@ijfw/memory-server 1.4.0 → 1.4.3

package/src/dashboard-server.js

@@ -22,6 +22,8 @@ import { searchMemory } from './memory/search.js';
 import { buildRecallCounts, mergeRecallCounts, topRecalled } from './memory/recall-counter.js';
 import { PLACEHOLDER_HTML } from './design-companion.js';
 import { listExtensions } from './extension-installer.js';
+import { aggregateEvents, computeWarnBashBypass, readActiveManifest } from './dashboard-aggregator.js';
+import { getQuotaUsage } from './extension-quota-tracker.js';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 // REPO_ROOT: IJFW_PROJECT_ROOT override > user's interactive shell cwd (PWD) > process.cwd() fallback.
@@ -688,6 +690,354 @@ export async function startServer(options = {}) {
       res.end(JSON.stringify(config));
     }],
 
+    // ---------- extensions: installed (B9) ----------
+    // Enumerate ~/.ijfw/state-org/extension-registry.json,
+    // ~/.ijfw/state-user/extension-registry.json, and project-scope registry.
+    // Returns JSON list with name, scope, version, publisher_keyId, permissions,
+    // last_activated_time. Path-traversal defence: resolve + assert under HOME.
+    ['/api/extensions/installed', async (req, res) => {
+      try {
+        const home = homedir();
+        // realpath both sides — on macOS /var/folders -> /private/var/folders is a symlink,
+        // so the registry's realpathed path won't show as under un-realpathed HOME.
+        let homeCanon;
+        try { homeCanon = realpathSync(home); } catch { homeCanon = home; }
+        function isUnderHome(p) {
+          try {
+            const canon = realpathSync(p);
+            const rel = relative(homeCanon, canon);
+            return rel !== '' && !rel.startsWith('..') && !isAbsolute(rel);
+          } catch { return false; }
+        }
+
+        const REGISTRY_FILENAME = 'extension-registry.json';
+        const registryPaths = [
+          { scope: 'org',  path: join(home, '.ijfw', 'state-org',  REGISTRY_FILENAME) },
+          { scope: 'user', path: join(home, '.ijfw', 'state-user', REGISTRY_FILENAME) },
+          { scope: 'project', path: join(REPO_ROOT, '.ijfw', 'state', REGISTRY_FILENAME) },
+        ];
+
+        const seen = new Map();
+        for (const { scope, path: regPath } of registryPaths) {
+          // Path-traversal check on each registry path.
+          const resolvedReg = resolve(regPath);
+          const underHome = isUnderHome(resolvedReg) ||
+            resolvedReg.startsWith(resolve(REPO_ROOT));
+          if (!underHome) continue;
+          if (!existsSync(resolvedReg)) continue;
+          let registry;
+          try {
+            const raw = readFileSync(resolvedReg, 'utf8');
+            const parsed = JSON.parse(raw);
+            registry = Array.isArray(parsed.extensions) ? parsed.extensions : [];
+          } catch { continue; }
+
+          for (const e of registry) {
+            if (!e || !e.name || !e.version) continue;
+            const key = `${e.name}@${e.version}`;
+            if (seen.has(key)) continue;
+            const manifest = (e.manifest && typeof e.manifest === 'object') ? e.manifest : null;
+            seen.set(key, {
+              name: e.name,
+              scope,
+              version: e.version,
+              publisher_keyId: manifest ? (manifest.publisher_keyId || null) : null,
+              permissions: manifest ? (manifest.permissions || null) : null,
+              last_activated_time: e.last_activated_time || null,
+            });
+          }
+        }
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ extensions: Array.from(seen.values()) }));
+      } catch (err) {
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ extensions: [], error: err.message }));
+      }
+    }],
+
+    // ---------- extensions: active (B9) ----------
+    ['/api/extensions/active', async (req, res) => {
+      try {
+        const home = homedir();
+        const activePath = join(home, '.ijfw', 'state', 'active-extension.json');
+        const resolvedActive = resolve(activePath);
+        // Return {active:null} BEFORE realpath — realpathSync throws on non-existent paths.
