@mingxy/cerebro 1.19.3 → 1.20.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mingxy/cerebro",
-  "version": "1.19.3",
+  "version": "1.20.0",
   "description": "Cerebro persistent memory plugin for OpenCode — auto-recall, auto-capture, 9 memory tools with clustering, project-scoped memory isolation",
   "type": "module",
   "main": "src/index.ts",

package/src/config.ts

@@ -39,6 +39,7 @@ export interface CerebroPluginConfig {
   };
   agentMemoryPolicy?: Record<string, "none" | "readonly" | "readwrite">;
   defaultPolicy?: "none" | "readonly" | "readwrite";
+  autoUpdate?: boolean;  // default false
 }
 
 // ── Defaults ─────────────────────────────────────────────────────────
@@ -75,6 +76,7 @@ const DEFAULTS: CerebroPluginConfig = {
   web: {
     enabled: true,
   },
+  autoUpdate: false,
 };
 
 // ── Flat-to-nested migration ─────────────────────────────────────────
@@ -146,6 +148,7 @@ function deepMerge(base: CerebroPluginConfig, overrides: Partial<CerebroPluginCo
   result.web = { ...base.web!, ...overrides.web };
   if (overrides.agentMemoryPolicy) result.agentMemoryPolicy = overrides.agentMemoryPolicy;
   if (overrides.defaultPolicy) result.defaultPolicy = overrides.defaultPolicy;
+  if (overrides.autoUpdate !== undefined) result.autoUpdate = overrides.autoUpdate;
   return result;
 }
 

package/src/hooks.ts

@@ -226,6 +226,8 @@ interface InjectionResult {
   profileCount: number;
   memoryCount: number;
   projectMemoryCount: number;
+  maxScore: number;
+  confidence: number;
 }
 
 export async function buildMemoryInjection(
@@ -297,11 +299,16 @@ export async function buildMemoryInjection(
     text = text.slice(0, cutoff > 0 ? cutoff : maxChars) + "\n…\n[/CEREBRO-MEMORY]";
   }
 
+  const maxScore = searchResults.reduce((max, r) => Math.max(max, r.score), 0);
+  const confidence = Math.min(maxScore, 1.0);
+
   return {
     text,
     profileCount: profile?.preference_count ?? 0,
     memoryCount: dedupedResults?.length ?? 0,
     projectMemoryCount: projectMemories.length,
+    maxScore,
+    confidence,
   };
 }
 
@@ -371,8 +378,8 @@ export function chatMessageRecallHook(
           session_id: input.sessionID,
           recall_type: "auto",
           query_text: query,
-          max_score: 0,
-          llm_confidence: 0,
+          max_score: injection.maxScore,
+          llm_confidence: injection.confidence,
           profile_injected: injection.profileCount > 0,
           kept_count: injection.projectMemoryCount + injection.memoryCount,
           discarded_count: 0,

package/src/index.ts

@@ -3,7 +3,6 @@ import { readFileSync, writeFileSync } from "node:fs";
 import { join, dirname } from "node:path";
 import { tmpdir } from "node:os";
 import { fileURLToPath } from "node:url";
-import type { Server } from "node:http";
 import { CerebroClient } from "./client.js";
 import { chatMessageRecallHook, autocontinueHook, compactingHook, sessionIdleHook, createToast, sessionMessages, firstMessages } from "./hooks.js";
 import { detectSaveKeyword, detectRecallKeyword, KEYWORD_NUDGE, RECALL_NUDGE } from "./keywords.js";
@@ -11,7 +10,8 @@ import { getUserTag, getProjectTag } from "./tags.js";
 import { buildTools } from "./tools.js";
 import { logInfo, logDebug, logError } from "./logger.js";
 import { loadPluginConfig, resolveAgentPolicy } from "./config.js";
-import { startWebServer, stopWebServer } from "./web-server.js";
+import { checkAndUpdate } from "./updater.js";
+import { startWebServer, stopWebServer, type WebServerHandle } from "./web-server.js";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -103,7 +103,7 @@ const OmemPlugin: Plugin = async (input) => {
 
   const chatMessageRecall = chatMessageRecallHook(cerebroClient, containerTags, tui, config, () => cachedAgentName || agentId, directory);
 
-  let webServer: Server | null = null;
+  let webServer: WebServerHandle | null = null;
   const webEnabled = config.web?.enabled !== false;
   let webPort: number | undefined;
   if (webEnabled) {
@@ -125,9 +125,12 @@ const OmemPlugin: Plugin = async (input) => {
   if (webPort) {
     toast(tui, `🧠 Cerebro Connected · v${pluginVersion}`, `🌐 Open in browser http://localhost:${webPort}`, "success");
   } else {
-    toast(tui, "🧠 Connected", `v${pluginVersion}`, "success");
+    toast(tui, `🧠 Cerebro Connected · v${pluginVersion}`, "No web server", "success");
   }
 
