claude-code-memory-explorer 0.15.0 → 0.16.0

package/lib/net-guard.js

@@ -245,7 +245,7 @@ function createNetGuard(config = {}) {
    * @param {{maxHeaderSize?: number, onUpgrade?: (req: any, socket: any, head: Buffer) => void}} [opts]
    */
   function listenLoopback(app, port, onReady, opts = {}) {
-    const http = require('http');
+    const http = require('node:http');
     const serverOpts = opts.maxHeaderSize ? { maxHeaderSize: opts.maxHeaderSize } : {};
     const makeServer = (handler) => {
       const s = http.createServer(serverOpts, handler);

package/lib/open-editor.js

@@ -21,9 +21,9 @@
 // npm packages and cannot import from each other. Run scripts/sync-security-lib.sh
 // after editing.
 
-const { spawn } = require('child_process');
-const path = require('path');
-const fs = require('fs');
+const { spawn } = require('node:child_process');
+const path = require('node:path');
+const fs = require('node:fs');
 
 const IS_WIN = process.platform === 'win32';
 
@@ -37,6 +37,7 @@ const VSCODE_FAMILY = new Set([
 // escape it. Inside "..." cmd treats & | < > ^ ( ) as literal, so only these
 // matter: '"' ends the quoted run, '%' triggers variable expansion whose value
 // could itself contain a quote. Neither is legal in an NTFS path anyway.
+// biome-ignore lint/suspicious/noControlCharactersInRegex: NUL is one of the rejected characters
 const WIN_CMD_FORBIDDEN = /["%\r\n\u0000]/;
 
 function fail(message, status) {
@@ -168,6 +169,7 @@ function resolveEditor() {
  */
 function assertOpenTarget(value, label = 'path') {
   if (typeof value !== 'string' || !value.trim()) throw fail(`${label} must be a non-empty string`, 400);
+  // biome-ignore lint/suspicious/noControlCharactersInRegex: NUL is one of the rejected characters
   if (/[\r\n\u0000]/.test(value)) throw fail(`${label} contains invalid characters`, 400);
   const resolved = path.resolve(value);
   if (!fs.existsSync(resolved)) throw fail(`${label} does not exist`, 404);

package/package.json

@@ -1,8 +1,9 @@
 {
   "name": "claude-code-memory-explorer",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Memory explorer dashboard for Claude Code",
   "main": "server.js",
+  "type": "commonjs",
   "bin": {
     "claude-code-memory-explorer": "server.js"
   },

package/public/app.js

@@ -2147,24 +2147,36 @@ document.addEventListener('keydown', (e) => {
   // 'π'), so the key alone cannot identify the binding. The hub owns the keymap and normalizes;
   // these tests only decide whether a press is the hub's to handle.
   document.addEventListener('keydown', (e) => {
-    const fwd = () => {
-      e.preventDefault();
-      hubPost({ type: 'hub:keydown', key: e.key, code: e.code, ctrl: e.ctrlKey, alt: e.altKey, shift: e.shiftKey });
-    };
-    if (e.ctrlKey && e.altKey && (e.key === 'ArrowLeft' || e.key === 'ArrowRight')) {
-      fwd();
-    }
-    // Own branch: the Alt+digit case below requires !ctrlKey. The hub owns the Ctrl+Alt+letter
-    // keymap and ignores unbound letters.
-    if (e.ctrlKey && e.altKey && !e.shiftKey && !e.metaKey && (/^[a-z]$/i.test(e.key) || /^Key[A-Z]$/.test(e.code))) {
-      fwd();
-    }
-    if (e.altKey && !e.ctrlKey && !e.shiftKey && !e.metaKey && (/^[1-9]$/.test(e.key) || /^Digit[1-9]$/.test(e.code))) {
-      fwd();
-    }
+    if (!isHubKey(e)) return;
+    e.preventDefault();
+    hubPost({ type: 'hub:keydown', key: e.key, code: e.code, ctrl: e.ctrlKey, alt: e.altKey, shift: e.shiftKey });
   });
 })();
 
