superlocalmemory 3.7.7 → 3.8.0

package/src/superlocalmemory/server/routes/ws.py

@@ -6,11 +6,13 @@
 
 Routes: /ws/updates
 """
+import logging
 from typing import Set
 from datetime import datetime, timezone
 
 from fastapi import APIRouter, WebSocket, WebSocketDisconnect
 
+logger = logging.getLogger("superlocalmemory.routes.ws")
 router = APIRouter()
 
 
@@ -71,10 +73,11 @@ async def websocket_updates(websocket: WebSocket):
 
             except WebSocketDisconnect:
                 break
-            except Exception as e:
+            except Exception:
+                logger.exception("ws route error")
                 await websocket.send_json({
                     "type": "error",
-                    "message": str(e),
+                    "message": "Internal server error",
                     "timestamp": datetime.now(timezone.utc).isoformat(),
                 })
 

package/src/superlocalmemory/server/security_middleware.py

@@ -36,13 +36,20 @@ class SecurityHeadersMiddleware(BaseHTTPMiddleware):
         # Content Security Policy (v3.4.22 — vendored assets, no CDN hosts).
         # All Bootstrap/D3/Sigma/graphology/Inter assets ship locally under
         # /static/vendor/, so we drop every CDN host from the allow-list.
-        # 'unsafe-inline' stays on script-src/style-src for the legacy inline
-        # click handlers in index.html — migrating those to addEventListener
-        # is tracked as a separate backlog item. img-src drops the https:
-        # wildcard now that nothing remote loads.
+        #
+        # v3.7.9 (B2): 'unsafe-inline' removed from script-src. Every inline
+        # on*= event handler was migrated to data-act-* attributes dispatched
+        # by js/event-delegation.js (nonces cannot authorise inline event-
+        # handler attributes, so delegation is the only real fix). A stored-XSS
+        # payload can no longer execute inline script here.
+        # 'unsafe-inline' is retained on style-src only: 82 inline style=
+        # attributes remain, style injection is far lower risk than script
+        # injection, and inline style attributes cannot be nonce'd either
+        # (GitHub/GitLab keep the same script-locked / style-inline posture).
+        # img-src drops the https: wildcard now that nothing remote loads.
         csp_directives = [
             "default-src 'self'",
-            "script-src 'self' 'unsafe-inline'",
+            "script-src 'self'",
             "style-src 'self' 'unsafe-inline'",
             "font-src 'self'",
             "img-src 'self' data:",

package/src/superlocalmemory/server/ui.py

@@ -15,6 +15,16 @@ All route handlers live in routes/ directory:
     routes/events.py    -- /events/stream (SSE), /api/events [v2.5]
     routes/agents.py    -- /api/agents, /api/trust [v2.5]
     routes/ws.py        -- /ws/updates (WebSocket)
+
+v3.7.8 (WS3 F4): ``create_app()`` in this module is a standalone/legacy app
+factory, NOT the app the running daemon serves -- that is
+``superlocalmemory.server.unified_daemon:create_app`` (see that module's
+uvicorn config). This module's ``auth_middleware`` keeps the older,
+unconditional ``check_api_key``-only write gate (no daemon-capability /
+install-token identity layer, no ``SLM_REQUIRE_API_KEY_LOOPBACK`` opt-in --
+see ``infra/auth_middleware.py`` for that). Treat this file as a standalone
+entry point only; the production write-auth boundary lives in
+``unified_daemon.py``.
 """
 
 import logging
@@ -51,11 +61,12 @@ from superlocalmemory.server.security_middleware import SecurityHeadersMiddlewar
 # caused dashboard-created profiles to land in a different memory.db than
 # `slm profile list` reads when a custom data dir was configured.
 from superlocalmemory.server.routes.helpers import MEMORY_DIR, DB_PATH
-# V3.3.21: UI shipped inside the package for pip/npm installs.
-# Check package location first, then fall back to repo root for dev mode.
-_PKG_UI = Path(__file__).resolve().parent.parent / "ui"
-_REPO_UI = Path(__file__).resolve().parent.parent.parent.parent / "ui"
-UI_DIR = _PKG_UI if (_PKG_UI / "index.html").exists() else _REPO_UI
+# V3.3.21+: the dashboard ships inside the package (superlocalmemory/ui) for
+# every install path — pip, npm, and editable checkouts. The legacy repo-root
+# ui/ dev fallback was retired in v3.8.0 when that copy was deleted; the
+# packaged directory is authoritative. A missing dir is surfaced at request
+# time (see the "UI not found" handler below).
+UI_DIR = Path(__file__).resolve().parent.parent / "ui"
 
 
 def create_app() -> FastAPI:
@@ -94,6 +105,16 @@ def create_app() -> FastAPI:
         _write_limiter = RateLimiter(max_requests=_rl_write, window_seconds=_rl_window)
         _read_limiter = RateLimiter(max_requests=_rl_read, window_seconds=_rl_window)
 
+        # Task #47: register for runtime reconfiguration via the dashboard.
+        try:
+            from superlocalmemory.infra.rate_limiter import (
+                register_managed as _reg_rl,
+            )
+            _reg_rl("write", _write_limiter)
+            _reg_rl("read", _read_limiter)
+        except Exception:
+            pass
+
         @application.middleware("http")
         async def rate_limit_middleware(request, call_next):
             client_ip = request.client.host if request.client else "unknown"
@@ -163,6 +184,10 @@ def create_app() -> FastAPI:
     from superlocalmemory.server.routes.v3_api import router as v3_router
     application.include_router(v3_router)
 
+    # Config endpoints (storage, daemon, mesh, trust, forgetting)
+    from superlocalmemory.server.routes.config_api import router as config_api_router
+    application.include_router(config_api_router)
+
     # v3.4.1: Chat SSE + Insights + Timeline endpoints
     for _module_name_v341 in ("chat",):
         try: