nlm-memory 0.4.1 → 0.5.0

package/plugin/scripts/stop-hook.mjs

@@ -3,7 +3,7 @@
 // src/hook/stop-hook.ts
 import { pathToFileURL } from "node:url";
 import { appendFileSync, mkdirSync as mkdirSync3 } from "node:fs";
-import { homedir as homedir3 } from "node:os";
+import { homedir as homedir4 } from "node:os";
 import { dirname, join as join3 } from "node:path";
 
 // src/core/hook/citation-detect.ts
@@ -162,6 +162,56 @@ function readAllAssistantTurns(transcriptPath) {
   return turns;
 }
 
+// src/llm/env-autoload.ts
+import { readFileSync as readFileSync4, existsSync as existsSync4 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { resolve } from "node:path";
+var DEFAULT_SEARCH_PATHS = [
+  "~/.nlm/.env",
+  "./.env",
+  "../.env",
+  "../../.env"
+];
+function expandHome(p) {
+  if (p.startsWith("~/")) return resolve(homedir3(), p.slice(2));
+  return p;
+}
+function autoloadEnv(extraPaths = []) {
+  const loaded = [];
+  const paths = [...DEFAULT_SEARCH_PATHS, ...extraPaths];
+  for (const raw of paths) {
+    const path = expandHome(raw);
+    if (!existsSync4(path)) continue;
+    try {
+      const content = readFileSync4(path, "utf8");
+      for (const line of content.split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith("#") || !trimmed.includes("=")) continue;
+        const eq = trimmed.indexOf("=");
+        const key = trimmed.slice(0, eq).trim();
+        let value = trimmed.slice(eq + 1).trim();
+        if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+          value = value.slice(1, -1);
+        }
+        if (key && process.env[key] === void 0) {
+          process.env[key] = value;
+        }
+      }
+      loaded.push(path);
+    } catch {
+      continue;
+    }
+  }
+  return loaded;
+}
+
+// src/hook/hook-auth.ts
+function hookAuthHeaders(extra = {}) {
+  const token = process.env["NLM_MCP_TOKEN"];
+  if (!token) return { ...extra };
+  return { ...extra, authorization: `Bearer ${token}` };
+}
+
 // src/hook/stop-hook.ts
 var RESPONSE_PREVIEW_CHARS = 200;
 var POST_TIMEOUT_MS = 1500;
@@ -229,7 +279,7 @@ async function runStopHook(input, deps) {
   };
 }
 function logPath() {
-  return process.env["NLM_HOOK_LOG"] ?? join3(homedir3(), ".nlm", "hook-log.jsonl");
+  return process.env["NLM_HOOK_LOG"] ?? join3(homedir4(), ".nlm", "hook-log.jsonl");
 }
 function logStopResult(result) {
   try {
@@ -254,12 +304,12 @@ function logStopResult(result) {
   }
 }
 function readStdin() {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     let data = "";
     process.stdin.setEncoding("utf8");
     process.stdin.on("data", (chunk) => data += chunk);
-    process.stdin.on("end", () => resolve(data));
-    process.stdin.on("error", () => resolve(data));
+    process.stdin.on("end", () => resolve2(data));
+    process.stdin.on("error", () => resolve2(data));
   });
 }
 async function postCitationOverHttp(conversationId, citedId, kind, responsePreview) {
@@ -270,7 +320,7 @@ async function postCitationOverHttp(conversationId, citedId, kind, responsePrevi
   try {
     await fetch(url, {
       method: "POST",
-      headers: { "content-type": "application/json" },
+      headers: hookAuthHeaders({ "content-type": "application/json" }),
       body: JSON.stringify({
         conversation_id: conversationId,
         cited_id: citedId,
@@ -285,6 +335,7 @@ async function postCitationOverHttp(conversationId, citedId, kind, responsePrevi
 }
 async function main() {
   try {
+    autoloadEnv();
     const raw = await readStdin();
     const payload = JSON.parse(raw);
     const conversationId = typeof payload.session_id === "string" ? payload.session_id : "unknown";