+        if (!existsSync(resolvedActive)) {
+          res.writeHead(200, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ active: null }));
+          return;
+        }
+        // Path-traversal: realpath BOTH home and target so macOS /private symlinks
+        // (e.g. /var/folders -> /private/var/folders) resolve correctly AND symlinks
+        // pointing outside HOME are rejected.
+        let homeCanon;
+        try { homeCanon = realpathSync(home); } catch { homeCanon = home; }
+        let activeCanon;
+        try {
+          activeCanon = realpathSync(resolvedActive);
+        } catch {
+          res.writeHead(403, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: 'path traversal rejected' }));
+          return;
+        }
+        const rel = relative(homeCanon, activeCanon);
+        if (rel.startsWith('..') || isAbsolute(rel)) {
+          res.writeHead(403, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: 'path traversal rejected' }));
+          return;
+        }
+        const raw = readFileSync(activeCanon, 'utf8');
+        const parsed = JSON.parse(raw);
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ active: parsed }));
+      } catch (err) {
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ active: null, error: err.message }));
+      }
+    }],
+
+    // ---------- extensions: events (B9) ----------
+    // Tail-streams ~/.ijfw/state/permission-events.jsonl with optional filters.
+    // Allowlisted query params: limit, extension, tool, denied.
+    // SSE mode: Accept: text/event-stream. JSON array otherwise.
+    // Never reads full file into memory: streams line-by-line.
+    ['/api/extensions/events', async (req, res, url) => {
+      const ALLOWED_FILTER_KEYS = new Set(['limit', 'extension', 'tool', 'denied']);
+      // Reject any non-allowlisted filter key.
+      for (const key of url.searchParams.keys()) {
+        if (!ALLOWED_FILTER_KEYS.has(key)) {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: `unknown filter parameter: ${key}` }));
+          return;
+        }
+      }
+
+      const home = homedir();
+      const eventsPath = join(home, '.ijfw', 'state', 'permission-events.jsonl');
+
+      const rawLimit = url.searchParams.get('limit');
+      let limit = 200;
+      if (rawLimit !== null) {
+        const n = safeIntegerParam(rawLimit, 10_000);
+        if (n === null) {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: 'invalid limit' }));
+          return;
+        }
+        limit = n;
+      }
+      const filterExtension = url.searchParams.get('extension') || null;
+      const filterTool      = url.searchParams.get('tool') || null;
+      const filterDenied    = url.searchParams.has('denied')
+        ? (url.searchParams.get('denied') !== 'false')
+        : null;
+
+      // Stream-tail: read only the last TAIL_CHUNK bytes, never slurp the full file.
+      // For permission-events.jsonl which rotates at 10_000 lines, 2MB covers
+      // many thousands of events without loading the entire file into memory.
+      const TAIL_CHUNK = 2 * 1024 * 1024; // 2MB
+      function tailEvents() {
+        if (!existsSync(eventsPath)) return [];
+        let st;
+        try { st = statSync(eventsPath); } catch { return []; }
+        if (st.size === 0) return [];
+        let lines = [];
+        try {
+          const fullBuf = readFileSync(eventsPath);
+          const slice = fullBuf.subarray(Math.max(0, fullBuf.length - TAIL_CHUNK));
+          const text = slice.toString('utf8');
+          lines = text.split('\n').filter(Boolean);
+          // If we sliced mid-line, the first element may be truncated — drop it.
+          if (fullBuf.length > TAIL_CHUNK) lines = lines.slice(1);
+        } catch { return []; }
+
+        const results = [];
+        for (let i = lines.length - 1; i >= 0 && results.length < limit; i--) {
+          let obj;
+          try { obj = JSON.parse(lines[i]); } catch { continue; }
+          if (filterExtension !== null && obj.extension !== filterExtension) continue;
+          if (filterTool !== null && obj.tool !== filterTool) continue;
+          if (filterDenied !== null && Boolean(!obj.allowed) !== filterDenied) continue;
+          results.unshift(obj);
+        }
+        return results;
+      }
+
+      const isSSE = (req.headers['accept'] || '').includes('text/event-stream');
+      if (isSSE) {
+        res.writeHead(200, {
+          'Content-Type': 'text/event-stream',
+          'Cache-Control': 'no-cache',
+          'Connection': 'keep-alive',
+          'X-Accel-Buffering': 'no',
+        });
+        res.write(': connected\n\n');
+        // Send current tail as initial batch.
