brainllm 12.4.0 → 12.4.2

package/README.md

@@ -10,7 +10,7 @@ A persistent, graph-structured second brain for Claude and any MCP client — bu
 
 [**brainllm site**](https://miisodev.github.io/BrainLLM/) · [How it works](https://miisodev.github.io/BrainLLM/how-it-works.html) · [Use cases](https://miisodev.github.io/BrainLLM/use-cases.html) · [Docs](https://miisodev.github.io/BrainLLM/docs.html)
 
-[![Version](https://img.shields.io/badge/version-12.4.0-f59e0b?style=flat-square)](https://github.com/miisodev/BrainLLM/releases)
+[![Version](https://img.shields.io/badge/version-12.4.2-f59e0b?style=flat-square)](https://github.com/miisodev/BrainLLM/releases)
 [![CI](https://img.shields.io/github/actions/workflow/status/miisodev/BrainLLM/ci.yml?branch=main&style=flat-square&label=CI&color=f59e0b)](https://github.com/miisodev/BrainLLM/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/license-MIT-a1a1aa?style=flat-square)](./LICENSE)
 [![Runtime: Bun](https://img.shields.io/badge/runtime-Bun%20%E2%89%A5%201.0-a1a1aa?style=flat-square&logo=bun&logoColor=white)](https://bun.sh)
@@ -233,7 +233,7 @@ The complete operational reference is [`skills/brainllm/SKILL.md`](./skills/brai
 | **stdio** | Local — Claude Desktop / Claude Code spawns BrainLLM as a child process | `PORT` unset (default) |
 | **HTTP connector** | Remote — clients reach BrainLLM over the network | `PORT` set (Railway injects it) |
 
-The HTTP connector serves a streamable-HTTP MCP endpoint at `/mcp` (one session per `mcp-session-id`, DELETE terminates, CORS-enabled with `mcp-session-id` exposed for browser clients), a **legacy SSE endpoint** at `/sse` (with `POST /messages`) for clients that predate streamable HTTP — older Cursor builds, Continue, and Python-SDK clients — and `GET /health`. The server root serves a plain page naming the endpoints, so a human or probing client landing on the origin sees what lives there. The server itself speaks plain HTTP — TLS is expected to terminate in front of it (Railway's edge does this automatically for you; on a bare VPS or your own Docker host, put it behind a reverse proxy such as Caddy, nginx, or a Cloudflare Tunnel). **HTTP mode now fails closed unless `MCP_AUTH_TOKEN` or `BRAINLLM_OWNER_PASSWORD` is configured**; `BRAINLLM_ALLOW_UNAUTHENTICATED_HTTP=true` is an explicit escape hatch for an isolated trusted network only. CORS defaults to `*`, so a reachable deployment must have a real authentication gate. Idle sessions are evicted after 1 hour; MCP request bodies are capped at 50 MiB by both the server and SDK transport. Both transports sit behind the same authentication gate.
+The HTTP connector serves a streamable-HTTP MCP endpoint at `/mcp` (one session per `mcp-session-id`, DELETE terminates, CORS-enabled with `mcp-session-id` exposed for browser clients), a **legacy SSE endpoint** at `/sse` (with `POST /messages`) for clients that predate streamable HTTP — older Cursor builds, Continue, and Python-SDK clients — and `GET /health`. The server root serves a plain page for ordinary browser `GET` requests; MCP-shaped requests sent to `/` are also accepted as a compatibility alias, because some hosted Claude connector versions normalize the post-token MCP path to the origin root. The server itself speaks plain HTTP — TLS is expected to terminate in front of it (Railway's edge does this automatically for you; on a bare VPS or your own Docker host, put it behind a reverse proxy such as Caddy, nginx, or a Cloudflare Tunnel). **HTTP mode now fails closed unless `MCP_AUTH_TOKEN` or `BRAINLLM_OWNER_PASSWORD` is configured**; `BRAINLLM_ALLOW_UNAUTHENTICATED_HTTP=true` is an explicit escape hatch for an isolated trusted network only. CORS defaults to `*`, so a reachable deployment must have a real authentication gate. Idle sessions are evicted after 1 hour; MCP request bodies are capped at 50 MiB by both the server and SDK transport. Both transports sit behind the same authentication gate.
 