+  // Auto-update check (fire-and-forget, non-blocking)
+  checkAndUpdate(tui, pluginVersion).catch(() => {});
+
   const shutdown = async () => {
     try {
       if (webServer) {

package/src/logger.ts

@@ -1,66 +1,160 @@
-import { appendFileSync, mkdirSync, existsSync } from "node:fs";
-import { join } from "node:path";
-import { loadPluginConfig } from "./config.js";
-
-const LEVEL_MAP: Record<string, number> = {
-  DEBUG: 0,
-  INFO: 1,
-  WARN: 2,
-  ERROR: 3,
-};
-
-const cfg = loadPluginConfig();
-const MIN_LEVEL = LEVEL_MAP[cfg.logging.logLevel] ?? LEVEL_MAP.INFO;
-const LOG_DIR = cfg.logging.logDir;
-const LOG_FILE = join(LOG_DIR, "plugin.log");
-const LOG_ENABLED = cfg.logging.logEnabled;
-
-let lastLogTime = Date.now();
-
-function ensureLogDir(): void {
-  if (!existsSync(LOG_DIR)) {
-    try {
-      mkdirSync(LOG_DIR, { recursive: true });
-    } catch {}
-  }
-}
-
-function writeLog(level: string, message: string, fields?: Record<string, unknown>): void {
-  if (!LOG_ENABLED) return;
-  const lvl = LEVEL_MAP[level] ?? 0;
-  if (lvl < MIN_LEVEL) return;
-  ensureLogDir();
-  const now = new Date();
-  const nowMs = now.getTime();
-  const delta = ((nowMs - lastLogTime) / 1000).toFixed(2);
-  lastLogTime = nowMs;
-  const pad = (n: number) => String(n).padStart(2, "0");
-  const ts = `${now.getFullYear()}-${pad(now.getMonth() + 1)}-${pad(now.getDate())} ${pad(now.getHours())}:${pad(now.getMinutes())}:${pad(now.getSeconds())}`;
-  const parts = [`${level.padEnd(5)} ${ts} +${delta}s service=cerebro`];
-  if (fields) {
-    for (const [k, v] of Object.entries(fields)) {
-      const val = typeof v === "string" ? v : JSON.stringify(v);
-      parts.push(`${k}=${val}`);
-    }
-  }
-  parts.push(message);
-  try {
-    appendFileSync(LOG_FILE, parts.join(" ") + "\n");
-  } catch {}
-}
-
-export function logInfo(message: string, fields?: Record<string, unknown>): void {
-  writeLog("INFO", message, fields);
-}
-
-export function logWarn(message: string, fields?: Record<string, unknown>): void {
-  writeLog("WARN", message, fields);
-}
-
-export function logError(message: string, fields?: Record<string, unknown>): void {
-  writeLog("ERROR", message, fields);
-}
-
-export function logDebug(message: string, fields?: Record<string, unknown>): void {
-  writeLog("DEBUG", message, fields);
-}
+import {
+  appendFileSync,
+  mkdirSync,
+  existsSync,
+  statSync,
+  renameSync,
+  readdirSync,
+  unlinkSync,
+} from "node:fs";
+import { join } from "node:path";
+import { loadPluginConfig } from "./config.js";
+
+// ── Level map ─────────────────────────────────────────────────────────
+
+const LEVEL_MAP: Record<string, number> = {
+  DEBUG: 0,
+  INFO: 1,
+  WARN: 2,
+  ERROR: 3,
+};
+
+// ── Config access with 30-second TTL cache ────────────────────────────
+
+let cachedConfig: ReturnType<typeof loadPluginConfig> | null = null;
+let configCacheTime = 0;
+const CONFIG_TTL_MS = 30_000;
+
+function getConfig() {
+  const now = Date.now();
+  if (cachedConfig && (now - configCacheTime) < CONFIG_TTL_MS) return cachedConfig;
+  cachedConfig = loadPluginConfig();
+  configCacheTime = now;
+  return cachedConfig;
+}
+
+function getLogFilePath(): string {
+  return join(getConfig().logging.logDir, "plugin.log");
+}
+
+function getMinLevel(): number {
+  return LEVEL_MAP[getConfig().logging.logLevel] ?? LEVEL_MAP.INFO;
+}
+
+function isLogEnabled(): boolean {
+  return getConfig().logging.logEnabled;
+}
+
+// ── Opencode client for dual-track logging ────────────────────────────