package/src/cli/nlm.ts

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 import { dirname, resolve, join } from "node:path";
 import { homedir } from "node:os";
 import { mkdirSync, writeFileSync, existsSync, rmSync } from "node:fs";
-import { execFileSync } from "node:child_process";
+import { execFileSync, spawnSync } from "node:child_process";
 import { Command } from "commander";
 import { serve } from "@hono/node-server";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -51,9 +51,13 @@ import {
   disconnectCodex,
   pluginScriptsDir,
 } from "../install/codex.js";
-import { connectClaudeCode, disconnectClaudeCode, installClaudeCodeHooks } from "../install/claude-code.js";
+import { connectClaudeCode, disconnectClaudeCode, installClaudeCodeHooks, mcpConfigPath } from "../install/claude-code.js";
+import { hardenNlmDirPermissions } from "../install/nlm-dir-perms.js";
+import { ensureMcpToken } from "../install/ollama.js";
+import { connectCursor, disconnectCursor } from "../install/cursor.js";
 import { connectHermes, disconnectHermes, hermesConfigPath } from "../install/hermes.js";
 import { connectHermesAgent, disconnectHermesAgent, hermesAgentPluginDir } from "../install/hermes-agent.js";
+import { connectWindsurf, disconnectWindsurf } from "../install/windsurf.js";
 import { runSetup } from "../install/setup.js";
 import { runParity } from "./classify-parity.js";
 import { reembedCorpus } from "../core/embedding/embed-backfill.js";
@@ -164,6 +168,13 @@ program
   .option("--no-scheduler", "HTTP only; skip the ingest tick loop")
   .option("--interval-min <n>", "scheduler tick interval (min, default 30)", (v) => Number.parseInt(v, 10), 30)
   .action(async (opts) => {
+    // Self-heal perms on every daemon start. Idempotent. Covers upgrade
+    // path from pre-v0.4.2 installs where ~/.nlm contents were world-readable.
+    hardenNlmDirPermissions();
+    // Generate NLM_MCP_TOKEN if missing so /api/* gets Bearer-protected for
+    // non-browser callers. Idempotent: re-reads persisted token first.
+    autoloadEnv();
+    ensureMcpToken();
     const { store, facts, sources, providers, recall, factRecall, embedder, classifier } = buildStack();
     const { existsSync } = await import("node:fs");
     const hasMcpToken = Boolean(process.env["NLM_MCP_TOKEN"]);
@@ -406,6 +417,40 @@ const LAUNCH_AGENT_PLIST = join(
   homedir(), "Library", "LaunchAgents", `${LAUNCH_AGENT_LABEL}.plist`,
 );
 
+const LINUX_SYSTEMD_UNIT_NAME = "nlm.service";
+const LINUX_SYSTEMD_UNIT_PATH = join(
+  homedir(), ".config", "systemd", "user", LINUX_SYSTEMD_UNIT_NAME,
+);
+
+function buildSystemdUnit(nodeExec: string, nlmJs: string): string {
+  const logDir = join(homedir(), ".nlm", "logs");
+  return `[Unit]
+Description=NLM Memory — local AI session memory daemon
+After=network.target
+
+[Service]
+Type=simple
+ExecStart=${nodeExec} ${nlmJs} start
+WorkingDirectory=${homedir()}
+Restart=on-failure
+RestartSec=10
+StandardOutput=append:${logDir}/daemon-out.log
+StandardError=append:${logDir}/daemon-err.log
+
+[Install]
+WantedBy=default.target
+`;
+}
+
+// systemd user instance needs XDG_RUNTIME_DIR (a real user session) and
+// systemctl --user to respond. Both are missing on headless servers without
+// loginctl enable-linger and in many minimal containers.
+function linuxSystemdUserAvailable(): boolean {
+  if (process.platform !== "linux") return false;
+  if (!process.env["XDG_RUNTIME_DIR"]) return false;
+  return spawnSync("systemctl", ["--user", "--version"], { encoding: "utf8" }).status === 0;
+}
+
 function buildPlist(nodeExec: string, nlmJs: string): string {
   const logDir = join(homedir(), ".nlm", "logs");
   return `<?xml version="1.0" encoding="UTF-8"?>
@@ -444,38 +489,92 @@ function buildPlist(nodeExec: string, nlmJs: string): string {
 
