superlocalmemory 3.7.8 → 3.8.1

package/src/superlocalmemory/ui/js/brain.js

@@ -21,7 +21,8 @@
 (() => {
   'use strict';
 
-  const TOKEN_STORAGE_KEY = 'slm_install_token';
+  // B2 (3.7.9): token kept in a private closure var, never sessionStorage.
+  let _tokenCache = null;
 
   // --------------------------------------------------------------------
   // Safe DOM helper — the ONLY way this file creates nodes.
@@ -69,25 +70,9 @@
   // --------------------------------------------------------------------
   // Token handling — auto-fetch from local daemon, never prompt user.
   // --------------------------------------------------------------------
-  function readToken() {
-    try {
-      return window.sessionStorage
-        ? window.sessionStorage.getItem(TOKEN_STORAGE_KEY)
-        : null;
-    } catch (e) {
-      return null;
-    }
-  }
+  function readToken() { return _tokenCache; }
 
-  function writeToken(value) {
-    try {
-      if (window.sessionStorage) {
-        window.sessionStorage.setItem(TOKEN_STORAGE_KEY, value);
-      }
-    } catch (e) {
-      // storage disabled — keep in-memory.
-    }
-  }
+  function writeToken(value) { _tokenCache = value; }
 
   async function fetchTokenFromServer() {
     try {
@@ -426,7 +411,7 @@
   function cardBandit(b) {
     const data = b || {};
     const wrap = EL('section', {className: 'brain-section'});
-    wrap.appendChild(EL('h4', {text: 'Adaptive ranking (bandit)'}));
+    wrap.appendChild(EL('h4', {text: 'Adaptive ranking'}));
 
     const top = data.top_arm_global;
     const topText = top

package/src/superlocalmemory/ui/js/core.js

@@ -16,27 +16,30 @@
 window.SLM_FETCH_TIMEOUT_MS = 15000;
 window.SLM_INSTALL_TOKEN_KEY = 'slm_install_token';
 
-window.slmInstallToken = async function (forceRefresh) {
-    if (!forceRefresh) {
-        var cached = sessionStorage.getItem(window.SLM_INSTALL_TOKEN_KEY);
-        if (cached) return cached;
-    }
-    var response = await window.__slmOriginalFetch(
-        '/internal/token',
-        {credentials: 'same-origin'}
-    );
-    if (!response.ok) return '';
-    var payload = await response.json();
-    var token = payload && payload.token ? payload.token : '';
-    if (token) sessionStorage.setItem(window.SLM_INSTALL_TOKEN_KEY, token);
-    return token;
-};
-
-// Global fetch patch: apply the abort timeout to every relative-URL request
+// B2 (3.7.9): the install token is kept in a private closure, never in
+// sessionStorage — a stored token is trivially readable by any injected
+// script (sessionStorage.getItem), which was the theft leg of the XSS chain.
+window.slmInstallToken = (function () {
+    var _cache = null;  // in-memory only; not on window, not in storage
+    return async function (forceRefresh) {
+        if (!forceRefresh && _cache) return _cache;
+        var response = await window.__slmOriginalFetch(
+            '/internal/token',
+            {credentials: 'same-origin'}
+        );
+        if (!response.ok) return '';
+        var payload = await response.json();
+        var token = payload && payload.token ? payload.token : '';
+        if (token) _cache = token;
+        return token;
+    };
+})();
+
+// Global fetch patch: apply the abort timeout to every same-origin request
 // automatically. 17 UI modules call bare fetch() — patching here avoids
 // touching each one and guarantees no future callsite can regress to an
-// un-timed fetch that holds the spinner forever. Absolute URLs (external
-// resources) are passed through unchanged. Callers that already supply
+// un-timed fetch that holds the spinner forever. External URLs are passed
+// through unchanged. Callers that already supply
 // `signal` keep their own behavior. `init.timeoutMs` lets callers override
 // the default per-request.
 (function patchFetch() {
@@ -46,25 +49,68 @@ window.slmInstallToken = async function (forceRefresh) {
     window.__slmOriginalFetch = _origFetch;
     window.fetch = function (input, init) {
         init = Object.assign({}, init || {});
-        var urlStr = typeof input === 'string' ? input : (input && input.url) || '';
-        var isRelative = !(/^https?:\/\//i.test(urlStr));
+        var urlStr = typeof input === 'string'
+            ? input
+            : (input && (input.url || input.href)) || '';
+        // Resolve every URL before deciding whether it is local. In particular,
+        // protocol-relative URLs such as //host/path inherit the current scheme
+        // but are not same-origin and must never receive the install token.
+        var isSameOrigin = false;
+        var requestUrl = null;
+        try {
+            requestUrl = new URL(urlStr, window.location.href);
+            isSameOrigin = requestUrl.origin === window.location.origin;
+        } catch (e) {
+            // A malformed URL is handled by native fetch. Treat it as external
+            // here so it cannot obtain local credentials while failing.
+        }
         var method = String(
             init.method || (input && input.method) || 'GET'
         ).toUpperCase();
         var mutating = ['POST', 'PUT', 'PATCH', 'DELETE'].indexOf(method) !== -1;
+        var invalidatesCache = init.slmInvalidatesCache !== false;
+        var requiresWriteAuth = init.slmRequiresWriteAuth !== false;
+        delete init.slmInvalidatesCache;
+        delete init.slmRequiresWriteAuth;
+
+        function invalidateAfterMutation(request) {
+            if (!isSameOrigin || !mutating || !invalidatesCache) return request;
+            return request.then(function (response) {
+                if (
+                    response && response.ok &&
+                    typeof window.slmInvalidatePanes === 'function'
+                ) {
+                    window.slmInvalidatePanes();
+                }
+                if (
+                    response && response.ok &&
+                    typeof window.slmInvalidateDashboardCache === 'function'
+                ) {
+                    window.slmInvalidateDashboardCache();
+                }
+                return response;
+            });
+        }
 