+// The combos the hub binds, from its hub:keys message. Null until one arrives: a hub from before
+// hub:keys sends none, and the fallback filter below is what such a hub expects.
+let hubKeys = null;
+
+// A copy of the hub's comboOf(): its names must match the hub:keys list.
+function hubCombo(e) {
+  const lower = (e.key || '').toLowerCase();
+  const m = /^(?:Key|Digit)([A-Z1-9])$/.exec(e.code || '');
+  const key = /^[a-z1-9]$/.test(lower) ? lower : m ? m[1].toLowerCase() : e.key;
+  const mods = [e.ctrlKey && 'ctrl', e.altKey && 'alt', e.shiftKey && 'shift', e.metaKey && 'meta'];
+  return [...mods, key].filter(Boolean).join('+');
+}
+
+function isHubKey(e) {
+  if (hubKeys) return hubKeys.has(hubCombo(e));
+  if (e.ctrlKey && e.altKey && (e.key === 'ArrowLeft' || e.key === 'ArrowRight')) return true;
+  // Own branch: the Alt+digit case below requires !ctrlKey. The hub owns the Ctrl+Alt+letter
+  // keymap and ignores unbound letters.
+  if (e.ctrlKey && e.altKey && !e.shiftKey && !e.metaKey && (/^[a-z]$/i.test(e.key) || /^Key[A-Z]$/.test(e.code))) {
+    return true;
+  }
+  return e.altKey && !e.ctrlKey && !e.shiftKey && !e.metaKey && (/^[1-9]$/.test(e.key) || /^Digit[1-9]$/.test(e.code));
+}
+
 function _hubNavigate(app, url) {
   if (!window.__HUB__?.enabled) return;
   hubPost({ type: 'hub:navigate', app, url });
@@ -2212,6 +2224,14 @@ function hubPost(message) {
   });
 })();
 
+(function initHubKeys() {
+  window.addEventListener('message', (e) => {
+    if (e.source !== window.parent || e.origin !== hubOrigin()) return;
+    if (e.data?.type !== 'hub:keys' || !Array.isArray(e.data.keys)) return;
+    hubKeys = new Set(e.data.keys.filter((k) => typeof k === 'string'));
+  });
+})();
+
 // Set synchronously when the hub pushes a project, so the DOMContentLoaded restore below can't
 // let a stale localStorage recent win the race against the hub's choice.
 let hubProjectPath = null;

package/server.js

@@ -2,11 +2,11 @@
 'use strict';
 
 const express = require('express');
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-const { execFileSync, spawn } = require('child_process');
-const crypto = require('crypto');
+const path = require('node:path');
+const fs = require('node:fs');
+const os = require('node:os');
+const { execFileSync, spawn } = require('node:child_process');
+const crypto = require('node:crypto');
 const { assertOpenTarget, openInEditor } = require('./lib/open-editor');
 const { createNetGuard } = require('./lib/net-guard');
 
@@ -156,8 +156,7 @@ function parseImports(content) {
   const softLinks = [];
   // Match @path/to/file.ext — must contain / or \ to be a file path import
   const re = /@(~?[\w./-]+\/[\w./-]+|~\/[\w./-]+)/g;
-  let m;
-  while ((m = re.exec(content)) !== null) {
+  for (const m of content.matchAll(re)) {
     if (m[1].includes('.') && !m[1].includes('/')) continue;
     // Skip npm scoped packages (e.g. @biomejs/biome) — require file extension in last segment
     const lastSeg = m[1].split('/').pop();
@@ -166,12 +165,12 @@ function parseImports(content) {
   }
   // Also match standalone @filename.md references (no path separator needed)
   const re2 = /(?:^|\s)@([\w-]+\.md)\b/gm;
-  while ((m = re2.exec(content)) !== null) {
+  for (const m of content.matchAll(re2)) {
     if (!imports.includes(m[1])) imports.push(m[1]);
   }
   // Match markdown links [text](path.md) — soft references, don't change load type
   const re3 = /\[.*?\]\(((?!https?:\/\/)[^)]+\.md)\)/g;
-  while ((m = re3.exec(content)) !== null) {
+  for (const m of content.matchAll(re3)) {
     if (!imports.includes(m[1]) && !softLinks.includes(m[1])) softLinks.push(m[1]);
   }
   return { imports, softLinks };
@@ -216,7 +215,7 @@ function spreadImports(filePath, content) {
 }
 
 function hasPathsFilter(frontmatter) {
-  if (!frontmatter || !frontmatter.paths) return false;
+  if (!frontmatter?.paths) return false;
   return Array.isArray(frontmatter.paths) ? frontmatter.paths.length > 0 : true;
 }
 
@@ -1343,7 +1342,7 @@ app.get('/api/rules/match', (req, res) => {
   if (!filePath) return res.status(400).json({ error: 'file query param required' });
   const rules = getStack().filter(s => s.scope === 'rule');
   const matched = rules.filter(r => {
-    if (!r.frontmatter || !r.frontmatter.paths) return true;
+    if (!r.frontmatter?.paths) return true;
     const patterns = Array.isArray(r.frontmatter.paths) ? r.frontmatter.paths : [r.frontmatter.paths];
     return micromatch.isMatch(filePath, patterns);
   });