+
+let opencodeClient: any = null;
+
+export function setOpencodeClient(client: any): void {
+  opencodeClient = client;
+}
+
+// ── Log file rotation (5 MB threshold) ────────────────────────────────
+// NOTE: multi-window concurrent rotate is a known limitation — the last
+// writer to rename wins; earlier writers will create a fresh file.
+
+const MAX_LOG_SIZE = 5 * 1024 * 1024; // 5 MB
+
+function rotateIfNeeded(logFile: string): void {
+  try {
+    const s = statSync(logFile);
+    if (s.size > MAX_LOG_SIZE) {
+      renameSync(logFile, logFile.replace(".log", ".old.log"));
+    }
+  } catch { /* file doesn't exist yet, first write */ }
+}
+
+// ── Startup cleanup (delete logs older than 7 days) ───────────────────
+
+const LOG_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000; // 7 days
+
+function cleanupOldLogs(): void {
+  const logDir = getConfig().logging.logDir;
+  try {
+    const files = readdirSync(logDir);
+    const cutoff = Date.now() - LOG_MAX_AGE_MS;
+    for (const f of files) {
+      if (!f.endsWith(".log") && !f.endsWith(".old.log")) continue;
+      const fp = join(logDir, f);
+      try {
+        const s = statSync(fp);
+        if (s.mtimeMs < cutoff) unlinkSync(fp);
+      } catch {}
+    }
+  } catch {}
+}
+
+// Run cleanup once at module load
+cleanupOldLogs();
+
+// ── Core logging ──────────────────────────────────────────────────────
+
+let lastLogTime = Date.now();
+
+function ensureLogDir(logDir: string): void {
+  if (!existsSync(logDir)) {
+    try {
+      mkdirSync(logDir, { recursive: true });
+    } catch {}
+  }
+}
+
+function writeLog(level: string, message: string, fields?: Record<string, unknown>): void {
+  if (!isLogEnabled()) return;
+  const lvl = LEVEL_MAP[level] ?? 0;
+  if (lvl < getMinLevel()) return;
+
+  const cfg = getConfig();
+  const logFile = getLogFilePath();
+  ensureLogDir(cfg.logging.logDir);
+
+  const now = new Date();
+  const nowMs = now.getTime();
+  const delta = ((nowMs - lastLogTime) / 1000).toFixed(2);
+  lastLogTime = nowMs;
+  const pad = (n: number) => String(n).padStart(2, "0");
+  const ts = `${now.getFullYear()}-${pad(now.getMonth() + 1)}-${pad(now.getDate())} ${pad(now.getHours())}:${pad(now.getMinutes())}:${pad(now.getSeconds())}`;
+  const parts = [`${level.padEnd(5)} ${ts} +${delta}s service=cerebro`];
+  if (fields) {
+    for (const [k, v] of Object.entries(fields)) {
+      const val = typeof v === "string" ? v : JSON.stringify(v);
+      parts.push(`${k}=${val}`);
+    }
+  }
+  parts.push(message);
+
+  // Track 1: file
+  try {
+    rotateIfNeeded(logFile);
+    appendFileSync(logFile, parts.join(" ") + "\n");
+  } catch {}
+
+  // Track 2: opencode client
+  try {
+    opencodeClient?.app?.log({
+      body: { service: "cerebro", level: level.toLowerCase(), message, extra: fields },
+    });
+  } catch { /* opencode client not available, skip */ }
+}
+
+// ── Public API ────────────────────────────────────────────────────────
+
+export function logInfo(message: string, fields?: Record<string, unknown>): void {
+  writeLog("INFO", message, fields);
+}
+
+export function logWarn(message: string, fields?: Record<string, unknown>): void {
+  writeLog("WARN", message, fields);
+}
+
+export function logError(message: string, fields?: Record<string, unknown>): void {
+  writeLog("ERROR", message, fields);
+}
+
+export function logDebug(message: string, fields?: Record<string, unknown>): void {
+  writeLog("DEBUG", message, fields);
+}

package/src/updater.ts

@@ -0,0 +1,125 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { createRequire } from "node:module";
+import { join, dirname } from "node:path";
+import { homedir, tmpdir } from "node:os";
+import { openSync, closeSync, unlinkSync, statSync, writeSync, mkdtempSync, readdirSync, rmSync } from "node:fs";
+import { loadPluginConfig } from "./config.js";
+
+const execFileAsync = promisify(execFile);
+const require = createRequire(import.meta.url);
+
+// ── Version fetching ────────────────────────────────────────────────
+
+async function getLatestVersion(): Promise<string | null> {
+  try {
+    const { stdout } = await execFileAsync("npm", ["view", "@mingxy/cerebro", "version"], { timeout: 10000 });
+    return stdout.trim();
+  } catch { return null; }
+}
+
+// ── Semantic version comparison ─────────────────────────────────────
+
+function compareVersions(a: string, b: string): number {
+  const pa = a.replace(/^v/, "").split(".").map(Number);
+  const pb = b.replace(/^v/, "").split(".").map(Number);
+  for (let i = 0; i < 3; i++) {
+    if ((pa[i] ?? 0) > (pb[i] ?? 0)) return 1;
+    if ((pa[i] ?? 0) < (pb[i] ?? 0)) return -1;
+  }
+  return 0;
+}
+
+// ── Install dir detection ───────────────────────────────────────────
+
+function getInstallDir(): string {
+  try {
+    const pkgPath = require.resolve("@mingxy/cerebro/package.json");
+    return dirname(pkgPath);
+  } catch {
+    return join(homedir(), ".cache", "opencode", "packages", "@mingxy", "cerebro");
+  }
+}
+
+// ── Install update via npm pack + tar ───────────────────────────────
+
+async function installUpdate(targetDir: string): Promise<boolean> {
+  const tmpDir = mkdtempSync(join(tmpdir(), "cerebro-update-"));
+  try {
+    // 1. Download tgz
+    await execFileAsync("npm", ["pack", "@mingxy/cerebro@latest", "--pack-destination", tmpDir], { timeout: 60000 });
+
+    // 2. Find the tgz file
+    const files = readdirSync(tmpDir);
+    const tgz = files.find(f => f.endsWith(".tgz"));
+    if (!tgz) return false;
+
+    // 3. Extract to target dir (strip the "package/" prefix from tgz)
+    await execFileAsync("tar", ["-xzf", join(tmpDir, tgz), "-C", targetDir, "--strip-components=1", "--no-same-owner", "--no-same-permissions"], { timeout: 30000 });
+
+    return true;
+  } catch {
+    return false;
+  } finally {
+    try { rmSync(tmpDir, { recursive: true }); } catch {}
+  }
+}
+
+// ── File lock with stale lock cleanup ───────────────────────────────
+
+const LOCK_FILE = join(tmpdir(), "cerebro-update.lock");
+const STALE_LOCK_MS = 5 * 60 * 1000; // 5 minutes
+let lockFd: number | null = null;
+
+function acquireLock(): boolean {
+  try {
+    // Clean up stale lock first
+    try {
+      const s = statSync(LOCK_FILE);
+      if (Date.now() - s.mtimeMs > STALE_LOCK_MS) {
+        unlinkSync(LOCK_FILE);
+      }
+    } catch { /* lock file doesn't exist, normal */ }
+
+    lockFd = openSync(LOCK_FILE, "wx");
+    writeSync(lockFd, String(process.pid));
+    return true;
+  } catch { return false; }
+}
+
+function releaseLock(): void {
+  if (lockFd !== null) {
+    try { closeSync(lockFd); } catch {}
+    lockFd = null;
+    try { unlinkSync(LOCK_FILE); } catch {}
+  }
+}
+
+// ── Main entry ──────────────────────────────────────────────────────
+
+export async function checkAndUpdate(tui: any, currentVersion: string): Promise<void> {
+  const config = loadPluginConfig();
+  if (!config.autoUpdate) return;
+
+  const latest = await getLatestVersion();
+  if (!latest) return;
+
+  if (compareVersions(latest, currentVersion) <= 0) return; // already up to date
+
+  if (!acquireLock()) return; // another process is updating
+
+  try {
+    const targetDir = getInstallDir();
+    const success = await installUpdate(targetDir);
+
+    if (success) {
+      try {
+        tui?.showToast?.({
+          body: { message: `Cerebro updated to v${latest} — restart opencode to apply`, variant: "info" }
+        });
+      } catch {}
+    }
+  } finally {
+    releaseLock();
+  }
+}

