@codemem/server 0.22.0 → 0.22.1

package/dist/index.d.ts

@@ -10,6 +10,7 @@
 import type { ObserverClient } from "@codemem/core";
 import { MemoryStore, type RawEventSweeper, VERSION } from "@codemem/core";
 import { Hono } from "hono";
+import { type InMemoryRequestRateLimiter } from "./request-rate-limit.js";
 export { VERSION };
 /** Get (or create) the shared store instance. Exported so the sweeper can share it. */
 export declare function getStore(): MemoryStore;
@@ -23,6 +24,13 @@ export interface AppOptions {
     storeFactory?: () => MemoryStore;
     sweeper?: RawEventSweeper | null;
     observer?: ObserverClient | null;
+    syncRequestRateLimit?: {
+        limiter?: InMemoryRequestRateLimiter;
+        readLimit?: number;
+        mutationLimit?: number;
+        unauthenticatedReadLimit?: number;
+        unauthenticatedMutationLimit?: number;
+    };
     getSyncRuntimeStatus?: () => {
         phase: "starting" | "running" | "stopping" | "error" | "disabled" | "rebootstrapping" | "needs_attention" | null;
         detail?: string | null;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,KAAK,eAAe,EAAiB,OAAO,EAAE,MAAM,eAAe,CAAC;AAE1F,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAS5B,OAAO,EAAE,OAAO,EAAE,CAAC;AAKnB,uFAAuF;AACvF,wBAAgB,QAAQ,IAAI,WAAW,CAKtC;AAED,mDAAmD;AACnD,wBAAgB,UAAU,IAAI,IAAI,CAGjC;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IAC1B,YAAY,CAAC,EAAE,MAAM,WAAW,CAAC;IACjC,OAAO,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IACjC,oBAAoB,CAAC,EAAE,MAAM;QAC5B,KAAK,EACF,UAAU,GACV,SAAS,GACT,UAAU,GACV,OAAO,GACP,UAAU,GACV,iBAAiB,GACjB,iBAAiB,GACjB,IAAI,CAAC;QACR,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACvB,GAAG,IAAI,CAAC;CACT;AAED,wBAAgB,SAAS,CAAC,IAAI,CAAC,EAAE,UAAU,8EAuD1C;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,IAAI,CAAC,EAAE,UAAU,8EAS9C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,KAAK,eAAe,EAAiB,OAAO,EAAE,MAAM,eAAe,CAAC;AAE1F,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAEN,KAAK,0BAA0B,EAC/B,MAAM,yBAAyB,CAAC;AAQjC,OAAO,EAAE,OAAO,EAAE,CAAC;AAKnB,uFAAuF;AACvF,wBAAgB,QAAQ,IAAI,WAAW,CAKtC;AAED,mDAAmD;AACnD,wBAAgB,UAAU,IAAI,IAAI,CAGjC;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IAC1B,YAAY,CAAC,EAAE,MAAM,WAAW,CAAC;IACjC,OAAO,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IACjC,oBAAoB,CAAC,EAAE;QACtB,OAAO,CAAC,EAAE,0BAA0B,CAAC;QACrC,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,wBAAwB,CAAC,EAAE,MAAM,CAAC;QAClC,4BAA4B,CAAC,EAAE,MAAM,CAAC;KACtC,CAAC;IACF,oBAAoB,CAAC,EAAE,MAAM;QAC5B,KAAK,EACF,UAAU,GACV,SAAS,GACT,UAAU,GACV,OAAO,GACP,UAAU,GACV,iBAAiB,GACjB,iBAAiB,GACjB,IAAI,CAAC;QACR,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACvB,GAAG,IAAI,CAAC;CACT;AAED,wBAAgB,SAAS,CAAC,IAAI,CAAC,EAAE,UAAU,8EAuD1C;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,IAAI,CAAC,EAAE,UAAU,8EA8B9C"}

package/dist/index.js

@@ -1,9 +1,10 @@
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { CODEMEM_CONFIG_ENV_OVERRIDES, DEFAULT_TIME_WINDOW_S, MemoryStore, VERSION, applyReplicationOps, buildFilterClausesWithContext, buildRawEventEnvelopeFromHook, cleanupNonces, coordinatorCreateInviteAction, coordinatorImportInviteAction, coordinatorReviewJoinRequestAction, coordinatorStatusSnapshot, createCoordinatorReciprocalApproval, ensureDeviceIdentity, extractReplicationOps, fingerprintPublicKey, fromJson, getCodememConfigPath, getCodememEnvOverrides, getSyncResetState, listCoordinatorJoinRequests, listObserverProviderOptions, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, parseStrictInteger, probeAvailableCredentials, readCodememConfigFile, readCoordinatorSyncConfig, recordNonce, resolveDbPath, runSyncPass, schema, stripJsonComments, stripPrivateObj, stripTrailingCommas, verifySignature, writeCodememConfigFile } from "@codemem/core";
