@schlessera/brain-ui-server 0.34.0 → 0.35.0

package/src/app.ts

@@ -35,7 +35,9 @@ import {
   assertPasskeyConfig,
   type PasskeyContext,
 } from "./middleware/passkeys.js";
+import { principalManagementRoutes } from "./middleware/principals.js";
 import { createUiDb } from "./db/client.js";
+import { isUsablePrincipal, prunePrincipals, resolvePrincipal } from "./db/principals.js";
 import {
   getAutoAllowedTools,
   getBillingOverrides,
@@ -61,6 +63,7 @@ import { createSessionCatalog } from "./ws/session-catalog.js";
 import type { KeytermSettings } from "./voice/keyterm-builder.js";
 import { createObservability, type Observability } from "./observability/index.js";
 import { isSameOriginRequest, originPolicy } from "./middleware/origin.js";
+import type { AppEnv } from "./app-env.js";
 
 export type { AppRenderer };
 
@@ -160,7 +163,7 @@ export function createApp(options: CreateAppOptions = {}): BrainUiApp {
     options.observability ?? createObservability({ minSeverity: config.logLevel });
   const auth: AuthRuntime = { ...config.auth, host: config.host };
 
-  const app = new Hono();
+  const app = new Hono<AppEnv>();
   const authLog = observability.logger("auth");
   const authMode = resolveAuthMode(auth, authLog);
   // Validate inside the factory, not the bin entry: every consumer of the app
@@ -181,6 +184,7 @@ export function createApp(options: CreateAppOptions = {}): BrainUiApp {
   probeBrainCliVersion(config.brainPath, observability.logger("brain"));
   const dbLog = observability.logger("db");
   const db = createUiDb(config.dbPath, { log: dbLog });
+  prunePrincipals(db, Date.now());
   const brain = createBrainClient({ brainPath: config.brainPath });
   const cron = createCronScheduler({ db, brain, log: observability.logger("cron") });
 
@@ -225,6 +229,10 @@ export function createApp(options: CreateAppOptions = {}): BrainUiApp {
     maxConcurrentSessions: () => config.maxConcurrentSessions,
     wsRate: config.wsRate,
     wsMaxConnections: config.wsMaxConnections,
+    isPrincipalValid: (principal) => {
+      const current = resolvePrincipal(db, principal.id);
+      return current !== null && isUsablePrincipal(current, Date.now());
+    },
     toolPermissions: {
       isAutoAllowed: (toolName) => getAutoAllowedTools(db, dbLog).includes(toolName),
       add: (toolName) =>
@@ -233,6 +241,7 @@ export function createApp(options: CreateAppOptions = {}): BrainUiApp {
     activity: {
       store: activity.store,
       stream: activity.stream,
+      pushSender: activity.pushSender,
       query: activity.query,
     },
   });
@@ -244,7 +253,7 @@ export function createApp(options: CreateAppOptions = {}): BrainUiApp {
   });
   const passkeyCtx: PasskeyContext = {
     db,
-    clients: host.clients,
+    revoker: host,
     webauthn: config.webauthn,
     auth,
     allowedOrigins: config.allowedOrigins,
@@ -268,6 +277,7 @@ export function createApp(options: CreateAppOptions = {}): BrainUiApp {
     if (c.req.path === "/api/health") return next();
     const startedAt = Date.now();
     await next();
+    const principal = c.get("principal");
     httpLog.emit({
       severityText: "INFO",
       body: "request",
@@ -276,6 +286,12 @@ export function createApp(options: CreateAppOptions = {}): BrainUiApp {
         path: c.req.path,
         status: c.res.status,
         "duration.ms": Date.now() - startedAt,
+        ...(principal
+          ? {
+              "auth.principal.id": principal.id,
+              "auth.principal.label": principal.label,
+            }
+          : {}),
       },
     });
   });
@@ -335,7 +351,7 @@ export function createApp(options: CreateAppOptions = {}): BrainUiApp {
     "/api",
     authRoutes(authMode, auth, {
       db,
-      clients: host.clients,
+      revoker: host,
       passwordDisabled: (c) => passwordLoginDisabled(c, passkeyCtx),
       log: authLog,
       failures: authFailures,
@@ -351,6 +367,16 @@ export function createApp(options: CreateAppOptions = {}): BrainUiApp {
   // Passkey registration/management: after the guard, so a session is required
   // by mount position (the public assertion routes are registered above).
   app.route("/api", passkeyManagementRoutes(authMode, passkeyCtx));
+  // Principal management: also after the guard. Its router adds the narrower
+  // owner-only check after authentication has resolved the caller principal.
+  app.route(
+    "/api",
+    principalManagementRoutes(authMode, auth, {
+      db,
+      revoker: host,
+      log: authLog,
+    })
+  );
   app.route(
     "/api",
     createStatusRoutes({
@@ -414,9 +440,11 @@ export function createApp(options: CreateAppOptions = {}): BrainUiApp {
     if (!isSameOriginRequest(c, allowedOrigins, auth.trustProxy)) {
       return c.json({ error: "Cross-origin WebSocket rejected" }, 403);
     }
-    if (!(await isWsAuthorized(c, authMode, auth, db))) {
+    const principal = await isWsAuthorized(c, authMode, auth, db);
+    if (!principal) {
       return c.json({ error: "Authentication required" }, 401);
     }
+    c.set("principal", principal);
     if (!host.clients.hasCapacity()) {
       host.reportRefusedConnection();
       return c.text("WebSocket connection limit reached", 503);
@@ -462,6 +490,7 @@ export function createApp(options: CreateAppOptions = {}): BrainUiApp {
     isTurnActive: () => host.coordinator.isTurnActive(),
     cancelActiveTurns: () => host.coordinator.cancelAll("Server shutting down"),
     close: () => {
+      host.close();
       activity.close();
       db.close();
     },