package/src/web-server-child.ts

@@ -0,0 +1,245 @@
+/**
+ * web-server-child.ts — Cerebro Web Server Child Process
+ *
+ * 独立 fork 入口。实际 HTTP server 运行在此进程中。
+ * 通过 IPC 从父进程接收配置，启动后通知父进程 ready。
+ * 通过心跳文件 mtime 探测 plugin 进程存活状态。
+ */
+import * as http from "node:http";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as os from "node:os";
+
+// ── Types ────────────────────────────────────────────────────────────────
+
+interface ChildConfig {
+  port: number;
+  webDir: string;
+  apiUrl: string;
+}
+
+// ── MIME map ─────────────────────────────────────────────────────────────
+
+const MIME_TYPES: Record<string, string> = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "application/javascript; charset=utf-8",
+  ".mjs": "application/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".ico": "image/x-icon",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".ttf": "font/ttf",
+  ".eot": "application/vnd.ms-fontobject",
+  ".webp": "image/webp",
+  ".webmanifest": "application/manifest+json",
+  ".map": "application/json",
+  ".txt": "text/plain; charset=utf-8",
+};
+
+function getMimeType(ext: string): string {
+  return MIME_TYPES[ext] || "application/octet-stream";
+}
+
+// ── Safe path resolver (prevent traversal) ───────────────────────────────
+
+function resolveSafe(baseDir: string, pathname: string): string | null {
+  const relative = pathname.startsWith("/") ? pathname.slice(1) : pathname;
+  const resolved = path.resolve(baseDir, relative || ".");
+  if (!resolved.startsWith(baseDir + path.sep) && resolved !== baseDir) {
+    return null;
+  }
+  return resolved;
+}
+
+// ── File serving ─────────────────────────────────────────────────────────
+
+function serveFile(
+  res: http.ServerResponse,
+  filePath: string,
+  apiUrl: string,
+): void {
+  const ext = path.extname(filePath).toLowerCase();
+  const contentType = getMimeType(ext);
+
+  fs.readFile(filePath, (err, data) => {
+    if (err) {
+      res.writeHead(500, { "Content-Type": "text/plain" });
+      res.end("Internal Server Error");
+      return;
+    }
+
+    let body: Buffer | string = data;
+
+    // Config injection: replace placeholder in index.html
+    if (ext === ".html" && data.includes("__OMEM_API_URL__")) {
+      body = data
+        .toString("utf-8")
+        .replace(
+          /window\.__OMEM_API_URL__\s*=\s*["']__OMEM_API_URL__["']/,
+          `window.__OMEM_API_URL__ = "${apiUrl}"`,
+        );
+    }
+
+    res.writeHead(200, {
+      "Content-Type": contentType,
+      "Cache-Control":
+        ext === ".html"
+          ? "no-cache, no-store, must-revalidate"
+          : "public, max-age=86400",
+    });
+    res.end(body);
+  });
+}
+
+// ── Server lifecycle ─────────────────────────────────────────────────────
+
+let server: http.Server | null = null;
+let heartbeatTimer: ReturnType<typeof setInterval> | null = null;
+let pidFilePath = "";
+let heartbeatFilePath = "";
+
+function cleanup(): void {
+  if (heartbeatTimer) {
+    clearInterval(heartbeatTimer);
+    heartbeatTimer = null;
+  }
+  if (server) {
+    server.closeAllConnections?.();
+    const forceTimer = setTimeout(() => {
+      try { fs.unlinkSync(pidFilePath); } catch { /* ignore */ }
+      process.exit(0);
+    }, 3000);
+    server.close(() => {
+      clearTimeout(forceTimer);
+      try { fs.unlinkSync(pidFilePath); } catch { /* ignore */ }
+      process.exit(0);
+    });
+  } else {
+    try { fs.unlinkSync(pidFilePath); } catch { /* ignore */ }
+    process.exit(0);
+  }
+}
+
+function startServer(config: ChildConfig): void {
+  const { port, webDir, apiUrl } = config;
+
+  pidFilePath = path.join(os.tmpdir(), `cerebro-web-${port}.pid`);
+  heartbeatFilePath = path.join(os.tmpdir(), `cerebro-web-${port}.heartbeat`);
+
+  const indexPath = path.join(webDir, "index.html");
+
+  // 写 PID 文件（子进程自己的 PID）
+  try {
+    fs.writeFileSync(pidFilePath, String(process.pid));
+  } catch {
+    console.error("[cerebro:web-child] Failed to write PID file");
+  }
+
+  // 初始 touch 心跳文件
+  try {
+    fs.writeFileSync(heartbeatFilePath, "");
+  } catch {
+    console.error("[cerebro:web-child] Failed to create heartbeat file");
+  }
+
+  server = http.createServer(
+    (req: http.IncomingMessage, res: http.ServerResponse) => {
+      // ── /health 端点 ──
+      if (req.url === "/health" || req.url === "/health/") {
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ status: "ok", service: "cerebro", port }));
+        return;
+      }
+
+      // Only handle GET / HEAD
+      if (req.method !== "GET" && req.method !== "HEAD") {
+        res.writeHead(405, { "Content-Type": "text/plain" });
+        res.end("Method Not Allowed");
+        return;
+      }
+
+      // Parse URL, strip query string
+      const url = new URL(req.url || "/", `http://localhost:${port}`);
+      // new URL() already decodes percent-encoding; no double-decode
+      const pathname = url.pathname;
+
+      // Resolve safe file path
+      const safePath = resolveSafe(webDir, pathname);
+
+      if (!safePath) {
+        res.writeHead(403, { "Content-Type": "text/plain" });
+        res.end("Forbidden");
+        return;
+      }
+
+      // Try to serve the file directly
+      fs.stat(safePath, (statErr, stats) => {
+        if (!statErr && stats.isFile()) {
+          serveFile(res, safePath, apiUrl);
+          return;
+        }
+
+        // SPA fallback: serve index.html for non-file paths
+        fs.stat(indexPath, (idxErr, idxStats) => {
+          if (idxErr || !idxStats.isFile()) {
+            res.writeHead(404, { "Content-Type": "text/plain" });
+            res.end("Not Found");
+            return;
+          }
+          serveFile(res, indexPath, apiUrl);
+        });
+      });
+    },
+  );
+
+  server.on("error", (err: NodeJS.ErrnoException) => {
+    console.error(`[cerebro:web-child] Server error: ${err.message}`);
+    process.send?.({ type: "error", message: err.message });
+    cleanup();
+  });
+
+  server.listen(port, "127.0.0.1", () => {
+    console.log(
+      `[cerebro:web-child] Server listening on http://localhost:${port}`,
+    );
+    process.send?.({ type: "ready", port });
+  });
+
+  // ── 心跳检测：每 30 秒检查心跳文件 mtime ──
+  heartbeatTimer = setInterval(() => {
+    try {
+      const stat = fs.statSync(heartbeatFilePath);
+      if (Date.now() - stat.mtimeMs > 60_000) {
+        console.log(
+          "[cerebro:web-child] Heartbeat expired, shutting down",
+        );
+        cleanup();
+      }
+    } catch {
+      // 心跳文件不存在，可能被清理，继续等待不主动退出
+    }
+  }, 30_000);
+
+  // 确保定时器不阻止进程退出
+  if (heartbeatTimer) heartbeatTimer.unref();
+
+  // ── 信号处理 ──
+  process.on("SIGTERM", cleanup);
+  process.on("SIGINT", cleanup);
+}
+
+// ── IPC 监听（只处理第一条消息） ─────────────────────────────────────────
+
+let started = false;
+
+process.on("message", (config: ChildConfig) => {
+  if (started) return;
+  started = true;
+  startServer(config);
+});

