@unson/brainbase-mcp 0.10.10 → 0.10.11

package/README.md

@@ -57,6 +57,8 @@ Brainbaseの価値は、情報を多く保存することではありません
 
 共通UIの最初の公開単位として、知識UIを `@unson/brainbase-mcp/ui/*` から利用できます。Mana委任UIはUnsonの実行基盤（Mana）に結びつくため組織版の画面とし、0.8.0の後に共通UIから外しました。
 
+私有版の画面は `createLocalWebHost({ extensions })` へ登録します。ホストが共通ナビ、静的ファイルの許可リスト、loopback Host検査、書込時の同一Origin・起動トークン検査を担います。拡張のAPIは `/api/extensions/<id>`、画面資産は `/ui/extensions/<id>` に限られ、私有コードはこの公開packageへ含めません。契約と受入条件は[拡張Story](docs/stories/story-local-web-private-extension-v1.md)に記録しています。
+
 実装済み・develop・計画中の境界は、[現在の状態](https://brainbase.pages.dev/guide/status)を参照してください。
 
 ## 10分で試す

package/contracts/judgment-dag/digest.json

@@ -25,8 +25,8 @@
     },
     {
       "path": "README.md",
-      "sha256": "bb90217590722381e3df17950e69e27e72aad25372f54a9a0767cc5c6d14c7d5"
+      "sha256": "c36fd404cbc6e9c2262e82b5d921ccbcef6617774f969dd1e0252cd9e7101af8"
     }
   ],
-  "digest": "8c7b66383e9bb30525c3a9a8e7f37c120209c17b1673ebe2a2a6769b076e94be"
+  "digest": "1beccdf5679b9b7f42375a498a76a661d87ba665f66657c93827dd8d6a938c28"
 }

package/dist/local-web-host.d.ts

@@ -5,9 +5,9 @@ import { type ObjectiveDefinitionBuilder } from './foundation-http.js';
  *
  * One loopback server carries every local screen.  The host owns the
  * protections, the trusted principal and the static allowlist; each screen's
- * server side is a `LocalWebModule`.  To add a screen, add its module to
- * `defaultLocalWebModules()` and its nav entry to `LOCAL_WEB_SCREENS` in
- * `ui/local-web-shell.js`.
+ * server side is a `LocalWebModule`. Public screens live in
+ * `defaultLocalWebModules()` and `LOCAL_WEB_SCREENS`; private products register
+ * a `LocalWebExtension` without copying either one.
  */
 export declare const LOCAL_WEB_HOST_VERSION: "local-web-host.v1";
 /** One per-launch token guards every write on this host, including value-proof feedback. */
@@ -50,6 +50,17 @@ export interface LocalWebModule {
     readonly uiFiles: readonly string[];
     handle(request: IncomingMessage, response: ServerResponse): Promise<boolean>;
 }
+/** Private products add one screen and one namespaced API without changing OSS routes. */
+export interface LocalWebExtension {
+    /** Lowercase URL segment, unique among extensions. */
+    readonly id: string;
+    /** Packaged directory containing only the files listed in uiFiles. */
+    readonly uiDir: string;
+    readonly uiFiles: readonly string[];
+    /** ES module exporting a `screen` compatible with createLocalWebShell. */
+    readonly screenEntry: string;
+    createModule(context: LocalWebModuleContext): LocalWebModule;
+}
 export interface LocalWebHostOptions {
     /** Personal OS data directory. Defaults to `BRAINBASE_PERSONAL_OS_DIR` or `~/.brainbase/personal-os`. */
     readonly dataDir?: string;
@@ -59,6 +70,7 @@ export interface LocalWebHostOptions {
     /** Directory containing the packaged `ui/` files. */
     readonly uiDir?: string;
     readonly now?: () => Date;
+    readonly extensions?: readonly LocalWebExtension[];
 }
 export interface LocalWebHost {
     readonly server: Server;