package/src/brain/client.ts

@@ -8,6 +8,7 @@ import type {
   BrainDocument,
   BrainStats,
   BrainSyncResult,
+  BrainAddResult,
 } from "./types.js";
 
 /**
@@ -20,7 +21,7 @@ export interface BrainClient {
   cliCommand(): string[];
   search(
     query: string,
-    opts?: { type?: string; tag?: string; limit?: number; mode?: string }
+    opts?: { type?: string; tag?: string; limit?: number; mode?: string; signal?: AbortSignal }
   ): Promise<BrainSearchResponse>;
   briefing(): Promise<string>;
   stats(): Promise<BrainStats>;
@@ -36,7 +37,7 @@ export interface BrainClient {
   add(
     content: string,
     opts?: { type?: string; title?: string; tags?: string[] }
-  ): Promise<void>;
+  ): Promise<BrainAddResult>;
   index(opts?: { force?: boolean }): Promise<void>;
   validate(): Promise<string>;
   /** Run `brain skills sync` — re-materialize every agent's skill links. */
@@ -157,25 +158,46 @@ export function probeBrainCliVersion(brainPath: string, log: Logger): void {
   }
 }
 
-export function createBrainClient(opts: { brainPath: string }): BrainClient {
+/** Interactive search must finish or fail within a bounded time. */
+const SEARCH_TIMEOUT_MS = 15_000;
+
+export function createBrainClient(opts: { brainPath: string; searchTimeoutMs?: number }): BrainClient {
   const { brainPath } = opts;
+  const searchTimeoutMs = opts.searchTimeoutMs ?? SEARCH_TIMEOUT_MS;
+  if (!Number.isFinite(searchTimeoutMs) || searchTimeoutMs <= 0) {
+    throw new Error("searchTimeoutMs must be a positive finite number");
+  }
 
-  async function execBrain(args: string[]): Promise<ExecResult> {
+  async function execBrain(args: string[], signal?: AbortSignal): Promise<ExecResult> {
+    signal?.throwIfAborted();
     const proc = Bun.spawn([...brainCliCommand(brainPath), ...args], {
       cwd: brainPath,
       stdout: "pipe",
       stderr: "pipe",
       // Force JSON output when not a TTY
       env: subprocessEnv("brainCli", { NO_COLOR: "1" }),
+      // Only read-only search passes a signal. Kill even a CLI that ignores
+      // SIGTERM; abandoning a request must not leave the local process alive.
+      ...(signal ? { signal, killSignal: "SIGKILL" } : {}),
     });
 
-    const [stdout, stderr] = await Promise.all([
-      new Response(proc.stdout).text(),
-      new Response(proc.stderr).text(),
-    ]);
-    const exitCode = await proc.exited;
-
-    return { stdout, stderr, exitCode };
+    try {
+      const [stdout, stderr, exitCode] = await Promise.all([
+        new Response(proc.stdout).text(),
+        new Response(proc.stderr).text(),
+        proc.exited,
+      ]);
+      signal?.throwIfAborted();
+      return { stdout, stderr, exitCode };
+    } catch (error) {
+      // A pipe-read failure also abandons search. Reap before its caller
+      // clears the deadline; otherwise that failure could orphan the child.
+      if (signal) {
+        proc.kill("SIGKILL");
+        await proc.exited;
+      }
+      throw error;
+    }
   }
 
   function parseJsonOutput<T>(result: ExecResult): T {
@@ -197,18 +219,29 @@ export function createBrainClient(opts: { brainPath: string }): BrainClient {
       return brainCliCommand(brainPath);
     },
 
-    async search(query, opts) {
+    async search(query, searchOpts) {
       const args = ["search"];
-      if (opts?.type) args.push("--type", opts.type);
-      if (opts?.tag) args.push("--tag", opts.tag);
-      if (opts?.limit) args.push("--limit", String(opts.limit));
-      if (opts?.mode) args.push("--mode", opts.mode);
+      if (searchOpts?.type) args.push("--type", searchOpts.type);
+      if (searchOpts?.tag) args.push("--tag", searchOpts.tag);
+      if (searchOpts?.limit) args.push("--limit", String(searchOpts.limit));
+      if (searchOpts?.mode) args.push("--mode", searchOpts.mode);
       args.push("--", query);
 
-      const result = await execBrain(args);
-      const parsed = parseJsonOutput<BrainSearchResponse | BrainSearchResult[]>(result);
-      // brain returns {results, warnings} since 22e82e1; tolerate the old bare array
-      return Array.isArray(parsed) ? { results: parsed, warnings: [] } : parsed;
+      const deadline = new AbortController();
+      const timer = setTimeout(() => deadline.abort(
+        new DOMException("Search timed out. Please try again.", "TimeoutError")
+      ), searchTimeoutMs);
+      const signal = searchOpts?.signal
+        ? AbortSignal.any([searchOpts.signal, deadline.signal])
+        : deadline.signal;
+      try {
+        const result = await execBrain(args, signal);
+        const parsed = parseJsonOutput<BrainSearchResponse | BrainSearchResult[]>(result);
+        // brain returns {results, warnings} since 22e82e1; tolerate the old bare array
+        return Array.isArray(parsed) ? { results: parsed, warnings: [] } : parsed;
+      } finally {
+        clearTimeout(timer);
+      }
     },
 
     async briefing() {
@@ -279,6 +312,14 @@ export function createBrainClient(opts: { brainPath: string }): BrainClient {
       if (result.exitCode !== 0) {
         throw new Error(`brain add failed: ${result.stderr}`);
       }
+      const parsed = parseJsonOutput<BrainAddResult>(result);
+      if (!parsed || typeof parsed !== "object" || typeof parsed.path !== "string" ||
+          typeof parsed.indexed !== "boolean" || typeof parsed.title !== "string" ||
+          typeof parsed.type !== "string" || (parsed.indexError !== undefined && typeof parsed.indexError !== "string") ||
+          !["created", "appended"].includes(parsed.action)) {
+        throw new Error("Capture completed but its outcome could not be read. Check your files before adding it again.");
+      }
+      return parsed;
     },
 
     async index(opts) {

package/src/brain/types.ts

@@ -42,3 +42,13 @@ export interface BrainSyncResult {
   conflicts: number;
   message: string;
 }
+
+/** Outcome of saving content, including a recoverable indexing failure. */
+export interface BrainAddResult {
+  action: "created" | "appended";
+  path: string;
+  title: string;
+  type: string;
+  indexed: boolean;
+  indexError?: string;
+}

package/src/cron/run-job.ts

@@ -8,6 +8,7 @@ import { unlinkSync } from "fs";
 import { ingestSpanSink } from "../activity/span-sink.js";
 import { createActivityStore } from "../activity/store.js";
 import { createUiDb } from "../db/client.js";
+import { resolveSystemPrincipal } from "../db/principals.js";
 import { recordCronRun } from "./scheduler.js";
 
 /** Tail of stderr retained for the cron_runs error row. */
@@ -70,7 +71,7 @@ function messageOf(error: unknown): string {
 }
 
 function writeLine(sink: TextSink, text: string): void {
-  sink.write(`${text}\n`);
+  try { sink.write(`${text}\n`); } catch { /* Logging cannot stop the job. */ }
 }
 