package/src/web-server.ts

@@ -1,6 +1,14 @@
-import * as http from "node:http";
+/**
+ * web-server.ts — Cerebro Web Server Manager (spawn mode)
+ *
+ * 不再直接创建 HTTP server，而是 fork 独立子进程 (web-server-child.ts)。
+ * 多窗口共享一个 server，任一窗口关闭不影响其他窗口。
+ * 子进程通过心跳文件 mtime 探测 plugin 存活状态，全部退出后自动关闭。
+ */
+import { fork } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
+import * as os from "node:os";
 import { fileURLToPath } from "node:url";
 
 const __filename = fileURLToPath(import.meta.url);
@@ -13,170 +21,185 @@ export interface WebServerConfig {
   port?: number;
 }
 
-// ── MIME map ─────────────────────────────────────────────────────────────
-
-const MIME_TYPES: Record<string, string> = {
-  ".html": "text/html; charset=utf-8",
-  ".js": "application/javascript; charset=utf-8",
-  ".mjs": "application/javascript; charset=utf-8",
-  ".css": "text/css; charset=utf-8",
-  ".json": "application/json; charset=utf-8",
-  ".svg": "image/svg+xml",
-  ".png": "image/png",
-  ".jpg": "image/jpeg",
-  ".jpeg": "image/jpeg",
-  ".gif": "image/gif",
-  ".ico": "image/x-icon",
-  ".woff": "font/woff",
-  ".woff2": "font/woff2",
-  ".ttf": "font/ttf",
-  ".eot": "application/vnd.ms-fontobject",
-  ".webp": "image/webp",
-  ".webmanifest": "application/manifest+json",
-  ".map": "application/json",
-  ".txt": "text/plain; charset=utf-8",
-};
-
-function getMimeType(ext: string): string {
-  return MIME_TYPES[ext] || "application/octet-stream";
+export interface WebServerHandle {
+  address(): { port: number; family: string; address: string } | string | null;
 }
 
-// ── Safe path resolver (prevent traversal) ───────────────────────────────
+// ── Helpers ──────────────────────────────────────────────────────────────
 
-function resolveSafe(baseDir: string, pathname: string): string | null {
-  // Strip leading slash so path.resolve treats it as relative
-  const relative = pathname.startsWith("/") ? pathname.slice(1) : pathname;
-  const resolved = path.resolve(baseDir, relative || ".");
-  if (!resolved.startsWith(baseDir + path.sep) && resolved !== baseDir) {
-    return null;
+/** Touch a file — update mtime or create if missing */
+function touchFile(filePath: string): void {
+  try {
+    fs.utimesSync(filePath, new Date(), new Date());
+  } catch {
+    try {
+      fs.writeFileSync(filePath, "");
+    } catch { /* ignore */ }
   }
-  return resolved;
 }
 
-// ── Start / Stop ─────────────────────────────────────────────────────────
-
-export function startWebServer(config: WebServerConfig): Promise<http.Server | null> {
-  return new Promise((resolve) => {
-    const webDir = path.resolve(__dirname, "..", "web");
+/** Check if a process with the given PID is still running */
+function isProcessAlive(pid: number): boolean {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
 