 ### Docker / Railway
 

package/dist/index.js

@@ -27788,6 +27788,7 @@ import { existsSync as existsSync2, readFileSync as readFileSync2, statSync, wri
 import { lookup } from "dns/promises";
 import { isIP } from "net";
 import { request as httpsRequest } from "https";
+var CIMD_USER_AGENT = "BrainLLM-CIMD/1.0 (+https://github.com/miisodev/BrainLLM)";
 function isNonPublicAddress(address) {
   const value = address.trim().toLowerCase().replace(/^\[|\]$/g, "").split("%")[0];
   const version = isIP(value);
@@ -27937,7 +27938,13 @@ async function fetchPinned(target, maxBytes, timeoutMs) {
     const hostname = target.url.hostname.replace(/^\[|\]$/g, "");
     const request = httpsRequest(target.url, {
       method: "GET",
-      headers: { Accept: "application/json", Host: target.url.host, Connection: "close" },
+      headers: {
+        Accept: "application/json",
+        "Accept-Encoding": "identity",
+        "User-Agent": CIMD_USER_AGENT,
+        Host: target.url.host,
+        Connection: "close"
+      },
       agent: false,
       servername: isIP(hostname) ? undefined : hostname,
       lookup: (_hostname, options, callback) => {
@@ -27989,6 +27996,7 @@ var SCOPE = "brain";
 var AUTH_CODE_TTL_MS = 10 * 60 * 1000;
 var ACCESS_TOKEN_TTL_S = 60 * 60;
 var REFRESH_TOKEN_TTL_MS = 90 * 24 * 60 * 60 * 1000;
+var CONSENT_TRANSACTION_TTL_S = 5 * 60;
 var CIMD_FETCH_TIMEOUT_MS = 5000;
 var MAX_OAUTH_BODY_BYTES = 64 * 1024;
 var MAX_CIMD_DOCUMENT_BYTES = 64 * 1024;
@@ -28044,13 +28052,16 @@ var bodyLimitResponse = (format = "json") => {
 };
 var b64url = (buf) => Buffer.from(buf).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 var b64urlDecode = (s) => Buffer.from(s.replace(/-/g, "+").replace(/_/g, "/"), "base64");
-function signJwt(claims, secret) {
+function signSignedClaims(claims, secret) {
   const header = b64url(JSON.stringify({ alg: "HS256", typ: "JWT" }));
   const payload = b64url(JSON.stringify(claims));
   const sig = b64url(createHmac("sha256", secret).update(`${header}.${payload}`).digest());
   return `${header}.${payload}.${sig}`;
 }
-function verifyJwt(token, secret) {
+function signJwt(claims, secret) {
+  return signSignedClaims(claims, secret);
+}
+function verifySignedClaims(token, secret) {
   const parts = token.split(".");
   if (parts.length !== 3)
     return null;
@@ -28069,6 +28080,51 @@ function verifyJwt(token, secret) {
     return null;
   }
 }
+function verifyJwt(token, secret) {
+  const claims = verifySignedClaims(token, secret);
+  if (!claims || typeof claims.iss !== "string" || typeof claims.aud !== "string" || typeof claims.sub !== "string" || typeof claims.scope !== "string" || typeof claims.iat !== "number")
+    return null;
+  return claims;
+}
+function issueConsentTransaction(request, base) {
+  const now = Math.floor(Date.now() / 1000);
+  const transaction = {
+    kind: "authorization-consent",
+    iss: base,
+    iat: now,
+    exp: now + CONSENT_TRANSACTION_TTL_S,
+    ...request
+  };
+  return signSignedClaims(transaction, signingSecret());
+}
+function verifyConsentTransaction(ticket, base) {
+  const claims = verifySignedClaims(ticket, signingSecret());
+  if (!claims || claims.kind !== "authorization-consent" || claims.iss !== base || typeof claims.clientId !== "string" || claims.clientName !== undefined && typeof claims.clientName !== "string" || typeof claims.redirectUri !== "string" || typeof claims.responseType !== "string" || typeof claims.codeChallenge !== "string" || typeof claims.challengeMethod !== "string" || typeof claims.state !== "string" || typeof claims.resource !== "string" || typeof claims.scope !== "string")
+    return null;
+  let redirect;
+  try {
+    redirect = new URL(claims.redirectUri);
+  } catch {
+    return null;
+  }
+  if (redirect.protocol !== "http:" && redirect.protocol !== "https:")
+    return null;
+  if (claims.responseType !== "code" || claims.challengeMethod !== "S256" || !claims.codeChallenge)
+    return null;
+  if (claims.resource.replace(/\/+$/, "") !== resourceUri(base).replace(/\/+$/, ""))
+    return null;
+  return {
+    clientId: claims.clientId,
+    ...typeof claims.clientName === "string" ? { clientName: claims.clientName } : {},
+    redirectUri: claims.redirectUri,
+    responseType: claims.responseType,
+    codeChallenge: claims.codeChallenge,
+    challengeMethod: claims.challengeMethod,
+    state: claims.state,
+    resource: claims.resource,
+    scope: claims.scope
+  };
+}
 var MAX_REGISTERED_CLIENTS = 200;
 function storePath() {
   return configFilePath().replace(/\.json$/, "") + ".oauth.json";
@@ -28196,6 +28252,12 @@ function wwwAuthenticate(base, error) {
   ];
   return parts.join(", ");
 }
+var PRE_REGISTERED_CLIENTS = {
+  "https://claude.ai/oauth/client-metadata": {
+    client_id: "https://claude.ai/oauth/client-metadata",
+    redirect_uris: ["https://claude.ai/api/mcp/auth_callback"]
+  }
+};
 function isLoopback(u) {
   return (u.protocol === "http:" || u.protocol === "https:") && (u.hostname === "127.0.0.1" || u.hostname === "::1" || u.hostname === "localhost");
 }
@@ -28270,6 +28332,10 @@ async function resolveClient(clientId) {
       }
     };
