@geminilight/mindos 0.6.53 → 0.6.55

package/app/app/api/file/raw/route.ts

@@ -0,0 +1,121 @@
+export const dynamic = 'force-dynamic';
+import fs from 'fs';
+import { NextRequest, NextResponse } from 'next/server';
+import { resolveSafe } from '@/lib/core/security';
+import { getMindRoot } from '@/lib/fs';
+
+/** MIME types for binary files served from the knowledge base */
+const BINARY_MIME: Record<string, string> = {
+  // Documents
+  '.pdf': 'application/pdf',
+  // Images
+  '.png': 'image/png',
+  '.jpg': 'image/jpeg',
+  '.jpeg': 'image/jpeg',
+  '.gif': 'image/gif',
+  '.webp': 'image/webp',
+  '.svg': 'image/svg+xml',
+  '.bmp': 'image/bmp',
+  '.ico': 'image/x-icon',
+  // Audio
+  '.mp3': 'audio/mpeg',
+  '.wav': 'audio/wav',
+  '.m4a': 'audio/mp4',
+  '.ogg': 'audio/ogg',
+  '.flac': 'audio/flac',
+  '.aac': 'audio/aac',
+  // Video
+  '.mp4': 'video/mp4',
+  '.webm': 'video/webm',
+  '.mov': 'video/quicktime',
+  '.mkv': 'video/x-matroska',
+};
+
+/** Max file size: 200MB for media, protects against truly absurd files */
+const MAX_RAW_SIZE = 200 * 1024 * 1024;
+
+/**
+ * GET /api/file/raw?path=<relative-path>
+ *
+ * Serve a binary file from the knowledge base with the correct Content-Type.
+ * Supports HTTP Range requests for audio/video seeking (required by <audio>/<video>).
+ *
+ * Security: path is resolved via resolveSafe() which prevents traversal attacks.
+ */
+export async function GET(req: NextRequest) {
+  const filePath = req.nextUrl.searchParams.get('path');
+  if (!filePath) {
+    return NextResponse.json({ error: 'Missing path parameter' }, { status: 400 });
+  }
+
+  const lower = filePath.toLowerCase();
+  const ext = lower.slice(lower.lastIndexOf('.'));
+  const mime = BINARY_MIME[ext];
+  if (!mime) {
+    return NextResponse.json({ error: `Unsupported binary file type: ${ext}` }, { status: 400 });
+  }
+
+  let resolved: string;
+  try {
+    resolved = resolveSafe(getMindRoot(), filePath);
+  } catch {
+    return NextResponse.json({ error: 'Access denied' }, { status: 403 });
+  }
+
+  if (!fs.existsSync(resolved)) {
+    return NextResponse.json({ error: 'File not found' }, { status: 404 });
+  }
+
+  const stat = fs.statSync(resolved);
+  if (stat.size > MAX_RAW_SIZE) {
+    return NextResponse.json(
+      { error: `File too large (${Math.round(stat.size / 1024 / 1024)}MB). Max: ${MAX_RAW_SIZE / 1024 / 1024}MB` },
+      { status: 413 },
+    );
+  }
+
+  const totalSize = stat.size;
+  const rangeHeader = req.headers.get('range');
+
+  // HTTP Range request — required for audio/video seeking
+  if (rangeHeader) {
+    const match = rangeHeader.match(/bytes=(\d+)-(\d*)/);
+    if (match) {
+      const start = Math.min(parseInt(match[1], 10), totalSize - 1);
+      const end = Math.min(match[2] ? parseInt(match[2], 10) : totalSize - 1, totalSize - 1);
+      const chunkSize = end - start + 1;
+
+      const buf = Buffer.alloc(chunkSize);
+      const fd = fs.openSync(resolved, 'r');
+      try {
+        fs.readSync(fd, buf, 0, chunkSize, start);
+      } finally {
+        fs.closeSync(fd);
+      }
+
+      return new NextResponse(buf, {
+        status: 206,
+        headers: {
+          'Content-Type': mime,
+          'Content-Length': String(chunkSize),
+          'Content-Range': `bytes ${start}-${end}/${totalSize}`,
+          'Accept-Ranges': 'bytes',
+          'Cache-Control': 'private, max-age=60',
+        },
+      });
+    }
+  }
+
+  // Full file response
+  const buf = fs.readFileSync(resolved);
+  return new NextResponse(buf, {
+    status: 200,
+    headers: {
+      'Content-Type': mime,
+      'Content-Length': String(totalSize),
+      'Accept-Ranges': 'bytes',
+      'Cache-Control': 'private, max-age=60',
+      'Content-Disposition': 'inline',
+    },
+  });
+}

package/app/app/api/file/route.ts

@@ -24,6 +24,7 @@ import {
   appendCsvRow,
   getMindRoot,
   invalidateCache,
+  getFileTree,
   listMindSpaces,
   appendContentChange,
 } from '@/lib/fs';
@@ -34,6 +35,18 @@ function err(msg: string, status = 400) {
   return NextResponse.json({ error: msg }, { status });
 }
 