 program
   .command("install")
-  .description("Install the macOS LaunchAgent so nlm-memory auto-starts on login")
+  .description("Install the auto-start daemon (LaunchAgent on macOS, systemd user unit on Linux)")
   .action(() => {
-    if (process.platform !== "darwin") {
-      console.error("nlm install: only macOS is supported. On Linux, add `nlm start` to your init system manually.");
-      process.exit(1);
-    }
-    const uid = process.getuid?.();
-    if (uid === undefined) {
-      console.error("nlm install: could not determine UID");
-      process.exit(1);
+    // Harden before installing the daemon so the persisted unit owner-
+    // checks succeed against locked-down ~/.nlm logs.
+    hardenNlmDirPermissions();
+    if (process.platform === "darwin") {
+      const uid = process.getuid?.();
+      if (uid === undefined) {
+        console.error("nlm install: could not determine UID");
+        process.exit(1);
+      }
+      mkdirSync(join(homedir(), ".nlm", "logs"), { recursive: true });
+      writeFileSync(LAUNCH_AGENT_PLIST, buildPlist(process.execPath, __filename), "utf8");
+      console.error(`nlm: wrote ${LAUNCH_AGENT_PLIST}`);
+      try {
+        execFileSync("launchctl", ["bootout", `gui/${uid}`, LAUNCH_AGENT_LABEL], { stdio: "ignore" });
+      } catch {
+        // not loaded yet — expected on first install
+      }
+      execFileSync("launchctl", ["bootstrap", `gui/${uid}`, LAUNCH_AGENT_PLIST]);
+      console.error("nlm: daemon installed and started.");
+      console.error(`  UI:       http://localhost:${port()}/ui`);
+      console.error(`  To stop:  launchctl stop ${LAUNCH_AGENT_LABEL}`);
+      console.error("  To remove: nlm uninstall");
+      return;
     }
-    mkdirSync(join(homedir(), ".nlm", "logs"), { recursive: true });
-    writeFileSync(LAUNCH_AGENT_PLIST, buildPlist(process.execPath, __filename), "utf8");
-    console.error(`nlm: wrote ${LAUNCH_AGENT_PLIST}`);
-    try {
-      execFileSync("launchctl", ["bootout", `gui/${uid}`, LAUNCH_AGENT_LABEL], { stdio: "ignore" });
-    } catch {
-      // not loaded yet — expected on first install
+
+    if (process.platform === "linux") {
+      if (!linuxSystemdUserAvailable()) {
+        console.error("nlm install: systemd user instance not available.");
+        console.error("  XDG_RUNTIME_DIR missing or `systemctl --user` did not respond.");
+        console.error("  Common on headless servers without an active user session.");
+        console.error("  Start manually with: nlm start &");
+        console.error("  Or enable lingering so user units run without login:");
+        console.error("    sudo loginctl enable-linger $USER");
+        console.error("  Then re-run: nlm install");
+        process.exit(1);
+      }
+      mkdirSync(dirname(LINUX_SYSTEMD_UNIT_PATH), { recursive: true });
+      mkdirSync(join(homedir(), ".nlm", "logs"), { recursive: true });
+      writeFileSync(LINUX_SYSTEMD_UNIT_PATH, buildSystemdUnit(process.execPath, __filename), "utf8");
+      console.error(`nlm: wrote ${LINUX_SYSTEMD_UNIT_PATH}`);
+      execFileSync("systemctl", ["--user", "daemon-reload"]);
+      execFileSync("systemctl", ["--user", "enable", "--now", LINUX_SYSTEMD_UNIT_NAME]);
+      console.error("nlm: daemon installed and started.");
+      console.error(`  UI:        http://localhost:${port()}/ui`);
+      console.error(`  Status:    systemctl --user status ${LINUX_SYSTEMD_UNIT_NAME}`);
+      console.error(`  To stop:   systemctl --user stop ${LINUX_SYSTEMD_UNIT_NAME}`);
+      console.error("  To remove: nlm uninstall");
+      console.error("  Headless? Run `sudo loginctl enable-linger $USER` so the daemon survives logout.");
+      return;
     }
-    execFileSync("launchctl", ["bootstrap", `gui/${uid}`, LAUNCH_AGENT_PLIST]);
-    console.error("nlm: daemon installed and started.");
-    console.error(`  UI:       http://localhost:${port()}/ui`);
-    console.error(`  To stop:  launchctl stop ${LAUNCH_AGENT_LABEL}`);
-    console.error("  To remove: nlm uninstall");
+
+    console.error("nlm install: only macOS and Linux (systemd) are supported.");
+    console.error("  On Windows, run `nlm start` manually or via Task Scheduler.");
+    process.exit(1);
   });
 