+        const initial = tailEvents();
+        for (const evt of initial) {
+          try { res.write(`data: ${JSON.stringify(evt)}\n\n`); } catch { break; }
+        }
+        // Watch for new events. lastLineCount must match what the watcher
+        // measures (tail-chunk lines), NOT the limited initial batch length —
+        // mismatching them causes a replay storm when the file is bigger than
+        // the limit.
+        let evtWatcher = null;
+        let lastLineCount = 0;
+        try {
+          const buf0 = readFileSync(eventsPath);
+          const slice0 = buf0.subarray(Math.max(0, buf0.length - TAIL_CHUNK));
+          let lines0 = slice0.toString('utf8').split('\n').filter(Boolean);
+          if (buf0.length > TAIL_CHUNK) lines0 = lines0.slice(1);
+          lastLineCount = lines0.length;
+        } catch { /* eventsPath missing or unreadable — start from 0 */ }
+        try {
+          evtWatcher = watch(existsSync(eventsPath) ? eventsPath : join(home, '.ijfw', 'state'), () => {
+            if (!existsSync(eventsPath)) return;
+            try {
+              // Use the tail-chunk reader (bounded read) rather than slurping the
+              // full file. At 10K lines × ~1-2KB each = 10-20MB sync read per watch
+              // event, which is unacceptable for a long-lived SSE connection.
+              try { statSync(eventsPath); } catch { return; }
+              const buf = (() => {
+                try { return readFileSync(eventsPath); } catch { return null; }
+              })();
+              if (!buf) return;
+              const slice = buf.subarray(Math.max(0, buf.length - TAIL_CHUNK));
+              const text = slice.toString('utf8');
+              let lines = text.split('\n').filter(Boolean);
+              if (buf.length > TAIL_CHUNK) lines = lines.slice(1);
+              if (lines.length > lastLineCount) {
+                const newLines = lines.slice(lastLineCount);
+                lastLineCount = lines.length;
+                for (const line of newLines) {
+                  let obj; try { obj = JSON.parse(line); } catch { continue; }
+                  if (filterExtension !== null && obj.extension !== filterExtension) continue;
+                  if (filterTool !== null && obj.tool !== filterTool) continue;
+                  if (filterDenied !== null && Boolean(!obj.allowed) !== filterDenied) continue;
+                  try { res.write(`data: ${JSON.stringify(obj)}\n\n`); } catch {}
+                }
+              }
+            } catch {}
+          });
+          if (evtWatcher) evtWatcher.on('error', () => {});
+        } catch {}
+        req.on('close', () => {
+          if (evtWatcher) { try { evtWatcher.close(); } catch {} }
+        });
+        return;
+      }
+
+      // JSON array response.
+      const events = tailEvents();
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify(events));
+    }],
+
+    // ---------- extensions: aggregates (B19) ----------
+    // Server-side aggregation of permission-events.jsonl for the per-tool
+    // audit charts. Filters are strictly allowlisted.
+    //   ?window=24h|30m|7d   (regex: \d+[hmd])
+    //   ?kind=hourly|by_ext|by_tool|quotas
+    ['/api/extensions/aggregates', async (req, res, url) => {
+      const ALLOWED_KINDS = new Set(['hourly', 'by_ext', 'by_tool', 'quotas']);
+      const WINDOW_RE = /^\d+(h|m|d)$/;
+      const ALLOWED_KEYS = new Set(['window', 'kind']);
+      try {
+        for (const key of url.searchParams.keys()) {
+          if (!ALLOWED_KEYS.has(key)) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: `unknown filter parameter: ${key}` }));
+            return;
+          }
+        }
+        const kind = url.searchParams.get('kind') || 'hourly';
+        if (!ALLOWED_KINDS.has(kind)) {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: `invalid kind: ${kind}` }));
+          return;
+        }
+        const rawWindow = url.searchParams.get('window') || '24h';
+        if (!WINDOW_RE.test(rawWindow)) {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: `invalid window: ${rawWindow}` }));
+          return;
+        }
+        // Parse window into ms.