+/** Recursively collect all directory paths from the file tree. */
+function collectDirectories(nodes: import('@/lib/types').FileNode[]): string[] {
+  const dirs: string[] = [];
+  for (const n of nodes) {
+    if (n.type === 'directory') {
+      dirs.push(n.path);
+      if (n.children) dirs.push(...collectDirectories(n.children));
+    }
+  }
+  return dirs;
+}
+
 /** Returns true if the path targets a root-level system file (INSTRUCTION.md, CONFIG.json, etc.). */
 function isSystemFile(filePath: string): boolean {
   const basename = path.posix.basename(filePath);
@@ -83,6 +96,14 @@ export async function GET(req: NextRequest) {
     }
   }
 
+  if (op === 'list_dirs') {
+    try {
+      return NextResponse.json({ dirs: collectDirectories(getFileTree()) });
+    } catch (e) {
+      return err((e as Error).message, 500);
+    }
+  }
+
   if (op === 'check_conflicts') {
     const names = req.nextUrl.searchParams.get('names');
     const space = req.nextUrl.searchParams.get('space') ?? '';

package/app/app/api/inbox/route.ts

@@ -41,10 +41,10 @@ export async function POST(req: NextRequest) {
     return NextResponse.json({ error: 'Request body must contain a files array' }, { status: 400 });
   }
 
-  const { files } = body as { files: Array<{ name: string; content: string; encoding?: 'text' | 'base64' }> };
+  const { files, source } = body as { files: Array<{ name: string; content: string; encoding?: 'text' | 'base64' }>, source?: string };
 
   try {
-    const result = saveToInbox(mindRoot, files);
+    const result = saveToInbox(mindRoot, files, source);
 
     if (result.saved.length > 0) {
       invalidateCache();
@@ -59,3 +59,39 @@ export async function POST(req: NextRequest) {
     );
   }
 }
+
+export async function DELETE(req: NextRequest) {
+  const mindRoot = effectiveSopRoot().trim();
+  if (!mindRoot) {
+    return NextResponse.json({ error: 'MIND_ROOT is not configured' }, { status: 400 });
+  }
+
+  let body: unknown;
+  try {
+    body = await req.json();
+  } catch {
+    return NextResponse.json({ error: 'Invalid JSON body' }, { status: 400 });
+  }
+
+  const { names } = (body ?? {}) as { names?: string[] };
+  if (!Array.isArray(names) || names.length === 0) {
+    return NextResponse.json({ error: 'Request body must contain a non-empty names array' }, { status: 400 });
+  }
+
+  try {
+    const { archiveFromInbox } = await import('@/lib/core/inbox');
+    const result = archiveFromInbox(mindRoot, names);
+
+    if (result.archived.length > 0) {
+      invalidateCache();
+      try { revalidatePath('/', 'layout'); } catch { /* test env */ }
+    }
+
+    return NextResponse.json(result);
+  } catch (err) {
+    return NextResponse.json(
+      { error: (err as Error).message },
+      { status: 500 },
+    );
+  }
+}

package/app/app/api/mcp/status/route.ts

@@ -66,6 +66,7 @@ export async function GET(req: NextRequest) {
       maskedToken: authConfigured ? maskToken(token) : undefined,
       authToken: authConfigured ? token : undefined,
       localIP: getLocalIP(),
+      connectionMode: settings.connectionMode ?? { cli: true, mcp: false },
     });
   } catch (err) {
     return NextResponse.json({ error: String(err) }, { status: 500 });

package/app/app/api/settings/route.ts

@@ -96,6 +96,18 @@ export async function POST(req: NextRequest) {
       ? (incomingAuthToken === '' ? '' : current.authToken)
       : current.authToken;
 