+import { CODEMEM_CONFIG_ENV_OVERRIDES, DEFAULT_TIME_WINDOW_S, MemoryStore, VERSION, VERSION as VERSION$1, applyReplicationOps, buildFilterClausesWithContext, buildRawEventEnvelopeFromHook, cleanupNonces, coordinatorCreateInviteAction, coordinatorImportInviteAction, coordinatorReviewJoinRequestAction, coordinatorStatusSnapshot, createCoordinatorReciprocalApproval, ensureDeviceIdentity, extractReplicationOps, fingerprintPublicKey, fromJson, getCodememConfigPath, getCodememEnvOverrides, getSyncResetState, listCoordinatorJoinRequests, listObserverProviderOptions, loadMemorySnapshotPageForPeer, loadReplicationOpsForPeer, lookupCoordinatorPeers, mergeAddresses, parseStrictInteger, probeAvailableCredentials, readCodememConfigFile, readCoordinatorSyncConfig, recordNonce, resolveDbPath, runSyncPass, schema, stripJsonComments, stripPrivateObj, stripTrailingCommas, verifySignature, writeCodememConfigFile } from "@codemem/core";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono } from "hono";
 import { createMiddleware } from "hono/factory";
+import { RateLimiter } from "limiter";
 import { homedir } from "node:os";
 import { count, desc, eq, inArray, isNotNull, max, ne } from "drizzle-orm";
 import { drizzle } from "drizzle-orm/better-sqlite3";
@@ -113,6 +114,49 @@ function preflightHandler() {
 	});
 }
 //#endregion
+//#region src/request-rate-limit.ts
+function createInMemoryRequestRateLimiter(windowMs = 6e4) {
+	const safeWindowMs = Math.max(1e3, Math.trunc(windowMs));
+	const buckets = /* @__PURE__ */ new Map();
+	let checks = 0;
+	function estimatedRetryAfterS(limit) {
+		return Math.max(1, Math.ceil(safeWindowMs / Math.max(1, limit) / 1e3));
+	}
+	function cleanupExpiredBuckets(currentNow) {
+		if (buckets.size < 64 || checks % 64 !== 0) return;
+		const staleBefore = currentNow - safeWindowMs * 10;
+		for (const [key, bucket] of buckets) if (bucket.lastUsedAt < staleBefore) buckets.delete(key);
+	}
+	return { check(key, limit) {
+		checks += 1;
+		const currentNow = Date.now();
+		cleanupExpiredBuckets(currentNow);
+		const safeLimit = Math.max(1, Math.trunc(limit));
+		const bucketKey = `${safeLimit}:${key}`;
+		let bucket = buckets.get(bucketKey);
+		if (!bucket) {
+			bucket = {
+				limiter: new RateLimiter({
+					tokensPerInterval: safeLimit,
+					interval: safeWindowMs,
+					fireImmediately: true
+				}),
+				lastUsedAt: currentNow
+			};
+			buckets.set(bucketKey, bucket);
+		}
+		bucket.lastUsedAt = currentNow;
+		if (bucket.limiter.tryRemoveTokens(1)) return {
+			allowed: true,
+			retryAfterS: 0
+		};
+		return {
+			allowed: false,
+			retryAfterS: estimatedRetryAfterS(safeLimit)
+		};
+	} };
+}
+//#endregion
 //#region src/routes/config.ts
 /**
 * Config routes — GET /api/config, POST /api/config.
@@ -120,6 +164,7 @@ function preflightHandler() {
 * Ports the user-facing config read/write path from Python's
 * codemem/viewer_routes/config.py, scoped to the TS runtime's current needs.
