@schlessera/brain-ui-server 0.4.0

package/src/render/template.ts

@@ -0,0 +1,124 @@
+import { marked } from "marked";
+import type { RenderContentType } from "@schlessera/brain-ui-sdk/protocol";
+
+marked.setOptions({ gfm: true, breaks: false });
+
+const STYLES = `
+  :root {
+    color-scheme: light;
+    --bg: #ffffff;
+    --fg: #1f2937;
+    --muted: #6b7280;
+    --border: #e5e7eb;
+    --surface: #f8fafc;
+    --primary: #2563eb;
+    --code-bg: #f3f4f6;
+  }
+  * { box-sizing: border-box; }
+  html, body { margin: 0; padding: 0; background: var(--bg); }
+  body {
+    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", system-ui, "Helvetica Neue", Arial, sans-serif, "Noto Color Emoji", "Apple Color Emoji", "Segoe UI Emoji";
+    color: var(--fg);
+    font-size: 16px;
+    line-height: 1.6;
+    padding: 28px 32px;
+    word-wrap: break-word;
+  }
+  h1, h2, h3, h4, h5, h6 { font-weight: 600; line-height: 1.25; margin: 1.4em 0 0.6em; color: var(--fg); }
+  h1 { font-size: 1.75em; border-bottom: 1px solid var(--border); padding-bottom: 0.3em; }
+  h2 { font-size: 1.4em; border-bottom: 1px solid var(--border); padding-bottom: 0.25em; }
+  h3 { font-size: 1.2em; }
+  h4 { font-size: 1.05em; }
+  p { margin: 0.7em 0; }
+  a { color: var(--primary); text-decoration: none; }
+  a:hover { text-decoration: underline; }
+  ul, ol { padding-left: 1.6em; margin: 0.6em 0; }
+  li { margin: 0.2em 0; }
+  blockquote {
+    margin: 0.8em 0;
+    padding: 0.4em 1em;
+    border-left: 3px solid var(--border);
+    color: var(--muted);
+    background: var(--surface);
+    border-radius: 0 6px 6px 0;
+  }
+  code {
+    font-family: ui-monospace, "SF Mono", Menlo, Consolas, "Liberation Mono", monospace;
+    font-size: 0.9em;
+    background: var(--code-bg);
+    padding: 0.15em 0.35em;
+    border-radius: 4px;
+  }
+  pre {
+    background: var(--code-bg);
+    border: 1px solid var(--border);
+    border-radius: 8px;
+    padding: 0.8em 1em;
+    overflow-x: auto;
+    font-size: 0.88em;
+    line-height: 1.5;
+  }
+  pre code { background: transparent; padding: 0; border-radius: 0; }
+  hr { border: 0; border-top: 1px solid var(--border); margin: 1.6em 0; }
+  table { border-collapse: collapse; margin: 0.8em 0; width: 100%; }
+  th, td { border: 1px solid var(--border); padding: 0.45em 0.7em; text-align: left; }
+  th { background: var(--surface); font-weight: 600; }
+  img { max-width: 100%; height: auto; }
+  .remote-image {
+    display: inline-block; padding: 2px 8px; border: 1px dashed #b0b0b0;
+    border-radius: 4px; color: #6b6b6b; font-size: 0.9em;
+  }
+  /* Trim trailing whitespace at the bottom so screenshots crop tightly */
+  body > *:last-child { margin-bottom: 0; }
+  body > *:first-child { margin-top: 0; }
+`;
+
+function escapeHtml(s: string): string {
+  return s
+    .replace(/&/g, "&")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&#39;");
+}
+
+/**
+ * The renderer denies the page all network access (see
+ * @schlessera/brain-render-puppeteer), so a remote `<img>` would silently render
+ * as a broken-image box. Replace those with a visible, honest placeholder —
+ * inlined `data:` images still render normally.
+ */
+function placeholderRemoteImages(html: string): string {
+  return html.replace(
+    /<img\b[^>]*\bsrc\s*=\s*["']([^"']+)["'][^>]*>/gi,
+    (tag, src: string) => {
+      if (/^data:/i.test(src)) return tag;
+      const alt = /\balt\s*=\s*["']([^"']*)["']/i.exec(tag)?.[1];
+      const label = alt ? escapeHtml(alt) : "remote image";
+      return `<span class="remote-image">[${label} — not embedded]</span>`;
+    }
+  );
+}
+
+export function buildHtmlDocument(opts: {
+  content: string;
+  contentType: RenderContentType;
+  title?: string;
+}): string {
+  const rendered =
+    opts.contentType === "markdown"
+      ? (marked.parse(opts.content, { async: false }) as string)
+      : opts.content;
+  const inner = placeholderRemoteImages(rendered);
+  const title = opts.title ?? "Shared from Brain";
+  return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width,initial-scale=1" />
+  <title>${escapeHtml(title)}</title>
+  <style>${STYLES}</style>
+</head>
+<body>${inner}</body>
+</html>`;
+}

