mcp-memory-bucket 0.10.2 → 0.10.4

package/dist/client/index.html

@@ -33,7 +33,7 @@
       z-index: 2147483000;
     }
   </style>
-  <script type="module" crossorigin src="/assets/index-DXX4Dusv.js"></script>
+  <script type="module" crossorigin src="/assets/index-ARgjrRA4.js"></script>
 </head>
 <body>
   <mem-bucket-app></mem-bucket-app>

package/dist/src/attachments/repository.js

@@ -23,10 +23,34 @@ export class AttachmentRepository {
             await this.skillRepo.update(docIdOrName, { attachments });
         }
     }
+    /**
+     * Pushes an attachment's binary content to folderfoo if the doc lives in a remote folder —
+     * no-op for a local folder (both repos' pushAttachmentIfNeeded already guard on that). Callers
+     * must roll back their own local file write if this throws, same as skill/memory create() rolls
+     * back its own file on a failed remote push.
+     */
+    async pushAttachmentToRemoteIfNeeded(kind, folder, filePath, mimeType) {
+        if (kind === 'memory') {
+            await this.memoryRepo.pushAttachmentIfNeeded(folder, filePath, mimeType);
+        }
+        else {
+            await this.skillRepo.pushAttachmentIfNeeded(folder, filePath, mimeType);
+        }
+    }
     async add(kind, docIdOrName, filename, data) {
         const doc = await this.getDoc(kind, docIdOrName);
         const dir = attachmentsDirFor(doc.source_path, kind);
         const entry = writeAttachmentFile(dir, filename, data);
+        try {
+            await this.pushAttachmentToRemoteIfNeeded(kind, doc.folder, path.join(dir, entry.filename), entry.mime_type);
+        }
+        catch (err) {
+            // Mirrors create()'s rollback: remote push failed after the local mirror file was already
+            // written — remove the orphaned local file rather than leaving it registered as if it were
+            // already synced remotely.
+            fs.rmSync(path.join(dir, entry.filename), { force: true });
+            throw err;
+        }
         const existing = doc.attachments ?? [];
         await this.saveAttachmentsList(kind, docIdOrName, [...existing, entry]);
         return entry;
@@ -44,6 +68,7 @@ export class AttachmentRepository {
         const safePath = resolveWithinBase(dir, undefined, filename);
         fs.rmSync(safePath, { force: true });
         const written = writeAttachmentFile(dir, filename, data);
+        await this.pushAttachmentToRemoteIfNeeded(kind, doc.folder, path.join(dir, written.filename), written.mime_type);
         // Full replace: preserve position, overwrite metadata for this filename entry.
         const next = (doc.attachments ?? []).map((a) => (a.filename === filename ? written : a));
         await this.saveAttachmentsList(kind, docIdOrName, next);
@@ -54,6 +79,10 @@ export class AttachmentRepository {
         const dir = attachmentsDirFor(doc.source_path, kind);
         const safePath = resolveWithinBase(dir, undefined, filename);
         fs.rmSync(safePath, { force: true });
+        // Does NOT delete the corresponding file on folderfoo — there is no delete endpoint in
+        // folderfoo-client.ts, matching the same already-flagged gap on skill/memory doc rename/delete
+        // (see SkillRepository.rename()/remove() doc comments). A removed attachment leaves a stale
+        // copy on the remote source until folderfoo itself gains a delete API.
         const next = (doc.attachments ?? []).filter((a) => a.filename !== filename);
         await this.saveAttachmentsList(kind, docIdOrName, next);
         if (listAttachmentFiles(dir).length === 0) {