 */
+var REDACTED_VALUE = "[redacted]";
 var RUNTIMES = new Set(["api_http", "claude_sidecar"]);
 var AUTH_SOURCES = new Set([
 	"auto",
@@ -129,6 +174,20 @@ var AUTH_SOURCES = new Set([
 	"none"
 ]);
 var HOT_RELOAD_KEYS = new Set(["raw_events_sweeper_interval_s"]);
+var PROTECTED_WRITE_KEYS = new Set([
+	"claude_command",
+	"observer_base_url",
+	"observer_auth_file",
+	"observer_auth_command",
+	"observer_headers",
+	"sync_coordinator_url"
+]);
+var SECRET_CONFIG_KEYS = new Set([
+	"observer_auth_file",
+	"observer_auth_command",
+	"observer_headers",
+	"sync_coordinator_admin_secret"
+]);
 var ALLOWED_KEYS = [
 	"claude_command",
 	"observer_base_url",
@@ -216,6 +275,43 @@ function getEffectiveConfig(configData) {
 	}
 	return effective;
 }
+function redactConfigValue(key, value) {
+	if (value == null || !SECRET_CONFIG_KEYS.has(key)) return value;
+	if (Array.isArray(value)) return value.length > 0 ? REDACTED_VALUE : [];
+	if (typeof value === "object") return Object.keys(value).length > 0 ? REDACTED_VALUE : {};
+	if (typeof value === "string") return value.trim() ? REDACTED_VALUE : "";
+	return REDACTED_VALUE;
+}
+function sanitizeConfigForResponse(configData) {
+	const sanitized = {};
+	for (const [key, value] of Object.entries(configData)) sanitized[key] = redactConfigValue(key, value);
+	return sanitized;
+}
+function configValuesEqual(left, right) {
+	if (Object.is(left, right)) return true;
+	if (left == null || right == null) return left == null && right == null;
+	if (typeof left === "object" || typeof right === "object") return JSON.stringify(left) === JSON.stringify(right);
+	return false;
+}
+function partitionViewerUpdates(updates, beforeConfig) {
+	const allowedUpdates = {};
+	for (const [key, value] of Object.entries(updates)) {
+		if (!PROTECTED_WRITE_KEYS.has(key)) {
+			allowedUpdates[key] = value;
+			continue;
+		}
+		if (SECRET_CONFIG_KEYS.has(key) && value === REDACTED_VALUE) continue;
+		if (configValuesEqual(value, beforeConfig[key])) continue;
+		return {
+			allowedUpdates: {},
+			error: `${key} cannot be changed from the viewer API; edit the config file or environment instead`
+		};
+	}
+	return {
+		allowedUpdates,
+		error: null
+	};
+}
 function parsePositiveInt(value, allowZero = false) {
 	if (typeof value === "boolean") return null;
 	const parsed = typeof value === "number" ? value : typeof value === "string" && /^-?\d+$/.test(value.trim()) ? Number(value.trim()) : NaN;
@@ -322,12 +418,14 @@ function configRoutes(opts = {}) {
 	app.get("/api/config", (c) => {
 		const configPath = getConfigPath();
 		const configData = readConfigFile(configPath);
+		const effective = getEffectiveConfig(configData);
 		return c.json({
 			path: configPath,
-			config: configData,
+			config: sanitizeConfigForResponse(configData),
 			defaults: DEFAULTS,
-			effective: getEffectiveConfig(configData),
+			effective: sanitizeConfigForResponse(effective),
 			env_overrides: getCodememEnvOverrides(),
+			protected_keys: [...PROTECTED_WRITE_KEYS].sort(),
 			providers: loadProviderOptions()
 		});
 	});
@@ -343,13 +441,15 @@ function configRoutes(opts = {}) {
 		const updates = "config" in payload && payload.config != null && typeof payload.config === "object" && !Array.isArray(payload.config) ? payload.config : payload;
 		const configPath = getCodememConfigPath();
 		const beforeConfig = readCodememConfigFile();
+		const { allowedUpdates, error: protectedKeyError } = partitionViewerUpdates(updates, beforeConfig);
+		if (protectedKeyError) return c.json({ error: protectedKeyError }, 403);
 		const beforeEffective = getEffectiveConfig(beforeConfig);
 		const nextConfig = { ...beforeConfig };
 		const providers = new Set(loadProviderOptions());
-		const touchedKeys = ALLOWED_KEYS.filter((key) => key in updates);
+		const touchedKeys = ALLOWED_KEYS.filter((key) => key in allowedUpdates);
 		for (const key of ALLOWED_KEYS) {
-			if (!(key in updates)) continue;
-			const error = validateAndApplyUpdate(nextConfig, key, updates[key], providers);
+			if (!(key in allowedUpdates)) continue;
+			const error = validateAndApplyUpdate(nextConfig, key, allowedUpdates[key], providers);
 			if (error) return c.json({ error }, 400);
 		}
 		let savedPath;
@@ -371,8 +471,9 @@ function configRoutes(opts = {}) {
 		const restartRequiredKeys = effectiveChangedKeys.filter((key) => !HOT_RELOAD_KEYS.has(key) && !(key in envOverrides));
 		return c.json({
 			path: savedPath,
-			config: nextConfig,
-			effective: afterEffective,
+			config: sanitizeConfigForResponse(nextConfig),
+			effective: sanitizeConfigForResponse(afterEffective),
+			protected_keys: [...PROTECTED_WRITE_KEYS].sort(),
 			effects: {
 				saved_keys: savedChangedKeys,
 				effective_keys: effectiveChangedKeys,
@@ -1079,6 +1180,11 @@ function rawEventsRoutes(getStore, sweeper) {
 //#endregion
 //#region src/routes/stats.ts
 /**
+* Stats routes — GET /api/stats, GET /api/usage.
+*
+* Ports Python's viewer_routes/stats.py.
+*/
+/**
 * Create stats routes. The store factory is called per-request to get a
 * fresh connection (matching the Python viewer pattern).
 */
@@ -1099,6 +1205,9 @@ function statsRoutes(getStore) {
 			viewer_pid: process.pid
 		});
 	});
+	app.get("/api/runtime", (c) => {
+		return c.json({ version: VERSION$1 });
+	});
 	app.get("/api/usage", (c) => {
 		const store = getStore();
 		{
@@ -1185,6 +1294,31 @@ function intEnvOr(name, fallback) {
 }
 var MAX_SYNC_BODY_BYTES = intEnvOr("CODEMEM_SYNC_MAX_BODY_BYTES", 1048576);
 var MAX_SYNC_OPS = intEnvOr("CODEMEM_SYNC_MAX_OPS", 2e3);
+async function readBoundedRequestBytes(request, maxBytes) {
+	const contentLength = Number.parseInt(request.headers.get("content-length") ?? "", 10);
+	if (Number.isFinite(contentLength) && contentLength > maxBytes) return null;
+	const stream = request.body;
+	if (!stream) return Buffer.alloc(0);
+	const reader = stream.getReader();
+	const chunks = [];
+	let total = 0;
+	try {
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			if (!value) continue;
+			total += value.byteLength;
+			if (total > maxBytes) {
+				await reader.cancel();
+				return null;
+			}
+			chunks.push(value);
+		}
+	} finally {
+		reader.releaseLock();
+	}
+	return Buffer.concat(chunks.map((chunk) => Buffer.from(chunk)));
+}
 var PAIRING_FILTER_HINT = "Run this on another device with codemem sync pair --accept '<payload>'. On the accepting device, --include/--exclude control both what it sends and what it accepts from that peer.";
 function pathWithQuery(url) {
 	const parsed = new URL(url);
@@ -1645,12 +1779,26 @@ var PEERS_QUERY = `
 * network-accessible. All requests are auth-gated via signature
 * verification so unauthenticated callers are rejected.
 */
-function syncProtocolRoutes(getStore) {
+function syncProtocolRoutes(getStore, opts = {}) {
 	const app = new Hono();
+	const routeRateLimit = opts.routeRateLimit ?? null;
+	function rateLimitedResponse(c, key, authenticated) {
+		if (!routeRateLimit) return null;
+		const isRead = c.req.method === "GET" || c.req.method === "HEAD" || c.req.method === "OPTIONS";
+		const result = routeRateLimit.limiter.check(`${c.req.method}:${authenticated ? "auth" : "anon"}:${key}`, authenticated ? isRead ? routeRateLimit.readLimit : routeRateLimit.mutationLimit : isRead ? routeRateLimit.unauthenticatedReadLimit : routeRateLimit.unauthenticatedMutationLimit);
+		if (result.allowed) return null;
+		c.header("Retry-After", String(result.retryAfterS));
+		return c.json({
+			error: "rate_limited",
+			retry_after_s: result.retryAfterS
+		}, 429);
+	}
 	app.get("/v1/status", (c) => {
 		const store = getStore();
 		const auth = authorizeSyncRequest(store, c.req, Buffer.alloc(0));
-		if (!auth.ok) return c.json(unauthorizedPayload(auth.reason), 401);
+		if (!auth.ok) return rateLimitedResponse(c, c.req.path, false) ?? c.json(unauthorizedPayload(auth.reason), 401);
+		const limited = rateLimitedResponse(c, auth.deviceId, true);
+		if (limited) return limited;
 		try {
 			let device = store.db.prepare("SELECT device_id, fingerprint FROM sync_device LIMIT 1").get();
 			if (!device) {
@@ -1674,7 +1822,9 @@ function syncProtocolRoutes(getStore) {
 	app.get("/v1/ops", (c) => {
 		const store = getStore();
 		const auth = authorizeSyncRequest(store, c.req, Buffer.alloc(0));
-		if (!auth.ok) return c.json(unauthorizedPayload(auth.reason), 401);
+		if (!auth.ok) return rateLimitedResponse(c, c.req.path, false) ?? c.json(unauthorizedPayload(auth.reason), 401);