package/src/routes/brain.ts

@@ -0,0 +1,305 @@
+import { Hono } from "hono";
+import { streamSSE } from "hono/streaming";
+import {
+  brainSearch,
+  brainBriefing,
+  brainStats,
+  brainList,
+  brainAdd,
+  brainCliCommand,
+} from "../brain/client.js";
+import { buildKeyterms, writeCache } from "../voice/keyterm-builder.js";
+import { existsSync } from "fs";
+import { join } from "path";
+
+/**
+ * Locate the brain repo's `whatsup` script, relative to the repo root.
+ *
+ * Unlike the commands in brain/client.ts, whatsup is NOT part of the packaged
+ * @schlessera/brain CLI (it is absent from CORE_COMMAND_NAMES) — it stays a
+ * repo-local script. A brain repo migrated onto the published packages deletes
+ * the vendored `scripts/` tree and keeps whatsup at `private/whatsup.ts`; the
+ * legacy layout has it at `scripts/whatsup.ts`. Try both, newest layout first.
+ *
+ * Returns null when neither exists, so the route can report that plainly
+ * instead of surfacing bun's "module not found" through the SSE stream.
+ */
+function findWhatsupScript(brainPath: string): string | null {
+  for (const rel of ["private/whatsup.ts", "scripts/whatsup.ts"]) {
+    if (existsSync(join(brainPath, rel))) return rel;
+  }
+  return null;
+}
+
+export const brainRoutes = new Hono()
+  .get("/brain/search", async (c) => {
+    const q = c.req.query("q");
+    if (!q) {
+      return c.json({ error: "Query parameter 'q' is required" }, 400);
+    }
+    try {
+      const { results, warnings } = await brainSearch(q, {
+        type: c.req.query("type"),
+        tag: c.req.query("tag"),
+        limit: c.req.query("limit") ? Number(c.req.query("limit")) : undefined,
+        mode: c.req.query("mode"),
+      });
+      return c.json({ results, warnings });
+    } catch (err) {
+      return c.json(
+        { error: err instanceof Error ? err.message : "Search failed" },
+        500
+      );
+    }
+  })
+
+  .get("/brain/briefing", async (c) => {
+    try {
+      const content = await brainBriefing();
+      return c.json({ content });
+    } catch (err) {
+      return c.json(
+        { error: err instanceof Error ? err.message : "Briefing failed" },
+        500
+      );
+    }
+  })
+
+  .post("/brain/whatsup", async (c) => {
+    const BRAIN_PATH =
+      process.env.BRAIN_PATH ||
+      `${process.env.HOME || "/root"}/brain`;
+
+    // Defeat reverse-proxy buffering for SSE
+    c.header("X-Accel-Buffering", "no");
+
+    return streamSSE(c, async (stream) => {
+      const send = (data: {
+        type: string;
+        text?: string;
+        success?: boolean;
+      }) => stream.writeSSE({ data: JSON.stringify(data) });
+
+      // Heartbeat keeps the proxy from idling out the connection while
+      // the upstream LLM call is in flight (~5-15s with no stdout)
+      const heartbeat = setInterval(() => {
+        stream
+          .writeSSE({ event: "ping", data: "" })
+          .catch(() => {});
+      }, 3000);
+
+      try {
+        await send({ type: "start", text: "Running whatsup briefing..." });
+
+        const script = findWhatsupScript(BRAIN_PATH);
+        if (!script) {
+          // Terminate with the frames the client actually handles: it only
+          // reads "progress" and "done", so an "error" type would leave the
