@tpsdev-ai/flair 0.4.6 → 0.4.8

package/dist/cli.js

@@ -1031,7 +1031,7 @@ program
     .action(async (opts) => {
     const platform = process.platform;
     const port = readPortFromConfig() ?? DEFAULT_PORT;
-    // Stop first
+    // Stop first: remove launchd service on macOS, then kill by port on all platforms
     if (platform === "darwin") {
         const label = "ai.tpsdev.flair";
         const plistPath = join(homedir(), "Library", "LaunchAgents", `${label}.plist`);
@@ -1045,27 +1045,22 @@ program
             unlinkSync(plistPath);
             console.log("✅ Launchd service removed");
         }
-        else {
-            console.log("No launchd service found — skipping");
-        }
     }
-    else {
-        // Linux: kill by port
-        try {
-            const { execSync } = await import("node:child_process");
-            const lsof = execSync(`lsof -ti :${port}`, { encoding: "utf-8" }).trim();
-            if (lsof) {
-                for (const pid of lsof.split("\n")) {
-                    try {
-                        process.kill(Number(pid.trim()), "SIGTERM");
-                    }
-                    catch { }
+    // Kill any process still on the port (covers direct-start, no-service, or failed unload)
+    try {
+        const { execSync } = await import("node:child_process");
+        const lsof = execSync(`lsof -ti :${port}`, { encoding: "utf-8" }).trim();
+        if (lsof) {
+            for (const pid of lsof.split("\n")) {
+                try {
+                    process.kill(Number(pid.trim()), "SIGTERM");
                 }
+                catch { }
             }
+            console.log("✅ Flair process stopped");
         }
-        catch { /* not running */ }
-        console.log("✅ Flair process stopped");
     }
+    catch { /* not running */ }
     // Remove config
     const cfgPath = configPath();
     if (existsSync(cfgPath)) {

package/dist/resources/auth-middleware.js

@@ -357,93 +357,13 @@ server.http(async (request, nextLayer) => {
             }
         }
     }
-    // ── SemanticSearch: agentId must match authenticated agent ─────────────────
-    // Non-admin agents can only search their own memories (plus MemoryGrant access,
-    // which is enforced inside SemanticSearch.ts using the x-tps-agent header).
-    if (!request.tpsAgentIsAdmin &&
-        method === "POST" &&
-        (url.pathname === "/SemanticSearch" || url.pathname === "/SemanticSearch/")) {
-        try {
-            const clone = request.clone();
-            const body = await clone.json();
-            if (body?.agentId && body.agentId !== agentId) {
-                return new Response(JSON.stringify({
-                    error: "forbidden: agentId must match authenticated agent",
-                }), { status: 403, headers: { "Content-Type": "application/json" } });
-            }
-        }
-        catch {
-            return new Response(JSON.stringify({ error: "malformed_request_body" }), { status: 400, headers: { "Content-Type": "application/json" } });
-        }
-    }
-    // ── BootstrapMemories: agentId must match authenticated agent ───────────────
-    if (!request.tpsAgentIsAdmin &&
-        method === "POST" &&
-        (url.pathname === "/BootstrapMemories" || url.pathname === "/BootstrapMemories/")) {
-        try {
-            const clone = request.clone();
-            const body = await clone.json();
-            if (body?.agentId && body.agentId !== agentId) {
-                return new Response(JSON.stringify({
-                    error: "forbidden: agentId must match authenticated agent",
-                }), { status: 403, headers: { "Content-Type": "application/json" } });
-            }
-        }
-        catch {
-            return new Response(JSON.stringify({ error: "malformed_request_body" }), { status: 400, headers: { "Content-Type": "application/json" } });
-        }
-    }
-    // ── Memory POST (create): agentId must match authenticated agent ────────────
-    if (!request.tpsAgentIsAdmin &&
-        method === "POST" &&
-        (url.pathname === "/Memory" || url.pathname === "/Memory/")) {
-        try {
-            const clone = request.clone();
-            const body = await clone.json();
-            if (body?.agentId && body.agentId !== agentId) {
-                return new Response(JSON.stringify({
-                    error: "forbidden: cannot create memories for another agent",
-                }), { status: 403, headers: { "Content-Type": "application/json" } });
-            }
-        }
-        catch {
-            return new Response(JSON.stringify({ error: "malformed_request_body" }), { status: 400, headers: { "Content-Type": "application/json" } });
-        }
-    }
-    // ── Soul POST/PUT: agentId must match authenticated agent ───────────────────
-    if (!request.tpsAgentIsAdmin &&
-        (method === "POST" || method === "PUT") &&
-        (url.pathname === "/Soul" || url.pathname === "/Soul/" || url.pathname.startsWith("/Soul/"))) {
-        try {
-            const clone = request.clone();
-            const body = await clone.json();
-            if (body?.agentId && body.agentId !== agentId) {
-                return new Response(JSON.stringify({
-                    error: "forbidden: cannot write another agent's soul",
-                }), { status: 403, headers: { "Content-Type": "application/json" } });
-            }
-        }
-        catch {
-            return new Response(JSON.stringify({ error: "malformed_request_body" }), { status: 400, headers: { "Content-Type": "application/json" } });
-        }
-    }
-    // ── Memory PUT: agentId must match authenticated agent ──────────────────────
-    if (!request.tpsAgentIsAdmin &&
-        method === "PUT" &&
-        (url.pathname === "/Memory" || url.pathname === "/Memory/" || url.pathname.startsWith("/Memory/"))) {
-        try {
-            const clone = request.clone();
-            const body = await clone.json();
-            if (body?.agentId && body.agentId !== agentId) {
-                return new Response(JSON.stringify({
-                    error: "forbidden: cannot write memories for another agent",
-                }), { status: 403, headers: { "Content-Type": "application/json" } });
-            }
-        }
-        catch {
-            return new Response(JSON.stringify({ error: "malformed_request_body" }), { status: 400, headers: { "Content-Type": "application/json" } });
-        }
-    }
+    // ── Mutation scoping: agentId in body must match authenticated agent ────────
+    // The resource handlers also enforce this (defense-in-depth), but rejecting
+    // early avoids unnecessary work. We don't use request.clone().json() because
+    // Harper's Request is not a Web API Request — it wraps a Node.js stream.
+    // Instead, the resource-level check (e.g. BootstrapMemories line 58) handles
+    // body-level enforcement since it receives the parsed data from Harper's REST
+    // layer. The middleware's job is identity verification (done above).
     // ── Memory GET: non-admin can only read own memories (by ID) ────────────────
     if (!request.tpsAgentIsAdmin && method === "GET") {
         if (url.pathname.startsWith("/Memory/")) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tpsdev-ai/flair",
-  "version": "0.4.6",
+  "version": "0.4.8",
   "description": "Identity, memory, and soul for AI agents. Cryptographic identity (Ed25519), semantic memory with local embeddings, and persistent personality — all in a single process.",
   "type": "module",
   "license": "Apache-2.0",