@memtensor/memos-local-openclaw-plugin 0.1.0

package/src/viewer/server.ts

@@ -0,0 +1,464 @@
+import http from "node:http";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import type { SqliteStore } from "../storage/sqlite";
+import type { Embedder } from "../embedding";
+import { vectorSearch } from "../storage/vector";
+import type { Logger } from "../types";
+import { viewerHTML } from "./html";
+
+export interface ViewerServerOptions {
+  store: SqliteStore;
+  embedder: Embedder;
+  port: number;
+  log: Logger;
+  dataDir: string;
+}
+
+interface AuthState {
+  passwordHash: string | null;
+  sessions: Map<string, number>;
+}
+
+export class ViewerServer {
+  private server: http.Server | null = null;
+  private readonly store: SqliteStore;
+  private readonly embedder: Embedder;
+  private readonly port: number;
+  private readonly log: Logger;
+  private readonly authFile: string;
+  private readonly auth: AuthState;
+
+  private static readonly SESSION_TTL = 24 * 60 * 60 * 1000;
+  private resetToken: string;
+
+  constructor(opts: ViewerServerOptions) {
+    this.store = opts.store;
+    this.embedder = opts.embedder;
+    this.port = opts.port;
+    this.log = opts.log;
+    this.authFile = path.join(opts.dataDir, "viewer-auth.json");
+    this.auth = { passwordHash: null, sessions: new Map() };
+    this.resetToken = crypto.randomBytes(16).toString("hex");
+    this.loadAuth();
+  }
+
+  start(): Promise<string> {
+    return new Promise((resolve, reject) => {
+      this.server = http.createServer((req, res) => this.handleRequest(req, res));
+      this.server.on("error", (err: NodeJS.ErrnoException) => {
+        if (err.code === "EADDRINUSE") {
+          this.log.warn(`Viewer port ${this.port} in use, trying ${this.port + 1}`);
+          this.server!.listen(this.port + 1, "127.0.0.1");
+        } else {
+          reject(err);
+        }
+      });
+      this.server.listen(this.port, "127.0.0.1", () => {
+        const addr = this.server!.address();
+        const actualPort = typeof addr === "object" && addr ? addr.port : this.port;
+        resolve(`http://127.0.0.1:${actualPort}`);
+      });
+    });
+  }
+
+  stop(): void {
+    this.server?.close();
+    this.server = null;
+  }
+
+  getResetToken(): string {
+    return this.resetToken;
+  }
+
+  // ─── Auth helpers ───
+
+  private loadAuth(): void {
+    try {
+      if (fs.existsSync(this.authFile)) {
+        const data = JSON.parse(fs.readFileSync(this.authFile, "utf-8"));
+        this.auth.passwordHash = data.passwordHash ?? null;
+      }
+    } catch {
+      this.log.warn("Failed to load viewer auth file, starting fresh");
+    }
+  }
+
+  private saveAuth(): void {
+    try {
+      fs.mkdirSync(path.dirname(this.authFile), { recursive: true });
+      fs.writeFileSync(this.authFile, JSON.stringify({ passwordHash: this.auth.passwordHash }));
+    } catch (e) {
+      this.log.warn(`Failed to save viewer auth: ${e}`);
+    }
+  }
+
+  private hashPassword(pw: string): string {
+    return crypto.createHash("sha256").update(pw + "memos-local-salt-2026").digest("hex");
+  }
+
+  private createSession(): string {
+    const token = crypto.randomBytes(32).toString("hex");
+    this.auth.sessions.set(token, Date.now() + ViewerServer.SESSION_TTL);
+    return token;
+  }
+
+  private isValidSession(req: http.IncomingMessage): boolean {
+    const cookie = req.headers.cookie ?? "";
+    const match = cookie.match(/memos_token=([a-f0-9]+)/);
+    if (!match) return false;
+    const expiry = this.auth.sessions.get(match[1]);
+    if (!expiry) return false;
+    if (Date.now() > expiry) { this.auth.sessions.delete(match[1]); return false; }
+    return true;
+  }
+
+  private get needsSetup(): boolean {
+    return this.auth.passwordHash === null;
