@jungjaehoon/mama-core 2.4.1 → 4.1.0

package/dist/embedding-server/index.js

@@ -1,405 +0,0 @@
-"use strict";
-/**
- * MAMA Embedding HTTP Server
- *
- * HTTP API for embedding generation, integrated with MCP server.
- * Provides fast embedding access for Claude Code hooks.
- *
- * Features:
- * - Model stays loaded in memory (singleton)
- * - HTTP API at localhost:${MAMA_EMBEDDING_PORT || MAMA_HTTP_PORT || 3849}
- * - Health check endpoint
- * - Shared model with MCP server
- *
- * @module embedding-http-server
- */
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.PORT_FILE = exports.HOST = exports.DEFAULT_PORT = exports.SHUTDOWN_TOKEN = void 0;
-exports.resolveEmbeddingRole = resolveEmbeddingRole;
-exports.cleanupPortFile = cleanupPortFile;
-exports.startEmbeddingServer = startEmbeddingServer;
-exports.warmModel = warmModel;
-const http_1 = __importDefault(require("http"));
-const path_1 = __importDefault(require("path"));
-const fs_1 = __importDefault(require("fs"));
-const crypto_1 = __importDefault(require("crypto"));
-// SECURITY P1: Shutdown token for authenticated takeover
-exports.SHUTDOWN_TOKEN = process.env.MAMA_SHUTDOWN_TOKEN || crypto_1.default.randomBytes(16).toString('hex');
-// Import embedding functions from mama-core
-const embeddings_js_1 = require("../embeddings.js");
-const config_loader_js_1 = require("../config-loader.js");
-const db_manager_js_1 = require("../db-manager.js");
-// Import Session API handler (chat session API)
-const session_api_js_1 = require("./mobile/session-api.js");
-// Import WebSocket handler (chat WebSocket API - V2 with MessageRouter)
-const websocket_handler_js_1 = require("./mobile/websocket-handler.js");
-// Import Session Manager
-const session_manager_js_1 = require("./mobile/session-manager.js");
-// Create session manager (shared between REST API and WebSocket)
-const sessionManager = new session_manager_js_1.SessionManager();
-const sessionHandler = (0, session_api_js_1.createSessionHandler)(sessionManager);
-function resolveConfiguredPort() {
-    const rawPort = process.env.MAMA_EMBEDDING_PORT || process.env.MAMA_HTTP_PORT || '';
-    const parsedPort = parseInt(rawPort, 10);
-    if (Number.isInteger(parsedPort) && parsedPort > 0 && parsedPort < 65536) {
-        return parsedPort;
-    }
-    return 3849;
-}
-// Configuration
-exports.DEFAULT_PORT = resolveConfiguredPort();
-exports.HOST = '127.0.0.1'; // localhost only for security
-// Port file for clients to discover the server
-exports.PORT_FILE = path_1.default.join(process.env.HOME || '/tmp', '.mama-embedding-port');
-// Track if model is loaded
-let modelLoaded = false;
-// Track server instance for shutdown
-let _serverInstance = null;
-let _hasChatCapability = false;
-// Track active connections for graceful shutdown
-const connections = new Set();
-// Graph handler (optional, passed from standalone)
-let graphHandler = null;
-let _wssInstance = null;
-// Resolve the e5 role from an HTTP body value. Absent/unknown -> passage, so old
-// clients that never send a role keep getting passage vectors (backward compatible).
