@atlaso-labs/opencode 0.1.1 → 0.2.0

package/CHANGELOG.md

@@ -0,0 +1,31 @@
+# Changelog
+
+## 0.2.0
+
+**Your memories now survive a bad connection.** Capture used to send a memory once
+and, if anything went wrong — a timeout, a server hiccup, a dropped wifi
+connection — it was gone, with nothing kept locally and nothing to tell you. Every
+memory is now written to disk *before* it is sent and retried automatically on a
+later turn. A memory is never silently lost; if one truly cannot be delivered it is
+set aside with a reason rather than discarded.
+
+**Removing the plugin now really stops it, on every platform.** On Windows the
+plugin could not obtain its own credential, which meant it never learned it had been
+removed and kept syncing. Fixed.
+
+**Secrets stay on your machine.** Explicit `remember` calls and recall queries are
+now scrubbed on-device, matching what automatic capture already did. Previously a
+key pasted into an explicit save or a search left your machine (it was redacted
+before storage, but it should never have been sent at all).
+
+**Memory stays in the right project.** Per-project filtering now applies to the
+`recall` and `recent` tools, so one repository's notes no longer surface in another.
+Repositories cloned over SSH with a custom port no longer split into two separate
+projects. An explicit save can now be scoped to a project instead of always being
+personal.
+
+**Fixes**
+- `status` no longer reports "connected" when the server is unreachable.
+- Concurrent tool calls can no longer interleave and corrupt the MCP transport.
+- A preference that merely mentions a file path is no longer trapped in one repo.
+- A valid credential is no longer discarded and re-minted on every run.

package/lib/atlaso.ts

@@ -6,21 +6,35 @@
  * endpoints over the global `fetch`. The engine stays on the server; this only
  * knows the URLs — the IP thin-client rule, in TypeScript.
  *
- * v1 is ONLINE-FIRST: no local cache / outbox / sync (deferred — see README).
+ * NO local RECALL cache — reads always go to the brain, keeping the ranking
+ * engine server-side (the IP thin-client rule). WRITES are durable: deposits go
+ * through lib/outbox.ts write-ahead and are retried by lib/drain.ts, so a
+ * timeout, 5xx, 429, WAF block or offline laptop can no longer silently lose a
+ * user's memory the way v1 did.
  * Every call is FAIL-OPEN (memory must never break a Cursor turn): callers get
  * `[]` / `false` on any error — never a throw. A REACHED-but-rejected token
  * (HTTP 401/403) is the one authoritative signal: we retire auth.json so the next
  * session re-authorizes (mirrors the Python client's AuthRejected handling).
  */
-import { readFileSync, renameSync } from "node:fs";
+import {
+  closeSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync,
+} from "node:fs";
+import { createHash, randomUUID } from "node:crypto";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { scrub } from "./capture";
 
 export interface Auth {
   server: string;
   token: string;
   user_id?: string;
   device_id?: string;
+  // Where this credential came from — set by resolveCredential (lib/credential.ts).
+  // "own" = the tool's OWN ~/.atlaso/tools/<tool>.json; "shared" = the shared bearer.
+  // undefined = a bare loadAuth() result (treated as shared for retirement). This is
+  // what lets a rejected per-tool token retire ONLY that file, never the shared one.
+  source?: "own" | "shared";
+  tool?: string; // the tool slug, when source === "own"
 }
 
 export interface RecallResult {
@@ -89,8 +103,91 @@ export function markRevoked(): void {
   }
 }
 
-/** One bearer-authed JSON call, hard-bounded by a timeout. null on ANY non-2xx
- *  or transport/parse error; 401/403 also retires the (revoked) token. */
+// ── per-tool credentials (~/.atlaso/tools/<tool>.json) ───────────────────────────
+//
+// Each Atlaso integration on a machine holds its OWN credential, minted from the
+// shared bearer (see lib/credential.ts). That's what lets the brain tell two tools
+// on one device apart, so removing one truly stops it. ONE FILE PER TOOL (not a map
+// inside auth.json): two hooks can fire concurrently, and separate files + a kernel
+// lock avoid a read-modify-write clobber. This module owns the file I/O; the mint
+// state machine lives in lib/credential.ts.
+
+export function toolsDir(): string {
+  return join(atlasoDir(), "tools");
+}
+
+export function toolAuthPath(tool: string): string {
+  return join(toolsDir(), `${tool}.json`);
+}
+
+export function toolLockPath(tool: string): string {
+  return join(toolsDir(), `${tool}.lock`);
+}
+
+/** {server, token, user_id, device_id, tool} from tools/<tool>.json, or null. */
+export function loadToolAuth(tool: string): Auth | null {
+  try {
+    const o = JSON.parse(readFileSync(toolAuthPath(tool), "utf-8"));
+    if (o && typeof o === "object" && typeof o.token === "string" && o.token) {
+      return {
+        server: typeof o.server === "string" && o.server ? o.server : defaultServer(),
+        token: o.token,
+        user_id: o.user_id,
+        device_id: o.device_id,
+        tool,
+        source: "own",
+      };
+    }
+  } catch {
+    /* missing / unreadable → no per-tool credential yet */
+  }
+  return null;
+}
+
+/** Atomically + durably write tools/<tool>.json at 0600 (O_EXCL temp + fsync +
+ *  atomic rename) — a torn credential file would brick the integration. */
+export function saveToolAuth(tool: string, cred: Record<string, unknown>): void {
+  const dir = toolsDir();
+  mkdirSync(dir, { recursive: true });
+  const p = toolAuthPath(tool);
+  const tmp = join(dir, `.${tool}.${process.pid}.${randomUUID()}.tmp`);
+  const fd = openSync(tmp, "wx", 0o600); // O_CREAT|O_EXCL|O_WRONLY, owner-only
+  try {
+    writeFileSync(fd, JSON.stringify(cred, null, 2));
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+  renameSync(tmp, p);
+}
+
+/** Remove a per-tool credential (a rejected token, or a foreign leftover). The
+ *  shared auth.json and the lock file are untouched. */
+export function clearToolAuth(tool: string): void {
+  try {
+    unlinkSync(toolAuthPath(tool));
+  } catch {
+    /* already gone */
+  }
+}
+
+/** Retire the credential a rejected call was made with — the ONE thing that takes a
+ *  client offline, so it is source-aware and never over-reaches:
+ *   - source "own"  → drop ONLY tools/<tool>.json; the shared auth.json (and any
+ *     other tool riding it) is untouched. resolveCredential re-mints next run, or the
+ *     server refuses (tombstoned tool) and it goes local-only.
+ *   - source "shared"/undefined → retire the shared bearer, as before.
+ *  Called only for a VERIFIED verdict (see call()). */
+function retireForAuth(auth: Auth): void {
+  if (auth.source === "own" && auth.tool) clearToolAuth(auth.tool);
+  else markRevoked();
+}
+
+/** One bearer-authed JSON call, hard-bounded by a timeout. null on ANY non-2xx or
+ *  transport/parse error. A 401/403 retires the token ONLY when the response is a
+ *  VERIFIED verdict from our own brain — `x-atlaso-response: 1`, stamped by a global
+ *  middleware on every app response including errors. An edge/WAF 403 lacks it and
+ *  must NOT take us offline (never-brick; the WAF sync-brick incident). */
 async function call(
   auth: Auth,
   method: string,
@@ -98,6 +195,32 @@ async function call(
   body: unknown,
   timeoutMs: number,
 ): Promise<any | null> {
+  return (await callDetailed(auth, method, path, body, timeoutMs)).data;
+}
+
+/** Outcome of one call, with enough detail for the outbox to classify a failure.
+ *  `call()` above collapses this to data-or-null for the many call sites that only
+ *  need "did it work"; the deposit path needs the WHY, because "retry forever",
+ *  "stop retrying", and "this will never succeed" are three different answers and
+ *  guessing wrong either loses a memory or wedges the queue. */
+export interface CallOutcome {
+  data: any | null;
+  /** HTTP status, or 0 when the request never produced a response (timeout,
+   *  DNS failure, connection reset, unparseable body). */
+  status: number;
+  /** True when the response positively identifies as OUR brain rather than an
+   *  edge/WAF page — the same marker that gates credential retirement. */
+  ours: boolean;
+  error?: string;
+}
+
+export async function callDetailed(
+  auth: Auth,
+  method: string,
+  path: string,
+  body: unknown,
+  timeoutMs: number,
+): Promise<CallOutcome> {
   const ctrl = new AbortController();
   const timer = setTimeout(() => ctrl.abort(), timeoutMs);
   try {
@@ -110,14 +233,24 @@ async function call(
       body: body ? JSON.stringify(body) : undefined,
       signal: ctrl.signal,
     });
+    const ours = res.headers?.get("x-atlaso-response") === "1";
     if (res.status === 401 || res.status === 403) {
-      markRevoked(); // authoritative: token rejected → re-authorize next session
-      return null;
+      // Only OUR server's verdict may retire a credential — an edge/WAF block is not one.
+      if (ours) retireForAuth(auth);
+      return { data: null, status: res.status, ours };
     }
-    if (!res.ok) return null;
-    return await res.json();
-  } catch {
-    return null; // transport/timeout/parse — transient, leave auth.json intact
+    if (!res.ok) return { data: null, status: res.status, ours };
+    try {
+      return { data: await res.json(), status: res.status, ours };
+    } catch {
+      // 2xx with an unreadable body: the write may well have landed. Report it as
+      // a transport-class failure so the caller RETRIES — the deposit is
+      // idempotent on client_id, so a retry cannot duplicate.
+      return { data: null, status: 0, ours, error: "unparseable body" };
+    }
+  } catch (e) {
+    // transport/timeout/abort — transient, leave auth.json intact
+    return { data: null, status: 0, ours: false, error: String(e).slice(0, 200) };
   } finally {
     clearTimeout(timer);
   }
@@ -134,7 +267,11 @@ export async function recall(
   project?: string,
   session?: string,
 ): Promise<RecallResult[]> {
-  const params = new URLSearchParams({ q: query, limit: String(limit) });
+  // Explicit MCP queries are user/agent-controlled too. Scrub BEFORE building the
+  // URL so a pasted token cannot escape through the READ path while searching
+  // memory — the write path is not the only way a secret leaves the machine.
+  const safeQuery = scrub(query || "")[0];
+  const params = new URLSearchParams({ q: safeQuery, limit: String(limit) });
   if (project) params.set("project", project);
   if (session) params.set("session", session);
   const data = await call(auth, "GET", `/v1/recall?${params.toString()}`, null, RECALL_TIMEOUT_MS);
@@ -150,12 +287,58 @@ export async function recent(auth: Auth, limit = 8): Promise<RecallResult[]> {
   return Array.isArray(deposits) ? deposits : [];
 }
 
