@iamem/amem 0.1.1 → 0.1.3

package/dist/api/routes.js

@@ -3,12 +3,29 @@ import { resolve, join } from "node:path";
 import { createHash } from "node:crypto";
 import { estimateUsdSaved, metricsFromPacket, USD_PER_MILLION_INPUT_TOKENS } from "../estimate.js";
 import { buildActivityGraph, speedForEvent } from "../activity.js";
-import { getRepoByCwd, getRepoById, getRepoByName, renameWorkspace, getSetupState, insertUsageEvent, listClaims, listClaimsAll, listComponents, listComponentsAll, listEdges, listEdgesAll, listFlows, listFlowsAll, listRepos, listSessions, listSessionsAll, listUsageEvents, listProposalDrafts, listProposalDraftsAll, countProposalDrafts, countProposalDraftsAll, getProposalDraft, setProposalDraftStatus, updateClaim, setClaimPinned, deleteClaim, setReportedOnLatest, setReportedTokensSaved, upsertRepo, upsertSetupState, wipeRepo, openDb, closeDb, } from "../db.js";
+import { getRepoByCwd, getRepoById, getRepoByName, renameWorkspace, getSetupState, insertUsageEvent, listClaims, listClaimsAll, listComponents, listComponentsAll, listEdges, listEdgesAll, listFlows, listFlowsAll, listRepos, listSessions, listSessionsAll, listUsageEvents, listProposalDrafts, listProposalDraftsAll, countProposalDrafts, countProposalDraftsAll, getProposalDraft, setProposalDraftStatus, listTasks, listTasksAll, getSkillDraft, insertSkillDraft, listSkillDrafts, recordSkillUse, setSkillDraftStatus, setSkillRepo, findTaskAnyRepo, getTask, insertTask, updateTask, completeTask, deleteTask, countTasks, countTasksAll, normalizeTaskStatus, updateClaim, setClaimPinned, deleteClaim, setReportedOnLatest, setReportedTokensSaved, upsertRepo, upsertSetupState, wipeRepo, openDb, closeDb, } from "../db.js";
+import { deleteSkill, findSkillOnDisk, isValidSkillName, listIndexedSkills, listSkillAssets, rankSkills, readSkillAsset, readSkillBody, renderSkillMarkdown, scanSkillContent, skillsDir, slugifySkillName, syncSkillIndex, writeSkill, } from "../skills.js";
 import { buildContext, buildRetrievalShowdown, decorateUsageEvents, renderContextMarkdown } from "../context.js";
 import { installClaude, claudeInstallHealth } from "../install/claude.js";
 import { installCursor, cursorInstallHealth } from "../install/cursor.js";
 import { hostInstallHealth, installHost } from "../install/hosts.js";
 import { decorateDraft, decorateDrafts } from "../draft-quality.js";
+/**
+ * Which repo owns a task. Scoped requests may only touch the current repo; an
+ * all-memory request resolves the task's real owner so a board that shows every
+ * memory can also edit what it shows.
+ */
+function taskOwnerRepoId(id, currentRepoId, all) {
+    if (currentRepoId) {
+        const direct = getTask(currentRepoId, id);
+        if (direct)
+            return currentRepoId;
+    }
+    if (all) {
+        return findTaskAnyRepo(id)?.repo_id ?? null;
+    }
+    return null;
+}
 import { isUsefulRememberText } from "../capture.js";
 import { buildSavingsExport, formatSavingsMarkdown, savingsPdf, } from "../savings-export.js";
 import { assertPlatformAllowed, assertRemoteAllowed, loadPolicy, } from "../policy.js";
@@ -58,6 +75,40 @@ function ok(body) {
 function err(status, message) {
     return { status, body: { error: message } };
 }
+function safeJsonArray(raw) {
+    try {
+        const list = JSON.parse(raw);
+        return Array.isArray(list) ? list.filter((v) => typeof v === "string") : [];
+    }
+    catch {
+        return [];
+    }
+}
+/** Once a skill is saved, the nudge that prompted it has done its job. */
+function resolveSuggestionFor(repoId, sessionId) {
+    if (!repoId)
+        return;
+    for (const draft of listSkillDrafts({ status: "pending", repoId, limit: 20 })) {
+        if (draft.kind !== "suggestion")
+            continue;
+        if (sessionId && draft.session_id && draft.session_id !== sessionId)
+            continue;
+        setSkillDraftStatus(draft.id, "applied");
+        return;
+    }
+}
+/** Level-0 view of a skill: enough to decide whether to load it, without the body. */
+function skillSummary(skill) {
+    return {
+        name: skill.name,
+        description: skill.description,
+        version: skill.version,
+        tags: skill.tags,
+        source: skill.source,
+        repo_id: skill.repoId ?? null,
+        uses: skill.uses ?? 0,
+    };
+}
 function bodyField(body, key) {
     if (!body || typeof body !== "object")
         return undefined;
@@ -1242,6 +1293,285 @@ export function handleApi(req) {
             return err(404, "Claim not found");
         return ok({ deleted: id });
     }
+    // Skills are a global library, not repo-scoped like claims and tasks — no `repo` guard.