+    // Handle connectionMode: validate if provided, otherwise keep existing
+    let resolvedConnectionMode = current.connectionMode ?? { cli: true, mcp: false };
+    if (body.connectionMode && typeof body.connectionMode === 'object') {
+      const incomingMode = body.connectionMode as Record<string, unknown>;
+      if (typeof incomingMode.cli === 'boolean' && typeof incomingMode.mcp === 'boolean') {
+        resolvedConnectionMode = {
+          cli: incomingMode.cli,
+          mcp: incomingMode.mcp,
+        };
+      }
+    }
+
     const next: ServerSettings = {
       ai: {
         provider: body.ai?.provider ?? current.ai.provider,
@@ -108,6 +120,7 @@ export async function POST(req: NextRequest) {
       port: typeof body.port === 'number' ? body.port : current.port,
       mcpPort: typeof body.mcpPort === 'number' ? body.mcpPort : current.mcpPort,
       startMode: body.startMode ?? current.startMode,
+      connectionMode: resolvedConnectionMode,
     };
 
     writeSettings(next);

package/app/app/api/setup/route.ts

@@ -53,7 +53,7 @@ export async function GET() {
 export async function POST(req: NextRequest) {
   try {
     const body = await req.json();
-    const { mindRoot, template, port, mcpPort, authToken, webPassword, ai } = body;
+    const { mindRoot, template, port, mcpPort, authToken, webPassword, ai, connectionMode } = body;
 
     // Validate required fields
     if (!mindRoot || typeof mindRoot !== 'string') {
@@ -126,6 +126,15 @@ export async function POST(req: NextRequest) {
     const disabledSkills = body.template === 'zh' ? ['mindos'] : ['mindos-zh'];
     // Determine guide template from setup template
     const guideTemplate = body.template === 'zh' ? 'zh' : body.template === 'empty' ? 'empty' : 'en';
+    
+    // Validate and build connectionMode
+    let resolvedConnectionMode = current.connectionMode ?? { cli: true, mcp: false };
+    if (connectionMode && typeof connectionMode === 'object') {
+      if (typeof connectionMode.cli === 'boolean' && typeof connectionMode.mcp === 'boolean') {
+        resolvedConnectionMode = connectionMode;
+      }
+    }
+
     const config: ServerSettings = {
       ai: mergedAi,
       mindRoot: resolvedRoot,
@@ -145,6 +154,7 @@ export async function POST(req: NextRequest) {
         askedAI: false,
         nextStepIndex: 0,
       },
+      connectionMode: resolvedConnectionMode,
     };
 
     writeSettings(config);

package/app/app/api/sync/route.ts

@@ -1,7 +1,7 @@
 export const dynamic = 'force-dynamic';
 import { NextRequest, NextResponse } from 'next/server';
 import { execSync, execFile } from 'child_process';
-import { existsSync, readFileSync, writeFileSync, unlinkSync } from 'fs';
+import { existsSync, readFileSync, writeFileSync, unlinkSync, renameSync } from 'fs';
 import { join, resolve } from 'path';
 import { homedir } from 'os';
 
@@ -13,8 +13,23 @@ function loadConfig() {
   try { return JSON.parse(readFileSync(CONFIG_PATH, 'utf-8')); } catch { return {}; }
 }
 
+/** Atomic write to prevent data corruption on crash/power loss */
+function atomicWriteJSON(filePath: string, data: unknown) {
+  const content = JSON.stringify(data, null, 2) + '\n';
+  const tmp = filePath + '.tmp';
+  writeFileSync(tmp, content, 'utf-8');
+  renameSync(tmp, filePath);
+}
+
 function saveConfig(config: Record<string, unknown>) {
-  writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2) + '\n', 'utf-8');
+  atomicWriteJSON(CONFIG_PATH, config);
+}
+
+/** Validate that a file path is safely within mindRoot (prevents path traversal) */
+function isPathWithinMindRoot(mindRoot: string, filePath: string): boolean {
+  const normalizedPath = resolve(mindRoot, filePath);
+  // Must start with mindRoot + separator to prevent escape via symlinks or ../
+  return normalizedPath.startsWith(mindRoot + '/') || normalizedPath === mindRoot;
 }
 
 function loadSyncState() {
@@ -175,7 +190,7 @@ export async function POST(req: NextRequest) {
         delete config.sync;
         saveConfig(config);
         // Clear sync state
-        try { writeFileSync(SYNC_STATE_PATH, '{}', 'utf-8'); } catch {}
+        try { atomicWriteJSON(SYNC_STATE_PATH, {}); } catch {}
         return NextResponse.json({ ok: true, enabled: false });
       }
 
