@lotargo/memory_plugin 1.6.9 → 1.6.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/CHANGELOG.md +7 -0
  2. package/README.md +1 -0
  3. package/mcp-server/admin/auth.js +8 -1
  4. package/mcp-server/cli.js +1 -1
  5. package/mcp-server/index.js +2 -2
  6. package/mcp-server/setup.js +3 -3
  7. package/mcp-server/uninstall.js +1 -1
  8. package/package.json +1 -1
package/CHANGELOG.md CHANGED
@@ -5,6 +5,12 @@ All notable changes to `@lotargo/memory_plugin` are documented in this file.
5
5
  The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
6
6
  and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
7
7
 
8
+ ## [1.6.10] - 2026-09-08
9
+
10
+ ### Fixed
11
+
12
+ - Fixed OAuth callback rejecting every real Turso login: Turso redirects to `/?jwt=<JWT>&username=<USERNAME>` without echoing `state`, so a missing state is now accepted with a warning (the token is still validated against the Turso API); only a present-but-mismatched state is rejected as CSRF.
13
+
8
14
  ## [1.6.9] - 2026-09-08
9
15
 
10
16
  ### Fixed
@@ -294,6 +300,7 @@ a critical retrieval regression introduced after `v1.5.3`.
294
300
  - `BENCHMARKS.md` tables were re-derived from the stored JSON artifacts; the
295
301
  bge-m3 section had carried e5-small numbers shifted by a column.
296
302
 
303
+ [1.6.10]: https://github.com/Lotargo/memory_plugin/releases/tag/v1.6.10
297
304
  [1.6.9]: https://github.com/Lotargo/memory_plugin/releases/tag/v1.6.9
298
305
  [1.6.8]: https://github.com/Lotargo/memory_plugin/releases/tag/v1.6.8
299
306
  [1.6.7]: https://github.com/Lotargo/memory_plugin/releases/tag/v1.6.7
package/README.md CHANGED
@@ -161,6 +161,7 @@ The doctor validates the configured Node runtime, MCP initialization, tool disco
161
161
 