package/dist/src/attachments/storage.js

@@ -32,8 +32,30 @@ const MIME_BY_EXT = {
     '.pdf': 'application/pdf',
     '.csv': 'text/csv',
 };
+// Extensions whose content isn't meaningfully viewable as text, so an unrecognized one among
+// these should stay application/octet-stream rather than fall through to the text/plain default
+// below — a spreadsheet or archive rendered as raw bytes in the inline preview is just noise;
+// better to leave that preview blank and let the download button be the escape hatch.
+const BINARY_EXTENSIONS = new Set([
+    '.zip', '.tar', '.gz', '.tgz', '.rar', '.7z',
+    '.exe', '.dll', '.so', '.dylib', '.wasm', '.bin', '.class', '.jar',
+    '.doc', '.docx', '.xls', '.xlsx', '.ppt', '.pptx',
+    '.mp3', '.mp4', '.mov', '.avi', '.wav', '.ogg',
+    '.woff', '.woff2', '.ttf', '.otf', '.eot',
+    '.db', '.sqlite', '.ico',
+]);
+/**
+ * Attachments on skills/memory docs are overwhelmingly source/config/template files (the
+ * generate-crud-entity-from-plop-templates skill's .hbs templates are a typical example) —
+ * extensions with no dedicated MIME_BY_EXT entry default to text/plain so the inline preview
+ * (src/web/routes.ts's /view route) can actually render them, instead of application/octet-stream
+ * which browsers show as a blank iframe. Recognized binary formats stay opaque via BINARY_EXTENSIONS.
+ */
 export function guessMimeType(filename) {
-    return MIME_BY_EXT[path.extname(filename).toLowerCase()] ?? 'application/octet-stream';
+    const ext = path.extname(filename).toLowerCase();
+    if (MIME_BY_EXT[ext])
+        return MIME_BY_EXT[ext];
+    return BINARY_EXTENSIONS.has(ext) ? 'application/octet-stream' : 'text/plain';
 }
 function uniqueFilename(dir, filename) {
     // Validate that the filename doesn't escape the directory

package/dist/src/memory/repository.js

@@ -11,7 +11,7 @@ import { applyBodyEdits } from '../shared/body-edits.js';
 import { attachmentsDirFor } from '../attachments/storage.js';
 import { rebaseFolderPath } from '../config.js';
 import { normalizeKey } from '../types.js';
-import { readFile as readRemoteFile, writeFile as writeRemoteFile, joinRemoteFolderPath, assertRemoteFolderExists } from '../remote/folderfoo-client.js';
+import { readFile as readRemoteFile, writeFile as writeRemoteFile, writeBinaryFile as writeRemoteBinaryFile, joinRemoteFolderPath, assertRemoteFolderExists } from '../remote/folderfoo-client.js';
 import { isFolderVisible } from '../remote/identity.js';
 /** Uppercases and strips everything but letters/digits — used to compare keys that differ only in
  * punctuation/whitespace formatting (e.g. `RMXS-15` and `RMXS15` strip to the same `RMXS15`). */
@@ -73,6 +73,24 @@ export class MemoryRepository {
         const identity = this.identity.current();
         return this.remoteFolders.filter((f) => !isFolderVisible(f, identity)).map((f) => f.name);
     }
+    /**
+     * Pushes one attachment file's raw binary content to folderfoo, if `folderName` resolves to a
+     * remote source — the attachment counterpart to create()/update()'s inline remote-write blocks.
+     * Pushed under the attachment's own actual filename (unlike the doc's own .md file, which is
+     * pushed under its id with the .md suffix stripped). No-op for a local folder. Called by
+     * AttachmentRepository after it writes an attachment to the local mirror — callers must roll
+     * back the local write on a thrown error here, exactly like create() already rolls back its own
+     * .md file on a failed push.
+     */
+    async pushAttachmentIfNeeded(folderName, attachmentFilePath, mimeType) {
+        const remote = this.remoteFor(folderName);
+        if (!remote || !this.credentialsBaseDir)
+            return;
+        await assertRemoteFolderExists(remote.server, this.credentialsBaseDir, remote.tenantId, remote.folderPath, folderName);
+        const dirRelPath = joinRemoteFolderPath(remote.folderPath, path.relative(remote.mirrorDir, path.dirname(attachmentFilePath)));
+        const data = fs.readFileSync(attachmentFilePath);
+        await writeRemoteBinaryFile(remote.server, this.credentialsBaseDir, remote.tenantId, dirRelPath, path.basename(attachmentFilePath), data, mimeType);
+    }
     /** Attaches the live chokidar watcher so addFolder/removeFolder can mutate it without a restart. */
     setWatcher(watcher) {
         this.watcher = watcher;

