@tpsdev-ai/flair 0.4.7 → 0.4.11

package/dist/cli.js

@@ -462,10 +462,39 @@ program
     }
     console.log(`\n   Claude Code: Add to your CLAUDE.md:`);
     console.log(`     At the start of every session, run mcp__flair__bootstrap before responding.`);
-    const mcpEnv = { FLAIR_AGENT_ID: agentId };
-    mcpEnv.FLAIR_URL = httpUrl;
-    console.log(`\n   MCP config (.mcp.json):`);
-    console.log(`     { "mcpServers": { "flair": { "command": "npx", "args": ["@tpsdev-ai/flair-mcp"], "env": ${JSON.stringify(mcpEnv)} } } }`);
+    // Auto-wire MCP config into ~/.claude.json if Claude Code is installed
+    const claudeJsonPath = join(homedir(), ".claude.json");
+    const mcpEnv = { FLAIR_AGENT_ID: agentId, FLAIR_URL: httpUrl };
+    const flairMcpConfig = {
+        type: "stdio",
+        command: "flair-mcp",
+        args: [],
+        env: mcpEnv,
+    };
+    try {
+        if (existsSync(claudeJsonPath)) {
+            const claudeJson = JSON.parse(readFileSync(claudeJsonPath, "utf-8"));
+            const existing = claudeJson.mcpServers?.flair;
+            if (existing && existing.env?.FLAIR_URL === httpUrl && existing.env?.FLAIR_AGENT_ID === agentId) {
+                console.log(`\n   MCP config already set in ~/.claude.json ✓`);
+            }
+            else {
+                claudeJson.mcpServers = claudeJson.mcpServers || {};
+                claudeJson.mcpServers.flair = flairMcpConfig;
+                writeFileSync(claudeJsonPath, JSON.stringify(claudeJson, null, 2));
+                console.log(`\n   MCP config written to ~/.claude.json ✓`);
+                console.log(`   Restart Claude Code to pick up the new config.`);
+            }
+        }
+        else {
+            console.log(`\n   MCP config (add to ~/.claude.json):`);
+            console.log(`     { "mcpServers": { "flair": ${JSON.stringify(flairMcpConfig)} } }`);
+        }
+    }
+    catch {
+        console.log(`\n   MCP config (add manually to ~/.claude.json):`);
+        console.log(`     { "mcpServers": { "flair": ${JSON.stringify(flairMcpConfig)} } }`);
+    }
 });
 // ─── flair agent ─────────────────────────────────────────────────────────────
 const agent = program.command("agent").description("Manage Flair agents");

package/dist/resources/SemanticSearch.js

@@ -89,12 +89,10 @@ export class SemanticSearch extends Resource {
         if (!qEmb && q) {
             // Always attempt embedding generation — getEmbedding() handles init internally.
             // Don't gate on getMode() which may return "none" before init completes in worker threads.
-            {
-                try {
-                    qEmb = await getEmbedding(String(q).slice(0, 8000));
-                }
-                catch { }
+            try {
+                qEmb = await getEmbedding(String(q).slice(0, 8000));
             }
+            catch { }
         }
         // ─── Temporal intent detection ────────────────────────────────────────────
         let sinceDate = since ? new Date(since) : null;
@@ -145,8 +143,6 @@ export class SemanticSearch extends Resource {
             agentConditions.push({ attribute: "visibility", comparator: "equals", value: "office" });
             conditions.push({ operator: "or", conditions: agentConditions });
         }
-        // Exclude archived records. Use "not equals true" instead of "equals false"
-        // so records without the archived field (default: not archived) are included.
         // Exclude archived records. Use "not_equal" (Harper v5 comparator) instead of
         // "equals false" so records without the archived field are included.
         conditions.push({ attribute: "archived", comparator: "not_equal", value: true });

package/dist/resources/Soul.js

@@ -1,9 +1,29 @@
 import { databases } from "@harperfast/harper";
+function enforceAgentScope(self, data) {
+    const authenticatedAgent = self.request?.headers?.get?.("x-tps-agent");
+    const callerIsAdmin = self.request?.tpsAgentIsAdmin === true;
+    if (authenticatedAgent && !callerIsAdmin && data?.agentId && data.agentId !== authenticatedAgent) {
+        return new Response(JSON.stringify({
+            error: "forbidden: agentId must match authenticated agent",
+        }), { status: 403, headers: { "Content-Type": "application/json" } });
+    }
+    return null;
+}
 export class Soul extends databases.flair.Soul {
     async post(content, context) {
+        const denied = enforceAgentScope(this, content);
+        if (denied)
+            return denied;
         content.durability ||= "permanent";
         content.createdAt = new Date().toISOString();
         content.updatedAt = content.createdAt;
         return super.post(content, context);
     }
+    async put(content, context) {
+        const denied = enforceAgentScope(this, content);
+        if (denied)
+            return denied;
+        content.updatedAt = new Date().toISOString();
+        return super.put(content, context);
+    }
 }

package/dist/resources/auth-middleware.js

@@ -357,93 +357,13 @@ server.http(async (request, nextLayer) => {
             }
         }
     }
-    // ── SemanticSearch: agentId must match authenticated agent ─────────────────
-    // Non-admin agents can only search their own memories (plus MemoryGrant access,
-    // which is enforced inside SemanticSearch.ts using the x-tps-agent header).
-    if (!request.tpsAgentIsAdmin &&
-        method === "POST" &&
-        (url.pathname === "/SemanticSearch" || url.pathname === "/SemanticSearch/")) {
-        try {
-            const clone = request.clone();
-            const body = await clone.json();
-            if (body?.agentId && body.agentId !== agentId) {
-                return new Response(JSON.stringify({
-                    error: "forbidden: agentId must match authenticated agent",
-                }), { status: 403, headers: { "Content-Type": "application/json" } });
-            }
-        }
-        catch {
-            return new Response(JSON.stringify({ error: "malformed_request_body" }), { status: 400, headers: { "Content-Type": "application/json" } });
-        }
-    }
-    // ── BootstrapMemories: agentId must match authenticated agent ───────────────
-    if (!request.tpsAgentIsAdmin &&
-        method === "POST" &&
-        (url.pathname === "/BootstrapMemories" || url.pathname === "/BootstrapMemories/")) {
-        try {
-            const clone = request.clone();
-            const body = await clone.json();
-            if (body?.agentId && body.agentId !== agentId) {
-                return new Response(JSON.stringify({
-                    error: "forbidden: agentId must match authenticated agent",
-                }), { status: 403, headers: { "Content-Type": "application/json" } });
-            }
-        }
-        catch {
-            return new Response(JSON.stringify({ error: "malformed_request_body" }), { status: 400, headers: { "Content-Type": "application/json" } });
-        }
-    }
-    // ── Memory POST (create): agentId must match authenticated agent ────────────
-    if (!request.tpsAgentIsAdmin &&
-        method === "POST" &&
-        (url.pathname === "/Memory" || url.pathname === "/Memory/")) {
-        try {
-            const clone = request.clone();
-            const body = await clone.json();
-            if (body?.agentId && body.agentId !== agentId) {
-                return new Response(JSON.stringify({
-                    error: "forbidden: cannot create memories for another agent",
-                }), { status: 403, headers: { "Content-Type": "application/json" } });
-            }
-        }
-        catch {
-            return new Response(JSON.stringify({ error: "malformed_request_body" }), { status: 400, headers: { "Content-Type": "application/json" } });
-        }
-    }
-    // ── Soul POST/PUT: agentId must match authenticated agent ───────────────────
-    if (!request.tpsAgentIsAdmin &&
-        (method === "POST" || method === "PUT") &&
-        (url.pathname === "/Soul" || url.pathname === "/Soul/" || url.pathname.startsWith("/Soul/"))) {
-        try {
-            const clone = request.clone();
-            const body = await clone.json();
-            if (body?.agentId && body.agentId !== agentId) {
-                return new Response(JSON.stringify({
-                    error: "forbidden: cannot write another agent's soul",
-                }), { status: 403, headers: { "Content-Type": "application/json" } });
-            }
-        }
-        catch {
-            return new Response(JSON.stringify({ error: "malformed_request_body" }), { status: 400, headers: { "Content-Type": "application/json" } });
-        }
-    }
-    // ── Memory PUT: agentId must match authenticated agent ──────────────────────
-    if (!request.tpsAgentIsAdmin &&
-        method === "PUT" &&
-        (url.pathname === "/Memory" || url.pathname === "/Memory/" || url.pathname.startsWith("/Memory/"))) {
-        try {
-            const clone = request.clone();
-            const body = await clone.json();
-            if (body?.agentId && body.agentId !== agentId) {
-                return new Response(JSON.stringify({
-                    error: "forbidden: cannot write memories for another agent",
-                }), { status: 403, headers: { "Content-Type": "application/json" } });
-            }
-        }
-        catch {
-            return new Response(JSON.stringify({ error: "malformed_request_body" }), { status: 400, headers: { "Content-Type": "application/json" } });
-        }
-    }
+    // ── Mutation scoping: agentId in body must match authenticated agent ────────
+    // The resource handlers also enforce this (defense-in-depth), but rejecting
+    // early avoids unnecessary work. We don't use request.clone().json() because
+    // Harper's Request is not a Web API Request — it wraps a Node.js stream.
+    // Instead, the resource-level check (e.g. BootstrapMemories line 58) handles
+    // body-level enforcement since it receives the parsed data from Harper's REST
+    // layer. The middleware's job is identity verification (done above).
     // ── Memory GET: non-admin can only read own memories (by ID) ────────────────
     if (!request.tpsAgentIsAdmin && method === "GET") {
         if (url.pathname.startsWith("/Memory/")) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tpsdev-ai/flair",
-  "version": "0.4.7",
+  "version": "0.4.11",
   "description": "Identity, memory, and soul for AI agents. Cryptographic identity (Ed25519), semantic memory with local embeddings, and persistent personality — all in a single process.",
   "type": "module",
   "license": "Apache-2.0",