+export interface DepositOutcome {
+  ok: boolean;
+  results: Array<{ client_id?: string; status?: string }>;
+  /** Transport/HTTP detail so the outbox can decide retry vs quarantine. */
+  status: number;
+  ours: boolean;
+  error?: string;
+}
+
+/** Batch deposit exposing the full outcome. The outbox drain uses this; everything
+ *  that only cares "did it work" uses `depositWithResults` below. */
+export async function depositDetailed(
+  auth: Auth,
+  items: DepositItem[],
+  captureStats?: unknown[],
+): Promise<DepositOutcome> {
+  if (!items.length && !(captureStats && captureStats.length)) {
+    return { ok: false, results: [], status: 0, ours: false, error: "empty" };
+  }
+  const body: Record<string, unknown> = { items };
+  if (captureStats && captureStats.length) body.capture_stats = captureStats;
+  const out = await callDetailed(auth, "POST", "/v1/memories/batch", body, DEPOSIT_TIMEOUT_MS);
+  return {
+    ok: !!out.data,
+    results: Array.isArray(out.data?.results) ? out.data.results : [],
+    status: out.status,
+    ours: out.ours,
+    error: out.error,
+  };
+}
+
+/** Batch deposit returning the server's per-item verdicts (added/duplicate) —
+ *  the capture counters need them. `captureStats` is the ADDITIVE content-free
+ *  counter payload (old servers ignore it; items may be [] for a stats-only
+ *  flush, though the connectors currently only piggyback). */
+/** Batch deposit returning the server's per-item verdicts (added/duplicate) —
+ *  the capture counters need them. `captureStats` is the ADDITIVE content-free
+ *  counter payload (old servers ignore it; items may be [] for a stats-only
+ *  flush, though the connectors currently only piggyback). */
+export async function depositWithResults(
+  auth: Auth,
+  items: DepositItem[],
+  captureStats?: unknown[],
+): Promise<{ ok: boolean; results: Array<{ client_id?: string; status?: string }> }> {
+  const r = await depositDetailed(auth, items, captureStats);
+  return { ok: r.ok, results: r.results };
+}
+
 /** Batch deposit (the server re-scrubs + runs the worth-keeping gate). The
  *  client_id is the server idempotency key, so a retry never duplicates. */
 export async function deposit(auth: Auth, items: DepositItem[]): Promise<boolean> {
-  if (!items.length) return false;
-  const data = await call(auth, "POST", "/v1/memories/batch", { items }, DEPOSIT_TIMEOUT_MS);
-  return !!data;
+  return (await depositWithResults(auth, items)).ok;
 }
 