+  }
+
+  // ─── Request routing ───
+
+  private handleRequest(req: http.IncomingMessage, res: http.ServerResponse): void {
+    const url = new URL(req.url ?? "/", `http://${req.headers.host}`);
+    const p = url.pathname;
+
+    res.setHeader("Access-Control-Allow-Origin", "*");
+    res.setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
+    res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+
+    if (req.method === "OPTIONS") { res.writeHead(204); res.end(); return; }
+
+    try {
+      if (p === "/api/auth/status") {
+        return this.jsonResponse(res, { needsSetup: this.needsSetup, loggedIn: this.isValidSession(req) });
+      }
+      if (p === "/api/auth/setup" && req.method === "POST") {
+        return this.handleSetup(req, res);
+      }
+      if (p === "/api/auth/login" && req.method === "POST") {
+        return this.handleLogin(req, res);
+      }
+      if (p === "/api/auth/reset" && req.method === "POST") {
+        return this.handlePasswordReset(req, res);
+      }
+      if (p === "/" || p === "/viewer") {
+        return this.serveViewer(res);
+      }
+
+      if (!this.isValidSession(req)) {
+        res.writeHead(401, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "unauthorized" }));
+        return;
+      }
+
+      if (p === "/api/memories" && req.method === "GET") this.serveMemories(res, url);
+      else if (p === "/api/stats") this.serveStats(res);
+      else if (p === "/api/search") this.serveSearch(req, res, url);
+      else if (p === "/api/memory" && req.method === "POST") this.handleCreate(req, res);
+      else if (p.startsWith("/api/memory/") && req.method === "PUT") this.handleUpdate(req, res, p);
+      else if (p.startsWith("/api/memory/") && req.method === "DELETE") this.handleDelete(res, p);
+      else if (p === "/api/session" && req.method === "DELETE") this.handleDeleteSession(res, url);
+      else if (p === "/api/memories" && req.method === "DELETE") this.handleDeleteAll(res);
+      else if (p === "/api/auth/logout" && req.method === "POST") this.handleLogout(req, res);
+      else {
+        res.writeHead(404, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "not found" }));
+      }
+    } catch (err) {
+      this.log.error(`Viewer request error: ${err}`);
+      res.writeHead(500, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: String(err) }));
+    }
+  }
+
+  // ─── Auth endpoints ───
+
+  private handleSetup(req: http.IncomingMessage, res: http.ServerResponse): void {
+    if (!this.needsSetup) {
+      res.writeHead(400, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "Password already set" }));
+      return;
+    }
+    this.readBody(req, (body) => {
+      try {
+        const { password } = JSON.parse(body);
+        if (!password || password.length < 4) {
+          res.writeHead(400, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Password must be at least 4 characters" }));
+          return;
+        }
+        this.auth.passwordHash = this.hashPassword(password);
+        this.saveAuth();
+        const token = this.createSession();
+        res.writeHead(200, {
+          "Content-Type": "application/json",
+          "Set-Cookie": `memos_token=${token}; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400`,
+        });
+        res.end(JSON.stringify({ ok: true, message: "Password set successfully" }));
+      } catch (err) {
+        res.writeHead(400, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: String(err) }));
+      }
+    });
+  }
+
+  private handleLogin(req: http.IncomingMessage, res: http.ServerResponse): void {
+    this.readBody(req, (body) => {
+      try {
+        const { password } = JSON.parse(body);
+        if (this.needsSetup || this.hashPassword(password) !== this.auth.passwordHash) {