 program
   .command("uninstall")
-  .description("Remove the macOS LaunchAgent")
+  .description("Remove the auto-start daemon (LaunchAgent on macOS, systemd user unit on Linux)")
   .action(() => {
+    if (process.platform === "linux") {
+      // Stop + disable, then remove the unit. Idempotent: ignore "not loaded"
+      // errors so re-running uninstall on a half-removed state still finishes.
+      try {
+        execFileSync("systemctl", ["--user", "disable", "--now", LINUX_SYSTEMD_UNIT_NAME], { stdio: "pipe" });
+        console.error(`nlm: stopped and disabled ${LINUX_SYSTEMD_UNIT_NAME}`);
+      } catch {
+        // Unit wasn't loaded — fine, proceed to file cleanup.
+      }
+      if (existsSync(LINUX_SYSTEMD_UNIT_PATH)) {
+        rmSync(LINUX_SYSTEMD_UNIT_PATH);
+        console.error(`nlm: removed ${LINUX_SYSTEMD_UNIT_PATH}`);
+      }
+      try {
+        execFileSync("systemctl", ["--user", "daemon-reload"], { stdio: "pipe" });
+      } catch {
+        // systemd unavailable — file already removed, nothing more to do.
+      }
+      console.error("nlm: uninstalled. Run `nlm install` to reinstall.");
+      return;
+    }
+
     if (process.platform !== "darwin") {
-      console.error("nlm uninstall: only macOS is supported.");
+      console.error("nlm uninstall: only macOS and Linux (systemd) are supported.");
       process.exit(1);
     }
     const uid = process.getuid?.();
@@ -560,7 +659,7 @@ const hook = program
 
 hook
   .command("install")
-  .description("Add the NLM hooks (recall + session-end + stop) to ~/.claude/settings.json (shadow mode)")
+  .description("Add the NLM hooks (recall + session-end + stop) to ~/.claude/settings.json (live mode)")
   .action(() => {
     const path = claudeSettingsPath();
     const hookLogPath = process.env["NLM_HOOK_LOG"] ?? join(homedir(), ".nlm", "hook-log.jsonl");
@@ -571,7 +670,7 @@ hook
     // partial failure is the bug class we shipped #161 to prevent.
     const installed: HookSpec[] = [];
     for (const spec of ALL_HOOKS) {
-      const command = buildHookCommand(process.execPath, spec.script, "shadow");
+      const command = buildHookCommand(process.execPath, spec.script, "live");
       addHook(path, command, spec.event);
       const smoke = smokeTestHookCommand(command, hookLogPath);
       if (!smoke.ok) {
@@ -591,14 +690,14 @@ hook
       installed.push(spec);
     }
 
-    console.error(`nlm: NLM hooks installed in ${path} (shadow mode):`);
+    console.error(`nlm: NLM hooks installed in ${path} (live mode):`);
     for (const spec of installed) {
       console.error(`  - ${spec.event} → ${spec.label}-hook`);
     }
     console.error("  Smoke tests passed — all hooks appended synthetic entries to hook-log.jsonl.");
-    console.error("  Recall hooks log to ~/.nlm/hook-log.jsonl and inject nothing in shadow mode.");
+    console.error("  Recall hooks inject prior-session context on UserPromptSubmit and log to ~/.nlm/hook-log.jsonl.");
     console.error("  Session-end hook cleans up ~/.nlm/hook-state/<session>.json on session close.");
-    console.error("  To go live later: change NLM_HOOK_MODE=shadow to live for the recall hook.");
+    console.error("  To run silently for calibration (no injection): set NLM_HOOK_MODE=shadow in the command.");
     console.error("  To remove: nlm hook uninstall");
   });
 
@@ -680,7 +779,7 @@ connect
   .action((opts) => {
     if (opts.dryRun) {
       console.error("nlm connect claude-code (dry run):");
-      console.error(`  write [mcpServers.nlm-memory] to ${join(homedir(), ".mcp.json")}`);
+      console.error(`  write [mcpServers.nlm-memory] to ${mcpConfigPath()}`);
       if (opts.withHooks) console.error("  install 6 Claude Code hooks");
       return;
     }
@@ -746,6 +845,54 @@ connect
     console.error("  Also run: nlm connect hermes  (to wire the MCP server)");
   });
 