-function resolveEmbeddingRole(raw) {
-    return raw === 'query' ? 'query' : 'passage';
-}
-/**
- * Read request body as JSON
- */
-function readBody(req) {
-    return new Promise((resolve, reject) => {
-        let data = '';
-        req.on('data', (chunk) => (data += chunk));
-        req.on('end', () => {
-            try {
-                resolve(JSON.parse(data));
-            }
-            catch {
-                reject(new Error('Invalid JSON'));
-            }
-        });
-        req.on('error', reject);
-    });
-}
-/**
- * HTTP request handler
- */
-async function handleRequest(req, res) {
-    // CORS headers for local requests
-    // Security Note: CORS '*' is safe here because:
-    // 1. Server binds to localhost only (127.0.0.1)
-    // 2. No sensitive data exposed (user's own decisions)
-    // 3. Required for the browser-based Viewer
-    res.setHeader('Content-Type', 'application/json');
-    res.setHeader('Access-Control-Allow-Origin', '*');
-    // Health check
-    if (req.url === '/health' && req.method === 'GET') {
-        res.writeHead(200);
-        res.end(JSON.stringify({
-            status: 'ok',
-            modelLoaded,
-            model: (0, config_loader_js_1.getModelName)(),
-            dim: (0, config_loader_js_1.getEmbeddingDim)(),
-            chatEnabled: _hasChatCapability,
-        }));
-        return;
-    }
-    // SECURITY P1: Shutdown endpoint with token authentication (for Standalone takeover)
-    if (req.url === '/shutdown' && req.method === 'POST') {
-        const providedToken = req.headers['x-shutdown-token'];
-        if (providedToken !== exports.SHUTDOWN_TOKEN) {
-            console.error('[EmbeddingHTTP] SECURITY: Invalid shutdown token rejected');
-            res.writeHead(401);
-            res.end(JSON.stringify({ error: 'Invalid shutdown token' }));
-            return;
-        }
-        console.error('[EmbeddingHTTP] Shutdown requested (Standalone takeover, token validated)');
-        res.writeHead(200);
-        res.end(JSON.stringify({ status: 'shutting_down' }));
-        // Graceful shutdown after response - close WebSocket first, then HTTP
-        setTimeout(() => {
-            // Close WebSocket server first to release connections
-            if (_wssInstance) {
-                _wssInstance.clients?.forEach((client) => {
-                    try {
-                        client.terminate();
-                    }
-                    catch {
-                        // Ignore termination errors
-                    }
-                });
-                _wssInstance.close(() => {
-                    console.error('[EmbeddingHTTP] WebSocket server closed');
-                });
-            }
-            // Then close HTTP server
-            if (_serverInstance) {
-                _serverInstance.close(() => {
-                    console.error('[EmbeddingHTTP] Server closed for Standalone takeover');
-                    cleanupPortFile();
-                });
-                // Force close any remaining connections after a short delay
-                setTimeout(() => {
-                    for (const socket of connections) {
-                        socket.destroy();
-                    }
-                }, 50);
-            }
-        }, 100);
-        return;
-    }
-    // Embedding endpoint
-    if (req.url === '/embed' && req.method === 'POST') {
-        try {
-            const startTime = Date.now();
-            const body = await readBody(req);
-            if (!body.text || typeof body.text !== 'string') {
-                res.writeHead(400);
-                res.end(JSON.stringify({ error: 'Missing or invalid "text" field' }));
-                return;
-            }
-            const role = resolveEmbeddingRole(body.role);
-            const embedding = await (0, embeddings_js_1.generateEmbedding)(body.text, role);
-            modelLoaded = true;
-            const latency = Date.now() - startTime;
-            res.writeHead(200);
-            res.end(JSON.stringify({
-                embedding: Array.from(embedding),
-                dim: embedding.length,
-                latency,
-            }));
-        }
-        catch (error) {
-            const errMsg = error instanceof Error ? error.message : String(error);
-            console.error(`[EmbeddingHTTP] Error: ${errMsg}`);
-            res.writeHead(500);
-            res.end(JSON.stringify({ error: errMsg }));
-        }
-        return;
-    }
-    // Batch embedding endpoint
-    if (req.url === '/embed/batch' && req.method === 'POST') {
-        try {
-            const startTime = Date.now();
-            const body = await readBody(req);