+        const num = parseInt(rawWindow.slice(0, -1), 10);
+        const unit = rawWindow.slice(-1);
+        const mult = unit === 'h' ? 3600_000 : unit === 'm' ? 60_000 : 86_400_000;
+        const windowMs = num * mult;
+
+        const home = homedir();
+        const eventsPath = join(home, '.ijfw', 'state', 'permission-events.jsonl');
+
+        if (kind === 'quotas') {
+          // Walk the active extension state and compute per-extension usage.
+          let active = null;
+          try {
+            const activePath = join(home, '.ijfw', 'state', 'active-extension.json');
+            if (existsSync(activePath)) {
+              active = JSON.parse(readFileSync(activePath, 'utf8'));
+            }
+          } catch { active = null; }
+          const rows = [];
+          if (active && typeof active === 'object') {
+            // active may be a single record or a map keyed by name.
+            const entries = Array.isArray(active.extensions)
+              ? active.extensions
+              : (active.name ? [active] : []);
+            for (const ent of entries) {
+              if (!ent || !ent.name) continue;
+              const scope = ent.scope || 'user';
+              const manifest = readActiveManifest({ scope, name: ent.name, home, projectRoot: REPO_ROOT });
+              const quotas = (manifest && manifest.quotas) || {};
+              const usage = await getQuotaUsage(ent.name, { homeDir: home, limits: quotas });
+              rows.push({
+                ...usage,
+                scope,
+                warn_bash_bypass: computeWarnBashBypass(manifest),
+              });
+            }
+          }
+          res.writeHead(200, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ rows }));
+          return;
+        }
+
+        const agg = await aggregateEvents(eventsPath, { windowMs });
+
+        if (kind === 'hourly') {
+          const buckets = Object.entries(agg.hourly)
+            .map(([hour, count]) => ({ hour, count }))
+            .sort((a, b) => a.hour.localeCompare(b.hour));
+          res.writeHead(200, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ buckets }));
+          return;
+        }
+
+        if (kind === 'by_ext') {
+          const rows = Object.entries(agg.by_extension)
+            .map(([ext, v]) => ({ ext, allowed: v.allowed, denied: v.denied }))
+            .sort((a, b) => b.denied - a.denied);
+          res.writeHead(200, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ rows }));
+          return;
+        }
+
+        // kind === 'by_tool'
+        const rows = Object.entries(agg.by_tool_denied)
+          .map(([tool, count]) => ({ tool, count }))
+          .sort((a, b) => b.count - a.count)
+          .slice(0, 10);
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ rows }));
+      } catch (err) {
+        process.stderr.write(`[ijfw-mcp] /api/extensions/aggregates: ${err && err.message ? err.message : err}\n`);
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ buckets: [], rows: [], error: 'aggregation failed' }));
+      }
+    }],
+
     // ---------- extensions health (W3/t15) ----------
     // Reads .ijfw/state/extension-registry.json (project) plus org/user via
     // listExtensions(). Missing or malformed registry yields {extensions: []}

package/src/dispatch/active-cli.js

@@ -0,0 +1,141 @@
+/**
+ * dispatch/active-cli.js — IJFW v1.4.3 W9-B (B18)
+ *
+ * Frozen CLI module contract:
+ *   export const handlers       — { '<subcommand>': async (args, ctx) => { ok, output?, error? } }
+ *   export const subcommandHelp — { '<subcommand>': 'one-line description' }
+ *
+ * Subcommands:
+ *   active --check          — report current active extension + last-writer IDE + divergence
+ *   activate <name> [--ide <id>] [--strict-ide]
+ *                           — activate <name> stamping the host IDE id; refuse
+ *                             activation when --strict-ide is set AND a different
+ *                             IDE is the current writer of stale state.
+ *
+ * Phase D wires these into `dispatch/extension.js`'s main switch by iterating
+ * Object.entries(handlers). Until then, this module is callable in isolation.
+ */
+
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+
+import {
+  findInstalledManifest,
+  writeActiveExtension,
+  detectCrossIdeDivergence,
+} from '../active-extension-writer.js';
+import { detectIde } from '../ide-detect.js';
+
+function homeFromCtx(ctx) {
+  if (ctx && typeof ctx.homedir === 'string') return ctx.homedir;
+  if (ctx && typeof ctx.homeDir === 'string') return ctx.homeDir;
+  return undefined;
+}
+
+function projectRootFromCtx(ctx) {
+  if (ctx && typeof ctx.projectRoot === 'string') return ctx.projectRoot;
+  return process.cwd();
+}
+
+function parseArgs(args) {
+  // Accept either a token array (preferred per registry-cli contract) or a
+  // raw string (fallback for direct callers).