         function send() {
-            if (!isRelative || init.signal) {
-                return _origFetch(input, init);
+            if (!isSameOrigin || init.signal) {
+                return invalidateAfterMutation(_origFetch(input, init));
             }
             var controller = new AbortController();
             var timeoutMs = init.timeoutMs || window.SLM_FETCH_TIMEOUT_MS;
             var timer = setTimeout(function () { controller.abort(); }, timeoutMs);
             init.signal = controller.signal;
-            return _origFetch(input, init).finally(function () { clearTimeout(timer); });
+            return invalidateAfterMutation(
+                _origFetch(input, init).finally(function () { clearTimeout(timer); })
+            );
         }
 
-        if (isRelative && mutating && urlStr !== '/internal/token') {
+        if (
+            isSameOrigin &&
+            mutating &&
+            requiresWriteAuth &&
+            (!requestUrl || requestUrl.pathname !== '/internal/token')
+        ) {
             return window.slmInstallToken(false).then(function (token) {
                 if (!token) throw new Error('local write credential unavailable');
                 var headers = new Headers(
@@ -460,22 +506,30 @@ function populateFilters(categories, projects) {
     // Clear existing options beyond the first placeholder to prevent duplicates on refresh
     if (categorySelect) while (categorySelect.options.length > 1) categorySelect.remove(1);
     if (projectSelect) while (projectSelect.options.length > 1) projectSelect.remove(1);
-    categories.forEach(function(cat) {
-        if (cat.category) {
-            var option = document.createElement('option');
-            option.value = cat.category;
-            option.textContent = cat.category + ' (' + cat.count + ')';
-            categorySelect.appendChild(option);
-        }
-    });
-    projects.forEach(function(proj) {
-        if (proj.project_name) {
-            var option = document.createElement('option');
-            option.value = proj.project_name;
-            option.textContent = proj.project_name + ' (' + proj.count + ')';
-            projectSelect.appendChild(option);
-        }
-    });
+    // Guard appendChild: in the OD dashboard #filter-category / #filter-project
+    // live in a folded pane and are frequently absent. Without these guards a
+    // null.appendChild threw, tripping the loadStats() catch and zeroing every
+    // dashboard counter after a profile create/switch.
+    if (categorySelect) {
+        categories.forEach(function(cat) {
+            if (cat.category) {
+                var option = document.createElement('option');
+                option.value = cat.category;
+                option.textContent = cat.category + ' (' + cat.count + ')';
+                categorySelect.appendChild(option);
+            }
+        });
+    }
+    if (projectSelect) {
+        projects.forEach(function(proj) {
+            if (proj.project_name) {
+                var option = document.createElement('option');
+                option.value = proj.project_name;
+                option.textContent = proj.project_name + ' (' + proj.count + ')';
+                projectSelect.appendChild(option);
+            }
+        });
+    }
 }
 
 // ============================================================================
@@ -491,6 +545,11 @@ window.addEventListener('DOMContentLoaded', function() {
     loadProfiles();
     loadStats();
     loadGraph();
+    // DASH-V1/V2/V3 fix: populate the landing-page cards (Operating Mode,
+    // LLM Provider, Memories facts, Version) on first paint. loadDashboard()
+    // was only bound to visibilitychange/focus/hashchange, none of which fire
+    // on a fresh load, so those cards were stuck on their static "Loading…".
+    if (typeof loadDashboard === 'function') loadDashboard();
 
     // v2.5 — Event Bus + Agent Registry (graceful if functions don't exist)
     if (typeof initEventStream === 'function') initEventStream();