package/dist/local-web-host.js

@@ -1,5 +1,5 @@
 import { randomBytes } from 'node:crypto';
-import { readFile, stat } from 'node:fs/promises';
+import { lstat, readFile, stat } from 'node:fs/promises';
 import { createServer } from 'node:http';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -20,9 +20,9 @@ import { createWorldModelStore, WORLD_MODEL_EVIDENCE_SIDECAR, WorldModelStoreErr
  *
  * One loopback server carries every local screen.  The host owns the
  * protections, the trusted principal and the static allowlist; each screen's
- * server side is a `LocalWebModule`.  To add a screen, add its module to
- * `defaultLocalWebModules()` and its nav entry to `LOCAL_WEB_SCREENS` in
- * `ui/local-web-shell.js`.
+ * server side is a `LocalWebModule`. Public screens live in
+ * `defaultLocalWebModules()` and `LOCAL_WEB_SCREENS`; private products register
+ * a `LocalWebExtension` without copying either one.
  */
 export const LOCAL_WEB_HOST_VERSION = 'local-web-host.v1';
 /** One per-launch token guards every write on this host, including value-proof feedback. */
@@ -598,7 +598,7 @@ function shellHtml(token, stylesheets) {
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <meta name="brainbase-web-token" content="${escapeAttribute(token)}">
 <title>Brainbase</title>
-${stylesheets.map((file) => `<link rel="stylesheet" href="/ui/${escapeAttribute(file)}">`).join('\n')}
+${stylesheets.map((path) => `<link rel="stylesheet" href="${escapeAttribute(path)}">`).join('\n')}
 </head>
 <body>
 <div id="brainbase-local-web"></div>
@@ -607,16 +607,31 @@ ${stylesheets.map((file) => `<link rel="stylesheet" href="/ui/${escapeAttribute(
 </html>
 `;
 }
-const BOOTSTRAP_JS = `import { createLocalWebShell } from '/ui/local-web-shell.js';
+function bootstrapJs(extensions) {
+    const imports = extensions.map((extension, index) => `import { screen as extensionScreen${index} } from '/ui/extensions/${extension.id}/${extension.screenEntry}';`).join('\n');
+    const screens = extensions.map((_, index) => `extensionScreen${index}`).join(', ');
+    const ids = JSON.stringify(extensions.map((extension) => extension.id));
+    return `import { createLocalWebShell, LOCAL_WEB_SCREENS } from '/ui/local-web-shell.js';
+${imports}
+const extensionScreens = [${screens}];
+const extensionIds = ${ids};
+if (extensionScreens.some((screen, index) => screen?.id !== extensionIds[index] || LOCAL_WEB_SCREENS.some((base) => base.id === screen.id))) {
+  throw new Error('Invalid extension screen id');
+}
 const meta = (name) => document.querySelector(\`meta[name="\${name}"]\`)?.getAttribute('content') ?? '';
 const screenFromHash = () => decodeURIComponent(location.hash.replace(/^#/, '')) || undefined;
 const shell = createLocalWebShell({
   root: document.getElementById('brainbase-local-web'),
   token: meta('brainbase-web-token'),
-  initialScreen: screenFromHash()
+  initialScreen: screenFromHash(),
+  screens: [...LOCAL_WEB_SCREENS, ...extensionScreens]
 });
 addEventListener('hashchange', () => shell.show(screenFromHash()));
 `;
+}
+function validExtensionFile(file) {
+    return /^[A-Za-z0-9][A-Za-z0-9._-]*\.(?:js|css)$/u.test(file) && !file.includes('..');
+}
 /** Local single-owner host. The caller owns `listen()` and must bind to a loopback address. */
 export function createLocalWebHost(options = {}) {
     const token = options.token ?? randomBytes(24).toString('base64url');
@@ -627,15 +642,40 @@ export function createLocalWebHost(options = {}) {
     const uiDir = options.uiDir ?? fileURLToPath(new URL('../ui/', import.meta.url));
     const context = { dataDir, journalRoot, token, now: options.now ?? (() => new Date()) };
     const modules = defaultLocalWebModules(context);
+    const extensions = [...options.extensions ?? []];
+    const extensionModules = [];
+    const ids = new Set();
     const uiFiles = new Map();
     for (const file of [...BASE_UI_FILES, ...modules.flatMap((module) => module.uiFiles)]) {
         const extension = file.slice(file.lastIndexOf('.'));
         const type = CONTENT_TYPES[extension];
-        if (!type || file.includes('/'))
+        if (!type || !validExtensionFile(file))
             throw new TypeError(`Unsupported UI file ${file}`);
-        uiFiles.set(`/ui/${file}`, type);
+        uiFiles.set(`/ui/${file}`, { type, root: uiDir, file });
+    }
+    for (const extension of extensions) {
+        if (!/^[a-z][a-z0-9-]*$/u.test(extension.id) || ids.has(extension.id)) {
+            throw new TypeError(`Invalid or duplicate extension id ${extension.id}`);
+        }