+    if (method === "GET" && pathname === "/api/skills") {
+        const query = searchParams.get("q") || "";
+        const skills = listIndexedSkills();
+        const ranked = query ? rankSkills(skills, query, Number(searchParams.get("limit") || 10)) : [];
+        return ok({
+            skills: skills.map(skillSummary),
+            matches: ranked.map((s) => ({ ...skillSummary(s), score: s.score, reasons: s.reasons })),
+            dir: skillsDir(),
+        });
+    }
+    if (method === "GET" && pathname === "/api/skills/view") {
+        const name = searchParams.get("name");
+        if (!name)
+            return err(400, "name required");
+        const file = searchParams.get("file");
+        if (file) {
+            const asset = readSkillAsset(name, file);
+            if (asset === null)
+                return err(404, "Skill file not found");
+            return ok({ name, file, content: asset });
+        }
+        const meta = findSkillOnDisk(name);
+        if (!meta)
+            return err(404, "Skill not found");
+        const content = readSkillBody(name);
+        if (content === null)
+            return err(404, "Skill not found");
+        // A skill can be viewed before anything indexed it, and the usage counter lives in
+        // the index — reconcile first or the increment silently updates zero rows.
+        syncSkillIndex();
+        recordSkillUse(meta.name, {
+            repoId: repo ? repo.id : null,
+            sessionId: searchParams.get("session_id"),
+        });
+        return ok({ ...skillSummary(meta), content, files: listSkillAssets(meta.name) });
+    }
+    if (method === "POST" && pathname === "/api/skills") {
+        const name = bodyField(body, "name");
+        if (!name)
+            return err(400, "name required");
+        const slug = slugifySkillName(name);
+        if (!isValidSkillName(slug))
+            return err(400, "Invalid skill name");
+        const content = bodyField(body, "content");
+        const description = bodyField(body, "description") || "";
+        // Accept either a full SKILL.md or the parts, so agents can save without templating.
+        const markdown = content && content.includes("---")
+            ? content
+            : renderSkillMarkdown({
+                name: slug,
+                description,
+                body: content || "",
+                version: bodyField(body, "version"),
+            });
+        const scan = scanSkillContent(markdown);
+        if (!scan.ok)
+            return err(400, `Rejected: ${scan.reason}`);
+        const policy = loadPolicy().policy;
+        if (!policy.skills_enabled)
+            return err(403, "Skills are disabled by policy");
+        // A SKILL.md is too long to review inline, so an approval gate stages rather than
+        // blocks — the agent keeps working and a human decides later.
+        if (policy.skill_write_approval) {
+            const draft = insertSkillDraft({
+                repoId: repo ? repo.id : null,
+                name: slug,
+                title: description || slug,
+                summary: description,
+                content: markdown,
+                kind: findSkillOnDisk(slug) ? "revision" : "create",
+                targetSkill: findSkillOnDisk(slug) ? slug : null,
+                source: `agent-save:${slug}:${Date.now()}`,
+                sessionId: bodyField(body, "session_id") ?? null,
+                reasons: ["staged by skill_write_approval"],
+            });
+            return ok({
+                staged: draft.id,
+                name: slug,
+                pending: true,
+                message: "Skill staged for review — approve it in the Skills tab or `amem skills drafts`.",
+            });
+        }
+        const written = writeSkill(slug, markdown);
+        syncSkillIndex();
+        const repoId = bodyField(body, "repo_id") ?? (repo ? repo.id : null);
+        if (repoId)
+            setSkillRepo(slug, repoId);
+        resolveSuggestionFor(repo?.id, bodyField(body, "session_id"));
+        return ok({ saved: written.name, path: written.path, hash: written.hash });
+    }
+    if (method === "GET" && pathname === "/api/skills/drafts") {
+        const drafts = listSkillDrafts({
+            status: searchParams.get("status") || "pending",
+            limit: Number(searchParams.get("limit") || 50),
+        });
+        const repoNames = new Map(listRepos().map((r) => [r.id, r.repo_name]));
+        return ok({
+            drafts: drafts.map((d) => ({
+                ...d,
+                reasons: safeJsonArray(d.reasons),
+                repo_name: d.repo_id ? (repoNames.get(d.repo_id) ?? null) : null,
+                // A suggestion has no content yet — only an agent can write the body.
+                has_content: Boolean(d.content),
+            })),
+            counts: { pending: listSkillDrafts({ status: "pending", limit: 200 }).length },
+        });
+    }
+    if (method === "POST" && pathname === "/api/skills/drafts/apply") {
+        const id = bodyField(body, "id");
+        if (!id)
+            return err(400, "id required");
+        const draft = getSkillDraft(id);
+        if (!draft)
+            return err(404, "Draft not found");
+        if (!draft.content || !draft.name) {
+            return err(400, "This is a suggestion, not a staged skill — an agent must write it first");
+        }
+        const scan = scanSkillContent(draft.content);
+        if (!scan.ok)
+            return err(400, `Rejected: ${scan.reason}`);
+        const written = writeSkill(draft.name, draft.content);
+        syncSkillIndex();
+        if (draft.repo_id)
+            setSkillRepo(draft.name, draft.repo_id);
+        setSkillDraftStatus(id, "applied");
+        return ok({ applied: id, name: written.name, path: written.path });
+    }
+    if (method === "POST" && pathname === "/api/skills/drafts/dismiss") {
+        const id = bodyField(body, "id");
+        if (!id)
+            return err(400, "id required");
+        if (!getSkillDraft(id))
+            return err(404, "Draft not found");
+        setSkillDraftStatus(id, "dismissed");
+        return ok({ dismissed: id });
+    }
+    if (method === "DELETE" && pathname === "/api/skills") {
+        const name = searchParams.get("name") || bodyField(body, "name");
+        if (!name)
+            return err(400, "name required");
+        const removed = deleteSkill(name);
+        if (!removed)
+            return err(404, "Skill not found");
+        syncSkillIndex();
+        return ok({ deleted: slugifySkillName(name) });
+    }
+    if (method === "GET" && pathname === "/api/tasks") {
+        const all = searchParams.get("scope") === "all" ||
+            bodyField(body, "scope") === "all" ||
+            searchParams.get("repo") === "all";
+        if (!all && !repo)
+            return err(400, "Repo not initialized");
+        const statusRaw = searchParams.get("status") || bodyField(body, "status");
+        const status = statusRaw ? normalizeTaskStatus(statusRaw) : null;
+        if (statusRaw && !status)
+            return err(400, "invalid status");
+        const includeDone = searchParams.get("include_done") === "1" ||
+            searchParams.get("include_done") === "true" ||
+            bodyField(body, "include_done") === "1" ||
+            bodyField(body, "include_done") === "true";
+        const listOpts = {
+            status: status || undefined,
+            includeDone: includeDone || Boolean(status === "done"),
+            limit: Number(searchParams.get("limit") || (all ? 200 : 100)),
+        };
+        const tasks = all ? listTasksAll(listOpts) : listTasks(repo.id, listOpts);
+        const count = (o) => all ? countTasksAll(o) : countTasks(repo.id, o);
+        // Name the owning memory so an all-memory board can say where each task lives.
+        const repoNames = all
+            ? new Map(listRepos().map((r) => [r.id, r.repo_name]))
+            : new Map();
+        return ok({
+            scope: all ? "all" : "current",
+            tasks: all
+                ? tasks.map((t) => ({ ...t, repo_name: repoNames.get(t.repo_id) ?? null }))
+                : tasks,
+            counts: {
+                open: count({ openOnly: true }),
+                backlog: count({ status: "backlog" }),
+                next: count({ status: "next" }),
+                doing: count({ status: "doing" }),
+                blocked: count({ status: "blocked" }),
+                done: count({ status: "done" }),
+            },
+        });
+    }
+    if (method === "POST" && pathname === "/api/tasks") {
+        const targetRepo = repo || ensurePersonalWorkspace();
+        const payload = body && typeof body === "object" ? body : {};
+        const title = typeof payload.title === "string" ? payload.title : "";
+        if (!title.trim())
+            return err(400, "title required");
+        let anchors;
+        if (Array.isArray(payload.anchors)) {
+            anchors = payload.anchors.filter((a) => typeof a === "string");
+        }
+        try {
+            const task = insertTask({
+                repoId: targetRepo.id,
+                title,
+                body: typeof payload.body === "string" ? payload.body : "",
+                status: typeof payload.status === "string" ? payload.status : "backlog",
+                anchors,
+                source: typeof payload.source === "string" ? payload.source : "ui",
+            });
+            return ok({ task });
+        }
+        catch (error) {
+            return err(400, error instanceof Error ? error.message : String(error));
+        }
+    }
+    if (method === "PATCH" && pathname === "/api/tasks") {
+        const all = searchParams.get("scope") === "all" ||
+            bodyField(body, "scope") === "all" ||
+            searchParams.get("repo") === "all";
+        if (!all && !repo)
+            return err(400, "Repo not initialized");
+        const payload = body && typeof body === "object" ? body : {};
+        const id = bodyField(body, "id");
+        if (!id)
+            return err(400, "id required");
+        // In all-memory scope the card may belong to any repo, so find its real owner.
+        const ownerId = taskOwnerRepoId(id, repo?.id, all);
+        if (!ownerId)
+            return err(404, "Task not found");
+        let anchors;
+        if (Array.isArray(payload.anchors)) {
+            anchors = payload.anchors.filter((a) => typeof a === "string");
+        }
+        try {
+            const task = updateTask(ownerId, id, {
+                title: typeof payload.title === "string" ? payload.title : undefined,
+                body: typeof payload.body === "string" ? payload.body : undefined,
+                status: typeof payload.status === "string" ? payload.status : undefined,
+                anchors,
+            });
+            if (!task)
+                return err(404, "Task not found");
+            return ok({ task });
+        }
+        catch (error) {
+            return err(400, error instanceof Error ? error.message : String(error));
+        }
+    }
+    if (method === "POST" && pathname === "/api/tasks/complete") {
+        const all = searchParams.get("scope") === "all" ||
+            bodyField(body, "scope") === "all" ||
+            searchParams.get("repo") === "all";
+        if (!all && !repo)
+            return err(400, "Repo not initialized");
+        const id = bodyField(body, "id");
+        if (!id)
+            return err(400, "id required");
+        const ownerId = taskOwnerRepoId(id, repo?.id, all);
+        if (!ownerId)
+            return err(404, "Task not found");
+        const task = completeTask(ownerId, id);
+        if (!task)
+            return err(404, "Task not found");
+        return ok({ task });
+    }
+    if (method === "DELETE" && pathname === "/api/tasks") {
+        const all = searchParams.get("scope") === "all" ||
+            bodyField(body, "scope") === "all" ||
+            searchParams.get("repo") === "all";
+        if (!all && !repo)
+            return err(400, "Repo not initialized");
+        const id = searchParams.get("id") || bodyField(body, "id");
+        if (!id)
+            return err(400, "id required");
+        const ownerId = taskOwnerRepoId(id, repo?.id, all);
+        if (!ownerId)
+            return err(404, "Task not found");
+        const removed = deleteTask(ownerId, id);
+        if (!removed)
+            return err(404, "Task not found");
+        return ok({ deleted: id });
+    }
     if (method === "GET" && pathname === "/api/usage/export") {
         const scope = searchParams.get("scope") ?? "current";
         const days = Number(searchParams.get("days") ?? "30");

package/dist/app-shell.d.ts

@@ -0,0 +1,13 @@
+export declare function desktopDir(pkgRoot?: string): string;
+export declare function electronInstallHint(dir?: string): string;
+/** Absolute path to the Electron binary, or null if desktop deps are missing. */
+export declare function resolveElectronBinary(dir?: string): string | null;
+/**
+ * Start or attach to amem ui, then open the Electron window.
