@jbarket/loomai 0.9.0 → 0.9.2

package/CHANGELOG.md

@@ -12,6 +12,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.9.2] - 2026-10-24
+
+### Fixed
+
+- **Logging in to the page (and every form on it) failed in a browser with
+  "forbidden: cross-site request".** The page was served with
+  `Referrer-Policy: no-referrer`, under which browsers send `Origin: null` on
+  the page's own form posts, and the cross-site guard refuses that. It's
+  `same-origin` now, which still sends nothing to links that leave the page.
+
+## [0.9.1] - 2026-10-24
+
+### Changed
+
+- **loom's page is at the root.** `/`, `/mind`, `/people`, `/memory/<ref>`,
+  `/p/<piece>/…`, `/act/<source>`, `/login`, `/logout` and `/pieces.json`.
+  The old `/ui/…` addresses redirect (308) to the same page. MCP still
+  answers everywhere else, and at `/` for a POST, a request with an MCP
+  session, or an event-stream GET. The session cookie's path is `/`.
+
 ## [0.9.0] - 2026-10-24
 
 ### Changed
@@ -646,7 +666,9 @@ Initial public release.
   stack and all added external-service dependencies or operational
   overhead.
 
-[Unreleased]: https://github.com/sleepunit-agents/loom/compare/v0.9.0...HEAD
+[Unreleased]: https://github.com/sleepunit-agents/loom/compare/v0.9.2...HEAD
+[0.9.2]: https://github.com/sleepunit-agents/loom/compare/v0.9.1...v0.9.2
+[0.9.1]: https://github.com/sleepunit-agents/loom/compare/v0.9.0...v0.9.1
 [0.9.0]: https://github.com/sleepunit-agents/loom/compare/v0.8.0...v0.9.0
 [0.8.0]: https://github.com/sleepunit-agents/loom/compare/v0.7.0...v0.8.0
 [0.7.0]: https://github.com/sleepunit-agents/loom/compare/v0.6.0...v0.7.0

package/README.md

@@ -383,9 +383,12 @@ header, or a body that isn't `application/json`). The knowledge-only daemon
 has no `/cli`. Every other command (`doctor`, `inject`, `serve`, …) stays
 local, and `--url` on one of them is an error.
 
-### loom's page — `/ui`
+### loom's page
 
-The full-scope daemon serves a web page at `/ui`. **Home** is the tape:
+The full-scope daemon serves a web page at its root (`/`; the old `/ui/…`
+addresses redirect). MCP shares the root: a POST, a request with an MCP
+session or an event-stream GET is MCP's, a plain browser GET is the page.
+**Home** is the tape:
 what every body did in the last day, by hour and by where it happened, with
 top of mind and the people cards that need a look beside it. **Mind** lists
 every memory by heat and says why each one has it, which is how you find a
@@ -409,7 +412,7 @@ until the daemon restarts. Every form carries an anti-forgery token bound to
 that session, a cross-site post is refused, and another site can link to the
 page but not embed or fetch it. A form's fields go to the piece on stdin, and loom never logs, keeps
 or puts them in a URL. Scripts can send the bearer header instead (for
-example `/ui/pieces.json` for the pieces' manifests). The page runs no script
+example `/pieces.json` for the pieces' manifests). The page runs no script
 and is served under a CSP that forbids script and framing. Pieces never
 receive loom's bearer tokens.
 

package/dist/transport/http-server.js

@@ -32,7 +32,7 @@ import { EmptyResultSchema } from '@modelcontextprotocol/core';
 import { createLoomServer } from '../server.js';
 import { createBackend } from '../backends/index.js';
 import { handleCliBody } from './cli-endpoint.js';
-import { handleUi, isUiPath } from '../ui/handler.js';
+import { handleUi, isUiRequest } from '../ui/handler.js';
 import { assertSafeBind, checkBearer, checkBearerMulti, checkPayloadSize, DEFAULT_MAX_BODY_BYTES, } from './guards.js';
 /**
  * SSE keep-alive: the SDK opens the standalone GET stream but sends no
@@ -197,11 +197,11 @@ export async function startHttpServer(opts) {
     }
     const http = createServer((req, res) => {
         void (async () => {
-            // /ui: loom's web page (src/ui). Its own auth (a cookie from the bearer,
-            // or the bearer header), so it comes before the bearer gate. Full scope
-            // only: a scoped server has no memory to show.
+            // loom's web page (src/ui), at the root. Its own auth (a session from
+            // the bearer, or the bearer header), so it comes before the bearer gate.
+            // Full scope only: a scoped server has no memory to show.
             const uiPath = new URL(req.url ?? '/', 'http://localhost').pathname;
-            if (isUiPath(uiPath)) {
+            if (isUiRequest(req, uiPath)) {
                 if (opts.createServer)
                     return sendError(res, 404, 'not-found: this server has no UI');
                 return handleUi(req, res, uiPath, {