162
162
  ```bash
163
163
  # Authenticate with a Turso account token and enable hybrid sync
164
+ # (--api-token and --token are accepted as aliases for --api-key)
164
165
  npx -y @lotargo/memory_plugin setup --api-key <TURSO_API_TOKEN> --mode hybrid-sync
165
166
 
166
167
  # Or change mode when credentials already exist
package/mcp-server/admin/auth.js CHANGED
@@ -50,12 +50,19 @@ export async function createAuthLoopbackServer(port = 0, expectedState = null) {
50
50
  const receivedState = url.searchParams.get("state");
51
51
 
52
52
  if (token) {
53
- if (expectedState && receivedState !== expectedState) {
53
+ if (expectedState && receivedState && receivedState !== expectedState) {
54
54
  res.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" });
55
55
  res.end("Invalid state parameter");
56
56
  server.close(() => rejectResult(new Error("OAuth callback rejected: state parameter mismatch (possible CSRF attempt).")));
57
57
  return;
58
58
  }
59
+ if (expectedState && !receivedState) {
60
+ // Turso's CLI callback redirects to /?jwt=<JWT>&username=<USERNAME>
61
+ // without echoing our `state` (see tursodatabase/turso-cli#634).
62
+ // Rejecting here would break every real login, so accept the token
63
+ // (it is still validated against the Turso API afterwards) and warn.
64
+ console.warn(" [!] OAuth callback arrived without a state parameter; accepting it (Turso does not echo state).");
65
+ }
59
66
  res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
60
67
  res.end(`
61
68
  <!DOCTYPE html>
package/mcp-server/cli.js CHANGED
@@ -24,7 +24,7 @@ export async function runCli() {
24
24
 
25
25
  Usage:
26
26
  memory-cli Launch the interactive TUI
27
- memory-cli login [--from-env|--api-token|--db-url <URL>]
27
+ memory-cli login [--from-env|--api-token|--api-key|--db-url <URL>]
28
28
  memory-cli logout [--api-key]
29
29
  memory-cli auth-status
30
30
  memory-cli link|unlink|relink|identity [--dir <path>] [--remote <url>]
package/mcp-server/index.js CHANGED
@@ -45,11 +45,11 @@ function printUsage() {
45
45
 
46
46
  Usage:
47
47
  memory_plugin Start the MCP server on stdio (default)
48
- memory_plugin setup [--opencode|--claude|--codex|--gemini|--antigravity] [--mode <MODE>]
48
+ memory_plugin setup [--opencode|--claude|--codex|--gemini|--antigravity] [--api-key <TOKEN>] [--mode <MODE>]
49
49
  memory_plugin setup --uninstall [--purge] [--purge-cache] [--dry-run] [--yes]
50
50
  memory_plugin uninstall [--purge] [--purge-cache] [--dry-run] [--yes] [--opencode|--claude|--codex|--gemini|--antigravity]
51
51
  memory_plugin cli Interactive terminal UI
52
- memory_plugin login [--from-env|--api-token|--db-url <URL>]
52
+ memory_plugin login [--from-env|--api-token|--api-key|--db-url <URL>]
53
53
  memory_plugin logout [--api-key]
54
54
  memory_plugin auth-status
55
55
  memory_plugin link|unlink|relink|identity [--dir <path>] [--remote <url>]
package/mcp-server/setup.js CHANGED
@@ -55,9 +55,9 @@ export async function runSetup() {
55
55
  const doGemini = !hasSpecificFlag || lowerArgs.includes("--gemini");
56
56
  const doCodex = !hasSpecificFlag || lowerArgs.includes("--codex");
57
57
 
58
- // Headless cloud setup: --api-key <TURSO_API_TOKEN> and/or --mode <only-local|only-cloud|hybrid-sync>
58
+ // Headless cloud setup: --api-key (aliases: --api-token, --token) <TURSO_API_TOKEN> and/or --mode <only-local|only-cloud|hybrid-sync>
59
59
  const VALID_MODES = ["only-local", "only-cloud", "hybrid-sync"];
60
- const apiKeyArg = flagValue(args, "--api-key");
60
+ const apiKeyArg = flagValue(args, "--api-key") || flagValue(args, "--api-token") || flagValue(args, "--token");
61
61
  const modeArg = flagValue(args, "--mode");
62
62
  if (modeArg && !VALID_MODES.includes(modeArg)) {
63
63
  console.log(` [WARN] Unknown --mode "${modeArg}". Allowed: ${VALID_MODES.join(", ")}`);
@@ -78,7 +78,7 @@ export async function runSetup() {
78
78
  promptLabel: "Turso API token",
79
79
  interactive: false,
80
80
  });
81
- if (!apiKey) throw new Error("Missing API token. Set TURSO_API_TOKEN or pass --api-key <TOKEN>.");
81
+ if (!apiKey) throw new Error("Missing API token. Set TURSO_API_TOKEN or pass --api-key <TOKEN> (--api-token, --token also work).");
82
82
  const { loginWithApiToken } = await import("./admin/auth.js");
83
83
  const secrets = await loginWithApiToken({ token: apiKey });
84
84
  if (modeArg && VALID_MODES.includes(modeArg)) {
package/mcp-server/uninstall.js CHANGED
@@ -102,7 +102,7 @@ Usage:
102
102
  memory_plugin uninstall [options]
103
103
  memory_plugin setup --uninstall [options]
104
104
  memory-cli uninstall [options]
105
- npx @lotargo/memory_plugin uninstall [options]
105
+ npx -y @lotargo/memory_plugin uninstall [options]
106
106
 
107
107
  Options:
108
108
  --opencode Only remove OpenCode plugin entry
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@lotargo/memory_plugin",
3
- "version": "1.6.9",
3
+ "version": "1.6.10",
4
4
  "description": "Local-first memory, hybrid RAG, and agent personalization for AI coding agents (OpenCode, Claude Code, Codex, Gemini CLI, Antigravity). MCP server + CLI with persistent context, document ingestion, vector + SQLite FTS5 retrieval, sync, setup, and safe uninstall.",
5
5
  "type": "module",
6
6
  "main": "opencode-plugin/main.js",