+          // panel spinning on an empty body.
+          await send({
+            type: "progress",
+            text: "whatsup script not found in the brain repo (looked for private/whatsup.ts and scripts/whatsup.ts).",
+          });
+          await send({ type: "done", success: false, text: "Not available" });
+          return;
+        }
+
+        // --gemini: the default backend needs ANTHROPIC_API_KEY, which is no
+        // longer set (Claude runs on subscription auth, and the script's
+        // --claude backend uses --bare mode, which can't read the
+        // CLAUDE_CODE_OAUTH_TOKEN either).
+        const proc = Bun.spawn(["bun", script, "--gemini"], {
+          cwd: BRAIN_PATH,
+          stdout: "pipe",
+          stderr: "pipe",
+          env: { ...process.env, NO_COLOR: "1" },
+        });
+
+        const reader = proc.stdout.getReader();
+        const decoder = new TextDecoder();
+        let buffer = "";
+        try {
+          while (true) {
+            const { done, value } = await reader.read();
+            if (done) break;
+            buffer += decoder.decode(value, { stream: true });
+            const lines = buffer.split("\n");
+            buffer = lines.pop() || "";
+            for (const line of lines) {
+              await send({ type: "progress", text: line });
+            }
+          }
+          if (buffer.trim()) {
+            await send({ type: "progress", text: buffer });
+          }
+        } catch {}
+
+        const exitCode = await proc.exited;
+
+        const stderr = await new Response(proc.stderr).text();
+        if (stderr.trim()) {
+          for (const line of stderr.split("\n")) {
+            if (line.trim()) await send({ type: "progress", text: line });
+          }
+        }
+
+        await send({
+          type: "done",
+          success: exitCode === 0,
+          text:
+            exitCode === 0
+              ? "Briefing complete"
+              : `Failed (exit ${exitCode})`,
+        });
+      } finally {
+        clearInterval(heartbeat);
+      }
+    });
+  })
+
+  .get("/brain/stats", async (c) => {
+    try {
+      const stats = await brainStats();
+      return c.json(stats);
+    } catch (err) {
+      return c.json(
+        { error: err instanceof Error ? err.message : "Stats failed" },
+        500
+      );
+    }
+  })
+
+  .get("/brain/list", async (c) => {
+    try {
+      const results = await brainList({
+        type: c.req.query("type"),
+        tag: c.req.query("tag"),
+        status: c.req.query("status"),
+        relevance: c.req.query("relevance"),
+        limit: c.req.query("limit") ? Number(c.req.query("limit")) : undefined,
+      });
+      return c.json({ results });
+    } catch (err) {
+      return c.json(
+        { error: err instanceof Error ? err.message : "List failed" },
+        500
+      );
+    }
+  })
+
+  .post("/brain/sync", async (c) => {
+    // Stream sync output via SSE so the client sees live progress.
+    // brain sync spawns a nested Claude Code process that can take minutes.
+    const BRAIN_PATH =
+      process.env.BRAIN_PATH ||
+      `${process.env.HOME || "/root"}/brain`;
+
+    return streamSSE(c, async (stream) => {
+      const send = (data: {
+        type: string;
+        text?: string;
+        success?: boolean;