   }
+  const preRegistered = PRE_REGISTERED_CLIENTS[clientId];
+  if (preRegistered) {
+    return { client: { ...preRegistered, redirect_uris: [...preRegistered.redirect_uris] } };
+  }
   let url;
   try {
     url = new URL(clientId);
@@ -28451,6 +28517,26 @@ function landingPage(base, oauthOn, sseOn) {
   <p class="foot">Health: <span class="host">/health</span> \xB7 Everything else is MCP.</p>
 </div>`);
 }
+var PAGE_SECURITY_DIRECTIVES = "default-src 'none'; frame-ancestors 'none'; base-uri 'none'; img-src 'self' data:";
+function pageContentSecurityPolicy(redirectUri) {
+  let formAction = "'self'";
+  if (redirectUri) {
+    const origin = new URL(redirectUri).origin;
+    if (origin !== "null")
+      formAction += ` ${origin}`;
+  }
+  return `${PAGE_SECURITY_DIRECTIVES}; form-action ${formAction}; style-src 'unsafe-inline'`;
+}
+function consentResponse(transaction, redirectUri, clientHost, verifiedHost, error, status = 200) {
+  return new Response(consentPage({ transaction }, clientHost, error, verifiedHost), {
+    status,
+    headers: {
+      "Content-Type": "text/html; charset=utf-8",
+      "Cache-Control": "no-store",
+      "Content-Security-Policy": pageContentSecurityPolicy(redirectUri)
+    }
+  });
+}
 function consentPage(params, clientHost, error, verifiedHost = true) {
   const hidden = Object.entries(params).map(([k, v]) => `<input type="hidden" name="${esc2(k)}" value="${esc2(v)}">`).join("");
   const foot = verifiedHost ? "Only the host above is shown, and it is the one DNS and TLS vouch for." : "The name above is self-reported by the application \u2014 your password is what authorizes access.";
@@ -28481,7 +28567,13 @@ var htmlError = (message, status = 400) => new Response(shell("Authorization err
   <h1>Authorization error</h1>
   <div class="err">${esc2(message)}</div>
   <p class="foot">Nothing was authorized. Close this window and start again from your client.</p>
-</div>`), { status, headers: { "Content-Type": "text/html; charset=utf-8" } });
+</div>`), {
+  status,
+  headers: {
+    "Content-Type": "text/html; charset=utf-8",
+    "Content-Security-Policy": pageContentSecurityPolicy()
+  }
+});
 async function handleAuthorize(req, base) {
   const url = new URL(req.url);
   let form = null;
@@ -28494,63 +28586,73 @@ async function handleAuthorize(req, base) {
       return htmlError("The authorization form could not be read.", 400);
     }
   }
-  const get = (k) => (form ? form.get(k) : url.searchParams.get(k)) ?? "";
-  const clientId = get("client_id");
-  const redirectUri = get("redirect_uri");
-  const responseType = get("response_type");
-  const codeChallenge = get("code_challenge");
-  const challengeMethod = get("code_challenge_method");
-  const state = get("state");
-  const resource = get("resource");
-  const scope = get("scope") || SCOPE;
-  if (!clientId || !redirectUri)
-    return htmlError("Missing client_id or redirect_uri.");
-  const resolved = await resolveClient(clientId);
-  if ("error" in resolved)
-    return htmlError(resolved.error);
-  if (!redirectUriAllowed(redirectUri, resolved.client.redirect_uris)) {
-    return htmlError("redirect_uri is not listed in the client's metadata document.");
+  let request;
+  let transaction;
+  if (form) {
+    transaction = form.get("transaction") ?? "";
+    const verified = verifyConsentTransaction(transaction, base);
+    if (!verified) {
+      return htmlError("This authorization request expired or was altered. Start again from your client.");
+    }
+    request = verified;
+  } else {
+    const get = (k) => url.searchParams.get(k) ?? "";
+    const clientId = get("client_id");
+    const redirectUri = get("redirect_uri");
+    const responseType = get("response_type");
+    const codeChallenge = get("code_challenge");
+    const challengeMethod = get("code_challenge_method");
+    const state = get("state");
+    const resource = get("resource");
+    const scope = get("scope") || SCOPE;
+    if (!clientId || !redirectUri)
+      return htmlError("Missing client_id or redirect_uri.");
+    const resolved = await resolveClient(clientId);
+    if ("error" in resolved)
+      return htmlError(resolved.error);
+    if (!redirectUriAllowed(redirectUri, resolved.client.redirect_uris)) {
+      return htmlError("redirect_uri is not listed in the client's metadata document.");
+    }
+    const fail = (error, description) => redirectWith(redirectUri, { error, error_description: description, iss: base, ...state ? { state } : {} });
+    if (responseType !== "code")
+      return fail("unsupported_response_type", "Only response_type=code is supported.");
+    if (!codeChallenge || challengeMethod !== "S256") {
+      return fail("invalid_request", "PKCE with code_challenge_method=S256 is required.");
+    }
+    if (resource && resource.replace(/\/+$/, "") !== resourceUri(base).replace(/\/+$/, "")) {
+      return fail("invalid_target", `This server only issues tokens for ${resourceUri(base)}.`);
+    }
+    request = {
+      clientId,
+      ...resolved.client.client_name ? { clientName: resolved.client.client_name } : {},
+      redirectUri,
+      responseType,
+      codeChallenge,