+connect
+  .command("cursor")
+  .description("Register Cursor as an nlm source (reads state.vscdb directly — no files installed)")
+  .option("--db-path <path>", "override path to globalStorage/state.vscdb")
+  .option("--dry-run", "print what would happen without changing files")
+  .action((opts) => {
+    const store = new SqliteSessionStore({ dbPath: dbPath(), migrationsDir: MIGRATIONS_DIR });
+    try {
+      const registry = new SourceRegistry(store.rawDb());
+      const report = connectCursor(registry, {
+        ...(opts.dbPath ? { dbPath: opts.dbPath as string } : {}),
+        dryRun: Boolean(opts.dryRun),
+      });
+      if (opts.dryRun) {
+        console.error(`nlm connect cursor (dry run): register source at ${report.adapterDbPath}${report.adapterExists ? "" : " (not found yet)"}`);
+        return;
+      }
+      const suffix = report.adapterExists ? "" : " (DB not found — will activate when Cursor is installed)";
+      console.error(`nlm: Cursor source ${report.action} → ${report.adapterDbPath}${suffix}`);
+    } finally {
+      store.close();
+    }
+  });
+
+connect
+  .command("windsurf")
+  .description("Register Windsurf as an nlm source (reads state.vscdb files directly — no files installed)")
+  .option("--user-dir <path>", "override path to Windsurf User directory")
+  .option("--dry-run", "print what would happen without changing files")
+  .action((opts) => {
+    const store = new SqliteSessionStore({ dbPath: dbPath(), migrationsDir: MIGRATIONS_DIR });
+    try {
+      const registry = new SourceRegistry(store.rawDb());
+      const report = connectWindsurf(registry, {
+        ...(opts.userDir ? { userDir: opts.userDir as string } : {}),
+        dryRun: Boolean(opts.dryRun),
+      });
+      if (opts.dryRun) {
+        console.error(`nlm connect windsurf (dry run): register source at ${report.userDir}${report.dirExists ? "" : " (not found yet)"}`);
+        return;
+      }
+      const suffix = report.dirExists ? "" : " (User dir not found — will activate when Windsurf is installed)";
+      console.error(`nlm: Windsurf source ${report.action} → ${report.userDir}${suffix}`);
+    } finally {
+      store.close();
+    }
+  });
+
 const disconnect = program
   .command("disconnect")
   .description("Disconnect nlm-memory from an AI coding runtime");
@@ -841,6 +988,48 @@ disconnect
       : `nlm: no plugin directory found at ${report.destDir}`);
   });
 
+disconnect
+  .command("cursor")
+  .description("Disable the Cursor source in the nlm registry (leaves Cursor untouched)")
+  .option("--dry-run", "print what would happen without changing files")
+  .action((opts) => {
+    const store = new SqliteSessionStore({ dbPath: dbPath(), migrationsDir: MIGRATIONS_DIR });
+    try {
+      const registry = new SourceRegistry(store.rawDb());
+      const report = disconnectCursor(registry, { dryRun: Boolean(opts.dryRun) });
+      if (opts.dryRun) {
+        console.error("nlm disconnect cursor (dry run): disable Cursor source in registry");
+        return;
+      }
+      console.error(report.action === "disabled"
+        ? "nlm: Cursor source disabled"
+        : "nlm: no Cursor source found in registry");
+    } finally {
+      store.close();
+    }
+  });
+
+disconnect
+  .command("windsurf")
+  .description("Disable the Windsurf source in the nlm registry (leaves Windsurf untouched)")
+  .option("--dry-run", "print what would happen without changing files")
+  .action((opts) => {
+    const store = new SqliteSessionStore({ dbPath: dbPath(), migrationsDir: MIGRATIONS_DIR });
+    try {
+      const registry = new SourceRegistry(store.rawDb());
+      const report = disconnectWindsurf(registry, { dryRun: Boolean(opts.dryRun) });
+      if (opts.dryRun) {
+        console.error("nlm disconnect windsurf (dry run): disable Windsurf source in registry");
+        return;
+      }
+      console.error(report.action === "disabled"
+        ? "nlm: Windsurf source disabled"
+        : "nlm: no Windsurf source found in registry");
+    } finally {
+      store.close();
+    }
+  });
+
 program
   .command("setup")
   .description("Interactive first-run setup: detect runtimes, wire MCP + hooks, start daemon")
@@ -854,6 +1043,10 @@ program
       launchAgentLabel: LAUNCH_AGENT_LABEL,
       launchAgentPlist: LAUNCH_AGENT_PLIST,
       buildPlist,
+      linuxSystemdUnitName: LINUX_SYSTEMD_UNIT_NAME,
+      linuxSystemdUnitPath: LINUX_SYSTEMD_UNIT_PATH,
+      buildSystemdUnit,
+      linuxSystemdUserAvailable,
       claudeSettingsPath: claudeSettingsPath(),
       allHooks: ALL_HOOKS,
       addHook,