+ * Owns server shutdown only when this process started it.
+ */
+export declare function runDesktopApp(options?: {
+    port?: number;
+    cwd?: string;
+    pkgRoot?: string;
+}): Promise<void>;

package/dist/app-shell.js

@@ -0,0 +1,126 @@
+/**
+ * Desktop (Electron) shell launcher for the localhost Brain UI.
+ */
+import { spawn } from "node:child_process";
+import { createRequire } from "node:module";
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { loadPolicy } from "./policy.js";
+import { buildUiLandingUrl, isAddrInUse, probeUiHealth, startUiServer, } from "./ui/server.js";
+const PKG_ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
+export function desktopDir(pkgRoot = PKG_ROOT) {
+    return join(pkgRoot, "desktop");
+}
+export function electronInstallHint(dir = desktopDir()) {
+    return `npm run app:setup   # or: npm install --prefix "${dir}" && node desktop/scripts/ensure-electron.mjs`;
+}
+/** Absolute path to the Electron binary, or null if desktop deps are missing. */
+export function resolveElectronBinary(dir = desktopDir()) {
+    const pkgJson = join(dir, "package.json");
+    if (!existsSync(pkgJson))
+        return null;
+    const candidates = [
+        join(dir, "node_modules/electron/dist/Electron.app/Contents/MacOS/Electron"),
+        join(dir, "node_modules/electron/dist/electron"),
+        join(dir, "node_modules/electron/dist/electron.exe"),
+    ];
+    try {
+        const require = createRequire(pkgJson);
+        const bin = require("electron");
+        if (typeof bin === "string" && bin && existsSync(bin))
+            return bin;
+    }
+    catch {
+        /* path.txt missing or postinstall incomplete — try dist paths */
+    }
+    for (const candidate of candidates) {
+        if (existsSync(candidate))
+            return candidate;
+    }
+    return null;
+}
+function spawnElectron(electronBin, dir, url) {
+    return new Promise((resolve, reject) => {
+        const env = { ...process.env, AMEM_UI_URL: url };
+        // Parent IDEs sometimes set this; it makes Electron run as plain Node.
+        delete env.ELECTRON_RUN_AS_NODE;
+        const child = spawn(electronBin, [".", url], {
+            cwd: dir,
+            env,
+            stdio: "inherit",
+        });
+        child.on("error", reject);
+        child.on("exit", (code, signal) => {
+            if (signal) {
+                resolve(1);
+                return;
+            }
+            resolve(code ?? 0);
+        });
+    });
+}
+/**
+ * Start or attach to amem ui, then open the Electron window.
+ * Owns server shutdown only when this process started it.