+      challengeMethod,
+      state,
+      resource: resource || resourceUri(base),
+      scope
+    };
+    transaction = issueConsentTransaction(request, base);
   }
+  const { clientId, redirectUri, codeChallenge, state, resource, scope } = request;
   const fail = (error, description) => redirectWith(redirectUri, { error, error_description: description, iss: base, ...state ? { state } : {} });
-  if (responseType !== "code")
-    return fail("unsupported_response_type", "Only response_type=code is supported.");
-  if (!codeChallenge || challengeMethod !== "S256") {
-    return fail("invalid_request", "PKCE with code_challenge_method=S256 is required.");
-  }
-  if (resource && resource.replace(/\/+$/, "") !== resourceUri(base).replace(/\/+$/, "")) {
-    return fail("invalid_target", `This server only issues tokens for ${resourceUri(base)}.`);
-  }
   let clientHost;
   let verifiedHost = true;
   try {
     clientHost = new URL(clientId).host;
   } catch {
     verifiedHost = false;
-    clientHost = resolved.client.client_name ?? "a dynamically registered client";
+    clientHost = request.clientName ?? "a dynamically registered client";
   }
-  const carried = {
-    client_id: clientId,
-    redirect_uri: redirectUri,
-    response_type: responseType,
-    code_challenge: codeChallenge,
-    code_challenge_method: challengeMethod,
-    scope,
-    ...state ? { state } : {},
-    ...resource ? { resource } : {}
-  };
   if (!form) {
-    return new Response(consentPage(carried, clientHost, undefined, verifiedHost), {
-      headers: { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" }
-    });
+    return consentResponse(transaction, redirectUri, clientHost, verifiedHost);
   }
-  if (get("decision") !== "approve") {
+  if (form.get("decision") !== "approve") {
     return fail("access_denied", "The owner denied the request.");
   }
-  if (!ownerPasswordMatches(get("password"))) {
-    return new Response(consentPage(carried, clientHost, "Incorrect password.", verifiedHost), {
-      status: 401,
-      headers: { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" }
-    });
+  if (!ownerPasswordMatches(form.get("password") ?? "")) {
+    return consentResponse(transaction, redirectUri, clientHost, verifiedHost, "Incorrect password.", 401);
   }
   const store = loadStore();
   const code = randomBytes(32).toString("base64url");
@@ -28559,7 +28661,7 @@ async function handleAuthorize(req, base) {
     redirectUri,
     codeChallenge,
     scope,
-    resource: resource || resourceUri(base),
+    resource,
     expiresAt: Date.now() + AUTH_CODE_TTL_MS
   };
   saveStore();
@@ -28572,7 +28674,7 @@ var tokenError = (error, description, status = 400) => new Response(JSON.stringi
 function issueTokens(base, clientId, resource, scope) {
   const store = loadStore();
   const now = Math.floor(Date.now() / 1000);
-  const accessToken = signJwt({ iss: base, aud: resource, sub: "owner", scope, iat: now, exp: now + ACCESS_TOKEN_TTL_S }, store.secret);
+  const accessToken = signJwt({ iss: base, aud: resource, sub: "owner", scope, iat: now, exp: now + ACCESS_TOKEN_TTL_S }, signingSecret());
   const refreshToken = randomBytes(32).toString("base64url");
   store.refresh[refreshToken] = { clientId, resource, scope, expiresAt: Date.now() + REFRESH_TOKEN_TTL_MS };
   saveStore();
@@ -28722,7 +28824,7 @@ function createServer(origin = null) {
   const s = new McpServer({
     name: "BrainLLM",
     title: "BrainLLM",
-    version: "12.4.0",
+    version: "12.4.2",
     icons: brandingIcons(origin)
   });
   registerTools(s, trilium, brainRef);
@@ -28761,8 +28863,11 @@ if (port) {
     "Strict-Transport-Security": "max-age=31536000; includeSubDomains"
   };
   const withCors = (res) => {
-    for (const [k, v] of Object.entries({ ...CORS_HEADERS, ...SECURITY_HEADERS }))
+    for (const [k, v] of Object.entries({ ...CORS_HEADERS, ...SECURITY_HEADERS })) {
+      if (k === "Content-Security-Policy" && res.headers.has(k))
+        continue;
       res.headers.set(k, v);
+    }
     return res;
   };
   const rateLimiters = {
@@ -28872,12 +28977,14 @@ if (port) {
           return withCors(await handleRegister(req));
         }
       }
-      if (url.pathname === "/") {
+      const rootMcpRequest = url.pathname === "/" && (req.method !== "GET" || req.headers.has("mcp-session-id") || req.headers.has("mcp-protocol-version") || (req.headers.get("accept") ?? "").includes("application/json") || (req.headers.get("accept") ?? "").includes("text/event-stream"));
+      if (url.pathname === "/" && !rootMcpRequest) {
         return withCors(new Response(landingPage(base, oauthOn, true), {
           headers: { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" }
         }));
       }
-      if (url.pathname !== "/mcp" && url.pathname !== "/sse" && url.pathname !== "/messages") {
+      const isMcpEndpoint = url.pathname === "/mcp" || rootMcpRequest;
+      if (!isMcpEndpoint && url.pathname !== "/sse" && url.pathname !== "/messages") {
         return withCors(new Response("Not Found", { status: 404 }));
       }
       const transportLimit = rateLimited(rateLimiters.transport, requestKey);