+        ids.add(extension.id);
+        if (!extension.uiFiles.includes(extension.screenEntry) || !extension.screenEntry.endsWith('.js')) {
+            throw new TypeError(`Extension screen entry must be an allowlisted JS file: ${extension.id}`);
+        }
+        const module = extension.createModule(context);
+        if (module.id !== extension.id || module.uiFiles.length !== 0) {
+            throw new TypeError(`Extension module must use its id and declare UI files on the extension: ${extension.id}`);
+        }
+        extensionModules.push({ prefix: `/api/extensions/${extension.id}`, module });
+        for (const file of extension.uiFiles) {
+            if (!validExtensionFile(file))
+                throw new TypeError(`Unsupported extension UI file ${file}`);
+            const path = `/ui/extensions/${extension.id}/${file}`;
+            if (uiFiles.has(path))
+                throw new TypeError(`Duplicate extension UI file ${path}`);
+            uiFiles.set(path, { type: CONTENT_TYPES[file.slice(file.lastIndexOf('.'))], root: extension.uiDir, file });
+        }
     }
-    const stylesheets = [...uiFiles.keys()].filter((path) => path.endsWith('.css')).map((path) => path.slice('/ui/'.length));
+    const stylesheets = [...uiFiles.keys()].filter((path) => path.endsWith('.css'));
     async function handle(request, response) {
         if (!isLoopbackHost(request)) {
             writeJson(response, 403, { error: { code: 'host_rejected', message: 'Host must be a loopback address for this server' } });
@@ -653,6 +693,14 @@ export function createLocalWebHost(options = {}) {
                 return;
         }
         const path = requestUrl(request).pathname;
+        for (const extension of extensionModules) {
+            if (path === extension.prefix || path.startsWith(`${extension.prefix}/`)) {
+                if (await extension.module.handle(request, response))
+                    return;
+                writeJson(response, 404, { error: { code: 'not_found', message: 'Not found' } });
+                return;
+            }
+        }
         if (request.method !== 'GET') {
             writeJson(response, 405, { error: { code: 'method_not_allowed', message: 'Use GET' } });
             return;
@@ -668,16 +716,21 @@ export function createLocalWebHost(options = {}) {
         }
         if (path === '/app.js') {
             response.setHeader('Content-Type', 'text/javascript; charset=utf-8');
-            response.end(BOOTSTRAP_JS);
+            response.end(bootstrapJs(extensions));
+            return;
+        }
+        const asset = uiFiles.get(path);
+        if (!asset) {
+            writeJson(response, 404, { error: { code: 'not_found', message: 'Not found' } });
             return;
         }
-        const type = uiFiles.get(path);
-        if (!type) {
+        const target = join(asset.root, asset.file);
+        if (!(await lstat(target)).isFile()) {
             writeJson(response, 404, { error: { code: 'not_found', message: 'Not found' } });
             return;
         }
-        response.setHeader('Content-Type', type);
-        response.end(await readFile(join(uiDir, path.slice('/ui/'.length))));
+        response.setHeader('Content-Type', asset.type);
+        response.end(await readFile(target));
     }
     const server = createServer((request, response) => {
         void handle(request, response).catch((error) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unson/brainbase-mcp",
-  "version": "0.10.10",
+  "version": "0.10.11",
   "description": "Local-first Brainbase judgment OS that lets supported AI agents reuse a user's approved goals, priorities, decisions, and judgment criteria.",
   "type": "module",
   "license": "MIT",
@@ -336,5 +336,5 @@
   "engines": {
     "node": ">=20"
   },
-  "gitHead": "12af97cb3f02f9964c7bb7ca8ba7a5debdf29e11"
+  "gitHead": "6e626178bfa8b8b3acf99600ba79555309518046"
 }

package/ui/local-web-shell.js

@@ -11,9 +11,8 @@
  * mounted until the host reports Graph v2; a v1 Graph shows the migration
  * commands instead of zero items, and the host never migrates by itself.
  *
- * To add a screen: append `{ id, label, usesGraph, mount(container, context) }`
- * to LOCAL_WEB_SCREENS (or pass `screens`) and add its server module to
- * `defaultLocalWebModules()` in `src/local-web-host.ts`.
+ * Public screens are listed in LOCAL_WEB_SCREENS. Private products pass an
+ * extended `screens` list through LocalWebHostOptions.extensions.
  */
 
 import { createGraphProjectsView } from './graph-projects-view.js';