@saluzi/saluzi-edu 0.7.4 → 0.7.6

package/packages/remote-control-server/src/registerRoutes.ts

@@ -16,6 +16,7 @@ import { consumeWebLoginCode } from './services/web-login'
 
 // Routes
 import v1Artifacts from './routes/v1/artifacts'
+import v1Memories from './routes/v1/memories'
 import v1Environments from './routes/v1/environments'
 import v1EnvironmentsWork from './routes/v1/environments.work'
 import v1Sessions from './routes/v1/sessions'
@@ -29,6 +30,7 @@ import webAuthRoutes from './routes/web/auth-routes'
 import webSessions from './routes/web/sessions'
 import webControl from './routes/web/control'
 import webEnvironments from './routes/web/environments'
+import webMemories from './routes/web/memories'
 import webShares from './routes/web/shares'
 import webTeams from './routes/web/teams'
 
@@ -103,6 +105,9 @@ export function registerRoutes(
   // v1 Artifacts — CLI worker upload + public content read
   app.route('/v1', v1Artifacts)
 
+  // v1 Memories — CLI worker injection pack + write-back sync
+  app.route('/v1', v1Memories)
+
   // v1 Session routes
   app.route('/v1/sessions', v1Sessions)
 
@@ -128,6 +133,7 @@ export function registerRoutes(
   app.route('/web', webSessions)
   app.route('/web', webControl)
   app.route('/web', webEnvironments)
+  app.route('/web', webMemories)
 
   // ACP protocol routes — created via factory with upgradeWebSocket
   console.log('[RCS] ACP support enabled')

package/packages/remote-control-server/src/routes/v1/memories.ts

@@ -0,0 +1,132 @@
+import { Hono } from 'hono'
+import type { Context } from 'hono'
+import { validateApiKey } from '../../auth/api-key'
+import { verifyWorkerJwt } from '../../auth/jwt'
+import { extractBearerToken } from '../../auth/middleware'
+import { resolveExistingSessionId } from '../../services/session'
+import {
+  MemoryError,
+  buildMemoryPack,
+  syncMemories,
+  type MemoryWriteBackEntry,
+} from '../../services/memories'
+
+const app = new Hono()
+
+/**
+ * CLI/worker memory endpoints (API key or worker JWT auth — same credential
+ * surface as the v1 artifact upload route).
+ *
+ * - GET  /v1/memories/pack?session_id= — the injection pack for a session:
+ *   { files: { "<rel path>": "<file content>" } }. Empty pack for unknown
+ *   sessions; the bridge treats an empty pack as "no memory override".
+ * - POST /v1/memories/sync — write-back from the bridge: { session_id,
+ *   files: [{rel_path, content}] }. Identity is derived server-side from
+ *   the session's owners; any owner/team fields in the body are ignored
+ *   (anti-forgery). Entries land in the session owner's personal scope.
+ */
+
+function authenticateWorker(c: Context): boolean {
+  const token = extractBearerToken(c)
+  if (!token) return false
+  if (validateApiKey(token)) return true
+  return verifyWorkerJwt(token) !== null
+}
+
+app.get('/memories/pack', async c => {
+  if (!authenticateWorker(c)) {
+    return c.json(
+      { error: { type: 'unauthorized', message: 'Invalid auth token' } },
+      401,
+    )
+  }
+
+  const requested = c.req.query('session_id')
+  if (!requested) {
+    return c.json(
+      { error: { type: 'bad_request', message: 'session_id is required' } },
+      400,
+    )
+  }
+  const sessionId = resolveExistingSessionId(requested)
+  if (!sessionId) {
+    // Unknown session → empty pack; the bridge proceeds without memory
+    // injection rather than failing the spawn.
+    return c.json({ files: {} }, 200)
+  }
+
+  return c.json(buildMemoryPack(sessionId), 200)
+})
+
+app.post('/memories/sync', async c => {
+  if (!authenticateWorker(c)) {
+    return c.json(
+      { error: { type: 'unauthorized', message: 'Invalid auth token' } },
+      401,
+    )
+  }
+
+  let body: Record<string, unknown>
+  try {
+    body = await c.req.json()
+  } catch {
+    return c.json(
+      { error: { type: 'bad_request', message: 'Invalid JSON body' } },
+      400,
+    )
+  }
+
+  const requestedSessionId =
+    typeof body.session_id === 'string' ? body.session_id : ''
+  if (!requestedSessionId) {
+    return c.json(
+      { error: { type: 'bad_request', message: 'session_id is required' } },
+      400,
+    )
+  }
+  const sessionId = resolveExistingSessionId(requestedSessionId)
+  if (!sessionId) {
+    return c.json(
+      { error: { type: 'not_found', message: 'Unknown session' } },
+      404,
+    )
+  }
+
+  const rawFiles = body.files
+  if (!Array.isArray(rawFiles)) {
+    return c.json(
+      { error: { type: 'bad_request', message: 'files must be an array' } },
+      400,
+    )
+  }
+  const entries: MemoryWriteBackEntry[] = []
+  for (const item of rawFiles) {
+    if (
+      item &&
+      typeof item === 'object' &&
+      typeof (item as Record<string, unknown>).rel_path === 'string' &&
+      typeof (item as Record<string, unknown>).content === 'string'
+    ) {
+      entries.push({
+        rel_path: (item as Record<string, unknown>).rel_path as string,
+        content: (item as Record<string, unknown>).content as string,
+      })
+    }
+  }
+  if (entries.length === 0) {
+    return c.json({ created: 0, updated: 0, skipped: 0 }, 200)
+  }
+
+  try {
+    const result = syncMemories(sessionId, entries)
+    return c.json(result, 200)
+  } catch (err) {
+    if (err instanceof MemoryError) {
+      const status = err.code === 'no_owner' ? 409 : 400
+      return c.json({ error: { type: err.code, message: err.message } }, status)
+    }
+    throw err
+  }
+})
+
+export default app

package/packages/remote-control-server/src/routes/web/memories.ts

@@ -0,0 +1,321 @@
+import { Hono } from 'hono'
+import { getDb } from '../../db/sqlite'
+import { sessionAuth } from '../../auth/middleware'
+import { SYSTEM_USER_ID } from '../../auth/constants'
+import { isSessionVisibleToUser } from '../../services/session'
+import {
+  MemoryError,
+  MEMORY_TYPES,
+  archiveMemory,
+  canManageMemory,
+  createMemory,
+  getMemoryRow,
+  isMemoryVisibleToUser,
+  listMemoriesForUser,
+  promoteMemoryToTeam,
+  updateMemory,
+  type MemoryType,
+} from '../../services/memories'
+
+const app = new Hono()
+
+/**
+ * Web-UI memory routes (mounted under /web with CSRF protection).
+ *
+ * - GET    /web/memories             — memories visible to the caller
+ *                                      (?team_id= / ?scope=personal /
+ *                                       ?session_id= / ?type=)
+ * - POST   /web/memories             — create (personal for self, or team)
+ * - GET    /web/memories/:id         — metadata + content + can_manage
+ * - PATCH  /web/memories/:id         — edit (manage permission)
+ * - DELETE /web/memories/:id         — soft delete (manage permission)
+ * - POST   /web/memories/:id/promote — personal → team (owner-initiated)
+ */
+
+function isTeamMember(
+  userId: string,
+  teamId: string,
+  db: ReturnType<typeof getDb>,
+): boolean {
+  const row = db
+    .query(
+      'SELECT 1 FROM team_members WHERE team_id = $teamId AND user_id = $userId',
+    )
+    .get({ $teamId: teamId, $userId: userId })
+  return !!row
+}
+
+function forbidden(
+  c: { json: (body: unknown, status: number) => Response },
+  message: string,
+) {
+  return c.json({ error: { type: 'forbidden', message } }, 403)
+}
+
+app.get('/memories', sessionAuth, async c => {
+  const userId = c.get('userId') as string
+  const isAdmin = (c.get('isAdmin') as boolean) || userId === SYSTEM_USER_ID
+  const db = getDb()
+
+  const teamId = c.req.query('team_id')
+  const personalScope = c.req.query('scope') === 'personal'
+  const sessionId = c.req.query('session_id')
+  const type = c.req.query('type') as MemoryType | undefined
+
+  if (personalScope && teamId) {
+    return c.json(
+      {
+        error: {
+          type: 'bad_request',
+          message: 'scope=personal cannot be combined with team_id',
+        },
+      },
+      400,
+    )
+  }
+  if (teamId && !isAdmin && !isTeamMember(userId, teamId, db)) {
+    return forbidden(c, 'Not a member of this team')
+  }
+  if (sessionId && !isAdmin && !isSessionVisibleToUser(sessionId, userId, db)) {
+    return forbidden(c, 'Not authorized for this session')
+  }
+  if (type && !MEMORY_TYPES.includes(type)) {
+    return c.json(
+      { error: { type: 'bad_request', message: 'invalid type filter' } },
+      400,
+    )
+  }
+
+  const rows = listMemoriesForUser(
+    userId,
+    { teamId, personalScope, sessionId, type },
+    isAdmin,
+  )
+  return c.json(
+    rows.map(row => ({
+      ...row,
+      can_manage: canManageMemory(row.id, userId, isAdmin),
+    })),
+    200,
+  )
+})
+
+app.get('/memories/:id', sessionAuth, async c => {
+  const userId = c.get('userId') as string
+  const isAdmin = (c.get('isAdmin') as boolean) || userId === SYSTEM_USER_ID
+  const id = c.req.param('id')!
+
+  const row = getMemoryRow(id)
+  if (!row) {
+    return c.json(
+      { error: { type: 'not_found', message: 'Memory not found' } },
+      404,
+    )
+  }
+  // Single-fetch returns 404 (not 403) on no access — same existence-hiding
+  // convention as the caller-scoped artifact routes.
+  if (!isMemoryVisibleToUser(id, userId, isAdmin)) {
+    return c.json(
+      { error: { type: 'not_found', message: 'Memory not found' } },
+      404,
+    )
+  }
+  return c.json(
+    { ...row, can_manage: canManageMemory(id, userId, isAdmin) },
+    200,
+  )
+})
+
+app.post('/memories', sessionAuth, async c => {
+  const userId = c.get('userId') as string
+  const isAdmin = (c.get('isAdmin') as boolean) || userId === SYSTEM_USER_ID
+  const db = getDb()
+
+  let body: Record<string, unknown>
+  try {
+    body = await c.req.json()
+  } catch {
+    return c.json(
+      { error: { type: 'bad_request', message: 'Invalid JSON' } },
+      400,
+    )
+  }
+
+  const name = typeof body.name === 'string' ? body.name.trim() : ''
+  const content = typeof body.content === 'string' ? body.content : ''
+  const type = typeof body.type === 'string' ? body.type : ''
+  const description =
+    typeof body.description === 'string' && body.description.trim()
+      ? body.description.trim()
+      : undefined
+  if (!name || !content.trim()) {
+    return c.json(
+      {
+        error: {
+          type: 'bad_request',
+          message: 'name and content are required',
+        },
+      },
+      400,
+    )
+  }
+  if (!MEMORY_TYPES.includes(type as MemoryType)) {
+    return c.json(
+      {
+        error: {
+          type: 'bad_request',
+          message: `type must be one of ${MEMORY_TYPES.join(', ')}`,
+        },
+      },
+      400,
+    )
+  }
+
+  // Scope: team_id → team memory (membership required); otherwise personal.
+  const teamId =
+    typeof body.team_id === 'string' && body.team_id ? body.team_id : undefined
+  if (teamId && !isAdmin && !isTeamMember(userId, teamId, db)) {
+    return forbidden(c, 'Not a member of this team')
+  }
+
+  // Optional session provenance — caller must see the session.
+  const sourceSessionId =
+    typeof body.source_session_id === 'string' && body.source_session_id
+      ? body.source_session_id
+      : undefined
+  if (sourceSessionId && !isSessionVisibleToUser(sourceSessionId, userId, db)) {
+    return forbidden(c, 'Not authorized for this session')
+  }
+
+  try {
+    const row = createMemory({
+      scopeKind: teamId ? 'team' : 'personal',
+      ownerUserId: teamId ? undefined : userId,
+      teamId,
+      name,
+      description,
+      type: type as MemoryType,
+      content,
+      sourceSessionId,
+      createdBy: userId,
+    })
+    const { content: _c, ...meta } = row
+    return c.json({ ...meta, can_manage: true }, 201)
+  } catch (err) {
+    if (err instanceof MemoryError) {
+      return c.json({ error: { type: err.code, message: err.message } }, 400)
