWith('git@') || trimmed.startsWith('ssh://');
+    const hasInlineCredential = /\/\/[^/@]*:[^/@]*@/.test(trimmed) || /@[^/]*:[^/]*@/.test(trimmed);
+    if (!isSsh || hasInlineCredential) {
+        return { ok: false, reason: 'ssh-url-required' };
+    }
+    return { ok: true };
+};
+const dirHasMarkdown = async (dir) => {
+    const walk = async (current) => {
+        const entries = await readdir(current, { withFileTypes: true }).catch(() => []);
+        for (const entry of entries) {
+            if (entry.name === '.git') {
+                continue;
+            }
+            const full = join(current, entry.name);
+            if (entry.isDirectory()) {
+                if (await walk(full)) {
+                    return true;
+                }
+            }
+            else if (entry.name.toLowerCase().endsWith('.md')) {
+                return true;
+            }
+        }
+        return false;
+    };
+    return walk(dir);
+};
+const persistVersioningConfig = async (remoteUrl) => {
+    const raw = await readFile(getGlobalConfigPath(), 'utf8').catch(() => '{}');
+    const parsed = JSON.parse(raw);
+    const merged = { ...parsed, vaultRemote: remoteUrl, autoVersion: true };
+    await writeRawConfig('global', merged);
+};
+export const connectVaultRemote = async (vaultPath, remoteUrl) => {
+    const validation = validateRemoteUrl(remoteUrl);
+    if (!validation.ok) {
+        return { ok: false, reason: validation.reason };
+    }
+    const remote = remoteUrl.trim();
+    const keyPath = getVaultDeployKeyPath();
+    try {
+        await ensureDeployKey();
+    }
+    catch {
+        return { ok: false, reason: 'no-deploy-key' };
+    }
+    if (!(await fileExists(keyPath))) {
+        return { ok: false, reason: 'no-deploy-key' };
+    }
+    const sshEnv = buildSshEnv(keyPath);
+    const sshCommand = sshEnv.GIT_SSH_COMMAND;
+    let cloneDir = null;
+    try {
+        cloneDir = await mkdtemp(join(tmpdir(), 'brainlink-vault-clone-'));
+        const clone = await runProcess('git', ['clone', remote, cloneDir], { env: sshEnv });
+        if (clone.code !== 0) {
+            return { ok: false, reason: 'clone-failed' };
+        }
+        // CLONE-AND-AGGREGATE, conflict-preserving. Skip when the remote has no
+        // markdown (empty/unborn repo) so aggregated stays undefined.
+        let aggregated;
+        if (await dirHasMarkdown(cloneDir)) {
+            const envelope = await buildSnapshotEnvelope(cloneDir);
+            const result = await applySnapshotEnvelope(envelope, vaultPath, {});
+            aggregated = { imported: result.imported, conflicted: result.conflicted };
+        }
+        // Ensure the vault is a git repo and wire origin (add or set-url via
+        // initVaultGit) + core.sshCommand so future pull/push authenticate with the
+        // deploy key.
+        const { root } = await initVaultGit(vaultPath, { remote });
+        const sshConfig = await runProcess('git', ['config', 'core.sshCommand', sshCommand], { cwd: root, env: sshEnv });
+        if (sshConfig.code !== 0) {
+            return { ok: false, reason: 'config-failed' };
+        }
+        await persistVersioningConfig(remote);
+        // Best-effort: push the merged state so the remote reflects the vault. A
+        // push failure is non-fatal — the connection itself succeeded.
+        try {
+            await commitVault(vaultPath, 'chore: connect vault remote');
+            await pushVault(vaultPath);
+        }
+        catch {
+            // non-fatal
+        }
+        return aggregated ? { ok: true, aggregated } : { ok: true };
+    }
+    catch {
+        return { ok: false, reason: 'clone-failed' };
+    }
+    finally {
+        if (cloneDir) {
+            await rm(cloneDir, { recursive: true, force: true }).catch(() => undefined);
+        }
+    }
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@andespindola/brainlink",
-  "version": "1.6.9",
+  "version": "1.6.11",
   "description": "Local-first knowledge memory for agents with Markdown, backlinks, indexing and context retrieval.",
   "type": "module",
   "license": "MIT",