 /** POST /v1/entitlement — this device's tool policy {active_tool, multi_tool,
@@ -170,3 +353,75 @@ export async function entitlementCall(auth: Auth): Promise<any | null> {
 export async function claimToolCall(auth: Auth, tool: string): Promise<any | null> {
   return call(auth, "POST", "/v1/devices/claim-tool", { tool }, RECALL_TIMEOUT_MS);
 }
+
+// ── the MCP surface: explicit remember / forget / status ─────────────────────────
+// These back the plugin's MCP tools (recall/recent already exist above). An explicit
+// user "remember" is tagged `manual` — the server enricher treats manual memories as
+// untouchable — plus the tool id for attribution. Mirrors the Cursor connector.
+
+/** Deposit ONE memory the user explicitly asked to keep. Returns the server id
+ *  (so a later `forget` can target it), or null on failure. */
+export interface RememberOptions {
+  text: string;
+  /** Extra tags (e.g. scope:project + project:<key>) so an explicit save is
+   *  scoped like an automatic capture instead of defaulting to personal —
+   *  otherwise repo-specific facts saved via MCP follow the user everywhere. */
+  tags?: string[];
+}
+
+export async function remember(auth: Auth, opts: RememberOptions): Promise<string | null> {
+  // SCRUB BEFORE SENDING. Auto-capture scrubs secrets on-device; this explicit path
+  // did not, so "remember my key is sk-..." shipped the key to the brain in clear —
+  // a hole in the on-device scrubbing guarantee, reachable from the MCP `remember`
+  // tool with arbitrary agent-supplied text. (Bugbot, cursor/plugins#157, HIGH.)
+  const t = scrub(opts.text || "")[0].trim();
+  if (!t) return null;
+  // CONTENT-DERIVED idempotency key, not a random UUID. A random key meant a
+  // timeout AFTER the server committed looked like failure, and the retry minted a
+  // NEW key — so the same fact could be stored twice, or reported unsaved when it
+  // had landed. Auto-capture already derives its key from content; the explicit
+  // path is the higher-intent one and deserves it more, not less.
+  // (Bugbot #157, "Remember lacks durable idempotency".)
+  const client_id = createHash("sha256")
+    .update(`remember\u0000${t}\u0000${(opts.tags || []).slice().sort().join(",")}`)
+    .digest("hex")
+    .slice(0, 32);
+  const tags = [...new Set(["opencode", "manual", ...(opts.tags || [])])];
+  const item: DepositItem = {
+    client_id, text: t, polarity: "open", evidence_grade: "anecdotal",
+    scope_note: null, tags,
+  };
+  const data = await call(auth, "POST", "/v1/memories/batch", { items: [item] }, DEPOSIT_TIMEOUT_MS);
+  if (!data) return null;
+  const results = Array.isArray(data.results) ? data.results : [];
+  const row = results.find((r: any) => r?.client_id === client_id) ?? results[0];
+  return row?.id ?? client_id; // durable server id when settled, else the idempotency key
+}
+
+/** DELETE /v1/memories/<id>. Success = REACHED and 2xx (the body may be empty, so we
+ *  don't route it through call()'s JSON parse). A verified 401/403 retires the token. */
+export async function forget(auth: Auth, id: string): Promise<boolean> {
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), RECALL_TIMEOUT_MS);
+  try {
+    const res = await fetch(auth.server.replace(/\/+$/, "") + `/v1/memories/${encodeURIComponent(id)}`, {
+      method: "DELETE",
+      headers: { Authorization: `Bearer ${auth.token}` },
+      signal: ctrl.signal,
+    });
+    if (res.status === 401 || res.status === 403) {
+      if (res.headers?.get("x-atlaso-response") === "1") retireForAuth(auth);
+      return false;
+    }
+    return res.ok;
+  } catch {
+    return false; // offline / transient — the memory stays; caller says "try again"
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/** GET /v1/health — {fmi, deposit_count} for the status tool. null on any error. */
+export async function health(auth: Auth): Promise<any | null> {
+  return call(auth, "GET", "/v1/health", null, RECALL_TIMEOUT_MS);
+}