-            if (!Array.isArray(body.texts)) {
-                res.writeHead(400);
-                res.end(JSON.stringify({ error: 'Missing or invalid "texts" array' }));
-                return;
-            }
-            const role = resolveEmbeddingRole(body.role);
-            const embeddings = await Promise.all(body.texts.map((text) => (0, embeddings_js_1.generateEmbedding)(text, role).then((e) => Array.from(e))));
-            modelLoaded = true;
-            const latency = Date.now() - startTime;
-            res.writeHead(200);
-            res.end(JSON.stringify({
-                embeddings,
-                count: embeddings.length,
-                latency,
-            }));
-        }
-        catch (error) {
-            const errMsg = error instanceof Error ? error.message : String(error);
-            console.error(`[EmbeddingHTTP] Batch error: ${errMsg}`);
-            res.writeHead(500);
-            res.end(JSON.stringify({ error: errMsg }));
-        }
-        return;
-    }
-    // Session API routes (chat session API)
-    try {
-        const sessionHandled = await sessionHandler(req, res);
-        if (sessionHandled) {
-            return;
-        }
-    }
-    catch (error) {
-        const errMsg = error instanceof Error ? error.message : String(error);
-        console.error(`[EmbeddingHTTP] Session API error: ${errMsg}`);
-        res.writeHead(500);
-        res.end(JSON.stringify({ error: errMsg }));
-        return;
-    }
-    // Graph API routes (Viewer, if graphHandler provided)
-    if (graphHandler) {
-        try {
-            const graphHandled = await graphHandler(req, res);
-            if (graphHandled) {
-                return;
-            }
-        }
-        catch (error) {
-            const errMsg = error instanceof Error ? error.message : String(error);
-            console.error(`[EmbeddingHTTP] Graph API error: ${errMsg}`);
-            res.writeHead(500);
-            res.end(JSON.stringify({ error: errMsg }));
-            return;
-        }
-    }
-    // Viewer fallback when graphHandler not provided (MCP-only mode)
-    const url = new URL(req.url || '/', `http://${req.headers.host || 'localhost'}`);
-    const isViewerPath = url.pathname === '/' ||
-        url.pathname === '/viewer' ||
-        url.pathname.startsWith('/viewer/') ||
-        url.pathname === '/graph' ||
-        url.pathname.startsWith('/graph/');
-    if (isViewerPath && !graphHandler) {
-        res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-        res.end(`<!DOCTYPE html>
-<html>
-<head><title>MAMA - Standalone Required</title></head>
-<body style="font-family: system-ui; display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0; background: #1a1a2e; color: #eee;">
-  <div style="text-align: center; padding: 2rem;">
-    <h1>🧠 MAMA Viewer</h1>
-    <p>The Viewer is only available in <strong>Standalone</strong> mode.</p>
-    <p style="color: #888; margin-top: 1rem;">Start Standalone: <code style="background: #333; padding: 0.25rem 0.5rem; border-radius: 4px;">mama start</code></p>
-    <p style="color: #666; font-size: 0.9rem; margin-top: 2rem;">Current: MCP Server (embedding only)</p>
-  </div>
-</body>
-</html>`);
-        return;
-    }
-    // 404 for unknown routes
-    res.writeHead(404);
-    res.end(JSON.stringify({ error: 'Not found' }));
-}
-/**
- * Write port file for client discovery
- */
-function writePortFile(port) {
-    try {
-        fs_1.default.writeFileSync(exports.PORT_FILE, String(port));
-        console.error(`[EmbeddingHTTP] Port file written: ${exports.PORT_FILE}`);
-    }
-    catch (e) {
-        const errMsg = e instanceof Error ? e.message : String(e);
-        console.error(`[EmbeddingHTTP] Failed to write port file: ${errMsg}`);
-    }
-}
-/**
- * Clean up port file on exit
- */
-function cleanupPortFile() {
-    try {
-        if (fs_1.default.existsSync(exports.PORT_FILE)) {
-            fs_1.default.unlinkSync(exports.PORT_FILE);
-        }
-    }
-    catch {
-        // Ignore cleanup errors
-    }
-}
-/**
- * Start the HTTP embedding server
- *
- * @param port - Port to listen on (default: DEFAULT_PORT)
- * @returns HTTP server instance
- */
-async function startEmbeddingServer(port = exports.DEFAULT_PORT, options = {}) {
-    const { messageRouter, sessionStore, graphHandler: graphHandlerOption } = options;
-    // Track chat capability (Standalone provides messageRouter)
-    _hasChatCapability = !!(messageRouter && sessionStore);
-    // Store graph handler if provided
-    if (graphHandlerOption) {
-        graphHandler = graphHandlerOption;
-        console.error(`[EmbeddingHTTP] Graph handler registered (Viewer routes on port ${port})`);
-    }
