superlocalmemory 3.7.8 → 3.8.0

package/src/superlocalmemory/server/security_middleware.py

@@ -36,13 +36,20 @@ class SecurityHeadersMiddleware(BaseHTTPMiddleware):
         # Content Security Policy (v3.4.22 — vendored assets, no CDN hosts).
         # All Bootstrap/D3/Sigma/graphology/Inter assets ship locally under
         # /static/vendor/, so we drop every CDN host from the allow-list.
-        # 'unsafe-inline' stays on script-src/style-src for the legacy inline
-        # click handlers in index.html — migrating those to addEventListener
-        # is tracked as a separate backlog item. img-src drops the https:
-        # wildcard now that nothing remote loads.
+        #
+        # v3.7.9 (B2): 'unsafe-inline' removed from script-src. Every inline
+        # on*= event handler was migrated to data-act-* attributes dispatched
+        # by js/event-delegation.js (nonces cannot authorise inline event-
+        # handler attributes, so delegation is the only real fix). A stored-XSS
+        # payload can no longer execute inline script here.
+        # 'unsafe-inline' is retained on style-src only: 82 inline style=
+        # attributes remain, style injection is far lower risk than script
+        # injection, and inline style attributes cannot be nonce'd either
+        # (GitHub/GitLab keep the same script-locked / style-inline posture).
+        # img-src drops the https: wildcard now that nothing remote loads.
         csp_directives = [
             "default-src 'self'",
-            "script-src 'self' 'unsafe-inline'",
+            "script-src 'self'",
             "style-src 'self' 'unsafe-inline'",
             "font-src 'self'",
             "img-src 'self' data:",

package/src/superlocalmemory/server/ui.py

@@ -61,11 +61,12 @@ from superlocalmemory.server.security_middleware import SecurityHeadersMiddlewar
 # caused dashboard-created profiles to land in a different memory.db than
 # `slm profile list` reads when a custom data dir was configured.
 from superlocalmemory.server.routes.helpers import MEMORY_DIR, DB_PATH
-# V3.3.21: UI shipped inside the package for pip/npm installs.
-# Check package location first, then fall back to repo root for dev mode.
-_PKG_UI = Path(__file__).resolve().parent.parent / "ui"
-_REPO_UI = Path(__file__).resolve().parent.parent.parent.parent / "ui"
-UI_DIR = _PKG_UI if (_PKG_UI / "index.html").exists() else _REPO_UI
+# V3.3.21+: the dashboard ships inside the package (superlocalmemory/ui) for
+# every install path — pip, npm, and editable checkouts. The legacy repo-root
+# ui/ dev fallback was retired in v3.8.0 when that copy was deleted; the
+# packaged directory is authoritative. A missing dir is surfaced at request
+# time (see the "UI not found" handler below).
+UI_DIR = Path(__file__).resolve().parent.parent / "ui"
 
 
 def create_app() -> FastAPI:
@@ -104,6 +105,16 @@ def create_app() -> FastAPI:
         _write_limiter = RateLimiter(max_requests=_rl_write, window_seconds=_rl_window)
         _read_limiter = RateLimiter(max_requests=_rl_read, window_seconds=_rl_window)
 
+        # Task #47: register for runtime reconfiguration via the dashboard.
+        try:
+            from superlocalmemory.infra.rate_limiter import (
+                register_managed as _reg_rl,
+            )
+            _reg_rl("write", _write_limiter)
+            _reg_rl("read", _read_limiter)
+        except Exception:
+            pass
+
         @application.middleware("http")
         async def rate_limit_middleware(request, call_next):
             client_ip = request.client.host if request.client else "unknown"
@@ -173,6 +184,10 @@ def create_app() -> FastAPI:
     from superlocalmemory.server.routes.v3_api import router as v3_router
     application.include_router(v3_router)
 
+    # Config endpoints (storage, daemon, mesh, trust, forgetting)
+    from superlocalmemory.server.routes.config_api import router as config_api_router
+    application.include_router(config_api_router)
+
     # v3.4.1: Chat SSE + Insights + Timeline endpoints
     for _module_name_v341 in ("chat",):
         try: