mcp-memory-bucket 0.5.4 → 0.6.0

package/dist/src/web/routes.js

@@ -4,7 +4,11 @@ import path from 'node:path';
 import express from 'express';
 import matter from 'gray-matter';
 import { saveFolder, removeFolder as removeFolderFromConfig, sanitizeFolderName } from '../config.js';
+import { stripKey } from '../memory/repository.js';
 import { initialScan } from '../store/sync.js';
+import { sanitizeFtsQuery } from '../store/search.js';
+import { resolveWithinBase } from '../store/safe-path.js';
+import { attachmentsDirFor } from '../attachments/storage.js';
 function asArray(v) {
     if (v === undefined)
         return [];
@@ -16,7 +20,7 @@ function tagWhereClause(tags) {
     const clauses = tags.map(() => `EXISTS (SELECT 1 FROM json_each(tags) WHERE value = ?)`);
     return { clause: ` AND ${clauses.join(' AND ')}`, params: tags };
 }
-function queryEntries(db, req) {
+function queryEntries(db, memoryRepo, req) {
     const type = req.query.type ?? 'all';
     const tags = asArray(req.query.tag);
     const statuses = asArray(req.query.status);
@@ -31,10 +35,15 @@ function queryEntries(db, req) {
     const paused = pausedParam === '0' || pausedParam === '1' ? pausedParam : undefined;
     const dateFrom = req.query.date_from?.trim() || undefined;
     const dateTo = req.query.date_to?.trim() || undefined;
-    const matchedIds = q
-        ? matchSearch(db, q)
-        : null;
-    if (q && matchedIds && matchedIds.skills.size === 0 && matchedIds.memory_docs.size === 0) {
+    // If the typed query matches an existing key (ignoring punctuation/case), short-circuit straight
+    // to "every doc under this key" for memory_docs — this bypasses FTS/bm25 ranking entirely, so a
+    // doc whose body never repeats the literal key text (e.g. a session summary) still shows up.
+    // Skills have no `key` concept, so they still go through the normal FTS path below when q is set.
+    const keyMatch = q ? memoryRepo.suggestKeys(q, 1).find((m) => stripKey(m.key) === stripKey(q)) : undefined;
+    // Always compute FTS matches when q is set, even on a keyMatch — skills still need this to stay
+    // filtered by q (they have no key concept, so keyMatch only bypasses filtering for memory_docs below).
+    const matchedIds = q ? matchSearch(db, q) : null;
+    if (q && !keyMatch && matchedIds && matchedIds.skills.size === 0 && matchedIds.memory_docs.size === 0) {
         return [];
     }
     const dateIds = dateFrom || dateTo ? matchDateRange(db, dateFrom, dateTo) : null;
@@ -43,10 +52,10 @@ function queryEntries(db, req) {
     }
     const results = [];
     if (type === 'skill' || type === 'all') {
-        results.push(...queryTable(db, 'skills', { tags, statuses, owners, docTypes: [], keyTypes: [], folders, deprecated, paused }, intersectIds(matchedIds?.skills, dateIds?.skills)));
+        results.push(...queryTable(db, 'skills', { tags, statuses, owners, docTypes: [], keyTypes: [], folders, keys: [], deprecated, paused }, intersectIds(matchedIds?.skills, dateIds?.skills)));
     }
     if (type === 'memory' || type === 'all') {
-        results.push(...queryTable(db, 'memory_docs', { tags, statuses, owners: [], docTypes, keyTypes, folders, deprecated, paused }, intersectIds(matchedIds?.memory_docs, dateIds?.memory_docs)));
+        results.push(...queryTable(db, 'memory_docs', { tags, statuses, owners: [], docTypes, keyTypes, folders, deprecated, paused, keys: keyMatch ? [keyMatch.key] : [] }, keyMatch ? undefined : intersectIds(matchedIds?.memory_docs, dateIds?.memory_docs)));
     }
     const sort = req.query.sort ?? 'mtime_desc';
     results.sort((a, b) => {
@@ -91,6 +100,10 @@ function queryTable(db, table, filters, restrictToIds) {
         where += ` AND key_type IN (${filters.keyTypes.map(() => '?').join(', ')})`;
         params.push(...filters.keyTypes);
     }
+    if (table === 'memory_docs' && filters.keys.length > 0) {
+        where += ` AND key IN (${filters.keys.map(() => '?').join(', ')})`;
+        params.push(...filters.keys);
+    }
     if (filters.folders.length > 0) {
         where += ` AND folder IN (${filters.folders.map(() => '?').join(', ')})`;
         params.push(...filters.folders);
@@ -186,7 +199,7 @@ function matchSearch(db, q) {
     try {
         rows = db
             .prepare(`SELECT ref_table, ref_id FROM search_index WHERE search_index MATCH ? ORDER BY rank`)
-            .all(q);
+            .all(sanitizeFtsQuery(q));
     }
     catch {
         // Bad FTS5 query syntax (e.g. a bare quote) — treat as no matches rather than 500ing.
@@ -271,7 +284,7 @@ export function buildWebRouter(db, config, skillRepo, memoryRepo, skillSpec, mem
         }
     });
     router.get('/api/entries', (req, res) => {
-        res.json(queryEntries(db, req));
+        res.json(queryEntries(db, memoryRepo, req));
     });
     router.get('/api/entries/:table/:id', (req, res) => {
         const { table, id } = req.params;
@@ -286,6 +299,7 @@ export function buildWebRouter(db, config, skillRepo, memoryRepo, skillSpec, mem
         }
         const tags = JSON.parse(row.tags);
         const trigger_phrases = row.trigger_phrases ? JSON.parse(row.trigger_phrases) : undefined;
+        const attachments = row.attachments ? JSON.parse(row.attachments) : undefined;
         // A memory doc's cache row always looks fully populated even for a bare file (deriveFrontmatter's
         // fallback backfills id/key/etc — see sync.ts), so whether it actually has an authored
         // frontmatter block has to be checked on disk. This drives "Add frontmatter" (memory only —
@@ -305,7 +319,46 @@ export function buildWebRouter(db, config, skillRepo, memoryRepo, skillSpec, mem
             // file unreadable/missing — treat as having frontmatter so the UI doesn't offer to "add"
             // one for a doc it can't actually reach; the existing edit/delete-doc paths will 404 instead.
         }
-        res.json({ ...row, tags, trigger_phrases, has_frontmatter, raw_file });
+        res.json({ ...row, tags, trigger_phrases, attachments, has_frontmatter, raw_file });
+    });
+    // Serves a single attachment file for a doc. Unauthenticated web-facing surface, so the
+    // filename from the URL is validated with resolveWithinBase (same containment check
+    // attachments/storage.ts uses when writing) to rule out path traversal before touching disk.
+    router.get('/api/entries/:table/:id/attachments/:filename', (req, res) => {
+        const { table, id, filename } = req.params;
+        if (table !== 'skills' && table !== 'memory_docs') {
+            res.status(400).json({ error: 'table must be "skills" or "memory_docs"' });
+            return;
+        }
+        if (!filename) {
+            res.status(400).json({ error: 'filename is required' });
+            return;
+        }
+        const row = db.prepare(`SELECT source_path FROM ${table} WHERE id = ?`).get(id);
+        if (!row) {
+            res.status(404).json({ error: 'not found' });
+            return;
+        }
+        const dir = attachmentsDirFor(row.source_path, table === 'skills' ? 'skill' : 'memory');
+        let filePath;
+        try {
+            filePath = resolveWithinBase(dir, undefined, filename);
+        }
+        catch (err) {
+            res.status(400).json({ error: err.message });
+            return;
+        }
+        // Force a non-executable Content-Type and force-download disposition so a maliciously
+        // named attachment (e.g. "notes.html" with an embedded <script>) can never render inline
+        // in the browser and execute in this origin — Express/sendFile would otherwise infer
+        // Content-Type from the file extension.
+        res.setHeader('Content-Type', 'application/octet-stream');
+        res.setHeader('Content-Disposition', `attachment; filename="${encodeURIComponent(filename)}"`);
+        res.sendFile(filePath, (err) => {
+            if (err && !res.headersSent) {
+                res.status(404).json({ error: 'attachment not found' });
+            }
+        });
     });
     router.patch('/api/entries/:table/:id/deprecated', (req, res) => {
         const { table, id } = req.params;
@@ -491,6 +544,14 @@ export function buildWebRouter(db, config, skillRepo, memoryRepo, skillSpec, mem
         const type = req.query.type ?? 'all';
         res.json(buildFacets(db, type));
     });
+    router.get('/api/keys/suggest', (req, res) => {
+        const q = req.query.q?.trim();
+        if (!q) {
+            res.json([]);
+            return;
+        }
+        res.json(memoryRepo.suggestKeys(q, 8));
+    });
     router.get('/api/health', (_req, res) => {
         res.json(buildHealth(db));
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-memory-bucket",
-  "version": "0.5.4",
+  "version": "0.6.0",
   "type": "module",
   "description": "MCP server exposing skill_* (reusable coding patterns) and memory_* (point-in-time working context) tools over a markdown+frontmatter source, cached into SQLite at runtime.",
   "repository": {