-    // Check web directory exists
-    if (!fs.existsSync(webDir)) {
-      console.warn(`[cerebro:web] Web directory not found: ${webDir}, skipping server start`);
-      resolve(null);
-      return;
+/** Probe an existing server's /health endpoint */
+async function probeExistingServer(port: number): Promise<boolean> {
+  try {
+    const resp = await fetch(`http://127.0.0.1:${port}/health`);
+    if (resp.ok) {
+      const body = await resp.text();
+      return body.includes("cerebro");
     }
+  } catch { /* connection refused → port free */ }
+  return false;
+}
+
+// ── Start / Stop ─────────────────────────────────────────────────────────
+
+export async function startWebServer(
+  config: WebServerConfig,
+): Promise<WebServerHandle | null> {
+  const port =
+    config.port || parseInt(process.env.OMEM_LOCAL_PORT || "", 10) || 5212;
+  const pidFilePath = path.join(os.tmpdir(), `cerebro-web-${port}.pid`);
+  const heartbeatFilePath = path.join(
+    os.tmpdir(),
+    `cerebro-web-${port}.heartbeat`,
+  );
+
+  // ── Step 1: 检查端口是否已有 cerebro server ──
+  if (await probeExistingServer(port)) {
+    console.log(`[cerebro:web] Reusing existing server on port ${port}`);
+    return createHandle(port, heartbeatFilePath);
+  }
 
-    const indexPath = path.join(webDir, "index.html");
-    if (!fs.existsSync(indexPath)) {
-      console.warn(`[cerebro:web] index.html not found in ${webDir}, skipping server start`);
-      resolve(null);
-      return;
+  // ── Step 2: 检查 PID 文件（可能有其他进程正在 fork） ──
+  try {
+    const pidStr = fs.readFileSync(pidFilePath, "utf-8").trim();
+    const pid = parseInt(pidStr, 10);
+    if (pid > 0 && isProcessAlive(pid)) {
+      // 有其他进程正在 fork 或运行，等待 200ms 后重试
+      await new Promise((r) => setTimeout(r, 200));
+      if (await probeExistingServer(port)) {
+        console.log(
+          `[cerebro:web] Reusing server after PID check on port ${port}`,
+        );
+        return createHandle(port, heartbeatFilePath);
+      }
+    } else {
+      // 进程已死亡，清理 PID 文件
+      try { fs.unlinkSync(pidFilePath); } catch { /* ignore */ }
     }
+  } catch { /* PID 文件不存在，继续 */ }
 
-    const port = config.port || parseInt(process.env.OMEM_LOCAL_PORT || "", 10) || 5212;
-
-    const server = http.createServer(
-      (req: http.IncomingMessage, res: http.ServerResponse) => {
-        // Only handle GET / HEAD
-        if (req.method !== "GET" && req.method !== "HEAD") {
-          res.writeHead(405, { "Content-Type": "text/plain" });
-          res.end("Method Not Allowed");
-          return;
-        }
-
-        // Parse URL, strip query string
-        const url = new URL(req.url || "/", `http://localhost:${port}`);
-        const pathname = decodeURIComponent(url.pathname);
-
-        // Resolve safe file path
-        const safePath = resolveSafe(webDir, pathname);
-
-        if (!safePath) {
-          res.writeHead(403, { "Content-Type": "text/plain" });
-          res.end("Forbidden");
-          return;
-        }
-
-        // Try to serve the file directly
-        fs.stat(safePath, (statErr, stats) => {
-          if (!statErr && stats.isFile()) {
-            serveFile(res, safePath, config.apiUrl);
-            return;
-          }
-
-          // SPA fallback: serve index.html for non-file paths
-          fs.stat(indexPath, (idxErr, idxStats) => {
-            if (idxErr || !idxStats.isFile()) {
-              res.writeHead(404, { "Content-Type": "text/plain" });
-              res.end("Not Found");
-              return;
-            }
-            serveFile(res, indexPath, config.apiUrl);
-          });
-        });
-      },
+  // ── Step 3: 检查 web 目录 ──
+  const webDir = path.resolve(__dirname, "..", "web");
+  if (!fs.existsSync(webDir)) {
+    console.warn(
+      `[cerebro:web] Web directory not found: ${webDir}, skipping server start`,
     );
+    return null;
+  }
+  if (!fs.existsSync(path.join(webDir, "index.html"))) {
+    console.warn(
+      `[cerebro:web] index.html not found in ${webDir}, skipping server start`,
+    );
+    return null;
+  }
 