+  let tokens;
+  if (Array.isArray(args)) {
+    tokens = args.slice();
+  } else if (typeof args === 'string') {
+    tokens = args.split(/\s+/).filter(Boolean);
+  } else {
+    tokens = [];
+  }
+  const flags = { check: false, strictIde: false, ide: null };
+  const positional = [];
+  for (let i = 0; i < tokens.length; i++) {
+    const t = tokens[i];
+    if (t === '--check') { flags.check = true; continue; }
+    if (t === '--strict-ide') { flags.strictIde = true; continue; }
+    if (t === '--ide' && tokens[i + 1]) {
+      flags.ide = tokens[i + 1];
+      i++;
+      continue;
+    }
+    positional.push(t);
+  }
+  return { positional, flags };
+}
+
+async function activeHandler(args, ctx) {
+  const { flags } = parseArgs(args);
+  const home = homeFromCtx(ctx) || process.env.HOME || homedir();
+  if (!flags.check) {
+    return { ok: false, error: "active: --check required (usage: active --check)" };
+  }
+  // Read current active.json (best-effort).
+  const activePath = join(home, '.ijfw', 'state', 'active-extension.json');
+  let active = null;
+  try {
+    const raw = await readFile(activePath, 'utf8');
+    active = JSON.parse(raw);
+  } catch {
+    // null
+  }
+  const verdict = await detectCrossIdeDivergence({ homeDir: home });
+  const out = {
+    active: active ? {
+      name: active.name ?? null,
+      scope: active.scope ?? null,
+      activated_at: active.activated_at ?? null,
+      activated_by_ide: active.activated_by_ide ?? null,
+      activated_by_pid: active.activated_by_pid ?? null,
+    } : null,
+    current_ide: verdict.current_ide,
+    divergent: !!verdict.divergent,
+    last_writer: verdict.last_writer ?? null,
+    age_seconds: verdict.age_seconds ?? null,
+  };
+  return { ok: true, output: JSON.stringify(out, null, 2) };
+}
+
+async function activateHandler(args, ctx) {
+  const { positional, flags } = parseArgs(args);
+  const name = positional[0];
+  if (!name || typeof name !== 'string') {
+    return { ok: false, error: 'activate: extension name required (usage: activate <name> [--ide <id>] [--strict-ide])' };
+  }
+  const home = homeFromCtx(ctx) || process.env.HOME || homedir();
+  const projectRoot = projectRootFromCtx(ctx);
+
+  const ideId = flags.ide && /^[a-z0-9-]+$/.test(flags.ide) ? flags.ide : detectIde();
+
+  // Strict-IDE gate: if active.json was last touched by a different IDE AND
+  // divergence semantic flags it, refuse before writing.
+  if (flags.strictIde) {
+    const verdict = await detectCrossIdeDivergence({ homeDir: home, currentIde: ideId });
+    if (verdict && verdict.divergent) {
+      return {
+        ok: false,
+        error: `[ijfw] activate refused: --strict-ide and active extension last activated by '${verdict.last_writer}'`,
+      };
+    }
+  }
+
+  const lookup = await findInstalledManifest(name, projectRoot, { homeDir: home });
+  if (!lookup.ok) return { ok: false, error: lookup.error };
+  const result = await writeActiveExtension(lookup.manifest, lookup.scope, { homeDir: home, ideId });
+  if (!result.ok) return { ok: false, error: result.error };
+  return {
+    ok: true,
+    output: JSON.stringify({ name, scope: lookup.scope, activated_by_ide: ideId, path: result.path }, null, 2),
+  };
+}
+
+export const handlers = Object.freeze({
+  'active': activeHandler,
+  'activate': activateHandler,
+});
+
+export const subcommandHelp = Object.freeze({
+  'active': 'active --check — report current active extension + cross-IDE divergence status',
+  'activate': 'activate <name> [--ide <id>] [--strict-ide] — activate extension and stamp host IDE',
+});