-    // Check if HTTP server is disabled
-    if (process.env.MAMA_DISABLE_HTTP_SERVER === 'true') {
-        console.error('[EmbeddingHTTP] HTTP server disabled via MAMA_DISABLE_HTTP_SERVER');
-        console.error('[EmbeddingHTTP] The Viewer and the chat WebSocket API will not be available');
-        return null;
-    }
-    // Initialize database for graph API
-    await (0, db_manager_js_1.initDB)();
-    // Initialize session manager
-    await sessionManager.initDB();
-    return new Promise((resolve, reject) => {
-        const server = http_1.default.createServer(handleRequest);
-        server.on('error', (error) => {
-            if (error.code === 'EADDRINUSE') {
-                console.warn(`[EmbeddingHTTP] Port ${port} already in use, assuming another instance is running`);
-                // Not a fatal error - another server instance may be running
-                resolve(null);
-            }
-            else if (error.code === 'EPERM' || error.code === 'EACCES') {
-                console.warn(`[EmbeddingHTTP] Permission denied opening port ${port}, skipping HTTP embedding server (sandboxed environment)`);
-                // Some environments block listening on localhost; keep MCP server running without HTTP embeddings
-                resolve(null);
-            }
-            else {
-                reject(error);
-            }
-        });
-        server.listen(port, exports.HOST, () => {
-            console.warn(`[EmbeddingHTTP] Running at http://${exports.HOST}:${port}`);
-            // Note: Shutdown token not logged for security (use MAMA_DEBUG=true to enable)
-            if (process.env.MAMA_DEBUG === 'true') {
-                console.warn(`[EmbeddingHTTP] Shutdown token: ${exports.SHUTDOWN_TOKEN}`);
-            }
-            writePortFile(port);
-            // Track connections for graceful shutdown
-            server.on('connection', (socket) => {
-                connections.add(socket);
-                socket.on('close', () => connections.delete(socket));
-            });
-            // Initialize WebSocket server (unless disabled)
-            const skipWebSocket = process.env.MAMA_DISABLE_WEBSOCKET === 'true' ||
-                process.env.MAMA_DISABLE_MOBILE_CHAT === 'true';
-            if (!skipWebSocket) {
-                try {
-                    if (messageRouter && sessionStore) {
-                        _wssInstance = (0, websocket_handler_js_1.createWebSocketHandler)({
-                            httpServer: server,
-                            messageRouter: messageRouter,
-                            sessionStore: sessionStore,
-                            authToken: process.env.MAMA_AUTH_TOKEN,
-                        });
-                        console.error(`[EmbeddingHTTP] WebSocket server initialized (MessageRouter mode) at ws://${exports.HOST}:${port}/ws`);
-                    }
-                    else {
-                        // Legacy mode without MessageRouter - skip for now
-                        console.error(`[EmbeddingHTTP] WebSocket server skipped (no MessageRouter provided)`);
-                    }
-                }
-                catch (wsError) {
-                    const errMsg = wsError instanceof Error ? wsError.message : String(wsError);
-                    console.error(`[EmbeddingHTTP] WebSocket initialization failed: ${errMsg}`);
-                }
-            }
-            // Track server instance for shutdown
-            _serverInstance = server;
-            resolve(server);
-        });
-    });
-}
-/**
- * Pre-warm the embedding model
- */
-async function warmModel() {
-    console.error('[EmbeddingHTTP] Pre-warming embedding model...');
-    const startTime = Date.now();
-    try {
-        await (0, embeddings_js_1.generateEmbedding)('MAMA warmup initialization');
-        modelLoaded = true;
-        const latency = Date.now() - startTime;
-        console.error(`[EmbeddingHTTP] Model warmed in ${latency}ms`);
-        return { success: true, latency };
-    }
-    catch (error) {
-        const errMsg = error instanceof Error ? error.message : String(error);
-        console.error(`[EmbeddingHTTP] Model warmup failed: ${errMsg}`);
-        return { success: false, error: errMsg };
-    }
-}
-// Cleanup on exit
-process.on('exit', cleanupPortFile);
-process.on('SIGTERM', cleanupPortFile);
-process.on('SIGINT', cleanupPortFile);
-//# sourceMappingURL=index.js.map

package/dist/embedding-server/mobile/auth.d.ts

@@ -1,44 +0,0 @@
-/**
- * @fileoverview Authentication module - token-based auth for external access
- * @module mobile/auth
- * @version 1.5.0
- *
- * Provides authentication for requests from outside localhost.