+          res.writeHead(401, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Invalid password" }));
+          return;
+        }
+        const token = this.createSession();
+        res.writeHead(200, {
+          "Content-Type": "application/json",
+          "Set-Cookie": `memos_token=${token}; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400`,
+        });
+        res.end(JSON.stringify({ ok: true }));
+      } catch (err) {
+        res.writeHead(401, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: String(err) }));
+      }
+    });
+  }
+
+  private handleLogout(req: http.IncomingMessage, res: http.ServerResponse): void {
+    const cookie = req.headers.cookie ?? "";
+    const match = cookie.match(/memos_token=([a-f0-9]+)/);
+    if (match) this.auth.sessions.delete(match[1]);
+    res.writeHead(200, {
+      "Content-Type": "application/json",
+      "Set-Cookie": "memos_token=; Path=/; HttpOnly; Max-Age=0",
+    });
+    res.end(JSON.stringify({ ok: true }));
+  }
+
+  private handlePasswordReset(req: http.IncomingMessage, res: http.ServerResponse): void {
+    this.readBody(req, (body) => {
+      try {
+        const { token, newPassword } = JSON.parse(body);
+        if (token !== this.resetToken) {
+          res.writeHead(403, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Invalid reset token" }));
+          return;
+        }
+        if (!newPassword || newPassword.length < 4) {
+          res.writeHead(400, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ error: "Password must be at least 4 characters" }));
+          return;
+        }
+        this.auth.passwordHash = this.hashPassword(newPassword);
+        this.auth.sessions.clear();
+        this.saveAuth();
+        this.resetToken = crypto.randomBytes(16).toString("hex");
+        this.log.info(`memos-local: password has been reset. New reset token: ${this.resetToken}`);
+        const sessionToken = this.createSession();
+        res.writeHead(200, {
+          "Content-Type": "application/json",
+          "Set-Cookie": `memos_token=${sessionToken}; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400`,
+        });
+        res.end(JSON.stringify({ ok: true, message: "Password reset successfully" }));
+      } catch (err) {
+        res.writeHead(400, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: String(err) }));
+      }
+    });
+  }
+
+  // ─── Pages ───
+
+  private serveViewer(res: http.ServerResponse): void {
+    res.writeHead(200, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-cache" });
+    res.end(viewerHTML);
+  }
+
+  // ─── Data APIs ───
+
+  private serveMemories(res: http.ServerResponse, url: URL): void {
+    const limit = Math.min(Number(url.searchParams.get("limit")) || 30, 200);
+    const page = Math.max(1, Number(url.searchParams.get("page")) || 1);
+    const offset = (page - 1) * limit;
+    const session = url.searchParams.get("session") ?? undefined;
+    const role = url.searchParams.get("role") ?? undefined;
+    const kind = url.searchParams.get("kind") ?? undefined;
+    const dateFrom = url.searchParams.get("dateFrom") ?? undefined;
+    const dateTo = url.searchParams.get("dateTo") ?? undefined;
+    const sortBy = url.searchParams.get("sort") === "oldest" ? "ASC" : "DESC";
+
+    const db = (this.store as any).db;
+    const conditions: string[] = [];
+    const params: any[] = [];
+    if (session) { conditions.push("session_key = ?"); params.push(session); }
+    if (role) { conditions.push("role = ?"); params.push(role); }
+    if (kind) { conditions.push("kind = ?"); params.push(kind); }
+    if (dateFrom) { conditions.push("created_at >= ?"); params.push(new Date(dateFrom).getTime()); }
+    if (dateTo) { conditions.push("created_at <= ?"); params.push(new Date(dateTo).getTime()); }