@@ -205,8 +220,12 @@ export async function POST(req: NextRequest) {
         if (!file || typeof file !== 'string') {
           return NextResponse.json({ error: 'Missing file path' }, { status: 400 });
         }
-        const conflictPath = join(mindRoot, file + '.sync-conflict');
-        const originalPath = join(mindRoot, file);
+        // Security: prevent path traversal attacks
+        if (!isPathWithinMindRoot(mindRoot, file)) {
+          return NextResponse.json({ error: 'Invalid file path' }, { status: 400 });
+        }
+        const conflictPath = resolve(mindRoot, file + '.sync-conflict');
+        const originalPath = resolve(mindRoot, file);
         try {
           if (strategy === 'keep-remote' && existsSync(conflictPath)) {
             // Replace local with remote version
@@ -221,7 +240,7 @@ export async function POST(req: NextRequest) {
           const state = loadSyncState();
           if (state.conflicts) {
             state.conflicts = state.conflicts.filter((c: { file: string }) => c.file !== file);
-            writeFileSync(SYNC_STATE_PATH, JSON.stringify(state, null, 2) + '\n', 'utf-8');
+            atomicWriteJSON(SYNC_STATE_PATH, state);
           }
           return NextResponse.json({ ok: true });
         } catch (e) {
@@ -234,8 +253,12 @@ export async function POST(req: NextRequest) {
         if (!file || typeof file !== 'string') {
           return NextResponse.json({ error: 'Missing file path' }, { status: 400 });
         }
-        const localPath = join(mindRoot, file);
-        const remotePath = join(mindRoot, file + '.sync-conflict');
+        // Security: prevent path traversal attacks
+        if (!isPathWithinMindRoot(mindRoot, file)) {
+          return NextResponse.json({ error: 'Invalid file path' }, { status: 400 });
+        }
+        const localPath = resolve(mindRoot, file);
+        const remotePath = resolve(mindRoot, file + '.sync-conflict');
         const local = existsSync(localPath) ? readFileSync(localPath, 'utf-8') : '';
         const remote = existsSync(remotePath) ? readFileSync(remotePath, 'utf-8') : '';
         return NextResponse.json({ local, remote });
@@ -247,17 +270,17 @@ export async function POST(req: NextRequest) {
         if (commitInterval === undefined && pullInterval === undefined) {
           return NextResponse.json({ error: 'At least one interval must be provided' }, { status: 400 });
         }
-        if (commitInterval !== undefined && (commitInterval < 10 || commitInterval > 300)) {
-          return NextResponse.json({ error: 'autoCommitInterval must be between 10 and 300 seconds' }, { status: 400 });
+        if (commitInterval !== undefined && (!Number.isInteger(commitInterval) || commitInterval < 10 || commitInterval > 300)) {
+          return NextResponse.json({ error: 'autoCommitInterval must be an integer between 10 and 300 seconds' }, { status: 400 });
         }
-        if (pullInterval !== undefined && (pullInterval < 60 || pullInterval > 3600)) {
-          return NextResponse.json({ error: 'autoPullInterval must be between 60 and 3600 seconds' }, { status: 400 });
+        if (pullInterval !== undefined && (!Number.isInteger(pullInterval) || pullInterval < 60 || pullInterval > 3600)) {
+          return NextResponse.json({ error: 'autoPullInterval must be an integer between 60 and 3600 seconds' }, { status: 400 });
         }
         const fullConfig = loadConfig();
         if (!fullConfig.sync) fullConfig.sync = {};
         if (commitInterval !== undefined) fullConfig.sync.autoCommitInterval = commitInterval;
         if (pullInterval !== undefined) fullConfig.sync.autoPullInterval = pullInterval;
-        writeFileSync(CONFIG_PATH, JSON.stringify(fullConfig, null, 2) + '\n', 'utf-8');
+        atomicWriteJSON(CONFIG_PATH, fullConfig);
         return NextResponse.json({
           autoCommitInterval: fullConfig.sync.autoCommitInterval || 30,
           autoPullInterval: fullConfig.sync.autoPullInterval || 300,