+      }) => stream.writeSSE({ data: JSON.stringify(data) });
+
+      await send({ type: "start", text: "Starting brain sync..." });
+
+      // The nested Claude process can be silent for minutes; without traffic
+      // the socket gets cut by idle timeouts (Bun's own, or a proxy's). SSE
+      // comment lines are ignored by EventSource and data-line parsers.
+      const keepalive = setInterval(() => {
+        stream.write(": keepalive\n\n").catch(() => {});
+      }, 15_000);
+
+      // Merge stderr into stdout — brain sync spawns a nested Claude Code
+      // process whose output goes to stderr. The command comes from
+      // brainCliCommand() (packaged bin or legacy vendored script), passed to
+      // bash as positional args rather than interpolated into the script, so a
+      // BRAIN_PATH containing spaces or shell metacharacters stays inert.
+      const [cliBin, ...cliArgs] = brainCliCommand();
+      const proc = Bun.spawn(
+        ["bash", "-c", '"$0" "$@" 2>&1', cliBin!, ...cliArgs, "sync"],
+        {
+          cwd: BRAIN_PATH,
+          stdout: "pipe",
+          stderr: "pipe",
+          env: { ...process.env, NO_COLOR: "1" },
+        }
+      );
+
+      const reader = proc.stdout.getReader();
+      const decoder = new TextDecoder();
+      let buffer = "";
+      try {
+        while (true) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          buffer += decoder.decode(value, { stream: true });
+          const lines = buffer.split("\n");
+          buffer = lines.pop() || "";
+          for (const line of lines) {
+            if (line.trim()) {
+              await send({ type: "progress", text: line });
+            }
+          }
+        }
+        if (buffer.trim()) {
+          await send({ type: "progress", text: buffer });
+        }
+      } catch {} finally {
+        clearInterval(keepalive);
+      }
+
+      const exitCode = await proc.exited;
+
+      // Rebuild voice keyterms cache after a successful sync.
+      if (exitCode === 0) {
+        try {
+          const cache = buildKeyterms();
+          writeCache(cache);
+          await send({
+            type: "progress",
+            text: `[voice] Rebuilt keyterms cache (${cache.count} terms)`,
+          });
+        } catch (err) {
+          await send({
+            type: "progress",
+            text: `[voice] Keyterm rebuild failed: ${
+              err instanceof Error ? err.message : String(err)
+            }`,
+          });
+        }
+      }
+
+      await send({
+        type: "done",
+        success: exitCode === 0,
+        text:
+          exitCode === 0 ? "Sync completed" : `Sync failed (exit ${exitCode})`,
+      });
+    });
+  })
+
+  .post("/brain/add", async (c) => {
+    const body = await c.req.json<{
+      content: string;
+      type?: string;
+      title?: string;
+      tags?: string[];
+    }>();
+    if (!body.content) {
+      return c.json({ error: "Field 'content' is required" }, 400);
+    }
+    try {
+      await brainAdd(body.content, {
+        type: body.type,
+        title: body.title,
+        tags: body.tags,
+      });
+      return c.json({ success: true });
+    } catch (err) {
+      return c.json(
+        { error: err instanceof Error ? err.message : "Add failed" },
+        500
+      );
+    }
+  });