+ */
+export async function runDesktopApp(options = {}) {
+    const port = options.port ?? 7843;
+    const cwd = options.cwd ?? process.cwd();
+    const dir = desktopDir(options.pkgRoot ?? PKG_ROOT);
+    const electronBin = resolveElectronBinary(dir);
+    if (!electronBin) {
+        const err = new Error([
+            "Electron desktop shell is not installed.",
+            `Run once:  ${electronInstallHint(dir)}`,
+            "Then:       amem app",
+            "(Browser UI still works with: amem ui)",
+        ].join("\n"));
+        err.code = "AMEM_ELECTRON_MISSING";
+        throw err;
+    }
+    const policy = loadPolicy().policy;
+    const landing = buildUiLandingUrl(port, cwd);
+    let owned = null;
+    try {
+        owned = await startUiServer({
+            port,
+            cwd,
+            openBrowser: false,
+            host: policy.ui_bind,
+            landingUrl: landing,
+        });
+    }
+    catch (error) {
+        if (!isAddrInUse(error))
+            throw error;
+        const probe = await probeUiHealth(port);
+        if (!probe.hasVault) {
+            throw new Error([
+                `Port ${port} is already serving an older amem without lock/backup APIs.`,
+                "Stop that process, then run amem app again:",
+                `  lsof -nP -iTCP:${port} -sTCP:LISTEN`,
+            ].join("\n"));
+        }
+    }
+    console.log(`amem app → ${landing}`);
+    if (owned)
+        console.log("UI server started for this window (localhost only).");
+    else
+        console.log("Attached to UI server already running on this port.");
+    try {
+        const code = await spawnElectron(electronBin, dir, landing);
+        if (code !== 0)
+            process.exitCode = code;
+    }
+    finally {
+        if (owned) {
+            try {
+                await owned.close();
+            }
+            catch {
+                /* ignore */
+            }
+        }
+    }
+}

package/dist/attest.d.ts

@@ -38,6 +38,19 @@ export type AttestReport = {
     };
     license: ReturnType<typeof licenseStatus>;
     embed: ReturnType<typeof embedStatus>;
+    /** Procedural memory an auditor should be able to review: what agents may be told to do. */
+    skills: {
+        dir: string;
+        enabled: boolean;
+        write_approval: boolean;
+        pending_drafts: number;
+        installed: Array<{
+            name: string;
+            description: string;
+            source: string;
+            hash: string;
+        }>;
+    };
     sku?: {
         tier: string;
         airgap: true;

package/dist/attest.js

@@ -12,6 +12,8 @@ import { FEATURE_ATTEST_SKU, hasFeature, licenseStatus } from "./license.js";
 import { embedIndexIssues, embedStatus } from "./embed.js";
 import { vaultStatus } from "./vault.js";
 import { hostInstallHealth } from "./install/hosts.js";
+import { listSkillDrafts } from "./db.js";
+import { scanSkills, skillsDir } from "./skills.js";
 function packageRoot() {
     const here = fileURLToPath(new URL(".", import.meta.url));
     // dist/ -> package root
@@ -104,6 +106,8 @@ export function buildAttestReport(cwd = process.cwd()) {
     catch {
         // Locked vault: the vault section already reports that.
     }
+    const skills = skillsAttestSection();
+    issues.push(...skillIssues(skills));
     const pkgPath = join(packageRoot(), "package.json");
     const sku = hasFeature(FEATURE_ATTEST_SKU)
         ? {
@@ -154,11 +158,51 @@ export function buildAttestReport(cwd = process.cwd()) {
         },
         license,
         embed,
+        skills,
         sku,
         ok: issues.length === 0,
         issues,
     };
 }
+/**
+ * Inventory of procedural memory. Hashes let an auditor diff what agents are being told to
+ * do between two machines, which a bare list of names would not support.
+ */
+function skillsAttestSection() {
+    const policy = loadPolicy().policy;
+    const base = {
+        dir: skillsDir(),
+        enabled: policy.skills_enabled,
+        write_approval: policy.skill_write_approval,
+    };
+    try {
+        return {
+            ...base,
+            pending_drafts: listSkillDrafts({ status: "pending", limit: 200 }).length,
+            installed: scanSkills().map((s) => ({
+                name: s.name,
+                description: s.description,
+                source: s.source,
+                hash: s.hash,
+            })),
+        };
+    }
+    catch {
+        return { ...base, pending_drafts: 0, installed: [] };
+    }
+}
+function skillIssues(skills) {
+    const issues = [];
+    for (const skill of skills.installed) {
+        if (!skill.description.trim()) {
+            issues.push(`skill ${skill.name} has no description — agents cannot rank it`);
+        }
+    }
+    if (skills.pending_drafts > 0 && skills.write_approval) {
+        issues.push(`${skills.pending_drafts} skill write(s) awaiting approval`);
+    }
+    return issues;
+}
 export function formatAttestHuman(report) {
     const lines = [
         `amem attest ${report.ok ? "OK" : "ISSUES"} · v${report.version}`,