package/app/app/global-error.tsx

@@ -14,13 +14,13 @@ export default function GlobalError({
 }) {
   return (
     <html lang="en">
-      <body style={{ margin: 0, fontFamily: 'system-ui, sans-serif', background: '#0f0f0f', color: '#e5e5e5' }}>
+      <body style={{ margin: 0, fontFamily: "'IBM Plex Sans', system-ui, sans-serif", background: '#131210', color: '#e8e4dc' }}>
         <div style={{
           display: 'flex', flexDirection: 'column', alignItems: 'center', justifyContent: 'center',
           minHeight: '100vh', gap: '16px', padding: '24px', textAlign: 'center',
         }}>
           <h2 style={{ fontSize: '18px', fontWeight: 600, margin: 0 }}>Something went wrong</h2>
-          <p style={{ fontSize: '14px', color: '#888', maxWidth: '400px', margin: 0 }}>
+          <p style={{ fontSize: '14px', color: '#8a8275', maxWidth: '400px', margin: 0 }}>
             {error.message || 'An unexpected error occurred. Please try again.'}
           </p>
           <div style={{ display: 'flex', gap: '12px', marginTop: '8px' }}>
@@ -28,7 +28,7 @@ export default function GlobalError({
               onClick={reset}
               style={{
                 padding: '8px 16px', borderRadius: '6px', fontSize: '14px', fontWeight: 500,
-                background: '#222', color: '#e5e5e5', border: '1px solid #333', cursor: 'pointer',
+                background: '#1c1a17', color: '#e8e4dc', border: '1px solid rgba(232,228,220,0.08)', cursor: 'pointer',
               }}
             >
               Try again

package/app/app/globals.css

@@ -7,8 +7,8 @@
 @theme inline {
   --color-background: var(--background);
   --color-foreground: var(--foreground);
-  --font-sans: var(--font-sans);
-  --font-mono: var(--font-geist-mono);
+  --font-sans: var(--font-inter);
+  --font-mono: var(--font-ibm-plex-mono);
   --color-sidebar-ring: var(--sidebar-ring);
   --color-sidebar-border: var(--sidebar-border);
   --color-sidebar-accent-foreground: var(--sidebar-accent-foreground);
@@ -52,7 +52,7 @@
 }
 
 body {
-  font-family: 'IBM Plex Sans', var(--font-geist-sans), system-ui, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Noto Color Emoji';
+  font-family: 'IBM Plex Sans', var(--font-ibm-plex-sans), system-ui, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Noto Color Emoji';
 }
 
 :root {
@@ -138,6 +138,13 @@ body {
 /* Utility: IBM Plex Mono display heading font */
 .font-display { font-family: 'IBM Plex Mono', var(--font-ibm-plex-mono), monospace; }
 
+/* Brand wordmark — premium sans with engineering precision */
+.font-brand {
+  font-family: 'IBM Plex Sans', var(--font-ibm-plex-sans), system-ui, sans-serif;
+  font-weight: 700;
+  letter-spacing: 0.03em;
+}
+
 /* Content width — controlled by Settings > Appearance */
 :root { --content-width: 780px; --toc-width: 0px; }
 .content-width { max-width: var(--content-width-override, var(--content-width)); margin-left: auto; margin-right: auto; }
@@ -332,6 +339,25 @@ body {
 @layer utilities {
   .text-2xs { font-size: 10px; line-height: 1.4; }
   .animate-spin-slow { animation: spin 3s linear infinite; }
+  /* Checkerboard background for transparent image preview */
+  .bg-checkerboard {
+    background-color: #f0f0f0;
+    background-image:
+      linear-gradient(45deg, #e0e0e0 25%, transparent 25%),
+      linear-gradient(-45deg, #e0e0e0 25%, transparent 25%),
+      linear-gradient(45deg, transparent 75%, #e0e0e0 75%),
+      linear-gradient(-45deg, transparent 75%, #e0e0e0 75%);
+    background-size: 16px 16px;
+    background-position: 0 0, 0 8px, 8px -8px, -8px 0;
+  }
+  :is(.dark) .bg-checkerboard {
+    background-color: #1a1a1a;
+    background-image:
+      linear-gradient(45deg, #252525 25%, transparent 25%),
+      linear-gradient(-45deg, #252525 25%, transparent 25%),
+      linear-gradient(45deg, transparent 75%, #252525 75%),
+      linear-gradient(-45deg, transparent 75%, #252525 75%);
+  }
 }
 
 /* Hide scrollbar but keep scroll functionality */