package/dist/ui/handler.d.ts

@@ -6,6 +6,7 @@ export interface UiOptions {
     /** Env for piece discovery and piece processes (PATH decides which pieces exist). */
     env: NodeJS.ProcessEnv;
 }
-export declare function isUiPath(pathname: string): boolean;
-/** Handle a /ui request. The caller has already matched isUiPath. */
+/** Whether a request is for the page (see the header for how `/` is shared with MCP). */
+export declare function isUiRequest(req: IncomingMessage, pathname: string): boolean;
+/** Handle a request for the page. The caller has already matched isUiRequest. */
 export declare function handleUi(req: IncomingMessage, res: ServerResponse, pathname: string, opts: UiOptions): Promise<void>;

package/dist/ui/handler.js

@@ -1,12 +1,17 @@
 /**
  * loom's web UI on the HTTP daemon (full scope only).
  *
- *   GET  /ui                       Home: the tape, tiles, "Your call"
- *   GET  /ui/mind, /ui/people[/<slug>], /ui/memory/<ref>   loom's own pages
- *   GET  /ui/p/<piece>[/<path>]    a piece's page
- *   GET  /ui/pieces.json           the installed pieces' manifests, for scripts
- *   POST /ui/act/<source>          an action (source = loom or a piece)
- *   GET/POST /ui/login, POST /ui/logout
+ *   GET  /                         Home: the tape, tiles, "Your call"
+ *   GET  /mind, /people[/<slug>], /memory/<ref>   loom's own pages
+ *   GET  /p/<piece>[/<path>]       a piece's page
+ *   GET  /pieces.json              the installed pieces' manifests, for scripts
+ *   POST /act/<source>             an action (source = loom or a piece)
+ *   GET/POST /login, POST /logout
+ *   /ui/…                          the old address: redirects to the same page at the root
+ *
+ * The page shares the daemon with MCP, which answers on any other path. `/`
+ * is the page only for a plain browser GET: a POST, a request with an MCP
+ * session, or one asking for an event stream is MCP's.
  *
  * Auth follows the daemon's bearer token, and the UI needs one: a daemon with
  * no token serves no /ui (like /cli), because an open page would be readable
@@ -44,11 +49,25 @@ const COOKIE_KEY = randomBytes(32);
 const SECURITY_HEADERS = {
     'content-security-policy': "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'",
     'x-content-type-options': 'nosniff',
-    'referrer-policy': 'no-referrer',
+    // same-origin, not no-referrer: under no-referrer, browsers send `Origin:
+    // null` on the page's own form posts, which the cross-site guard has to
+    // refuse. same-origin still sends nothing to links that leave the page.
+    'referrer-policy': 'same-origin',
     'cache-control': 'no-store',
 };
-export function isUiPath(pathname) {
-    return pathname === '/ui' || pathname.startsWith('/ui/');
+const PAGE_ROOTS = ['/login', '/logout', '/pieces.json', '/mind', '/people', '/memory', '/p', '/act'];
+/** Whether a request is for the page (see the header for how `/` is shared with MCP). */
+export function isUiRequest(req, pathname) {
+    if (pathname === '/ui' || pathname.startsWith('/ui/'))
+        return true;
+    if (pathname === '/') {
+        if (req.method !== 'GET' && req.method !== 'HEAD')
+            return false;
+        if (req.headers['mcp-session-id'] !== undefined)
+            return false;
+        return !/text\/event-stream/i.test(req.headers.accept ?? '');
+    }
+    return PAGE_ROOTS.some((r) => pathname === r || pathname.startsWith(`${r}/`));
 }
 const digest = (s) => createHash('sha256').update(s).digest();
 const sessions = new Map();
@@ -208,14 +227,14 @@ function hasPages(p) {
 }
 function chrome(opts, pieces, skipped, current, csrf, flash) {
     const tabs = pieces.filter(hasPages)
-        .map((p) => ({ label: p.manifest.tab?.label ?? p.piece, href: `/ui/p/${p.piece}`, current: current === `p/${p.piece}`, piece: true }))
+        .map((p) => ({ label: p.manifest.tab?.label ?? p.piece, href: `/p/${p.piece}`, current: current === `p/${p.piece}`, piece: true }))
         .sort((a, b) => a.label.localeCompare(b.label));
     return {
         agent: agentName(opts.contextDir),
         nav: [
-            { label: 'Home', href: '/ui', current: current === '', piece: false },
-            { label: 'Mind', href: '/ui/mind', current: current === 'mind', piece: false },
-            { label: 'People', href: '/ui/people', current: current === 'people', piece: false },
+            { label: 'Home', href: '/', current: current === '', piece: false },
+            { label: 'Mind', href: '/mind', current: current === 'mind', piece: false },
+            { label: 'People', href: '/people', current: current === 'people', piece: false },
             ...tabs,
         ],
         clock: clock(),
@@ -230,7 +249,7 @@ function landing(source, result, back) {
     const core = s?.core || source.id === 'loom';
     const path = s?.path ?? '';
     const q = s ? new URLSearchParams(s.query).toString() : '';
-    const base = core ? `/ui${path ? `/${path}` : ''}` : `/ui/p/${source.id}${path ? `/${path}` : ''}`;
+    const base = core ? `/${path}` : `/p/${source.id}${path ? `/${path}` : ''}`;
     return q ? `${base}?${q}` : base;
 }
 function withFlash(to, id) {
@@ -246,15 +265,24 @@ function decode(s) {
         return null;
     }
 }
-/** Handle a /ui request. The caller has already matched isUiPath. */
+/** Handle a request for the page. The caller has already matched isUiRequest. */
 export async function handleUi(req, res, pathname, opts) {
     // No token, no page: an open /ui would be readable by any site that
     // DNS-rebinds a name to the loopback address (the same rule as /cli).
     if (opts.secrets.length === 0) {
         return send(res, 403, 'text/plain', 'forbidden: loom\'s page requires LOOM_BEARER_TOKEN');
     }
+    // The page used to live under /ui. Old links and bookmarks land on the same page.
+    if (pathname === '/ui' || pathname.startsWith('/ui/')) {
+        const to = new URL(req.url ?? pathname, 'http://loom.invalid');
+        // One leading slash, never two: `/ui//evil.example` must not become a
+        // protocol-relative `//evil.example`.
+        const rest = '/' + pathname.slice(3).replace(/^[/\\]+/, '');
+        res.writeHead(308, { location: rest + to.search, ...SECURITY_HEADERS });
+        return void res.end();
+    }
     const secure = req.headers['x-forwarded-proto'] === 'https';
-    if (pathname === '/ui/login') {
+    if (pathname === '/login') {
         // Unauthenticated: the login page names no agent.
         if (req.method === 'GET')
             return send(res, 200, 'text/html; charset=utf-8', renderLogin());
@@ -269,13 +297,13 @@ export async function handleUi(req, res, pathname, opts) {
         const match = opts.secrets.find((s) => safeEq(token, s));
         if (!match)
             return send(res, 401, 'text/html; charset=utf-8', renderLogin('That token didn’t match.'));
-        return redirect(res, '/ui', {
-            'set-cookie': `${COOKIE}=${newSession(match)}; Path=/ui; HttpOnly; SameSite=Strict; Max-Age=${COOKIE_MAX_AGE_S}${secure ? '; Secure' : ''}`,
+        return redirect(res, '/', {
+            'set-cookie': `${COOKIE}=${newSession(match)}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${COOKIE_MAX_AGE_S}${secure ? '; Secure' : ''}`,
         });
     }
     const who = whoIs(req, opts);
     const csrf = who?.kind === 'session' ? csrfFor(who.cookie) : '';
-    if (pathname === '/ui/logout') {
+    if (pathname === '/logout') {
         if (req.method !== 'POST')
             return send(res, 405, 'text/plain', 'method not allowed');
         if (!sameOrigin(req))
@@ -284,22 +312,22 @@ export async function handleUi(req, res, pathname, opts) {
         const c = readCookie(req, COOKIE);
         if (c)
             sessions.delete(c);
-        return redirect(res, '/ui/login', { 'set-cookie': `${COOKIE}=; Path=/ui; HttpOnly; SameSite=Strict; Max-Age=0` });
+        return redirect(res, '/login', { 'set-cookie': `${COOKIE}=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0` });
     }
     if (!who) {
         if (pathname.endsWith('.json'))
             return send(res, 401, 'application/json', JSON.stringify({ error: 'unauthorized' }));
         if (req.method === 'GET')
-            return redirect(res, '/ui/login');
+            return redirect(res, '/login');
         return send(res, 401, 'text/plain', 'unauthorized');
     }
     const url = new URL(req.url ?? pathname, 'http://loom.invalid');
-    if (pathname.startsWith('/ui/act/')) {
+    if (pathname.startsWith('/act/')) {
         if (req.method !== 'POST')
             return send(res, 405, 'text/plain', 'method not allowed');
         if (!sameOrigin(req))
             return send(res, 403, 'text/plain', 'forbidden: cross-site request');
-        const sourceId = pathname.slice('/ui/act/'.length);
+        const sourceId = pathname.slice('/act/'.length);
         if (sourceId !== 'loom' && !ID.test(sourceId))
             return send(res, 404, 'text/plain', 'not found');
         const form = await readForm(req, ACT_MAX_BYTES);
@@ -350,7 +378,7 @@ export async function handleUi(req, res, pathname, opts) {
         return send(res, 405, 'text/plain', 'method not allowed');
     if (!allowedGet(req))
         return send(res, 403, 'text/plain', 'forbidden: loom\'s page can only be opened, not embedded or fetched from another site');
-    if (pathname === '/ui/pieces.json') {
+    if (pathname === '/pieces.json') {
         const m = await pieceManifests(opts.env);
         return send(res, 200, 'application/json', JSON.stringify({
             agent: agentName(opts.contextDir),
@@ -363,7 +391,7 @@ export async function handleUi(req, res, pathname, opts) {
     const { pieces, skipped } = await pieceManifests(opts.env);
     const skippedNames = skipped.map((s) => s.piece);
     const html = (body, status = 200) => send(res, status, 'text/html; charset=utf-8', body);
-    if (pathname === '/ui' || pathname === '/ui/') {
+    if (pathname === '/') {
         const home = homePage(opts.contextDir, query);
         const tiles = [
             { ...home.tile, source: CORE },
@@ -372,8 +400,8 @@ export async function handleUi(req, res, pathname, opts) {
         const asks = pieces.flatMap((p) => p.manifest.asks.map((a) => ({ ...a, source: pieceSource(p.piece) })));
         return html(renderHome(home.page, { source: CORE, path: '', query, csrf }, chrome(opts, pieces, skippedNames, '', csrf, flash), tiles, asks));
     }
-    if (pathname.startsWith('/ui/p/')) {
-        const rest = pathname.slice('/ui/p/'.length);
+    if (pathname.startsWith('/p/')) {
+        const rest = pathname.slice('/p/'.length);
         const slash = rest.indexOf('/');
         const piece = slash === -1 ? rest : rest.slice(0, slash);
         const path = slash === -1 ? '' : decode(rest.slice(slash + 1));
@@ -388,7 +416,7 @@ export async function handleUi(req, res, pathname, opts) {
         }
         return html(renderPage(page, ctx, ch), page.title === 'Not found' && page.sections.length === 0 ? 404 : 200);
     }
-    const path = decode(pathname.slice('/ui/'.length)) ?? '\0';
+    const path = decode(pathname.slice(1)) ?? '\0';
     const top = path.split('/')[0];
     const ch = chrome(opts, pieces, skippedNames, top, csrf, flash);
     const page = validPath(path) ? corePage(opts.contextDir, path, query) : null;

package/dist/ui/render.js

@@ -7,8 +7,8 @@ export function esc(s) {
         .replace(/"/g, '"')
         .replace(/'/g, ''');
 }
-export const CORE = { id: 'loom', base: '/ui/' };
-export const pieceSource = (piece) => ({ id: piece, base: `/ui/p/${piece}/` });
+export const CORE = { id: 'loom', base: '/' };
+export const pieceSource = (piece) => ({ id: piece, base: `/p/${piece}/` });
 function qs(query) {
     const p = new URLSearchParams();
     for (const [k, v] of Object.entries(query))
@@ -23,7 +23,7 @@ export function pageHref(link, source) {
     if (!s)
         return '#';
     const base = s.core ? CORE.base : source.base;
-    const url = s.path === '' ? (base === CORE.base ? '/ui' : base.replace(/\/$/, '')) : base + s.path;
+    const url = s.path === '' ? (base === CORE.base ? '/' : base.replace(/\/$/, '')) : base + s.path;
     return url + qs(s.query);
 }
 const tone = (t) => (t ? ` tone-${t}` : '');
@@ -40,7 +40,7 @@ function hiddenInputs(fields) {
 }
 function actionForm(ctx, action, inner, cls) {
     const back = ctx.path + qs(ctx.query);
-    return `<form class="${cls}" method="post" action="/ui/act/${esc(ctx.source.id)}">${hiddenInputs({ _csrf: ctx.csrf, _action: action, _path: back })}${inner}</form>`;
+    return `<form class="${cls}" method="post" action="/act/${esc(ctx.source.id)}">${hiddenInputs({ _csrf: ctx.csrf, _action: action, _path: back })}${inner}</form>`;
 }
 let fieldSeq = 0;
 function renderField(f) {
@@ -94,7 +94,7 @@ function renderBlock(b, ctx) {
         case 'filters': {
             const current = ctx.query[b.param] ?? '';
             return `<nav class="filters" aria-label="Filter">${b.options.map((o) => {
-                const href = ctx.source.base === CORE.base && ctx.path === '' ? '/ui' : pageHref(ctx.path, ctx.source);
+                const href = pageHref(ctx.path, ctx.source);
                 const target = href + qs({ ...ctx.query, [b.param]: o.value });
                 const on = o.value === current;
                 return `<a class="pill${on ? ' on' : ''}" href="${esc(target)}"${on ? ' aria-current="true"' : ''}>${esc(o.label)}</a>`;
@@ -183,9 +183,9 @@ function chromeTop(c) {
     const core = c.nav.filter((n) => !n.piece);
     const pieces = c.nav.filter((n) => n.piece);
     const tab = (n) => `<a href="${esc(n.href)}"${n.current ? ' aria-current="page"' : ''}>${esc(n.label)}</a>`;
-    return `<header class="top"><div class="top-in"><a class="brand" href="/ui"><svg width="20" height="20" viewBox="0 0 22 22" fill="none" stroke="currentColor" stroke-width="1.6" aria-hidden="true"><path d="M3 5h16M3 11h16M3 17h16"></path><path d="M7 2v18M15 2v18" opacity=".55"></path></svg>loom <span class="who">· ${esc(c.agent)}</span></a>` +
+    return `<header class="top"><div class="top-in"><a class="brand" href="/"><svg width="20" height="20" viewBox="0 0 22 22" fill="none" stroke="currentColor" stroke-width="1.6" aria-hidden="true"><path d="M3 5h16M3 11h16M3 17h16"></path><path d="M7 2v18M15 2v18" opacity=".55"></path></svg>loom <span class="who">· ${esc(c.agent)}</span></a>` +
         `<nav class="tabs" aria-label="Sections">${core.map(tab).join('')}${pieces.length ? `<span class="sep" aria-hidden="true"></span>${pieces.map(tab).join('')}` : ''}</nav>` +
-        `<div class="top-right"><span class="mono">${esc(c.clock)}</span><form class="inline" method="post" action="/ui/logout"><input type="hidden" name="_csrf" value="${esc(c.csrf)}"><button type="submit">Sign out</button></form></div></div></header>`;
+        `<div class="top-right"><span class="mono">${esc(c.clock)}</span><form class="inline" method="post" action="/logout"><input type="hidden" name="_csrf" value="${esc(c.csrf)}"><button type="submit">Sign out</button></form></div></div></header>`;
 }
 function chromeFoot(c, refresh) {
     return `<footer>${refresh ? '<span>Refreshes every minute.</span>' : ''}${c.skipped.length ? `<span>Pieces with no page: ${c.skipped.map(esc).join(', ')}</span>` : ''}</footer>`;
@@ -238,5 +238,5 @@ export function renderHome(page, ctx, chrome, tiles, asks) {
     return document(chrome.agent, body, true);
 }
 export function renderLogin(error) {
-    return document('loom', `<form class="login" method="post" action="/ui/login"><h1>loom</h1><p class="sub">Paste the bearer token once. This browser keeps a cookie (until the daemon restarts, or 30 days).</p>${error ? `<p class="err">${esc(error)}</p>` : ''}<input type="password" name="token" autocomplete="current-password" autofocus aria-label="token"><button type="submit">Open</button></form>`, false);
+    return document('loom', `<form class="login" method="post" action="/login"><h1>loom</h1><p class="sub">Paste the bearer token once. This browser keeps a cookie (until the daemon restarts, or 30 days).</p>${error ? `<p class="err">${esc(error)}</p>` : ''}<input type="password" name="token" autocomplete="current-password" autofocus aria-label="token"><button type="submit">Open</button></form>`, false);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jbarket/loomai",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "description": "MCP server for persistent AI agent identity and memory. Single-file sqlite-vec + local ONNX embeddings; zero external services.",
   "type": "module",
   "main": "dist/index.js",