package/dist/src/remote/folderfoo-client.js

@@ -172,3 +172,25 @@ export async function writeFile(server, baseDir, tenantId, folderPath, name, con
         body: content,
     }), async () => undefined);
 }
+/**
+ * Writes one file's raw BINARY content via POST /save/:filename — the attachment-file counterpart
+ * to writeFile's markdown-string upload. Same endpoint, same auth/retry wrapper, just a Buffer body
+ * and the attachment's own mime type instead of a fixed text/markdown content-type.
+ *
+ * NOT YET LIVE-VERIFIED against folderfoo: memory doc ids are deliberately stripped of hyphens
+ * before ever reaching writeFile's `name` param, per a confirmed-in-production finding that
+ * folderfoo's save endpoint silently drops non-[0-9a-zA-Z_] characters from the final filename
+ * segment. Attachment filenames routinely contain dots and hyphens (e.g. "entity.java.hbs") that
+ * this same stripping would mangle if it applies uniformly here too. This function intentionally
+ * does NOT pre-sanitize the name (unlike memory ids) because that behavior hasn't been confirmed
+ * for this endpoint/content-type combination from this client alone — verify with a real round-trip
+ * (attach a dotted/hyphenated filename to a doc in a remote folder, then check the folderfoo UI
+ * shows it unmangled) before relying on this for anything beyond best-effort.
+ */
+export async function writeBinaryFile(server, baseDir, tenantId, folderPath, name, data, mimeType) {
+    await withAuth(server, baseDir, (jwt) => fetch(`${server}/save/${filenameParam(folderPath, name)}`, {
+        method: 'POST',
+        headers: { authorization: `Bearer ${jwt}`, 'x-tenant-id': tenantId, 'content-type': mimeType },
+        body: data,
+    }), async () => undefined);
+}

package/dist/src/skills/repository.js

@@ -8,7 +8,7 @@ import { upsertFile, removeFile, scanSingleFolder, unregisterFolder, skillSyncSp
 import { SearchQueryError, sanitizeFtsQuery } from '../store/search.js';
 import { applyBodyEdits } from '../shared/body-edits.js';
 import { rebaseFolderPath } from '../config.js';
-import { readFile as readRemoteFile, writeFile as writeRemoteFile, joinRemoteFolderPath, assertRemoteFolderExists } from '../remote/folderfoo-client.js';
+import { readFile as readRemoteFile, writeFile as writeRemoteFile, writeBinaryFile as writeRemoteBinaryFile, joinRemoteFolderPath, assertRemoteFolderExists } from '../remote/folderfoo-client.js';
 import { isFolderVisible } from '../remote/identity.js';
 function rowToDoc(row) {
     return {
@@ -81,6 +81,24 @@ export class SkillRepository {
         const fileContents = fs.readFileSync(filePath, 'utf-8');
         await writeRemoteFile(remote.server, this.credentialsBaseDir, remote.tenantId, skillDirRelPath, 'SKILL', fileContents);
     }
+    /**
+     * Pushes one attachment file's raw binary content to folderfoo, if `folderName` resolves to a
+     * remote source — the attachment counterpart to pushToRemoteIfNeeded. Unlike SKILL.md (always
+     * pushed under the fixed name 'SKILL'), an attachment is pushed under its own actual filename,
+     * since folderfoo needs to store each attachment as a distinct file. No-op for a local folder,
+     * same as pushToRemoteIfNeeded. Called by AttachmentRepository after it writes an attachment to
+     * the local mirror — callers must roll back the local write on a thrown error here, exactly like
+     * create()/update() already roll back SKILL.md on a failed push.
+     */
+    async pushAttachmentIfNeeded(folderName, attachmentFilePath, mimeType) {
+        const remote = this.remoteFor(folderName);
+        if (!remote || !this.credentialsBaseDir)
+            return;
+        await assertRemoteFolderExists(remote.server, this.credentialsBaseDir, remote.tenantId, remote.folderPath, folderName);
+        const dirRelPath = joinRemoteFolderPath(remote.folderPath, path.relative(remote.mirrorDir, path.dirname(attachmentFilePath)));
+        const data = fs.readFileSync(attachmentFilePath);
+        await writeRemoteBinaryFile(remote.server, this.credentialsBaseDir, remote.tenantId, dirRelPath, path.basename(attachmentFilePath), data, mimeType);
+    }
     /** Attaches the live chokidar watcher so addFolder/removeFolder can mutate it without a restart. */
     setWatcher(watcher) {
         this.watcher = watcher;