+		const limited = rateLimitedResponse(c, auth.deviceId, true);
+		if (limited) return limited;
 		const peerDeviceId = auth.deviceId;
 		try {
 			const since = c.req.query("since") ?? null;
@@ -1720,7 +1870,9 @@ function syncProtocolRoutes(getStore) {
 	app.get("/v1/snapshot", (c) => {
 		const store = getStore();
 		const auth = authorizeSyncRequest(store, c.req, Buffer.alloc(0));
-		if (!auth.ok) return c.json(unauthorizedPayload(auth.reason), 401);
+		if (!auth.ok) return rateLimitedResponse(c, c.req.path, false) ?? c.json(unauthorizedPayload(auth.reason), 401);
+		const limited = rateLimitedResponse(c, auth.deviceId, true);
+		if (limited) return limited;
 		try {
 			const rawGeneration = c.req.query("generation");
 			const generation = rawGeneration != null && rawGeneration.trim().length > 0 ? Number.parseInt(rawGeneration, 10) : null;
@@ -1756,10 +1908,12 @@ function syncProtocolRoutes(getStore) {
 	});
 	app.post("/v1/ops", async (c) => {
 		const store = getStore();
-		const raw = Buffer.from(await c.req.arrayBuffer());
-		if (raw.length > MAX_SYNC_BODY_BYTES) return c.json({ error: "payload_too_large" }, 413);
+		const raw = await readBoundedRequestBytes(c.req.raw, MAX_SYNC_BODY_BYTES);
+		if (raw == null) return c.json({ error: "payload_too_large" }, 413);
 		const auth = authorizeSyncRequest(store, c.req, raw);
-		if (!auth.ok) return c.json(unauthorizedPayload(auth.reason), 401);
+		if (!auth.ok) return rateLimitedResponse(c, c.req.path, false) ?? c.json(unauthorizedPayload(auth.reason), 401);
+		const limited = rateLimitedResponse(c, auth.deviceId, true);
+		if (limited) return limited;
 		const peerDeviceId = auth.deviceId;
 		let body;
 		try {
@@ -1907,7 +2061,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 			const sharingReview = store.sharingReviewSummary(project);
 			const coordinator = redactCoordinatorStatus(await coordinatorStatusSnapshot(store, config), showDiag);
 			let joinRequests = [];
-			if (includeJoinRequests && config.syncCoordinatorAdminSecret) try {
+			if (includeJoinRequests && showDiag && config.syncCoordinatorAdminSecret) try {
 				joinRequests = await listCoordinatorJoinRequests(config);
 			} catch {
 				joinRequests = [];
@@ -1942,7 +2096,7 @@ function syncRoutes(getStore, getSyncRuntimeStatus) {
 				sharing_review: sharingReview,
 				coordinator
 			};
-			if (includeJoinRequests) responsePayload.join_requests = joinRequests;
+			if (includeJoinRequests && showDiag) responsePayload.join_requests = joinRequests;
 			return c.json(responsePayload);
 		}
 	});
@@ -2447,8 +2601,18 @@ function createApp(opts) {
 */
 function createSyncApp(opts) {
 	const storeFactory = opts?.storeFactory ?? getStore;
+	const requestRateLimit = opts?.syncRequestRateLimit ?? {};
+	const rateLimiter = requestRateLimit.limiter ?? createInMemoryRequestRateLimiter();
+	const readLimit = Math.max(1, Math.trunc(requestRateLimit.readLimit ?? 120));
+	const mutationLimit = Math.max(1, Math.trunc(requestRateLimit.mutationLimit ?? 30));
 	const app = new Hono();
-	app.route("/", syncProtocolRoutes(storeFactory));
+	app.route("/", syncProtocolRoutes(storeFactory, { routeRateLimit: {
+		limiter: rateLimiter,
+		readLimit,
+		mutationLimit,
+		unauthenticatedReadLimit: Math.max(1, Math.trunc(requestRateLimit.unauthenticatedReadLimit ?? Math.min(20, readLimit))),
+		unauthenticatedMutationLimit: Math.max(1, Math.trunc(requestRateLimit.unauthenticatedMutationLimit ?? Math.min(10, mutationLimit)))
+	} }));
 	app.all("*", (c) => c.json({ error: "not found" }, 404));
 	return app;
 }