-    server.on("error", (err: NodeJS.ErrnoException) => {
-      if (err.code === "EADDRINUSE") {
-        console.warn(`[cerebro:web] Port ${port} already in use, web server not started`);
-      } else {
-        console.warn(`[cerebro:web] Server error: ${err.message}`);
-      }
-      resolve(null);
-    });
+  // ── Step 4: 写 PID 文件（标记正在 fork） ──
+  try {
+    fs.writeFileSync(pidFilePath, String(process.pid));
+  } catch { /* ignore */ }
 
-    server.listen(port, "127.0.0.1", () => {
-      const addr = server.address();
-      const actualPort = typeof addr === "object" && addr ? addr.port : port;
-      console.log(`[cerebro:web] Static server listening on http://localhost:${actualPort}`);
-      resolve(server);
-    });
+  // ── Step 5: Fork 子进程 ──
+  const childPath = path.resolve(__dirname, "web-server-child.js");
+
+  const child = fork(childPath, [], {
+    detached: true,
+    stdio: ["pipe", "pipe", "pipe", "ipc"],
   });
-}
 
-// ── File serving ─────────────────────────────────────────────────────────
-
-function serveFile(
-  res: http.ServerResponse,
-  filePath: string,
-  apiUrl: string,
-): void {
-  const ext = path.extname(filePath).toLowerCase();
-  const contentType = getMimeType(ext);
-
-  fs.readFile(filePath, (err, data) => {
-    if (err) {
-      res.writeHead(500, { "Content-Type": "text/plain" });
-      res.end("Internal Server Error");
-      return;
-    }
+  // Drain stdout/stderr to prevent pipe buffer from blocking the child
+  child.stdout?.on("data", () => {});
+  child.stderr?.on("data", () => {});
 
-    let body: Buffer | string = data;
+  child.unref();
 
-    // Config injection: replace placeholder in index.html
-    if (ext === ".html" && data.includes("__OMEM_API_URL__")) {
-      body = data.toString("utf-8").replace(/window\.__OMEM_API_URL__\s*=\s*["']__OMEM_API_URL__["']/, `window.__OMEM_API_URL__ = "${apiUrl}"`);
-    }
+  // 发送配置给子进程
+  child.send({ port, webDir, apiUrl: config.apiUrl });
+
+  // ── Step 6: 等待 ready 或超时 5s ──
+  const ready = await new Promise<boolean>((resolve) => {
+    const timeout = setTimeout(() => resolve(false), 5000);
 
-    res.writeHead(200, {
-      "Content-Type": contentType,
-      "Cache-Control": ext === ".html" ? "no-cache, no-store, must-revalidate" : "public, max-age=86400",
+    child.on("message", (msg: { type: string }) => {
+      if (msg.type === "ready") {
+        clearTimeout(timeout);
+        resolve(true);
+      } else if (msg.type === "error") {
+        clearTimeout(timeout);
+        resolve(false);
+      }
     });
-    res.end(body);
-  });
-}
 
-// ── Graceful shutdown ────────────────────────────────────────────────────
+    child.on("error", () => {
+      clearTimeout(timeout);
+      resolve(false);
+    });
 
-export function stopWebServer(server: http.Server): Promise<void> {
-  return new Promise((resolve) => {
-    server.closeAllConnections?.();
-    const timer = setTimeout(resolve, 3000);
-    server.close(() => {
-      clearTimeout(timer);
-      console.log("[cerebro:web] Server stopped");
-      resolve();
+    child.on("exit", () => {
+      clearTimeout(timeout);
+      resolve(false);
     });
   });
+
+  if (!ready) {
+    console.warn(
+      `[cerebro:web] Failed to start web server child process on port ${port}`,
+    );
+    try { child.kill(); } catch { /* ignore */ }
+    try { fs.unlinkSync(pidFilePath); } catch { /* ignore */ }
+    return null;
+  }
+
+  console.log(
+    `[cerebro:web] Web server child process started on port ${port}`,
+  );
+  return createHandle(port, heartbeatFilePath);
+}
+
+/** Create a handle with address() compat + heartbeat keep-alive */
+function createHandle(
+  port: number,
+  heartbeatFilePath: string,
+): WebServerHandle {
+  // 初始 touch
+  touchFile(heartbeatFilePath);
+
+  // 每 30 秒 touch 心跳文件，保持子进程存活
+  const timer = setInterval(() => {
+    touchFile(heartbeatFilePath);
+  }, 30_000);
+
+  // 确保定时器不阻止进程退出
+  timer.unref();
+
+  return {
+    address() {
+      return { port, family: "IPv4", address: "127.0.0.1" };
+    },
+  };
+}
+
+export function stopWebServer(_handle: WebServerHandle): Promise<void> {
+  // Intentionally do NOT touch heartbeat: parent exits → timer stops →
+  // heartbeat ages out → child detects mtime > 60s → self-terminate.
+  return Promise.resolve();
 }