package/src/routes/files.ts

@@ -0,0 +1,99 @@
+import { Hono } from "hono";
+import {
+  listDirectory,
+  readFileContent,
+  resolveAncestors,
+  resolveForRaw,
+  buildWikilinkMap,
+  NotFoundError,
+  PathEscapeError,
+  TooLargeError,
+} from "../files/walker.js";
+
+let wikilinkCache: { generatedAt: number; map: Record<string, string> } | null = null;
+const WIKILINK_TTL_MS = 30_000;
+
+function errorResponse(err: unknown): { body: { error: string; size?: number }; status: 400 | 404 | 413 | 500 } {
+  if (err instanceof PathEscapeError) {
+    return { body: { error: "invalid_path" }, status: 400 };
+  }
+  if (err instanceof NotFoundError) {
+    return { body: { error: "not_found" }, status: 404 };
+  }
+  if (err instanceof TooLargeError) {
+    return { body: { error: "file_too_large", size: err.size }, status: 413 };
+  }
+  console.error("[files]", err);
+  return { body: { error: err instanceof Error ? err.message : "internal_error" }, status: 500 };
+}
+
+export const filesRoutes = new Hono()
+  .get("/files/tree", async (c) => {
+    const path = c.req.query("path") ?? "";
+    try {
+      const entries = await listDirectory(path);
+      return c.json({ path, entries });
+    } catch (err) {
+      const { body, status } = errorResponse(err);
+      return c.json(body, status);
+    }
+  })
+
+  .get("/files/content", async (c) => {
+    const path = c.req.query("path");
+    if (!path) return c.json({ error: "missing_path" }, 400);
+    const raw = c.req.query("raw") === "1";
+    try {
+      if (raw) {
+        const { abs, mime, size } = await resolveForRaw(path);
+        const file = Bun.file(abs);
+        return new Response(file, {
+          status: 200,
+          headers: {
+            "Content-Type": mime,
+            "Content-Length": String(size),
+            "Content-Disposition": "inline",
+            "X-Content-Type-Options": "nosniff",
+            "Content-Security-Policy": "default-src 'none'; img-src 'self' data:; style-src 'unsafe-inline'",
+            "Cache-Control": "private, max-age=0, must-revalidate",
+          },
+        });
+      }
+      const result = await readFileContent(path);
+      return c.json({ path, ...result });
+    } catch (err) {
+      const { body, status } = errorResponse(err);
+      return c.json(body, status);
+    }
+  })
+
+  .get("/files/resolve", async (c) => {
+    const path = c.req.query("path");
+    if (!path) return c.json({ error: "missing_path" }, 400);
+    try {
+      const result = await resolveAncestors(path);
+      return c.json({ path, ...result });
+    } catch (err) {
+      const { body, status } = errorResponse(err);
+      return c.json(body, status);
+    }
+  })
+
+  .get("/files/wikilinks", async (c) => {
+    const refresh = c.req.query("refresh") === "1";
+    const now = Date.now();
+    try {
+      if (refresh || !wikilinkCache || now - wikilinkCache.generatedAt > WIKILINK_TTL_MS) {
+        const map = await buildWikilinkMap();
+        wikilinkCache = { generatedAt: now, map };
+      }
+      return c.json({
+        generatedAt: wikilinkCache.generatedAt,
+        count: Object.keys(wikilinkCache.map).length,
+        slugs: wikilinkCache.map,
+      });
+    } catch (err) {
+      const { body, status } = errorResponse(err);
+      return c.json(body, status);
+    }
+  });

package/src/routes/health.ts

@@ -0,0 +1,29 @@
+import { Hono } from "hono";
+import { getCronStatus } from "../cron/scheduler.js";
+import { isTurnActive } from "../ws/handler.js";
+
+const startTime = Date.now();
+
+// Public liveness probe. Deliberately minimal: no version/commit, no cron
+// detail, no session oracle — this route sits in front of the auth guard and
+// is reachable by anyone on the origin.
+export const healthRoutes = new Hono().get("/health", (c) => {
+  return c.json({
+    status: "healthy",
+    uptime: Date.now() - startTime,
+    timestamp: new Date().toISOString(),
+  });
+});
+
+// Operational status. Registered BEHIND the auth guard: it exposes the git SHA,
+// cron job errors (raw stderr with filesystem paths), and whether a turn is
+// active — none of which should be readable unauthenticated.
+export const statusRoutes = new Hono().get("/status", (c) => {
+  return c.json({
+    healthy: true,
+    uptime: Date.now() - startTime,
+    version: process.env.SOURCE_COMMIT ?? "dev",
+    cronJobs: getCronStatus(),
+    activeSession: isTurnActive(),
+  });
+});

package/src/routes/providers.ts

@@ -0,0 +1,9 @@
+import { Hono } from "hono";
+import { getBackendsInfo, listAllProviders } from "../agent/backend.js";
+
+export const providerRoutes = new Hono().get("/providers", async (c) => {
+  return c.json({
+    providers: await listAllProviders(),
+    backends: await getBackendsInfo(),
+  });
+});