package/dist/src/web/routes.js

@@ -19,6 +19,43 @@ function asArray(v) {
         return [];
     return Array.isArray(v) ? v.map(String) : [String(v)];
 }
+function isTextishMime(mimeType) {
+    return mimeType.startsWith('text/') || mimeType === 'application/json' || mimeType === 'application/xml';
+}
+function escapeHtml(s) {
+    return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+}
+/**
+ * Colors mirror public/index.html's --bg-subtle/--fg light-dark() pairs (composited over --bg,
+ * since this shell has no ambient page to layer a translucent --bg-subtle over) so a text
+ * attachment's inline preview reads as part of the same surface as the detail panel around it,
+ * in both the app's manual theme override and the OS-level default.
+ */
+function renderTextAttachmentPage(content, theme) {
+    return `<!doctype html>
+<html data-theme="${theme}">
+<head>
+<meta charset="utf-8">
+<style>
+  :root { color-scheme: light dark; }
+  :root[data-theme='light'] { color-scheme: light; }
+  :root[data-theme='dark'] { color-scheme: dark; }
+  html, body { margin: 0; }
+  body { background: light-dark(#f7f7f7, #262626); color: light-dark(#111111, #f0f0f0); }
+  pre {
+    margin: 0;
+    padding: 12px;
+    white-space: pre-wrap;
+    word-break: break-word;
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    font-size: 12px;
+    line-height: 1.5;
+  }
+</style>
+</head>
+<body><pre>${escapeHtml(content)}</pre></body>
+</html>`;
+}
 function tagWhereClause(tags) {
     if (tags.length === 0)
         return { clause: '', params: [] };
@@ -450,7 +487,30 @@ export function buildWebRouter(db, config, skillRepo, memoryRepo, skillSpec, mem
             return;
         }
         res.setHeader('Content-Security-Policy', "sandbox; default-src 'none'; style-src 'unsafe-inline'; img-src *");
-        res.setHeader('Content-Type', guessMimeType(filename));
+        const mimeType = guessMimeType(filename);
+        // The client's detail-panel embeds this route in an <iframe> sized/backgrounded to match its
+        // own light/dark theme (see .attachment-frame in detail-panel.ts) — but a plain text/JSON/XML
+        // file sent as-is renders through the browser's own raw-text viewer, which is always
+        // white-on-black-text regardless of that surrounding theme. Wrapping it in a tiny themed HTML
+        // shell (same color-scheme/data-theme pattern as public/index.html, so a manual light/dark
+        // pick in the app is honored, not just the OS preference) fixes that mismatch. Images/PDFs/etc.
+        // are unaffected — the browser's native viewer for those is used as-is.
+        if (isTextishMime(mimeType)) {
+            let content;
+            try {
+                content = fs.readFileSync(filePath, 'utf-8');
+            }
+            catch {
+                res.status(404).json({ error: 'attachment not found' });
+                return;
+            }
+            const theme = req.query.theme === 'light' || req.query.theme === 'dark' ? req.query.theme : '';
+            res.setHeader('Content-Type', 'text/html; charset=utf-8');
+            res.setHeader('Content-Disposition', `inline; filename="${encodeURIComponent(filename)}"`);
+            res.send(renderTextAttachmentPage(content, theme));
+            return;
+        }
+        res.setHeader('Content-Type', mimeType);
         res.setHeader('Content-Disposition', `inline; filename="${encodeURIComponent(filename)}"`);
         res.sendFile(filePath, (err) => {
             if (err && !res.headersSent) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-memory-bucket",
-  "version": "0.10.2",
+  "version": "0.10.4",
   "type": "module",
   "description": "MCP server exposing skill_* (reusable coding patterns) and memory_* (point-in-time working context) tools over a markdown+frontmatter source, cached into SQLite at runtime.",
   "repository": {