+
+    const where = conditions.length > 0 ? " WHERE " + conditions.join(" AND ") : "";
+    const totalRow = db.prepare("SELECT COUNT(*) as count FROM chunks" + where).get(...params) as any;
+    const memories = db.prepare("SELECT * FROM chunks" + where + ` ORDER BY created_at ${sortBy} LIMIT ? OFFSET ?`).all(...params, limit, offset);
+
+    this.jsonResponse(res, {
+      memories, page, limit, total: totalRow.count,
+      totalPages: Math.ceil(totalRow.count / limit),
+    });
+  }
+
+  private serveStats(res: http.ServerResponse): void {
+    const db = (this.store as any).db;
+    const total = db.prepare("SELECT COUNT(*) as count FROM chunks").get() as any;
+    const sessions = db.prepare("SELECT COUNT(DISTINCT session_key) as count FROM chunks").get() as any;
+    const roles = db.prepare("SELECT role, COUNT(*) as count FROM chunks GROUP BY role").all() as any[];
+    const timeRange = db.prepare("SELECT MIN(created_at) as earliest, MAX(created_at) as latest FROM chunks").get() as any;
+    const embeddings = db.prepare("SELECT COUNT(*) as count FROM embeddings").get() as any;
+    const kinds = db.prepare("SELECT kind, COUNT(*) as count FROM chunks GROUP BY kind").all() as any[];
+    const sessionList = db.prepare(
+      "SELECT session_key, COUNT(*) as count, MIN(created_at) as earliest, MAX(created_at) as latest FROM chunks GROUP BY session_key ORDER BY latest DESC",
+    ).all() as any[];
+
+    this.jsonResponse(res, {
+      totalMemories: total.count, totalSessions: sessions.count, totalEmbeddings: embeddings.count,
+      embeddingProvider: this.embedder.provider,
+      roleBreakdown: Object.fromEntries(roles.map((r: any) => [r.role, r.count])),
+      kindBreakdown: Object.fromEntries(kinds.map((k: any) => [k.kind, k.count])),
+      timeRange: { earliest: timeRange.earliest, latest: timeRange.latest },
+      sessions: sessionList,
+    });
+  }
+
+  private async serveSearch(_req: http.IncomingMessage, res: http.ServerResponse, url: URL): Promise<void> {
+    const q = url.searchParams.get("q") ?? "";
+    if (!q.trim()) { this.jsonResponse(res, { results: [], query: q }); return; }
+
+    const role = url.searchParams.get("role") ?? undefined;
+    const kind = url.searchParams.get("kind") ?? undefined;
+    const dateFrom = url.searchParams.get("dateFrom") ?? undefined;
+    const dateTo = url.searchParams.get("dateTo") ?? undefined;
+
+    const passesFilter = (r: any): boolean => {
+      if (role && r.role !== role) return false;
+      if (kind && r.kind !== kind) return false;
+      if (dateFrom && r.created_at < new Date(dateFrom).getTime()) return false;
+      if (dateTo && r.created_at > new Date(dateTo).getTime()) return false;
+      return true;
+    };
+
+    const db = (this.store as any).db;
+    let ftsResults: any[] = [];
+    try {
+      ftsResults = db.prepare(
+        "SELECT c.* FROM chunks_fts f JOIN chunks c ON f.rowid = c.rowid WHERE chunks_fts MATCH ? ORDER BY rank LIMIT 100",
+      ).all(q).filter(passesFilter);
+    } catch {
+      ftsResults = db.prepare(
+        "SELECT * FROM chunks WHERE content LIKE ? OR summary LIKE ? ORDER BY created_at DESC LIMIT 100",
+      ).all(`%${q}%`, `%${q}%`).filter(passesFilter);
+    }
+
+    let vectorResults: any[] = [];
+    try {
+      const queryVec = await this.embedder.embedQuery(q);
+      const hits = vectorSearch(this.store, queryVec, 40);
+      const hitIds = new Set(hits.filter(h => h.score > 0.3).map(h => h.chunkId));
+      if (hitIds.size > 0) {
+        const placeholders = [...hitIds].map(() => "?").join(",");
+        const rows = db.prepare(`SELECT * FROM chunks WHERE id IN (${placeholders})`).all(...hitIds).filter(passesFilter);