+    }
+    throw err
+  }
+})
+
+app.patch('/memories/:id', sessionAuth, async c => {
+  const userId = c.get('userId') as string
+  const isAdmin = (c.get('isAdmin') as boolean) || userId === SYSTEM_USER_ID
+  const id = c.req.param('id')!
+
+  if (!getMemoryRow(id)) {
+    return c.json(
+      { error: { type: 'not_found', message: 'Memory not found' } },
+      404,
+    )
+  }
+  if (!canManageMemory(id, userId, isAdmin)) {
+    return forbidden(c, 'Not authorized to edit this memory')
+  }
+
+  let body: Record<string, unknown>
+  try {
+    body = await c.req.json()
+  } catch {
+    return c.json(
+      { error: { type: 'bad_request', message: 'Invalid JSON' } },
+      400,
+    )
+  }
+
+  const params: {
+    name?: string
+    description?: string
+    content?: string
+    type?: MemoryType
+  } = {}
+  if (typeof body.name === 'string') params.name = body.name
+  if (typeof body.description === 'string')
+    params.description = body.description
+  if (typeof body.content === 'string') params.content = body.content
+  if (typeof body.type === 'string') params.type = body.type as MemoryType
+
+  try {
+    const updated = updateMemory(id, params)
+    if (!updated) {
+      return c.json(
+        { error: { type: 'not_found', message: 'Memory not found' } },
+        404,
+      )
+    }
+    const { content: _c, ...meta } = updated
+    return c.json({ ...meta, can_manage: true }, 200)
+  } catch (err) {
+    if (err instanceof MemoryError) {
+      return c.json({ error: { type: err.code, message: err.message } }, 400)
+    }
+    throw err
+  }
+})
+
+app.delete('/memories/:id', sessionAuth, async c => {
+  const userId = c.get('userId') as string
+  const isAdmin = (c.get('isAdmin') as boolean) || userId === SYSTEM_USER_ID
+  const id = c.req.param('id')!
+
+  if (!getMemoryRow(id)) {
+    return c.json(
+      { error: { type: 'not_found', message: 'Memory not found' } },
+      404,
+    )
+  }
+  if (!canManageMemory(id, userId, isAdmin)) {
+    return forbidden(c, 'Not authorized to delete this memory')
+  }
+
+  archiveMemory(id)
+  return c.json({ ok: true }, 200)
+})
+
+app.post('/memories/:id/promote', sessionAuth, async c => {
+  const userId = c.get('userId') as string
+  const id = c.req.param('id')!
+
+  let body: Record<string, unknown>
+  try {
+    body = await c.req.json()
+  } catch {
+    return c.json(
+      { error: { type: 'bad_request', message: 'Invalid JSON' } },
+      400,
+    )
+  }
+  const teamId = typeof body.team_id === 'string' ? body.team_id : ''
+  if (!teamId) {
+    return c.json(
+      { error: { type: 'bad_request', message: 'team_id is required' } },
+      400,
+    )
+  }
+
+  try {
+    const row = promoteMemoryToTeam(id, userId, teamId)
+    const { content: _c, ...meta } = row
+    return c.json({ ...meta, can_manage: true }, 200)
+  } catch (err) {
+    if (err instanceof MemoryError) {
+      const status =
+        err.code === 'not_found' ? 404 : err.code === 'forbidden' ? 403 : 400
+      return c.json({ error: { type: err.code, message: err.message } }, status)
+    }
+    throw err
+  }
+})
+
+export default app