package/src/routes/render.ts

@@ -0,0 +1,68 @@
+import { Hono } from "hono";
+import { z } from "zod";
+import type { RenderRequest } from "@schlessera/brain-ui-sdk/protocol";
+import { buildHtmlDocument } from "../render/template.js";
+
+const MAX_CONTENT_BYTES = 512 * 1024;
+
+/**
+ * Rendering seam. The deployment owns the actual renderer process (e.g. the
+ * network-denied headless Chrome in @schlessera/brain-render-puppeteer) and
+ * injects these two functions via `createApp({ renderer })` — the package
+ * itself never spawns a browser.
+ */
+export interface AppRenderer {
+  renderPng(options: { html: string }): Promise<Buffer | Uint8Array>;
+  renderPdf(options: { html: string }): Promise<Buffer | Uint8Array>;
+}
+
+const bodySchema = z.object({
+  content: z.string().min(1).max(MAX_CONTENT_BYTES),
+  contentType: z.enum(["markdown", "html"]),
+  format: z.enum(["png", "pdf"]),
+  title: z.string().max(200).optional(),
+}) satisfies z.ZodType<RenderRequest>;
+
+export function createRenderRoutes(renderer?: AppRenderer) {
+  return new Hono().post("/render", async (c) => {
+    if (!renderer) {
+      return c.json(
+        { error: "render_unavailable", detail: "This deployment has no renderer configured" },
+        501
+      );
+    }
+
+    let parsed;
+    try {
+      parsed = bodySchema.parse(await c.req.json());
+    } catch (err) {
+      return c.json({ error: "invalid_request", detail: err instanceof Error ? err.message : "bad body" }, 400);
+    }
+
+    try {
+      const html = buildHtmlDocument(parsed);
+      const buf =
+        parsed.format === "png"
+          ? await renderer.renderPng({ html })
+          : await renderer.renderPdf({ html });
+      const filename = (parsed.title ?? "share")
+        .replace(/[^a-z0-9_.-]+/gi, "_")
+        .slice(0, 60) || "share";
+      return new Response(new Uint8Array(buf), {
+        status: 200,
+        headers: {
+          "Content-Type": parsed.format === "png" ? "image/png" : "application/pdf",
+          "Content-Length": String(buf.byteLength),
+          "Content-Disposition": `inline; filename="${filename}.${parsed.format}"`,
+          "Cache-Control": "private, max-age=0, must-revalidate",
+        },
+      });
+    } catch (err) {
+      console.error("[render]", err);
+      return c.json(
+        { error: "render_failed", detail: err instanceof Error ? err.message : String(err) },
+        500
+      );
+    }
+  });
+}

package/src/routes/sessions.ts

@@ -0,0 +1,49 @@
+import { Hono } from "hono";
+import { getBackendForSession, getBackends } from "../agent/backend.js";
+import { getDb } from "../db/client.js";
+
+function getStoredBackendId(sessionId: string): string | null {
+  const row = getDb()
+    .query("SELECT backend_id AS backendId FROM sessions WHERE id = ?")
+    .get(sessionId) as { backendId: string | null } | null;
+  return row?.backendId ?? null;
+}
+
+export const sessionRoutes = new Hono()
+  .get("/sessions", async (c) => {
+    try {
+      const backends = await getBackends();
+      const sessions = (
+        await Promise.all(
+          backends.map(async (backend) =>
+            (await backend.listSessions()).map((session) => ({
+              ...session,
+              backendId: backend.id,
+            }))
+          )
+        )
+      )
+        .flat()
+        .sort((a, b) => b.lastActiveAt - a.lastActiveAt);
+      return c.json({ sessions });
+    } catch (err) {
+      return c.json(
+        { error: err instanceof Error ? err.message : "Failed to list sessions" },
+        500
+      );
+    }
+  })
+
+  .get("/sessions/:id", async (c) => {
+    const id = c.req.param("id");
+    try {
+      const backend = await getBackendForSession(getStoredBackendId(id));
+      const messages = await backend.getHistory(id);
+      return c.json({ id, messages });
+    } catch (err) {
+      return c.json(
+        { error: err instanceof Error ? err.message : "Failed to get session" },
+        500
+      );
+    }
+  });