- * Uses MAMA_AUTH_TOKEN environment variable for simple token auth.
- *
- * @example
- * import { authenticate, isLocalhost } from './auth';
- * if (!authenticate(req)) {
- *   res.writeHead(401);
- *   res.end('Unauthorized');
- * }
- */
-import type { IncomingMessage } from 'http';
-interface WebSocketLike {
-    close(code?: number, reason?: string): void;
-}
-/**
- * Environment variable for auth token
- */
-export declare const AUTH_TOKEN: string | undefined;
-/**
- * Check if request is from localhost
- * @param req - HTTP request
- * @returns True if from localhost
- */
-export declare function isLocalhost(req: IncomingMessage): boolean;
-/**
- * Authenticate an HTTP request
- * @param req - HTTP request
- * @returns True if authenticated
- */
-export declare function authenticate(req: IncomingMessage): boolean;
-/**
- * Authenticate a WebSocket upgrade request
- * @param req - HTTP upgrade request
- * @param ws - WebSocket connection
- * @returns True if authenticated, closes ws if not
- */
-export declare function authenticateWebSocket(req: IncomingMessage, ws: WebSocketLike): boolean;
-export {};
-//# sourceMappingURL=auth.d.ts.map

package/dist/embedding-server/mobile/auth.js

@@ -1,150 +0,0 @@
-"use strict";
-/**
- * @fileoverview Authentication module - token-based auth for external access
- * @module mobile/auth
- * @version 1.5.0
- *
- * Provides authentication for requests from outside localhost.
- * Uses MAMA_AUTH_TOKEN environment variable for simple token auth.
- *
- * @example
- * import { authenticate, isLocalhost } from './auth';
- * if (!authenticate(req)) {
- *   res.writeHead(401);
- *   res.end('Unauthorized');
- * }
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AUTH_TOKEN = void 0;
-exports.isLocalhost = isLocalhost;
-exports.authenticate = authenticate;
-exports.authenticateWebSocket = authenticateWebSocket;
-const node_crypto_1 = require("node:crypto");
-/**
- * Environment variable for auth token
- */
-exports.AUTH_TOKEN = process.env.MAMA_AUTH_TOKEN;
-/**
- * Track if we've warned about missing auth token
- */
-let hasWarnedAboutToken = false;
-/**
- * Track if we've warned about query parameter token usage
- */
-let hasWarnedAboutQueryToken = false;
-/**
- * HMAC key for timing-safe token comparison
- */
-const hmacKey = (0, node_crypto_1.randomBytes)(32);
-/**
- * Timing-safe string comparison using HMAC to prevent timing attacks.
- * Both strings are hashed with HMAC-SHA256 before comparison,
- * ensuring constant-time evaluation regardless of input.
- */
-function safeTokenEqual(a, b) {
-    const hmacA = (0, node_crypto_1.createHmac)('sha256', hmacKey).update(a).digest();
-    const hmacB = (0, node_crypto_1.createHmac)('sha256', hmacKey).update(b).digest();
-    return (0, node_crypto_1.timingSafeEqual)(hmacA, hmacB);
-}
-/**
- * Check if request is from localhost
- * @param req - HTTP request
- * @returns True if from localhost
- */
-function isLocalhost(req) {
-    const socket = req.socket;
-    const connection = req.connection;
-    const remoteAddress = socket?.remoteAddress || connection?.remoteAddress;
-    return (remoteAddress === '127.0.0.1' || remoteAddress === '::1' || remoteAddress === '::ffff:127.0.0.1');
-}
-/**
- * Authenticate an HTTP request
- * @param req - HTTP request
- * @returns True if authenticated
- */
-function authenticate(req) {
-    // Localhost always allowed
-    if (isLocalhost(req)) {
-        return true;
-    }
-    const remoteAddress = req.socket?.remoteAddress;
-    // External access detected - show security warning
-    if (!hasWarnedAboutToken) {
-        console.error('');
-        console.error('⚠️  ========================================');
-        console.error('⚠️  SECURITY WARNING: External access detected!');
-        console.error('⚠️  ========================================');
-        console.error('⚠️  ');
-        console.error('⚠️  Your MAMA server is being accessed from outside localhost.');
-        console.error('⚠️  This likely means you are using a tunnel (ngrok, Cloudflare, etc.)');
-        console.error('⚠️  ');
-        if (!exports.AUTH_TOKEN) {
-            console.error('⚠️  ❌ CRITICAL: MAMA_AUTH_TOKEN is NOT set!');
-            console.error('⚠️  Anyone with your tunnel URL can access your:');
-            console.error('⚠️    - Chat sessions with Claude Code');
-            console.error('⚠️    - Decision database (~/.claude/mama-memory.db)');
-            console.error('⚠️    - Local file system (via Claude Code)');
-            console.error('⚠️  ');
-            console.error('⚠️  To secure your server, set MAMA_AUTH_TOKEN:');
-            console.error('⚠️    export MAMA_AUTH_TOKEN="your-secret-token"');
-            console.error('⚠️  ');
-        }
-        else {
-            console.error('⚠️  ✅ MAMA_AUTH_TOKEN is set (authentication enabled)');
-            console.error('⚠️  External clients must provide token in:');
-            console.error('⚠️    - Authorization: Bearer <token> header, OR');
-            console.error('⚠️    - ?token=<token> query parameter');
-            console.error('⚠️  ');
-        }
-        console.error('⚠️  To disable external access entirely:');
-        console.error('⚠️    export MAMA_DISABLE_HTTP_SERVER=true');
-        console.error('⚠️    export MAMA_DISABLE_MOBILE_CHAT=true');
-        console.error('⚠️  ');
-        console.error('⚠️  ========================================');
-        console.error('');
-        hasWarnedAboutToken = true;
-    }
-    // External access requires token
-    if (!exports.AUTH_TOKEN) {
-        console.error(`[Auth] External access denied from ${remoteAddress} (no MAMA_AUTH_TOKEN)`);
-        return false;
-    }
-    // Check Authorization header
-    const authHeader = req.headers['authorization'];
-    if (authHeader?.startsWith('Bearer ')) {
-        const token = authHeader.slice(7);
-        if (safeTokenEqual(token, exports.AUTH_TOKEN)) {
-            console.error(`[Auth] External access granted via Bearer token from ${remoteAddress}`);
-            return true;
-        }
-    }
-    // Check URL query parameter
-    const url = new URL(req.url || '/', `http://${req.headers.host || 'localhost'}`);
-    const queryToken = url.searchParams.get('token');
-    if (queryToken && safeTokenEqual(queryToken, exports.AUTH_TOKEN)) {
-        if (!hasWarnedAboutQueryToken) {
-            console.warn('[Auth] DEPRECATION WARNING: Authentication via query parameter (?token=...) is deprecated. ' +
-                'Token in URL may leak through server logs, browser history, and Referer headers. ' +
-                'Please use the Authorization header instead: "Authorization: Bearer <token>"');
-            hasWarnedAboutQueryToken = true;
-        }
-        console.error(`[Auth] External access granted via query token from ${remoteAddress}`);
-        return true;
-    }
-    console.error(`[Auth] External access denied from ${remoteAddress} (invalid token)`);
-    return false;
-}
-/**
- * Authenticate a WebSocket upgrade request
- * @param req - HTTP upgrade request
- * @param ws - WebSocket connection
- * @returns True if authenticated, closes ws if not
- */
-function authenticateWebSocket(req, ws) {
-    if (!authenticate(req)) {
-        ws.close(4001, 'Authentication required');
-        return false;
-    }
-    return true;
-}
-//# sourceMappingURL=auth.js.map