package/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": "0.3",
   "name": "brainllm",
   "display_name": "BrainLLM",
-  "version": "12.4.0",
+  "version": "12.4.2",
   "description": "Turns TriliumNext Notes into a persistent, graph-structured second brain for Claude and other LLM clients.",
   "long_description": "BrainLLM is an MCP server that organises memory into five purpose-built areas (Master, LLM, Memory, Knowledge, Insights). The model supplies content while the server owns placement, format, lifecycle, dates and backups. Includes a full raw ETAPI surface for advanced use. Requires a running TriliumNext instance and the Bun runtime.",
   "author": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brainllm",
-  "version": "12.4.0",
+  "version": "12.4.2",
   "mcpName": "io.github.miisodev/brainllm",
   "description": "MCP server that turns TriliumNext Notes into a persistent, graph-structured second brain for Claude and other LLM clients.",
   "author": "Kevin Miiso Novo <miisodev@gmail.com>",

package/server.json

@@ -2,7 +2,7 @@
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.miisodev/brainllm",
   "description": "Persistent graph-structured memory for LLMs in TriliumNext Notes — readable and editable by humans.",
-  "version": "12.4.0",
+  "version": "12.4.2",
   "websiteUrl": "https://github.com/miisodev/BrainLLM#readme",
   "repository": {
     "url": "https://github.com/miisodev/BrainLLM",
@@ -12,7 +12,7 @@
     {
       "registryType": "npm",
       "identifier": "brainllm",
-"version": "12.4.0",
+"version": "12.4.2",
       "transport": {
         "type": "stdio"
       },