+        const scoreMap = new Map(hits.map(h => [h.chunkId, h.score]));
+        rows.forEach((r: any) => { r._vscore = scoreMap.get(r.id) ?? 0; });
+        rows.sort((a: any, b: any) => (b._vscore ?? 0) - (a._vscore ?? 0));
+        vectorResults = rows;
+      }
+    } catch (err) {
+      this.log.warn(`Vector search failed (falling back to FTS only): ${err}`);
+    }
+
+    const seenIds = new Set<string>();
+    const merged: any[] = [];
+    for (const r of vectorResults) {
+      if (!seenIds.has(r.id)) { seenIds.add(r.id); merged.push(r); }
+    }
+    for (const r of ftsResults) {
+      if (!seenIds.has(r.id)) { seenIds.add(r.id); merged.push(r); }
+    }
+
+    this.jsonResponse(res, {
+      results: merged,
+      query: q,
+      vectorCount: vectorResults.length,
+      ftsCount: ftsResults.length,
+      total: merged.length,
+    });
+  }
+
+  // ─── CRUD ───
+
+  private handleCreate(req: http.IncomingMessage, res: http.ServerResponse): void {
+    this.readBody(req, (body) => {
+      try {
+        const data = JSON.parse(body);
+        const { v4: uuidv4 } = require("uuid");
+        const id = uuidv4();
+        const now = Date.now();
+        this.store.insertChunk({
+          id, sessionKey: data.session_key || "manual", turnId: `manual-${now}`, seq: 0,
+          role: data.role || "user", content: data.content || "", kind: data.kind || "paragraph",
+          summary: data.summary || data.content?.slice(0, 100) || "",
+          createdAt: now, updatedAt: now, embedding: null,
+        });
+        this.jsonResponse(res, { ok: true, id, message: "Memory created" });
+      } catch (err) {
+        res.writeHead(400, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: String(err) }));
+      }
+    });
+  }
+
+  private handleUpdate(req: http.IncomingMessage, res: http.ServerResponse, urlPath: string): void {
+    const chunkId = urlPath.replace("/api/memory/", "");
+    this.readBody(req, (body) => {
+      try {
+        const data = JSON.parse(body);
+        const ok = this.store.updateChunk(chunkId, { summary: data.summary, content: data.content, role: data.role, kind: data.kind });
+        if (ok) this.jsonResponse(res, { ok: true, message: "Memory updated" });
+        else { res.writeHead(404, { "Content-Type": "application/json" }); res.end(JSON.stringify({ error: "Not found" })); }
+      } catch (err) {
+        res.writeHead(400, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: String(err) }));
+      }
+    });
+  }
+
+  private handleDelete(res: http.ServerResponse, urlPath: string): void {
+    const chunkId = urlPath.replace("/api/memory/", "");
+    if (this.store.deleteChunk(chunkId)) this.jsonResponse(res, { ok: true });
+    else { res.writeHead(404, { "Content-Type": "application/json" }); res.end(JSON.stringify({ error: "Not found" })); }
+  }
+
+  private handleDeleteSession(res: http.ServerResponse, url: URL): void {
+    const key = url.searchParams.get("key");
+    if (!key) { res.writeHead(400, { "Content-Type": "application/json" }); res.end(JSON.stringify({ error: "Missing key" })); return; }
+    const count = this.store.deleteSession(key);
+    this.jsonResponse(res, { ok: true, deleted: count });
+  }
+
+  private handleDeleteAll(res: http.ServerResponse): void {
+    this.jsonResponse(res, { ok: true, deleted: this.store.deleteAll() });
+  }
+
+  // ─── Helpers ───
+
+  private readBody(req: http.IncomingMessage, cb: (body: string) => void): void {
+    let body = "";
+    req.on("data", (chunk: Buffer) => { body += chunk.toString(); });
+    req.on("end", () => cb(body));
+  }
+
+  private jsonResponse(res: http.ServerResponse, data: unknown): void {
+    res.writeHead(200, { "Content-Type": "application/json; charset=utf-8" });
+    res.end(JSON.stringify(data));
+  }
+}