 /** Forward a stream verbatim while exposing decoded chunks for tail capture. */
@@ -80,11 +81,17 @@ export async function teeStream(
   onText: (text: string) => void
 ): Promise<void> {
   const decoder = new TextDecoder();
-  for await (const chunk of stream) {
-    const text = decoder.decode(chunk, { stream: true });
-    sink.write(text);
+  let forwarding = true;
+  const forward = async (text: string) => {
     onText(text);
+    if (!forwarding) return;
+    try { await sink.write(text); } catch { forwarding = false; }
+  };
+  for await (const chunk of stream) {
+    await forward(decoder.decode(chunk, { stream: true }));
   }
+  const trailing = decoder.decode();
+  if (trailing) await forward(trailing);
 }
 
 /** Keep the last `cap` characters, never the head. */
@@ -99,10 +106,16 @@ async function startRecord(
   dbPath: string,
   stderr: TextSink
 ): Promise<RunRecorder | null> {
+  let db: ReturnType<typeof createUiDb> | undefined;
   try {
-    const db = createUiDb(dbPath);
+    db = createUiDb(dbPath);
+    const openedDb = db;
     const record = recordCronRun(db, name);
     const store = createActivityStore(db, { writer: `cron:${process.pid}` });
+    const principal = resolveSystemPrincipal(db, {
+      identity: "scheduled-jobs",
+      label: "Scheduled jobs",
+    });
     const runId = `cron-${name}-${Date.now()}`;
     const rootSpanId = `${runId}:root`;
     store.startSpan({
@@ -112,6 +125,7 @@ async function startRecord(
       kind: "cron",
       origin: "cron",
       jobName: name,
+      principalId: principal.id,
     });
 
     let sinkOffset = 0;
@@ -168,10 +182,11 @@ async function startRecord(
       },
       close() {
         clearInterval(heartbeat);
-        db.close();
+        openedDb.close();
       },
     };
   } catch (error) {
+    try { db?.close(); } catch { /* Preserve fail-open tracking. */ }
     writeLine(
       stderr,
       `[cron-run] tracking unavailable (job runs anyway): ${messageOf(error)}`
@@ -191,13 +206,12 @@ export async function runJob(
     dependencies.sinkPath ??
     `/tmp/brain-activity-sink-${process.pid}-${Date.now()}.jsonl`;
   const beginRecord = dependencies.startRecord ?? startRecord;
-  const recorder = await beginRecord(
-    options.jobName,
-    sinkPath,
-    options.command,
-    options.dbPath,
-    stderr
-  );
+  let recorder: RunRecorder | null = null;
+  try {
+    recorder = await beginRecord(options.jobName, sinkPath, options.command, options.dbPath, stderr);
+  } catch (error) {
+    writeLine(stderr, `[cron-run] tracking unavailable (job runs anyway): ${messageOf(error)}`);
+  }
 
   let exitCode: number;
   let errorMessage: string | undefined;
@@ -213,7 +227,7 @@ export async function runJob(
     });
 
     let stderrTail = "";
-    await Promise.all([
+    const outcomes = await Promise.allSettled([
       teeStream(proc.stdout, stdout, (text) => {
         outputTail = appendTail(outputTail, text, OUTPUT_TAIL_CHARS);
       }),
@@ -221,9 +235,16 @@ export async function runJob(
         stderrTail = appendTail(stderrTail, text, STDERR_TAIL_CHARS);
         outputTail = appendTail(outputTail, text, OUTPUT_TAIL_CHARS);
       }),
+      proc.exited,
     ]);
-
-    exitCode = await proc.exited;
+    for (const outcome of outcomes.slice(0, 2)) {
+      if (outcome.status === "rejected") {
+        writeLine(stderr, `[cron-run] output capture failed: ${messageOf(outcome.reason)}`);
+      }
+    }
+    const child = outcomes[2]!;
+    if (child.status === "rejected") throw child.reason;
+    exitCode = child.value;
     if (exitCode !== 0) {
       const cause = proc.signalCode ? `killed by ${proc.signalCode}` : `exit code ${exitCode}`;
       const trimmedTail = stderrTail.trim();
@@ -238,9 +259,12 @@ export async function runJob(
   if (recorder) {
     try {
       recorder.finish(errorMessage, outputTail.trim(), exitCode);
-      recorder.close();
     } catch (error) {
       writeLine(stderr, `[cron-run] failed to record run outcome: ${messageOf(error)}`);
+    } finally {
+      try { recorder.close(); } catch (error) {
+        writeLine(stderr, `[cron-run] failed to close tracking: ${messageOf(error)}`);
+      }
     }
   }